Cron Job Exploitation Linux — How a Scheduled Task Running as Root Gets You a Shell
In this video we cover Linux Cron Job Privilege
Escalation from absolute zero — starting with what
a cron job actually is, all the way through two
completely different real-world exploitation methods
that give you a full root shell on a target machine.
This is one of the most common privilege escalation
techniques you will encounter in OSCP, TryHackMe,
HackTheBox, and real penetration testing engagements.
We start from the very beginning with a simple
analogy — a phone alarm — so you immediately
understand what scheduled tasks are and why Linux
uses them. From there we cover how cron jobs work,
how to read the cron syntax (the five stars), where
cron jobs are stored on a Linux system (/etc/crontab,
/etc/cron.d, user crontabs), how to enumerate all
scheduled tasks as a low privilege user, how to read
cron logs from /var/log/syslog, and exactly what
makes a cron job exploitable.
Then we go deep into two distinct attack paths that
work in real environments. Attack one is the Writable
Script Attack — finding a root-owned cron job that
calls a script you can write to, injecting a reverse
shell payload using echo and append, setting
up a netcat listener on Kali Linux, making the script
executable, and catching the root reverse shell. We
also cover the named pipe reverse shell in detail —
what mkfifo does, why the -e flag fails on modern
systems, and how to use the FIFO method instead.
Attack two is the Missing Script Attack — finding a
cron job that calls a script which no longer exists
on the filesystem, creating your own malicious script
with the exact same name in a PATH-writable directory,
and getting an instant root shell when the cron job
fires. This is the sneakier of the two attacks and
happens constantly in real world environments.
Chapters:
0:00 — What This Video Covers — Two Root Shell Methods Explained
0:41 — What Is a Cron Job? The Alarm Clock Analogy That Makes It Click
3:55 — Why Cron Jobs Matter to Hackers — Runs as Root, Not as You
5:54 — The Core Attack Logic — Find a Root Cron Job, Control Its Script = Root Shell
8:06 — Two Different Attack Paths We Will Cover Today
9:15 — How to Enumerate Cron Jobs — Every Command You Need
10:00 — Reading /etc/crontab — The Main Config File Explained Line by Line
13:30 — Decoding the Five Stars — Understanding Cron Syntax Properly
16:00 — /etc/cron.d — The Hidden Directory Most People Miss
19:45 — crontab -l — Listing Your Own Scheduled Tasks
21:00 — /var/spool/cron/crontabs — Where Personal Cron Jobs Live
22:58 — Reading Cron Logs from /var/log/syslog — The Most Powerful Enumeration Method
25:00 — Reading the Syslog Output — Spotting Root Cron Jobs in the Logs
27:00 — Lab Setup — TryHackMe Cron Job Room Starts
27:30 — Connecting to the Target via SSH as Low Privilege User
28:00 — Running All Enumeration Commands on the Real Machine
30:00 — Identifying Vulnerable Scripts — Which Cron Jobs Are Exploitable
38:00 — ATTACK 1: Writable Script Attack Begins
39:00 — Finding backup.sh — A Root Cron Job Calling a Script We Can Write To
40:00 — Confirming Write Permission — The Two Facts You Need
41:00 — Setting Up Netcat Listener on Kali Linux
43:00 — Injecting the Reverse Shell Payload Using Echo and Append
44:00 — The Named Pipe Reverse Shell Explained — mkfifo, FIFO, and Why -e Fails
46:00 — Appending vs Overwriting Explained
46:15 — Verifying the Payload Is Injected Without Breaking the Script
46:33 — Waiting for the Cron Job to Fire — Root Shell Incoming
47:45 — Troubleshooting — Wrong IP Address in the Payload
49:00 — Making the Script Executable — The Step That Gets Missed
57:45 — ROOT SHELL RECEIVED — Attack 1 Complete
58:22 — Recap of Attack 1: Writable Script — What We Did Step by Step
59:03 — Answering TryHackMe Questions — Counting Cron Jobs
59:38 — Finding Flag 5 Using Root Shell
1:01:00 — Bonus: Extracting /etc/shadow and Cracking Passwords with John the Ripper
1:04:00 — Cracking the Hash — Getting Matt's Password
1:06:29 — ATTACK 2: Missing Script Attack Begins
1:07:00 — The Scenario — Cron Job Calling a Script That No Longer Exists
1:08:00 — How PATH Variable Makes the Missing Script Attack Possible
1:09:00 — Finding a Writable Directory in the Cron PATH
1:10:00 — Creating the Malicious Script with the Exact Right Name
1:13:00 — Writing the Python Payload — Copying Bash with SUID Enabled
1:16:00 — Waiting for Cron to Execute Our Script as Root
1:17:35 — SUID Bash File Created — Running It for Root Shell
1:17:41 — Effective UID = 0 — Attack 2 Complete
1:18:50 — Full Video Summary — Both Attacks Explained in Plain Terms
#CronJobPrivEsc #LinuxPrivilegeEscalation #EthicalHacking