Writable cron jobs: scheduled privilege escalation

cron runs commands at fixed times, often as root. If you can influence what runs, you get privileged execution.

The routes

Writable script: if a root cron runs a script you can modify, drop a reverse shell in it. Relative PATH: if the cron calls a command without an absolute path, plant a same-named binary in a writable PATH folder. Wildcard injection: tar/rsync with * over a folder where you create files whose names become options (--checkpoint-action=exec=sh).

cat /etc/crontab; ls -la /etc/cron.*   # look for writable scripts
echo 'cp /bin/bash /tmp/b; chmod +s /tmp/b' >> writable_script.sh

Defence

Correct permissions on cron scripts and folders (root-writable only). Absolute paths in jobs. Avoid wildcards over untrusted input. Monitor changes to crontab/cron.d. Tools like pspy to see what runs periodically.