Anything in this folder runs at login
There is a second favourite hiding spot: the folder /etc/profile.d/. Every .sh file in there runs automatically whenever a user logs in. It is meant for harmless setup, but an attacker can drop a file there so their code runs again and again.
ls /etc/profile.d/In the terminal
student@vulntech:~$ ls /etc/profile.d/ bash_completion.sh gawk.csh gawk.sh
So a defender has two quick questions after an incident: “What services auto-start, and do I recognise them?” and “Is there anything unexpected in /etc/profile.d/?” In the lab you will answer both and clean up what you find.
Tip: A file name starting with a dot or a number (like
00-update.sh) is a trick to make it sort to the top and look boring. Open and read it anyway.