[CCTALK] DEC Unix (Break-in) DIgital Dec3000/500 Flamingo

From: Ethan Dicks <erd_6502_at_yahoo.com>
Date: Wed May 15 13:20:52 2002

--- "Truthan,Larry" <truthanl_at_oclc.org> wrote:
> Ethan Dicks wrote:
> >
> > >I'm trying to break into (my own) DEC Alpha running Digital Unix
> V3.2...
>
> COINCIDENTLY: I was trying to break into a DEC 3000/500 system I
> inherited from a launched development project here at OCLC.

Funny... seeing as how I'm a couple of miles down the road from you.
 
> Rick Murphy's post also got me into single user mode on my system, But
> unlike you I haven't a Clue on how to edit the password files now that I
> am In.

Do you know vi? Is that part of the problem?
 
> My system has Digital Unix V4.0D (rev 878) May 5 1998
>
> During the Boot the system changes Fonts and goes to 1280X1024 Mode
> My system has 224 MBytes of Ram 2 RZ25 drives, one RZ26 drive, one
> RRD42 cd drive and a TLZ06 tape transport.

Decently equipped. Nice little box.

> It also has the DEC lance ethernet installed.

That's standard for a DEC box (old Suns, too... 7990 chip)

Nice. If you get tired of it, I'm sure I can make the long drive to
save it. :-)
 
> So how do I edit the root password from here? This is my first foray
> into unix admin....

OK... if you've gotten into single-user mode, you need to remount the
root filesystem read/write (it's currently read-only).

It was in a previous post... it's something like...

  mount -u /

(I didn't stop to think about it last night; it is an example in the
man page - /usr/man/man1/mount.1, IIRC)

Now, you can edit it, but you don't even have vi...

  fsck /usr
  mount /usr

Now you have vi.

  TERM=vt100
  export TERM

Now vi knows how to format control strings to your console.

The "approved" method of editing the password file on a BSDish machine
is vipw (vi the passwd file). It establishes a lock, creates a temp
file and only twiddles the real file while locked. This prevents two
admins from clobbering the passwd file (which is bad, mmmkay?)

I learned last night (this morning ;-) that vipw also calls mkpasswd,
which produces a hashed-password file that is used to "quickly access"
passwords for verification, so that each login attempt does not re-do
the work of the others... it's a feature. Really.

You can vi /etc/passwd and remove what's in between the second and
third colons, then run mkpasswd with (I think) no options and it
has the right defaults. You can run vipw and make the same edit,
and it automatically runs mkpasswd. For my first try last night,
I used the passwd command to change the root password, but it didn't
stick. I had to use passwd _then_ mkpasswd. That stuck. Mind you,
the password file looked perfect. The problem was this hidden,
hashed file. Under Solaris, etc., I'm used to editing the /etc/shadow
file. This DU/BSDish thing is too new for me.

Once you have edited the password file, you can hit control-D to
exit your single-user shell and the startup will proceed as normal.
You can then login with your new root password.

Feel free to drop me a line off-list if you need further assistance.

-ethan




__________________________________________________
Do You Yahoo!?
LAUNCH - Your Yahoo! Music Experience
http://launch.yahoo.com
Received on Wed May 15 2002 - 13:20:52 BST

This archive was generated by hypermail 2.3.0 : Fri Oct 10 2014 - 23:35:16 BST