diff --git a/pwnables/Makefile b/pwnables/Makefile
index 661ed8f..154b3a8 100644
--- a/pwnables/Makefile
+++ b/pwnables/Makefile
@@ -5,23 +5,24 @@ TARGET = $(CURDIR)/target
 FAKE = fakeroot -s $(CURDIR)/fake -i $(CURDIR)/fake
 INSTALL = $(FAKE) install
 
-all: target
+all: 99-pwnables.tce
+
+99-pwnables.tce: target
+	$(FAKE) sh -c 'cd target && tar -czf - --exclude=placeholder --exclude=*~ .' > $@
 
 target:
 	$(INSTALL) -d $(TARGET)
+
+	(cd skel; tar cf - .) | (cd $(TARGET); tar xf -)
+
 	$(MAKE) -C daemons TARGET=$(TARGET) install
 
-	$(INSTALL) -D init/networking $(TARGET)/var/service/networking/run
-	$(INSTALL) -D init/telnetd $(TARGET)/var/service/networking/run
-	$(INSTALL) -D init/tftpd $(TARGET)/var/service/networking/run
 	$(INSTALL) -d $(TARGET)/usr/lib/www
-
 	$(INSTALL) $(CGI) $(TARGET)/usr/lib/www
 
 	$(INSTALL) -D flag $(TARGET)/var/lib/tftp/flag
 	$(INSTALL) -D flag $(TARGET)/var/lib/notes/flag
-	$(INSTALL) -D flag $(TARGET)/var/lib//flag
-	$(INSTALL) -D flag $(TARGET)/var/lib/tftp/flag
+	$(INSTALL) -D flag $(TARGET)/home/flag/.plan
 
 
 clean:
diff --git a/pwnables/init b/pwnables/init
new file mode 100755
index 0000000..39abecd
--- /dev/null
+++ b/pwnables/init
@@ -0,0 +1,25 @@
+#! /bin/sh
+
+## This is the init for the desktop services box.
+. /sbin/db-funcs.sh
+
+dbmsg
+dbmsg "-----------------------------------------------------------------------"
+dbmsg "Bringing up pwnables personality"
+dbmsg "-----------------------------------------------------------------------"
+dbmsg
+
+# /usr and /home live in RAM
+mount -t tmpfs usr /usr
+mount -t tmpfs home /home
+
+# Unpackage everything.  Globs are sorted in busybox.
+cd /
+for i in /opt/tce/*.tce; do
+    dbmsg "Unpacking $i..."
+    tar xzf $i
+done
+
+# Pass control to /usr/sbin/init
+[ -x /usr/sbin/init ] && exec /usr/sbin/init
+exec busybox init
diff --git a/pwnables/skel/usr/etc/hostname b/pwnables/skel/usr/etc/hostname
new file mode 100644
index 0000000..0dcc91d
--- /dev/null
+++ b/pwnables/skel/usr/etc/hostname
@@ -0,0 +1 @@
+ctf
diff --git a/pwnables/skel/usr/etc/shadow b/pwnables/skel/usr/etc/shadow
new file mode 100644
index 0000000..6a17be6
--- /dev/null
+++ b/pwnables/skel/usr/etc/shadow
@@ -0,0 +1 @@
+root::::::::
diff --git a/pwnables/skel/var/service/networking/finish b/pwnables/skel/var/service/networking/finish
new file mode 100755
index 0000000..8882913
--- /dev/null
+++ b/pwnables/skel/var/service/networking/finish
@@ -0,0 +1,3 @@
+#! /bin/sh
+
+# Nothing to see here.
diff --git a/pwnables/init/networking b/pwnables/skel/var/service/networking/run
similarity index 69%
rename from pwnables/init/networking
rename to pwnables/skel/var/service/networking/run
index 5946c70..6cc5a94 100755
--- a/pwnables/init/networking
+++ b/pwnables/skel/var/service/networking/run
@@ -2,7 +2,7 @@
 
 # busybox's dc doesn't support i :<
 # Its awk does support 0xa0 as an int, but gawk doesn't.  This only works on busybox.
-lastd=awk -F ':' '{for (i=1; i<NF; i++) {q = xor(q, "0x" $i);} print (q<2?2:q);}' /sys/class/net/eth0/address
+lastd=$(awk -F ':' '{for (i=1; i<NF; i++) {q = xor(q, "0x" $i);} print (q<2?2:q);}' /sys/class/net/eth0/address)
 
 myip=10.0.0.$lastd
 
diff --git a/pwnables/init/telnetd b/pwnables/skel/var/service/telnetd/run
similarity index 100%
rename from pwnables/init/telnetd
rename to pwnables/skel/var/service/telnetd/run
diff --git a/pwnables/init/tftpd b/pwnables/skel/var/service/tftpd/run
similarity index 100%
rename from pwnables/init/tftpd
rename to pwnables/skel/var/service/tftpd/run