516 lines
26 KiB
Plaintext
516 lines
26 KiB
Plaintext
_______________________________________________________________________________
|
|
|
|
INTRODUCTION TO THE PRIMOS OPERATING SYSTEM
|
|
Part I (Identification and Penetration)
|
|
|
|
Written by Violence
|
|
Copyright (C) 1989 The VOID Hackers
|
|
_______________________________________________________________________________
|
|
|
|
|
|
INTRODUCTION to This Series
|
|
|
|
This is the first in a public-release series of articles dealing with Prime
|
|
computers (both mini's and supermini's) and their respective operating system,
|
|
PRIMOS. PRIMOS is one of the several operating systems that the general hacker
|
|
community has avoided due to unfamiliarity. In all actuality, PRIMOS is a very
|
|
user-friendly operating system and as such, demands respect. In this series
|
|
of articles I will cover everything that is important to the aspiring PRIMOS
|
|
hacker. In the syllabus are:
|
|
|
|
Part Contents
|
|
---- ------------------------------------------------------------------------
|
|
I Identification, and penetration, PRIMOS command line, command types
|
|
II Making Your Stay Last Longer, Basic PRIMOS Commands, Internal Security
|
|
III Useful PRIMOS Applications
|
|
IV Prime Network Communications (PRIMENET and Associated Utilities)
|
|
V Language Interpreters and Compilers, Advanced PRIMOS Commands
|
|
---- ------------------------------------------------------------------------
|
|
|
|
That about covers it. This series is largely based on extensive on-hands use,
|
|
and all the information provided herein is guaranteed to be 100% accurate in
|
|
regards to Revisions 19.xx through 22.xx of PRIMOS. I do occasionally address
|
|
pre-revision 19.xx systems, but only in passing as they are extremely uncommon.
|
|
In addition, all sample programs included herein have been fully tested. All
|
|
PRIMOS output samples were taken from a Revision 22.0.0 PRIMOS system.
|
|
|
|
I chose to write this series in a technical manner, but not like a typical AT&T
|
|
document (grin). All in all, this series does not equal or even come close to
|
|
the actual PRIMOS documentation, but since such documentation is generally un-
|
|
available to the hacker community, I have tried my best to create a series that
|
|
proves as an acceptible alternative. Due to the high content of information I
|
|
have provided herein, you are advised to obtain all of the parts to this series
|
|
and dump them to your printer. Spend a day reading and comprehending them. I
|
|
suggest that you read the entire series before beginning to hack at Primes.
|
|
|
|
NOTE IN CLOSING: I have opted to remain purposefully vague in some areas due to
|
|
potential abuse. This seems to be the rage these days and I'm
|
|
sorry if that upsets you, but I have no wish to compromise any
|
|
of Prime Computer, Inc.'s trade secrets.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
WHAT'S IN PART I?
|
|
|
|
|
|
There is so much to get started with that I wasn't able to get everything in to
|
|
Part I. This makes the subsequent parts of this series vital to the comprehen-
|
|
sion of the information presented here. There is tons more to cover, so I will
|
|
urge you some more to go ahead and get ALL of the other parts. Inside this in-
|
|
stallment I shall cover:
|
|
|
|
o Conventions Used Throughout This Series
|
|
o System Identification
|
|
o Front-End Security and Penetration
|
|
o The PRIMOS Command Line
|
|
o A Discourse on PRIMOS Command Types
|
|
o How PRIMOS Interacts With Its Users
|
|
|
|
In 'Part II' I will completely detail the typical internal security setup and
|
|
how to improve your security, as well as the many internal snooping tactics
|
|
that I use in my day-to-day Prime wanderings. I will also discuss the vital
|
|
PRIMOS commands that should be memorized.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
CONVENTIONS USED THROUGHOUT THIS SERIES
|
|
|
|
|
|
As with any multi-part series, a set of standards is needed, otherwise the rea-
|
|
der may become confused. In writing this series of articles, I had to make an
|
|
important decision regarding the conventions used within command examples and
|
|
with the numerous hands-on examples scattered throughout the text.
