Bugtraq mailing list archives

Re: Escape sequences (was Wall and talkd pass binary data)


From: barnett () alydar crd ge com (Bruce Barnett)
Date: Wed, 20 Jul 94 14:10:17 EDT


The ANSI.SYS driver (ANSI.SYS is the terminal control feature which is
essentially DEC's VT100 terminal control routines) that comes with MS DOS
or PC DOS, allows someone to redefine the codes generated by keys.  

I'm not trying to hide what the command sequence is, I just don't
remember.

I do.

The DEC VT100 manual says sending an ASCII "ENQ" (octal 5)
character to a vt100 terminal will cause it to respond with an
answerback message. I don't know how to program a PC with a custom
message, but the original terminal did not allow programmatic method.
It had to be done using a special setup screen on the terminal.


Years ago I have a vt102 as my primry "workstation".

If someone sat on my console, they could program the answerback
to type "<return>/tmp/funnycommand<clearscreen>"

then they could send a "\005" to my terminal while I was root, and
force me to execute a trojan horse.

This was why I always locked my terminal when I left, and always
checked the answerback message every day.

memories....



Current thread: