Question

During a Linux post-exploitation phase, you have a low-privileged shell as user 'webapp'. Enumeration reveals a root-owned cron entry running '/opt/scripts/backup.sh' every five minutes. The script file has permissions '-rwxrwxrwx' and is owned by root. Which action most directly leads to privilege escalation?

Accepted Answer

Append a reverse shell or command that copies bash and sets the SUID bit into backup.sh, then wait for the next cron execution

Answer

Replace /etc/crontab entirely to schedule your own root job every minute

Answer

Run the backup.sh script manually as the webapp user to trigger elevated execution

Answer

Add the webapp user to the /etc/cron.allow file to gain scheduling privileges