Date: Mon, 24 Jun 1996 13:59:31 -0700 (PDT) From: "JULIAN Elischer" <julian@ref.tfs.com> To: richardc@CSUA.Berkeley.EDU (Veggy Vinny) Cc: mark@grumble.grondar.za, wilko@yedi.iaf.nl, jkh@time.cdrom.com, guido@gvr.win.tue.nl, hackers@FreeBSD.org, security@FreeBSD.org, ache@FreeBSD.org Subject: Re: I need help on this one - please help me track this guy down! Message-ID: <199606242059.NAA01968@ref.tfs.com> In-Reply-To: <Pine.PTX.3.91.960624133210.14727i-100000@soda.CSUA.Berkeley.EDU> from "Veggy Vinny" at Jun 24, 96 01:36:51 pm
next in thread | previous in thread | raw e-mail | index | archive | help
>
>
>
> On Mon, 24 Jun 1996, Mark Murray wrote:
>
>
> > What do you get from strings(1)? (Long shot..)
>
> -rwsr-xr-x 1 root users 278528 Jun 18 04:01 root is from the dir
^ DUH!
There was also the one that used rdist in daemon mode
to rdist itself a new copy of /etc/passwd (and friends)
I haven't looked recently to see if that still works for FreeBSD..
I last looked in 386BSD..
julian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199606242059.NAA01968>