[ News ] [ Paper Feed ] [ Issues ] [ Authors ] [ Archives ] [ Contact ]


..[ Phrack Magazine ]..
.:: Inside the SYSUAF.DAT File ::.

Issues: [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ] [ 19 ] [ 20 ] [ 21 ] [ 22 ] [ 23 ] [ 24 ] [ 25 ] [ 26 ] [ 27 ] [ 28 ] [ 29 ] [ 30 ] [ 31 ] [ 32 ] [ 33 ] [ 34 ] [ 35 ] [ 36 ] [ 37 ] [ 38 ] [ 39 ] [ 40 ] [ 41 ] [ 42 ] [ 43 ] [ 44 ] [ 45 ] [ 46 ] [ 47 ] [ 48 ] [ 49 ] [ 50 ] [ 51 ] [ 52 ] [ 53 ] [ 54 ] [ 55 ] [ 56 ] [ 57 ] [ 58 ] [ 59 ] [ 60 ] [ 61 ] [ 62 ] [ 63 ] [ 64 ] [ 65 ] [ 66 ] [ 67 ] [ 68 ] [ 69 ] [ 70 ] [ 71 ]
Current issue : #32 | Release date : 1990-11-17 | Editor : Crimson Death
Phrack Classic XXXII IndexCrimson Death
Phrack Classic Spotlight featuring Knight LightningCrimson Death & Knight Lightning
Concerning Hackers Who Break Into Computer SystemsDorthy Denning
The Art of InvestigationThe Butler
Unix 'Nasties'Sir Hackalot
Automatic Teller Machine CardsJester Sluggo
A Trip to the NCSCKnight Lightning
Inside the SYSUAF.DAT FilePain Hertz
RSTSCrimson Death
Knight Line I Part 1Doc Holiday
Knight Line I Part 2Doc Holiday
Knight Line I Part 3Doc Holiday
Title : Inside the SYSUAF.DAT File
Author : Pain Hertz
                              ==Phrack Classic==

                     Volume Three, Issue 32, File #8 of 12


                       +-------------------------------+
                       | Inside the SYSUAF.DAT file of |
                       +-------------------------------+

           +------------------------------------------------------+
           | Digital Equipment Corporation's VMS Operating System |
           +------------------------------------------------------+

                                   -= by =-

                         -----:>  Pain Hertz  <:----



Overview
~~~~~~~
        In this file, I will explain what the System User Authorization File
is, what information it contains, what the logical and physical characteristics
of the file are, and how one can manipulate it to reveal and/or modify its
contents.

Background
~~~~~~~~
        The Virtual Memory System (VMS) Operating System's System User
Authorization File (SYSUAF) contains the information that determines a given
user's username, password(s), security priviledges, as well as many other
similar data which either allow or disallow the user to have the system
perform certain tasks.

