Copy Link
Add to Bookmark
Report
Phrack Inc. Volume 04 Issue 42 File 06
==Phrack Magazine==
Volume Four, Issue Forty-Two, File 6 of 14
A User's Guide to XRAY
By N.O.D.
This file was made possible by a grant from a local
McDonnell Douglas Field Service Office quite some 'tyme'
ago. This was originally written about version 4, although
we are pretty sure that BT has now souped things up to version 6.
Everything still seems the same with the exception of a few
commands, one of which we will point out in particular.
Any comments/corrections/additions/updates or subpoenas
can be relayed to us through this magazine.
XRAY is a monitoring utility that gives the user a real-time
window into a Tymnet-II node. Used in tandem with other
utilities, XRAY can be a very powerful tool in monitoring network
activity.
In this file we will discuss key features of XRAY and give command
formats for several commands. Some commands are omitted from this
file since they can only be used from dedicated terminals. Several
others are likewise omitted since they deal with the utilization of
XRAY in network configuration and debugging the actual node code, and
would probably be more damaging than useful, and commands to reset
circuits and ports are similarly missing.
ACCESS
The most obvious way to access XRAY is to find the username/password
pair that either corresponds to the host number of an XRAY port, or
is otherwise in the goodguy list of a particular node.
XRAY can also be accessed through the DDT utility by typing
?STAT
Either will respond with the following
**X-RAY** NODE: XXX HOST: ZZZ TIME: DD:HH:MM:SS
If all ports are currently in use the user will only be allowed access
if his/her is of greater precedence in the goodguy list than that of
someone previously online. In such a case, that user will be forcibly
logged out and will receive the following message:
"xray slot overridden"
Otherwise the user will see:
"out of xray slots"
XRAY users are limited in their power by the associated "licence" level
given them in the XRAY goodguy list. The levels are:
0 - normal
1 - privileged
2 - super-privileged
There are several user names associated with the
XRAY utility. These exist on almost any network utilizing
the Tymnet-II style networking platform.
PRIORITY USERNAME
2 XMNGR
2 ISISTECX
2 XNSSC
1 TNSCMX
1 TNSUKMX
1 XSOFT
1 XEXP
1 XCOMM
1 XSERV1
0 XRTECH
0 XTECH
0 XOPPS
0 XSERV
0 XRAY
COMMANDS with parameters in <brackets>
HE Help
Use this command to display the commands available for that
particular node.
GP Get power <security string>
This command allows the user to move up to the maximum security
level allowed by his username, as specified in the good guy
list.
XG Display and/or modify XRAY goodguy list <entry number> <P/M>
This command without parameters will display the XRAY goodguy
list. When added with an entry number and 'P' (purge) or
'M' (modify), the user can edit the contents of the table.
The XGI command will allow the user to enter a new entry
into the list. Any use of XG or XGI to alter the list is
a super-privileged command and is audited.
>XG
XRAY GOODGUY LIST
NO. PRIV OVER NAME
---- ---- ---- ----
0001 0002 00FF TIIDEV
0002 0001 0030 RANDOMUSER
0003 0000 0000 XRAY
>XGI
ENTER UP TO 12 CHARACTERS OF USERNAME
NOD
ENTER NEW PRIVILEGE AND OVERRIDE - 2,FF
>XG
XRAY GOODGUY LIST
NO. PRIV OVER NAME
---- ---- ---- ----
0001 0002 00FF TIIDEV
0002 0001 0030 RANDOMUSER
0003 0000 0000 XRAY
0004 0002 00FF NOD
BG Display and/or modify Bad Guy List <node number> <R/I>
This command when entered without any parameters displays the
"bad guy" list. When used with a node number and 'R' it will remove
that node from the list, and 'I' will included. The 'R' and 'I'
features are privileged commands and usage is noted in audit trails.
>BG
2000 701 1012
>BG 2022 I
2022 2000 701 1012
HS Display host information
ND Display node descriptor
This command displays information about the node and its network
links.
NS Display node statistics
This command displays various statistics about the node including
time differentiations in packet loops, which can then be used to
determine the current job load on that particular node.
KD Display link descriptor <linked node>
This command displays the values of the link to the node specified.
This is displayed with columns relating to type of node (TP), speed
of the link (SP), number of channels on the link (NCHN), etc..
KS Display link statistics <up to 8 node numbers>
This command provides a report on various factors on the integrity
of the link to the given node(s), such as bandwidth usage, packet
overhead, characters/second transmitted, delays in milliseconds, etc.
BZ "Zap" link to node <node number>
This command will cause the link to the specified node to be
reset. This command is privileged and is audited. If the node
"zapped" is not currently linked a "??" error message will be
displayed.
