From:	CRDGW2::CRDGW2::MRGATE::"SMTP::CUNYVM.CUNY.EDU::VMSSERV%FHCRCVAX.BITNET" 24-OCT-1989 10:26
To:	MRGATE::"ARISIA::EVERHART"
Subj:	VMSSERV_ROOT:[FILES]UAF.1_OF_3;1

Message-Id:  <8910241407.AA03181@crdgw1.ge.com>
Received: from UWAVM.ACS.WASHINGTON.EDU by UWAVM.ACS.WASHINGTON.EDU (IBM VM SMTP R1.2.1MX) with BSMTP id 7234; Tue, 24 Oct 89 07:10:09 PDT
Received: from FHCRCVAX.BITNET (VMSSERV) by UWAVM.ACS.WASHINGTON.EDU (Mailer
 R2.04) with BSMTP id 8039; Tue, 24 Oct 89 07:10:01 PDT
Date: Tue, 24 Oct 89 07:00 PST
From: VMSSERV%FHCRCVAX.BITNET@UWAVM.ACS.WASHINGTON.EDU
Subject: VMSSERV_ROOT:[FILES]UAF.1_OF_3;1
To: everhart@arisia.decnet
X-Vms-To: IN%"everhart%arisia.decnet@crdgw1.ge.com"

$! ................... Cut between dotted lines and save. ...................
$!...........................................................................
$! VAX/VMS archive file created by VMS_SHARE V06.10 7-FEB-1989.
$!
$! VMS_SHARE was written by James Gray (Gray:OSBUSouth@Xerox.COM) from
$! VMS_SHAR by Michael Bednarek (U3369429@ucsvc.dn.mu.oz.au).
$!
$! To unpack, simply save, concatinate all parts into one file and
$! execute (@) that file.
$!
$! This archive was created by user JOE
$! on 23-OCT-1989 15:21:23.31.
$!
$! ATTENTION: To keep each article below 100 blocks (51200 bytes), this
$!            program has been transmitted in 3 parts.  You should
$!            concatenate ALL parts to ONE file and execute (@) that file.
$!
$! It contains the following 19 files:
$!        $PRVDEF.H
$!        CC.OPT
$!        COMPILE.COM
$!        DISPLAY.C
$!        GCC.OPT
$!        GUESS.MAIL
$!        GUESS_PASSWORD.C
$!        HPWD.MAR
$!        INIT_CLI.C
$!        MAKEFILE.
$!        PARSE.C
$!        PARSE_UIC.MAR
$!        SELECT.C
$!        UAF.C
$!        UAF.H
$!        UAF.RNH
$!        UAFCLD.CLD
$!        UAF_CLD.H
$!        WORDLIST.H
$!
$!============================================================================
$ SET SYMBOL/SCOPE=( NOLOCAL, NOGLOBAL )
$ VERSION = F$GETSYI( "VERSION" )
$ IF VERSION .GES "V4.4" THEN GOTO VERSION_OK
$ WRITE SYS$OUTPUT "You are running VMS ''VERSION'; ", -
    "VMS_SHARE V06.10 7-FEB-1989 requires VMS V4.4 or higher."
$ EXIT 44 ! SS$_ABORT
$VERSION_OK:
$ GOTO START
$!
$UNPACK_FILE:
$ WRITE SYS$OUTPUT "Creating ''FILE_IS'"
$ DEFINE/USER_MODE SYS$OUTPUT NL:
$ EDIT/TPU/COMMAND=SYS$INPUT/NODISPLAY/OUTPUT='FILE_IS'/NOSECTION -
    VMS_SHARE_DUMMY.DUMMY
b_part := CREATE_BUFFER( "{Part}", GET_INFO( COMMAND_LINE, "file_name" ) )
; s_file_spec := GET_INFO( COMMAND_LINE, "output_file" ); SET( OUTPUT_FILE
, b_part, s_file_spec ); b_errors := CREATE_BUFFER( "{Errors}" ); i_errors
:= 0; pat_beg_1 := ANCHOR & "-+-+-+ Beginning"; pat_beg_2 := LINE_BEGIN
& "+-+-+-+ Beginning"; pat_end := ANCHOR & "+-+-+-+-+ End"; POSITION
( BEGINNING_OF( b_part ) ); LOOP EXITIF SEARCH( SPAN( ' ' )@r_trail
& LINE_END, FORWARD) = 0; POSITION( r_trail ); ERASE( r_trail ); ENDLOOP
; POSITION( BEGINNING_OF( b_part ) ); i_append_line := 0; LOOP EXITIF MARK
( NONE ) = END_OF( b_part ); s_x := ERASE_CHARACTER( 1 )
; IF s_x = '+' THEN r_skip := SEARCH( pat_beg_1, FORWARD, EXACT ); IF r_skip
<> 0 THEN s_x := ''; MOVE_HORIZONTAL( -CURRENT_OFFSET ); ERASE_LINE; ENDIF
; ENDIF; IF s_x = '-' THEN r_skip := SEARCH( pat_end, FORWARD, EXACT )
; IF r_skip <> 0 THEN s_x := ''; MOVE_HORIZONTAL( -CURRENT_OFFSET ); m_skip
:= MARK( NONE ); r_skip := SEARCH( pat_beg_2, FORWARD, EXACT ); IF r_skip
<> 0 THEN POSITION( END_OF( r_skip ) ); MOVE_HORIZONTAL( -CURRENT_OFFSET )
; MOVE_VERTICAL( 1 ); MOVE_HORIZONTAL( -1 ); ELSE POSITION( END_OF( b_part )
); ENDIF; ERASE( CREATE_RANGE( m_skip, MARK( NONE ), NONE ) ); ENDIF; ENDIF
; IF s_x = 'V' THEN s_x := ''; IF i_append_line <> 0 THEN APPEND_LINE
; MOVE_HORIZONTAL( -CURRENT_OFFSET ); ENDIF; i_append_line := 1
; MOVE_VERTICAL( 1 ); ENDIF; IF s_x = 'X' THEN s_x := ''; IF i_append_line
<> 0 THEN APPEND_LINE; MOVE_HORIZONTAL( -CURRENT_OFFSET ); ENDIF
; i_append_line := 0; MOVE_VERTICAL( 1 ); ENDIF; IF s_x <> '' THEN i_errors
:= i_errors + 1; s_text := CURRENT_LINE; POSITION( b_errors ); COPY_TEXT
( "The following line could not be unpacked properly:" ); SPLIT_LINE
; COPY_TEXT( s_x ); COPY_TEXT( s_text ); POSITION( b_part ); MOVE_VERTICAL
( 1 ); ENDIF; ENDLOOP; POSITION( BEGINNING_OF( b_part ) ); LOOP r_x := SEARCH
( "`", FORWARD, EXACT ); EXITIF r_x = 0; POSITION( r_x ); ERASE_CHARACTER( 1
); COPY_TEXT( ASCII( INT( ERASE_CHARACTER( 3 ) ) ) ); ENDLOOP
; IF i_errors = 0 THEN SET( NO_WRITE, b_errors, ON ); ELSE POSITION
( BEGINNING_OF( b_errors ) ); COPY_TEXT( FAO
( "The following !UL errors were detected while unpacking !AS", i_errors
, s_file_spec ) ); SPLIT_LINE; SET( OUTPUT_FILE, b_errors, "SYS$COMMAND" )
; ENDIF; EXIT;
$ DELETE VMS_SHARE_DUMMY.DUMMY;*
$ CHECKSUM 'FILE_IS
$ WRITE SYS$OUTPUT " CHECKSUM ", -
  F$ELEMENT( CHECKSUM_IS .EQ. CHECKSUM$CHECKSUM, ",", "failed!!,passed." )
$ RETURN
$!
