3154 lines
147 KiB
Plaintext
3154 lines
147 KiB
Plaintext
+----------------------------------------------------------------------------+
|
||
! Beginners Guide to VAX/VMS Hacking !
|
||
! !
|
||
! File By ENTITY / Corrupt Computing Canada (c) 1989 !
|
||
! !
|
||
! !
|
||
! CORRUPT COMPUTING CANADA! !
|
||
! !
|
||
! CALL: (416)/398-3301 Login: Guest, PW: Guest !
|
||
! (416)/756-4545 type !! Login: lynx !
|
||
! !
|
||
+----------------------------------------------------------------------------+
|
||
! !
|
||
! You may freely distribute this file as long as no modifications of any !
|
||
! form are made to the file. All rights reserved by...What rights?! !
|
||
! !
|
||
! !
|
||
+----------------------------------------------------------------------------+
|
||
|
||
September 12,1989
|
||
|
||
|
||
INTRODUCTION
|
||
------------
|
||
|
||
|
||
Perhaps the most exciting Operating system to HACK on is VAX/VMS.
|
||
It offers many challenges for hackers and boasts one of the best security
|
||
systems ever developed. In comparison to the security on UNIX, VMS is far
|
||
superior in every respect. It can be very difficult to get inside such a
|
||
system and even harder to STAY inside, but isn't that what this is all about?!
|
||
I have written this file as a way for beginning hackers to learn about the VMS
|
||
operating system. There is such a vast amount of information that can be
|
||
related about VAX/VMS hacking that it is not possible for me to cover
|
||
everything in just one file. As such i will try and stick to the basics for
|
||
this file and hopefully write another file in the future that deals with
|
||
heavy-duty kernal programming, the various data structures, and system service
|
||
calls. All right so lets get at it!
|
||
|
||
|
||
|
||
|
||
GETTING IN
|
||
----------
|
||
|
||
First of all how do you recognize a VAX when you see one?! Well the
|
||
thing that always gives a VAX away, is when you logon you will see:
|
||
|
||
Username:
|
||
|
||
It may also have some other info before it asks you for the username, usually
|
||
identifying the company and perhaps a message to the effect of:
|
||
|
||
Unauthorized Users will be prosecuted to the fullest extent of the law!
|
||
|
||
That should get you right in the mood for some serious hacking! Ok so when you
|
||
have determined that the system you have logged into is indeed a VAX, you will
|
||
have to at this point enter your SYSTEM LOGIN. Basically on VAX's there are
|
||
several default logins which will get you into the system. However on MOST
|
||
systems these default logins are changed by the system manager. In any case,
|
||
before you try any other logins, you should try these (since some system
|
||
managers are lazy and don't bother changing them):
|
||
|
||
Username Password Alternate
|
||
-------------------------------------------------------------------------------
|
||
|
||
SYSTEM MANAGER OPERATOR
|
||
FIELD SERVICE TEST
|
||
DEFAULT DEFAULT USER
|
||
SYSTEST UETP SYSTEST
|
||
DECNET DECNET NONPRIV
|
||
|
||
|
||
That's it. Those are the default system users/passwords. The only ones on the
|
||
list that are GUARANTEED to be in the userlist are SYSTEM and DEFAULT. However,
|
||
I have never come across a system where these two haven't been changed from
|
||
their default passwords to something else. In the above list, the alternate
|
||
password is simply a password many operators set the password to from the
|
||
deafult. So if the first password doesn't work, try the alternate password. It
|
||
should be noted when the a user is added into the system, the default password
|
||
for the new user the SAME as his username. You should keep this point in mind
|
||
because it is VERY important. Most of the accounts you hack out, will be found
|
||
in this way! Ok if above ones don't work, then you should try these accounts.
