Security Issue Archive for BBS Systems and Door Games? reddit / bbs ---------------------------------------------------------------------- dfjj3jf393j9j · 2017-08-04 02:37 My BBS was hacked back in 1994 and it has always bothered me that I was never able to figure out how it was done. The BBS was running WildCat 3.91. The user was able to drop to DOS. It looked like it was from the login screen... but it was a pretty long time ago so my memory is foggy. It could have also been from a door game. Is there any known backdoors in WildCat 3.91? Is there an archive of security issues/exploits found in BBS Door games or WildCat? I was also thinking of putting the BBS up at some point to see if anyone could hack it. Is there is a sub-reddit for that? :) Thanks in advance, Curious SySop ---------------------------------------------------------------------- shrodingercat5 · 2017-08-04 05:45 You might want to search textfiles.org for stuff. Back then there were no CVEs or any central place. ---------------------------------------------------------------------- dalml · 2017-08-04 06:11 There's a group on Facebook called Wildcat! BBS Sysops (Alumni) that's full of former MSI employees. That's the first place I'd ask. https://www.facebook.com/groups/78694574189/ ---------------------------------------------------------------------- jellicohatesfish · 2017-08-04 15:43 Total guess here as it's been many moons since my Telegard 2.5i/2.7 setups but couldn't certain certain cases basically expose the batch file used for launching the door and allow someone to CTRL-C and basically "drop to DOS" (haven't heard that term in forever... as it was an official feature for sysops), and the BBS and/or fossil driver would think everything's just fine? ---------------------------------------------------------------------- f15sim · 2017-08-04 19:22 I doubt it was a real DOS prompt. AFAIK, no DOS BBS programs did I/O redirection, which would be required for the exploit you talk about. A number of BBS programs DID include kind of a DOS shell within the BBS, either as a built-in feature or as a door. Visually, it looked a lot like a regular DOS prompt. Now like all things, there's an exception or two. :) If you used the MS-DOS version of BYE to run your BBS (not possible with Wildcat!), BYE DID do I/O redirection. BYE got its start in CP/M - specifically the type of BBS known as an "RCP/M" or Remote CP/M. The systems ran a tweaked CCP that eliminated "harmful" commands like REN, ERA, etc. The BBS program (often RBBS or a derivative like MBBS) had no native modem I/O itself - BYE (or MBYE) handled all that. ---------------------------------------------------------------------- dfjj3jf393j9j · 2017-08-05 00:13 So, "The Drop to DOS" built-in feature in WildCat is not a real DOS prompt and only a layer? I saw them type FORMAT C: and then type Y to the prompt confirming the format. ---------------------------------------------------------------------- f15sim · 2017-08-06 19:35 It's entirely possible that Wildcat! did the I/O redirection itself. That being said, the hack had to have been a privilege escalation and not something that would result in "shell" access. It could have been that they figured out what your password was. :) ---------------------------------------------------------------------- mro_1337 · 2017-08-19 02:48 someone could have used pkzipv1 and hex edited an archive and if you had a certain overwrite switch in your command line of your upload processor, it could overwrite a file and the person could login and get access. not sure if this is possible with that version of wildcrap. them typing format and Y could be automated ---------------------------------------------------------------------- NuSkooler · 2017-08-22 22:04 Came here to say the same thing. This worked for many boards back in the day. What you would do is change paths in the archive to absolute paths -- you can then target & replace/add files to the users system. Use your imagination from there. ---------------------------------------------------------------------- mro_1337 · 2017-08-25 03:18 i think one way around this is to extract without directory structure and say NO to overwriting. ---------------------------------------------------------------------- mro_1337 · 2017-09-06 01:51 you would do ".." to go back one dir