$START:
$ FILE_IS = "$PRVDEF.H"
$ CHECKSUM_IS = 170737022
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X/* Created by SDL V3.1-7     */
V/* Source: 31-MAR-1989 19:12:20 SPUD$DISK:[MEADOWS.UNSDL.VMS5-0_H]STARDEFMP.S
XDI */
X#ifndef $PRVDEF_H
X#define $PRVDEF_H
X`032
X/*** MODULE $PRVDEF ***/
X#define PRV$M_CMKRNL 0x00000001
X#define PRV$M_CMEXEC 0x00000002
X#define PRV$M_SYSNAM 0x00000004
X#define PRV$M_GRPNAM 0x00000008
X#define PRV$M_ALLSPOOL 0x00000010
X#define PRV$M_DETACH 0x00000020
X#define PRV$M_DIAGNOSE 0x00000040
X#define PRV$M_LOG_IO 0x00000080
X#define PRV$M_GROUP 0x00000100
X#define PRV$M_NOACNT 0x00000200
X#define PRV$M_PRMCEB 0x00000400
X#define PRV$M_PRMMBX 0x00000800
X#define PRV$M_PSWAPM 0x00001000
X#define PRV$M_SETPRI 0x00002000
X#define PRV$M_SETPRV 0x00004000
X#define PRV$M_TMPMBX 0x00008000
X#define PRV$M_WORLD 0x00010000
X#define PRV$M_MOUNT 0x00020000
X#define PRV$M_OPER 0x00040000
X#define PRV$M_EXQUOTA 0x00080000
X#define PRV$M_NETMBX 0x00100000
X#define PRV$M_VOLPRO 0x00200000
X#define PRV$M_PHY_IO 0x00400000
X#define PRV$M_BUGCHK 0x00800000
X#define PRV$M_PRMGBL 0x01000000
X#define PRV$M_SYSGBL 0x02000000
X#define PRV$M_PFNMAP 0x04000000
X#define PRV$M_SHMEM 0x08000000
X#define PRV$M_SYSPRV 0x10000000
X#define PRV$M_BYPASS 0x20000000
X#define PRV$M_SYSLCK 0x40000000
X#define PRV$M_SHARE 0x80000000
X#define PRV$M_ACNT 0x00000200
X#define PRV$M_ALTPRI 0x00002000
Xunion prvdef `123
X    long prv$q_privilege[2]; /* added be J.E.M., not part of definition?! */
X    struct `123
X        unsigned prv$v_cmkrnl : 1;
X        unsigned prv$v_cmexec : 1;
X        unsigned prv$v_sysnam : 1;
X        unsigned prv$v_grpnam : 1;
X        unsigned prv$v_allspool : 1;
X        unsigned prv$v_detach : 1;
X        unsigned prv$v_diagnose : 1;
X        unsigned prv$v_log_io : 1;
X        unsigned prv$v_group : 1;
X        unsigned prv$v_noacnt : 1;
X        unsigned prv$v_prmceb : 1;
X        unsigned prv$v_prmmbx : 1;
X        unsigned prv$v_pswapm : 1;
X        unsigned prv$v_setpri : 1;
X        unsigned prv$v_setprv : 1;
X        unsigned prv$v_tmpmbx : 1;
X        unsigned prv$v_world : 1;
X        unsigned prv$v_mount : 1;
X        unsigned prv$v_oper : 1;
X        unsigned prv$v_exquota : 1;
X        unsigned prv$v_netmbx : 1;
X        unsigned prv$v_volpro : 1;
X        unsigned prv$v_phy_io : 1;
X        unsigned prv$v_bugchk : 1;
X        unsigned prv$v_prmgbl : 1;
X        unsigned prv$v_sysgbl : 1;
X        unsigned prv$v_pfnmap : 1;
X        unsigned prv$v_shmem : 1;
X        unsigned prv$v_sysprv : 1;
X        unsigned prv$v_bypass : 1;
X        unsigned prv$v_syslck : 1;
X        unsigned prv$v_share : 1;
X        unsigned prv$v_upgrade : 1;
X        unsigned prv$v_downgrade : 1;
X        unsigned prv$v_grpprv : 1;
X        unsigned prv$v_readall : 1;
X        unsigned prvdef$$_fill_3 : 2;
X        unsigned prv$v_security : 1;
X        unsigned prv$v_fill_15 : 1;
X        `125 prv$r_prvdef_bits0;
X    struct `123
X        unsigned prvdef$$_fill_1 : 9;
X        unsigned prv$v_acnt : 1;
X        unsigned prvdef$$_fill_2 : 3;
X        unsigned prv$v_altpri : 1;
X        unsigned prv$v_fill_16 : 2;
X        `125 prv$r_prvdef_bits1;
X`125 ;
X#endif
$ GOSUB UNPACK_FILE

$ FILE_IS = "CC.OPT"
$ CHECKSUM_IS = 1392527948
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
Xsys$share:vaxcrtl.exe/share
$ GOSUB UNPACK_FILE

$ FILE_IS = "COMPILE.COM"
$ CHECKSUM_IS = 1125872654
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X$! choose one of the following C compilers
X$ cc = "cc"`009! vax c
X$ !! cc = "gcc"`009! gnu c
X$!
X$ copt = "/debug"
X$ if "''p1'" .EQS. "LINK" then goto dolink
X$ 'cc' 'copt' uaf.c
X$ 'cc' 'copt' display.c
X$ 'cc' 'copt' init_cli.c
X$ 'cc' 'copt' parse.c
X$ 'cc' 'copt' select.c
X$ macro parse_uic.mar
X$ macro hpwd.mar
X$ set command/object uafcld
X$ dolink:
X$ link/nomap uaf,display,init_cli,parse,parse_uic,select,uafcld,hpwd,'cc'/opt
X$ runoff uaf.rnh
X$ exit
$ GOSUB UNPACK_FILE

$ FILE_IS = "DISPLAY.C"
$ CHECKSUM_IS = 373186981
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X#include <descrip.h>
X#include "uaf.h"
X#include "uaf_cld.h"
X
V#define WRAP(a) `123c += a; if (c > wrap) `123printf("\n  "); c = 2;`125;`125
X;
X
Xdisplay(struct UAFDEF *record, int len)
X`123
X  static int init = 0, wrap = 0x7fffffff;
X  static struct UAF_FIELDS field;
X  char *s;
X  extern char *get_value();
X  int c;
X
X  if (!init)
X  `123
X    init = 1;
X
X    init_parse("");
X    if (s = get_value("Wrap"))
X      wrap = atoi(s);
X
X    init_parse("DISPLAY.");
X    if (present("ACCESS"))
X    `123
X      field.network_access = 1;
X      field.local_access = 1;
X      field.dialup_access = 1;
X      field.remote_access = 1;
X      field.batch_access = 1;
X    `125                     `032
X    field.rtype = present("RTYPE");
X    field.version = present("VERSION");
X    field.usrdatoff = present("USRDATOFF");
X    field.account = present("ACCOUNT");
X    field.astlm = present("ASTLM");
X    field.batch_access `124= present("BATCH");
X    field.biolm = present("BIOLM");
X    field.bytlm = present("BYTLM");
X    field.defcli = present("CLI");
X    field.clitables = present("CLITABLES");
X    field.def_priv = present("DEFPRIVILEGES");
X    field.defdev = present("DEVICE");
X    field.dialup_access `124= present("DIALUP");
X    field.diolm = present("DIOLM");
X    field.defdir = present("DIRECTORY");
X    field.enqlm = present("ENQLM");
X    field.expiration = present("EXPIRATION");
X    field.fillm = present("FILLM");
X    field.flags = present("FLAGS");
X    field.jtquota = present("JTQUOTA");
X    field.logfails = present("LOGFAILS");
X    field.pwd_date = present("PWDCHANGE");
X    field.pwd2_date = present("PWD2CHANGE");
X    field.lastlogin_i = present("INTERACTIVE");
X    field.lastlogin_n = present("NONINTERACTIVE");
X    field.lgicmd = present("LGICMD");
X    field.local_access `124= present("LOCAL");