|
||
These following accounts are NOT defaults, but through experience i have found
|
||
that many systems use these accounts or some variation thereof:
|
||
|
||
Username Password
|
||
---------------------------
|
||
VAX VAX
|
||
VMS VMS
|
||
DCL DCL
|
||
DEC DEC *
|
||
DEMO DEMO *
|
||
TEST TEST *
|
||
NETNONPRIV NONPRIV *
|
||
NETPRIV PRIV
|
||
ORACLE ORACLE *
|
||
ALLIN1 ALLIN1 *
|
||
INGRES INGRES *
|
||
GUEST GUEST *
|
||
GAMES GAMES
|
||
BACKUP BACKUP *
|
||
HOST HOST
|
||
USER USER *
|
||
DIGITAL DIGITAL
|
||
REMOTE REMOTE *
|
||
SAS SAS
|
||
FAULT FAULT
|
||
USERP USERP
|
||
VISITOR VISITOR
|
||
GEAC GEAC
|
||
VLSI VLSI
|
||
INFO INFO *
|
||
POSTMASTER MAIL
|
||
NET NET
|
||
LIBRARY LIBRARY
|
||
OPERATOR OPERATOR *
|
||
OPER OPER
|
||
|
||
The ones that have asterisks (*) beside them are the more popular ones and you
|
||
have a better chance with them, so you should try them first. It should be
|
||
noted that the VAX will not give you any indication of whether the username
|
||
you typed in is indeed valid or not. Even if you type in a username that does
|
||
not exist on the system, it will still ask you for a password. Keep this in
|
||
mind because if you are not sure if whether an account exists or not, don't
|
||
waste your time in trying to hack out its password. You could be going on a
|
||
wild goose chase! You should also keep in mind that ALL bad login attempts are
|
||
kept track of and when the person logs in, he is informed of how many failed
|
||
attempts there were on his account. If he sees 400 login failures, I am sure
|
||
that he will know someone is trying to hack his account.
|
||
|
||
|
||
|
||
|
||
THE BASICS
|
||
----------
|
||
|
||
Ok i am assuming you tried all the above defaults and managed to get yourself
|
||
into the system. Now the real FUN begins! Ok first things first. After you log
|
||
in you will get some message about the last time you logged in etc. If this is
|
||
the first time you have logged into this system then you should note the last
|
||
login date and time and WRITE IT DOWN! This is important for several reasons.
|
||
The main one being that you want to find out if the account you have just
|
||
hacked is an ACTIVE or INACTIVE account. The best accounts are the inactive
|
||
ones. Why?! Well the inactive accounts are those that people are not using
|
||
currently, meaning that there is a better chance of you holding onto that
|
||
account and not being discovered by the system operator. If the account has
|
||
not been logged into for the last month or so, theres a good chance that it
|
||
is inactive. Ok anyhow once your in, if you have a normal account with access
|
||
to DCL you will get a prompt that looks like:
|
||
|
||
$
|
||
|
||
This may vary from machine to machine but its usually the same. If you have a
|
||
weird prompt and would like a normal one, type:
|
||
|
||
$set prompt=$
|
||
|
||
If this is the first time you have hacked into this system there are a couple
|
||
of steps you should take immediately. First type:
|
||
|
||
$set control=(y,t)
|
||
|
||
This will enable your break keys (like ctrl-c) so that you can stop a file or
|
||
command if you make a mistake. Usually ctrl-c is active, but this command will
|
||
insure that it is. (Note: in general to abort a command, or program you can
|
||
type ctrl-c or ctrl-y) Ok anyhow, the next step is to open the buffer in your
|
||
terminal then type:
|
||
|
||
$type sys$system:rightslist.dat
|
||
|
||
This will dump a file that has all the systems users listed in it. You may
|
||
notice a lot of weird garbage characters. Don't worry about those, that is
|
||
normal. Ok after this file ends and you get the shell prompt again ($) then
|
||
save the buffer, clear it out and leave it open. Then type:
|
||
|
||
$show logical
|
||
|
||
Ok after this file is buffered save it also. Ok at this point you have two
|
||
files on your disk which will help you hack out MORE accounts on the system.
|
||
For now, lets find out how powerful the account you currently hacked into is.
|
||
You should type:
|
||
|
||
$set proc/priv=all
|
||
|
||
This may give you a message telling you that all your privileges were not
|
||
granted. That's ok. Now type:
|
||
|
||
$show proc/priv
|
||
|
||
This will give you a list of all the privileges your account is set up for.
|
||
Usually most user accounts only have NETMBX and TMPMBX privs. If you have
|
||
more than these two, then it could mean that you have a nice high-level user.