Characteristics
~~~~~~~~~~~~~~
        The SYSUAF.DAT file (UAF) is usually located on the system on the
device pointed to by the logical SYS$COMMON, and under the [SYSEXE]
subdirectory.  However, if the logical SYSUAF exists, it will point to the
location and name of the UAF.

        The UAF is a binary, indexed data file.  It's indexed on 4 keys:
username, UIC, extended user identifier, and owner identifier.  Using
the VMS ANALYZE utility reveals the following about the UAF:


IDENT   "01-JAN-1990 13:13:13   VAX/VMS ANALYZE/RMS_FILE Utility"

SYSTEM
        SOURCE                  VAX/VMS

FILE
        ALLOCATION              24
        BEST_TRY_CONTIGUOUS     yes
        BUCKET_SIZE             3
        CLUSTER_SIZE            3
        CONTIGUOUS              no
        EXTENSION               3
        FILE_MONITORING         no
        GLOBAL_BUFFER_COUNT     0
        NAME                    "SYS$COMMON:[SYSEXE]SYSUAF.DAT;1"
        ORGANIZATION            indexed
        OWNER                   [SYSTEM]
        PROTECTION              (system:RWED, owner:RWED, group:RWED, world:RE)

RECORD
        BLOCK_SPAN              yes
        CARRIAGE_CONTROL        none
        FORMAT                  variable
        SIZE                    1412

AREA 0
        ALLOCATION              9
        BEST_TRY_CONTIGUOUS     yes
        BUCKET_SIZE             3
        EXTENSION               3

AREA 1
        ALLOCATION              3
        BUCKET_SIZE             3
        EXTENSION               3

AREA 2
        ALLOCATION              12
        BUCKET_SIZE             2
        EXTENSION               12

KEY 0
        CHANGES                 no
        DATA_KEY_COMPRESSION    yes
        DATA_RECORD_COMPRESSION yes
        DATA_AREA               0
        DATA_FILL               100
        DUPLICATES              no
        INDEX_AREA              1
        INDEX_COMPRESSION       yes
        INDEX_FILL              100
        LEVEL1_INDEX_AREA       1
        NAME                    "Username"
        NULL_KEY                no
        PROLOG                  3
        SEG0_LENGTH             32
        SEG0_POSITION           4
        TYPE                    string

KEY 1
        CHANGES                 yes
        DATA_KEY_COMPRESSION    no
        DATA_AREA               2
        DATA_FILL               100
        DUPLICATES              yes
        INDEX_AREA              2
        INDEX_COMPRESSION       no
        INDEX_FILL              100
        LEVEL1_INDEX_AREA       2
        NAME                    "UIC"
        NULL_KEY                no
        SEG0_LENGTH             4
        SEG0_POSITION           36
        TYPE                    bin4

KEY 2
        CHANGES                 yes
        DATA_KEY_COMPRESSION    no
        DATA_AREA               2
        DATA_FILL               100
        DUPLICATES              yes
        INDEX_AREA              2
        INDEX_COMPRESSION       no
        INDEX_FILL              100
        LEVEL1_INDEX_AREA       2
        NAME                    "Extended User Identifier"
        NULL_KEY                no
        SEG0_LENGTH             8
        SEG0_POSITION           36
        TYPE                    bin8

KEY 3
        CHANGES                 yes
        DATA_KEY_COMPRESSION    no
        DATA_AREA               2
        DATA_FILL               100
        DUPLICATES              yes
        INDEX_AREA              2
        INDEX_COMPRESSION       no
        INDEX_FILL              100
        LEVEL1_INDEX_AREA       2
        NAME                    "Owner Identifier"
        NULL_KEY                yes
        NULL_VALUE              0
        SEG0_LENGTH             8
        SEG0_POSITION           44
        TYPE                    bin8

ANALYSIS_OF_AREA 0
        RECLAIMED_SPACE         0

ANALYSIS_OF_AREA 1
        RECLAIMED_SPACE         0

ANALYSIS_OF_AREA 2
        RECLAIMED_SPACE         0

ANALYSIS_OF_KEY 0
        DATA_FILL               71
        DATA_KEY_COMPRESSION    75
        DATA_RECORD_COMPRESSION 67
        DATA_RECORD_COUNT       5
        DATA_SPACE_OCCUPIED     3
        DEPTH                   1
        INDEX_COMPRESSION       85
        INDEX_FILL              1
        INDEX_SPACE_OCCUPIED    3
        LEVEL1_RECORD_COUNT     1
        MEAN_DATA_LENGTH        644
        MEAN_INDEX_LENGTH       34

ANALYSIS_OF_KEY 1
        DATA_FILL               7
        DATA_KEY_COMPRESSION    0
        DATA_RECORD_COUNT       4
        DATA_SPACE_OCCUPIED     2
        DEPTH                   1
        DUPLICATES_PER_SIDR     0
        INDEX_COMPRESSION       0
        INDEX_FILL              2
        INDEX_SPACE_OCCUPIED    2
        LEVEL1_RECORD_COUNT     1
        MEAN_DATA_LENGTH        15
        MEAN_INDEX_LENGTH       6

ANALYSIS_OF_KEY 2
        DATA_FILL               8
        DATA_KEY_COMPRESSION    0
        DATA_RECORD_COUNT       4
        DATA_SPACE_OCCUPIED     2
        DEPTH                   1
        DUPLICATES_PER_SIDR     0
        INDEX_COMPRESSION       0
        INDEX_FILL              2
        INDEX_SPACE_OCCUPIED    2
        LEVEL1_RECORD_COUNT     1
        MEAN_DATA_LENGTH        19
        MEAN_INDEX_LENGTH       10

ANALYSIS_OF_KEY 3
        ! This index is uninitialized - there are no records.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Examination
~~~~~~~~~

