linux privilege escalation - Part three

4) CronJobs
    4.1) CronJobs - File Permissions
    4.2) CronJobs - Path Environment Variables
    4.3) CronJobs - Wildcards

CronJob - File permissions

The involves looking for instances in which a cronjob touches a writable root file we can overwrite. Taking a look at /etc/cronjob/ we can see which files have a cron schedule.

Notice how overwrite.sh has root permissions. We can then inject malicious code into overwrite.sh  which will get executed with root permissions. Check you can overwrite it:

Overwrite the file with malicious code (reverse shell) of yours. Mine is shown below:

Set up a listener and wait for the cronjob to run the file which we've just placed malicious code into. Root access achieved below

Cronjob - path environment variables

Here we are going to hijack the PATH variable of the overwrite.sh. Look at the image below and notice how the overwrite.sh file does not have an exact path. This means we could hijack it:

Create a file called overwrite.sh in the home directory. Place malicious code into our overwrite.sh. Mine is a simple reverse shell from earlier

Create the listener with Netcat and wait for root shell.

CRONJOBS - WIldcards

We can also abuse wildcards to try and get root. Lets look at the file /usr/local/bin/compress.sh which also has root privileges

Notice how it uses a tar command with a wildcard? this is something we can exploit. If we can create a file with the same names as arguments which are passed to the tar command we can get it to execute malicious code.
Create two files using the following command:

Have a listener set up to receive the connection. Once the cronjob runs, it will run compress.sh which will run the tar command, which executes our malicious shell.sh with root privileges.