|
||
Unlike UNIX which only has a distinction between user and superuser, VMS has
|
||
a whole shitload of different privileges you can gain. The basic privs are as
|
||
follows:
|
||
|
||
PRIVILEGE DESCRIPTION
|
||
------------------------------------------------------------------------------
|
||
NONE no privilege at all
|
||
|
||
|
||
NORMAL PRIVS
|
||
------------
|
||
MOUNT Execute mount volume QIO
|
||
NETMBX Create network connections (you need this to call out!)
|
||
TMPMBX Create temporary mailbox
|
||
|
||
|
||
GROUP PRIVS
|
||
-----------
|
||
GROUP Control processes in the same group
|
||
GRPPRV Group access through SYSTEM protection field
|
||
|
||
|
||
DEVOUR PRIVS
|
||
------------
|
||
ACNT Disable accounting
|
||
ALLSPOOL Allocate spooled devices
|
||
BUGCHK Make bugcheck error log entries
|
||
EXQUOTA Exceed disk quotas
|
||
GRPNAM Insert group logical names n the name table
|
||
PRMCEB Create/delete permanent common event flag clusters
|
||
PRMGBL Create permanent global sections
|
||
PRMMBX Create permanent mailboxes
|
||
SHMEM Create/delete structures in shared memory
|
||
|
||
|
||
SYSTEM PRIVS
|
||
------------
|
||
ALTPRI Set base priority higher that allotment
|
||
OPER Perform operator functions
|
||
PSWAPM Change process swap mode
|
||
WORLD Control any process
|
||
SECURITY Perform security related functions
|
||
SHARE Access devices allocated to other users
|
||
SYSLCK Lock system-wide resources
|
||
|
||
|
||
FILES PRIVS
|
||
-----------
|
||
DIAGNOSE Diagnose devices
|
||
SYSGBL Create system wide global sections
|
||
VOLPRO Override volume protection
|
||
|
||
|
||
ALL PRIVS
|
||
---------
|
||
BYPASS Disregard protection
|
||
CMEXEC Change to executive mode
|
||
CMKRNL Change to kernal mode
|
||
DETACH Create detached processes of arbitrary UIC
|
||
LOG_IO Issue logical I/O requests
|
||
PFNMAP Map to specific physical pages
|
||
PHY_IO Issue physical I/O requests
|
||
READALL Possess read access to everything
|
||
SETPRV *** ENABLE ALL PRIVILEGES!!! ***
|
||
SYSNAM Insert system logical names in the name table
|
||
SYSPRV Access objects through SYSTEM protection field
|
||
|
||
|
||
Ok that's the lot of them! I will explain some of the more important privileges
|
||
later in the file. For now, at least you can see just how powerful the account
|
||
is. It should be noted that most accounts usually are only granted the TMPMBX
|
||
and NETMBX privileges, so if you don't have the others, don't fret too much.
|
||
|
||
|
||
|
||
GENERAL TERMINOLOGY
|
||
-------------------
|
||
|
||
I think that i should clarify some of the basic concepts involved with
|
||
VAX/VMS operating systems before we go any further:
|
||
|
||
PROCESS: this is what is created when you log in. The system sets aside CPU
|
||
time and memory for you and calls it a process. Any task that is run
|
||
in VMS is called a process.
|
||
|
||
SUBPROCESS: also known as child-process, this is just a process that was
|
||
created by another process.
|
||
|
||
DCL : Digital Command Language. This is the shell ($) that you are put into
|
||
when you log into a VAX
|
||
|
||
MCR : an alternate shell that is used (rarely) on certain accounts. Login
|
||
prompt is a > as opposed to DCL which gives a $
|
||
SHELL : this is the '$' that you see once you are logged in. This is your
|
||
interface with the system, where you can enter the various commands
|
||
execute files and perform other activities.
|
||
|
||
JOB : a process and a group of its subprocesses performing some task
|
||
|
||
SPAWN : this is the actual command that allows you to create subprocesses
|
||
'SPAWNING' is the act of creating subprocesses
|
||
|
||
PID : process identification number. This is an 8 byte ID code that is
|
||
uniquely given to each process that is created on the system.
|
||
|
||
IMAGE : this is an EXE file that you can execute (ie run)
|
||
|
||
UIC : User identification code. This is in two parts, namely: [group,member]
|
||
The way this works is that users in the same group can access each
|
||
others files through the group protection code. However since the UIC
|
||
MUST uniquely identify each user, the member portion separates the
|
||
individuals in each group. If an account does not have a different
|
||
member number, he will NOT be put in the RIGHTSLIST database.