        Generally, an interactive user would use the AUTHORIZE utility to
modify or examine the UAF, while a program would use the $GETUAI system
services (get user authorization information service) to examine the file.
The $GETUAI system services reference provide an excellent description of what
fields the UAF contains, and how many bytes are used within the file to store
each of those fields.  However, it may not be within your realm of skills to
program using system services.  It would probably be considerably easier to
use a sector editor/browser to locate values within the UAF.  You could use a
sector editor/browser online (such as VFE.EXE), or you you might choose to
download the UAF and use an editor/browse for your personal computer.
Regardless of which method you choose, you will have to know the offset of
each field within the user authorization file.  This is what I have provided
for you.

        The contents of the UAF under VMS release 5.3-1 are as follows:

Offset   Description                                            Length
-----------------------------------------------------------------------------
   0     Record Header                                             4
   4     Username (loginid)                                       32
  36     Member UIC - Mem UIC decimal   1 = 0100                   2
                      Mem UIC decimal  10 = 0A00
                      Mem UIC decimal 256 = FF01

  38     Group UIC  - Same as format as member UIC                 2

         Note:  UICs as displayed in the VMS environment
         are OCTAL.  A UIC of [010,001] would be saved as
         '01000800' in bytes 36-39 (offset).

  40     Nulls                                                    12
  52     Account name                                             32
  84     1 byte - value = length of owner                          1
  85     Owner                                                    31
 116     1 byte - value = length of device                         1
 117     Device (default disk device)                             31
 148     1 byte - length of default (SYS$LOGIN) directory          1
 149     Default (SYS$LOGIN) directory name                       63
 212     1 byte - length of default login command file             1
 213     Default login command file                               63
 276     1 byte - length of default CLI                            1
 277     Default command language interpeter                      31

         Note: CLI is assumed to be in SYS$SYSTEM directory
         and have an .EXE extension.

 308     1 byte - length of user defined CLI tables                1
 309     User defined CLI table name                              31
 340     Encrypted primary password                                8
 348     Encrypted secondary password                              8
 356     Number of login fails                                     2
 358     Password encryption salt                                  2
 360     Encryption algorithm code byte - primary password         1
 361     Encryption algorithm code byte - secondary password       1
 362     Password minimum length                                   1
 363     Filler (1 byte)                                           1
 364     Account expiration date                                   8
 372     Password lifetime                                         8
 380     Password change date/time - primary password              8
 388     Password change date/time - secondary password            8
 396     Last interactive login date/time                          8
 404     Last non-interactive login date/time                      8
 412     Authorize priviledges                                     8
 420     Default priviledges                                       8
 428     Filler (40 bytes)                                        40

 468     Login Flags bits as follows:                              4

           7  6  5  4  3  2  1  0
         -------------------------
         |  |  |  |  |  |  |  |  |
         -------------------------

         Byte Offset 468:

