Description

A cron job is running periodically as bandit22. Inspecting it reveals that it writes the bandit22 password to a predictable temp file.

Overview

• Cron jobs are scheduled tasks defined in /etc/cron.d/.
• Reading the cron file shows which script runs and what it does.
• The script copies bandit22’s password to a world-readable file in /tmp.

Solution

Step 1: Find the Cron Job

ls /etc/cron.d/
cat /etc/cron.d/cronjob_bandit22

• The cron entry runs a script as bandit22 every minute.

Step 2: Read the Script

cat /usr/bin/cronjob_bandit22.sh

• The script does: cat /etc/bandit_pass/bandit22 > /tmp/<hash>.

Step 3: Read the Temp File

cat /tmp/<hash>

Password

WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff