Overview
The EnvironmentPath command enumerates all directories in the system %PATH% environment variable along with their security descriptors (SDDL). This helps identify writable directories in the PATH that could be exploited for DLL hijacking or binary planting attacks.Syntax
This command does not support remote execution.
Output
Returns PATH directories with:- Full directory path
- SDDL (Security Descriptor Definition Language)
- Write permissions for current user
- Directory existence status
Use Cases
- Red Team
- Blue Team
- Identify writable PATH directories for DLL hijacking
- Find locations for binary planting
- Discover persistence opportunities
- Locate paths for search order hijacking
Example Output
Remote Execution
Detection Considerations
Low detection risk - reads environment variables and file system ACLs.
Related Commands
- EnvironmentVariables - All environment variables
- InterestingProcesses - Security and admin tools
- Services - Windows services