Escalation via cron paths

The first privilege escalation technique we will be exploring is the process of exploiting poorly configured cron paths. However, before we can begin this process, let's take a quick look at the various ways of accessing the crontab file on the target system.

The reason we need to do this is because we will come across systems that have been configured differently and can access the crontab file, so enumerating cron jobs running on a system is vitally important in the privilege escalation process.

As demonstrated in the previous section, you can access the crontab file on the target system by running the following command:

crontab

This command may not yield any results if access to the utility has been limited by the administrator. However, you can use the following commands to enumerate information regarding the active cron jobs on the system:

crontab -l
ls -alh /var/spool/cron;
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron...