T06 · System Persistence
Error
- Location
SKILL.md:60- Finding
Recurring Privileged Cron Execution Creates a Persistence and Privilege-Escalation Risk
- Content
View full analysis
> /var/log/dht.log 2>&1 ``` ### Technical Analysis The documentation recommends configuring a cron entry that executes the sensor script every 30 minutes through `sudo`. This creates cross-session scheduled execution and exceeds the minimum privileges required for an on-demand temperature and humidity reading. The command executes a script located below a user's home directory. If the script or a parent directory is writable by a less-privileged user, replacing the script can turn the scheduled command into a privileged execution mechanism. Successful unattended execution depends on the host's `sudoers` configuration; if passwordless execution is not permitted, the task may fail instead. If passwordless execution is permitted, compromise of the referenced script can result in root-level command execution. The command also references `scripts/dht/main.py`, while the package contains `scripts/main.py`. This mismatch may lead users to create wrappers or copies at an unintended, insufficiently protected location. ### Attack Path 1. A user follows the documentation and installs the recurring cron entry. 2. The system permits unattended `sudo` execution for Python or the referenced command. 3. An attacker compromises the account, another process running as that account, or any writable component of the referenced path. 4. The attacker replaces `~/scripts/dht/main.py` with malicious Python code. 5. Cron reaches the next 30-minute interval and invokes the modified script through `sudo`. 6. The attacker's code executes with the privileges granted by the applicable `sudoers` rule, potentially including root. ### Impact Assessment If unattended `sudo` is available, exploitation may provide persisten ...[truncated 489 chars]- Remediation
View remediation