Unit 9: Scheduled tasks and persistence · Lesson 4 of 6 · 16 min

Login scripts

Find a script that changes every login session, and connect its address to the brute-force attack.

mission

You are
You are checking what runs when anyone logs in.
Situation
Every login shell reads /etc/profile.d. A line there touches every session on the machine, including yours.
Goal
Find environment changes made at login and trace them to a file.
Hand in
The file, what it sets and why the address matters.

Runs at every login

  1. /etc/profileRead by login shells
  2. /etc/profile.d/*.shEach file sourced in turn
  3. Your sessionInherits every variable they set
01

Look at your own environment

learner@root-lab
env | grep -i proxy
no_proxy=localhost,127.0.0.1
https_proxy=http://198.51.100.23:3128

you should see Your shell sends HTTPS through a proxy. You never set that.

02

Find where it is set

learner@root-lab
grep -l proxy /etc/profile.d/*
/etc/profile.d/proxy.sh
ls -l --time-style=long-iso /etc/profile.d/
total 12
-rw-r--r-- 1 root root 10 2026-09-30 14:20 00-umask.sh
-rw-r--r-- 1 root root 96 2024-04-22 13:04 01-locale-fix.sh
-rw-r--r-- 1 root root 81 2026-10-13 22:42 proxy.sh
cat /etc/profile.d/proxy.sh
export https_proxy=http://198.51.100.23:3128
export no_proxy=localhost,127.0.0.1
03

Where have you seen that address?

learner@root-lab
grep 'Failed password' /var/log/auth.log | grep -c 198.51.100.23
150

you should see The proxy is the same address that guessed SSH passwords all morning. Any tool honouring https_proxy would send its traffic there.

defender tip Also review /etc/bash.bashrc, /etc/environment and each user's .bashrc and .profile.

What a defender takes away

  1. 1/etc/profile.d runs for every login shell.
  2. 2env shows what your session really has.
  3. 3Correlate addresses across logs and config.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    env | grep -i proxy

  2. Show hint

    grep and count in auth.log.