117 lines
3.9 KiB
Plaintext
117 lines
3.9 KiB
Plaintext
|
|
|||
|
|
|
|||
|
|
%%%%%%%%%% HOW TO DESTROY AN RBBS-PC SYSTEM %%%%%%%%%%
|
|||
|
|
BY: MAD HACKER
|
|||
|
|
|
|||
|
|
IN THE COURSE OF YOUR HACKING AND PHREAKING ACTIVITIES,
|
|||
|
|
YOU WILL RUN ACROSS A GEEK SYSOP OR TWO. IN THIS SERIES OF
|
|||
|
|
ARTICLES, I AM GOING TO DESCRIBE WAYS TO DESTROY THESE GEEK
|
|||
|
|
BOARDS. I WILL COVER MOST OF THE MAJOR BBS PROGRAMS IN THE
|
|||
|
|
COURSE OF THIS TUTORIAL SET. THIS ISSUE WILL DEAL WITH THE
|
|||
|
|
RBBS SYSTEM.
|
|||
|
|
|
|||
|
|
BASIC SYSTEM FACTS :
|
|||
|
|
--------------------
|
|||
|
|
|
|||
|
|
HARDWARE : IBM-PC (OR XT)
|
|||
|
|
2 DRIVES
|
|||
|
|
128K OR MORE
|
|||
|
|
HAYES SMARTMODEM
|
|||
|
|
|
|||
|
|
FILES : COMMENTS TO SYSOP STORED IN "COMMENTS"
|
|||
|
|
MESSAGES STORED IN "MESSAGES"
|
|||
|
|
HELP FILES : "HELP01" - "HELP07"
|
|||
|
|
DOWNLOAD DIRCTORIES : "DIR" - "DIR 99"
|
|||
|
|
(DIR CONTIANS LIST OF DIRECTORIES ON CPC 12.1C AND OVER.
|
|||
|
|
IN EARLIER VERSIONS, ALL FILES ARE CONTAINED HERE.)
|
|||
|
|
USER FILES (PASSWORDS, ETC) : "USERS"
|
|||
|
|
SYSTEM CONFIG FILE (SYSOP'S PASSWORD, ETC) : "RBBS-PC.DEF"
|
|||
|
|
|
|||
|
|
|
|||
|
|
BUG #1 : DOWNLOADING THE USER FILE
|
|||
|
|
----------------------------------
|
|||
|
|
|
|||
|
|
VERSIONS THAT MAY BE ATTACKED THIS WAY : CPC 12.1C AND BEFORE.
|
|||
|
|
|
|||
|
|
PROCEDURE : DOWNLOAD "USERS."
|
|||
|
|
READ PASSWORDS.
|
|||
|
|
HAVE PHUN.
|
|||
|
|
|
|||
|
|
NOTE : LOOK FOR PASSWORDS MARKED "SYSOP". THESE PASSWORDS ON CPC 12.1F HAVE
|
|||
|
|
THE ABILITY TO DROP TO DOS.
|
|||
|
|
|
|||
|
|
EXPLAINATION :
|
|||
|
|
--------------
|
|||
|
|
|
|||
|
|
IBM'S BASIC (BY MICROSOFT) IS A RATHER HIGH LEVEL BASIC, WITH MANY
|
|||
|
|
POWERFUL COMMANDS. PC DOS, HOWEVER, IS A RATHER IDIOT-PROOF DISK SYSTEM.
|
|||
|
|
THE PROBLEM LIES IN THE DIFFERENT WAYS DOS AND BASIC INTERPRET A STRING
|
|||
|
|
OF CHARACTERS. IN THE RBBS PROGRAM IS A LINE THAT SAYS :
|
|||
|
|
|
|||
|
|
IF FN$ = USERS$ THEN 13520
|
|||
|
|
|
|||
|
|
FN$ IS THE NAME OF THE FILE YOU REQUESTED FOR DOWNLOAD.
|
|||
|
|
USER$ IS THE NAME OF THE USER FILE (USERS).
