A root job that runs a writable script

Who can edit what root runs?

Scheduled jobs in /etc/cron.d/ name the user they run as — often root. Look at the backup job and, crucially, the permissions on the script it runs:

cat /etc/cron.d/backup
ls -l /opt/backup/backup.sh

In the terminal (root runs backup.sh every minute — and it is writable by everyone (777))

student@vulntech:~$ cat /etc/cron.d/backup
* * * * * root /opt/backup/backup.sh >/dev/null 2>&1
student@vulntech:~$ ls -l /opt/backup/backup.sh
-rwxrwxrwx 1 root root 79 Oct 19 10:32 /opt/backup/backup.sh

Because the script is world-writable, any user can append a command to it and have root run it on the next tick. The job itself is fine; the permissions on the script are the problem.

Tip: A file executed by a privileged job must be writable only by root, and ideally live in a directory only root can write. Check both the file and the directory above it.