Loading
The Kirana Mart web server has been slow all week. The admin checked the usual suspects and found nothing, so now she is reading the scheduled tasks.
On Linux, crontab -l lists the jobs that run automatically. Attackers love cron because it gives them persistence: a malicious entry runs again and again, even after a reboot.
What you are given: the full crontab listing below. All of it is fictional.
What to find: one entry does not belong. It decodes a long Base64 string and writes the result to a hidden file. Decode that string yourself to recover the flag, which starts with the letters MXC in braces.
Read every line before you decide which entry is odd. The normal entries are backups, certificate renewals and cleanup. The odd one stands out once you look.
Crontab:
# Kirana Mart web server - scheduled jobs
# Managed by the infra team. Please do not edit by hand.
0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1
*/15 * * * * /usr/bin/certbot renew --quiet
*/7 * * * * echo 'TVhDe2Nyb25fcmFuX3RoZV9zZWNyZXRfaGxzb30=' | base64 -d > /tmp/.healthcheck 2>&1
30 4 * * 0 /usr/local/bin/cleanup.sh --prune >> /var/log/cleanup.log 2>&1
15 3 * * * /usr/local/bin/report.sh
Submit the flag when you have it.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.