> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/windows-privilege-escalation/eop-usdpath-interception.md).

# EoP - $PATH Interception

## PATH Hijacking: Exploitation and Mitigation Guide

### Key Concepts

* **Writable Directory**: A directory in the PATH variable that allows file creation/modification.
* **Order of Directories**: Windows executes the first matching executable found in the PATH.
* **Target Executable**: The malicious file is named identically to a legitimate binary.

***

### Example Exploitation Scenario

#### **Step 1: List the Contents of the PATH Environment Variable**

Identify directories in the PATH to locate potential writable folders.

**Command:**

```powershell
powershellCopy code$env:Path
```

**Example Output:**

```plaintext
plaintextCopy codeC:\Program Files\nodejs\;C:\WINDOWS\system32;
```

***

#### **Step 2: Check Permissions of the Target Folder**

Verify the permissions of a folder to ensure it allows writing.

**Command:**

```cmd
cmdCopy codeicacls.exe "C:\Program Files\nodejs\"
```

**Example Output:**

```plaintext
plaintextCopy codeBUILTIN\Users: (I)(M)
BUILTIN\Users: (I)(R)
```

**Legend:**

* **GR**: Read
* **GW**: Write
* **M**: Modify (includes writing)

***

#### **Step 3: Place the Malicious File in the Writable Directory**

Copy your malicious file (e.g., `evil-file.exe`) and rename it to match the target executable (`cmd.exe`).

**Command:**

```cmd
cmdCopy codecopy evil-file.exe "C:\Program Files\nodejs\cmd.exe"
```

***

### **How It Works**

1. **PATH Resolution**:\
   Windows searches directories in the PATH for the first matching `cmd.exe`.
2. **Execution of Malicious Code**:\
   Since `C:\Program Files\nodejs\` appears before `C:\WINDOWS\system32\`, the malicious `cmd.exe` is executed.

***

#### **Example of Execution**

When `cmd.exe` is called:

```cmd
cmdCopy codecmd.exe
```

**Sequence**:

1. Windows checks `PATH` and finds `C:\Program Files\nodejs\cmd.exe`.
2. The malicious `cmd.exe` runs with the same privileges as the calling process.

***

### **Security Implications**

1. **Privilege Escalation**\
   Malicious code runs with elevated privileges.
2. **Remote Code Execution (RCE)**\
   Arbitrary code execution within the user’s context.
3. **Data Exfiltration**\
   Unauthorized access and extraction of sensitive data.

***

### **Mitigation Strategies**

#### **1. Restrict Writable Directories**

Ensure writable directories are not included in the PATH:

**Commands:**

* **View writable PATH directories:**

  ```powershell
  powershellCopy code$env:Path.Split(';') | ForEach-Object { icacls $_ }
  ```
* **Remove risky directories:**

  ```powershell
  powershellCopy code[System.Environment]::SetEnvironmentVariable('Path', 'C:\WINDOWS\system32;', 'User')
  ```

***

#### **2. Validate Executables**

Use security tools to verify executables before execution.

* **Windows Defender Application Control (WDAC)** can block untrusted binaries.

***

#### **3. Use Application Control Policies**

Implement whitelisting with tools like:

* **AppLocker**
* **Microsoft Defender for Endpoint**

***

#### **4. Conduct Regular Audits**

Perform periodic audits of:

1. **PATH Environment Variable**:\
   Ensure no unauthorized or risky directories are included.
2. **File Permissions**:\
   Regularly inspect permissions on directories.

**Command:**

```powershell
powershellCopy codeicacls.exe "C:\path\to\directory"
```

***

### **Additional Resources**

* [**Microsoft Security Documentation**](https://learn.microsoft.com/en-us/windows/security/)
* **OWASP Top 10 Security Risks**

***

This guide offers a comprehensive understanding of PATH Hijacking, its exploitation, and strategies to mitigate its risks. Ensure all actions comply with legal and ethical guidelines.