392 lines
15 KiB
Plaintext
392 lines
15 KiB
Plaintext
==Phrack Magazine==
|
|
|
|
Volume Four, Issue Forty-Four, File 22 of 27
|
|
|
|
****************************************************************************
|
|
|
|
|
|
-- An Introduction to the DECserver 200 --
|
|
by Opticon The Disassembled
|
|
|
|
|
|
ANARCHY: "The belief that society
|
|
can be maintained without prisons,
|
|
armies, police or other organized force to
|
|
maintain property rights, collect taxes or
|
|
enforce such personal obligations as debts,
|
|
contracts or alimony." -EB 1966, vol.I
|
|
(taken from the Phrozen Realm)
|
|
|
|
|
|
"If ur good, nobody knows that ur there"
|
|
|
|
The DECserver is a terminal server (WOW!). The Model 200 is the most
|
|
commonly found server in VMS machines. This device connects up to eight
|
|
asynchronous (RS232C) terminals to one or more hosts available on an Ethernet
|
|
Local Area Network.
|
|
|
|
It is connected to the LAN through an Ethernet physical channel and
|
|
supports speeds up to 19.200bps. It can be found on VAXes, mVAXes and
|
|
VAXstations. It uses the Local Area Transport protocol to communicate with
|
|
the other nodes. It also implements the Terminal Device/Session Management
|
|
Protocol to achieve multiple sessions. Things that can be found plugged on
|
|
it include dial-in and out modems, terminals, printers and stuff like that.
|
|
The identification code for it in VMS is DS2. It's software is installed
|
|
via VMSINSTAL.COM to SYS$SYSROOT:[DECSERVER] or in SYS$COMMON:[DECSERVER]
|
|
for the cluster machines. And of course now you will ask why should you
|
|
be interested in a damn phucking (=relief, back to my native language) SERVER.
|
|
A lot of interesting things can be done, like dialing out for free (assuming
|
|
you can connect to it in a convenient way). You can even find a DEC server
|
|
200 dedicated to eight high speed modems. There is no need to say that you
|
|
need privileges to phuck up with devices like that...or there is?
|
|
|
|
..Set Default to SYS$SYSROOT:[DECSERVER] and run DSVCONFIG.COM :
|
|
|
|
$
|
|
$ set default sys$sysroot:[decserver]
|
|
$ show default
|
|
SYS$SYSROOT:[DECSERVER]
|
|
= SYS$SYSROOT:[DECSERVER]
|
|
= SYS$COMMON:[DECSERVER]
|
|
$ @dsvconfig
|
|
|
|
You must assign a unique DECnet node name and DECnet node
|
|
address for each new DECserver.
|
|
|
|
Press <RET> to start, or <CTRL/Z> to exit...
|
|
|
|
D E C s e r v e r C o n f i g u r a t i o n P r o c e d u r e
|
|
|
|
Version: V1.7
|
|
|
|
Menu of Options
|
|
|
|
1 - List known DECservers
|
|
2 - Add a DECserver
|
|
3 - Swap an existing DECserver
|
|
4 - Delete an existing DECserver
|
|
5 - Restore existing DECservers
|
|
CTRL/Z - Exit from this procedure
|
|
|
|
Your selection? 1
|
|
|
|
DECnet DECnet Server Service
|
|
Address Name Type Circuit Ethernet Address Load File Dump File
|
|
------- ------ ----- ------- ----------------- ------------- -------------
|
|
1.1 KEYWAY DS200 BNA-0 08-00-2B-07-39-5E PR0801ENG.SYS DS2KEYWAY.DMP
|
|
1.2 REVEAL DS200 BNA-0 08-00-2B-28-32-CB PR0801ENG.SYS DS2REVEAL.DMP
|
|
1.3 OASIS DS200 BNA-0 08-00-2B-26-A9-57 PR0801ENG.SYS DS2OASIS.DMP
|
|
1.4 PAWN DS200 BNA-0 08-00-2B-24-F3-98 PR0801ENG.SYS DS2PAWN.DMP
|
|
1.5 OPAQUE DS200 BNA-0 08-00-2B-11-EA-D4 PR0801ENG.SYS DS2OPAQUE.DMP
|
|
1.6 TOKEN DS200 BNA-0 08-00-2B-10-64-98 PR0801ENG.SYS DS2TOKEN.DMP
|
|
1.7 KERNEL DS200 BNA-0 08-00-2B-12-D6-39 PR0801ENG.SYS DS2KERNEL.DMP
|
|
1.8 IRIS DS200 BNA-0 08-00-2B-12-D6-39 PR0801ENG.SYS DS2IRIS.DMP
|
|
1.9 NEBULA DS200 BNA-0 08-00-2B-12-D6-39 PR0801ENG.SYS DS2NEBULA.DMP
|
|
|
|
Total of 9 DECservers defined.