|
|||
|
|
13520 IS THE LINE THAT PRINTS "FILE XXXX NOT FOUND. TYPE L FOR DIR"
|
|||
|
|
|
|||
|
|
NOW THAT YOU KNOW HOW RBBS WAS MEANT TO TRAP HACKERS, IT IS EASY TO
|
|||
|
|
EXPLAIN THE FALACY OF IT'S WAYS. BASIC SAYS THAT "USERS" IS NOT EQUAL
|
|||
|
|
TO "USERS." (AND FOR GOOD REASON!!!). BUT PC DOS SAYS THAT "USERS" IS
|
|||
|
|
EQUAL TO "USERS.". SO YOU ARE ACCESSING THE SAME FILE, BUT UNDER 2
|
|||
|
|
DIFFERENT NAMES. SINCE THE SYSTEM ONLY TRAPS ONE OF THEM, YOU CAN USE THE
|
|||
|
|
OTHER ONE AND GET THE SAME DATA. THIS PROBLEM IS WELL KNOWN AND MOST
|
|||
|
|
RBBS SYSTEMS HAVE BEEN FIXED TO AVOID THIS BUG.
|
|||
|
|
|
|||
|
|
BUG #2 : DOWNLOADING THE SYSOP'S PASSWORD
|
|||
|
|
-----------------------------------------
|
|||
|
|
|
|||
|
|
VERSIONS ATTACKABLE : ANY RBBS UP TO VERSION 12.2, WHICH IS STILL
|
|||
|
|
IN TESTING BY TOM MACK.
|
|||
|
|
|
|||
|
|
PROCEDURE : DOWNLOAD "RBBS-PC.DEFF"
|
|||
|
|
READ PASSWORD
|
|||
|
|
HAVE PHUN
|
|||
|
|
|
|||
|
|
THE SYSOP'S PASSWORD IS CONTAINED IN A FILE CALLED "RBBS-PC.DEF".
|
|||
|
|
THERE IS A TRAP IN THE RBBS CODE TO PREVENT YOU FROM DOWNLOADING IT.
|
|||
|
|
BUT, HERE AGAIN, BASIC AND DOS ARE NOT IN AGREEMENT ABOUT THE
|
|||
|
|
EQUIVILANCE OF STRINGS. BASIC SAYS THAT "RBBS-PC.DEFF" <> "RBBS-PC.
|
|||
|
|
DEF" (AGAIN, RIGHTFULLY SO!!). BUT DOS TRUNCATES THE EXTRA CHARACTER,
|
|||
|
|
AND ALLOWS YOU TO GET THE SAME FILE UNDER THIS NAME. (NOTE THAT ANY
|
|||
|
|
CHARACTER WILL WORK AFTER THE "F" IN .DEF. SO IF THE SYSOP HAS FIXED
|
|||
|
|
THIS BUG, TRY ANOTHER CHARACTER. HE MIGHT HAVE BEEN TOO DUMB TO SET
|
|||
|
|
UP A LENGTH TEST AND JUST TRAPPED "RBBS-PC.DEFF"). THIS BUG, TOO, IS
|
|||
|
|
WELL KNOWN, AND MAY BE FIXED ON SOME BOARDS.
|
|||
|
|
|
|||
|
|
BUG #3 : OVERLOADING THE USER FILE
|
|||
|
|
----------------------------------
|
|||
|
|
|
|||
|
|
VERSIONS ATTACKABLE : ALL
|
|||
|
|
|
|||
|
|
PROCEDURE : WRITE A PROGRAM THAT CALLS THE BOARD REPEATEDLY UNDER
|
|||
|
|
NEW NAMES EACH TIME.
|
|||
|
|
|
|||
|
|
EXPLAINATION :
|
|||
|
|
--------------
|
|||
|
|
|
|||
|
|
THIS IS RATHER OBVIOUS. IF YOU KEEP FILLING UP THE USERLOG
|
|||
|
|
WITH BULLSHIT I.D.'S, YOU WILL CAUSE IT TO BECOME TOO LARGE, AND
|
|||
|
|
DOS WILL NOT ALLOW IT TO BE WRITTEN TO. THIS WILL CAUSE IT TO
|
|||
|
|
"FATAL ERROR" WHENEVER A CALLER LOGS ON.
|
|||
|
|
|
|||
|
|
|
|||
|
|
WELL, THAT ABOUT WRAPS IT UP FOR THIS TIME. NEXT TIME : HOW
|
|||
|
|
TO KILL A NET-WORKS SYSTEM.
|
|||
|
|
|
|||
|
|
/\ /\
|
|||
|
|
/ \ / \
|
|||
|
|
/ \/ \ ------
|
|||
|
|
/ \
|
|||
|
|
/ \AD ACKER
|
|||
|
|
|
|||
|
|
FROM THE DOCTOR'S OFFICE (301)-926-3470
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|