Zines/phrack/44/22.txt

                              ==Phrack Magazine==

                 Volume Four, Issue Forty-Four, File 22 of 27

****************************************************************************


               -- An Introduction to the DECserver 200 --
                     by Opticon The Disassembled


 ANARCHY: "The belief that society
 can be maintained without prisons,
 armies, police or other organized force to
 maintain property rights, collect taxes or
 enforce such personal obligations as debts,
 contracts or alimony." -EB 1966, vol.I
 (taken from the Phrozen Realm)


 "If ur good, nobody knows that ur there"

    The DECserver is a terminal server (WOW!).  The Model 200 is the most
commonly found server in VMS machines.  This device connects up to eight
asynchronous (RS232C) terminals to one or more hosts available on an Ethernet
Local Area Network.

    It is connected to the LAN through an Ethernet physical channel and
supports speeds up to 19.200bps.  It can be found on VAXes, mVAXes and
VAXstations.  It uses the Local Area Transport protocol to communicate with
the other nodes.  It also implements the Terminal Device/Session Management
Protocol to achieve multiple sessions.  Things that can be found plugged on
it include dial-in and out modems, terminals, printers and stuff like that.
The identification code for it in VMS is DS2.  It's software is installed
via VMSINSTAL.COM to SYS$SYSROOT:[DECSERVER] or in SYS$COMMON:[DECSERVER]
for the cluster machines.  And of course now you will ask why should you
be interested in a damn phucking (=relief, back to my native language) SERVER.
A lot of interesting things can be done, like dialing out for free (assuming
you can connect to it in a convenient way).  You can even find a DEC server
200 dedicated to eight high speed modems.  There is no need to say that you
need privileges to phuck up with devices like that...or there is?

..Set Default to SYS$SYSROOT:[DECSERVER] and run DSVCONFIG.COM :

$
$ set default sys$sysroot:[decserver]
$ show default
  SYS$SYSROOT:[DECSERVER]
  =   SYS$SYSROOT:[DECSERVER]
  =   SYS$COMMON:[DECSERVER]
$ @dsvconfig

    You must assign a unique DECnet node name and DECnet node
address for each new DECserver.

Press <RET> to start, or <CTRL/Z> to exit...

      D E C s e r v e r   C o n f i g u r a t i o n   P r o c e d u r e

                                                      Version: V1.7

                               Menu of Options

                       1 - List known DECservers
                       2 - Add a DECserver
                       3 - Swap an existing DECserver
                       4 - Delete an existing DECserver
                       5 - Restore existing DECservers
                  CTRL/Z - Exit from this procedure

        Your selection? 1

DECnet  DECnet Server Service
Address Name   Type   Circuit  Ethernet Address   Load File      Dump File
------- ------ -----  -------  -----------------  -------------  -------------
 1.1    KEYWAY DS200  BNA-0    08-00-2B-07-39-5E  PR0801ENG.SYS  DS2KEYWAY.DMP
 1.2    REVEAL DS200  BNA-0    08-00-2B-28-32-CB  PR0801ENG.SYS  DS2REVEAL.DMP
 1.3    OASIS  DS200  BNA-0    08-00-2B-26-A9-57  PR0801ENG.SYS  DS2OASIS.DMP
 1.4    PAWN   DS200  BNA-0    08-00-2B-24-F3-98  PR0801ENG.SYS  DS2PAWN.DMP
 1.5    OPAQUE DS200  BNA-0    08-00-2B-11-EA-D4  PR0801ENG.SYS  DS2OPAQUE.DMP
 1.6    TOKEN  DS200  BNA-0    08-00-2B-10-64-98  PR0801ENG.SYS  DS2TOKEN.DMP
 1.7    KERNEL DS200  BNA-0    08-00-2B-12-D6-39  PR0801ENG.SYS  DS2KERNEL.DMP
 1.8    IRIS   DS200  BNA-0    08-00-2B-12-D6-39  PR0801ENG.SYS  DS2IRIS.DMP
 1.9    NEBULA DS200  BNA-0    08-00-2B-12-D6-39  PR0801ENG.SYS  DS2NEBULA.DMP

Total of 9 DECservers defined.
(Press RETURN for menu)

Connecting to one of them:

$ mc ncp connect node iris

Console connected (press CTRL/D when finished)
#


     Here you must give a password.  The default one is usually working so try
"access".  Only in "high security" systems they change the default password,
because privileges are needed anyway to access the Network Control Program
(which can be a possible subject for my next article).  But since you are in
using a system account (..privileged) you can change the current password if
you find any good reason for doing so.  More on that later.

DECserver 200 Terminal Server V3.0 (BL33) - LAT V5.1

Please type HELP if you need assistance

Enter username> <type anything here it doesnt really matter>


 You are in.

