YOU DIDIN'T PATCH SHIT, BITCHES. ;)
mmm. Journit.
lpd:x:500:500:lpd:/tmp:/bin/bash
lpd:$1$pit9Yc/I$EFVsav7iNfmOeDbEzHHKt1:11324:0:99999:7:::
adm1:x:0:0:adm:/usr:/bin/bash
adm1:$1$.eiZ/ij3$pONljGRjOm0jHSg0SSzRN1:11324:0:99999:7:::
adm1 pts/0 63.147.83.60 Tue Jan 2 08:50 - 09:13
Jan 2 08:50:28 kroberts PAM_unix[18646]: (system-auth) session opened for
user adm1 by lpd(uid=500)
Jan 2 08:50:20 kroberts -- lpd[18620]: LOGIN ON pts/0 BY lpd FROM
63.147.83.60
Jan 2 06:37:00 kroberts xinetd[543]: START: ftp pid=17591
from=63.147.83.60
Jan 2 06:38:21 kroberts xinetd[543]: START: telnet pid=17592
from=63.147.83.60
Jan 2 08:50:15 kroberts xinetd[543]: START: telnet pid=18619
from=63.147.83.60
cat .bash_history
who
id
ls
cd ..
ls
cd tmp
mkdir ...
cd ...
pico 1
ln -s /dev/null .bash_history
echo ".........uuuh..*ouch*...poor bash................... "
echo "Now kill logging .........................................."
killall -9 syslogd && killall -9 klogd
ls
cd /
ls
cd home
ls
cd ..
cd var
cd www
ls
cd html
ls
pico index.html
cd ..
cd ..
cd home
ls
cd ..
cd home
cd http
cd httpd
ls
cd ..
cd var
cd www
ls
mv index.html index.old
cd html
mv index.html index.old
ls
pico index.html
ls
cd ..
ls
cd ..
cat etc/passwd
cd ..
cat etc/passwd
ls
cd misc
ls
cd ..
cd home
ls
cd datacomm
ls
cd ..
cd chadm
ls
cd ..
exit