1

As normal user, if you open the Edit Environment Variable setting in Windows, you will get this:

environment variables

As you can see, the %path% variable that available for an user is a combination of %path% set globally as System variables and %path% set locally for each user User variables for username.

Consider the following situation:

If the user adds a path to his User variables %path%, for example he adds C:\mybin to his User variables %path% to run his program myapp.exe in C:\mybin\myapp.exe. But if he accidentally runs an unwanted program (as normal user) that change his user %path% (this can be done without administrator rights) to a different directory, for example %temp%\fake which contain the fake app but same name myapp.exe and delete the path C:\mybin from his variable, then he open Command Prompt as Administrator to run his myapp.exe, he will get the fake app myapp.exe run as administrator.

So my question is: is this called a vulnerability and will it be practical for viruses to do this?

I also find that some installers (which are run as administrator), extract their contents to %temp% and run some of these, so is they vulnerable too?

Thanks!

7
  • If a virus could do all that, then why not simply replace the existing binary with the malicious one?
    – schroeder
    Jun 3 at 8:16
  • But what if the existing binary is in a write-protected directory?
    – raspiduino
    Jun 3 at 8:19
  • I think if there is any virus do this, it will run the user's expected program. When it doesn't have admin rights, and when it has the admin rights it will go ahead and do its stubs
    – raspiduino
    Jun 3 at 11:04
  • 1
    Wouldn't a malware attacking the PATH variable be targeted for command line users, where the search path has some effect. A typical Windows user doesn't start programs from command line, but from icons on the start menu and the desktop. Jun 5 at 8:31
  • 1
    Take a look at, e.g., Windows Userland Persistence Fundamentals. Jun 5 at 13:41

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.