Jobs that run as root on a timer

The machine works while you wait

cron is the scheduler: it runs commands at set times. System-wide jobs live in /etc/cron.d/, and each line says which user the command runs as. Look at what is scheduled here:

ls -l /etc/cron.d/
cat /etc/cron.d/backup

In the terminal

student@vulntech:~$ ls -l /etc/cron.d/
total 2
-rw-r--r-- 1 root root  72 Oct 19 06:12 backup
-rw-r--r-- 1 root root 199 Jun  6  2025 e2scrub_all
-rw-r--r-- 1 root root 111 Oct 19 06:12 maint
student@vulntech:~$ cat /etc/cron.d/backup
# admin backup job
* * * * * root /opt/backup/backup.sh >/dev/null 2>&1

That line runs /opt/backup/backup.sh as root, every minute (the five *s mean ‘every minute of every hour of every day’). A job that runs as root, over and over, is worth a very close look.

Can you change what it runs?

The job itself is safe only if the script it runs is safe from you. Check who can write it:

ls -l /opt/backup/backup.sh

In the terminal

student@vulntech:~$ ls -l /opt/backup/backup.sh
-rwxrwxrwx 1 root root 124 Oct 19 06:12 /opt/backup/backup.sh

The script is world-writable (rwxrwxrwx). Root runs it every minute, and you can change what it does. That is the whole vulnerability.