Scheduled jobs, services, and writable execution inputs

Mechanism

Periodic jobs and services run with a configured identity and environment. A writable script, unit file, configuration, executable path, or consumed data file can cross into that authority. The relevant primitive is control of an execution input used by a more privileged process, not simply finding a job that runs as root.

Practical method

Inspect job definitions and service units visible in the challenge. Resolve scripts and helper paths, checking directory ownership as well as file modes. Determine triggering conditions and timing. Use a harmless marker in the lab to verify which changed input the service actually consumes.

systemctl cat challenge.service
systemctl show challenge.service -p User -p ExecStart -p WorkingDirectory

Interpreting evidence

Correlate the marker with service logs and effective identity. A writable file is irrelevant if the active unit references another path or the service never reloads it.

Pitfalls and limits

Unit drop-ins and generated units can override the visible file. Cron environments differ from interactive shells. Restart and reload have different semantics, and modifications may require a later trigger.