← Back to search

Check for PATH Hijacking

privesclinuxchecklist

Summary

If a privileged binary calls another program by relative name, hijack it via a writable PATH entry.

Walkthrough

Analyze a binary to see if it invokes commands without absolute paths, enabling PATH hijacking.

Commands

bash

strings <BINARY>
ltrace <BINARY>