X    field.maxacctjobs = present("MAXACCTJOBS");
X    field.maxdetach = present("MAXDETACH");
X    field.maxjobs = present("MAXJOBS");
X    field.network_access `124= present("NETWORK");
X    field.owner = present("OWNER");
X    /* PASSWORD */
X    field.pgflquota = present("PGFLQUOTA");
X    field.prccnt = present("PRCLM");
X    field.primedays = present("PRIMEDAYS");
X    field.pri = present("PRIORITY");
X    field.priv = present("PRIVILEGES");
X    /* PWDEXPIRED */
X    field.pwd_lifetime = present("PWDLIFETIME");
X    field.pwd_length = present("PWDMINIMUM");
X    field.remote_access `124= present("REMOTE");
X    field.shrfillm = present("SHRFILLM");
X    field.tqcnt = present("TQELM");
X    field.uic = present("UIC");
X    field.username = present("USERNAME");
X    field.dfwscnt = present("WSDEFAULT");
X    field.wsextent = present("WSEXTENT");
X    field.wsquota = present("WSQUOTA");
X  `125
X
X  c = 0;
X  if (field.username)
X    WRAP(printf("user: %.*s ",12,record->uaf$t_username));
X
X  if (field.rtype)
X    WRAP(printf("rtype: %d ",record->uaf$b_rtype));
X
X  if (field.version)
X    WRAP(printf("version: %d ",record->uaf$b_version));
X
X  if (field.usrdatoff)
X    WRAP(printf("usrdatoff: %d ",record->uaf$w_usrdatoff));
X
X  if (field.uic)
X    WRAP(print_uic("UIC",record->uaf$r_uic_overlay.uaf$l_uic));
X
X  /* uaf$l_sub_id */
X  /* uaf$q_parent_id */
X
X  if (field.account)
X    WRAP(printf("account: %.*s ",8,record->uaf$t_account));
X
X  if (field.owner)
X    WRAP(print_ascic("owner",record->uaf$t_owner));
X
X  if (field.defdev && field.defdir)
X  `123
X    c += printf("default: ");
X    c += print_ascic("", record->uaf$t_defdev);
X    c += print_ascic("", record->uaf$t_defdir);
X    c += printf(" ");
X    if (c > wrap) `123printf("\n  "); c = 2;`125
X  `125
X  else
X  `123
X    if (field.defdev)
X      WRAP(print_ascic("device", record->uaf$t_defdev));
X    if (field.defdir)
X      WRAP(print_ascic("directory",record->uaf$t_defdir));
X  `125
X
X  if (field.lgicmd)
X    WRAP(print_ascic("login",record->uaf$t_lgicmd));
X
X  if (field.defcli)
X    WRAP(print_ascic("cli",record->uaf$t_defcli));
X
X  if (field.clitables)
X    WRAP(print_ascic("tables",record->uaf$t_clitables));
X
X  /* uaf$q_pwd */
X  /* uaf$q_pwd2 */
X
X  if (field.logfails)
X    WRAP(printf("login failures: %d ",record->uaf$w_logfails));
X
X  /* uaf$b_encrypt */
X  /* uaf$b_encrypt2 */
X
X  if (field.pwd_length)
X    WRAP(printf("pwd len: %d ",record->uaf$b_pwd_length));
X
X  if (field.expiration)
X    WRAP(print_date("expiration",record->uaf$q_expiration));
X
X  if (field.pwd_lifetime)
X    WRAP(print_date("pwd life",record->uaf$q_pwd_lifetime));
X
X  if (field.pwd_date)
X    WRAP(print_date("pwd change",record->uaf$q_pwd_date));
X
X  if (field.pwd2_date)
X    WRAP(print_date("pwd2 change",record->uaf$q_pwd2_date));
X
X  if (field.lastlogin_i)
X    WRAP(print_date("last ilogin", record->uaf$q_lastlogin_i));
X
X  if (field.lastlogin_n)
X    WRAP(print_date("last nlogin", record->uaf$q_lastlogin_n));
X
X  if (field.priv)
X    WRAP(print_privs("privilege",record->uaf$r_priv_overlay.uaf$q_priv));
X
X  if (field.def_priv)
V    WRAP(print_privs("default priv",record->uaf$r_def_priv_overlay.uaf$q_def_
Xpriv));
X
X  /* uaf$r_min_class */
X  /* uaf$r_max_class */
X
X  if (field.flags)
X    WRAP(print_flags("flags",record->uaf$r_flags_overlay.uaf$l_flags));
X
X  if (field.network_access)
X    WRAP(print_access("network",record->uaf$b_network_access_p,
X`009`009record->uaf$b_network_access_s));
X
X  if (field.batch_access)
X    WRAP(print_access("batch",record->uaf$b_batch_access_p,
X`009record->uaf$b_batch_access_s));
X
X  if (field.local_access)
X    WRAP(print_access("local",record->uaf$b_local_access_p,
X`009record->uaf$b_local_access_s));
X
X  if (field.dialup_access)
X    WRAP(print_access("dialup",record->uaf$b_dialup_access_p,
X`009record->uaf$b_dialup_access_s));
X
X  if (field.remote_access)
X    WRAP(print_access("remote",record->uaf$b_remote_access_p,
X`009record->uaf$b_remote_access_s));
X
X  if (field.primedays)
V    WRAP(print_days("prime days",record->uaf$r_primedays_overlay.uaf$b_primed
Xays));
X
X  if (field.pri)
X    WRAP(printf("priority: %d ",record->uaf$b_pri));
X
X  /* uaf$b_quepri */
X
X  if (field.maxjobs)
X    WRAP(printf("maxjobs: %d ",record->uaf$w_maxjobs));
X
X  if (field.maxacctjobs)
X    WRAP(printf("maxacctjobs: %d ",record->uaf$w_maxacctjobs));
X
X  if (field.maxdetach)
X    WRAP(printf("maxdetach: %d ",record->uaf$w_maxdetach));
X
X  if (field.prccnt)
X    WRAP(printf("prclim: %d ",record->uaf$w_prccnt));
X
X  if (field.biolm)
X    WRAP(printf("biolm: %d ",record->uaf$w_biolm));
X
X  if (field.diolm)
X    WRAP(printf("diolm: %d ",record->uaf$w_diolm));
X
X  if (field.tqcnt)
X    WRAP(printf("tqcnt: %d ",record->uaf$w_tqcnt));
X
X  if (field.astlm)
X    WRAP(printf("astlm: %d ",record->uaf$w_astlm));
X
X  if (field.enqlm)
X    WRAP(printf("enqlm: %d ",record->uaf$w_enqlm));
X
X  if (field.fillm)
X    WRAP(printf("fillm: %d ",record->uaf$w_fillm));
X
X  if (field.shrfillm)
X    WRAP(printf("shrfillm: %d ",record->uaf$w_shrfillm));
X
X  if (field.wsquota)
X    WRAP(printf("wsquota: %d ",record->uaf$l_wsquota));
X
X  if (field.dfwscnt)
X    WRAP(printf("wsdefault: %d ",record->uaf$l_dfwscnt));
X
X  if (field.wsextent)
X    WRAP(printf("wsextent: %d ",record->uaf$l_wsextent));
X
X  if (field.pgflquota)
X    WRAP(printf("pgflquota: %d ",record->uaf$l_pgflquota));
X
X  /* uaf$l_cputim */
X
X  if (field.bytlm)
X    WRAP(printf("bytlm: %d ",record->uaf$l_bytlm));
X
X  /* uaf$l_pbytlm */
X
X  if (field.jtquota)
X    WRAP(printf("jtquota: %d ",record->uaf$l_jtquota));
X
X  /* uaf$w_proxy_lim */
X  /* uaf$w_proxies */
X  /* uaf$w_account_lim */
X  /* uaf$w_accounts */
X
X  if (c) printf("\n");
X`125
X
Xtrim(char *str, int max)
X`123
X  while (str[--max] == ' ')
X    str[max] = '\0';
X`125
X
