Stapler_Cronjob

Cronjob

---

PSPY has identified that the root cronjob process is executing the /bin/sh -c /usr/local/sbin/cron-logrotate.sh command PEAS has also identified that the /usr/local/sbin/cron-logrotate.sh Bash script is WRITABLE by anyone

SHayslett@red:/dev/shm$ ll /usr/local/sbin/cron-logrotate.sh
-rwxrwxrwx 1 root root 51 Jun  3  2016 /usr/local/sbin/cron-logrotate.sh*
 
SHayslett@red:/dev/shm$ cat /usr/local/sbin/cron-logrotate.sh
#Simon, you really need to-do something about this

While the file itself is empty, it is writable by anyone Moving on to the Privileges Escalation phase