|
|
|
|
All command references in this series will follow the conventions put forth in
|
|
the PRIMOS reference manuals and online help facilities. Conventions follow:
|
|
|
|
WORDS-IN-UPPERCASE identify command words or keywords and are to be entered
|
|
literally. All command abbreviations will be listed following the actual full
|
|
command name.
|
|
|
|
Words-in-lowercase identify arguments. You substitute the appropriate numer-
|
|
ical or text value.
|
|
|
|
Braces { } indicate a choice of arguments and/or keywords. At least one must
|
|
be selected.
|
|
|
|
Brackets [ ] indicate that the word or argument enclosed is optional.
|
|
|
|
Hyphens - indicate a command line option and must be entered literally.
|
|
|
|
Parenthesis ( ) must be entered literally.
|
|
|
|
Ellipses ... indicate that the preceeding argument may be repeated.
|
|
|
|
Angle Brackets < > are used literally to separate the elements of a pathname.
|
|
|
|
options: The word 'options' indicates that one or more keywords and/or argu-
|
|
ments can be given and that a list of options for the command follow.
|
|
|
|
All examples throughout this text will be indented '8' spaces so that they will
|
|
be easily identifiable. All text typed by the user in these examples will be
|
|
completely displayed in lowercase characters. PRIMOS output will then be easy
|
|
to identify.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
SYSTEM IDENTIFICATION
|
|
|
|
|
|
PRIMOS is Prime's uniform operating system for their extensive line of mini-
|
|
and supermini computers. If you have ever read some of the articles detailing
|
|
the PRIMOS operating system floating about, then you may have a basic working
|
|
knowledge of PRIMOS and such. I will be referencing some of these articles in
|
|
this series occasionally (all references are listed in the "References" section
|
|
at the end of the last part of this series).
|
|
|
|
A few years back, the Prime model 750 was all the rage. No longer is that the
|
|
case, however. Now days there are many models of Primes and corporations and
|
|
governments (the two main Prime owner classes) purchase the models that best
|
|
suit their individual needs. Thusly, you will find Prime 250's (ancient) and
|
|
750's (also ancient, but still in use) to Prime 4150's (a mid-range system) and
|
|
the huge Prime 9550's (high-end mini's). On the high-end of this you will also
|
|
find Prime MCXL's (super-mini's) and Prime workstation clusters. As you can
|
|
see, the army of Primes is astoundingly large.
|
|
|
|
Equally large in number are the revisions of PRIMOS that they run. About all
|
|
that you will see these days are Rev. 20.xx and greater but you will, on occ-
|
|
asion, find a revision 17.xx, 18.xx, or 19.xx system. About the only places
|
|
you will find 17.xx and 18.xx systems are on foreign packet-switched networks
|
|
(PSN's) (like on Brazil's Interdata or Renpac networks and Japan's Venus-P/NTII
|
|
or DDX-P/KDD networks). A scant few 18.xx and 19.xx systems are still operat-
|
|
ing in the United States. As said previously, however, you will most likely
|
|
find from Rev's 20.xx through 22.xx systems here (and in most other countries).
|
|
|
|
To understand how PRIMOS interfaces with users you need to have a good working
|
|
grasp of what the standard PRIMOS operating system model looks like. To do
|
|
this you need a decent abstract model. Here:
|
|
|
|
Identifying a Prime mini- or supermini computer is not very difficult. Primes
|
|
generally behave in one of two ways when connected to. They either sit there,
|
|
echoing nothing to your screen or, in the case of a PRIMENET-equipped system,
|
|
display their PRIMENET nodename.
|
|
|
|
In the former case, try this simple test upon connecting. Type a few random
|
|
keystrokes followed by a RETURN and take note of what the host system responds
|
|
with. If it responds with a battery of error messages followed with the rather
|
|
distinctive 'ER!' prompt, then it is a Prime. Here is an example:
|
|
|
|
asdf
|
|
Invalid command "ASDF". (processcommand)
|
|
Login please.
|
|
ER!
