Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting this gap with a well-timed symlink.
Inspect the contents of a periodic root script such as cleanup.sh
A gap between checking and using a file can indicate a TOCTOU vulnerability
Time the swap of the target file with a symlink to exploit the gap