Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Inspect the scheduled script placed under /usr/local/bin along with the cron entry that registers it. Comments inside the script itself can hide clues.
Explore /etc/cron.d/ and /usr/local/bin/
You can cat a script file including its comment lines
crontab -l -u <user> shows another user's crontab too