Xprint_uic(char *txt, long uic)
X`123
X  union
X  `123
X    long val;
X    short word[2];
X  `125 cvt;
X
X  cvt.val = uic;
X
X  return(printf("%s: [%05o,%05o] ",txt,cvt.word[1],cvt.word[0]));
X`125
X
Xprint_ascic(char *txt, char *str)
X`123
X  int len;
X
X  len = *str++;
X  if (txt && strlen(txt))
X    return(printf("%s: %.*s ",txt,len,str));
X  else
X    return(printf("%.*s",len,str));
X`125
X
Xprint_date(char *txt, long date[2])
X`123
X  char s[27];
X  struct dsc$descriptor d = `123sizeof(s) - 1,0,0,s`125;
X  short len;
X
X  if ((date[0] == 0) && (date[1] == 0))
X  `123
X    return(printf("%s: (none) ",txt));
X  `125
X  else
X  `123
X    sys$asctim(&len,&d,date,0);
X    return(printf("%s: %.*s ",txt,len,s));
X  `125
X`125
X
Xprint_privs(char *txt, union prvdef *priv)
X`123
X  char comma = ' ';
X  int c = 0, i;
X
X  c += printf("%s:",txt);
X  if ((priv->prv$q_privilege[0] == 0) && (priv->prv$q_privilege[1] == 0))
X  `123
X    c += printf(" (none)");
X  `125
X  else
X  `123
X    for (i = 0; i < 32; ++i)
X    `123
X      if (priv->prv$q_privilege[0] & (1 << i))
X      `123
X        c += printf("%c%s",comma,priv_txt[i]);
X        comma = ',';
X       `125
X    `125
X    for (i = 0; i < 7; ++i)
X    `123
X      if ((i != 4) && (i != 5)) /* these two have been removed! */
X      `123
X        if (priv->prv$q_privilege[1] & (1 << i))
X        `123
X          c += printf("%c%s",comma,priv_txt[i+32]);
X          comma = ',';
X         `125
X      `125
X    `125
X  `125
X
X  c += printf(" ");
X  return(c);
X`125
X
Xprint_flags(char *txt, unsigned long flag)
X`123
X  char comma = ' ';
X  int c = 0, i;
X
X  c += printf("%s:",txt);
X  if (flag == 0)
X  `123
X    c += printf(" (none)");
X  `125
X  else
X  `123
X    for (i = 0; i < 16; ++i)
X    `123
X      if (flag & (1 << i))
X      `123
X        c += printf("%c%s",comma,flag_txt[i]);
X        comma = ',';
X       `125
X    `125
X  `125
X
X  c += printf(" ");
X  return(c);
X`125
X
Xprint_days(char *txt, unsigned char days)
X`123
X  char comma = ' ';
X  int c = 0, i;
X
X  c += printf("%s:",txt);
X  if (days == 0)
X  `123
X    c += printf(" (all)");
X  `125
X  else
X  `123
X    for (i = 0; i < 7; ++i)
X    `123
X      if (!(days & (1 << i)))
X      `123
X        c += printf("%c%s",comma,primeday_txt[i]);
X        comma = ',';
X       `125
X    `125
X  `125
X  c += printf(" ");
X
X  return(c);
X`125
X
Xprint_access(char *txt, char *primary, char *secondary)
X`123
X  int c = 0, t, i;
X
X  c += printf("%s:",txt);
X
X  c += printf(" Primary: ");
X  t = *(long *)primary & 0x00ffffff;
X  if (t == 0)
X  `123
X    c += printf("full access");
X  `125
X  else
X  `123
X    if (t == 0x00ffffff)
X    `123
X      c += printf("no access");
X    `125
X    else
X    `123
X      for (i = 0; i < 24; ++i)
X        c += printf("%s",(t & (1 << i))?"-":"#");
X    `125
X  `125
X
X  c += printf(" Secondary: ");
X  t = *(long *)secondary & 0x00ffffff;
X  if (t == 0)
X  `123
X    c += printf("full access");
X  `125
X  else
X  `123
X    if (t == 0x00ffffff)
X    `123
X      c += printf("no access");
X    `125
X    else
X    `123
X      for (i = 0; i < 24; ++i)
X        c += printf("%s",(t & (1 << i))?"-":"#");
X    `125
X  `125
X
X  c += printf(" ");
X  return(c);
X`125
$ GOSUB UNPACK_FILE

$ FILE_IS = "GCC.OPT"
$ CHECKSUM_IS = 2230796
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
Xgnu_cc:[000000]gcclib/lib,-
Xsys$share:vaxcrtl.exe/share
$ GOSUB UNPACK_FILE

$ FILE_IS = "GUESS.MAIL"
$ CHECKSUM_IS = 376985956
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
XFrom:`009IN%"PJS@grouch.JPL.NASA.GOV"  "Peter Scott" 19-OCT-1989 12:22:51.65
XTo:`009joe%fhcrcvax.bitnet@cunyvm.cuny.edu
XCC:`009
XSubj:`009GUESS_PASSWORD.C
X
XReceived: from JNET-DAEMON by FHCRCVAX.BITNET; Thu, 19 Oct 89 12:21 PST
XReceived: From CUNYVM(MAILER) by FHCRCVAX with Jnet id 8614 for JOE@FHCRCVAX;
X Thu, 19 Oct 89 12:20 PST
VReceived: from CUNYVM by CUNYVM.BITNET (Mailer R2.03B) with BSMTP id 7379; Th
Xu,
X 19 Oct 89 15:16:08 EDT
XReceived: from grouch.JPL.NASA.GOV by CUNYVM.CUNY.EDU (IBM VM SMTP R1.2.1MX)
X with TCP; Thu, 19 Oct 89 15:16:04 EDT
XReceived: by grouch id <000009636E1@grouch.JPL.NASA.GOV> ; Thu, 19 Oct 89
X 11:39:26 PST
XDate: Thu, 19 Oct 89 11:35:11 PST
XFrom: Peter Scott <PJS@grouch.JPL.NASA.GOV>
XSubject: GUESS_PASSWORD.C
XTo: joe%fhcrcvax.bitnet@cunyvm.cuny.edu
XX-VMS-Mail-To: EXOS%"joe%fhcrcvax.bitnet@cunyvm.cuny.edu"
XMessage-ID: <891019113511.000009636E1@grouch.JPL.NASA.GOV>
X
XThanks very much for your GUESS_PASSWORD program.  I have modified it
Xa fair amount and am mailing it back to you to share the mods with you.
XI have modified it to expect a file called WORDS., which contains up to
X25,000 words in any case, one per line (I just ftp the file /usr/dict/words
Xfrom a Unix system), and eliminated WORDDEF.H.  That part's not very robust,
Xit expects the file to be in the current directory.  You might change it
Xto use a logical name or some such.  All the words are read into an array
Xat startup.  I have also modified it to check against the username, and
Xtheir first and last names in the OWNER field.  Also it outputs each username
Xwhether or not their password is guessed so you have an idea how far it's
Xgotten, since it takes `12610 minutes per user on an 11/785.
X`032
XPeter Scott (pjs@grouch.jpl.nasa.gov)
V-----------------------------------------------------------------------------
X--
X`032
X/* Guess_Password, written by Joe Meadows, released to the world MMM DD, YY.
X   This is a public domain utility. No parts of this utility are
X   copyrighted in any way. It may be used in any way, by anyone.
X   There are no restrictions on this code. You may include it
X   in a commercial package if you wish. Feel free to send money,
X   or better yet, make a donation to the FHCRC.
X`032
X  Joe Meadows Jr.
X  VAX/VMS System Manager / guru in training
X  Fred Hutchinson Cancer Research Center
X  1124 Columbia St.
