RE: [cobalt-users] New Exploit?

["Chris Demain" <cdemain@xxxxxxxxxxx>]

[outstanding exploit information snipped]

> user / password (md5) / password (clear)
>
> trk2 / SDaVtiyNMzUYs / fucked
> brmbrm / SD5FxnRnzpCs
>

This is not to pick a nit, but because it may be significant.
All MD5 passwords begin with the string: $1$
(ex. $1$lcL2mrpB$wjCsu6I.NJU9olJx8EGqp1 -- yes, an actual (hashed) password)
What you have is standard UNIX crypt(3).
What's significant about that is that they both have the same salt (SD)
possibly either indicating a problem with you (or Cobalt's) passwd, or
suggesting that the password was manually entered into /etc/passwd and/or
/etc/shadow using vipw or similar.
My RaQs are XTRs, so I don't have information on what format your machine
uses.

HTH
Chris