> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/path-of-least-resistance.md).

# %PATH% of Least Resistance

Environment variables matter because they expose how Windows resolves files and user resources. For example `PATH` can reveal writeable directories, while `HOME` related variables can reveal network shares and other useful locations. 

{% code title="Prints all environment variables" %}

```batch
set
```

{% endcode %}

**`PATH`**

If the folder placed in the `PATH` is writeable by your user, it may be possible to perform DLL Injections against other applications. Remember, when running a program, Windows looks for that program in the `CWD` first, then from the `PATH` going left to right. This means if the custom path is placed on the left (before `C:\Windows\System32`), it is much more dangerous than on the right.

**`HOME DRIVE`**

In enterprises, this will often be a file share. This file share may reveal interesting directories. Additionally shares are utilized for home directories so the user can log on to other computers and have the same experience/files/desktop/etc, known as [Roaming Profiles](https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview).