;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; A useful OPS-5 program
; Don Hopkins, University of Maryland
; CMSC421, Project 6
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

(literalize user
	user
	password
	first
	last
	host)

(literalize file
	name
	owner
	writable
	host)

(literalize goal
	status
	type
	file
	user
	password
	host
	ruser
	rhost)

(literalize rhosts
	user
	host
	ruser
	rhost)

(literalize session
	user
	host)

(literalize log
	user
	host
	status
	serial)

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

(p crack1
	(session ^user <user> ^host <host>)
	(rhosts ^user <ruser> ^host <rhost>
		^ruser <user> ^rhost <host>)
	(user ^user <ruser> ^host <rhost>)
	-(session ^user <ruser> ^host <rhost>)
    -->
	(make goal ^type rlogin ^status active
		   ^user <ruser> ^host <rhost>
		   ^ruser <user> ^rhost <host>))

(p crack2
	(session ^user <user> ^host <host>)
	(user ^user <ruser> ^password none ^host <rhost>)
	-(session ^user <ruser> ^host <rhost>)
    -->
	(make goal ^type telnet ^status active
	           ^user <user> ^host <host>
		   ^ruser <ruser> ^password none ^rhost <rhost>))

(p crack3
        (session ^user <user> ^host <host>)
    {	(goal ^type telnet ^status active
	      ^user <user> ^host <host>
	      ^ruser <ruser> ^password <password> ^rhost <rhost>) <g3> }
	(user ^user <ruser> ^host <rhost>)
    -->
	(write (crlf) ... from <user> at <host> ... telnet <rhost> 
	       (crlf) ... login <ruser> password <password>)
	(make goal ^type login ^status active
	           ^user <ruser> ^host <rhost> ^password <password>)
	(modify <g3> ^status satisfied))

(p crack4
	(session ^user <user> ^host <host>)
	-(session ^user root ^host <host>)
    -->
	(make goal ^type crack ^status active ^host <host>))

(p crack5
        (session ^user root ^host <host>)
    {	(goal ^type su ^status active
	      ^user <user> ^host <host>) <g5> }
	(user ^user <user> ^host <host> ^password <password>)
	-(session ^user <user> ^host <host>)
    -->
	(write (crlf) ... su from root to <user> at <host>)
	(make goal ^type login ^status active
	           ^user <user> ^host <host> ^password <password>)
	(modify <g5> ^status satisfied))

(p crack6
	(session ^user root ^host <host>)
	(user ^user <user> <> root ^host <host>)
	-(session ^user <user> ^host <host>)
    -->
	(make goal ^type su ^status active
		   ^user <user> ^host <host>))

(p crack7
	(session ^user sysdiag ^host <host>)
	(user ^user root ^host <host> ^password <password>)
    {	(goal ^type crack ^status active ^host <host>) <g7> }
	-(session ^user root ^host <host>)
    -->
	(write (crlf) ... sysdiag at <host> is equivalent to root)
	(make goal ^type login ^status active
	           ^user root ^host <host> ^password <password>)
	(modify <g7> ^status satisfied))

(p crack8
    {	(goal ^type rlogin ^status active
	      ^user <ruser> ^host <rhost>
	      ^ruser <user> ^rhost <host>) <g8> }
	(session ^user <user> ^host <host>)
	(user ^user <ruser> ^host <rhost> ^password <password>)
	(rhosts ^user <ruser> ^host <rhost>
		^ruser <user> ^rhost <host>)
	-(session ^user <ruser> ^host <rhost>)
    -->
	(write (crlf) ... from <user> at <host>
	       ... rlogin to <ruser> at <rhost>)
	(make goal ^type login ^status active
	           ^user <ruser> ^host <rhost> ^password <password>)
	(modify <g8> ^status satisfied))

(p crack9
	(session ^user <user> ^host <host>)
	(file ^user passwd ^writable yes ^host <host>)
    {	(user ^user root ^password <> none ^host <host>) <g9> }
	(goal ^type crack ^status active ^host <host>)
    -->
	(write (crlf) ... passwd file is writable on <host>
	       ... removing root password)
	(modify <g9> ^password none))

(p crack10
    {	(goal ^type login ^status active
	      ^user <user> ^host <host>
	      ^password <password>) <g10> }
	(user ^user <user> ^host <host> ^password <password>)
    -->
	(bind <serial>)
	(write (crlf) ... audit <serial> of OK login <user> at <host>
	       password <password>)
	(make session ^user <user> ^host <host>)
	(make log ^user <user> ^host <host>
	      ^status OK ^serial <serial>)
	(modify <g10> ^status satisfied))

(p crack11
    {	(log ^user <user> ^host <host> ^serial <serial>) <g11> }
	(session ^user root ^host <host>)
	(goal ^type covert)
    -->
	(write (crlf) ... cleaning up audit <serial> of login <user> at <host>)
	(remove <g11>))

(p crack12
    {	(session ^user <user> ^host <host>) <g12> }
	(goal ^type crack ^status active ^host <host>)
	(file ^name preserve ^host <host>)
	-(goal ^type ifs-hack ^host <host>)
    -->
	(write (crlf) ... trying IFS hack and logging out from
	       <user> at <host>)
	(make goal ^type ifs-hack ^status active ^host <host>)
	(remove <g12>))

(p crack13
    {	(user ^user root ^host <host>) <g13a> }
    {	(goal ^type ifs-hack ^status active ^host <host>) <g13b> }
	(file ^name preserve ^host <host>)
    -->
	(write (crlf) ... IFS hack succeeded in removing root password
	       at <host>)
	(modify <g13a> ^password none)
	(modify <g13b> ^status satisfied))

