The Job That Phones Home

An intruder left themselves a way back in through cron. Among the box's legitimate scheduled jobs in /etc/cron.d/, one drop-in quietly reaches out to an external host on every tick — a textbook persistence beacon, dressed up to look like routine package maintenance. Find the rogue drop-in, rip it out without breaking the jobs the box actually needs, and recover the note the intruder left behind.

Record your findings under /root/case:

1. Record the full path of the malicious cron drop-in to /root/case/finding.txt. (The legitimate jobs — log rotation, a package-index refresh that runs the stock apt-get — run real local commands; the rogue one calls out to an outside address.)

2. Neutralize it: remove the drop-in, or strip or comment out the line that beacons out. The legitimate jobs must survive untouched.

3. Recover the flag from the note the intruder left in root's home to /root/case/flag.txt.

See /root/case/brief.txt. Grading reads the filesystem directly.