Service Recovery After Compromise

During the incident, the attacker sabotaged a legitimate service two ways: they dropped a malicious systemd override that replaces its ExecStart with their own payload, and they disabled the service so the clean version wouldn't start on boot. The service name is in /root/case/assignment.env (SERVICE). Recover it: remove the malicious drop-in override so the unit runs its real ExecStart again, and re-enable the service so it starts at boot. Grading reads the systemd config on disk.