:-----------------------------------------------------------:
: :
: M A K I N G T H E M O S T O F :
: R S T S / E S Y S T E M S :
: ====================================== :
: :
: Written by : Captain Hack :
: : of Melbourne, :
: : Australia. :
: Written on : 01-Feb-86. :
: File No. : V01A-01 :
: :
:-----------------------------------------------------------:
Originally Displayed in the U.S. on:
P-80 Int'l Information Systems
INTRODUCTION.
This file is a tutorial on making the the most of a
RSTS/E system, making the most could mean anything from
making the system do so neat tricks, to using it to you
advantage, to taking it over completely; depending on your
needs!
For most of the examples you will need an account,
obviously non-privilaged, else you would not be reading this
tutorial. Bear in mind that most, if not all, of the
techniques described can be changed by the sysop. I found
this out while trying them, but most sysop's don't realize
everythings full potential and how it will be used; needless
to say that I most likely have missed out on things. Anyway I
hope you like the tutorial and you have an educational
experience! I will rely on also using your imagination and
ingenuity, as this is often needed.
OBTAINING OLD FILES.
If ever you have a valuble file that you don't want
people to see the contents of for one reason or another,
always write other information (random of fixed) over the
entire file before deleting it. When the system creates a
file it likes to have it continuous if possible, which means
many blocks will be consecutive. When a file is created the
system alters information in a system file indicting that a
particular block or set of blocks have been allocated so as
they will not be over-written. The directory knows which
which blocks are associated with which file, but when you
delete a file, the system flags the used blocks as available
and delete the directory entry. The system doesn't wipe the
information.
To dig up these old blocks, write yourself a program to
open a large file, I will leave the size up to you. You use
the filesize option in the OPEN statement to do this, then
just read in the blocks. When possible use block I/O for file
manipulation because of its speed and convienience. Look
through the blocks any if one if worth keeping save if to
another file.
-2-
Seeing as BASIC programs have line numbers, as long as you
find all the blocks, file reconstruction is easy.
There of course is no guarantee that you will find them
all. Some may have been reallocated, but it's amazing what
you can find! The bigger the block cluster size used in files
the easier it is to reconstruct them. Just experiment!
ANNOYING THE USERS.
A way to annoy the users of the system is a techinque
discovered just after we found out about the block recovery.
After finding remnants of some of my data strewn across the
system I decided the best thing to do was to zero all the
available disk space. One Sunday night we wrote a program to
open a very large file (all free disk space in fact) and
proceeded to zero this. This was sucessful, except when the
system was supposed to kill the file something went wrong and
the file was not deleted. The next morning, before the sysops
arrived, the users tried to login. Because there was no free
space to write login records or do anything! No-one could
login! Apparently this had the operators mystified why they
couldn't get into their system. They had to reboot, or so I
heard, they later worked out what had happended. They then
asked why!
THE PSEUDO KEYBOARD.
The pseudo keyboard (device PKnn:) must be about the most
useful and versatile device. This is the device to be used
for the perfect hack! Originally, like many people, I saw it
in a manual and really didn't read about it but as usual when
I was going over the manuals with a fine tooth comb I read
into it. Although most of the weak-points discussed in this
tutorial can be removed by patching implemented by the system
operator, they are likely to ignore them. The pseudo keyboard
is a keyboard which doesn't physically exist! When you open
the channel and do I/O's with it it appears like another
keyboard. It even has a keyboard number. This is useful for
extracting inormation for your programs that can only be
accessed in command mode. An example of this is SYSTAT. I
recommend that you get hold of a PROGRAMMING MANUAL and read
it thoroughly, including the section on pseudo keyboards.
PASSWORD CATCHING.
Password catching is always desirable if you want access
to a privilaged account! When I first started out we ran a
crude program which did I/O's to the desired terminal and
gave the responses that the system would give. A number of
problems that we ran into was that you cannot fake the whole
system, that is impossible using those methods, and also this
did not allow for timing delays which most users were used to
and expected.
-3-
With these old programs, the passwords obtained never
lasted long because the user almost always knew they had been
caught because users get suspicious when they get an INVALD
ENTRY - TRY AGAIN message when they put in their correct
password. This problem left me pondering how could you write
the "perfect" password catcher. When I discovered pseudo
keyboards I was thinking of applications, then it hit me. Why
not simulate the whole job of another user? It was possible
too!
