Cron PATH Hijack
When a root scheduled task trusts PATH, the writable directory before system paths becomes the attack surface.
Read the scheduled job, inspect the script it launches, find the relative command name, and plant an executable with that name in the writable PATH entry.
Variants add decoy writable directories and different maintenance scripts so you have to confirm the active job path before exploiting it.
What you'll practice
cronPATH hijacklinux privilege escalation
medium
Cron PATH Hijack
When a root scheduled task trusts PATH, the writable directory before system paths becomes the attack surface.
Objective
Recover the flag at /root/flag.txt and submit it.
Drill this now
Spin up a live isolated target and start practicing in seconds — free.