Privilege Escalation: Which Account Was Compromised?

An attacker escalated one ordinary user to administrative rights so they could keep root access without an obvious backdoor. The box has several normal users; exactly one has been quietly added to the sudo group.

Identify the compromised account and record its username to /root/case/compromised_account.txt: a plain-text file holding just that one name (the sudo group line itself is accepted too). A list of every user fails.

getent group sudo # who can sudo?

# cross-check against the normal users in /etc/passwd

On a clean baseline the sudo group is empty of regular users — so the lone member is your answer. Grading checks the recorded username.