ShadowSpawn BBS Presents.. ------------------------------------------------------------------------------- INSIDE RSTS/E VOLUME IV ------------------------ By: The Marauder The Legion of Hackers ! The information in this document is intended for informational purposes only Written - December 11, 1984. Zone communications, LOH ------------------------------------------------------------------------------- In this document, I will describe how to create, delete, and edit accounts, and how to modify the System Account file to help escape detection I will assume for the most part, that you have read my earlier files on RSTS/E and/or have a working knowledge of the RSTS/E Runtime System. 1) CREATING ACCOUNTS. On all versions of RSTS/E lower than V9, the system manager uses a program called 'REACT', to create new accounts, and to remove old ones. REACT resides normally in the system library account (1,2), under the name 'REACT.BAC', or 'REACT.TSK', depending on who installed the system. If you don't find it in (1,2), do a 'DIR(*,*)REACT.*', And find out where It's been moved to. To run the program, you must have privleges, (run it from a (1,*) account). Usage of the program is as follows: (from 'Ready') RUN $REACT REACT V7.2-04 RSTS V7.2-04 LOD/H TIMESHARING SYSTEM ACCOUNT MANAGER FUNCTION? E PROJ,PROG? 1,233 DISK:PASSWORD? LOH QUOTA? 0 CLUSTER SIZE? 16 ACCOUNT NAME? LOH USERS PROJ,PROG? ^Z READY DESCRIPTION OF OPTIONS: Function? - This is where you specify whether you are deleting, or creating an account it can be one of two choices: 1) E= E)NTER/CREATE an Account. 2) D = D)elete an account. NOTE: When deleting an account, the account must be completely empty (use 'PIP (P,PN)/ZE), Otherwise the error message '?Account in use..' Will result. Proj,Prog? This is where you enter the Project-Programmer number of the account, you wish to create (or delete), it must be two numbers between 1, and 255 (inclusivley), seperated by a comma. (Ie. 1,33 - 50,50 - 2,20 - Etc..) If you are deleting an account, it should be the PPN of the account you wish to delete. Password? This is where you enter the password you want assigned to tha account, enter the password in the format: "XXXXXX" where "XXXXXX" = 1 to 6 upper case letters, or numbers, or a combination of both.. (Ie. LOD1, 1234, A1B2C, etc..) NOTE: Some versions of REACT will respond with 'Disk:password?', Allowing you to specify which disk you want the account to be created on, and it's password. In either case, just enter the password, and ignore the disk qualifier, since you can only log into accounts that reside on the system (SY:) disk, it's for the most part useless to create an Account on say 'DB1:', unless you wish to use it for storage purposes only. If you have reason to create an account on any other disk than the system disk, you would use the format: "Disk:password? DB1:PASSWD". To access this account, you will either Have to be in a privleged account (thus allowing you access to any other account on the system, or be logged into a 'mirror' account on the system disk, for example, say you created an account DB1:(40,40), to acess this, would have to be logged into account SY:(40,40), to modify anything in the account DB1:(40,40). In any case, if you recieve the 'Disk:password? Prompt, and wish to create an account on the system disk, (one that you can actually log into, just enter the password you have selected. Quota? This is where you set the maximum size of disk space (in blocks) That the account can have. It can be from 0 to 32767, (inclusivly). Selecting a Quota size of '0' (zero), gives the account unlimited space. Cluster size? This must match the clustersize of the system disk, it can be 4,8, or 16, (16 being the most common), you can find the system clustersize by using the 'SYSTAT' command, or if that is unavailable, use trial and error, if the clustersize you enter at this point does not correspond with the system cluster size, an error message will result, so just try tne next size up until it matches. Account name? This is a symbolic 'Account name', that is basically not used anywhere except in the file '$ACCT.SYS' (which will be discussed in detail later), you can give it any name you want, for the above example I used the name 'LOD USERS', in reality I would probably just hit at this question, thus giving it no name. If the above questions were answered with valid responses, REACT would now create the specified account (1-6 seconds, depending on the system performance) And a description of the account (PPN, Disk, Password, etc.. ), Will be entered into the file '$ACCT.SYS'. NOTE: When using the 'D - Delete' command, you will be asked only the following FUNCTION? D PROJ,PROG? 30,30 DISK? SY: 'D' being the 'DELETE' specification, "30,30" being the account you wish to delete, and "SY:" being the disk that account (30,30) currently exists on. If the account was empty, REACT would remove this account. (Although refrence to the account, will still exist in the file '$ACCT.SYS') In both cases (after the account has been Created, or Deleted), REACT will return to: "Proj,Prog?", If you have additional accounts to Create, or Delete, you can enter them now, if you are done, hit "^Z" (control