352 lines
16 KiB
Plaintext
352 lines
16 KiB
Plaintext
|
___________________________________________________________
|
|||
|
|
|
|||
|
|
GUIDE TO (mostly) HARMLESS HACKING
|
|||
|
|
|
|||
|
|
Beginners<EFBFBD> Series #3 Part 2
|
|||
|
|
|
|||
|
|
How to Get a *Good* Shell Account
|
|||
|
|
____________________________________________________________
|
|||
|
|
|
|||
|
|
|
|||
|
|
____________________________________________________________
|
|||
|
|
In this section you will learn:
|
|||
|
|
|
|||
|
|
<EFBFBD> how to explore your shell account
|
|||
|
|
<EFBFBD> Ten Meinel Hall of Fame Shell Account Exploration Tools
|
|||
|
|
<EFBFBD> how to decide whether your shell account is any good for hacking
|
|||
|
|
<EFBFBD> Ten Meinel Hall of Fame LAN and Internet Exploration Tools
|
|||
|
|
<EFBFBD> Meinel Hall of Infamy Top Five Ways to Get Kicked out of Your Shell Account
|
|||
|
|
____________________________________________________________
|
|||
|
|
|
|||
|
|
|
|||
|
|
How to Explore Your Shell Account
|
|||
|
|
|
|||
|
|
|
|||
|
|
So you<6F>re in your shell account. You<6F>ve tried the <20>ls -alF<6C> command and are
|
|||
|
|
pretty sure this really, truly is a shell account. What do you do next?
|
|||
|
|
|
|||
|
|
A good place to start is to find out what kind of shell you have. There are
|
|||
|
|
many shells, each of which has slightly different ways of working. To do
|
|||
|
|
this, at your prompt give the command <20>echo $SHELL.<2E> Be sure to type in the
|
|||
|
|
same lower case and upper case letters. If you were to give the command
|
|||
|
|
<EFBFBD>ECHO $shell,<2C> for example, this command won<6F>t work.
|
|||
|
|
|
|||
|
|
If you get the response:
|
|||
|
|
|
|||
|
|
/bin/sh
|
|||
|
|
|
|||
|
|
That means you have the Bourne shell.
|
|||
|
|
|
|||
|
|
If you get:
|
|||
|
|
|
|||
|
|
/bin/bash
|
|||
|
|
|
|||
|
|
Then you are in the Bourne Again (bash) shell.
|
|||
|
|
|
|||
|
|
If you get:
|
|||
|
|
|
|||
|
|
/bin/ksh
|
|||
|
|
|
|||
|
|
You have the Korn shell.
|
|||
|
|
|
|||
|
|
If the <20>echo $SHELL<4C> command doesn<73>t work, try the command <20>echo $shell,<2C>
|
|||
|
|
remembering to use lower case for <20>shell.<2E> This will likely get you the answer:
|
|||
|
|
|
|||
|
|
/bin/csh
|
|||
|
|
|
|||
|
|
This means you have the C shell.
|
|||
|
|
|
|||
|
|
Why is it important to know which shell you have? For right now, you<6F>ll want
|
|||
|
|
a shell that is easy to use. For example, when you make a mistake in typing,
|
|||
|
|
it<EFBFBD>s nice to hit the backspace key and not see ^H^H^H on your screen. Later,
|
|||
|
|
though, for running those super hacker exploits, the C shell may be better
|
|||
|
|
for you.
|
|||
|
|
|
|||
|
|
Fortunately, you may not be stuck with whatever shell you have when you log
|
|||
|
|
in. If your shell account is any good, you will have a choice of shells.
|
|||
|
|
|
|||
|
|
Trust me, if you are a beginner, you will find bash to be the easiest shell
|
|||
|
|
to use. You may be able to get the bash shell by simply typing the word
|
|||
|
|
<EFBFBD>bash<EFBFBD> at the prompt. If this doesn<73>t work, ask tech support at your ISP for
|
|||
|
|
a shell account set up to use bash. A great book on using the bash shell is
|
|||
|
|
_Learning the Bash Shell_, by Cameron Newham and Bill Rosenblatt, published
|
|||
|
|
by O<>Reilly.
