Goal
A program runs automatically via cron. Look in /etc/cron.d/ to find what command executes.
Hints
- Start by listing
/etc/cron.d. - The cron entry will reference a script (usually in
/usr/binor/usr/local/bin). - The script often writes output to
/tmp.
Solution (click to reveal)
- SSH in:
ssh bandit22@bandit.labs.overthewire.org -p 2220
- Inspect cron definitions:
ls -la /etc/cron.d
cat /etc/cron.d/*
- Find the referenced script and read it:
cat /usr/bin/cronjob_bandit22.sh
- The script will write the next password somewhere (often under
/tmp). Read that file.
Notes
- Cron jobs run as specific users; the script may copy the password file into a world-readable temp file.
- Don’t brute force—just read the script carefully.