X  Seattle Wa. 98104
X     bitnet - JOE@FHCRCVAX
X     arpa   - JOE%FHCRCVAX.BITNET@WISCVM.WISC.EDU
X     voice  - (206) 467-4970
X*/
X`032
X/* Modification History
X   --------------------
X*/
X#include <descrip.h>
X#include <rms.h>
X`032
X#include <stdio.h>
X#include <string.h>
X`032
X#include "uaf.h"
X`032
Xmain(int argc, char *argv[])
X`123
X  struct FAB fab;
X  struct RAB rab;
X  struct UAFDEF record;
X  char pswd_bin[8];
V  char owner[UAF$S_OWNER+1], firstname[UAF$S_OWNER+1], lastname[UAF$S_OWNER+1
X];
X  struct dsc$descriptor outpswd = `123sizeof(pswd_bin),0,0,pswd_bin`125;
X  struct dsc$descriptor username = `1230,0,0,0`125;
X  struct dsc$descriptor word = `1230,0,0,0`125;
X  int sts, i, guessed = 0, records = 0;
X  FILE *fin = fopen ("WORDS.", "r");
X  char *wordlist[25000];
X  char **try;
X`032
X  if (fin == NULL)
X  `123
X    fprintf (stderr, "Can't open file WORDS.: quitting\n");
X    exit (1);
X  `125
X  else
X    read_words (fin, wordlist);
X`032
X  fab = cc$rms_fab;
X  rab = cc$rms_rab;
X  fab.fab$b_fns = sizeof("sysuaf");
X  fab.fab$l_fna = "sysuaf";
X  fab.fab$b_dns = sizeof("sys$system:.dat");
X  fab.fab$l_dna = "sys$system:.dat";
X  fab.fab$b_fac = FAB$M_GET;
V  fab.fab$b_shr = FAB$M_SHRGET `124 FAB$M_SHRPUT `124 FAB$M_SHRDEL `124 FAB$M
X_SHRUPD;
X  rab.rab$l_rop = RAB$M_NLK;
X  rab.rab$w_usz = sizeof(record);
X  rab.rab$l_ubf = & record;
X  rab.rab$l_fab = &fab;
X`032
X  sts = SYS$OPEN(&fab);
X  if (!(sts & 1)) return(sts);
X`032
X  sts = SYS$CONNECT(&rab);
X  if (!(sts & 1)) return(sts);
X`032
X  for (i = 1; i < argc; ++i)
X    strupcase(argv[i]);
X`032
X  while(SYS$GET(&rab) & 1)
X  `123
X    if (record.uaf$b_rtype == 1)
X    `123
X      char *cptr;
X`032
X      strncpy (owner, record.uaf$t_owner+1, UAF$S_OWNER);
X      *(owner+*(record.uaf$t_owner)) = '\0';
X      strupcase (owner);
X      strcpy (firstname, owner);
X      cptr = strchr (firstname, ' ');
X      if (cptr)
X        *cptr = '\0';
X      cptr = strrchr (owner, ' ');
X      if (cptr)
X        strcpy (lastname, cptr + 1);
X      else
X        strcpy (lastname, owner);
X      username.dsc$w_length = 12;
X      username.dsc$a_pointer = record.uaf$t_username;
X      ++records;
X`032
X      try = wordlist;
X      printf ("\n%.*s - ", 12, record.uaf$t_username);
X      while (*try)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        word.dsc$w_length = strlen(*try);
X        word.dsc$a_pointer = *try;
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          printf("\"%s\"",*try);
X          ++guessed;
X          break;
X        `125
X        ++try;
X      `125
X`032
X/* Check username as password on first pass, first & last names on previous
X   passes (kludgy as hell, but it works) */
X`032
X      for (i = -2; i < argc; ++i)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        if (i > 0)
X        `123
X          word.dsc$w_length = strlen(argv[i]);
X          word.dsc$a_pointer = argv[i];
X        `125
X        else switch (i)
X        `123
X`032
X          case -2 : word.dsc$w_length = strlen (firstname);
X                    word.dsc$a_pointer = firstname;
X                    break;
X`032
X          case -1 : word.dsc$w_length = strlen (lastname);
X                    word.dsc$a_pointer = lastname;
X                    break;
X`032
X          case  0 : word.dsc$w_length = mystrlen (record.uaf$t_username);
X                    word.dsc$a_pointer = record.uaf$t_username;
X                    break;
X`032
X          default : printf ("This can't happen!!!\n");
X                    break;
X        `125
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          printf("\"%s\"",argv[i]);
X          ++guessed;
X          break;
X        `125
X      `125
X    `125
X  `125
X  printf("\n%d of %d accounts were guessed\n",guessed,records);
X`125
X`032
Xstrupcase(char *s)
X`123
X  while (*s)
X  `123
X    *s = toupper(*s); ++s;
X  `125
X`125
X`032
Xcmp_quad(int x1[2], int x2[2])
X`123
X  return( (x1[0] == x2[0]) &&  (x1[1] == x2[1]) );
X`125
X`032
Xint mystrlen (char *str)
X`123
X  while (*(str + strlen (str) - 1) == ' ')
X    *(str + strlen (str) - 1) = '\0';
X  return strlen (str);
X`125
X`032
Xread_words (FILE *fin, char *wordlist[])
X`123
X  char str[100];
X  int i = 0;
X`032
X  while (fgets (str, 99, fin))
X  `123
X    *(str+strlen(str)-1) = '\0';                    /* remove /n */
X    wordlist[i] = malloc (strlen (str));
X    strupcase (str);
X    strcpy (wordlist[i++], str);
X  `125
X  wordlist[i] = 0;
X  fclose (fin);
X`125
X`032
XFrom:`009IN%"grant@umigw.Miami.EDU" 20-OCT-1989 13:39:48.06
XTo:`009JOE%FHCRCVAX.BITNET@OLY.ACS.WASHINGTON.EDU
XCC:`009
XSubj:`009guess_password updates
X
XReceived: from JNET-DAEMON by FHCRCVAX.BITNET; Fri, 20 Oct 89 13:39 PST
XReceived: From UWAVM(MAILER) by FHCRCVAX with Jnet id 9867 for JOE@FHCRCVAX;
X Fri, 20 Oct 89 13:39 PST
XReceived: from UWAVM by UWAVM.ACS.WASHINGTON.EDU (Mailer R2.04) with BSMTP id
X 6093; Fri, 20 Oct 89 13:37:30 PDT
XReceived: from umigw.Miami.EDU by UWAVM.ACS.WASHINGTON.EDU (IBM VM SMTP
X R1.2.1MX) with TCP; Fri, 20 Oct 89 13:37:25 PDT
XReceived: by umigw.Miami.EDU (5.57/Ult2.4-Cbjm1); Fri, 20 Oct 89 16:26:13 EDT
X id AA26432 for JOE%FHCRCVAX.BITNET@oly.acs.washington.edu
XDate: Fri, 20 Oct 89 16:26:11 EDT
XFrom: grant@umigw.Miami.EDU
XSubject: guess_password updates
XTo: JOE%FHCRCVAX.BITNET@OLY.ACS.WASHINGTON.EDU
XMessage-Id: <8910202026.AA26432@umigw.Miami.EDU>
XX-Mailer: ELM [version 2.2 PL11]
X
XJoe - for your perusal.  We were being banged badly by the SPAN
Xworm this week and I asked Angel Li - our local c/systems person
X - if he could quickly cobble up your guess_password program to to
Xcheck for username=password.  He did and it worked nicely.  Ten
Xpercent of our users had username=password :-(  I passed the routine
Xaround this area and it was well received.  Angel has said you are
Xwelcome to include any of the changes you wish
X(angel@miami.miami.edu).  There have been several request for this
Xtype of ability in the last few days.  If you decide to include the
Xchanges and can handle the traffic on your server, I am sure their are
Xsome managers who could use this.  These are diff/slp for guess_password
Xand wordlist
X$! ------------------ CUT HERE -----------------------
X$ v='f$verify(f$trnlnm("SHARE_VERIFY"))'
X$!
X$! This archive created by VMS_SHARE Version 7.1-004  3-AUG-1989
X$!   On 20-OCT-1989 16:20:19.79   By user GRANT
X$!
X$! This VMS_SHARE Written by:
X$!    Andy Harper, Kings College London UK
X$!
X$! Acknowledgements to:
X$!    James Gray       - Original VMS_SHARE
X$!    Michael Bednarek - Original Concept and implementation
X$!
X$! TO UNPACK THIS SHARE FILE, CONCATENATE ALL PARTS IN ORDER
X$! AND EXECUTE AS A COMMAND PROCEDURE  (  @name  )
X$!
X$! THE FOLLOWING FILE(S) WILL BE CREATED AFTER UNPACKING:
X$!       1. GUESS_PASSWORD.DIF;1
X$!       2. WORDLIST.DIF;1
X$!       3. UPDATE_GUESS.COM;1
X$!
