> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/privilege-escalation/environment-variable-path-interception.md).

# Environment Variable $Path Interception

It's possible to abuse `$PATH` environment variable to elevate privileges if the variable:

* contains a folder that a malicious user can write to
* that folder precedes c:\windows\system32\\

Below is an example, showing how c:\temp precedes c:\windows\system32:

![](/files/-M-6g5S7OCf5zgbpgmAF)

Let's make sure c:\temp is (M)odifiable by low privileged users:

![](/files/-M-6gtfYvAlaGui6WqmM)

Let's now drop our malicious file (calc.exe in this case) into c:\temp and call it cmd.exe:

![](/files/-M-6g9EKrA-l-PulxAeQ)

Now, the next time a high privileged user invokes cmd.exe, our malicious cmd.exe will be invoked from the c:\temp:

![](/files/-M-6gLUaw1TB79moRZ3w)

This can be very easily abused in environments where software deployment packages call powershell, cmd, cscript and other similar system binaries with `NT SYSTEM` privileges to carry out their tasks.