Table of Contents
levels
Concepts to consider
Cron Jobs:
- Cron is a time-based job scheduler in Unix-like operating systems. Users can schedule jobs (commands or scripts) to run at specific times or intervals.
- Cron jobs are defined in crontab files, which specify the schedule and the command to run.
Cron Configuration Files:
- The directory
/etc/cron.d/contains system-wide cron jobs, each defined in separate files. - Each line in a cron job file defines a schedule and a command to run.
Crontab Syntax:
- The typical syntax for a cron job line is:where the five asterisks represent:
* * * * * user command- Minute (0-59)
- Hour (0-23)
- Day of the month (1-31)
- Month (1-12)
- Day of the week (0-7) (0 and 7 both represent Sunday)
- For example,
* * * * *means the command runs every minute.
Special Strings:
- Instead of the five fields, you can use special strings such as
@reboot, which runs the command once at startup.
Redirection:
&> /dev/nullredirects both stdout and stderr to/dev/null, effectively silencing any output or error messages.
bandit 21
Task
A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.
Solution
Look in /etc/cron.d/
bandit21@bandit:/etc/cron.d$ ls -l
total 36
-rw-r--r-- 1 root root 62 Oct 5 2023 cronjob_bandit15_root
-rw-r--r-- 1 root root 62 Oct 5 2023 cronjob_bandit17_root
-rw-r--r-- 1 root root 120 Oct 5 2023 cronjob_bandit22
-rw-r--r-- 1 root root 122 Oct 5 2023 cronjob_bandit23
-rw-r--r-- 1 root root 120 Oct 5 2023 cronjob_bandit24
-rw-r--r-- 1 root root 62 Oct 5 2023 cronjob_bandit25_root
-rw-r--r-- 1 root root 201 Jan 8 2022 e2scrub_all
-rwx------ 1 root root 52 Oct 5 2023 otw-tmp-dir
-rw-r--r-- 1 root root 396 Feb 2 2021 sysstat
we see whats inside cronjob_bandit22
bandit21@bandit:/etc/cron.d$ cat cronjob_bandit22
@reboot bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
* * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
/usr/bin/cronjob_bandit22.sh script is executed, then see whats is inside of this script
bandit21@bandit:/etc/cron.d$ cat /usr/bin/cronjob_bandit22.sh
#!/bin/bash
chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
The password of the bandit22 is in a temp file, then cat this file to see the password
bandit21@bandit:/etc/cron.d$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff