13 Jun
1997
13 Jun
'97
5:34 p.m.
I realize this is a little off-topic (last build was about 1987 or 88)
but I have my self in a corner 8-) There are a couple of windows I could
crawl thru if I HAD to.
I have a pristene TI Xenix 386DX16 system.
I have access to one account and - you guessed it - it ain't root!
Nobody seems to remember the root password 8-(
I can't believe that I can't break into this thing! I don't have the
original disks (I haven't dug that far into ALL my docs) but it has
a SCSI Tape drive and two 8 port serial adaptors and some *special* TI
card. It has 2 140 MB MFM drives and I want to keep both the drivers
for the multiport boards and the SCSI board. I think I can get it to
run Linux but I *really* don't want to blow away the Xenix.
So - does any body know where I can find a way into Xenix?
Are there any archives of CERT Advisories on glaring holes I can
worm my way into editing the passwd file or something? I realize
I could run CRACK but since that isn't what I normally do for FUN
I was hoping the mass intellegence and huge experience in this list
might be able to help 8-)
All suggestions are welcome - except blowing it away.
BC
13 Jun
13 Jun
5:51 p.m.
It was thus said that the Great Brett once stated:
I realize this is a little off-topic (last build was about 1987 or 88)
but I have my self in a corner 8-) There are a couple of windows I could
crawl thru if I HAD to.
I have a pristene TI Xenix 386DX16 system.
I have access to one account and - you guessed it - it ain't root!
Nobody seems to remember the root password 8-(
I can't believe that I can't break into this thing!
[snip]
So - does any body know where I can find a way into
Xenix?
There are two I know of off hand that may let you in; one requiring you to
know your Intel 386 Assembly. And both assume you are running certain
programs.
The first is via sendmail. There used to be a way to get into a debugging
mode and have sendmail run arbitrary commands, and since it often ran as
root, this was one way someone could break into a system. The debug mode of
sendmail is the "wizard" mode, but I came onto the e-mail scene just after
this hole was closed (after the Robert Morris Internet Worm of '88). I
don't know more than that, sorry.
The second requires the Intel 386 Assembly and assumes you have fingerd
running (has to be fingerd). What this entails is feeding the fingerd
program too much information, which overwrites the program stack. With
careful programming, the excess information can be code that will then run
arbitrary commands (since fingerd often runs as root). This will also
require you to know where in memory the executable is loaded into so you
provide a valid return address on the stack.
If you don't have either of those, try finding an interactive setuid root
program you can run, as it too, may be possible to overrun an input buffer.
There may be easier ways, I just don't know of them offhand (do you have
access to another Xenix system? Could you mount your drives to it? Can you
boot MS-DOS on it (from the floppy)? If so, you might be able to use Norton
Utilities to scan the harddrive for the password file and modify it there
(and if not Norton, then some other low level disk editor program)).
-spc (Just some ideas ... )
14 Jun
14 Jun
1:59 p.m.
On Fri, 13 Jun 1997, Captain Napalm wrote:
The first is via sendmail. There used to be a way to get into a debugging
mode and have sendmail run arbitrary commands, and since it often ran as
root, this was one way someone could break into a system. The debug mode of
sendmail is the "wizard" mode, but I came onto the e-mail scene just after
this hole was closed (after the Robert Morris Internet Worm of '88). I
don't know more than that, sorry.
sendmail wasn't part of Xenix in those days -- all networking aside from
uucp was extra, and mostly still being developed.
The second requires the Intel 386 Assembly and
assumes you have fingerd
running (has to be fingerd). What this entails is feeding the fingerd
program too much information, which overwrites the program stack. With
careful programming, the excess information can be code that will then run
arbitrary commands (since fingerd often runs as root). This will also
require you to know where in memory the executable is loaded into so you
provide a valid return address on the stack.
No fingerd, either. Or _any_ real networking daemons in Xenix at the
time.
If you don't have either of those, try finding
an interactive setuid root
program you can run, as it too, may be possible to overrun an input buffer.
No real holes that I remember from Xenix in that era -- amazingly secure
for a Unix port in those days.
There may be easier ways, I just don't know of
them offhand (do you have
access to another Xenix system? Could you mount your drives to it? Can you
boot MS-DOS on it (from the floppy)? If so, you might be able to use Norton
Utilities to scan the harddrive for the password file and modify it there
(and if not Norton, then some other low level disk editor program)).
Well, I know that the setuid hole in Profile 16 for Tandy 68000 Xenix
was never fixed. But filePro 16plus for the 386 version didn't have it.
Back when I broke into over half the Tandy 6000 systems in the Radio
Shack Area Training and Support Offices in 1986 (by invitation from
management -- I'm a hacker, not a cracker) my tools were lists of the
employees' names (works nine out of ten times) and knowledge of the
hole in Profile 16. Which I'd already published a fix for. (An
expanded version of which is available in CIS UNIXFORUM under the
filename SECURE.MS -- I'd delete it, but the account with authority to
do so is ancient history).
--
Ward Griffiths
"America is at that awkward stage. It's too late to work within
the system, but too early to shoot the bastards." --Claire Wolfe
22 Jun
22 Jun
3:45 p.m.