|
|
|
|
Any Prime that just sits there waiting for you to login is not running PRIMENET
|
|
and generally lacks inter-system communications capability. On the other hand,
|
|
those systems that are equipped with PRIMENET jump right out and yell "Hey! I'm
|
|
a Prime!", as they display their revision of PRIMOS and their system nodename
|
|
upon connect. Here is an example:
|
|
|
|
PRIMENET 21.0.3 VOID
|
|
|
|
That's all there is to Prime system identification. Like I said, it's a rather
|
|
trivial task.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
FRONT-END SECURITY AND SYSTEM PENETRATION
|
|
|
|
|
|
Now that we have located a Prime, how do we bypass the front-end security and
|
|
get in? Well, before I can begin to answer that question a little discourse on
|
|
the security itself is required.
|
|
|
|
The government has granted Primes a C2 security rating. To give you an idea of
|
|
what that means, VAXen are also classed as C2 systems. Hoewever, that C2 rat-
|
|
ing sort of 'fluctuates' about. External security should really be a bit high-
|
|
er, as Prime Computer, Inc. tells their administrators to remove all defaults.
|
|
Not very nice, eh? On the other hand, internal security is not so hot. I'll
|
|
discuss internal security more fully in the next Part of this series.
|
|
|
|
The front door is similar to PRIMOS command level in that it utilizes the comm-
|
|
and line (the prompting and I/O sub-systems). The only command which you can
|
|
enter at this level of operation is the LOGIN command. There is no 'who' comm-
|
|
and available to you prior to system login. As Evil Jay pointed out in
|
|
his "Hacking PRIMOS" files (volumes I-III), there is no easy way to get
|
|
into a
|
|
Prime computer, as its front-door security is excellent.
|
|
|
|
At this point only one option lies available, unless, of course, you know some-
|
|
one on the inside (grin). This option is default accounts. How nice of Prime
|
|
Computer, Inc. to install so many default accounts at their factories. As I
|
|
have said, however, they tell their administrators to remove these default acc-
|
|
ounts after the system has been installed. Not a few administrators fail to
|
|
remove these defaults, however, and that is good for us. Also, never forget
|
|
that Prime users are people and people like to use easy-to-remember passwords.
|
|
But before I go any further, let me explain the LOGIN command in greater detail
|
|
(patience is a virtue, you know).
|
|
|
|
Typically you will type 'LOGIN' and press RETURN. You will then be requested
|
|
first for User ID and then your password. Here's yet another example:
|
|
|
|
login
|
|
User id? user
|
|
Password? <not echoed>
|
|
Invalid user id or password; please try again.
|
|
Login please.
|
|
ER!
|
|
|
|
Well, that sure didn't work. Notice how PRIMOS didn't echo your password to
|
|
you. The above example is from a non-PRIMENET Prime. After this bad entry you
|
|
are probably still connected, so you can have another go at it. A non-PRIMENET
|
|
system generally has a high bad-login threshold, so you can make many attempts
|
|
per connect. A PRIMENET system on the other hand is more of a bitch to hack as
|
|
it will disconnect you after the first incorrect login. Here's another example
|
|
(assuming you are hacking a PRIMENET system from the TELENET X.25 network):
|
|
|
|
@214XXX
|
|
|
|
214 XXX CONNECTED
|
|
PRIMENET 20.0.0 VOID
|
|
login user
|
|
Password? <not echoed>
|
|
Invalid user id or password; please try again.
|
|
|
|
214 XXX DISCONNECTED 00 00 00:00:00:08 9 7
|
|
|
|
As you can see, one chance is all you get with a PRIMENET system. A minor note
|
|
is in order here regarding all the myriad of X's in the above example. I have
|
|
masked the last three digits of the system's NUA (Network User Address), for I
|
|
do not wish all you eager PRIMOS hackers to start banging on my system's front
|
|
door (grin). I have also edited the system's nodename from its actual nodename
|
|
to a more appropriate one (grin). I will continue to mask all system identifi-
|
|
cation from my examples.
|
|
|
|
So far you are accustomed to typing in 'LOGIN' and pressing RETURN to start
|
|
logging in. On all Primes you can nest the 'LOGIN' command and your User ID in
|
|
the same line, as is illustrated in the following example:
|
|
|
|
login user
|
|
Password? <not echoed>
|
|
|
|
And on a very few other Primes you can do a full LOGIN nest, as such:
|
|
|
|
login user password
|
|
|
|
You might not wish to use full-nesting capability when other hackers are lurk-
|
|
ing about, as they might decide to practice shoulder surfing (grin).
