L-CRON-WRAPPersistence

Cron-Based Persistence

Drop a per-user or root cron entry that re-implants the shell on a schedule.

§ Where this technique fits

L-CRON-WRAP is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 5 on average.

§ Dossiers chaining this technique

sudo NOPASSWD on a shell-spawner → root
User has sudo NOPASSWD on a binary that can shell out (vi, less, awk, perl, python). Use the binary's escape sequence to drop into a root shell.
step 5 / 5

§ Where this technique fits

§ Dossiers chaining this technique

sudo NOPASSWD on a shell-spawner → root