|
David Gibbs wrote:
How do you get a program from a foreign system on to the System i? You save it to a savefile,
David:Unfortunately, that isn't actually required. There are a couple ways to get programs into an AS/400 (iSeries, System i) that don't involve savefiles. (Hmmm... in fact, I just reminded myself of another way.)
I'll mention the most trivial method -- a REXX source member. And if you've seen some of the REXX programs that Gene Gaunt has posted to the MI list, you'll be in the proper state of mind to appreciate how powerful REXX can be. In a very real sense, REXX is a clear case of how "a file can execute as a program" under OS/400.
Guess what percentage of sites lock down the STRREXPRC command? And if they do, how many of those lock down the QREXX API? (And guess how many have successfully _removed_ REXX from their systems?)
FTP a REXX script in a streamfile and copy to a QTEMP source file, or FTP direct to any *PUBLIC authorized source, and then send the STRREXPRC command... You're on your way.
I'll emphasize that that's the most simple way. It's _extremely_ rare to find a system that _cannot_ be exploited along those lines by some variation of basic file transfer plus remote command/remote program call. (How many different ways of "remote command" can you think of? Have you tried locking down EDRS?)
Tom Liotta
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
