A login script that ships your history
Every interactive shell on ops-02 makes a small HTTP request after each command. Find the startup file responsible, the shell variable it abuses, and where the data goes.
Briefing
The proxy shows ops-02 posting a few bytes to the same host every time an administrator types a command. It only happens in interactive shells.
Bash reads /etc/profile, everything in /etc/profile.d, /etc/bash.bashrc, and each user’s ~/.bashrc when a shell starts. Search those for anything that makes a network call.
ops-02 · Persistence hunting
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.