Finally I figured out how to tackle this beast. It took me some time (Limited VMS background) to get through, but this was really exciting exercise. And I must really admit – OpenVMS is one really well engineered operating system. The start is a little clumsy if you come from the UNIX/Linux background, but gradually it begins to make more and more sense over time.
So what we need are the following pre-requisites
- Linux x86_64 (some good Linux distro with standard tools – socat, mkisofs)
- alphavm_free (https://drop.me/o2ewWB)
- OpenVMS 8.3 from https://thepiratebay.org/torrent/4584595/OpenVMS_8.3_Alpha.iso
- Following three files for upgrade to OpenVSM 8.4.2 and install license PAKs
- http://vmssoftware.com/alpha/downloads/eval-paks-vsi-alpha_com.txt
- http://vmssoftware.com/alpha/downloads/ALPHAX842.ZIPEXE
- http://vmssoftware.com/alpha/downloads/VSI-AXPVMS-TCPIP-V0507-13ECO5.ZIPEXE
So first we will download the OpenVMS 8.3 iso (530 MB)
https://thepiratebay.org/torrent/4584595/OpenVMS_8.3_Alpha.iso
and setup the alphavm_free cofiguration file as follows:
system {
type = ds10_616;
reported_type = default;
num_cpus = 1;
ssn = 'EmuVM-00-000-001';
interval_clock_freq = 1000;
memory {
size = 1024;
}
cpu {
server = basic;
jit {
async = yes;
}
}
serial com1 {
server = socket;
port = 3000;
}
serial com2 {
server = socket;
port = 3001;
}
scsi_controller qla0 {
scsi_id = 7;
}
scsi_controller qla1 {
scsi_id = 7;
}
scsi_disk dka0 {
scsi_bus = 0;
scsi_id = 0;
scsi_lun = 0;
file = 'disk.dd';
caching = no;
write_through = yes;
}
scsi_disk dka1 {
scsi_bus = 0;
scsi_id = 2;
scsi_lun = 0;
file = 'disk2.dd';
caching = no;
write_through = yes;
}
scsi_cdrom iso {
scsi_id = 4;
file = 'OpenVMS_8.3_Alpha.iso';
}
ether eth0 {
type = dec21040;
server = dummy;
mac_address = 0x08002B000001;
}
ether eth1 {
type = dec21040;
server = tap;
interface = 'tap0';
mac_address = 0x08002B000002;
}
}
Setup 2 disks like so :
DKA0
$ dd if=/dev/zero of=disk.dd bs=1024 count=6M
DKA200
$ dd if=/dev/zero of=disk2.dd bs=1024 count=3M
Save the following networking script to use network and execute it prior running alphavm_free
#Setup tap and bridge tunctl -t tap0 -u user ifconfig tap0 up brctl addbr br0 brctl addif br0 eth0 brctl setfd br0 0 ifconfig eth0 10.0.2.1 up ifconfig br0 10.0.2.2 netmask 255.255.255.0 broadcast 10.0.2.255 up brctl addif br0 tap0 ifconfig tap0 0.0.0.0 sysctl net.ipv4.ip_forward=1 iptables -A FORWARD --in-interface eth0 -j ACCEPT iptables --table nat -A POSTROUTING --out-interface wlan0 -j MASQUERADE
Startup the alphavm_free and boot the OpenVMS_8.3_Alpha.iso on DKA400 with root privs
# ./alphavm_free config.emu
Connect to the VM like so
socat -,raw,echo=0,escape=0x1c tcp:127.0.0.1:3000
Boot the OpenVMS 8.3 cdrom and install it (its straight forward… )
>>> boot dka400
Do your stuff and configure OpenVMS 8.3 (Don’t install DECNET..we won’t need it) It is not difficult :)
Remember to install to DKA0 and afterwards boot from DKA0
Next comes the harder part – upgrading to OpenVMS 8.4 (No ISO on Piratebay)
- Download the following 3 files and save them in UPGRADE.ISO dir
http://vmssoftware.com/alpha/downloads/eval-paks-vsi-alpha_com.txt http://vmssoftware.com/alpha/downloads/ALPHAX842.ZIPEXE http://vmssoftware.com/alpha/downloads/VSI-AXPVMS-TCPIP-V0507-13ECO5.ZIPEXE
Use mkisofs on Linux host to create an ISO we will use on the OpenVMS later :
$ mkisofs -o upgrade.iso UPGRADE.ISO/
Attach this ISO to the config.emu like so :
scsi_cdrom iso {
scsi_id = 4;
file = 'upgrade.iso';
}
Boot the OpenVMS
>>> boot dka0
Once logged in as SYSTEM do the following :
