Unit 9: Scheduled tasks and persistence · Lesson 1 of 6 · 16 min
Reading cron
Five time fields, a user and a command: read every scheduled job on the machine.
mission
- You are
- You are listing every scheduled job on web01.
- Situation
- Jobs run without anyone watching. Attackers love them because they come back on their own.
- Goal
- Read the system crontab and every file in /etc/cron.d.
- Hand in
- Each job with its schedule, account and command.
A line in /etc/cron.d
17 * * * * root /opt/scripts/rotate.sh
- 1
17minute - 2
*hour - 3
*day - 4
*month - 5
*weekday - 6
rootaccount - 7
/opt/scripts/rotate.shcommand
List the job files
ls -la /etc/cron.d
total 28
drwxr-xr-x 1 root root 4096 Oct 22 11:36 .
drwxr-xr-x 1 root root 4096 Oct 22 11:44 ..
-rw-r--r-- 1 root root 102 Mar 31 2024 .placeholder
-rw-r--r-- 1 root root 53 Oct 13 22:44 .sync-check
-rw-r--r-- 1 root root 121 Oct 14 09:00 disk-report
-rw-r--r-- 1 root root 201 Apr 8 2024 e2scrub_all
-rw-r--r-- 1 root root 120 Oct 14 09:00 rotate-logs
you should see .placeholder and e2scrub_all come from packages. The hidden .sync-check matches the 22:44 sudo line.
Read every schedule at once
grep -h -v -E '^(#|$|SHELL|PATH)' /etc/cron.d/* /etc/cron.d/.sync-check
0 6 * * 1-5 root /opt/scripts/report.sh
30 3 * * 0 root test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron
10 3 * * * root test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r
17 * * * * root /opt/scripts/rotate.sh
@reboot dana /usr/local/lib/sync/sync-agent -lk 4444
you should see * does not match dotfiles, so .sync-check needs its own path. Attackers rely on that.
defender tip Also check /etc/crontab, the cron.hourly to cron.monthly folders and each user's crontab, which root lists with crontab -l -u name.
Check your own and the system crontab
crontab -l no crontab for learner ls /var/spool/cron/crontabs ls: cannot open directory '/var/spool/cron/crontabs': Permission denied
you should see User crontabs are private. Reviewing them is a root task for the audit plan.
What a defender takes away
- 1Five time fields, then the account in /etc/cron.d.
- 2@reboot runs at every boot.
- 3Hidden files in cron.d dodge wildcards.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.