Sooo… got user, I see the timestamp change, and I can see the script that writes to that file. But when I change that script to my liking (i.e., open a reverse shell), nothing happens, and the script reverts to its original, including the timestamp. Which means it must be copied from somewhere, right? Well I haven’t been able to find it. I feel this is the last step on my way to root. Hints are welcome.