Every Login Reopens the Door

The attacker didn't need a daemon — they hooked the login path itself. Every *.sh file in /etc/profile.d/ is sourced for each interactive login shell, so a script dropped there runs as whoever logs in. One of the scripts in /etc/profile.d/ isn't housekeeping: on every login it reaches an external host and re-arms the attacker's access. The rest are legitimate shell setup. Find the rogue login hook, remove it without breaking the real shell environment, and recover the note left beside it.

Record your findings under /root/case:

1. Record the full path of the rogue login hook to /root/case/finding.txt. (The legitimate scripts set the locale, the pager, aliases — local, inert. The rogue one calls out to an external address on every login.)

2. Neutralize it: remove the script, strip the beaconing code out of it, or quarantine it in place (comment it out, or rename it so the name no longer ends in .sh; only *.sh files are sourced). Whatever stays in /etc/profile.d/ must still parse — every login sources it, so a half-deleted if block prints a syntax error at every login. The legitimate shell setup must survive.

3. Recover the flag from the note the attacker left beside the hook to /root/case/flag.txt.

See /root/case/brief.txt. Grading reads the filesystem directly.