3 ms·
I seem to remember that being used as an attack vector at college: Identify a terminal that was logged on as root (albeit physically inaccessible), then find a
by samlittlewood 9y ago
I seem to remember that being used as an attack vector at college: Identify a terminal that was logged on as root (albeit physically inaccessible), then find a way of getting message to it, then send a string that programmed answerback and then triggered it. Usual payload was moving your 'special' version of a common suid program into place, possibly along with a tweaked version of 'sum'.
This started with 'write' etc. but became an escalating arms-race.
- kpcyrd 9y agoDo you happen to know if this is still supported in eg. xterm?
- samlittlewood 9y agoIt certainly supports sending answerback: http://invisible-island.net/xterm/manpage/xterm.html#VT100-Widget-Resources:answerbackString http://invisible-island.net/xterm/manpage/xterm.html#VT100-W.... But IIRC, we had some (non-DEC?) terminals that 'helpfully' allowed remote programming of the answerback as well. I recall there was also a race to find other ways to get terminals to reflect content (send line, forms etc.).
- gpvos 9y agoThere are VT100/ANSI codes to program not only the answerback message, but also the function keys. All terminal emulators that I know of, including xterm, removed that functionality a long time ago already.