STATION ID - 7047/3.12 9x Datakit Network FOR OFFICIAL USE ONLY This is a 9x system, restricted to authorized persons and for official 9x business only. Anyone using this system, network or data is subject to being monitored at any time for system administration and for identifying unauthorized users or system misuse. Anyone using this system expressly consents to such monitoring and is advised that any evidence of criminal activity revealed through such monitoring may be provided to law enforcement for prosecution. Scraps of information about IBM's 4690 / Store System Part I or: how to extend your horizons and stop 0wning dumb sites and 0wn your local supermarket/mall and buy free candy. compiled by Synner'1998 (synner@hack.gr) http://www.hack.gr/users/synner o "IBM what?" The so called IBM's 4690/Store System is a multiuser / multitasking operating system that is used mainly for fat ass stores to run their business.It is mainly menu driven ,but also ,for the negr0 admins, theres the capability of command line driven option. The operating systems also supports a special feature called the IBM 4690 Multiple Controller Feature (MCF) that enables on store controller to be the central point of control in the system and communicate with other store controllers using a Data Distribution Application (DDA).The IBM 4690 MCF also provides a LU 6.2 communications capability on a token-ring network.4960's commands are much like DOS ones ,but more network-wise. Kinda like Novell.What is a `store controller` ? ,we will discuss it later. o "How will I identify a 4690 Store System ?" This is quite easy because the initial startup screen of the system is rather descriptive.Upon logging to such a system this will appear on your terminal: Welcome to the IBM (big ascii logo) 4690 STORE SYSTEM Type your Operator ID: When complete ,press Enter. note: if you still cant recognize what system this is after you've read this t-file then you are a fucking idiot. o Windows IBM 4690 multi-application mode is done using windows , not the familiar M$ ones ,but rather more elitistic in the sense of aesthetic.Windows are available only in multi-application mode.You can ,for example run a report a trace ,or edit a file all at the same time using a single store controller.A window operates like the channels on a tv.You have only one screen ,but you can switch from window to window without ending the applications you are currently running.Appendix B; shows some of the special key functions used to switch,open,close application windows. o Security I know that you had this in mind from the first time you started reading this crappy informational file ,so here is it: ^BSecurity^B :-P. Upon logging to the 4690 System you will be asked for an Operator ID. Whats an operator ID? pretty much like a username in Unix systems. The ID can contain up to nine valid characters.Valid characters are any letters (A-Z) ,any numbers (0-9), or one of these `special` characters: # ( ) { } When you type in your ID ,you see it displayed on the screen. You will be asked to enter a password.This password authorizes you to sign on and use the system (duh!). The password can be up to eight characters.Valid characters are the same as for you ID. o Specially Authorized Operators Some functions on the system can be used by operators having special authorization.These functions include stopping another operator's window, checking background applications or requesting system control functions. The authorization to use these functions is designated in the .. o System Authorization File We will refer to this file as SAF for brevvity shake's.You guessed right. The SAF is what /etc/passwd is for Unix.The password file.It is placed in the system upon installation with same file protection as the other application files. The 'ADXCSOUF.DAT' file resides in the 'ADX_IDT1' subdirectory that is: C:\ADX_IDT1\ADXCSOUF.DAT o Password Encryption (oops, shit) The IBM 4690 Operating System uses one-way encrypted passwords.The system encrypts passwords before storing them in the system authorization file. When an operator signs on ,the password entered is encrypted and the encryption code is compared to the encrypted password code in the operator's authorization record.If the two match ,the operator is allowed to sign on.Kinda like the standard unix crypt() but more gay ,cause I dont think this damn thing knows about salts!.Heres some code ripped off from the manual to encrypt an eight-character ASCII password: SUB ADXCRYPT (RETCODE ,PWIN$ ,PWOUT$) EXTERNAL STRING PWIN$,PWOUT$ INTEGER*2 RETCODE END SUB where: RETCODE = Contains the return code from the call. PWIN$ = Contains the password to be encrypted. PWOUT$ = Receives the encrypted value. Yeap ,that almost makes sense. o "Arent any Default accounts?!@#!()@#&*!@" Dont know.The only thing I know is that the default operator ID is :99999999 and there is no password set.But you can try various lame combinations for the password like "4690" , "IBM4690" and so on ,the military installment that I was had something like that as for their operator password :-). o File Protection IBM 4690 Store System offers exactly the same security scheme for protecting files as Unix uses,like chmod, 4690 uses the FSET command. View the attributes of a file: (1) FSET filespec Change the attributes of a file: (2) FSET filespec -H=ON|OFF (3) FSET filespec -A=ON|OFF (4) FSET filespec -S=ON|OFF (5) FSET filespec -R=ON|OFF Set the protection on a file: (6) FSET filespec -O=[R][W][E][D] (7) FSET filespec -G=[R][W][E][D] (8) FSET filespec -W=[R][W][E][D] . -H Hidden file.If you specify -H=ON in your FSET command, that file becomes a hidden file.It doesnt appear in your directory listing unless you use the DIR (see Appendix A;) command with the -H parameter. Specifing -H=OFF ,the file is listed in the directory.If you dont specify a value for H ,OFF is default. . -A Archive file. If this attribute is off, it indicates the file has been archived since it was created or last modified. -A is automatically ON when you modify your file. . -S System file. If you specify -S=ON ,your file becomes a system file.A System file can be accessed by any user on the system without the user needing a copy of the file in their own directory. System files does not appear in directory listings unless you use the DIR (see Appendix A;) command with the -H parameter. . -R Read-Only file. If you specify -R=ON ,your file becomes a readonly file.You can only read the file ,even if your user ID or