(p crack14
	(session ^user <user> ^host <host>)
	(file ^name <name> ^owner <user> ^host <host>)
    {	(goal ^type mail ^status active ^file <name>
	      ^ruser <ruser> ^rhost <rhost>) <g14> }
    -->
	(write (crlf) ... found <name> belonging to <user> at <host>
	       (crlf) ... mailing <name> to <ruser> at <rhost>)
	(modify <g14> ^status satisfied))

(p crack15
	(session ^user <user> ^host <host>)
	(goal ^type mail ^status satisfied)
	(goal ^type covert)
    -->
	(make goal ^type logout ^status active
	           ^user <user> ^host <host>))

(p crack16
	(goal ^type mail ^status satisfied)
	-(session)
    -->
	(write (crlf) ... time to stop fooling around and
	       go read some netnews)
	(halt))

(p crack17
    {	(goal ^type login ^status active
	      ^user <user> ^host <host>
	      ^password <password>) <g17> }
	(user ^user <user> ^host <host> ^password <> <password>)
    -->
	(bind <serial>)
	(write (crlf) ... audit <serial> of BAD login <user> at <host>
	       password <password>)
	(make log ^user <user> ^host <host>
	      ^status BAD ^serial <serial>)
	(modify <g17> ^status satisfied))

(p crack18
        (session ^user <user> ^host <host>)
	(user ^user <ruser> ^host <host>
	      ^first {<first> <> nil})
	-(session ^user <ruser> ^host <host>)
	-(goal ^type covert)
	-(goal ^type telnet ^status satisfied
	       ^ruser <ruser> ^rhost <host> ^password <first>)
    -->
	(write (crlf) ... guessing user <ruser> at <host>
	       password <first>)
	(make goal ^type telnet ^status active
	           ^user <user> ^host <host>
	           ^ruser <ruser> ^rhost <host> ^password <first>))

(p crack19
	(session ^user <user> ^host <host>)
	(user ^user <ruser> ^host <host>
	      ^last {<last> <> nil})
	-(session ^user <ruser> ^host <host>)
	-(goal ^type covert)
	-(goal ^type telnet ^status satisfied
	       ^ruser <ruser> ^rhost <host> ^password <last>)
    -->
	(write (crlf) ... guessing user <ruser> at <host>
	       password <last>)
	(make goal ^type telnet ^status active
	           ^user <user> ^host <host>
		   ^ruser <ruser> ^rhost <host> ^password <last>))

(p crack20
    {	(session ^user <user> ^host <host>) <g20a> }
    {	(goal ^type logout ^status active
	      ^user <user> ^host <host>) <g20b> }
    -->
	(write (crlf) ... logging out from <user> at <host>)
	(remove <g20a>)
	(modify <g20b> ^status satisfied))

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

(p t1
	(start 1)
    -->
	(make goal ^type covert)
	(make start 2))

(p t2
	(start 2)
    -->
	; host tycho
	(make file ^name preserve ^owner root ^host tycho)
	(make user ^user root ^password unknown ^host tycho)
	(make user ^user casper ^password unknown ^host tycho)
	(make rhosts ^user casper ^host tycho
	             ^ruser casper ^rhost mimsy)
	(make user ^user ollie ^password unknown ^host tycho)
	(make rhosts ^user ollie ^host tycho
	             ^ruser ollie ^rhost basement)

	; host basement
	(make user ^user root ^password ron ^host basement
	           ^first ron ^last reagan)
	(make user ^user casey ^password bill ^host basement
	           ^first bill ^last casey)
	(make user ^user fawn ^password unknown ^host basement
	           ^first fawn ^last hall)
	(make rhosts ^user fawn ^host basement
	             ^ruser fawn ^rhost intimus-007s)
	(make user ^user iatollah ^password unknown ^host basement
	           ^first guest ^last iranian)
	(make rhosts ^user iatollah ^host basement
	             ^ruser allah ^rhost persia)
	(make user ^user ollie ^password unknown ^host basement)
	(make rhosts ^user ollie ^host basement
	             ^ruser ollie ^rhost tycho)
	(make file ^name notes ^owner ollie ^host basement)

	; host intimus-007s ("the ace of security paper shredders")
	(make user ^user fawn ^password unknown ^host intimus-007s)
	(make rhosts ^user fawn ^host intimus-007s
	             ^ruser fawn ^rhost basement)
	(make user ^user ollie ^password north ^host intimus-007s
	           ^first ollie ^last north)
	(make file ^name diary ^owner ollie ^host intimus-007s)

	; host mimsy
	(make file ^name passwd ^writable yes ^owner root ^host mimsy)
	(make user ^user root ^password unknown ^host mimsy)
	(make user ^user casper ^password unknown ^host mimsy)
	(make rhosts ^user casper ^host mimsy
	             ^ruser casper ^rhost tycho)
	(make user ^user hendler ^password unknown ^host mimsy)
	(make rhosts ^user hendler ^host mimsy
	             ^ruser hendler ^rhost dormouse)

	; host dormouse
	(make user ^user root ^password unknown ^host dormouse)
	(make user ^user sysdiag ^password none ^host dormouse)
	(make user ^user hendler ^password unknown ^host dormouse)
	(make rhosts ^user hendler ^host dormouse
		     ^ruser hendler ^rhost mimsy)

	; host prep
	(make user ^user rms ^password rms ^host prep)

	; give ourselves a meaning in life ...
	(make goal ^type mail ^status active
	           ^file diary ^ruser post-talk-rumor ^rhost ucbvax)
	(make goal ^type mail ^status active
	           ^file notes ^ruser post-talk-rumor ^rhost ucbvax)

	; and point us in the right direction ...
	(make session ^user nobody ^host nowhere)
	(make goal ^type telnet ^status active
	           ^user nobody ^host nowhere
		   ^ruser rms ^password rms ^rhost prep))