💾 Archived View for gemini.spam.works › mirrors › textfiles › phreak › BOXES › hacking.an.oxga captured on 2022-07-17 at 10:39:30.
⬅️ Previous capture (2022-06-12)
-=-=-=-=-=-=-
[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
[!] [!]
[!] Hacking the Oxgate Public Bulletin Board System [!]
[!] [!]
[!] Written by: The 0mega & Lord Vision [!]
[!] Infinity's Edge -:- 805/683-2725 [!]
[!] 10 Megz. 300/1200 baud [!]
[!] [!]
[!] Call these cool boards: [!]
[!] [!]
[!] The Cartel..........206/825-6236 [!]
[!] Metal Land South..........404/327-2327 [!]
[!] Terrapin Station AE..........505/865-0883 [!]
[!] [!]
[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
Written Sept. 20, 1986.
Why am I writing a file on hacking a measly public Bulletin Board System?
There are a few reasons: Oxgate is probably one of the more popular Public
Bulletin Board Systems for CP/M and MS-DOS systems that is cheap (it supercedes
the archaic RBBS). Second, I am probably the only person, or one of the few
people who knows the in's and out's of this system and can say that Oxgate will
be the easiest system you will ever hack (providing you know a few key
secrets). Thirdly, I owe the Author of the program, Paul Traina, something
special.
A couple of years ago, I was a co-sysop on one of these Oxgate systems,
and did some modding to the Source Code for the Sysop, so I have had the chance
to get to know the system from firsthand experience, and as a Sysop. After a
while, Traina decided to be an asshole and try and fuck me over a few times
(he's a Jehovah's Witness, what can you expect?) I'm surprised I haven't
contracted AIDS yet. But, as it turned out, Traina liked my modds so much, he
decided to snake them from me and put them into his newer source code and
market his program (Oxgate ver. 6). So for a few reasons, I've decided to
write this file - for informational purposes only, of course. All the usual
disclaimers apply. I will assume that you, the reader, have a brain of your
own and are not influenced by subliminal messages in Text files such as these.
SYSTEM OVERVIEW:
The Oxgate system is mainly based on CP/M systems. Oxgate also tends to
be the next step up for Sysops running RBBS, RCP/M systems. At the end of this
article, I will try and list as many of the Oxgate Systems nationally as I can
find. I'm sure you can find a more extensive list of other Oxgates off of one
of the systems I list. I will assume some knowledge on the reader's part on
CP/M systems, but I will try and explain as much as I can along the way.
The Program is divided into 3 separate modules, namely: OXENTR, OXGATE,
and OXEDIT. OXENTR is the main login program, which accepts password,
username, prints any announcements and goes to OXGATE. OXGATE is the main BBS
program, which does all the user functions and takes care of the message bases.
OXEDIT is a Sysop utility which allows editing users, masking sub-boards the
user can access, etc.
If you do not understand the following decriptions then, you can come back
to them later, after I explain how to get into the CP/M operating System.
The CP/M system is usually subdivided thusly: 2 areas (or drives), A>, and
B>, each divided into 15 sub-areas, A0> through A14>, and B0> through B14>. All
Sysop utilities will be found either on A14> or B14>. You enter these areas
simply by typing the Area Name followed by a colon (and a RETURN), for example
"B14:" or "A6:". Most of the time, the OXGATE will allow the user to drop into
the CP/M operating system, in order to upload/download, etc. The Normal user
can usually access A0> through A6>, and some lower B> areas. A0> will contain
the OXGATE.COM file so that a user can return to OXGATE from the Operating
System (by typing "OXGATE"). A14> will usually contain OXENTR to allow the
Sysop (or remote-Sysop) to re-login as another user without having to drop
carrier. The OXEDIT utility is also to be found in this area.
At the heart of controlling the CP/M access is a small daemon program
called WHEEL. WHEEL will watch what areas you try to access and determine
whether you can get in or not. If a user has the correct password, he can
access all of the areas, change the WHEEL Password, etc. Once the WHEEL is set
to allow access to the upper areas, you are Sysop, with the control to access
the ERAse command, the OXEDIT utilities, and anything else your heart desires.
WHEEL is a COM file that may be called from any area, and you will usually see
it in A0>. It may be renamed, of course, so if you are hacking in CP/M, be
aware of that. To use WHEEL, you simply type "WHEEL password", and the WHEEL
will be set (upon being given the correct password) to let you in to the
restricted areas.
BBS OVERVIEW AND HACKING INTO IT:
As boring as Oxgates are to me (especially for the countless 'daim
bramaged' users that seem to flock to them), they seem to be popular. In some
cases, the Sysop will restrict the system so that you cannot gain an account
automatically; you must log on, answer the questions, and then send an SASE.
This tends to discourage users from creating loser accounts, or being 'Twits'
as the term goes (comp: Luser, Ruggie, Dick...) There is one big disadvantage
to the SASE method that Sysops do not realize, and that I have used severely to
my advantage (I was able to shut down, permanently, an Oxgate and force the
Sysop to 'retire'). So, the only way to get in is to hack in.
When you log on, it will ask for a user name, however, a user # can be
entered here, as well. Then it will ask for a password (if that account
exists). It will let you type a password with an 80 char. limit, however, the
system *ONLY RECOGNIZES THE FIRST FOUR (4) CHARACTERS*. 99% of the users are
ignorant of this, and tend to think if they type in 7 letters, they are more
safe than if they type 5 letters for their password. And, 99% of the users, in
my experience, use only alphabetical characters. That narrows the combinations
down considerably to a mere 456,976 (26^4). You could sit there and try them
all, but there is another little known fact about the way Oxgate saves
passwords that will help considerably. Namely this: Traina decided to get
clever (ooh!) and encrypt (tricky!) user passwords with a one-way function (a
one-way function in that you cannot derive the original password from the
encrypted one, and you are not meant to.) into a 4 digit number, repesentative
of the password. Even when a Sysop uses OXEDIT to look at a user, all he will
see for a password is that 4 digit number. But, unfortunately for Traina and
the Oxgate Sysops, the way that a password is encrypted, there are 4 other
possible combinations you can type for a password that will be encrypted