https://hackita.it/tags/path-hijacking/Recent content in Path-Hijacking on Ethical Hacking | Pentest e Sicurezza Informatica | HackitaHugoitTue, 30 Jun 2026 00:00:00 +0000https://hackita.it/articoli/sesystemenvironmentprivilege/Tue, 30 Jun 2026 00:00:00 +0000https://hackita.it/articoli/sesystemenvironmentprivilege/<p>Hai SeSystemEnvironmentPrivilege. Vettore A: aggiungi una directory al PATH di sistema, i processi SYSTEM caricano il tuo binary senza saperlo. Vettore B (APT): scrivi nel NVRAM del firmware — persistenza che sopravvive a wipe del disco e reinstallazione del SO.</p> <hr> <h2 id="quick-exploit--vettore-a-path-hijacking" class="group/anchor-heading"> Quick Exploit — Vettore A (PATH Hijacking) <a href="#quick-exploit--vettore-a-path-hijacking" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">cmd</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-cmd" data-lang="cmd"><span class="line"><span class="cl">reg add <span class="s2">&#34;HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment&#34;</span> /v Path /t REG_EXPAND_SZ /d <span class="s2">&#34;C:\temp\mytools;</span><span class="nv">%PATH%</span><span class="s2">&#34;</span> /f</span></span></code></pre></div> </div> <p>Piazza il binary con il nome cercato da un processo SYSTEM:</p>