    In the DECserver there are Permanent and Operational databases.  The
permanent database holds commands which affect the device permanently when
you log out.  In the Operational database whatever you do is temporary and
takes effect only for the time you are logged in.

    Let's go on by trying to get the default privileged account which enables
you to view various things and make changes other than the normal ones.

Local> set privileged
Password> system

    Again the default password should work.

Local> show hosts

Service Name        Status       Identification

VMS               1 Connected    Welcome to VAX/VMS V5.4-2
MODEM               Available    Dial In And Out
UNIX                Available    BSD

Local> show nodes

Node Name           Status       Identification

VMS               1 Connected    Welcome to VAX/VMS V5.4-2
UNIX                Reachable    BSD
IRIS                Reachable

Local> show services

Service Name        Status       Identification

VMS               1 Connected   Welcome to VAX/VMS V5.4-2
MODEM               Available    Dial In And Out
UNIX                Available    BSD (RISC)

Local> show users

Port    Username             Status          Service

  1     anything             Connected       VMS

Local> show sessions (it'll display YOUR sessions)

Port 1:  anything            Local Mode    Current Session: None


** Before proceeding lets have a better look at some Features DECserver 200
has, needed to understand some interesting things which follow or even some
things that were previously mentioned.

    Remote Console Facility (RCF) is a management tool which helps you to
connect remotely to any server available via it's management port.  This
is not hardware, but a logical port although it still has the same
characteristics physical ports have.

    There are Privileged, non-Privileged and Secured ports.  These are
variables you can define by the time you manage to get the privileged account.
A privileged port accepts all server commands.  You can perform tests, define
server operations, maintain security and all that bullshit.  If you don't
understand it yet, this status is enabled with the SET PRIVILEGED command we
have used previously.

    A non-Privileged port can only manage and use commands which affect the
sessions that are currently connected to a host or node.  This is the default
status of course.

    A Secured port is something in between.  Users can make use of a restricted
command set to make changes which affect only the port they own ("Property
is theft but theft is property too, Prounton."  Pardon me if the translation
was destructive to the original meaning of this phrase, and if I piss you off
every time I start talking about things that are completely irrelevant
to the grand scheme of things and everything my articles are SUPPOSED
to deal with).

    Our little unit has 5 types of passwords and that will help you understand
how important it is for the whole system.

    (1) A PRIVILEGED password is what you should be aware of by now.  You can
SET/DEFINE SERVER PRIVILEGED PASSWORD "string", to change it.

    (2) A LOGIN password prevents the use of the server by unauthorized
users.  This can be enabled for every port or for a single dial-in modem port.
You must first specify the password for the entire server via SET/DEFINE
SERVER LOGIN PASSWORD and then, enable or disable it depending on the needs
of a specified port, via SET/DEFINE PORT x LOGIN PASSWORD ENABLED/DISABLED.
This password takes effect when you try to login to a port.  The prompt is
a "#" sign, without the double quotes.

    (3) A MAINTENANCE password prevents unauthorized users from doing remote
maintenance operations like the one we did after we ran DSVCONFIG.COM.
"The DECnet service password corresponds to the server maintenance password
and it is entirely unrelated with the DECserver 200 service password".  In
other words someone who wishes to modify a value in your server must give
in the NCP> command line, a parameter which specifies your server's
maintenance password.  Of course if this password is set to null (0)
no password is needed.  Also "Digital Equipment Corporation recommends
against storing the password in the DECnet database (as the DECnet service
password) and it strongly suggests that you change the maintenance password
from the default value of 0 to maintain adequate server security"
...tsk tsk tsk...

    (4) A SERVICE password protects a service or services defined on the
server.  You can increase or decrease the number of attempts before the server
gives a message, informing that the connect has failed because of an invalid
password, via SET/DEFINE SERVER PASSWORD LIMIT.

    (5) A LOCK password protects your current sessions and port from other
unwanted human substances.  The server accepts no input until you retype the
password you used for locking it.

    Finally, a port may be available only for certain users or groups.

** As you can see, it can be really tough to break VMS' security if all the
available measures are taken.

Research for modems:

Local> show port 8

Port 8:                                Server: IRIS

Character Size:            8           Input Speed:        19200
Flow Control:            XON           Output Speed:       19200
Parity:                 None           Modem Control:   Disabled

Access:                Local           Local Switch:       None
Backwards Switch:       None           Name:             PORT_8
Break:                 Local           Session Limit:         4
Forwards Switch:        None           Type:               Soft

Preferred Service: None

Authorized Groups:   0
(Current)  Groups:   0

Enabled Characteristics:

Autobaud, Autoprompt, Broadcast, Input Flow Control, Loss Notification,
Message Codes, Output Flow Control, Verification

    Simple configuration, probably nothing or a terminal in there.  What this
screen says is that we have on server IRIS, on port 8, something with character
size of 8, flow control XON (it could be CTS -hardware-), parity none, input
speed 19200bps, output speed 19200bps and modem control disabled.

