Unit 9: Scheduled tasks and persistence · Lesson 2 of 6 · 15 min
A job that hands out root
Find a script that root runs every hour and anyone can edit.
mission
- You are
- You are checking every script that cron runs as root.
- Situation
- If a script runs as root but someone else can write it, that someone controls root.
- Goal
- Check the owner and mode of every script in the root jobs.
- Hand in
- The dangerous script, its mode and the fix.
Root for anyone
- cron runs as rootEvery hour
- rotate.shWorld-writable
- Any user edits itTheir command runs as root at :17
List what root runs
grep -h -E '^[0-9]' /etc/cron.d/rotate-logs /etc/cron.d/disk-report
17 * * * * root /opt/scripts/rotate.sh
0 6 * * 1-5 root /opt/scripts/report.sh
Check who can change them
stat -c '%a %A %U %n' /opt/scripts/* 755 -rwxr-xr-x root /opt/scripts/report.sh 777 -rwxrwxrwx root /opt/scripts/rotate.sh cat /opt/scripts/rotate.sh #!/bin/bash find /var/log/nginx -name "*.log" -size +50M -exec gzip {} \;
you should see rotate.sh is 777. Any account could add a line and root would run it at the next :17.
defender tip Do not test this by editing the script. Proving that you could is enough for the report, and editing it would change evidence.
Find every caller of a script
grep -rn '/opt/scripts' /etc/cron.d /etc/systemd/system 2>/dev/null
/etc/cron.d/rotate-logs:4:17 * * * * root /opt/scripts/rotate.sh
/etc/cron.d/disk-report:4:0 6 * * 1-5 root /opt/scripts/report.sh
/etc/systemd/system/backup.service:7:ExecStart=/opt/scripts/report.sh
you should see rotate.sh hourly as root, report.sh from cron and from the backup service.
rotate.sh
-rwxrwxrwx root rotate.sh
777: anyone edits, root runs
-rwxr-xr-x root rotate.sh
755: only root edits
What a defender takes away
- 1Check the mode of every script cron runs as root.
- 2Writable by others plus run by root equals root for anyone.
- 3Report the path; do not exploit it.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.