Lesson 4.2: Auditing scheduled tasks
Attackers who get in want to stay in, even after a reboot or a password change: that's persistence. Scheduled tasks are one of the most common ways. Where cron jobs live on Linux (system crontab, /etc/cron.d, the cron.daily-style folders and per-user crontabs), what a malicious one looks like, and how to remove it without destroying the evidence. In the lab a web shell uploaded through the shop left a crontab for the web server's user. You find it, connect it to the access log, keep a copy for the investigation, remove it and stop that user from having crontabs at all.
17 min
You will learn to
- Explain persistence
- List every place cron jobs can live
- Recognise a malicious cron entry
- Preserve evidence before removing
- Restrict who may use cron
Key terms
- Persistence
- Techniques that keep an attacker's access across reboots, password changes and cleanups.
- cron and crontab
- cron runs commands on a schedule; a crontab is a table of minute, hour, day, month, weekday and command.
- Web shell
- A script uploaded to a web server that runs commands sent through web requests.
- Evidence preservation
- Copying artefacts with their metadata and a hash before changing or deleting them.
← Ports and sockets: which program gets the data · All lessons · SQL injection →