Linux Cron Service Abuse
This skill teaches penetration testers to identify and exploit scheduled tasks, system services, and inter-process communication mechanisms for privilege escalation. It covers writable cron scripts, PATH manipulation, wildcard injection attacks, systemd unit modification, and D-Bus service exploitation—all under explicit authorization.
Linux Cron Service Abuse helps you escalate privileges through cron jobs, systemd services, and D-Bus exploitation on authorized Linux systems.
AI-generated summary based on this skill's SKILL.md
Install
blacklanternsecurity/red-run/linux-cron-service-abuse · repository language: Python
git clone https://github.com/blacklanternsecurity/red-run
cp -r red-run ~/.claude/skills/linux-cron-service-abusegenerated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
npx skillfed install blacklanternsecurity/red-run/linux-cron-service-abuseFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is Linux cron service abuse and how does it enable privilege escalation?
Linux Cron Service Abuse teaches how attackers exploit scheduled tasks to gain elevated privileges. Cron jobs running as root or other privileged users can be hijacked through writable scripts, PATH manipulation, or wildcard injection. When a lower-privileged user modifies a cron script or injects malicious commands into its execution path, the job runs those commands with the owner's privileges—enabling privilege escalation from a regular user to root or other system accounts.
How can cron job exploitation be used for persistence on a Linux system?
Linux Cron Service Abuse covers persistence techniques where attackers create or modify cron entries to execute malicious payloads at regular intervals. By adding backdoor commands to root-owned crontabs or writable cron scripts, an attacker ensures their code runs automatically even after reboot. This persistence survives system restarts and allows long-term access without requiring manual re-exploitation, making cron a favored mechanism for maintaining compromised systems.
What are the main exploitation techniques for cron-based attacks?
Linux Cron Service Abuse teaches multiple attack vectors: modifying writable cron scripts directly, manipulating the PATH variable to execute attacker-controlled binaries instead of legitimate ones, exploiting wildcard characters in cron commands (e.g., `tar *`), and hijacking cron job dependencies. These techniques work because cron runs jobs in predictable environments with inherited permissions, allowing attackers to intercept execution or inject malicious logic into the job's runtime context.
How can unauthorized cron modifications and cron-based attacks be detected?
Linux Cron Service Abuse includes detection methods: audit crontab files and `/etc/cron.d/` directories for unexpected entries or timestamps, monitor file integrity of cron scripts using tools like AIDE or Tripwire, check process execution logs for suspicious cron-spawned commands, and review system logs for failed cron runs or permission errors. Regular baseline comparisons and alerting on new cron job creation help identify unauthorized modifications before they cause damage.
What defensive measures secure cron jobs against abuse and malicious configuration?
Linux Cron Service Abuse recommends securing cron by restricting write permissions on cron scripts and directories (use `chmod 755` for scripts, `chmod 700` for cron directories), avoiding wildcards in cron commands, hardening PATH variables in cron environments, and using absolute paths for all executables. Additionally, limit crontab access via `/etc/cron.allow` and `/etc/cron.deny`, audit cron logs regularly, and apply principle of least privilege—run cron jobs with the minimum required permissions rather than as root.
What is cron job hijacking and how does PATH manipulation enable it?
Linux Cron Service Abuse explains cron job hijacking as intercepting a scheduled task's execution to run attacker-controlled code instead. PATH manipulation is a primary technique: if a cron job calls a binary by name (e.g., `backup.sh` instead of `/usr/local/bin/backup.sh`), an attacker can place a malicious script with the same name in a directory earlier in the PATH. When cron executes the job, it finds and runs the attacker's version first, gaining the cron job's privileges—often root or system-level access.