Hack The Box Cronos:

DNS zone transfer -> web app -> command injection -> reverse shell -> cronjob exploit -> root