Good Day

Our HP box was hacked and the passwd file has been altered,there are only 2 user accounts active,and these dont have any administrative rights.I need to edit the passwd file to correct the su and root entries.
Does any body have any suggestions as to how i can do this with out the root account (maybe a "live cd" to edit the files??)

Thank you

If you have a recovery tape, this would now be usefull. Boot from the tape and restore the passwd file, then boot again.

Thx for the reply, but this is where my problems start.

Firstly i try a tape recovery,once it gets to a point where i can select the files to recover it fails ie
ERROR : Tar: blocksize =0;broken pipe
ERROR: File: /usr/ccs not found
ERROR: file: /usr/obam not found and it carries on with further errors

Secondly i try a DVD recovery and boot from the DVD,but when i try to load files and dependencies, it tells me the file system is full.
That is I try to edit the passwd file , vi isnt loaded, so I add the file to the list and it trys to add the files to the system so i can edit the passwd file.But returns an error that the file system is full, so basically i am $##@@ right now.

So i was thinking of another tool that i could use to edit the passwd file ?

Use the shell itself to edit the passwd file:
echo "fixup::0:0::/:/usr/bin/ksh" >> /etc/passwd
then reboot and login as fixup to finish the job.

Also this link may be helpful: Expert Recovery Using the Core Media

Thx, I logged in a as the SU and edited the /etc/passwd

cheers

So use:
echo "fixup::0:0::/:/usr/bin/ksh" >> /mnt/etc/passwd

or whatever. Your post implied that lack of vi was your problem. This sidesteps that.