To do this you write a program to open a channel to the
keyboard where the person will enter the desired account
number and password. You also open a pseudo keyboard.
Basically from then on you pass the data from one to the
other, and you keep checking what is being typed and when the
account number and password are detected save them to a disk
file encoded or what ever. You should continue to simulate
the job until the person logs off. There are a few things to
be careful about. When the person runs SYSTAT make sure the
output is sent to the terminal replaces the pseudo keyboard
number with his keyboard number. Make sure he doesn't see a
channel is open to his terminal and other things like that.
Another things to be careful of is that he doesn't run
programs to tell him his keyboard number or a few other
things like that or a program where the terminal where it is
run from affects its operation, if he does it could be quite
hard to deal with. All of the techniques I describe will need
practice and perfection. Perfect things before using them and
don't tell people what you are doing. Another thing to be
careful of are operators who look at the files in your
account. A simple way to deal with those people is to
encrypt/code those files and keep decoded copies online for
as little time as possible. If you can't stay at a terminal
to have the password catcher program running don't despair
because I will show you how to detach jobs later. My biggest
piece of advice is always stalk and watch the target system
first for a while. Get to know what most or all of the
programs in the project 1 accounts do, and only after you are
sure should you try and pull a stunt like I decribe. Once you
have a privilaged password you must use your own imagination
to how you use it. Remember always be security conscious.
Don't take unneccessary risks and by the time you get to a
privilaged account you should know all the SYS functions
possible and how to use them to your advantage. If you system
keeps login and logout records remember to edit them, because
depending on what you do, your activities should be able to
go on undetected!
DETACHING JOBS.
There is one way a non-privilaged user can detach a job.
This is done using pseudo keyboards. You will need to read
the PROGRAMMING MANUAL (the RSTS/E bible for hackers!) and
write yourself a program to almost simulate a job except you
do it to your terminal and you don't log the passwords etc..
-4-
When you are logged into your account and you run this
program it will look on your terminal like you are logged out
again and you will have to log into the system again. Log
into the account which you want to detach the job from and
you must have access to the program from this account. You
should execute the program you want detached then have a
special key sequence that will close the channel to the
pseudo keyboard. You detacher program will finish and that is
how you do it. ut you say that doesn't work, it just kills
the job you started when you closed the channel to the pseudo
keyboard, but you didn't wait for the most important piece!
When opening the pseudo keyboard you must have included MODE
1 in the OPEN statement which tells the system to detach the
job when you close the channel instead of killing the job.
When you do a SYSTAT you will see your job running detached.
Don't forget opertors mightn't like you detaching too many
jobs so do it when they aren't around. For a job to terminate
itself you may try getting it to run LOGOUT, but when it
tries to output something like a message saying your disk
space or have a nice afternoon it will sit there helpless in
a HB wait state until someone attaches to it (like you or an
operator) or an operator kills it. To get around this take
notice of the message you get when you log in and you have a
job detached. The system tells you that and asks if you want
to attach. So you what you do is make you detached program
open a pseudo keyboard in a mode that won't detach it and get
that job to log into your account. Don't worry about
entrusting your password to the program as others can't
obtain it. Anyway when you get the new job to log in make it
attach to the job you wanted killed, then when your original
program closes the channel to the pseudo keyboard the job
running on the pseudo keyoard is killed and it effectively
kills itself as it attached to itself in a manner of
speaking, and thus the job disappears! (Well it worked on the
system I tried it on)
RECOMMENDATIONS.
When you attempt to do all of this I advise you to get
hold of (buy ($20) or borrow) the RSTS/E PROGRAMMING MANUAL.
There would be at least one with the system and are also
available from DEC (Digital Equipment Corporation).
Finally, non of the above methods and techniques are
guaranteed as they can be removed or altered by the system
operators. All of the techniques are valid and are not bugs
in the operating system. Whether your operator knows about
them or what they can do is a different matter! Anyhow have
fun, RSTS/E is a good operating system, and don't do anything
that I wouldn't do!