         Bit 0            - User can not use CTRL-Y
         Bit 1            - User is restricted to default
                            command interpeter
         Bit 2            - SET PASSWORD command is disabled
         Bit 3            - Prevent user from changing any
                            defaults at login
         Bit 4            - User account is disabled
         Bit 5            - User will not receive the login
                            welcome message
         Bit 6            - Announcement of new mail is suppressed
         Bit 7            - Mail delivery to user is disabled

         Byte Offset 469:

         Bit 0            - User is required to use generated
                            passwords
         Bit 1            - Primary password is expired
         Bit 2            - Secondary password is expired
         Bit 3            - All actions are audited
         Bit 4            - User will not receive last login
                            messages
         Bit 5            - User can not reconnect to existing
                            processes
         Bit 6            - User can only login to terminals
                            defined by the automatic login
                            facility (ALF)
         Bit 7            - User is required to change expired
                            passwords

         Byte Offset 470:

         Bit 0            - User is restricted to captive account
         Bit 1            - Prevent user from executing RUN, MCR
                            commands, or foreign commands at the
                            DCL level
         Bits 2-7         - Reserved for future use

         Byte Offset 471:

         Bits 0-7         - Reserved for future use


         Note On Access Bytes:

         Each bit set represents a 1-hour period, from bit 0 as
         midnight to 1 a.m. to bit 23 as 11 p.m. to midnight.

 472     Network access bytes - primary days                       3
 475     Network access bytes - seconday days                      3
 478     Batch access bytes - primary days                         3
 481     Batch access bytes - seconday days                        3
 484     Local access bytes - primary days                         3
 487     Local access bytes - seconday days                        3
 490     Dialup access bytes - primary days                        3
 493     Dialup access bytes - secondary days                      3
 496     Remote access bytes - primary days                        3
 499     Remote access bytes - seconday days                       3

 502     Filler (12 bytes)                                        12
 514     Prime days                                                1

         Bits 0-7 toggled on represents primedays, respective
         to Mon, Tue, ..., Sun.

 515     Filler (1 byte)                                           1
 516     Default base priority                                     1
 517     Maximum job queue priority                                1
 518     Active process limit                                      2
 520     Max. number of interactive, detached, and batch jobs      2
 524     Detached process limit                                    2
 526     Subprocess creation limit                                 2
 528     Buffered I/O count                                        2
 530     Timer queue entry limit                                   2
 532     AST queue limit                                           2
 534     Lock queue limit                                          2
 536     Open file limit                                           4
 538     Shared file limit                                         2
 540     Working set quota                                         4
 548     Working set extent                                        4
 552     Paging file quota                                         4
 556     Maximum CPU time limit (in 10-milliseconds)               4
 560     Buffered I/O byte limit                                   4
 564     Paged buffer I/O byte count limit                         4
 568     Initial byte quota (jobwide logical name table uses)      4
 572     Filler (72 bytes)                                        72

        Dates and times are stored as 8 bytes representing the number of
seconds elapsed since November 17, 1858, 12:00:00 a.m.

        Earlier versions of the VMS UAF will contain much of the same data,
which should be at the same offset as listed above.


        Should you decide to attempt to modify the SYSUAF.DAT file, keep in
mind that if you download the file, when you upload it, it will not be the
same as it was before; it will not be an indexed file.  You *might* be able
to create an .FDL file (using ANALYZE/RMS/FDL SYSUAF.DAT), and use that .FDL
file to convert it back to an indexed file
(with CONVERT/FDL=SYSUAF.FDL UPLOAD_UAF.DAT NEW_UAF.DAT), but chances that it
will contain the proper indexing and file attributes are slim.  Remember when
altering the SYSUAF.DAT file to keep a copy around (on the system) in case
you need to repair the damage.


-PHz

Feel free to make any comments or corrections to the following address:

[phz@judy.indstate.edu]
_______________________________________________________________________________
[ News ] [ Paper Feed ] [ Issues ] [ Authors ] [ Archives ] [ Contact ]
© Copyleft 1985-2024, Phrack Magazine.