Danny's Weblog

The Phrack guide to hacking VMS

www.phrack.org [http://www.phrack.org/phrack/27/P27-06]

it's hardly comprehensive but gives you a few ideas.

I was struck by the revelation that (according to Phrack) groups are handled in VMS by *giving everyone who needs to use the group the password for the group*. Incredible. If Microsoft tried to do something like that they would be ridiculed (even more than now).

Sample code for use on an internal webpage

Most web servers are used for the public and therefore the system does not have an "authenticated user" name which can be accessed by scripts.

The following posting on Slashdot illustrates what can be done on an internal Windows server, where IIS is aware of the Windows logon name of the user. Here, it's just used for a prank: a certain user gets a joke image, and all other users get an innocuous image.

ask.slashdot.org [http://ask.slashdot.org/comments.pl?sid=80131&cid=7071926]

He gives two versions, one with basic code and the other with php. It works as a redirect – I'm not sure why (something to do with his original plan to add the image to the victim's Outlook signature).

<%
embarrassing_image = "embarrassing_image.png"
fake_image = "white_one_pixel_square.png"
userfull = Request.ServerVariables("LOGON_USER")
look = inStr (1, userfull, "user_to_goof",1)
If 1 > look Then _
Response.Redirect (embarrassing_image) _
else _
Response.Redirect (fake_image) _
end if
%>




<?php
$embarrassing_image = "embarrassing_image.png";
$fake_image = "white_one_pixel_square.png";
$userfull = $_SERVER["LOGON_USER"];
if (eregi ("user_to_goof", $userfull))
{
header ("Location: " . $embarrassing_image);
}
else
{
header ("Location: " . $fake_image);
}
?>

Debug: hittotal: 3 startban: 0 dancookie: endbandate: banned: 0 tempdate: tert: jse: jsno jsh: 3