Re: Buffer overflow and code execution on iSeries (Off Topic)

Marvin,

Thanks,
Tony Pack

Marvin Radding wrote:

Well, to continue off topic:

There is yet  a n o t h e r  trick to make the SysReq line do
interesting things.  I thought it was Bob Cozzi who came up with it.  It
involves creating a temporary message queue object in QTemp and then
send a message to that queue via the SysReq line with option 5 and using
the temporary queue name.

The message you send to the queue is then interpreted, via a break
program, as a command.  You can basically make it do anything you want,

according to the logic of the message queue break program.

I am surprised that Bob wrote a hook into the SEPT to accomplish similar
tricks.  Of course, I never heard of the SEPT until I read Leif's book.


Anyway, Steven, if you want details on the message queue trick, feel
free to contact me off list.  The other tricks I had never heard of.
Anyway, these things are still useful, although of course not essential.


------------------------------

[Marvin Radding:] What I have done is create a library named QUSRJOB where I create the

message queue.  Then I can execute CL commands in any job that has
created the message queue.  This is especially helpful in batch jobs
where a minor adjustment needs to be made that cannot be made any other
way.  Like changing the current library or overriding a database as a
temporary fix to get the job to run.  (Month end only comes once a
month).  At one job, I went so far as to create a program to look at the
message queues, select the queue to send the message to, and syntax
check each command sent to a message queue.  I left the code there and
have never attempt to recreate it.  But this message queue technique has
CMA several times while I fixed the problem at my leisure.

Marvin



_______________________________________________
This is the MI Programming on the AS400 / iSeries (MI400) mailing list
To post a message email: MI400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/mi400
or email: MI400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/mi400.