|
||
|
||
|
||
|
||
CONTROL KEYS
|
||
------------
|
||
|
||
A brief note on control sequences. Several different actions can be activated
|
||
via control sequences. They are:
|
||
|
||
CTRL-H :delete last character
|
||
CTRL-B :redisplay last command (can go back up to the last 20 commands issued)
|
||
CTRL-S :pause display
|
||
CTRL-Q :continue after pause
|
||
CTRL-Z :*EXIT* use to break out of things such as CREATE and EDIT
|
||
CTRL-C :*CANCEL* will exit out of most operations
|
||
CTRL-Y :*INTERRUPT* will break out of whatever you are doing
|
||
CTRL-T :print out statistical info about the process
|
||
|
||
NOTE: sometimes upon login, the CTRL-Y, CTRL-C keys are disabled. To ensure
|
||
these are enabled, issue this command upon login:
|
||
|
||
$ SET CONTROL
|
||
|
||
|
||
-------------------------------------------------------------------------------
|
||
NOTE: all the commands that are executed from DCL can be referenced from an
|
||
online help manual. To access this, simply type help at any '$' prompt
|
||
This help is also available within the various utilities and programs
|
||
such as authorize and mail. The two MOST important commands are SET and
|
||
SHOW. These should be buffered and printed out for your own reference.
|
||
-------------------------------------------------------------------------------
|
||
|
||
FILES and DIRECTORIES
|
||
---------------------
|
||
|
||
The directory structure of VMS is a heirarchical one similar to MS-DOS and
|
||
UNIX. Its a simple concept, and i will only briefly skim over it. First of all
|
||
it should be noted that there may be more than one hard drive or other
|
||
mass-storage device hooked up to your system. Within each hard drive there is
|
||
the ROOT directory. This is the highest directory in the tree and is referenced
|
||
by [000000]. (this will be explained in a minute) Within the root there are
|
||
several subdirectories. Within these subdirectories there may be files and even
|
||
further subdirectories. The concept is quite simple, but can be difficult to
|
||
explain. Here is a diagram to give you a rough idea of how it is set up:
|
||
|
||
|
||
|
||
[000000] <--root directory
|
||
!
|
||
!
|
||
+--------------------------+---------------------------------+
|
||
! ! !
|
||
! ! !
|
||
[d1] [d2] [d3]
|
||
! ! !
|
||
+-----+--------+ +-----+-----+ +--------+
|
||
! ! ! ! ! ! !
|
||
! ! ! ! ! [d3.d3a] [d3.d3b]
|
||
[d1.da] [d1.db] [d1.dc] [d2.d2a] [d2.d2b]
|
||
! ! !
|
||
! ! +--+-----------+
|
||
[d1.db.db1] [d2.d2a.d2a1] ! !
|
||
[d2.d2b.d2b1] [d2.d2b.d2b2]
|
||
|
||
|
||
|
||
|
||
Hopefully this will give you some sort of an idea of how the directories
|
||
can be structured. Within each subdirectory there may be other files also. For
|
||
example to see the directory after you log in you would type:
|
||
|
||
$dir
|
||
|
||
a sample result may be:
|
||
|
||
|
||
Directory DISK$SCHOOL:[REPORTS.JOHN]
|
||
|
||
average.com;3
|
||
generate.exe;1
|
||
mail.mai;10
|
||
marks.dat;4
|
||
marks.dat;5
|
||
reportcard.dir
|
||
projects.dir
|
||
|
||
Total 7 files.
|
||
|
||
What does this tell you? The first line tells you what drive and subdirectory
|
||
you are in. The next lines are the actual files. As you can see each file has
|
||
a 3 character extension, followed by a comma and a number. The name before the
|
||
period is the actual filename (eg. average) the 3 characters after the period
|
||
is known as the extension (eg.com) and the number after the comma refers to the
|
||
version of the file. So in this case, this is version number 3. Any time you
|
||
modify or save a file, it automatically assigns it a version number of 1. If
|
||
file already exists on your disk, it increments the version number by 1 and
|
||
then saves it as such. So the next time i go ahead and save the file
|
||
average.com, it would add another file to the list called average.com;4
|
||
Special note should be taken of the files that have an extension of '.DIR'
|
||
These are not really files, but rather subdirectories. I will show you how to
|
||
switch subdirectories in just a minute. First you should take note of the
|
||
different file extensions. Although you can name the files anything you want
|
||
some of the more important extensions are:
|
||
|
||
TYPE DESCRIPTION
|
||
-------------------------------------------------------------------------------
|
||
EXE Executable IMAGE. These files are programs that can be RUN
|
||
COM DCL SCRIPT files. These can also be executed, utilizing the @ command
|
||
DAT DATA file. Sometimes useful things to look at.