On Fri, 13 Jun 1997, Captain Napalm wrote:
It was thus said that the Great Brett once stated:
Networking was not part of the standard Xenix distribution in those
days, so both of those holes are unlikely to be available.
--
Ward Griffiths
"America is at that awkward stage. It's too late to work within
the system, but too early to shoot the bastards." --Claire Wolfe
I have a pristene TI Xenix 386DX16 system.
The first is via sendmail. There used to be a way to get into a debugging
The second requires the Intel 386 Assembly and assumes you have fingerd
running (has to be fingerd). What this entails is feeding the fingerd 
13 Jun
13 Jun
8:04 p.m.
On Fri, 13 Jun 1997, Brett wrote:
Are there any archives of CERT Advisories on glaring
holes I can
worm my way into editing the passwd file or something? I realize
I could run CRACK but since that isn't what I normally do for FUN
I was hoping the mass intellegence and huge experience in this list
might be able to help 8-)
Build a device that taps into the data bus. Make it so that you can set
a memory address using knobs and then the 16-bit value you want to store
in that address. Then put a "fire" button on it that sets that memory
address to the value. Then, find out where your uid is stored in the
kernal, use your device to set the value at that address to 0, press fire
and voila! You are root!
Sam
-------------------------------------------------------------------------------
Computer Historian, Programmer, Musician, Philosopher, Athlete, Writer, Jackass
9:44 p.m.
On Fri, 13 Jun 1997, Sam Ismail wrote:
On Fri, 13 Jun 1997, Brett wrote:
OF COURSE! That's it! How stupid of me! But I think you just got
disinherited! You will NOT be getting my KIM-1 when I'm gone!
8-) 8-)
Thanks Sam - I really do appreciate the - uh - effort 8-)
BC
Are there any archives of CERT Advisories on
glaring holes I can
worm my way into editing the passwd file or something? I realize
I could run CRACK but since that isn't what I normally do for FUN
I was hoping the mass intellegence and huge experience in this list
might be able to help 8-)
Build a device that taps into the data bus. Make it so that you can set
a memory address using knobs and then the 16-bit value you want to store
in that address. Then put a "fire" button on it that sets that memory
address to the value. Then, find out where your uid is stored in the
kernal, use your device to set the value at that address to 0, press fire
and voila! You are root!
9:52 p.m.
On Sat, 14 Jun 1997, Brett wrote:
Oh come now! I should at least get brownie points for creativity! Hmph!
Sam
-------------------------------------------------------------------------------
Computer Historian, Programmer, Musician, Philosopher, Athlete, Writer, Jackass
Build a device
that taps into the data bus. Make it so that you can set
a memory address using knobs and then the 16-bit value you want to store
in that address. Then put a "fire" button on it that sets that memory
address to the value. Then, find out where your uid is stored in the
kernal, use your device to set the value at that address to 0, press fire
and voila! You are root!
OF COURSE! That's it! How stupid of me! But I think you just got
disinherited! You will NOT be getting my KIM-1 when I'm gone!
14 Jun
14 Jun
2:19 p.m.
On Fri, 13 Jun 1997, Sam Ismail wrote:
Build a device that taps into the data bus. Make it
so that you can set
a memory address using knobs and then the 16-bit value you want to store
in that address. Then put a "fire" button on it that sets that memory
address to the value. Then, find out where your uid is stored in the
kernal, use your device to set the value at that address to 0, press fire
and voila! You are root!
crack is easier than finding where the kernel is going to store a UID in
memory. It's not exactly a constant. (But you knew that -- using the
term "uid" gives you away as knowing about processors that handle more
than eight bits at a time 8-)} heretic).
--
Ward Griffiths
"America is at that awkward stage. It's too late to work within
the system, but too early to shoot the bastards." --Claire Wolfe
16 Jun
16 Jun
7:44 a.m.
So - does any body know where I can find a way into
Xenix?
Xenix is now owned by the SCO group, I believe. There is a Usenet
newsgroup dedicated to Xenix called comp.unix.xenix.sco. I don't think
that my school carries the comp.unix hierarchy, but it's easily
accessable via dejanews (www.dejanews.com) or altavista if your ISP
doesn't carry it either.
There might be some old Xenix hacks hanging around in there... or you
may be able to get someone to send you some bootable media that'll get
you to a root shell.
Are there any archives of CERT Advisories on glaring
holes I can
worm my way into editing the passwd file or something? I realize
I could run CRACK but since that isn't what I normally do for FUN
I was hoping the mass intellegence and huge experience in this list
might be able to help 8-)
Mmmm... would be kinda fun. Too bad you can't plug 'er into a network
and let me have a hack at her. Already having an account would
definately help. But if you want, you could e-mail me the passwd file
and I'd set up an idle machine to cracking it and see what turns up.
It'd be worth a shot...
However...
I think that getting bootable media (tape or floppy) is going to be your
best bet... or else try to find the original owner/user.
chris starling
starling(a)umr.edu
9893
days inactive
9902
days old
8 comments
5 participants
participants (5)
-
danjo＠xnet.com -
dastar＠crl.com -
gram＠cnct.com -
spc＠armigeron.com -
starling＠umr.edu