|
|
(Press RETURN for menu)
|
|
|
|
Connecting to one of them:
|
|
|
|
$ mc ncp connect node iris
|
|
|
|
Console connected (press CTRL/D when finished)
|
|
#
|
|
|
|
|
|
Here you must give a password. The default one is usually working so try
|
|
"access". Only in "high security" systems they change the default password,
|
|
because privileges are needed anyway to access the Network Control Program
|
|
(which can be a possible subject for my next article). But since you are in
|
|
using a system account (..privileged) you can change the current password if
|
|
you find any good reason for doing so. More on that later.
|
|
|
|
DECserver 200 Terminal Server V3.0 (BL33) - LAT V5.1
|
|
|
|
Please type HELP if you need assistance
|
|
|
|
Enter username> <type anything here it doesnt really matter>
|
|
|
|
|
|
You are in.
|
|
|
|
In the DECserver there are Permanent and Operational databases. The
|
|
permanent database holds commands which affect the device permanently when
|
|
you log out. In the Operational database whatever you do is temporary and
|
|
takes effect only for the time you are logged in.
|
|
|
|
Let's go on by trying to get the default privileged account which enables
|
|
you to view various things and make changes other than the normal ones.
|
|
|
|
Local> set privileged
|
|
Password> system
|
|
|
|
Again the default password should work.
|
|
|
|
Local> show hosts
|
|
|
|
Service Name Status Identification
|
|
|
|
VMS 1 Connected Welcome to VAX/VMS V5.4-2
|
|
MODEM Available Dial In And Out
|
|
UNIX Available BSD
|
|
|
|
Local> show nodes
|
|
|
|
Node Name Status Identification
|
|
|
|
VMS 1 Connected Welcome to VAX/VMS V5.4-2
|
|
UNIX Reachable BSD
|
|
IRIS Reachable
|
|
|
|
Local> show services
|
|
|
|
Service Name Status Identification
|
|
|
|
VMS 1 Connected Welcome to VAX/VMS V5.4-2
|
|
MODEM Available Dial In And Out
|
|
UNIX Available BSD (RISC)
|
|
|
|
Local> show users
|
|
|
|
Port Username Status Service
|
|
|
|
1 anything Connected VMS
|
|
|
|
Local> show sessions (it'll display YOUR sessions)
|
|
|
|
Port 1: anything Local Mode Current Session: None
|
|
|
|
|
|
** Before proceeding lets have a better look at some Features DECserver 200
|
|
has, needed to understand some interesting things which follow or even some
|
|
things that were previously mentioned.
|
|
|
|
Remote Console Facility (RCF) is a management tool which helps you to
|
|
connect remotely to any server available via it's management port. This
|
|
is not hardware, but a logical port although it still has the same
|
|
characteristics physical ports have.
|
|
|
|
There are Privileged, non-Privileged and Secured ports. These are
|
|
variables you can define by the time you manage to get the privileged account.
|
|
A privileged port accepts all server commands. You can perform tests, define
|
|
server operations, maintain security and all that bullshit. If you don't
|
|
understand it yet, this status is enabled with the SET PRIVILEGED command we
|
|
have used previously.
|
|
|
|
A non-Privileged port can only manage and use commands which affect the
|
|
sessions that are currently connected to a host or node. This is the default
|
|
status of course.
|
|
|
|
A Secured port is something in between. Users can make use of a restricted
|
|
command set to make changes which affect only the port they own ("Property
|
|
is theft but theft is property too, Prounton." Pardon me if the translation
|
|
was destructive to the original meaning of this phrase, and if I piss you off
|
|
every time I start talking about things that are completely irrelevant
|
|
to the grand scheme of things and everything my articles are SUPPOSED
|
|
to deal with).
|
|
|
|
Our little unit has 5 types of passwords and that will help you understand
|
|
how important it is for the whole system.