|
|||
|
|
|
|||
|
|
If you want to find out what other shells you have the right to use, try
|
|||
|
|
<EFBFBD>csh<EFBFBD> to get the C shell; <20>ksh<73> to get the Korn shell, <20>sh<73> for Bourne
|
|||
|
|
shell, <20>tcsh<73> for the Tcsh shell, and <20>zsh<73> for the Zsh shell. If you don<6F>t
|
|||
|
|
have one of them, when you give the command to get into that shell you will
|
|||
|
|
get back the answer <20>command not found.<2E>
|
|||
|
|
|
|||
|
|
Now that you have chosen your shell, the next thing is to explore. See what
|
|||
|
|
riches your ISP has allowed you to use. For that you will want to learn, and
|
|||
|
|
I mean *really learn* your most important Unix commands and auxiliary
|
|||
|
|
programs. Because I am supreme arbiter of what goes into these Guides, I get
|
|||
|
|
to decide what the most important commands are. Hmm, <20>ten<65> sounds like a
|
|||
|
|
famous number. So you<6F>re going to get the:
|
|||
|
|
|
|||
|
|
Ten Meinel Hall of Fame Shell Account Exploration Tools
|
|||
|
|
|
|||
|
|
1) man <command name>
|
|||
|
|
This magic command brings up the online Unix manual. Use it on each of the
|
|||
|
|
commands below, today! Wonder what all the man command options are? Try the
|
|||
|
|
"man -k" option.
|
|||
|
|
|
|||
|
|
2) ls
|
|||
|
|
Lists files. Jericho suggests <20>Get people in the habit of using "ls -alF".
|
|||
|
|
This will come into play down
|
|||
|
|
the road for security-conscious users.<2E> You<6F>ll see a huge list of files that
|
|||
|
|
you can<61>t see with the <20>ls<6C> command alone, and lots of details. If you see
|
|||
|
|
such a long list of files that they scroll off the terminal screen, one way
|
|||
|
|
to solve the problem is to use <20>ls -alF|more.<2E>
|
|||
|
|
|
|||
|
|
3) pwd
|
|||
|
|
Shows what directory you are in.
|
|||
|
|
|
|||
|
|
4) cd <directory>
|
|||
|
|
Changes directories. Kewl directories to check out include /usr, /bin and
|
|||
|
|
/etc. For laughs, jericho suggests exploring in /tmp.
|
|||
|
|
|
|||
|
|
5) more <filename>
|
|||
|
|
This shows the contents of text files. Also you might be able to find <20>less<73>
|
|||
|
|
and <20>cat<61> which are similar commands.
|
|||
|
|
|
|||
|
|
6) whereis <program name>
|
|||
|
|
Think there might be a nifty program hidden somewhere? Maybe a game you
|
|||
|
|
love? This will find it for you. Similar commands are <20>find<6E> and <20>locate.<2E>
|
|||
|
|
Try them all for extra fun.
|
|||
|
|
|
|||
|
|
7) vi
|
|||
|
|
An editing program. You<6F>ll need it to make your own files and when you start
|
|||
|
|
programming while in your shell account. You can use it to write a really
|
|||
|
|
lurid file for people to read when they finger you. Or try <20>emacs.<2E> It<49>s
|
|||
|
|
another editing program and IMHO more fun than vi. Other editing programs
|
|||
|
|
you may find include <20>ed<65> (an ancient editing program which I have used to
|
|||
|
|
write thousands of lines of Fortran 77 code), <20>ex,<2C> <20>fmt,<2C> <20>gmacs,<2C>
|
|||
|
|
<EFBFBD>gnuemacs,<2C> and <20>pico.<2E>
|
|||
|
|
|
|||
|
|
8) grep
|
|||
|
|
Extracts information from files, especially useful for seeing what<61>s in
|
|||
|
|
syslog and shell log files. Similar commands are <20>egrep,<2C> <20>fgrep,<2C> and <20>look.<2E>
|
|||
|
|
|
|||
|
|
9) chmod <filename>
|
|||
|
|
Change file permissions.