|
|
|
|
If a User ID/password combination (hereafter referred to as an 'account') is
|
|
valid, you will recieve the following login herald from PRIMOS:
|
|
|
|
USER (user 87) logged in Sunday, 22 Jan 89 16:15:40.
|
|
Welcome to PRIMOS version 21.0.3
|
|
Copyright (c) 1988, Prime Computer, Inc.
|
|
Serial #serial_number (company_name)
|
|
Last login Wednesday, 18 Jan 89 23:37:48.
|
|
|
|
'serial_number' and 'company_name' will be replaced by the actual serial number
|
|
and company name of the company that owns the Prime computer site.
|
|
|
|
Just one more small thing I need to cover about the 'LOGIN' command right now,
|
|
and that is login troubles. Troubles? You bet'cha. The first trouble occurs
|
|
when the account you login to exists and is valid, but it doesn't have an init-
|
|
ial ATTACH point (in other words, you don't seem to have a 'home' directory).
|
|
This is no fun, since this account cannot be logged into. Bah. The other tro-
|
|
uble is remote user passwords. This is definitely no fun. The prompt for such
|
|
are generally different from one another, as they run both commercial and cust-
|
|
om written software to handle this. When you come upon a remote password, try
|
|
the User ID and, if that doesn't work, then try the system's nodename. If both
|
|
of these attempts fail, you can either keep trying passwords (brute-force hack-
|
|
ing) or you can give it up and move onto the next account or system. A popular
|
|
commercial front-end security package is "LOGINSENTRY" from Bramalea Software
|
|
Systems, Inc. "LOGINSENTRY" is an excellent package, so good luck when you go
|
|
up against it. It supports remote passwords, password aging, old-password
|
|
databasing, etc.
|
|
|
|
That's about all you need to know about the 'LOGIN' command right away. In the
|
|
section on Prime Networking I will discuss the remote login feature (similar to
|
|
the UNIX 'rlogin' command). For now, this will suffice.
|
|
|
|
Here is a listing of default PRIMOS accounts along with some other accounts I
|
|
find that work occasionally (i.e, more than just once):
|
|
|
|
NOTE: The '+' and '*' symbols are not parts of the User ID.
|
|
|
|
|
|
User ID Password Comments
|
|
_______________________________________________________________________________
|
|
|
|
+ ADMIN ADMIN, ADMINISTRATOR Administrator account
|
|
+ CMDNC0 CMDNC0 External command UFD maintenance
|
|
* DEMO DEMO, GUEST Demo account
|
|
+ DIAG DIAG Diagnostic account
|
|
+ FAM FMA File Access Manager
|
|
+ GAMES GAMES Games account (only on schools)
|
|
* GUEST GUEST, VISITOR Demo account
|
|
+ HELP HELP Help subsystem account
|
|
+ INFO INFO Information account
|
|
+ JCL JCL Job Control Language account
|
|
+ LIB LIB, LIBRARY Library maintenance account
|
|
+ NETMAN NETMAN Network controller account
|
|
+ NETPRIV NETPRIV Network priv account
|
|
+ NEWS NEWS News account
|
|
+ NONETPRIV NONETPRIV Network nopriv account
|
|
* PRIME PRIME Prime account
|
|
+ PR1ME PR1ME Prime account
|
|
+ PRIMOS PRIMOS Prime account
|
|
+ PRIMOS_CL PRIMOS_CL Prime account
|
|
+ REGIST REGIST User registration account
|
|
+ RJE RJE Remote Job Entry account
|
|
+ STUDENT STUDENT, SCHOOL Student account (only on schools)
|
|
* SYSADM SYSADM, ADMIN Administrator account
|
|
* SYSTEM SYSTEM Administrator account
|
|
+ TELENET TELENET GTE TELENET account
|
|
* TEST TEST Test account
|
|
+ TOOLS TOOLS Tool maintenance account
|
|
_______________________________________________________________________________
|
|
|
|
|
|
Several of these combinations will not work, as they are initial system setup
|
|
accounts and the administrator, after setup, changes them or completely removes
|
|
them (Prime Computer, Inc. advises this). I have denoted these accounts with a
|
|
'+' symbol.