|
||
LIS Listing File, many times important info is in here
|
||
MAI Mail file, use the MAIL command to read these
|
||
DIR DIRECTORY - not a file
|
||
JOU Journal File, often created thru the use of other programs eg EDIT
|
||
TXT Text Files, often hold useful information.
|
||
|
||
These are just some of the extensions you are most likely to see. The two
|
||
important ones are the EXE and COM files. These can be executed from the DCL
|
||
level. EXE files are executed via the RUN command. Eg. to run authorize.exe:
|
||
|
||
$run authorize
|
||
|
||
This will run the authorize IMAGE. Supposing there were more than one version
|
||
of authorize you could specify a version number. eg.
|
||
|
||
$run authorize.exe;4
|
||
|
||
The other type of file you can run is the COM files. These are like SCRIPT
|
||
files in UNIX or .BAT files from MS-DOS. They are just a sequence of DCL
|
||
commands strung together that are executed when you initiate the file. To run
|
||
COM files, use the @ command. For example to run adduser.com, type:
|
||
|
||
$@adduser
|
||
|
||
The version number thing i stated for EXE files also applies for COM files.
|
||
|
||
***NOTE*** To get a listing of all the files on the whole drive, try this:
|
||
|
||
$sd [000000]
|
||
$dir [...]*.*
|
||
|
||
Similarly you type dir [...]*.com, if you wanted just the COM files listed.
|
||
To see the contents of a file, you can use the TYPE command. For example:
|
||
|
||
$type login.com
|
||
|
||
this might type out something like:
|
||
|
||
$ sd:==set default
|
||
$ set control=(y,t)
|
||
$ set proc/name=entity
|
||
$ set term/dev=vt100
|
||
:
|
||
:
|
||
:
|
||
etc
|
||
|
||
This is great for COM files, DAT files and some of the other types, but you
|
||
will always get garbage when you type EXE files so don't bother trying those.
|
||
This is very useful for snooping around other peoples files and getting
|
||
information. Many times i have found user/passwords lying around in TXT or
|
||
LIS files left by some careless user.
|
||
|
||
Now, how do you go about changing directories? Well, first you should set up
|
||
a shortcut. The normal command to change directories is SET DEFAULT. For
|
||
example to change to a subdirectory called REPORTS, you would have to type:
|
||
|
||
$set default [.reports]
|
||
|
||
To make life simpler on yourself, as soon as you log in, you should type:
|
||
|
||
$sd:==set default
|
||
|
||
This defines a macro called SD that is interpreted by DCL as SET DEFAULT. You
|
||
can similarly define other 'favorite' commands to some short, easy to remember
|
||
definition. Anyhow heres the syntax for changing directories:
|
||
|
||
SD DEVICE:[dir1.dir2.dir3....]
|
||
|
||
The device can be optionally left out, if you plan to remain in the same hard
|
||
drive. You have to then enter a '[' followed by the root directory, followed
|
||
by a period, followed by another subdirectory name etc. Eg.
|
||
|
||
$sd dub0:[cosy.users]
|
||
|
||
Suppose at this point, you were in directory cosy, subdirectory users and there
|
||
was a further subdirectory called 'info.dir'. Rather than specify the full
|
||
pathname, you can simply type:
|
||
|
||
$sd [.info]
|
||
|
||
This will advance you one level into the info subdirectory. Remember to put the
|
||
period in front of the subdirectory. If you don't, in this case it would assume
|
||
that you were trying to reference the root directory called info. Another
|
||
important thing to note is moving back levels in terms of subdirectories. For
|
||
example if you were in [cosy.users.info] and wanted to move back to
|
||
[cosy.users] you could type:
|
||
|
||
$sd [-]
|
||
|
||
Similarly you can put in as many hyphens (-) as you want to move back. For
|
||
example sd [--] would put you back to the cosy directory.
