OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 1st quarter (Jan-Mar) 1994: Re: /etc/utmp

Re: /etc/utmp

Aggelos D. Keromitis (kermitics.forth.gr)
Fri, 25 Mar 1994 15:00:14 +0200 

There is also another way, which may or may not be patched in your system;
 i know there is a patch somewhere out there about it, but i don't think many
 ppl know it...So, all you have to do, is bed the /etc/utmp (bed= binary editor)
 and go to your entry where it talks about the tty you're on...there is just
 enough space to replace it with /tmp/x (or any other single letter of course)..
 just remember, for each extra letter you right there, you remove a '\000' 
 (edit it in ascii mode)...then, go to /tmp and create a link to any file...
 you can imagine what follows i guess...
 Some time ago, i found a patch (source) about it, but i cant remember where...
 Anyway, i think the CERT certificate had this method in mind...
-Aggelos