Privilege Escalation: The Writable Cron Job

You have a foothold as 'student' — an ordinary account with NO sudo. Servers run scheduled jobs as root all the time: backups, log rotation, health checks. If even one of those jobs runs a script that you can write to, then "edit a file" quietly becomes "run commands as root."

1. Enumerate. Look at what the system runs on a schedule — /etc/cron.d, /etc/crontab, the per-user crontabs — and which user each job runs as. One maintenance job here runs as root every minute.

2. Abuse it. Follow that job to the script it executes and check its permissions. This one is world-writable: you can change what root runs. Add your own commands to it.

3. Prove it. Wait for the next minute so cron runs your edited script as root, then confirm: a marker at /root/pwned.txt (only root can write inside /root), and the root-only flag from /root/flag.txt saved to /home/student/loot.txt.

Grading reads the machine state: a /root/pwned.txt owned by root, and your loot matching the real flag. There is no way to pass without the root cron job actually running your code — and the fix is simply to make the script unwritable by anyone but root.