Z) to exit. 2) DESCRIPTION OF THE SYSTEM ACCOUNT FILE ($ACCT.SYS). The file '(1,2)ACCT.SYS', is the System Account file. It is a file that contains descriptions of the accounts that are on the system, such as the Account Name, it's Password, etc.. Contrary to popular beleif, it is -NOT- where RSTS/E looks to find the Password & other information, when a Person is logging in. It is simply a symbolic file, used by the System Manager to help keep track of what accounts are being used. It is a standard ASCII file, that is opened in 'APPEND' mode when REACT is used to create a file. It is quite useful for obtaining other accounts, especially if you are a Non-Privleged user, and have found a program on the system that will allow you to dump files anywhere (such as some versions of $RPGDMP.TSK) You would simply dump this file, it should look something like this: 1, 1,SY:DEMO ,0,16,SYSM 0, 1,SY:SYSPAK,0,16 1, 2,SY:DEMO ,0,16,SYSTEM LIBRARY 1, 3,SY:AUXLIB,0,16,AUXILLIARY LIBRARY 30,10,DB1:TEMP ,0,16,TEMPORARY STORAGE 50,10,SY:KEVIN ,1000,16,KEVIN'S ACCOUNT ETC.. Column 1 - is the account # (PPN) 2 - the disk the account resides on, and the account's password. 3 - Is the the accounts Quota (see above) 4 - the accounts Clustersize. 5 - The account's Symbolic name. 1, 1 - Tells you that this is the description of account (1,1). SY:DEMO - tells you that the password to account (1,1) is 'DEMO', and that it resides on the system (SY:) disk, thus you can actually log into it. 0 - Say's that the the Quota for account (1,1) is '0' (unlimited) 16 - The Clustersize for account (1,1) is 16. SYSM - is the symbolic name for account (1,1), this is the only place I have actually seen the 'Symbolic Name' actually refrenced to. It has no other use than to help the System Manager determine what purpose the account serves (while looking through $ACCT.SYS), it is most often used in school systems, where the Student's name, who is the owner of said account, would be used for it's symbolic name. MISC NOTES ABOUT REACT & $ACCT.SYS - As I said above, every time an account is created using 'REACT', an entry is made into $ACCT.SYS. When an account is deleted though, REACT -DOES NOT- Remove the entry from ACCT.SYS, so if you were to make 10 accounts then remove them, refrence to them would STILL exist in ACCT.SYS, Which would Immediatly raise the suspicion of even the most naieve System Manager next time He took a look into ACCT.SYS. Fortunatly the file $ACCT.SYS, is a standard ASCII file, so you can use any text editor available on the system to actually Remove the entries in it. Simply 'TECO $ACCT.SYS', and search for the account's and delete the entire line. NOTE 1 - I would also advise editing $ACCT.SYS, after you create -ANY- account (Ones that you wish to be permanent), this makes your account a little less obvious, and unless a System Manager either sees you on the system or happens to do a "DIR (*,*)" and by luck notices it. He will not find refrence to it in $ACCT.SYS. NOTE 2 - The information in $ACCT.SYS is NOT alway's 100% accurate, for example if the password to an account is changed (with UTILTY, or a custom program - to be discussed in a future volume), this DOES NOT update the information in $ACCT.SYS. This is especially common in schools Where the students are assigned a standard password, and encouraged to change it as soon as possible. Fortunatly though, the privleged accounts's are not changed as often, and you can usually come up with at the worst, one privleged account/password, and use the program "(1,2)MONEY", or a small user written program to find every password on the System. Here is a small program that will display the password for any account, given The PPN (accout number). It does of course, require privleges to run. 1 ! LOGPAS - V1.0-00 2 ! AUTHOR - THE MARAUDER 3 ! COPYRIGHT (C) - 1985,86,87 - LOH COMMUNICATIONS. 4 ! 5 EXTEND 10 ON ERROR GOTO 500 20 DIM M%(30%) : DIM T%(30%) 30 INPUT 'ACCOUNT NUMBER (P,PN) ';PROJ%,PROG% 40 M%(I%)=0% FOR I% = 1% TO 30% 45 T%(I%)=0% FOR I% = 1% TO 30% 50 M%(0%) = 9% 55 M%(1%) = 6% 60 M%(2%) = 14% 65 M%(7%) = PROG% 79 M%(8%) = PROJ% 80 CHANGE M% TO M$ 85 T$ = SYS(M$) 90 CHANGE T$ TO T% 95 PSW$ = RAD$(T%(9%)+SWAP%((T%(10%)))+RAD$(T%(11%)+SWAP%(T%(12%))) 100 PRINT 'PASSWORD = ';PSW$ 110 GOTO 30 500 PRINT 'INVALID ACCOUNT NUMBER - ';PROJ;',';PROG 32766 NO EXTEND 32767 END To use this program, simply type it in at the RSTS/E BASIC parser (at 'Ready'), or upload (as an ASCII file, the above program, directly to the RSTS/E BASIC parser. And type 'RUN', it will ask you for an account (PROJ,PROG?), enter the account you want the password for, and it will be printed out. Use ^C (control C) to exit from the program. That's about it for this issue, until the next volume, Dial with care... The Marauder ------------------------------------------------------------------------------- This Document, is the property of the Legion of Hackers as a whole. Sysops are free to use it, as long as nothing is changed. Any questions, comments, or corrections, can be made directly to me, at my BBS, The Twilight Zone, or to any member of the Legion of Hackers. ===============================================================================