4 ms·

/etc/passwd contains the user database on most Un*x systems. GP replaced it with the executable file, thus wiping out the system's users. Ouch.

by krylon 5y ago

rootusrootus 5y ago
> Ouch. Ouch, indeed. We ended up getting lucky and found a workstation where someone had left themselves at a root prompt on another machine that had a shared NFS mount. This was before protection from this kind of attack, so we were able to create a setuid root script and run it on the main server to get root access to fix the broken passwd file. Our next step was going to be rebooting the server. We were pretty sure that faced with a corrupt passwd file, SunOS would drop to single user mode. Never tested that theory. Glad we didn't have to, the server in question was a hack job as it was. Copied over (literally, as files) from a previous server, it wasn't even 100% in agreement with itself on its own hostname, so I always kinda wondered how it would react to any big changes.
unethical_ban 5y ago
Why did you write it Un*x? Is there a Unex or Unox? I've seen it written *nix to grab Linux and Unix.
- rootusrootus 5y ago
  That has precedent going way back, at least 34 years: https://unix.stackexchange.com/questions/2342/why-is-there-a-when-there-is-mention-of-unix-throughout-the-internet https://unix.stackexchange.com/questions/2342/why-is-there-a... Doesn't explain why exactly the asterisk was put in that particular position. Maybe someone felt like it was odd to lead the word with an asterisk. :shrug:
  - wiml 5y ago
    The asterisk is there to avoid writing the word out in full, like "G*d" or "f*ck". There was a time when Unix[1][2] was a trademarked name and if you used it you had to attribute it. If you wanted to refer to the general family of Unix/POSIX/SysV/BSD/etc systems, you might be tempted to write "Unix"[1][2], but to avoid the presumably-Sauron[3]-like eye of the trademark holders, you'd bowdlerize it a little. [1] Unix is a registered trademark of AT&T Bell Labs. [2] Unix is a registered trademark of The Open Group. [3] Sauron is a registered trademark of Tolkien Enterprises
- luke2m 5y ago
  Linix?
Nextgrid 5y ago
My bad. I somehow expected him to put it into /etc and rename it to something else. Indeed if he overwrote /etc/passwd then all hell would break loose.

/etc/passwd contains the user database on most Un*x systems. GP replaced it with the executable file, thus wiping out the system's users. Ouch.

by krylon 5y ago

/etc/passwd contains the user database on most Un*x systems. GP replaced it with the executable file, thus wiping out the system's users. Ouch.

rootusrootus 5y ago

> Ouch. Ouch, indeed. We ended up getting lucky and found a workstation where someone had left themselves at a root prompt on another machine that had a shared NFS mount. This was before protection from this kind of attack, so we were able to create a setuid root script and run it on the main server to get root access to fix the broken passwd file. Our next step was going to be rebooting the server. We were pretty sure that faced with a corrupt passwd file, SunOS would drop to single user mode. Never tested that theory. Glad we didn't have to, the server in question was a hack job as it was. Copied over (literally, as files) from a previous server, it wasn't even 100% in agreement with itself on its own hostname, so I always kinda wondered how it would react to any big changes.

unethical_ban 5y ago

Why did you write it Un*x? Is there a Unex or Unox? I've seen it written *nix to grab Linux and Unix.

rootusrootus 5y ago
That has precedent going way back, at least 34 years: https://unix.stackexchange.com/questions/2342/why-is-there-a-when-there-is-mention-of-unix-throughout-the-internet https://unix.stackexchange.com/questions/2342/why-is-there-a... Doesn't explain why exactly the asterisk was put in that particular position. Maybe someone felt like it was odd to lead the word with an asterisk. :shrug:
- wiml 5y ago
  The asterisk is there to avoid writing the word out in full, like "G*d" or "f*ck". There was a time when Unix[1][2] was a trademarked name and if you used it you had to attribute it. If you wanted to refer to the general family of Unix/POSIX/SysV/BSD/etc systems, you might be tempted to write "Unix"[1][2], but to avoid the presumably-Sauron[3]-like eye of the trademark holders, you'd bowdlerize it a little. [1] Unix is a registered trademark of AT&T Bell Labs. [2] Unix is a registered trademark of The Open Group. [3] Sauron is a registered trademark of Tolkien Enterprises
luke2m 5y ago
Linix?

Nextgrid 5y ago

My bad. I somehow expected him to put it into /etc and rename it to something else. Indeed if he overwrote /etc/passwd then all hell would break loose.