From owner-freebsd-hackers  Mon Jun 24 14:08:38 1996
Return-Path: owner-hackers
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id OAA02186
          for hackers-outgoing; Mon, 24 Jun 1996 14:04:05 -0700 (PDT)
Received: from ref.tfs.com (ref.tfs.com [140.145.254.251])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id OAA02055;
          Mon, 24 Jun 1996 14:02:08 -0700 (PDT)
Received: (from julian@localhost) by ref.tfs.com (8.7.5/8.7.3) id NAA01968; Mon, 24 Jun 1996 13:59:32 -0700 (PDT)
Message-Id: <199606242059.NAA01968@ref.tfs.com>
Subject: Re: I need help on this one - please help me track this guy down!
To: richardc@CSUA.Berkeley.EDU (Veggy Vinny)
Date: Mon, 24 Jun 1996 13:59:31 -0700 (PDT)
From: "JULIAN Elischer" <julian@ref.tfs.com>
Cc: mark@grumble.grondar.za, wilko@yedi.iaf.nl, jkh@time.cdrom.com,
        guido@gvr.win.tue.nl, hackers@FreeBSD.org, security@FreeBSD.org,
        ache@FreeBSD.org
In-Reply-To: <Pine.PTX.3.91.960624133210.14727i-100000@soda.CSUA.Berkeley.EDU> from "Veggy Vinny" at Jun 24, 96 01:36:51 pm
X-Mailer: ELM [version 2.4 PL25 ME8b]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-hackers@FreeBSD.org
X-Loop: FreeBSD.org
Precedence: bulk

> 
> 
> 
> On Mon, 24 Jun 1996, Mark Murray wrote:
> 
> 
> > What do you get from strings(1)? (Long shot..)
> 
> -rwsr-xr-x     1 root  users  278528 Jun 18 04:01 root is from the dir 
     ^ DUH!
There  was also the one that used rdist in daemon mode
to rdist itself a new copy of /etc/passwd (and friends)

I haven't looked recently to see if that still works for FreeBSD..
I last looked in  386BSD..

julian