A little guidance - TI Xenix

It was thus said that the Great Brett once stated: [snip] There are two I know of off hand that may let you in; one requiring you to know your Intel 386 Assembly. And both assume you are running certain programs. The first is via sendmail. There used to be a way to get into a debugging mode and have sendmail run arbitrary commands, and since it often ran as root, this was one way someone could break into a system. The debug mode of sendmail is the "wizard" mode, but I came onto the e-mail scene just after this hole was closed (after the Robert Morris Internet Worm of '88). I don't know more than that, sorry. The second requires the Intel 386 Assembly and assumes you have fingerd running (has to be fingerd). What this entails is feeding the fingerd program too much information, which overwrites the program stack. With careful programming, the excess information can be code that will then run arbitrary commands (since fingerd often runs as root). This will also require you to know where in memory the executable is loaded into so you provide a valid return address on the stack. If you don't have either of those, try finding an interactive setuid root program you can run, as it too, may be possible to overrun an input buffer. There may be easier ways, I just don't know of them offhand (do you have access to another Xenix system? Could you mount your drives to it? Can you boot MS-DOS on it (from the floppy)? If so, you might be able to use Norton Utilities to scan the harddrive for the password file and modify it there (and if not Norton, then some other low level disk editor program)). -spc (Just some ideas ... )