Description

A cron job runs a script that computes a filename using echo and md5sum based on the username. We must replicate the computation to find the temp file where the password is stored.

Overview

• The script does echo I am user bandit23 | md5sum | cut -d ' ' -f 1 to compute the temp filename.
• Running the same command for bandit23 gives the exact path where the password was written.

Solution

Step 1: Read the Cron Script

cat /usr/bin/cronjob_bandit23.sh

• Reveals the filename formula: $(echo I am user $myname | md5sum | cut -d ' ' -f 1).

Step 2: Compute the Filename for bandit23

command = ["echo", "I am user bandit23", "|", "md5sum", "|", "cut", "-d", "' '", "-f", "1"]
channel = connect.system(" ".join(command))
filename = channel.recv().decode().strip()

Step 3: Read the Temp File

cat /tmp/<md5hash>

Password

QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G