|
||
|
||
Another important thing to note about subdirectories are logical assigned
|
||
symbols. These are names assigned to certain things. For example the main
|
||
system directory is called sys$system. So to go to it you could type:
|
||
|
||
$sd sys$system
|
||
|
||
This would throw you into the system directory. Similarly you can type:
|
||
|
||
$sd sys$login
|
||
|
||
and this will put you back into the directory that you were initially in, when
|
||
you first logged in. These symbols stand for actual device:directory
|
||
combinations. To see the various definitions that are assigned to each process
|
||
you should type:
|
||
|
||
$show logical
|
||
|
||
This will list a whole bunch of global system equates that you can use to
|
||
access various parts of the VAX structure. In addition to view all of your
|
||
locally defined symbols, use:
|
||
|
||
$show symbol *
|
||
|
||
|
||
|
||
FILE PROTECTION
|
||
---------------
|
||
|
||
Ok before i begin this, let me just state that whatever i say about files also
|
||
applies to directories. There are four types of file protections. There is
|
||
SYSTEM,WORLD,GROUP and OWNER. These are briefly:
|
||
|
||
SYSTEM- All users who have group numbers 0-8 and users with physical or logical
|
||
I/O privileges (generally system managers, system programmers, and
|
||
operators)
|
||
OWNER - the owner of the file (or subdirectory), isolated via their User
|
||
Identification Code (UIC). This means the person who created the file!
|
||
GROUP - All users who have the same group number in their UICs as the owner of
|
||
the file.
|
||
WORLD - All users who do not fall in the categories above
|
||
|
||
Each file has four types of protection within each of the above categories.
|
||
They are: Read, Write, Execute, Delete. Explanations are:
|
||
|
||
READ - You can read the file and copy it.
|
||
WRITE - You can modify and rename that file.
|
||
EXECUTE- You can run the file
|
||
DELETE - You can delete the file
|
||
|
||
When you create a file the default is that you have all the privileges for that
|
||
particular file. Group, world and system may only have limited privileges. This
|
||
can be changed with the set protection DCL command. For example:
|
||
|
||
$set protection=(group:rwed,world:r)/default
|
||
|
||
would set your default protection to allow other users in your group to have
|
||
full read,write,execute,delete privs to the file, and others only read access
|
||
to the file. The /default means that from now on all the files you create will
|
||
be set with this particular protection. To change one of your own files to
|
||
some other protection you can alternatively use:
|
||
|
||
$set prot topsecret.dat /prot=(system:rwed,group:rwed,world:rwed,owner:rwed)
|
||
|
||
This would enable all users on the system to access the file 'topsecret.dat'
|
||
When specifying the protection, you do not have to list them for each of the
|
||
four groups. You can simply choose only those thatPath: works!merk!alliant!linus!agate!ames!pacbell.com!tandem!UB.com!grafex!steveh
|
||
From: steveh@grafex.Cupertino.CA.US (Steve Harding KA6ETB)
|
||
Newsgroups: comp.bbs.waffle
|
||
Subject: Re: Forced un-join?
|
||
Message-ID: <NqgwRB1w165w@grafex.Cupertino.CA.US>
|
||
Date: Tue, 29 Sep 92 22:50:22 PDT
|
||
References: <4i5VRB1w165w@dogear.spk.wa.us>
|
||
Distribution: usa
|
||
Organization: The GRAFex Company
|
||
Lines: 15
|
||
|
||
bobk@dogear.spk.wa.us (Bob Kirkpatrick) writes:
|
||
|
||
> Use Chris Winemiller's expire (CWEXP104.ZIP). It has a 'keeper' option
|
||
> that will always retain at least one message in any group. I've been
|
||
> using it since he first issued v1.0 and it just gets better with each
|
||
> new rev level. He has a rev 1.05 in the wings, but I don't know if he
|
||
> turned it loose yet.
|
||
|
||
As a beta site for 1.05...it works...it's super.
|
||
|
||
steve
|
||
|
||
--
|
||
play:steveh@grafex.Cupertino.CA.US 408.252.0578 work:harding@nas.nasa.gov
|
||
A prince trapped in the body of a dirty old man.
|
||
emiller's expire (CWEXP104.ZIP). It has a 'keep |