A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html.
An interesting characteristic of this server is that it exposes full read access to guest users via ssh. Any file on the system can be read by guests (except the SSL private key). Guest users can confirm that the SHA hashes of the node, http-server, and ssh binaries on the system match reference versions, and can confirm that those binaries are the currently running processes.
Is it possible for an attacker (via privilege escalation) or the owner of the server to modify the server in such a way that it serves a different version of index.html to specific IP addresses, while hiding this fact from any third party?