@database "PatchBBS"

Copyright (c) 1995 Bob Maple/Chris Hanson

AmigaGuide is a registered trademark of Commodore Amiga, Commodore
Business Machines, Inc.

@Node Main "PatchBBS Main"

     Welcome to PatchBBS.  Please read all of the following
     links in order for more information.

     This program comes with absolutely no warranties expressed
     or implied - You run this patch and the resulting CNet BBS executable
     entirely at your own risk!
     
     
     @{" Introduction                    " Link "Intro"    } What PatchBBS Does
     @{" Using PatchBBS                  " Link "Use"      } Installing the CNet patch
     
     @{" Technical Info                  " Link "Why"      } Why patch the BBS?
     
     
     PatchBBS is (c) 1995 Bob Maple/The Brazilian.
     The assembly debugging work was done by Chris Hanson.
     
     Ken Pletzer did not assist IN ANY WAY, and as selfish as it sounds,
     deserves absolutely no credit in this patch or program whatsoever, other
     than the fact that he made it necessary in the first place!
     
@EndNode

@Node Intro

 There is a very bad bug present in v3.05c of CNet Professional.  Since
 some **ASSHOLE** posted exactly how to take devious advantage of this
 bug all over a publically accessible network, I'm not going to refrain
 from telling you how and why it does what it does.  See @{" tech info " Link Why } for
 more information on that.
 
 Basically, any user can become any other user by setting up his mail
 forwarding, sending an OLM to himself (or having anyone send one to him),
 and save the OLM.  Bang, you're now somebody else!
 
 Several fixes have been posted which involve busting EP completely (stupid)
 so that nobody can ever turn on mail forwarding, or by hacking option 7
 in the EP menu to make it in-allowable (better but still sucks).
 
 A perfect solution, obviously, is a binary fix - to fix the program it's
 self and release a new version.
 
 However, this is quite impossible, since
 
   A) Ken doesn't seem to have the source code for v3.05c
   B) Ken doesn't seem to, in fact, have any opinion or information
      on this one way or another.
      
 So, to make a long story short, this patch was created to hack the assembly
 instructions themselves to fix the bug.  Luckily, since this is a REALLY
 stupid mistake in the code, it was easy to fix.

 Unfortunately, mail forwarding becomes disabled, but at the moment, this
 is more desireable than letting people hose up your system.

@EndNode


@Node Use

 First of all, this program comes with absolutely no warranties expressed
 or implied - You run this patch and the resulting CNet BBS executable
 entirely at your own risk!
 
 To Patch your BBS:
 
   First, you have to be running v3.05c.  This version is 266156 bytes
   long.  This patch will not work on any other executables.
   
   @{" Step 1: " } Make a copy of your CNet:BBS file by typing in a shell:

             1> copy CNet:BBS CNet:BBS.Patch
             
             You will patch the copy instead of the original.  If the patch
             program reports success, you will then rename the original as
             a backup, and rename the patched version as the primary version.
             
   @{" Step 2: " } Run PatchBBS from a shell with a single argument, the name
             of the binary you wish to patch.  Example:
             
             1> PatchBBS CNet:BBS.Patch
             
             PatchBBS will test to see if it's a patchable executable, and
             then do so, and change the version number to CNet Pro v3.05d.
             
   @{" Step 3: " } Assuming the patch reported complete success, rename
             your original BBS executable to something else and rename the
             new patched version as the primary version.  Example:
             
             1> rename CNet:BBS CNet:BBS.Orig
             1> rename CNet:BBS.Patch CNet:BBS
             
   @{" Step 4: " } REBOOT YOUR COMPUTER.  Don't attempt to close CNet and
             reload it, or flush BBS from the resident list and re-run the
             control panel;  Just reboot.  Save yourself the trouble.
             
   @{" Step 5: " } Login the BBS, and run around and make sure things still
             function properly.
             
 The end.  You're welcome.
 
@EndNode


@Node Why

 What the "backdoor is":
 
   Make a backup of your SYSDATA:bbs.udata file.  Kick everyone off the BBS
   and DO NOT let callers login (remove all but local ports.)
   
