358 lines
16 KiB
Plaintext
358 lines
16 KiB
Plaintext
|
|
************************ bioc agent 003's tutorial in ************************
|
|
* *
|
|
* ==================== *
|
|
* =hacking the hp2000= *
|
|
* ==================== *
|
|
* *
|
|
******************************************************************************
|
|
|
|
preface
|
|
-------
|
|
|
|
the purpose of this tutorial is to give potential hackers useful information
|
|
about hewlett-packard's hp2000 systems. the following notation will be used
|
|
throughout this tutorial:
|
|
|
|
<cr> - carriage return, return, enter, etc.
|
|
^c - a control character (control-c in example)
|
|
capital letters - computer output & user input
|
|
|
|
|
|
system information
|
|
------------------
|
|
|
|
each hp2000 system can support upto 32 users in a timeshared basic (tsb)
|
|
environment. the systems usually run a version of hewlett packard's
|
|
timeshared/basic 2000 (various levels).
|
|
|
|
|
|
logon procedure
|
|
---------------
|
|
|
|
once connected to a hp2000, type a nume ral followed by a <cr>. the system
|
|
should then respond with: please log i n. if it does not immediately respond
|
|
keep on trying this procedure u ntil it does (they tend to be slow to respond).
|
|
|
|
user id: the user id consists of a let ter followed by 3 digits, eg, h241.
|
|
|
|
password: the passwords are from 1 to 6 printing and/or non-printing (control)
|
|
characters. the following c
|
|
haracters will not be found in any passwords so don't bother tr ying them: line
|
|
delete (^x), null (^@), return (^m), linefeed (^j), x-off (^s), rubout,
|
|
comma (^l), space (^), back arrow (<-), & und erscore (_). hp also
|
|
suggests that ^e is not used in passwords (bu t i have seen it done!).
|
|
|
|
the logon format is: hello-a123,passwd
|
|
|
|
where: hello is the logi n command. it may be abbreviated to
|
|
hel. a123 is the
|
|
user id & passwd is the password.
|
|
|
|
the system will respond with either ill egal format or illegal access depending
|
|
upon whether you screwed up the syntax or it is an invalid user id or password.
|
|
the messages: please log in, illegal f ormat, & illegal access also help you
|
|
identify hp2000 systems.
|
|
|
|
the system may also respond with all po rts are busy now - please try again
|
|
later or a similar message. one other possibility is no time left which means
|
|
that they have used up their time limit without paying.
|
|
|
|
unlike other systems where you have a c ertain amount of tries to login, the
|
|
hp2000 system gives you a certain time limit to logon before it dumps you. the
|
|
system default is 120 seconds (2 mi nutes). the sysop can change it to be
|
|
anywhere between 1 and 255 seconds, tho ugh. in my experience, 120 seconds is
|
|
sufficient time for trying between 20-3 0 logon attempts while hand-hacking & a
|
|
much higher amount when using a hacki ng program.
|
|
|
|
users
|
|
-----
|
|
|
|
the various users are identified by the ir user id (a123) & password. users are
|
|
also identified by their group. ea ch group consists of 100 users. for
|
|
example, a000 through a099 is a group, a100 through a199 is another group, &
|
|
z900 through z999 is the last possible group. the first user id in each group
|
|
is designated as the group master & he has certain privileges. for example,
|
|
a000, a100,...h200..., & z900 are all g roup masters. the user id a000 is known
|
|
as the system master & he has the most privileges (besides the hardwired sysop
|
|
terminal). the library associated with user z999 can be used to store a hello
|
|
program which is executed each time som eone logs on.
|
|
|
|
so, the best thing to hack on an hp2000 system is the system master (a000)
|
|
account. it is also the only user id t hat must be on the system. he logs on by
|
|
typing: hel-a000,passwd. you just have to hack out his password. if you decide
|
|
to hack z999, you can create or change the hello program to give every user your
|
|
own personal message every time he logs on! this is about all you can do with
|
|
z999 though since it is otherwise a non-privileged account.
|
|
|
|
library organization
|
|
--------------------
|
|
|
|
each user has access to 3 levels of lib raries: his own private library, a
|
|
group library, and the system library. to see what is in these libraries you
|
|
would type: catalog, group, & library respectively (all commands can be
|
|
abbreviated to the first 3 letters). t he individual user is responsible for
|
|
his own library and maintaning all the files. if a program is in your catalog,
|
|
then you can change it.
|
|
|
|
[group masters]
|
|
|
|
group masters (gm) are responsible for controling all programs in the group
|
|
libraries. only members of the group c an use these programs. these are viewed
|
|
by typing group. for example, user s50 0 controls all programs in the group
|
|
library of all users beginning with id s5xx. other users in the group cannot
|
|
modify these programs. all programs in the group library are also in the group
|
|
masters private library (catalog) , therefore he can modify them! the group
|
|
master also has access to 2 privi leged commands. they are: protect &
|
|
unprotect. with protect, the group mas ter can render a program so it cannot be
|
|
listed, saved, csaved, punched to pa per tape, or xpunched. for example, if the
|
|
gm typed pro-wumpus, other users in the group would be able to run wumpus but
|
|
they would not be able to list it. the gm can remove these restrictions with the
|
|
unprotect command.
