Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

Check the permissions of a cron script that root executes periodically. If a regular user can write to it, think about what code will run the next time it fires.
Check /etc/crontab for jobs that root executes
Use ls -la to check the script's write permissions
If it is writable, append your own command and wait for the next run