    All the other information have to do with the server and how it reacts to
certain things.  So if the preferred service was "VMS" and you were logging in
through port 8, you would immediately connect to the VAX without having the
server asking you where to log you to.  The "break: Local" variable means that
if you send a break character you will find yourself in the "Local>" prompt even
if you have been working in the UNIX OS of the "UNIX" host and that lets you
start multiple sessions.  Quite useful.  The forward and backward switches are
for moving around your sessions.  Everything can be modified.

    For more information concerning the parameters have a look at the command
reference or the help utility.

Local> show port 1

Port 1:                                Server: IRIS

Character Size:            8           Primary Speed:      9600
Flow Control:            CTS           Alternate Speed:    2400
Parity:                 None           Modem Control:   Enabled

Access:              Dynamic           Local Switch:       None
Backwards Switch:       None           Name:            MODEM_1
Break:                 Local           Session Limit:         4
Forwards Switch:        None           Type:               Soft

Preferred Service: VMS

Authorized Groups:   0
(Current)  Groups:   0

Enabled Characteristics:

Autobaud, Autoconnect, Autoprompt, Broadcast, Dialup, DTRwait,
Inactivity Logout, Input Flow Control, Loss Notification,
Message Codes, Output Flow Control, Ring, Security, Verification


    And that's, obviously, a modem.  The speed, the modem control and the enabled
characteristics will help you understand even if the name is not helping at
all.  Have a look at the "Alternative Speed" option.

    What to do now that you have find it?

Local> set port 1 modem control disabled
Local> set service modem port 1
Local> connect modem


    Start programming.  This way is a little bit awkward and of course there
is a possibility that the modem is ALREADY defined as a dial-out modem.  You
are a privileged user, don't forget that.  I would recommend not to harm the
server ("nothing comes from violence and nothing ever good") and to leave
things as u find them.  DO NOT create a permanent dial-out modem service
(which can be done directly from VMS if you really want to) and DO NOT
forget that somebody has to pay for your calls and that the line which
the modem uses, may be limited to certain numbers or even prevent out-dialing
by hardware.  Use your brains...And don't stick in the idea of researching
modems.  You can use a DECserver to infiltrate a system.  Don't misuse those
introductions.

    Overview of Commands (in alphabetical order)

     *  BACKWARDS
         Goes back to a previous session.
     *  BROADCAST
         Sends a message to a port.
     *  CLEAR
         Clears a service.  It belongs to the Operational Database.
     *  CONNECT
         Connects to a service or port.
     *  CRASH
         Shuts down the server and reinitializes it.
     *  DEFINE
         Defines something.  It belongs to the Permanent Database.
     *  DISCONNECT
         Disconnects a session or port.
     *  FORWARD
         Goes forward to a following session.
     *  HELP
         Help.
     *  INITIALIZE
         Reboots the server.  You can specify a delay in minutes and
         "Local>initialize cancel" if you decide, finally, not to
         do it.
     *  LIST
         Displays information on something; Devices,Nodes,Ports,Queue,
         Server, Services, Sessions...
     *  LOCK
         Locks your terminal with a password you specify that moment.
         Retype your temporary password to continue.
     *  LOGOUT
         Logs out the specified port.  If none, your current port.
     *  MONITOR
         Devices, Nodes, Ports, Queue, Server, Services, Sessions...
     *  PURGE
         Purges a service from the Permanent database.
     *  RESUME
         Resumes a session.
     *  SET
         Devices, Nodes, Ports, Queue, Server, Services, Sessions,
         Characteristics,Privileged,NONprivileged...It belongs to the
         Operational database.
     *  SHOW
         Everything.
     *  TEST
         Tests a LOOP, PORT or SERVICE.

    An interesting Warning Message, just for informational purposes, is the
following;

      " Local -120- WARNING - Access to service is not secure

        Session status information cannot be passed between the
        server and the attached device because modem signals are
        not present.  This is not a problem if the device is a
        non-secure printer; however, if the port is a non-LAT
        host system, users could access other users' data. "

    That's all for now I think.

    There are many things to explain but there is no reason for doing that right
now.  If you need more information then just have a look at the HELP utility or
contact me, somehow.  [I hope you have not misunderstood my strange looking
article because my native language is not English]


    " Opticon: Don't you think that I'm getting insane?
      TLA: Yeah, sure looks like it..."

    Love and An-archy to all those who know why.

 BREAK DOWN THE WALL