Escalation via cron wildcards

This privilege escalation technique involves taking advantage of cron jobs that execute commands or scripts with wildcards. In the context of Linux, wildcards (*) are used to perform more than one action at a time, and they can be used in a variety of different ways. In this section, we will explore how they can be exploited to execute malicious commands or scripts if misconfigured.

Important Note

Note that the success of this technique will depend on whether or not wildcards have been utilized in cron jobs.

Follow these steps:

1. The first step in this process involves identifying cron jobs that run commands or scripts with wildcards. Analyzing the crontab file reveals an interesting cron job that is responsible for creating and compressing backup archives:

   Figure 12.14 – Backup cron job

   As highlighted in the preceding screenshot, the cron job runs the compress.sh script located under /usr/local/bin as the root user and runs every minute...