Cron Jobs and PATH Abuse
Root runs a script you can write. That is the whole game.
What you will learn
- -Enumerate cron jobs and find ones that run as root
- -Exploit a writable script or a writable PATH directory a cron uses
- -Recognize wildcard injection in cron backup jobs
Admins automate cleanup and backups with cron, and they write those scripts fast and loose because "only runs them." That assumption is the bug. If a job runs as root every minute and you can change what it executes, root runs your code on a timer. You do not attack the cron , you attack the sloppy script behind it.
Find the jobs
Cron entries live in a few predictable places. Read all of them. The system crontab and the drop-in directories are where root's scheduled jobs sit.
$cat /etc/crontab$ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/$cat /etc/cron.d/*You are hunting for a job that runs as root and calls a script or binary you can modify. Check the permissions on every path a root cron touches.
Case one: the script is writable
If root runs /opt/backup.sh every five minutes and that file is world-writable,
you win. Append a and wait for the next run.
$ls -la /opt/backup.sh$echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' >> /opt/backup.sh$/tmp/rootbash -pCase two: PATH hijacking
Sometimes the script itself is not writable, but it calls a program by bare name,
like backup or tar, instead of a full path. Cron resolves that name through
its PATH. If PATH lists a you can write to before the real location,
your fake binary runs first.
Look at the top of /etc/crontab. If it sets PATH=/home/user/bin:/usr/bin and
you own /home/user/bin, plant a malicious tar there and the root cron calls
yours.
$printf '#!/bin/bash\ncp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > /home/user/bin/tar$chmod +x /home/user/bin/tarCase three: wildcard injection
A backup job like tar czf /backup.tar.gz * run from a directory you can write to
is exploitable. tar treats filenames that start with a hyphen as options, so you
create files named after tar's checkpoint flags and it executes your command.
$echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > shell.sh$touch -- '--checkpoint=1'$touch -- '--checkpoint-action=exec=sh shell.sh'Unprivileged users often cannot see root's crontab, but you can still watch
processes as they spawn. pspy needs no root and prints every command and cron
job the moment it fires, so you catch the job even when the file is hidden.
Planting payloads in cron paths modifies the target and runs code as root. Do it only on machines you own or are contracted to test, and clean up your artifacts (the rootbash copy, the fake binary) when you are done.
A root cron script calls `backup` with no full path, and PATH starts with a directory you can write to. What do you do?