X$set="set"
X$set symbol/scope=(nolocal,noglobal)
X$f=f$parse("SHARE_TEMP","SYS$SCRATCH:.TMP_"+f$getjpi("","PID"))
X$e="write sys$error  ""%UNPACK"", "
X$w="write sys$output ""%UNPACK"", "
X$ if f$trnlnm("SHARE_LOG") then $ w = "!"
X$ if f$getsyi("version") .ges. "V4.4" then $ goto START
X$ e "-E-OLDVER, Must run at least VMS 4.4"
X$ v=f$verify(v)
X$ exit 44
X$UNPACK: SUBROUTINE ! P1=filename, P2=checksum
X$ if f$search(P1) .eqs. "" then $ goto file_absent
X$ e "-W-EXISTS, File ''P1' exists. Skipped."
X$ delete/nolog 'f'*
X$ exit
X$file_absent:
X$ if f$parse(P1) .nes. "" then $ goto dirok
X$ dn=f$parse(P1,,,"DIRECTORY")
X$ w "-I-CREDIR, Creating directory ''dn'."
X$ create/dir 'dn'
X$ if $status then $ goto dirok
X$ e "-E-CREDIRFAIL, Unable to create ''dn'. File skipped."
X$ delete/nolog 'f'*
X$ exit
X$dirok:
X$ w "-I-PROCESS, Processing file ''P1'."
X$ define/user sys$output nl:
X$ EDIT/TPU/NOSEC/NODIS/COM=SYS$INPUT 'f'/OUT='P1'
XPROCEDURE Unpacker ON_ERROR ENDON_ERROR;SET(FACILITY_NAME,"UNPACK");SET(
XSUCCESS,OFF);SET(INFORMATIONAL,OFF);f:=GET_INFO(COMMAND_LINE,"file_name");
Xbuff:=CREATE_BUFFER(f,f);p:=SPAN(" ")@r&LINE_END;POSITION(BEGINNING_OF(buff))
X;LOOP EXITIF SEARCH(p,FORWARD)=0;POSITION(r);ERASE(r);ENDLOOP;POSITION(
XBEGINNING_OF(buff));g:=0;LOOP EXITIF MARK(NONE)=END_OF(buff);x:=
XERASE_CHARACTER(1);IF g = 0 THEN IF x="X" THEN MOVE_VERTICAL(1);ENDIF;IF x=
X"V" THEN APPEND_LINE;MOVE_HORIZONTAL(-CURRENT_OFFSET);MOVE_VERTICAL(1);ENDIF;
XIF x="+" THEN g:=1;ERASE_LINE;ENDIF;ELSE IF x="-" THEN g:=0;ENDIF;ERASE_LINE;
VENDIF;ENDLOOP;p:="`096";POSITION(BEGINNING_OF(buff));LOOP r:=SEARCH(p,FORWARD
X);
XEXITIF r=0;POSITION(r);ERASE(r);COPY_TEXT(ASCII(INT(ERASE_CHARACTER(3))));
XENDLOOP;o:=GET_INFO(COMMAND_LINE,"output_file");WRITE_FILE(buff,o);
XENDPROCEDURE;Unpacker;EXIT;
X$ delete/nolog 'f'*
X$ CHECKSUM 'P1'
X$ IF CHECKSUM$CHECKSUM .eqs. P2 THEN $ EXIT
X$ e "-E-CHKSMFAIL, Checksum of ''P1' failed."
X$ ENDSUBROUTINE
X$START:
X$ create/nolog 'f'
XX-   31
XX  char`096009uName`09609113`096093;
XX-   67
XX      strncpy(uName, record.uaf$t_username, 12);
XX      uName`096091lenOf(uName, 12)`096093 = 0;
XX
XX-   71
XX      printf("Checking %s\n", uName);
XX
XX      words`0960910`096093 = uName;
XX-  117
XX
XXlenOf(s, maxLen)
XXchar`096009`096009*s;
XXint`096009`096009maxLen;
XX`096123
XX    char`096009`096009c;
XX    int`096009`096009`096009i = 0;
XX
XX    for (i=0; (c = *s++) && i < maxLen; i++) `096123
XX    `096009if (c == ' ')
XX    `096009    break;
XX    `096125
XX    return i;
XX`096125
XX/
X$ CALL UNPACK GUESS_PASSWORD.DIF;1 1298159663
X$ create/nolog 'f'
XX-    1
XX"",
XX/
X$ CALL UNPACK WORDLIST.DIF;1 538976541
X$ create/nolog 'f'
XX$ edit/sum guess_password.c/update=guess_password.dif
XX$ edit/sum wordlist.h/update=wordlist.h
XX$ make guess_password.exe
X$ CALL UNPACK UPDATE_GUESS.COM;1 169626609
X$ v=f$verify(v)
X$ EXIT
X--
Xgrant@umigw.miami.edu   Grant Basham     RSMAS Computer Facility
X`032
X`032
XFrom:`009IN%"PJS@grouch.JPL.NASA.GOV"  "Peter Scott" 21-OCT-1989 18:32:27.54
XTo:`009joe%fhcrcvax.bitnet@cunyvm.cuny.edu
XCC:`009
VSubj:`009UPDATE to GUESS_PASSWORD - the previous one didn't print correct gue
Xsses of the first, last, or user names correctly, this one does.
X
XReceived: from JNET-DAEMON by FHCRCVAX.BITNET; Sat, 21 Oct 89 18:31 PST
XReceived: From CUNYVM(MAILER) by FHCRCVAX with Jnet id 5811 for JOE@FHCRCVAX;
X Sat, 21 Oct 89 18:31 PST
VReceived: from CUNYVM by CUNYVM.BITNET (Mailer R2.03B) with BSMTP id 9206; Sa
Xt,
X 21 Oct 89 19:00:11 EDT
XReceived: from grouch.JPL.NASA.GOV by CUNYVM.CUNY.EDU (IBM VM SMTP R1.2.1MX)
X with TCP; Sat, 21 Oct 89 19:00:09 EDT
XReceived: by grouch id <000005381D1@grouch.JPL.NASA.GOV> ; Sat, 21 Oct 89
X 15:56:22 PST
XDate: Sat, 21 Oct 89 15:55:26 PST
XFrom: Peter Scott <PJS@grouch.JPL.NASA.GOV>
XSubject: UPDATE to GUESS_PASSWORD - the previous one didn't print correct
X guesses of the first, last, or user names correctly, this one does.
XTo: joe%fhcrcvax.bitnet@cunyvm.cuny.edu
XX-VMS-Mail-To: EXOS%"joe%fhcrcvax.bitnet@cunyvm.cuny.edu"
XMessage-ID: <891021155526.000005381D1@grouch.JPL.NASA.GOV>
X
X/* Guess_Password, written by Joe Meadows, released to the world MMM DD, YY.
X   This is a public domain utility. No parts of this utility are
X   copyrighted in any way. It may be used in any way, by anyone.
X   There are no restrictions on this code. You may include it
X   in a commercial package if you wish. Feel free to send money,
X   or better yet, make a donation to the FHCRC.
X`032
X  Joe Meadows Jr.
X  VAX/VMS System Manager / guru in training
X  Fred Hutchinson Cancer Research Center
X  1124 Columbia St.
