Sounds like the time my cat hacked my Sun 3/60 by simply sitting on the keyboard. XDM crashed when the username buffer hit 256 random characters, and then dropped a root shell. But this was in the early 90's when everybody was a lot more innocent about security.
It's funny, Apple themselves even suggest people use other apps for FTP: https://support.apple.com/guide/mac-help/servers-shared-comp...
> With read-only access, you can copy files from the server, but to copy files to the server, you may need another FTP app. Choose Apple menu > App Store to find FTP apps available for macOS.
Another funny note: NetAuthAgent has had a bug for years where you cannot connect to an FTP server if your username contains an `@` symbol. I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine. I'd dig up some old posts talking about it going back years, but I don't want to put in the effort, lol.
Basic auth and FTP had a username password schema like
ftp://username@ftpserver.address.com and even
ftp://username:password@ftpserver.address.com
I am completely aware of that, but I am aware that other clients handle it just fine. The bug actually forced me to use a different client for when I actually needed an FTP client.
I pressed Ctrl+C, and got a root shell. From it, I ran the enrollment scripts I could find; it gave me sufficient access to pull from the corporate repo. So I took a ticket, found a related bug in the code, and created a patch fixing it on the first day, technically by cracking into a corporate laptop. (I had to wait for a properly completed enrollment to be able to push the code.)
L1-A to bring up the boot monitor. Search memory for `/bin/login` and replace with `bin/ed`. Enter any file name as your ‘user’ name, or just junk, and use `!sh`.
(Amazing what you remember from school…)
There are definitely more recent flaws that might have been suspectible to "cat butt on keyboard", like this one in 2016: https://www.bleepingcomputer.com/news/security/linux-flaw-al...
Edit: terrible from today's security perspective, I meant.
After highschool I saw an exploit for this where if you typed the right magic characters in you could highjack the execution of the login prompt and get a shell.
Got in trouble a few times during school years doing that.
“With many users now using modified config files to uncap their modems, most cable modem service providers acted to defeat this exploit by turning on the DOCSIS security feature that requires the CMTS to check the authenticity of the modem's config file during the registration process (this is explained in more detail in Chapter 9). As previously mentioned, this checksum is a HMAC-MD5 digest of the entire config file that uniquely iden- tifies its original contents, and it is constructed from the config file using a password chosen by the ISP. This defeats config file exploits because a user 8 Chapter 1| cannot create a checksum that would validate a modified config file without knowing the password that was used by the service provider when the original config file was created. Defeating the Message Integrity Check The fact that the systems of most ISPs had now been patched to prevent this type of uncapping was a challenge to be overcome. I began by attempting to hack the patch that the ISPs had implemented. My starting point was a phrase that was displayed in the modem's HTTP log page when the method described in the uncapping tutorial failed. The logs would read TFTP file complete-but failed Message Integrity check MIC. I wondered how I could bypass this message integrity check or MIC. One morning I awoke to frantic beeps coming from my computer; a member of my group was messaging me. He had the answer. The way to bypass the MIC was not to include the MIC! As simple as that might sound, I had no idea what he was talking about. He then sent me a copy of his config file and had me open it up in a basic hex editor (a program used to examine and modify binary files). The config file normally contained two different checksums at the end of the con- fig file: a standard MD5 checksum of the config, followed by another check- sum, the dreaded HMAC-MD5 (also known as the CmMic). He had simply trun- cated the config file, removing the HMAC-MD5 checksum and the two bytes before it (its header). Remarkably, this allowed any config to be used on any ISP. Once again, every ISP around the world was vulnerable to OneStep. NOTE This hack worked because the developers of the firmware used in the ISPs' routers, which process the config files and CMTS checksums sent from the modems, had not thoroughly tested the finished code. The basic config file processing function in the firmware would process operation codes (opcodes) that were present in the config file, including the CmMic opcode, and carry out the associated actions. But it would not check to confirm that the CmMic opcode had actually been sent (or even that the config file had success- fully authenticated). This flaw was severe because the ISP operators could not directly fix it in their routers; the only ones who could do so were the third-party vendors who supplied the firmware for the CMTSs. It would be a long time before the individual systems could be patched.”