|
|
|
|
(1) A PRIVILEGED password is what you should be aware of by now. You can
|
|
SET/DEFINE SERVER PRIVILEGED PASSWORD "string", to change it.
|
|
|
|
(2) A LOGIN password prevents the use of the server by unauthorized
|
|
users. This can be enabled for every port or for a single dial-in modem port.
|
|
You must first specify the password for the entire server via SET/DEFINE
|
|
SERVER LOGIN PASSWORD and then, enable or disable it depending on the needs
|
|
of a specified port, via SET/DEFINE PORT x LOGIN PASSWORD ENABLED/DISABLED.
|
|
This password takes effect when you try to login to a port. The prompt is
|
|
a "#" sign, without the double quotes.
|
|
|
|
(3) A MAINTENANCE password prevents unauthorized users from doing remote
|
|
maintenance operations like the one we did after we ran DSVCONFIG.COM.
|
|
"The DECnet service password corresponds to the server maintenance password
|
|
and it is entirely unrelated with the DECserver 200 service password". In
|
|
other words someone who wishes to modify a value in your server must give
|
|
in the NCP> command line, a parameter which specifies your server's
|
|
maintenance password. Of course if this password is set to null (0)
|
|
no password is needed. Also "Digital Equipment Corporation recommends
|
|
against storing the password in the DECnet database (as the DECnet service
|
|
password) and it strongly suggests that you change the maintenance password
|
|
from the default value of 0 to maintain adequate server security"
|
|
...tsk tsk tsk...
|
|
|
|
(4) A SERVICE password protects a service or services defined on the
|
|
server. You can increase or decrease the number of attempts before the server
|
|
gives a message, informing that the connect has failed because of an invalid
|
|
password, via SET/DEFINE SERVER PASSWORD LIMIT.
|
|
|
|
(5) A LOCK password protects your current sessions and port from other
|
|
unwanted human substances. The server accepts no input until you retype the
|
|
password you used for locking it.
|
|
|
|
Finally, a port may be available only for certain users or groups.
|
|
|
|
** As you can see, it can be really tough to break VMS' security if all the
|
|
available measures are taken.
|
|
|
|
Research for modems:
|
|
|
|
Local> show port 8
|
|
|
|
Port 8: Server: IRIS
|
|
|
|
Character Size: 8 Input Speed: 19200
|
|
Flow Control: XON Output Speed: 19200
|
|
Parity: None Modem Control: Disabled
|
|
|
|
Access: Local Local Switch: None
|
|
Backwards Switch: None Name: PORT_8
|
|
Break: Local Session Limit: 4
|
|
Forwards Switch: None Type: Soft
|
|
|
|
Preferred Service: None
|
|
|
|
Authorized Groups: 0
|
|
(Current) Groups: 0
|
|
|
|
Enabled Characteristics:
|
|
|
|
Autobaud, Autoprompt, Broadcast, Input Flow Control, Loss Notification,
|
|
Message Codes, Output Flow Control, Verification
|
|
|
|
Simple configuration, probably nothing or a terminal in there. What this
|
|
screen says is that we have on server IRIS, on port 8, something with character
|
|
size of 8, flow control XON (it could be CTS -hardware-), parity none, input
|
|
speed 19200bps, output speed 19200bps and modem control disabled.
|
|
|
|
All the other information have to do with the server and how it reacts to
|
|
certain things. So if the preferred service was "VMS" and you were logging in
|
|
through port 8, you would immediately connect to the VAX without having the
|
|
server asking you where to log you to. The "break: Local" variable means that
|
|
if you send a break character you will find yourself in the "Local>" prompt even
|
|
if you have been working in the UNIX OS of the "UNIX" host and that lets you
|
|
start multiple sessions. Quite useful. The forward and backward switches are
|
|
for moving around your sessions. Everything can be modified.
|
|
|
|
For more information concerning the parameters have a look at the command
|
|
reference or the help utility.
