Quick answer

cron runs commands on a schedule. If a job runs as root and executes a script (or relies on a PATH) that a low-privilege user can modify, that user gets code execution as root every time the job fires. This makes writable cron scripts one of the most reliable escalation paths.

What is cron jobs?#

cron reads schedules from /etc/crontab, /etc/cron.d/, the /etc/cron.{hourly,daily,weekly,monthly} directories, and per-user crontabs. Each line specifies a schedule and a command, and system crontabs specify the user to run as.

Why LinPEAS checks cron jobs#

LinPEAS enumerates cron files and, with -a, monitors running processes for about a minute to catch frequently-executed jobs that aren't obvious from crontab files. It flags writable cron scripts and suspicious PATH usage — both classic privilege-escalation paths.

What a normal configuration looks like#

System maintenance jobs (log rotation, updates) run from root-owned scripts that only root can modify. Users may have their own crontabs affecting only their own account.

Why it can be security-sensitive#

A root cron job that runs a world-writable script, a script in a writable directory, or a bare command name relying on a writable PATH entry, all let you inject code that runs as root. Wildcards in cron commands (e.g. tar * in a writable directory) can also be abused.

From highlight to verdict

Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

System crontab and drop-ins
cat /etc/crontab; ls -la /etc/cron.d/ /etc/cron.daily/
Your crontab
crontab -l
Find writable cron scripts
find /etc/cron* -writable 2>/dev/null

Defensive remediation#

  • Ensure cron scripts are root-owned and not writable by others.
  • Use absolute paths in cron commands; set an explicit, safe PATH.
  • Avoid wildcards on user-controlled directories.
  • Review /etc/cron.d drop-ins added by packages or users.

Sources & references

  1. HackTricks: Linux privilege escalation
  2. GTFOBins — abuse techniques for standard binaries
  3. PEASS-ng repository — reviewed 20260908-dffb9496