   Login the BBS, and type EP once you're logged in.  Edit option 7, your
   mail forwarding, and set your box to open.  When asked who to forward to,
   type in the alias or account number of your favorite BBS user.
   
   Hit return to exit out of EP.  Send yourself an OLM.  When you receive it,
   press "S" to save a copy of it into your mailbox.  Now, type ST.
   
     Horrors!  You are now your favorite BBS user!
     
   Imagine that!  Although if you were a normal user and used this method to
   'take control' of a SysOp account, you do NOT have full access;  You must
   still type "ID" (although _you_ don't since you're doing this in local
   mode) to gain access to high-maintenance commands.  But with Sysop access
   you can still go around deleting posts and files and other such things
   that do not require additional passwords or being "ID"entified first.
   
 
 Why this is so:
 
   Basically, when you save your OLM, CNet sees you have mail forwarding
   turned on.  "Gee," it says stupidly, "I'd better look up this user
   he's forwarding to so I know who to send the email to."
   
    Now, pausing for a moment, there are two "UserData" structures in
    memory at all times.  user1, which is the 'primary' UserData structure,
    (it contains "you"), and then there is user2, which is a 'scratch'
    UserData structure, used to load up other people's accounts for
    informational purposes (when you type "UI", it loads up the user
    account you're snooping at in user2 and displays information from
    there).
   
   So, you say to yourself, what's the big deal?  CNet loads up the user's
   information in user2 and sends the email.
   
   WRONG.  CNet loads up his information in user1 -- WRITING OVER YOUR OWN
   USER INFORMATION!  This is how you "turn into" another user.
   
   Stupid!
   
 
 How we fixed it:
 
   Programmer God Lord Xenon deserves just about all the credit for his
   devious invention.  I simply sat beside and gave tech info behind CNet
   and kept him from stealing _my_ password.
   
   If you step through the code in assembler, you'll see that when you hit
   "Save" from that OLM prompt, Cnet checks the MailForward account.  If it's
   0, it says "Alright", and saves the mail into your box.
   
   If it's NON-0, it attempts to look up that user.  However, in the process,
   it loads the WRONG memory address into the register that gets passed onto
   Read() that is responsible for reading the account information into a
   block of memory.  Instead of user2, it gives the address of user1!!
   
   And, as brilliant as it is, it also seems to then look at user1 to get the
   account information on who to forward the email to (which, in this case is
   really the user you have forwarding setup to, since it just loaded his
   account on top of yours.)
   
   How this patch fixes this problem is that we hack a couple of assembler
   instructions so that, when CNet goes to look at the MailForward variable, 
   it appears at 0 -- as though mail forwarding isn't on -- and just saves
   the OLM to your own mailbox (which seems the desireable method in the
   first place!).
   
   Mailforwarding hasn't changed -- we didn't turn it off, only tricked
   CNet at this particular prompt to think that it was turned off, and
   thus not load an account on top of your own.  If you type EP and look,
   it's still set.
   
   It's perfectly safe to let users setup their mail forwarding.  However,
   at the moment, this particular fix does not let mail forwarding run
   normally.  Even though they have it setup to forward to an account,
   it never will.

   
 Major weenie info:
 
   If you're afraid to run this program, well, get real.. I've been
   programming CNet modifications and providing technical info that Ken
   won't for years now, and I think I've proven myself to be a straight
   individual with no devious plans to get in your BBS or whatever.
   
   But in any event, here's exactly what happens, and you can certainly
   load up a Hex editor and do what this patch does to your own BBS
   yourself manually.
   
     Seek to position 45750 in CNet:BBS.  You will see 4 bytes:
     
       0x30 0x2D 0x01 0x92
       
     These are the 4 offending bytes.  Change them to:
     
       0x70 0x00 0x70 0x00
       
     This effectively loads "0" into the register that eventually gets
     looked at to determine if mailforwarding is on (and it does it
     twice because we had to get rid of two instructions, so we just had
     it set 0 in that register twice).  Since we changed a register and
     not a byte in memory, CNet then does the test to see if mail forwarding
     is turned on, sees it's not, and just saves the email.
     
   That's as complicated as it gets.  If you for some reason desire more
   information, please email bmaple@burner.com and I'll try and answer
   your questions.
   
@EndNode