|
|||
|
|
|
|||
|
|
10) rm <filename>
|
|||
|
|
Delete file. If you have this command you should also find <20>cp<63> for copy
|
|||
|
|
file, and <20>mv<6D> for move file.
|
|||
|
|
|
|||
|
|
|
|||
|
|
How to Tell Whether Your Shell Account Is any Good for Hacking
|
|||
|
|
|
|||
|
|
|
|||
|
|
Alas, not all shell accounts are created equal. Your ISP may have decided
|
|||
|
|
to cripple your budding hacker career by forbidding your access to
|
|||
|
|
important tools. But you absolutely must have access to the top ten tools
|
|||
|
|
listed above. In addition, you will need tools to explore both your ISP<53>s
|
|||
|
|
local area network (LAN) and the Internet. So in the spirit of being Supreme
|
|||
|
|
Arbiter of Haxor Kewl, here are my:
|
|||
|
|
|
|||
|
|
Ten Meinel Hall of Fame LAN and Internet Exploration Tools
|
|||
|
|
|
|||
|
|
1) telnet <hostname> <port number or name>
|
|||
|
|
If your shell account won<6F>t let you telnet into any port you want either on
|
|||
|
|
its LAN or the Internet, you are totally crippled as a hacker. Dump your ISP
|
|||
|
|
now!
|
|||
|
|
|
|||
|
|
2) who
|
|||
|
|
Shows you who else is currently logged in on your ISP<53>s LAN. Other good
|
|||
|
|
commands to explore the other users on your LAN are <20>w,<2C> <20>rwho, <20> <20>users.<2E>
|
|||
|
|
|
|||
|
|
3) netstat
|
|||
|
|
All sorts of statistics on your LAN, including all Internet connections. For
|
|||
|
|
real fun, try <20>netstat -r<> to see the kernel routing table. However, jericho
|
|||
|
|
warns <20>Be careful. I was teaching a friend the basics of summing up a Unix
|
|||
|
|
system and I told her to do that and <20>ifconfig<69>. She was booted off the system
|
|||
|
|
the next day for <20>hacker suspicion<6F> even though both are legitimate commands
|
|||
|
|
for users.<2E>
|
|||
|
|
|
|||
|
|
4) whois <hostname>
|
|||
|
|
Get lots of information on Internet hosts outside you LAN.
|
|||
|
|
|
|||
|
|
5) nslookup
|
|||
|
|
Get a whole bunch more information on other Internet hosts.
|
|||
|
|
|
|||
|
|
6) dig
|
|||
|
|
Even more info on other Internet hosts. Nslookup and dig are not redundant.
|
|||
|
|
Try to get a shell account that lets you use both.
|
|||
|
|
|
|||
|
|
7) finger
|
|||
|
|
Not only can you use finger inside your LAN. It will sometimes get you
|
|||
|
|
valuable information about users on other Internet hosts.
|
|||
|
|
|
|||
|
|
8) ping
|
|||
|
|
Find out if a distant computer is alive and run diagnostic tests -- or just
|
|||
|
|
plain be a meanie and clobber people with pings. (I strongly advise
|
|||
|
|
*against* using ping to annoy or harm others.)
|
|||
|
|
|
|||
|
|
9) traceroute
|
|||
|
|
Kind of like ping with attitude. Maps Internet connections, reveals routers
|
|||
|
|
and boxes running firewalls.
|
|||
|
|
|
|||
|
|
10) ftp
|
|||
|
|
Use it to upload and download files to and from other computers.
