Cron Jobs and Scheduled Tasks Enumeration on Linux

Scheduled tasks running as root are one of the most reliable privilege escalation sources on Linux. This page covers locating and reading all scheduled tasks — cron jobs, systemd timers, and at jobs. Exploiting what you find here is covered separately in Cron Job Privilege Escalation and Systemd Unit and Timer Privilege Escalation.

System-Wide Crontab

The user column shows who the command runs as. Any entry running as root with a writable script or binary path is a privilege escalation lead.

Cron Drop-In Directories

Read each file in these directories:

/etc/cron.d/ files follow the same format as /etc/crontab with an explicit user field. The run-parts directories contain scripts that execute as root on a schedule — check permissions on both the directory and each script inside.

Per-User Crontabs

crontab -l shows the current user's crontab. Reading root's crontab directly requires root — but it is worth trying in case of misconfiguration.

On Debian-based systems, user crontabs are stored here. If the directory or files are readable, you can see scheduled tasks for all users including root.

Anacron

Anacron handles jobs on systems that are not always on — it runs missed jobs on next boot. The format includes delay and job ID fields alongside the command. Jobs here run as root unless specified otherwise.

Checking Script Permissions

Once you have identified what scripts cron is calling, check whether you can write to them:

A script writable by your current user that runs as root is an immediate escalation path. Also check the directory — a writable directory allows replacing the script entirely even if the file itself is not writable.

Check all scripts referenced in cron entries at once:

Wildcard Usage in Cron Commands

Look for cron commands using wildcards with tools like tar, rsync, chown, or find:

Wildcards in these commands can be abused through filename injection. This is a separate technique — if you find it, the exploitation is covered in the Wildcard Injection privilege escalation page.

Systemd Timers

The ACTIVATES column shows the service triggered by each timer. Check the deploy.timer service unit and its ExecStart binary for writable paths.

at Jobs

atq lists pending one-time jobs scheduled with at. These are less common than cron but worth checking. Reading the job content requires the job to belong to your user or root access:

Monitoring for Cron Execution

To catch cron jobs that run infrequently and might not appear in static enumeration, monitor process creation:

Or transfer pspy to the target to monitor /proc without root:

Let it run for a few minutes around the top of the hour when most cron jobs execute. Short-lived root processes that appear on a schedule confirm the cron entry and show the full command being run.