$ mount /over=id DKA400 (mount the CD-ROM @ DKA400) $ run DKA400:[000000]ALPHAX84.ZIP (extract ALPHAX84.ZIP) $ @SYS$STARTUP:LD$STARTUP.COM (configure LD to enable loopback mount) $ LD CONNECT ALPHAX842.IMG (register ALPHAX842.IMG as mountable) $ mount /over=id LDA1 (mount LDA1 as loopback device) $ MOUNT/FOREIGN DKA200: (mount the empty DKA200 disk) $ BACKUP/IMAGE/VERIFY LDA1: DKA200 (restore LDA1 to DKA200) $ reboot >>> boot dka200 (boot the setup of OpenVMS 8.4.2) loaded boot image pa=200000 size=0x99c00 OpenVMS (TM) Alpha Operating System, Version V8.4-2 Copyright 2016 VMS Software, Inc. You can also execute DCL commands and procedures to perform "standalone" tasks, such as backing up the system disk. Please choose one of the following: 1) Upgrade, install or reconfigure OpenVMS ALPHA Version V8.4-2 2) Display layered products that this procedure can install 3) Install or upgrade layered products 4) Show installed products 5) Reconfigure installed products 6) Remove installed products 7) Find, Install or Undo patches; Show or Delete Recovery Data 8) Execute DCL commands and procedures 9) Shut down this system Enter CHOICE or ? for help: (1/2/3/4/5/6/7/8/9/?) 1 *********************************************************** Do you want to INITIALIZE or to PRESERVE? [PRESERVE] Enter device name for target disk: (? for choices) dka0 Do you want to keep this label? (Yes/No) [Yes] Do you want to INITIALIZE or to PRESERVE? [PRESERVE] Enter device name for target disk: (? for choices) dka0 Do you want to keep this label? (Yes/No) [Yes] OpenVMS ALPHA will be upgraded on DKA0: Will this system be a member of an OpenVMS Cluster? (Yes/No) No Will this system be an instance in an OpenVMS Galaxy? (Yes/No) No Do you always want detailed descriptions? (Yes/No) [No] Do you want the defaults for all options? [YES] Do you want to continue? [YES] Do you want to review the options? [NO] Portion done: 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100% 9) Shut down this system Enter CHOICE or ? for help: (1/2/3/4/5/6/7/8/9/?) 9
after two reboots
Welcome to OpenVMS (TM) Alpha Operating System, Version V8.4-2 Username: system Password: %LICENSE-I-NOLICENSE, no license is active for this software product %LOGIN-S-LOGOPRCON, login allowed from OPA0: Welcome to OpenVMS (TM) Alpha Operating System, Version V8.4-2 Last interactive login on Thursday, 30-MAR-2017 21:23:57.59
Remove the ALPHAX842.IMG file
$ DELETE ALPHAX842.IMG;1
$ mount /over=id DKA400 (mount the CD-ROM) $ dir DKA400:[000000] Directory DKA400:[000000] ALPHAX84.ZIP;1 HOWTO.DIR;1 LICENSE.PAK;1 VSI_AXPV.ZIP;1
– PAK file – 2.1 KB
This file contains temporary License PAKs for the VSI OpenVMS Alpha 8.4-2 operating system and all layered products involved in this field test. These temporary License PAKs expire on 30-September-2017.
– VSI AXPVMS TCPIP V5.7-13ECO5 – 48.6 MB
This is the Alpha version of VSI’s TCP/IP V5.7 kit. Use PCSI to install this kit on your Alpha system
Extract the VSI AXPVMS TCPIP
$ run DKA400:[000000]VSI_AXPV.ZIP (install the VSI)
– Check the licenses
$ SHOW LICENSE/USAGE View of loaded licenses from node ALPHA1 30-MAR-2017 22:33:24.27 %SHOW-I-NOLICENSE, no licenses exist
– Load license for OPENVMS-ALPHA
$ @SYS$UPDATE:VMSLICENSE
Register OpenVMS-Alpha like so (Valid till 30-Sept-2017)
Issuer: VSI
Authorization: EVAL-VSI-ALPHA-02
Product Name: OPENVMS-ALPHA
Producer: VSI
Units: 0
Release Date:
Version:
Termination Date: 30-SEP-2017
Availability:
Activity: CONSTANT=100
Options:
Token:
Hardware ID:
Checksum: 2-ADLM-GFDE-KPMA-KNHH
Register UCX (TCP/IP) like so (Valid till 30-Sept-2017)
Issuer: VSI
Authorization: EVAL-VSI-ALPHA-02
Product Name: UCX
Producer: VSI
Units: 0
Release Date:
Version:
Termination Date: 30-SEP-2017
Availability:
Activity: CONSTANT=100
Options:
Token:
Hardware ID:
Checksum: 2-NFBG-GCJM-PNPE-GPBP
Verify the licenses
$ SHOW LICENSE/USAGE View of loaded licenses from node ALPHA1 30-MAR-2017 23:05:44.33 ------- Product ID -------- ---- Unit usage information ---- Product Producer Loaded Allocated Available OPENVMS-ALPHA VSI Unlimited license, no usage information UCX VSI Unlimited license, no usage information
In next episode I will configure TCP/IP and start some exploitation tests.
Here is a short vid
