A root cron job anyone can edit
A cleanup script runs as root every five minutes, but its file is world-writable. Find the weak permission, see what was appended, and name the file it creates.
Briefing
An EDR rule fired on a SUID shell appearing in /tmp on db-02. The host has no interactive users other than admins.
Cron runs files in /etc/cron.d as the user in the sixth column. If any user can write the script that root runs, any user can become root. find -perm -o+w lists world-writable files.
db-02 · Privilege audit
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.