X  Seattle Wa. 98104
X     bitnet - JOE@FHCRCVAX
X     arpa   - JOE%FHCRCVAX.BITNET@WISCVM.WISC.EDU
X     voice  - (206) 467-4970
X*/
X`032
X/* Modification History
X   --------------------
X*/
X#include <descrip.h>
X#include <rms.h>
X`032
X#include <stdio.h>
X#include <string.h>
X`032
X#include "uaf.h"
X`032
Xmain(int argc, char *argv[])
X`123
X  struct FAB fab;
X  struct RAB rab;
X  struct UAFDEF record;
X  char pswd_bin[8];
V  char owner[UAF$S_OWNER+1], firstname[UAF$S_OWNER+1], lastname[UAF$S_OWNER+1
X];
X  struct dsc$descriptor outpswd = `123sizeof(pswd_bin),0,0,pswd_bin`125;
X  struct dsc$descriptor username = `1230,0,0,0`125;
X  struct dsc$descriptor word = `1230,0,0,0`125;
X  int sts, i, guessed = 0, records = 0;
X  FILE *fin = fopen ("WORDS.", "r");
X  char *wordlist[25000];
X  char **try;
X`032
X  if (fin == NULL)
X  `123
X    fprintf (stderr, "Can't open file WORDS.: quitting\n");
X    exit (1);
X  `125
X  else
X    read_words (fin, wordlist);
X`032
X  fab = cc$rms_fab;
X  rab = cc$rms_rab;
X  fab.fab$b_fns = sizeof("sysuaf");
X  fab.fab$l_fna = "sysuaf";
X  fab.fab$b_dns = sizeof("sys$system:.dat");
X  fab.fab$l_dna = "sys$system:.dat";
X  fab.fab$b_fac = FAB$M_GET;
V  fab.fab$b_shr = FAB$M_SHRGET `124 FAB$M_SHRPUT `124 FAB$M_SHRDEL `124 FAB$M
X_SHRUPD;
X  rab.rab$l_rop = RAB$M_NLK;
X  rab.rab$w_usz = sizeof(record);
X  rab.rab$l_ubf = & record;
X  rab.rab$l_fab = &fab;
X`032
X  sts = SYS$OPEN(&fab);
X  if (!(sts & 1)) return(sts);
X`032
X  sts = SYS$CONNECT(&rab);
X  if (!(sts & 1)) return(sts);
X`032
X  for (i = 1; i < argc; ++i)
X    strupcase(argv[i]);
X`032
X  while(SYS$GET(&rab) & 1)
X  `123
X    if (record.uaf$b_rtype == 1)
X    `123
X      char *cptr;
X`032
X      strncpy (owner, record.uaf$t_owner+1, UAF$S_OWNER);
X      *(owner+*(record.uaf$t_owner)) = '\0';
X      strupcase (owner);
X      strcpy (firstname, owner);
X      cptr = strchr (firstname, ' ');
X      if (cptr)
X        *cptr = '\0';
X      cptr = strrchr (owner, ' ');
X      if (cptr)
X        strcpy (lastname, cptr + 1);
X      else
X        strcpy (lastname, owner);
X      username.dsc$w_length = 12;
X      username.dsc$a_pointer = record.uaf$t_username;
X      ++records;
X`032
X      try = wordlist;
X      printf ("\n%.*s - ", 12, record.uaf$t_username);
X      while (*try)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        word.dsc$w_length = strlen(*try);
X        word.dsc$a_pointer = *try;
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          printf("\"%s\"",*try);
X          ++guessed;
X          break;
X        `125
X        ++try;
X      `125
X`032
X/* Check username as password on first pass, first & last names on previous
X   passes (kludgy as hell, but it works) */
X`032
X      for (i = -2; i < argc; ++i)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        if (i > 0)
X        `123
X          word.dsc$w_length = strlen(argv[i]);
X          word.dsc$a_pointer = argv[i];
X        `125
X        else switch (i)
X        `123
X`032
X          case -2 : word.dsc$w_length = strlen (firstname);
X                    word.dsc$a_pointer = firstname;
X                    break;
X`032
X          case -1 : word.dsc$w_length = strlen (lastname);
X                    word.dsc$a_pointer = lastname;
X                    break;
X`032
X          case  0 : word.dsc$w_length = mystrlen (record.uaf$t_username);
X                    word.dsc$a_pointer = record.uaf$t_username;
X                    break;
X`032
X          default : printf ("This can't happen!!!\n");
X                    break;
X        `125
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          switch (i)
X          `123
X            case -2 : printf ("\"%s\"", firstname);
X                      break;
X`032
X            case -1 : printf ("\"%s\"", lastname);
X                      break;
X`032
X            case  0 : printf ("\"%.*s\"", 12, record.uaf$t_username);
X                      break;
X`032
X            default : printf ("\"%s\"", argv[i]);
X                      break;
X          `125
X          ++guessed;
X          break;
X        `125
X      `125
X    `125
X  `125
X  printf("\n%d of %d accounts were guessed\n",guessed,records);
X`125
X`032
Xstrupcase(char *s)
X`123
X  while (*s)
X  `123
X    *s = toupper(*s); ++s;
X  `125
X`125
X`032
Xcmp_quad(int x1[2], int x2[2])
X`123
X  return( (x1[0] == x2[0]) &&  (x1[1] == x2[1]) );
X`125
X`032
Xint mystrlen (char *str)
X`123
X  while (*(str + strlen (str) - 1) == ' ')
X    *(str + strlen (str) - 1) = '\0';
X  return strlen (str);
X`125
X`032
Xread_words (FILE *fin, char *wordlist[])
X`123
X  char str[100];
X  int i = 0;
X`032
X  while (fgets (str, 99, fin))
X  `123
X    *(str+strlen(str)-1) = '\0';                    /* remove /n */
X    wordlist[i] = malloc (strlen (str));
X    strupcase (str);
X    strcpy (wordlist[i++], str);
X  `125
X  wordlist[i] = 0;
X  fclose (fin);
X`125
$ GOSUB UNPACK_FILE

$ FILE_IS = "GUESS_PASSWORD.C"
$ CHECKSUM_IS = 1432097997
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X/* Guess_Password, written by Joe Meadows, released to the world in '89.
X   This is a public domain utility. No parts of this utility are
X   copyrighted in any way. It may be used in any way, by anyone.
X   There are no restrictions on this code. You may include it
X   in a commercial package if you wish. Feel free to send money,
X   or better yet, make a donation to the FHCRC.
X`032
X  Joe Meadows Jr.
X  VAX/VMS System Manager / guru in training
X  Fred Hutchinson Cancer Research Center
X  1124 Columbia St.
X  Seattle Wa. 98104
X     bitnet - JOE@FHCRCVAX
X     arpa   - JOE%FHCRCVAX.BITNET@WISCVM.WISC.EDU
X     voice  - (206) 467-4970
X*/
X`032
X/* Modification History
X   --------------------
X   Oct 23, 1989
X   Peter Scott - PJS@grouch.JPL.NASA.GOV added support for a word dictionary
X`009`009and check for password=(username `124 lastname `124 firstname)
X
X   I have modified it to expect a file called WORDS., which contains up to
V   25,000 words in any case, one per line (I just ftp the file /usr/dict/word
Xs
V   from a Unix system), and eliminated WORDDEF.H.  That part's not very robus
Xt,
X   it expects the file to be in the current directory.  You might change it
X   to use a logical name or some such.  All the words are read into an array
X   at startup.  I have also modified it to check against the username, and
V   their first and last names in the OWNER field.  Also it outputs each usern
Xame
X   whether or not their password is guessed so you have an idea how far it's
X   gotten, since it takes `12610 minutes per user on an 11/785.
X
X
X   (thanks also to Angel Li - angel@miami.miami.edu, who did similar work
X    and had the changes mailed to me.)
X
X   I changed it to use a logical name, and added back the wordlist. Note that
X   there are a few #define's which you may want to modify, and that the first
X   name/last name handling may need to be modified for your site. The version
X   enclosed (by PJS) supports names separated by spaces. I just cribbed some
X   code from STATUS to add support for "last, first" (it rearranges it to
X   "first last" then continues with PJS's code).