|
|||
|
|
|
|||
|
|
If you have all these tools, you<6F>re in great shape to begin your hacking
|
|||
|
|
career. Stay with your ISP. Treat it well.
|
|||
|
|
|
|||
|
|
Once you get your shell account, you will probably want to supplement the
|
|||
|
|
<EFBFBD>man<EFBFBD> command with a good Unix book . Jericho recommends _Unix in a
|
|||
|
|
Nutshell_ published by O'Reilly. "It is the ultimate Unix command reference,
|
|||
|
|
and only costs 10 bucks. O'Reilly r00lz."
|
|||
|
|
|
|||
|
|
How to Keep from Losing Your Shell Account
|
|||
|
|
|
|||
|
|
So now you have a hacker<65>s dream, an account on a powerful computer running
|
|||
|
|
Unix. How do you keep this dream account? If you are a hacker, that is not
|
|||
|
|
so easy. The problem is that you have no right to keep that account. You can
|
|||
|
|
be kicked off for suspicion of being a bad guy, or even if you become
|
|||
|
|
inconvenient, at the whim of the owners.
|
|||
|
|
|
|||
|
|
Meinel Hall <20>O Infamy
|
|||
|
|
Top Five Ways to Get Kicked out of Your Shell Account
|
|||
|
|
|
|||
|
|
1) Abusing Your ISP
|
|||
|
|
Let<EFBFBD>s say you are reading Bugtraq and you see some code for a new way to
|
|||
|
|
break into a computer. Panting with excitement, you run emacs and paste in
|
|||
|
|
the code. You fix up the purposely crippled stuff someone put in to keep
|
|||
|
|
total idiots from running it. You tweak it until it runs under your flavor
|
|||
|
|
of Unix. You compile and run the program against your own ISP. It works! You
|
|||
|
|
are looking at that <20>#<23> prompt and jumping up and down yelling <20>I got root!
|
|||
|
|
I got root!<21> You have lost your hacker virginity, you brilliant dude, you!
|
|||
|
|
Only, next time you go to log in, your password doesn<73>t work. You have been
|
|||
|
|
booted off your ISP. NEVER, NEVER ABUSE YOUR OWN ISP!
|
|||
|
|
|
|||
|
|
*********************************************************
|
|||
|
|
You can go to jail warning: Of course, if you want to break into another
|
|||
|
|
computer, you must have the permission of the owner. Otherwise you are
|
|||
|
|
breaking the law.
|
|||
|
|
*********************************************************
|
|||
|
|
|
|||
|
|
2) Ping Abuse.
|
|||
|
|
Another temptation is to use the powerful Internet connection of your shell
|
|||
|
|
account (usually a T1 or T3) to ping the crap out of the people you don<6F>t
|
|||
|
|
like. This is especially common on Internet Relay Chat. Thinking of ICBMing
|
|||
|
|
or nuking that dork? Resist the temptation to abuse ping or any other
|
|||
|
|
Internet Control Message Protocol attacks. Use ping only as a diagnostic
|
|||
|
|
tool, OK? Please? Or else!
|
|||
|
|
|
|||
|
|
3) Excessive Port Surfing
|
|||
|
|
Port surfing is telnetting to a specific port on another computer. Usually
|
|||
|
|
you are OK if you just briefly visit another computer via telnet, and don<6F>t
|
|||
|
|
go any further than what that port offers to the casual visitor. But if you
|
|||
|
|
keep on probing and playing with another computer, the sysadmin at the
|
|||
|
|
target computer will probably email your sysadmin records of your little
|
|||
|
|
visits. (These records of port visits are stored in <20>messages,<2C> and
|
|||
|
|
sometimes in <20>syslog<6F> depending on the configuration of your target computer
|
|||
|
|
-- and assuming it is a Unix system.)