group ID gives you other priviledges. -R=OFF switches off the read-only attribute. -R=OFF is default. There are three classes of users on the operating system : . -O = owner . -G = group . -W = world The class of user you are depends on your user ID and group ID numbers. You can assign each class a user one or more of the following priviledges: . R = Read the specified file. . W = Write to the specified file. To modify a file you need this priviledge. . E = Run the specified file (if the file is a program) . D = Delete part or all of the specified file.To change the security of a file ,you must have either owner access or the delete priviledge. Local format : C:\> FSET FOOBAH.TXT C:FOOBAH.TXT A=ON , O=RWED C:\> FSET FOOBAH -A=OFF LAN (MCF Network) Format C:\> FSET ADXLXCCN::C:\\FOOBAH.TXT Note: 'CC' between the ADXLXxxN is the store controllers unique two letter ID used to identify a _remote_ device attached to the master Note the use of the two "::" marks ,a single ":" mark identifies a local device ,such as C: ,A: and so on. o File Type Attributes on the MCF Network On a LAN MCF Network all distributed files have two file attributes. file /type/ and file /mode/.The file /type/ attribute tells where a file is distruted.The file /mode/ attribute tells when a file is distributed. These file attributes are stored in each file's directory where the file name ,path ,length and location are stored.The distribution attributes are not part of the file ,but rather of the store controller's file directory.A file's attribute can be copiedto and from a diskette using the COPY(see Appendix A;) command. . File Type Attribute. The file type attribute indicates which store controller a file is to be distributed to. Your files can be one of three file types: local, mirrored or compound.The file type is defined when a file is crated.A file type can be modified at any time using the Distributed File Utility (DFU) (see Appendix B;). Local File: A local file resides on only one store controller and is not distributed on the LAN (MCF Network) system. When a local file is updated, other store controllers on the network are not affected by the change. Mirrored File: A mirrored file is one that exists on only two store controllers. Mirrored files can be either system-mirrored files or application-mirrored files.The file has two file versions on the system; a prime version and an image version that is distributed by the 4690 Operating System. The prime version of a system-mirrored file resides on the master store controller while the image version resides on the alternate master store while the image version resides on the alternate master store controller. The prime version of an application-mirrored file resides on the file server controller while the image version is on the alternate file server controller. Compound File: a compound file is distributed to all store controllers except subordinate store controllers.Compound files are more common than mirrored files. . File Mode Attribute Per Update: With the per update modem method ,when the change is made to a file record , the record (not the whole file) is distributed to all store controllers on the LAN (MCF Network) system immediately. At Close: with this method ,image version files are updated across the network whenever the prime version file is closed ,and the entire file is sent across the network to all store controllers that have a copy of it. o Store Controller Roles On a LAN (MCF Network) each store controller is assigned one or more roles. Each roles indicates a type of responsibility that a store controller has on the network There are five possible store controller roles: . Master . Alternate Master . File Server . Alternate file server . Subordinate As all role names seem rather descriptive we shall only talk about Subordinate roles.Well ,subordinate store controllers are all store controllers that are not master or alternative masters.This includes the file server ,and the alternative file server. o Nodes A Node is a point of physical or logical connection to a network. Every store controller in a multiple-controller system is a node. Non-4690 store controllers or other PC's attached to the network are also considered as nodes. o Node ID's Every store controller node must have a two-character identification by which it can be addressed by other nodes. This is node ID (sometimes called the store controller ID). These ID's are specified during the installation process and assigned when store controllers are booted.Each store controller is assigned alphabetic characters in the range of CC through ZZ ,which are unique ID's.A and B cannot be used. The following node ID's are special ID's that are reserved for specific store controllers. These ID's are assigned automatically by the system to the acting store controller and cannot be used when configuring the system. Special ID Reserved for AA Acting Master AB Acting alternate master AC Acting file server AD Acting alternate file server These node ID's readily identify the store controller perfoming a given role. For example ,if the configured master controller is disabled and the alternate master controller becomes the acting master then using the AA node ID to refer to a file on the acting master store controller directs the access to the alternate master store controller that is the acting master store controller. In other words ,the special reserved node ID's relate to a controller _role_ rather than to a _specific store controller_. o Node Names Every store controller node names has the form of ADXLXxyN::, where xy is the store controller ID.The node names as you noticed end with a double colon ,that indicates different nodes on the network. o "OK , OK ,what nifty tricks can I do after I hack it?" Well ,most stores have all their cashier draws ,magnetic card readers,POS terminals hooked up on the network ,so you can pull all the tricks you want from changing the receipt paper from the cashiers ,open/close the cashier drawer ,sniff from the magnetic readers card information ,play with the cashier's VDU display and send kewl messages like "KILL YOURSELF" hehe. o Ending notes Well ,that was about all? not ,this t-file hardly covered the basics behind the 4690 Store System ,so I guess there will be a second part. Like the exception logging ,some Basic code to program most of its terminal I/O devices (well ,only those that are fun!) and many more. Appendix A; Summary of IBM 4690 Commands. Appendix B; Main Menu System Map.