X*/
X
X#include <descrip.h>
X#include <rms.h>
X`032
X#include <stdio.h>
X#include <string.h>
X`032
X#include "uaf.h"
X`032
X/* the following should be 0 if reading words from a file */
X/* a value of 1 uses the internally defined wordlist */
X#define USE_WORDLIST 1
X
X#if USE_WORDLIST == 1
X#  include "wordlist.h"
X#else
X/* the following can/should be changed to reflect your sites usage */
X#  define DICT_NAME "DICTIONARY"
X#  define DICT_DFLT "dnm=SYS$SYSTEM:.DAT"
X#  define MAXWORDS 25000
X#endif
X
Xmain(int argc, char *argv[])
X`123
X  struct FAB fab;
X  struct RAB rab;
X  struct UAFDEF record;
X  char pswd_bin[8];
V  char owner[UAF$S_OWNER+1], firstname[UAF$S_OWNER+1], lastname[UAF$S_OWNER+1
X];
X  struct dsc$descriptor outpswd = `123sizeof(pswd_bin),0,0,pswd_bin`125;
X  struct dsc$descriptor username = `1230,0,0,0`125;
X  struct dsc$descriptor word = `1230,0,0,0`125;
X  int sts, i, guessed = 0, records = 0;
X#if USE_WORDLIST == 0
X  FILE *fin = fopen (DICT_NAME, "r",DICT_DFLT);
X  char *wordlist[MAXWORDS];
X#endif
X  char **try;
X`032
X#if USE_WORDLIST == 0
X  if (fin == NULL)
X  `123
X    fprintf (stderr, "Can't open DICTIONARY: quitting\n");
X    exit (1);
X  `125
X  else
X    read_words (fin, wordlist);
X#endif
X`032
X  fab = cc$rms_fab;
X  rab = cc$rms_rab;
X  fab.fab$b_fns = sizeof("sysuaf");
X  fab.fab$l_fna = "sysuaf";
X  fab.fab$b_dns = sizeof("sys$system:.dat");
X  fab.fab$l_dna = "sys$system:.dat";
X  fab.fab$b_fac = FAB$M_GET;
V  fab.fab$b_shr = FAB$M_SHRGET `124 FAB$M_SHRPUT `124 FAB$M_SHRDEL `124 FAB$M
X_SHRUPD;
X  rab.rab$l_rop = RAB$M_NLK;
X  rab.rab$w_usz = sizeof(record);
X  rab.rab$l_ubf = & record;
X  rab.rab$l_fab = &fab;
X`032
X  sts = SYS$OPEN(&fab);
X  if (!(sts & 1)) return(sts);
X`032
X  sts = SYS$CONNECT(&rab);
X  if (!(sts & 1)) return(sts);
X`032
X  for (i = 1; i < argc; ++i)
X    strupcase(argv[i]);
X`032
X  while(SYS$GET(&rab) & 1)
X  `123
X    if (record.uaf$b_rtype == 1)
X    `123
X      char *cptr;
X`032
X      strncpy (owner, record.uaf$t_owner+1, UAF$S_OWNER);
X      *(owner+*(record.uaf$t_owner)) = '\0';
X      fix_personal_name(owner,owner); /* checks for "," and rearranges */
X      strupcase (owner);
X      strcpy (firstname, owner);
X      cptr = strchr (firstname, ' ');
X      if (cptr)
X        *cptr = '\0';
X      cptr = strrchr (owner, ' ');
X      if (cptr)
X        strcpy (lastname, cptr + 1);
X      else
X        strcpy (lastname, owner);
X      username.dsc$w_length = 12;
X      username.dsc$a_pointer = record.uaf$t_username;
X      ++records;
X`032
X#if USE_WORDLIST == 1
X      try = words;
X#else
X      try = wordlist;
X#endif
X      printf ("\n%.*s - ", 12, record.uaf$t_username);
X      while (*try)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        word.dsc$w_length = strlen(*try);
X        word.dsc$a_pointer = *try;
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          printf("\"%s\"",*try);
X          ++guessed;
X          break;
X        `125
X        ++try;
X      `125
X`032
X/* Check username as password on first pass, first & last names on previous
X   passes (kludgy as hell, but it works) */
X`032
X      for (i = -2; i < argc; ++i)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        if (i > 0)
X        `123
X          word.dsc$w_length = strlen(argv[i]);
X          word.dsc$a_pointer = argv[i];
X        `125
X        else switch (i)
X        `123
X`032
X          case -2 : word.dsc$w_length = strlen (firstname);
X                    word.dsc$a_pointer = firstname;
X                    break;
X`032
X          case -1 : word.dsc$w_length = strlen (lastname);
X                    word.dsc$a_pointer = lastname;
X                    break;
X`032
X          case  0 : word.dsc$w_length = mystrlen (record.uaf$t_username);
X                    word.dsc$a_pointer = record.uaf$t_username;
X                    break;
X`032
X          default : printf ("This can't happen!!!\n");
X                    break;
X        `125
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          switch (i)
X          `123
X            case -2 : printf ("\"%s\"", firstname);
X                      break;
X`032
X            case -1 : printf ("\"%s\"", lastname);
X                      break;
X`032
X            case  0 : printf ("\"%.*s\"", 12, record.uaf$t_username);
X                      break;
X`032
X            default : printf ("\"%s\"", argv[i]);
X                      break;
X          `125
X          ++guessed;
X          break;
X        `125
X      `125
X    `125
X  `125
X  printf("\n%d of %d accounts were guessed\n",guessed,records);
X`125
X`032
Xstrupcase(char *s)
X`123
X  while (*s)
X  `123
X    *s = toupper(*s); ++s;
X  `125
X`125
X`032
Xcmp_quad(int x1[2], int x2[2])
X`123
X  return( (x1[0] == x2[0]) &&  (x1[1] == x2[1]) );
X`125
X`032
Xint mystrlen (char *str)
X`123
X  while (*(str + strlen (str) - 1) == ' ')
X    *(str + strlen (str) - 1) = '\0';
X  return strlen (str);
X`125
X`032
Xread_words (FILE *fin, char *wordlist[])
X`123
X  char str[100];
X  int i = 0;
X`032
X  while (fgets (str, 99, fin))
X  `123
X    *(str+strlen(str)-1) = '\0';                    /* remove /n */
X    wordlist[i] = malloc (strlen (str));
X    strupcase (str);
X    strcpy (wordlist[i++], str);
X  `125
X  wordlist[i] = 0;
X  fclose (fin);
X`125
X
Xfix_personal_name(from,to)
X  char *from, *to;
X`123
X  char *comma, tmp[80];
X  int len;
X
X  while (*from == ' ')
X    ++from; /* kill leading spaces */
X  len = strlen(from) - 1;
X  while (from[len] == ' ')
X    from[len--] = '\0'; /* kill trailing spaces */
X
X  /* look for a comma, if there, rearrange the name */
X  comma = strchr(from,',');
X  if (comma)
X  `123
X    *comma++ = '\0';
X
X    while (*comma == ' ')
X      ++comma; /* kill leading spaces in first name */
X    len = strlen(comma) - 1;
X    while (comma[len] == ' ')
X      comma[len--] = '\0'; /* kill trailing spaces in first name */
X
X    /* copy strings together, first last */
X    sprintf(tmp,"%s %s",comma,from);
X    /* and output it.. */
X    strcpy(to,tmp);
X  `125
X  else
X  `123
X    strcpy(to,from);
X  `125;
X`125
$ GOSUB UNPACK_FILE

$ FILE_IS = "HPWD.MAR"
$ CHECKSUM_IS = 342542492
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X.TITLE`009HPWD - hash user password
X.IDENT`009'X-2'
X`032
X;
X;****************************************************************************
X;*`009`009`009`009`009`009`009`009`009    *
X;*  COPYRIGHT (c) 1978, 1980, 1982, 1984 BY`009`009`009`009    *
X;*  DIGITAL EQUIPMENT CORPORATION, MAYNARD, MASSACHUSETTS.`009`009    *
X;*  ALL RIGHTS RESERVED.`009`009`009`009`009     `009    *
X;*`009`009`009`009`009`009`009`009`009    *
X;*  THIS SOFTWARE IS FURNISHED UNDER A LICENSE AND MAY BE USED AND COPIED   *
X;*  ONLY IN  ACCORDANCE WITH  THE  TERMS  OF  SUCH  LICENSE  AND WITH THE   *
X;*  INCLUSION OF THE ABOVE COPYRIGHT NOTICE. THIS SOFTWARE OR  ANY  OTHER   *
X;*  COPIES THEREOF MAY NOT BE PROVIDED OR OTHERWISE MADE AVAILABLE TO ANY   *
X;*  OTHER PERSON.  NO TITLE TO AND OWNERSHIP OF  THE  SOFTWARE IS  HEREBY   *
-+-+-+-+-+ End of part 1 +-+-+-+-+-
