Environment Variable $Path Interception

It's possible to abuse $PATH environment variable to elevate privileges if the variable:

• contains a folder that a malicious user can write to

• that folder precedes c:\windows\system32\

Below is an example, showing how c:\temp precedes c:\windows\system32:

Let's make sure c:\temp is (M)odifiable by low privileged users:

Let's now drop our malicious file (calc.exe in this case) into c:\temp and call it cmd.exe:

Now, the next time a high privileged user invokes cmd.exe, our malicious cmd.exe will be invoked from the c:\temp:

This can be very easily abused in environments where software deployment packages call powershell, cmd, cscript and other similar system binaries with NT SYSTEM privileges to carry out their tasks.