1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
Assuming you want to display on $DISPLAY what is on the display
$VICTIM, then you go
xtv -d $VICTIM
NOTE: you must have appropriate permissions. You can test with
xlsclient -display $VICTIM
To deal with permissions, assuming $VHOST is the host on which the
$VICTIM display resides, and ~vic is the home directory of the victim,
you can do this:
ssh -X -a root@$VHOST
export VICTIM=:0.0 # or whatever
xauth add `xauth -f ~vic/.Xauthority list $VICTIM`
xtv -d $VICTIM
Other potentially less secure methods would include editing
/etc/X11/xinit/xserverrc on $VHOST to remove "-nolisten tcp",
restarting the X server there, and doing an "xhost + $DISPLAYHOST"
One use for xtv aside from spying on people without their knowledge,
is so students in a computer classroom can see everything on the
instructor's screen on their own, which can be much easier on the eyes
than a distant fuzzy projector.
WARNING: be careful with "xhost + host-evil-person-can-log-onto"
because you leave $VICTIM open to various attacks. It is equivalent
to letting anyone who can log onto host-evil-person-can-log-onto sit
at the $VICTIM display and type whatever they want unobserved. This
is of particular relevance in an academic setting, where a nasty
person could remotely log onto student-machine, so if you've done an
"xhost + student-machine" be aware that people other than the person
actually sitting at that machine can potentially do nasties through
it.
The "right" way to let students see your display is to give each of
them access to an account on your machine (can be shared) using a
secure mechanism, and using xauth commands of the sort shown above to
let people who "ssh -X" into that account access its :0.0 display.
|
