Scott Chasin wrote this... > The following is somewhat of a security hole in Solaris 2.x which > allows any non-root user to remove themselves from /var/adm/utmp[x] > files (who, w, finger, etc). > Now the trick here is also to exploit this enough so that you can > change your ttyname (which can easily be done) and manipulate a > system utility into writing to that new ttyname (which could be a > system file). This example only takes you out of the utmp files. solaris utmp has had heaps of bugs, why dont sun just fix it up properly once and for all?? i think i'll put in a RFE for this, just to make it official, even if the &^%*& (favorite expletive here), wont do it. Matt -- #!/bin/sh echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D3F204445524F42snlbxq'|dc;exit Matthew Keenan Systems Programmer Information Technology Division University of Technology Sydney Australia It's nice to be in a position where people apologize because they assume there's humor in your work, based on past experience, but they're not sure where it is. -- Rob Pike