> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/linux-privilege-escalation/path-variables.md).

# Path Variables

<figure><img src="/files/Ip9KereDEo8o4rjJI2rm" alt=""><figcaption></figcaption></figure>

```
tar -cvf /root/.backup/pandora-backup.tar.gz /var/www/pandora/pandora_console/*
```

This line can be leveraged due to the command not using the full path for the tar binary

Drop a malicious file with the same name in your pwd and change the PATH variable;

```
 export PATH=$(pwd):$PATH
```