T06 · System Persistence
Error
- Location
maintainer.sh:70- Finding
Persistent Cron Job Installed Without Lifecycle Controls
- Content
View full analysis
/dev/null | grep -q "evomap-maintainer"; then log "⚠️ 自动任务已存在" else # 添加 cron 任务 (crontab -l 2>/dev/null; echo "*/15 * * * * $script_path heartbeat >> /tmp/evomap-cron.log 2>&1") | crontab - log "✅ 已设置每15分钟自动心跳" fi log "" log "配置完成！当前设置:" log " 节点ID: $NODE_ID" log " 日志文件: $LOG_FILE" log " 查看日志: tail -f $LOG_FILE" } ``` ### Technical Analysis The `setup` operation modifies the invoking user's crontab and registers the script to execute every 15 minutes. The task survives the current Skill execution, terminal session, and system restart where cron is enabled. Scheduled execution is related to the advertised automatic-heartbeat function and is explicitly documented. However, the implementation does not provide an expiration period, interactive confirmation, disable operation, uninstall operation, or reliable ownership marker. It therefore creates indefinite persistence with no corresponding lifecycle management. The cron job repeatedly invokes a script from its current installation path. If that file or an ancestor directory is subsequently writable by another account or process, modification of the script would convert the existing cron entry into a recurring code-execution mechanism under the crontab owner's privileges. ### Attack Path 1. The user invokes `bash maintainer.sh setup`. 2. The script resolves its absolute path. 3. It appends a cron entry to the user's existing crontab. 4. Cron invokes that path every 15 minutes across future sessions. 5. The task continues generating network requests and logs until the user manually i ...[truncated 733 chars]- Remediation
View remediation