|
|
|
|
Local> show port 1
|
|
|
|
Port 1: Server: IRIS
|
|
|
|
Character Size: 8 Primary Speed: 9600
|
|
Flow Control: CTS Alternate Speed: 2400
|
|
Parity: None Modem Control: Enabled
|
|
|
|
Access: Dynamic Local Switch: None
|
|
Backwards Switch: None Name: MODEM_1
|
|
Break: Local Session Limit: 4
|
|
Forwards Switch: None Type: Soft
|
|
|
|
Preferred Service: VMS
|
|
|
|
Authorized Groups: 0
|
|
(Current) Groups: 0
|
|
|
|
Enabled Characteristics:
|
|
|
|
Autobaud, Autoconnect, Autoprompt, Broadcast, Dialup, DTRwait,
|
|
Inactivity Logout, Input Flow Control, Loss Notification,
|
|
Message Codes, Output Flow Control, Ring, Security, Verification
|
|
|
|
|
|
And that's, obviously, a modem. The speed, the modem control and the enabled
|
|
characteristics will help you understand even if the name is not helping at
|
|
all. Have a look at the "Alternative Speed" option.
|
|
|
|
What to do now that you have find it?
|
|
|
|
Local> set port 1 modem control disabled
|
|
Local> set service modem port 1
|
|
Local> connect modem
|
|
|
|
|
|
Start programming. This way is a little bit awkward and of course there
|
|
is a possibility that the modem is ALREADY defined as a dial-out modem. You
|
|
are a privileged user, don't forget that. I would recommend not to harm the
|
|
server ("nothing comes from violence and nothing ever good") and to leave
|
|
things as u find them. DO NOT create a permanent dial-out modem service
|
|
(which can be done directly from VMS if you really want to) and DO NOT
|
|
forget that somebody has to pay for your calls and that the line which
|
|
the modem uses, may be limited to certain numbers or even prevent out-dialing
|
|
by hardware. Use your brains...And don't stick in the idea of researching
|
|
modems. You can use a DECserver to infiltrate a system. Don't misuse those
|
|
introductions.
|
|
|
|
Overview of Commands (in alphabetical order)
|
|
|
|
* BACKWARDS
|
|
Goes back to a previous session.
|
|
* BROADCAST
|
|
Sends a message to a port.
|
|
* CLEAR
|
|
Clears a service. It belongs to the Operational Database.
|
|
* CONNECT
|
|
Connects to a service or port.
|
|
* CRASH
|
|
Shuts down the server and reinitializes it.
|
|
* DEFINE
|
|
Defines something. It belongs to the Permanent Database.
|
|
* DISCONNECT
|
|
Disconnects a session or port.
|
|
* FORWARD
|
|
Goes forward to a following session.
|
|
* HELP
|
|
Help.
|
|
* INITIALIZE
|
|
Reboots the server. You can specify a delay in minutes and
|
|
"Local>initialize cancel" if you decide, finally, not to
|
|
do it.
|
|
* LIST
|
|
Displays information on something; Devices,Nodes,Ports,Queue,
|
|
Server, Services, Sessions...
|
|
* LOCK
|
|
Locks your terminal with a password you specify that moment.
|
|
Retype your temporary password to continue.
|
|
* LOGOUT
|
|
Logs out the specified port. If none, your current port.
|
|
* MONITOR
|
|
Devices, Nodes, Ports, Queue, Server, Services, Sessions...
|
|
* PURGE
|
|
Purges a service from the Permanent database.
|
|
* RESUME
|
|
Resumes a session.
|
|
* SET
|
|
Devices, Nodes, Ports, Queue, Server, Services, Sessions,
|
|
Characteristics,Privileged,NONprivileged...It belongs to the
|
|
Operational database.
|
|
* SHOW
|
|
Everything.
|
|
* TEST
|
|
Tests a LOOP, PORT or SERVICE.
|
|
|
|
An interesting Warning Message, just for informational purposes, is the
|
|
following;
|
|
|
|
" Local -120- WARNING - Access to service is not secure
|
|
|
|
Session status information cannot be passed between the
|
|
server and the attached device because modem signals are
|
|
not present. This is not a problem if the device is a
|
|
non-secure printer; however, if the port is a non-LAT
|
|
host system, users could access other users' data. "
|
|
|
|
That's all for now I think.
|
|
|
|
There are many things to explain but there is no reason for doing that right
|
|
now. If you need more information then just have a look at the HELP utility or
|
|
contact me, somehow. [I hope you have not misunderstood my strange looking
|
|
article because my native language is not English]
|
|
|
|
|
|
" Opticon: Don't you think that I'm getting insane?
|
|
TLA: Yeah, sure looks like it..."
|
|
|
|
Love and An-archy to all those who know why.
|
|
|
|
BREAK DOWN THE WALL
|