Default cronjobs

From Grayhat cheatsheets
Jump to navigationJump to search

One of the several linux privilege escalation techniques is to abuse cron jobs that run with root privileges (or a user with lesser privileges, to do lateral motion). These cron jobs can be found (not only) in the directories /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly, /etc/cron.monthly. These directories are not empty except for cron jobs defined by the root user, and when exploring them, it is common to find jobs with not very obvious names, but still unexploitable (maintenance jobs performed by the OS, etc, with different names in different linux distributions).

It is important to not waste time trying to understand what a cron job does, to end up realizing that it is something created by the very linux installation, and therefore unexploitable (most of the times, at least, and not in an obvious manner). Next is a compilation of such default cron jobs, to avoid wasting time researching if there may be something useful in them. If you see any of the following, you should probably skip their analysis.

There may be others absent in this table that are still created by some other linux distributions. It may also happen that a custom cron job created by the user has the same name that one of the listed below, but is actually exploitable.

/etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly
.placeholder 0anacron 0anacron 0anacron
apache2cd fstrim ./placeholder
apport man-db
apt .placeholder
apt-compat update-notifier-common
aptitude
bsdmainutils
cracklib-runtime
dpkg
lighttpd
logrotate
man-db
mlocate
ntp
passwd
.placeholder
polpularity-contest
standard
update-notifier-common
upstart


It may happen that the same cron job is called with different timings, so the same job is in two cron folders and one executes more often than the other.