TL Set/Reset trace on link <node number>
TN Set/Reset trace on line <node number>
TM Display trace events <B(ackground) / F(oreground)>
These commands are used to display activity between two active
nodes.
AC Display active channels <starting channel> <range of channels>
This command will display all active channel numbers for the given
range starting at the given channel number. Range is in hex.
QC Query channel status <channel number>
This command displays information about the given channel,
including throughput speed, source and output buffer size and
address location.
TC Enable/disable data trace on channel <channel number> <0/1>
This command with no arguments displays the channels
that are being diagnosed by the trace. The command with
a channel number and a '1' will enable data trace for that
channel, and a '0' will disable trace on that channel. Enabling
or disabling trace is a privileged command.
TD Display channel trace data in hex <count> <I/O>
TE Display channel trace data in hex including escapes <count> <I/O>
TA Display channel trace data as ASCII <count> <I/O>
With these commands trace data is displayed for a specified
time count. A prefixed 'I' or 'O' will show input or output
data. The default is both.
>ta 5
I/O CHN TIME
OUT 0040 ECC5 \86\86\0F\00\8A\80h\80\8CS\83valinfo;
IN 0040 EC87 \00\09\86\86\0D\08\00\00h
OUT 0040 0F67 \86\86\0E\00\880\8D
IN 0040 1029 \00,\86\86\09\86\00\00\90\1B\19\80 \06\86\00\00h
\15\1B\08J\04\0B\04\0F\04=\0DR\80JS\80\80
\8CVALINFO\8D
OUT 0040 102F \86\86\14\89p\90\1B\19\86\86\14\89j\18\15\13
**Note: Although this will allow one to follow the network connections
on specific channels, password data is filtered out. As you
can see from the above example, usernames are not. Many
usernames do not have passwords, as you all know. **
On more recent versions of XRAY a similar command "DR" performs a
similar function to the trace commands, but shows both hex and
ascii of the data in memory registers of the node.
>DR
I NOS 0001 A0 *
I SND 0001 A1 * !
I DTA 4920 616D 2061 6E20 6964 696F 7420 6265 *I am an idiot be*
0002 9D63 6175 7365 2049 206C 6566 7420 * cause I left *
6D79 7365 6C66 206C 6F67 6765 6420 696E *myself logged in*
2061 6E64 2077 656E 7420 686F 6D65 2E0D * and went home. *
6F70 7573 2520 0D0A 0D0A 0D0A 0D0A 0D0A *opus% *
BS Display bufferlet use statistics
This command shows the current and past usage of the memory
allocated to data buffering. This shows total usage, total peak
usage, and available buffer size.
RB Read buffer <buffer index>
This command displays the entire contents of the given buffer.
This is a privileged command and its use is not primarily for user
circuits. Primarily.
>RB 69
50 61 72 74 79 20 6F 6E 20 64 75 64 65 21 21 21
WB Write buffer <buffer index>
This command writes up to seven bytes into the specified buffer.
The buffer must greater than 4. This is also a privileged command.
CD Set/reset CRYPTO auto display mode <Y/N>
CL Display CRYPTO log <number of minutes>
CM Display CRYPTO messages by type
SM Enable/Disable CRYPTO messages by type
CRYPTO messages are informational messages about the activity of
the node. Up to 256 such entries are stored in a circular buffer
to record this activity. You can turn on automatic reporting
of these messages with the CD command prefixed with a 'Y' for
on and 'N' for off. Certain message types that become bothersome
can be disabled with the SM command and the message type.
DB Begin delay measurement
DD Display delay measurement statistics
DE Terminate delay measurement
DL Begin data loopback circuit
These commands are used to build circuits for testing the speed and
integrity of data flow between two nodes. The DL command is
super privileged and only one such circuit can be built on
a node at a given time. The data traffic generated by the DL is for
diagnostic use only and can be monitored by viewing node and link
statistics.
PM Measure performance on a channel <channel number>
This command measures the performance of a given channel by
inserting a timing sequence into the packet stream. Once it has
reached the given channel it is returned and a value corresponding
to the total time elapsed in milliseconds is displayed. If the
channel is not active, or no response is returned in 8 seconds the
message "BAD CHANNEL OR TIMEOUT" is displayed.
LE Set local echo mode
RE Set remote echo mode
One would use the set local echo command if the XRAY terminal
is not echoing commands typed by the user. By default, XRAY does
not echo output.
SUMMARY
XRAY is pretty confusing. Be careful with what you are doing
since you are essentially prodding around in the memory of the
node. Think of it in terms of using a utility to poke and prod
the memory of your own computer. Think of how disastrous a
command written to the wrong portion of memory can be. Don't
do anything stupid, or you might bring down a whole network,
or at minimum lose your access.