|
|
|
|
The accounts marked by a '*' are the ones that I find work most commonly. More
|
|
often than not they have good privileges (with exception to GUEST).
|
|
|
|
Notice SYSADM. Say, isn't that a UNIX default? Sure it is but I have found it
|
|
to work so many times that I just had to assume it was a default of some sort.
|
|
|
|
As for TELENET I have yet to see it work, but Carrier Culprit states in the LOD
|
|
Hacker's Technical Journal file on PRIMOS (LOD T/J Issue 2) that it works some-
|
|
times.
|
|
|
|
Lastly, unlike UNIX, the PRIMOS LOGIN subsystem is not case-dependant. This is
|
|
good, as case dependancy gets boring at times. User ID "system" is the same as
|
|
"SYSTEM". PRIMOS maps all command line input to upper case prior to processing
|
|
it. This is true for logins and commands. Although your typing appears in
|
|
lower case, PRIMOS interprets it in upper case. No big deal. Just thought I'd
|
|
mention it.
|
|
|
|
All of this information is for 19.xx through 22.xx systems. I do believe that
|
|
I will make an appendix for logging into revision 17.xx and 18.xx systems beca-
|
|
use you never know when you might find one. And besides, once you have experi-
|
|
enced a revision 17.xx or 18.xx system you will love revisions 21.xx and 22.xx
|
|
that much more!
|
|
|
|
_______________________________________________________________________________
|
|
|
|
THE PRIMOS COMMAND LINE
|
|
|
|
|
|
Before I go on any further some discussion on the PRIMOS command line is in or-
|
|
der. The command line is the agent that accepts your input and then transports
|
|
the input to the command processor (known affectionately as '(processcommand)')
|
|
for parsing.
|
|
|
|
The PRIMOS command line is interesting in the fact that it utilizes two prompts
|
|
in it's execution. These prompts are 'OK,' and 'ER!'. There is no difference
|
|
in the two, save that the 'ER!' prompt is displayed only after you make a mist-
|
|
ake and are given an error message. After successful execution of a command,
|
|
however, you will see the 'OK,' prompt again. You can alter these prompts with
|
|
a special command, but I will save that for the section I have planned on cust-
|
|
omizing your environment.
|
|
|
|
Of all the most popular command lines (PRIMOS, UNIX, VAX/VMS) I like the PRIMOS
|
|
command line the most. You can have separate commands on the same command line
|
|
(just separate them with a semicolon), and so forth.
|
|
|
|
No command (along with all options and arguments) can be longer than 160 char-
|
|
acters. If you should enter a command line longer than 160 characters then it
|
|
will be rejected by the command processor and you will get the following error
|
|
message:
|
|
|
|
Command line longer than 160 characters. (listen_)
|
|
|
|
The PRIMOS command line has several special features, and some of these are:
|
|
|
|
o User-defined abbreviations
|
|
o Command line syntax suppression
|
|
o Multiple commands on one line
|
|
o User-defined global variables
|
|
o PRIMOS command functions
|
|
o Command iteration
|
|
o Wildcard names
|
|
o Treewalk pathnames
|
|
o Name generation patterns
|
|
|
|
There will be full discourses on user-defined abbreviations and command func-
|
|
tions later in this series.
|
|
|
|
The PRIMOS command processor identifies these features by searching for special
|
|
characters entered in the command line. These special features, in the order
|
|
that they are searched for, are given in the following table (this table repro-
|
|
duced from the Revision 19.xx Command Reference Manual, still pretty current in
|
|
this regard).
|
|
|
|
Be aware that user-defined functions are always processed first and use no spe-
|
|
cial characters of any sort.
