tutorial · bandit

Bandit Level 21 → 22

Trace a scheduled task from cron configuration to its output artifact.

By

banditcronscheduled-tasks
Marks this level complete in your browser.

Goal

Inspect the cron job in /etc/cron.d and follow its command to the next password.

Why this matters

Scheduled-task investigation connects configuration, execution identity, scripts, and filesystem outputs.

Progressive hints

  1. Hint 1

    List /etc/cron.d for the job named for the next account.

  2. Hint 2

    Read the referenced script.

  3. Hint 3

    Follow the script's destination path.

Method

Run only the lines that match the evidence you observe.

ls -la /etc/cron.d
cat /etc/cron.d/cronjob_bandit22
cat <script-path-from-cron>
cat <output-path-from-script>

Expected non-secret observation

The cron entry names a script, and the script writes the credential to a readable temporary file.

Explanation

Cron supplies schedule and identity; the script reveals the deterministic data flow.

Troubleshooting

  • Distinguish the cron definition from the script it invokes.
  • Copy paths exactly, including /tmp filenames.

Safety and cleanup

  • Use only the OverTheWire game host and your own local practice directory.
  • Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
  • Treat commands as learning prompts: inspect paths and flags before running them.

Completion and next step

Use the recovered credential only in the official Level 22 login. Then mark this transition complete and continue.