Breaking password on FreeBSD 5.2.1 box

[Andrew Lewis]

Hi list,

We have a client running a fBSD 5.2.1 box that needed its root password
hacked.

I couldn't boot into single user mode w/o the root password, so I
installed fBSD 5.3 on another machine, and slaved the drive from the
5.2.1 box in mine.

Then I tried editting its master.passwd file and removing the root
password: didn't work.

So then I tried setting it to the hash of a password I knew: didn't
work.

So then I editted /etc/ttys and set 'secure', booted up in single user
mode, ran 'passwd' and it came back with some failure in pam_chauthtok -
I forget the exact message, but it wasn't any more specific than what
I've described.

What to do now? Did I do something very wrong? :( Please CC your
response to me (non-subscriber)...

Thanks...

Best,
-AL.