Scheduled tasks

password_attacks linprivesc linuxprivesc commonlinuxprivesc startup bashed celestial bash_cron

Scheduled tasks on Linux are called cron jobs. You may try to inject some code for instance, using environment variables.

# tasks of the current user
$ crontab -l
# list every system-wide cron task
$ ls -la /etc/cron*

⚠️ System-wide cron tasks and user tasks are not stored in the same place. Only root can browse/list other users' cron tasks.

# tasks of the user 'root'
$ sudo ls /var/spool/cron/crontabs/root
$ sudo crontab -l -u root # same

But, there is another way to find users' cron tasks. You can monitor Linux processes, for instance, using pspy (3.2k ⭐) which can monitor Linux processes without root permissions.

$ # use wget/... to fetch the static binary
$ chmod +x /tmp/pspy
$ /tmp/pspy

⏰ In CTFs, they usually run every minute or every 5 minutes.

⚠️ If you create a script that is executed by a cron task, ensure the user reading the file has access to it (if they are not root).