Day 21: PATH Hijacking & Cron Exploitation — The Automation Trap 🕵️‍♂️

🛠️ The "Invisible" Attack Vectors 1. PATH Hijacking: The Power of Order Linux finds programs by looking through directories in the $PATH variable. If a root script calls tar instead of /bin/tar , it will execute the first tar it finds. The Exploit: Place a malicious script named tar in a directory like /tmp , then add /tmp to the start of the PATH: export PATH=/tmp:$PATH . The Result: The root script runs your "fake" tar , giving you a root shell. 2. Cron Job Exploitation Cron is the Linux scheduler. If a script in /etc/crontab is world-writable ( -rwxrwxrwx ), you've already won. The Injection: echo "/bin/bash" >> /usr/local/bin/backup.sh The Payload: Wait 1 minute for the cron to run, and your command executes as root. 3. Wildcard Injection in Cron If a cron job uses a wildcard like tar -czf backup.tar.gz /home/user/* , you can create files that look like command arguments (e.g., --checkpoint=1 ) to trick the program into executing code. Follow my journey: #1HourADayJourney