Closing the writable directory

Lock the directory

Take the group and other write bits off /opt/maint/bin so only root can put files there:

sudo chmod 755 /opt/maint/bin
ls -ld /opt/maint/bin

In the terminal (now only root can write the directory — nothing to hijack)

student@vulntech:~$ sudo chmod 755 /opt/maint/bin
[sudo] password for student:
student@vulntech:~$ ls -ld /opt/maint/bin
drwxr-xr-x 2 root root 0 Oct 19 10:35 /opt/maint/bin

Now no ordinary user can plant a backup-logs for root to pick up. For defence in depth you would also rewrite collect.sh to call /usr/bin/… by full path, so even a future PATH mistake could not be abused.