3 ms·

I remember being amused when I discovered that all the servers in our server room at uni had their terminals downgraded from adm-3e terminals to adm-3 ones (the

I remember being amused when I discovered that all the servers in our server room at uni had their terminals downgraded from adm-3e terminals to adm-3 ones (the one with dip-switches). This was because someone had discovered that you could use `write` to send a message to root if it'd been left logged in that contained the control codes to re-program a function key and then query the function key back. This had the unfortunate effect of allowing anyone to run arbitrary commands as root! The older consoles didn't support function keys, so couldn't be exploited this way.

DonHopkins 3y ago
I friend my mine wrote a "memoline" messaging system for the HP3000, and everybody used it with those "smart" HP terminals. I knew he had admin privs, and what the command to give me admin privs was, so I sent him a message that said something like: Hi, Frank! How much would I have to pay you to execute the command: % grant Don.Hopkins admin Followed by the HP escape sequences for [up][right][right][send rest of line as input][up]. So when he read the message, it entered the command and ran it with his admin privileges, granting me admin! Lesson: Don't print out raw escape sequences from untrusted messages! And don't design terminals with [send rest of line as input] commands.