|
|
|
|
[system master]
|
|
|
|
there is exactly one system master (sm) and his user id is a000. he can protect
|
|
& unprotect programs in the sys tem library. all users have access to these
|
|
files by typing library to view t hem. only the system master can modify these
|
|
files since his private library & group library constitute the system library.
|
|
the sm also has access to oth er privileged commands such as:
|
|
|
|
directory: this command will printout all files and programs stored on the
|
|
sysBem according to users.
|
|
dir will print out the entire directory. dir-s500 will s
|
|
tart listing the directory with user s500.
|
|
|
|
example:
|
|
|
|
dir
|
|
boces ed 1 053/84 1243
|
|
|
|
id name date length disc
|
|
drum
|
|
a000 alpha 043/84 00498 001384
|
|
bckgmn 053/84 04564 001526
|
|
fprint 053/84 00567 002077
|
|
stock 038/84 04332 002753
|
|
tfile 020/83 f 00028 002804
|
|
wumpus 053/84 p 02636 003142
|
|
b451 bljack 316/75 03088 011887
|
|
golf 316/75 02773 011911
|
|
s500 gis 050/84 c 03120 019061
|
|
giscl4 050/84 f 03741 022299
|
|
z999 hello 021/84 00058 011863
|
|
|
|
in this example, the system name is boc es ed 1. the date of the printout is
|
|
the 53rd day of 1984 (053/84) and the t ime is 12:43 (24-hr). the files
|
|
appearing under a000 are those in the s ystem library. the date associated with
|
|
the program is the date it was last ref erenced. the length is how long it is
|
|
in words. disc refers to its storage b lock location on one of the hard drives.
|
|
drum refers to its location on the drum storage unit. only sanctified programs
|
|
are stored on a drum to increase their access time. the letters after the date
|
|
refer to f if it is a file, p means it is protected, and c means the program is
|
|
compiled. in the example the system pr ogram, wumpus, was last used on the 53rd
|
|
day of 1984 (2-22-84); it is currently unlistable (protected) and it occupies
|
|
2636 words of memory starting at disc b lock 3142. the command sdirectory will
|
|
print out programs that are only stored on drum. most system directories are
|
|
usually longer than the0example. the a bove example is an abridged version of a
|
|
43 page directory! the <break> key wil l stop the listing if necessary.
|
|
|
|
|
|
report
|
|
|
|
the report command will show the user i d, how much terminal time they have used
|
|
since the last billing period (in minut es), and how much disc space they are
|
|
using.
|
|
|
|
example:
|
|
|
|
report
|
|
boces ed 1 055/84 1905
|
|
|
|
id time space id time space id time space
|
|
a000 01150 12625 b451 00003 05861 b864 00000 00000
|
|
s500 00235 06861 s543 00421 00000 z999 00000 00058
|
|
|
|
the advantage of hacking the a000 passw ord first is that you can use the
|
|
privileged commands to see which which user id's exist and what programs are
|
|
stored where so that you can further pe netrate the system.
|
|
|
|
|
|
port
|
|
|
|
this command tells the character size a nd baud rate at which each of the 32
|
|
ports are configured. it is in the for mat c-bbb, where c=character size &
|
|
bbb=baud rate. it is set up in columns of 8. the first row corresponds to
|
|
ports 0-7, the second row corresponds t o 8-15, etc. this is generally useless
|
|
in my opinion. also, the ports are usu ally only configured separately if the
|
|
terminals are all hard-wired.
|
|
|
|
|
|
status
|
|
|
|
this command allows the sm to view info rmation concerning the mass-storage
|
|
devices. it gives current locations of the id table, user swap areas, line
|
|
printer status, etc. it tends to hold alot of info if it is read correctly.
|
|
unfortunately, i don't have the room to fully discuss it here.
|
|
|
|
since all logins & logouts are printed at the system console along with other
|
|
pertinent information, i would strongly suggest that you avoid extensive use of
|
|
an a000 password if you find one.
|
|
|
|
the system operator has access to alot of other commands. unfortunately, he is
|
|
situated at the system console which is hard-wired to the computer. if anyone
|
|
figures out a way to give a remote user sysop privileges, let me know & i can
|
|
help you with his commands.
|
|
|
|
|
|
non-privileged commands
|
|
-----------------------
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
library - lists the system programs. t here is only 1 system library & any user
|
|
can access it.
|
|
example:
|
|
|
|
library
|
|
name length name length na me length name length
|
|
alpha 498 bckgmn 4564 fpr int 567 stock 4332
|
|
tfile f 28 wumpus p 2636
|
|
|
|
this uses the same notation as the priv ileged directory command.
|
|
|
|
to retrieve a program from the system l ibrary, you would type:
|
|
|
|
get-$name (to load the stock pro gram, you would type get-$stock)
|
|
|
|
you can then run or list it. if you at tempted to list wumpus which is
|
|
protected (p), it would say run only.
