Exam SY0-601 topic 1 question 389 discussion

Fu*k This question should not be in the Security+ exam ???

the penetration tester has discovered a cron job that runs every 10 minutes as the root user and executes the script /writable/update.sh. This suggests that the update.sh script has write permissions in a directory that is writable by the current user. Therefore, the next logical step for the penetration tester would be to review the contents of the /writable directory and the update.sh script to determine if there are any vulnerabilities that can be exploited to escalate privileges or otherwise compromise the system. The correct answer is: A. Privilege escalation.

Based on the information provided, the penetration tester has identified a cron job that runs the script /writable/update.sh as the root user every 10 minutes. The next logical step for the penetration tester would be to investigate the contents and permissions of the /writable/update.sh script to look for potential vulnerabilities or misconfigurations that could be exploited.

https://medium.com/swlh/privilege-escalation-via-cron-812a9da9cf1a#:~:text=By%20exploiting%20a%20misconfiguration%20in,choosing%20and%20gain%20root%20privileges.

it says ROOT

At every 10th minute (*/10 * * * *) run /writable/update.sh as root