29 Dec
2009
29 Dec
'09
7:06 p.m.
Philip Pemberton wrote:
Josh Dersch wrote:
"bps" does work;
embarrassingly enough the terminal that came with the
Vitek system (A Tektronix 4205, fun!) is affixed with a label that says
"login: bps." I just hadn't taken the time to unpack the terminal until
late last night (well, early this morning). Silly me :).
Definitely an odd hash for the root password, if I can figure out how to
start the machine in single-user mode it'd be trivial to reset it,
otherwise I'll probably do as Al suggested and hack the disk image.
Maybe if I reset the machine without syncing the disks, fsck will fail
on the next boot and drop me into single user mode ;). (Gotta love the
reliability of old UNIX filesystems...)
Now I just need to find a compatible drive to replace the dying one...
I've imaged the two drives, they're up at
http://yahozna.dyndns.org/computers/vitek. Just in the nick of time
too, drive 0 started flaking out this evening and now fails to come
ready most of the time.
I've had a quick play with strings and ghex2 and I think I've come up
with the password file for that machine:
root:QvAAlS1A:0:0:/:/bin/sh
irb1::1:3:/usr/ams/r1:/bin/irbtsh
irb2::2:3:/usr/ams/r2:/bin/irbtsh
arp:1vrorYSd:11:3:/usr:/bin/sh
ams::12:3:/usr/ams:/bin/sh
bactec::13:3:/usr/bactec:/bin/sh
bacrd1::3:3:/usr/bactec:/bin/sh
ims::14:3:/usr/ims/bin:/bin/sh
vid::15:3:/usr/msd:/bin/sh
vidas1::15:3:/usr/msd/bin:/bin/sh
vidas2::15:3:/usr/msd/bin:/bin/sh
vidas3::15:3:/usr/msd/bin:/bin/sh
vidas4::15:3:/usr/msd/bin:/bin/sh
bps::20:3:/usr/bps:/bin/sh
show::94:3:/demo:/demo/bin/bsh
demo::95:3:/demo:/demo/bin/bsh
auto::99:3:/demo:/demo/bin/bsh
I'd be tempted to try logging in as 'bps' or 'demo'; that might get
you a shell (though those accounts look like they might be disabled).
As for the root password, that's too short to be a DES hash. I don't
know of any UNIX system that stored passwords unencrypted in
/etc/passwd, nor can I find any evidence of a password hashing
algorithm that produced an 8-byte base64 hash.
There's also some evidence of a "password recovery" mode in the disk0
image. How to get into that mode is not explained...
Seems fairly likely. Either that or Regulus' disklabel tool only knows
about/supports a small subset of known drives (much like my 3B2, which
is no end of fun finding compatible drives for...)
Thanks,
Josh
They're both Quantum ProDrive 40S drives.
Interestingly the two disc images carry the text "Miniscribe 8051p"
and "Miniscribe 8051d" in the first few bytes. I wonder if the machine
originally came with drives of that type, which were later 'dd' copied
from one to the other.