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
group - lists all files in your group. it is in the same format as the library
|
|
command.
|
|
|
|
to retrieve a program from your group l ibrary, you would type:
|
|
|
|
get-*name
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
catalog - lists all files in your perso nal library. it is also in the same
|
|
format as the library command
|
|
|
|
|
|
to retrive a program in your personal l ibrary, you would type:
|
|
|
|
get-name
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
other commands you can use with your pe rsonal files (or system files if logged
|
|
on as a000) include:
|
|
|
|
run runs the program in the user swap area (memory)
|
|
list lists the program in th e user swap area
|
|
save-name name may be upto 6 char acters
|
|
csave-name save in compiled form
|
|
name-name assign a name to it
|
|
kill-name deletes a file from you r library
|
|
punch punches a program onto
|
|
paper tape
|
|
tape input a paper tape
|
|
append-name attaches the file name to current program in memory
|
|
length tells the current lengt h of program in memory
|
|
lprinter designates the line pri nter as user output device
|
|
open creates a file [open-fi le,# of records, (record lengths)]
|
|
renumber renumbers statements
|
|
[ren-(1st statement #),
|
|
(interval between statements),(# to start renumbering at), (# to end
|
|
renumbering)]
|
|
|
|
note: all commands can be abbreviated to the first 3 digits. the main command
|
|
is separated from the first para meter by a dash (-), the first parameter
|
|
is separated by the second param eter by a comma (,), and all further
|
|
parameters are separated by comm as. eg, hel-a000,^c (i did actually
|
|
find a system where the sm passw ord was ^c).
|
|
|
|
other useful commands
|
|
---------------------
|
|
|
|
bye logs user off
|
|
echo-on half-duplex
|
|
-off full-duplex (default)
|
|
scratch clears users swap area (new)
|
|
key transfers control to ke yboard
|
|
time informs user of total c onnect time & console time
|
|
message sends a message to syso p console [mes-(text upto 68 chars)]
|
|
|
|
|
|
tsb 2000
|
|
--------
|
|
|
|
the programming of the system is above the scope of this tutorial. if you do
|
|
manage to get into the a000 or z999 acc ounts, there is sufficient info provided
|
|
in this text to help you manip ulate the data. the basic is rather extensive.
|
|
the file commands are excell ent & you can mask files so that nobody can read
|
|
them without the proper mask ( i have already cracked this code, though!).
|
|
briefly, it is similar to mos t other basic's. if you want, order their
|
|
programming manual. it is called 20854a timeshared basic/2000, level f (part #
|
|
02000-90073).
|
|
|
|
note: there are different levels (vers ions) of tsb/2000. this article is
|
|
based primarily on level f. mos t of the levels are similar in their
|
|
commands so the differences shou ld not affect the hacker. also, some
|
|
systems are customized. eg, one system i know doesn't have the message
|
|
command because they don't want the operator bothered with messages.
|
|
another system says ??? instead of please log in and illegal instead of
|
|
illegal access. these are only trivial problems, though.
|
|
|
|
programs
|
|
--------
|
|
|
|
hewlett-packard often supplies programs from their tsb library for the systems.
|
|
utilities such as ascii*, fprint, & oth ers are almost inevitably found on
|
|
every system. standard games such as w umpus, stock, lunar, & many others are
|
|
also a "system must." other companies offer very large programs for the
|
|
hp2000 also. gis (guidance information systems) is a database to help guidance
|
|
counselors help students to select coll eges, jobs, financial aid, etc. gis is
|
|
usually found in the s5xx group library (anyone with an s5xx password can use
|
|
it). unfortunately, sometimes these pr ograms are set so that a certain
|
|
password will automatically run them. in some cases you can abort by pressing
|
|
the <break> key. there is a basic func tion [x=brk(0)] that disables the
|
|
<break> key. in this case, only the sy sop or the program can throw you into
|
|
basic.
|
|
|
|
there are many alleged bugs on the hp20 00 that allow users to do all sorts of
|
|
things. if you run across any of these be sure to let me know.
|
|
|
|
i have seen one system that consisted o f 2 hp2000's running together. in this
|
|
case, the multiplexer would first ask t he user system 1 or system 2? before
|
|
logging in. you would then type sys1 o r sys2.
|
|
|
|
most of the hp2000 systems are used by schools, school districts, boces, and
|
|
various businesses. this was an id eal system for schools before micro-
|
|
computers existed. the hp2000 system h as been in existance since around 1973.
|
|
it has been replaced by the hp3000 but there are still many hp2000 systems in
|
|
existance & i believe that they will st ay there for awhile.
|
|
|
|
here are the dial-ups to a few hp2000 s ystems to get you started:
|
|
|
|
[xxx/xxx-xxxx]
|
|
[xxx/xxx-xxxx]
|
|
[xxx/xxx-xxxx]
|
|
|
|
if you need help with anything on an hp 2000 or find other hp2000 systems, feel
|
|
free to ask me. any comments, correcti ons, and/or threats are also welcome.
|
|
|
|
yours truly,
|
|
|
|
*****bioc
|
|
*=$=*agent
|
|
*****003
|
|
|
|
<=-fargo 4a-=>>
|
|
|
|
|
|
|
|
|
|
|
|
Text-Files 2:
|
|
|