How to login to a machine with invalid shell in /etc/passwd?

["Raymond Causton" <rc@iki.fi>]

Due to a late-night-typo (tm) I unfortunately managed to lock my
root-account on a Solaris 7/sparc box last night and I'm damned if I can
figure out how to regain root access on that machine.

What I did was I installed bash onto the machine in /bin/bash and as every
other user on the system defaults to /bin/csh and I had changed n+1 accounts
to /bin/bash I didn't pay attention to the detail, that for root the default
shell is /sbin/sh instead of /bin/something, so I ended up with an entry for
root pointing to the nonexistant shell /sbin/bash instead of /bin/bash.

Now, I don't have any other interactive user-accounts on this machine that
belong to any other group that 'users' so no bin/sys/wheel group-access is
possible i.e. with g+bin I could just copy bash over to /sbin and be done
with it, but as it is I can't. =(

The Solaris 7 (v.11/99) install in the bare-bones install with only telnet
and ftp-services on, no sshd, lpd or httpd (which would have been
exploitable) and it doesn't seem very vulnerable to any root exploit I could
find at packetstorm or root shell.

Now I know the root password and I have non-privilidged accounts on the
machine, but login barfs when trying to 'su' to root or login from the
console with "No Shell for root." and goes back to the login-prompt. I can't
login to the ftp-server either (but I can log onto ftp on three other
identical machines (except for the typo ofcourse) and with another user
account on this machine too).

The machine in question is a Sun Netra T1 with serial console/network for
access and a CD-ROM, no floppy.

So I'm basically asking:

What ways are there left to login to a machine either specifying which shell
to use or using another source of configuration regarding which shell to use
for the login other than /etc/passwd?

Sorry if this is a bit OT as it's concerned with Solaris, but I figured that
this is universal enough situation that I could ask on this forum.

Your Truely,
    Raymond Causton