Dave Dunfield wrote:
try doing a
"POVF" and reporting what is there. Also type "WHAT"
POVF gives me:
POVF
4585- 4585 : 1 46976- 46980 : 5 46982- 46990 : 9
46994- 46999 : 6 47040- 47077 : 38 47084- 47088 : 5
-- Many more lines deleted for brevity - I can send off-list if useful --
51330- 51669 : 340 51671- 52227 : 557 52229- 52340 : 112
52342- 52351 : 10 52353- 74623 : 22271
ADDITIONAL FRAMES : 826
TOTAL NUMBER OF AVAILABLE FRAMES : 26139
from below and above:
you have 512K system which is a fairly large system.
you have 8 active ports. 9 processes, 1 / port, 1 for the print spooler
process
768 PCB0 means you have 768 abs frames, which contain the system code.
from frame 768 to 4485 are the workspaces for the 9
processes, and also
PCB's. Picks virtual architecture requres at any time a
PCB, code to
execute in any give ABS frame, and a monitor construct called a PIB.
there is
only one PIB / process, but there is a main PCB for the code to run in, and
a special PCB for each process to run the debugger context in.
the system file is laid down at 4485 and has 27 base frames (modulo = 1)
a Maxfid of 74623 implies a 75mb disk if the frame sicze is 1024 and 35mb
if it is 512. you have therefore got about 1/3 your space free.
if you can dump a frame, say the first frame of the system frame we can
infer from that dump what the frame size is. IIRC "DUMP 4485 (X" will
give a hex dump. if it goes to 512, then we have 512 byte frames and
the total system size id 74523 is multiplied by 512 to give the above
estimate of 35mb, etc. Pick systems have been implemented with up
to 4096 byte frames. more on the frames later.
WHAT gives me:
WHAT
00:04:08 23 SEP 1988 MAXUSERS [8] CURRENT # USERS [1]
CORE LINES PROCESSES PCB0 WSSTART WSSIZE SYSBASE/MODULO MAXFID OVRFLW
512K 8 9 768 1056 127 4485 27 74623 26139
GROUP AND EXECUTION LOCKS (LOCK-PROCESS)
*000 000300 FF20 121.000 121.1BC 166.586
005 0003A0 BF00 170.06A 170.0B4
007 0003E0 BF00 170.06A 170.0B4
008 000400 BF00 170.06A 170.13C
THE SPOOLER IS INACTIVE.
PRINTER # 0 IS SERIAL AND INACTIVE.
THE PRINTER IS RUNNING ON PROCESS 7.
ASSIGNED OUTPUT QUEUES: 0.
THE NUMBER OF INTER-JOB PAGES TO EJECT IS 0.
PRINTER # 1 IS SERIAL AND INACTIVE.
THE PRINTER IS RUNNING ON PROCESS 5.
ASSIGNED OUTPUT QUEUES: 1.
THE NUMBER OF INTER-JOB PAGES TO EJECT IS 0.
Thanks for the other warnings and hints...
The system really is not that insecure, as there
was and is the
issue of how secure a software system can be without the
encryption that is integrated into laptops today, if you have
physical access to the machine. And the only place the
exploit you pulled can happen is on the console, so if you
secured the console and the connection and the machine,
you were okay. and it was not feasible to be more secure
as in encyrpting everything back then.
Agreed - now that I'm in to it, I've found a "whole bunch" of
accounts which have no passwords and can get to a shell.
Several of them with "high privilege.... But if these acounts
were either removed or properly password protected, they
would not present the gaping hole in security that I
exploited.