|
|
|
|
|
|
FEATURE SPECIAL CHARACTER COMMENTS
|
|
-------------------------------------------------------------------------------
|
|
Abbreviations No special characters
|
|
Syntax suppressor In first position on line only
|
|
Command separator ;
|
|
Global variables % %
|
|
Functions [ ]
|
|
Iteration ( )
|
|
Treewalking @,@@,+,^ In any intermediate position of
|
|
pathname
|
|
Wildcarding @,@@,+,^ In final position of pathname
|
|
Name generation =,==,^=,^==,+
|
|
-------------------------------------------------------------------------------
|
|
|
|
|
|
When these special characters are found, the PRIMOS command processor substi-
|
|
tutes the value of the item for the item itself. This is 'one-to-one' substi-
|
|
tution.
|
|
|
|
Iteration lists cause the command processor to create one command for each item
|
|
found or matched on the iteration lists. In the case of wildcard or treewalk
|
|
names, the user sets the pattern and the command processor searches the spec-
|
|
ific directory or directories for all file system objects that "match" that
|
|
pattern. These features can be thought of as creating "many-to-one" matches.
|
|
|
|
Name generation patterns can be used to create matching names either for simple
|
|
filenames or for whatever number of filenames resulting from a wildcard or
|
|
treewalk name.
|
|
|
|
NOTE: All commands support all the features listed above. The general rule is
|
|
as follows: if a feature is not useful in connection with a particular
|
|
command, then that command will not recognize it.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
A DISCOURSE ON PRIMOS COMMAND TYPES
|
|
|
|
|
|
There are two kinds of PRIMOS commands, internal and external. Internal comm-
|
|
ands are built right inside of PRIMOS (i.e, in the compiled programs that make
|
|
up PRIMOS). External commands are programs located in the CMDNC0 directory.
|
|
When an external command's filename is typed (the name of the command, less the
|
|
file extension) then the program is invoked. Of course, you may add the file's
|
|
extension if you wish, as it will work, but that is defeating the purpose.
|
|
|
|
The reason for internal and external commands is twofold. The PRIMOS files
|
|
(usually located in the DOS directory) take up a lot of memory. Not all Prime
|
|
systems have whopping loads of memory, so Prime made sure that PRIMOS was able
|
|
to be executed flawlessly (memory constraint-wise) on all system models. Only
|
|
the MOST important commands were built inside of PRIMOS. Less vital (yet still
|
|
vastly important) commands were made to be external commands. Secondly, diff-
|
|
erent sites have different needs. Prime recognized this need and their command
|
|
structure allows for the easy customizing of PRIMOS commands (adding, changing,
|
|
removing, creating). It's an ideal setup, really.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
HOW PRIMOS INTERACTS WITH ITS USERS
|
|
|
|
|
|
To understand how PRIMOS interfaces with users you need to have a good working
|
|
grasp of what the standard PRIMOS operating system model looks like. To do
|
|
this you need a decent abstract model. Here:
|
|
|
|
__ ________________________ __
|
|
| | | | | |
|
|
| | | CMDNC0 Externals | | |
|
|
| | | __________ | | |
|
|
Requests | |->| | | |<-| | Requests
|
|
| | | | Kernel | | | |
|
|
Replies | |<-| |__________| |->| | Replies
|
|
| | | | | |
|
|
| | | Command Line | | |
|
|
|__| |________________________| |__|
|
|
|
|
User Phantom
|
|
Processes Processes
|
|
|
|
|
|
As you can see, PRIMOS is made up of the kernel (the heart of the operating
|
|
system; the command processor and all of the internal commands) as well as
|
|
the CMDNC0 externals (prograns; external commands) and the PRIMOS command line
|
|
(what the user uses to interact with PRIMOS).
|
|
|
|
_______________________________________________________________________________
|
|
|
|
|
|
Well, I have come to the end of the first installment of five of the Introduct-
|
|
ion to the PRIMOS Operating System. In the next part I will detail:
|
|
|
|
o Making Your Stay Last Longer
|
|
o Basic PRIMOS Commands to Memorize
|
|
o A Full Discourse on User-to-User Communication
|
|
o Internal PRIMOS Security
|
|
o Exploring the Vast Reaches of a Prime
|
|
|
|
Until then may the forces of darkness become confused on the way to your house.
|
|
|
|
_______________________________________________________________________________
|
|
|
|
End of Part I of the "Introduction to the PRIMOS Operating System".
|
|
_______________________________________________________________________________
|
|
|
|
|