OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1994: Re: Escape sequences (was Wall and talkd pass binary data)

Re: Escape sequences (was Wall and talkd pass binary data)

Bruce Barnett (barnettalydar.crd.ge.com)
Wed, 20 Jul 94 14:10:17 EDT 

>The ANSI.SYS driver (ANSI.SYS is the terminal control feature which is
>essentially DEC's VT100 terminal control routines) that comes with MS DOS
>or PC DOS, allows someone to redefine the codes generated by keys.  

>I'm not trying to hide what the command sequence is, I just don't
>remember.

I do.

The DEC VT100 manual says sending an ASCII "ENQ" (octal 5)
character to a vt100 terminal will cause it to respond with an
answerback message. I don't know how to program a PC with a custom
message, but the original terminal did not allow programmatic method.
It had to be done using a special setup screen on the terminal.


Years ago I have a vt102 as my primry "workstation".

If someone sat on my console, they could program the answerback
to type "<return>/tmp/funnycommand<clearscreen>"

then they could send a "\005" to my terminal while I was root, and
force me to execute a trojan horse.

This was why I always locked my terminal when I left, and always
checked the answerback message every day.

memories....