Btw, Why could this exploit not happen on another port or
the dial-in line ... Are the various system accounts (BACKUP
etc.) not accessable from all the ports (I tried from PORT-1
and it worked) - Does the BREAK interrupt not work from
a dial-up line? -- Just curious as to why this "hole" would
not be accessable from a more remote terminal.
the reason for mentioning securing the console or port 0, is that the system
always boots up on that. therefore there are never any spurious breaks
to annoy you. once the system releases the other lines to run and accept
logons, they dont get the spooler startup window, they all just get
LOGON PLEASE, which does not have the hole (in theory)
BTW, the behaviour of hanging your console with a break probably is
due to the fact that you can do break while in the kernel. before the
system goes "virtual" and runs the other lines and allows logins, all
the async I/O is done by the kernal, and is frequently not designed
by the kernel coders to be tolerant of breaks. just a fact of life with
what pick systems did.
the open sys2 accounts are inexcusible. that is just sloppy system
administration.
one of the things that pick did was to turn people who usually had
adding machines next to their desks into system administrators, and
as you will find programmers. This lead to some leaps in what you
could expect in skills with the site that ran pick. It is worse than
now because there was no way to point to examples of how things
like these accounts could bite you so even if our documentaiton
and training said to get rid of them, there was always some guy
who figured if the acocunts were unknown, noone would log
into them. it gets worse from there.
>when you get a Dave account try the following
Hello
>world program
>
>CREATE-FILE MYBP
>
>ED MYBP HELLO
>
>
if the above
works, you are cooking.
Well... I used CREATE-ACCOUNT to create a DAVE
account - It asked me 4-5 rather terse/cryptic questions to
which I accepted the defaults. This created an account
which I could log in to, h
I am thinking that maybe you need SYS1 privileges to create files.
I suspect that DAVE got created with SYS0.
on SYSPROG try the following:
CT SYSTEM DAVE
that will show us what the account can do.
if there is a SYS0, we can try an edit of the dictionary,
but that may be prevented. some pick systems tried
to put in protections on editing the system dictionary
as a reliability factor. I am not that familiar with ADDS
and it may take a utility to modify the account.
if you can do the following we can get some more info
on the system utilities.
If it isn't too long, do the following: on SYSPROG
LIST BP
LISTVERBS
and publish that. It will give hints about the system utilites
names. if that turns out to be to long, see where Jay
can put it out of line so we don't have a huge junk message.
owever
CREATE-FILE advises me that I do not have sufficent
privilege to use this command!
So I decided to try from the GAMES account since it lets
me get to a TCL prompt, and does not appear to be a
privileged account.
'CREATE-FILE MYBP' results in this error message:
CREATE-FILE MYBP
[416] RANGE ERROR IN MODULO PARAMETER.
I don't have a system to try this on, sorry.
CREATE-FILE MYBP 1,1 17,1
need dictionay and data section sizes.
Looks like it wants a parameter of some kind - tried
'CREATE-FILE MYBP 10' and got the same result, and
don't want to try too much else without knowing what
I'm actually doing - going to see if I can pickup a PICK
book or docs .... But if you can suggest resolutions to
the above (ie: How to create an account where you can
make files, and how to actually create the file)... that
would be helpful, as I agree that a "safe" account for
experimentation would be a good idea.
On the more positive side, I believe I have successfully
created two SYSGEN tapes - they can be booted (and it
works), but I have not tried performing an actual restore
from them ...
We are supposed to be getting high-speed wireless access in my
area within the next month or two ... If it works reliably (big if), I am
hoping to get a server set up here eventually which I can use to
make various classic systems available for on-line demos.. The
Mentor would be a good candidate - but given your warnings about
three-character death incantations, I don't know that I would make
the privileged users generally available...
I would never let SYSPROG be available on the net. I would rather have an
R83 system online which could be restored than have a classic that could
not.
I guess at some time we should poke inside and see if the disk is a common
one, and maybe you can do a swap and restore your backups. then we will
have it made about keeping it running. I would never do a restore on the
physical disk you have unless it forces you to. so the best approach will
to be to try to find an identical one somewhere and put it in to try the
restore
on.
Dave
--
dave06a (at) Dave Dunfield
dunfield (dot) Firmware development services & tools:
www.dunfield.com
com Collector of vintage computing equipment:
http://www.parse.com/~ddunfield/museum/index.html