After gaining initial low-privilege access to a Linux system, a penetration tester identifies an interesting binary in a user's home folder titled ''changepass." -sr-xr-x 1 root root 6443 Oct 18…

The strings output reveals the binary uses ENV_PATH with the format string '%s/changepw' to build the full path of the executable it will call, and the setuid string confirms the process runs as root. By copying or navigating to a writable directory, placing a malicious binary named 'changepw' there, and exporting ENV_PATH to that directory's path, the attacker causes the SUID root process to execute their payload with root privileges when changepass is run.

Naming a copy of the changepass binary itself as 'changepw' would cause the SUID binary to invoke itself recursively rather than execute an attacker-controlled payload, producing no privilege escalation.

Exporting ENV_PATH alone without ensuring the correct malicious 'changepw' binary is present in the target directory and properly executable does not complete the exploit chain needed to achieve privilege escalation.

Invoking changepass with sudo requires the low-privilege user to have sudo rights, which are not available given only initial low-privilege access has been established on the system.