Goal
Create a shell script that the bandit24 cron job runs and removes, so it copies the next password to a readable location.
Why this matters
The level teaches execution identity, writable drop directories, output permissions, and cleanup under a scheduler.
Progressive hints
Hint 1
Inspect the cron script before writing anything.
Hint 2
Use a unique /tmp output directory you control.
Hint 3
Your script must be executable and must make its copied output readable.
Method
Run only the lines that match the evidence you observe.
workdir=$(mktemp -d /tmp/bandit23.XXXXXX) && chmod 700 "$workdir"
# Create a small script in the official spool directory that copies the game password to $workdir/output and chmods it 600.
# Make the script executable, wait for one cron interval, then inspect $workdir/output.Expected non-secret observation
Cron consumes the submitted script and a credential file appears in your private temporary directory.
Explanation
The scheduler runs submitted scripts as the destination account; explicit destination permissions determine whether your current account can read the result.
Troubleshooting
- Use absolute paths inside cron scripts.
- Check the shebang and executable bit.
- Clean up only the unique directory you created.
Safety and cleanup
- Use only the OverTheWire game host and your own local practice directory.
- Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
- Treat commands as learning prompts: inspect paths and flags before running them.
Completion and next step
Use the recovered credential only in the official Level 24 login. Then mark this transition complete and continue.