Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Check the permissions of a cron script that root executes periodically. If a regular user can write to it, think about what code will run the next time it fires.
Check /etc/crontab for jobs that root executes
Use ls -la to check the script's write permissions
If it is writable, append your own command and wait for the next run