Home Linux Privilege Escalation Cron PATH Hijack
medium Live now Linux · Privilege Escalation

Cron PATH Hijack

When a root scheduled task trusts PATH, the writable directory before system paths becomes the attack surface.

Read the scheduled job, inspect the script it launches, find the relative command name, and plant an executable with that name in the writable PATH entry.

Variants add decoy writable directories and different maintenance scripts so you have to confirm the active job path before exploiting it.

What you'll practice

cronPATH hijacklinux privilege escalation
drill workspace · session live
medium

Cron PATH Hijack

When a root scheduled task trusts PATH, the writable directory before system paths becomes the attack surface.

Objective

Recover the flag at /root/flag.txt and submit it.

Drill this now

Spin up a live isolated target and start practicing in seconds — free.

Start drilling