Curling

Got root.txt but still lingering thoughts/questions. My take away from this box is to not have a config file for a service running as root be writable by a non root user.

I’d like to know how people a getting a shell but I still want to figure this rather than be told
so my question is,
what service is updating the ad**-ar** files?

edit:
I tried putting in the location of shell in the same format as root and got binary as output.
Any care to explain in a pm?