|
|||
|
|
|
|||
|
|
Even if no one complains about you, some sysadmins habitually check the
|
|||
|
|
shell log files that keep a record of everything you or any other user on
|
|||
|
|
the system has been doing in their shells. If your sysadmin sees a pattern
|
|||
|
|
of excessive attention to one or a few computers, he or she may assume you
|
|||
|
|
are plotting a break-in. Boom, your password is dead.
|
|||
|
|
|
|||
|
|
4) Running Suspicious Programs
|
|||
|
|
If you run a program whose primary use is as a tool to commit computer
|
|||
|
|
crime, you are likely to get kicked off your ISP. For example, many ISPs
|
|||
|
|
have a monitoring system that detects the use of the program SATAN. Run
|
|||
|
|
SATAN from your shell account and you are history.
|
|||
|
|
|
|||
|
|
|
|||
|
|
**********************************************************
|
|||
|
|
Newbie note: SATAN stands for Security Administration Tool for Analyzing
|
|||
|
|
Networks. It basically works by telnetting to one port after another of the
|
|||
|
|
victim computer. It determines what program (daemon) is running on each
|
|||
|
|
port, and figures out whether that daemon has a vulnerability that can be
|
|||
|
|
used to break into that computer. SATAN can be used by a sysadmin to figure
|
|||
|
|
out how to make his or her computer safe. Or it may be just as easily used
|
|||
|
|
by a computer criminal to break into someone else<73>s computer.
|
|||
|
|
***********************************************************
|
|||
|
|
|
|||
|
|
|
|||
|
|
5) Storing Suspicious Programs
|
|||
|
|
It<EFBFBD>s nice to think that the owners of your ISP mind their own business. But
|
|||
|
|
they don<6F>t. They snoop in the directories of their users. They laugh at your
|
|||
|
|
email. OK, maybe they are really high-minded and resist the temptation to
|
|||
|
|
snoop in your email. But chances are high that they will snoop in your shell
|
|||
|
|
log files that record every keystroke you make while in your shell account.
|
|||
|
|
If they don<6F>t like what they see, next they will be prowling your program files.
|
|||
|
|
|
|||
|
|
One solution to this problem is to give your evil hacker tools innocuous
|
|||
|
|
names. For example, you could rename SATAN to ANGEL. But your sysdamin may
|
|||
|
|
try running your programs to see what they do. If any of your programs turn
|
|||
|
|
out to be commonly used to commit computer crimes, you are history.
|
|||
|
|
|
|||
|
|
Wait, wait, you are saying. Why get a shell account if I can get kicked out
|
|||
|
|
even for legal, innocuous hacking? After all, SATAN is legal to use. In
|
|||
|
|
fact, you can learn lots of neat stuff with SATAN. Most hacker tools, even
|
|||
|
|
if they are primarily used to commit crimes, are also educational. Certainly
|
|||
|
|
if you want to become a sysadmin someday you will need to learn how these
|
|||
|
|
programs work.
|
|||
|
|
|
|||
|
|
Sigh, you may as well learn the truth. Shell accounts are kind of like
|
|||
|
|
hacker training wheels. They are OK for beginner stuff. But to become a
|
|||
|
|
serious hacker, you either need to find an ISP run by hackers who will
|
|||
|
|
accept you and let you do all sorts of suspicious things right under their
|
|||
|
|
nose. Yeah, sure. Or you can install some form of Unix on your home
|
|||
|
|
computer. But that<61>s another Guide to (mostly) Harmless Hacking (Vol. 2
|
|||
|
|
Number 2: Linux!).
|
|||
|
|
|
|||
|
|
If you have Unix on your home computer and use a PPP connection to get into
|
|||
|
|
the Internet, your ISP is much less likely to snoop on you. Or try making
|
|||
|
|
friends with your sysadmin and explaining what you are doing. Who knows, you
|
|||
|
|
may end up working for your ISP!
|
|||
|
|
|
|||
|
|
In the meantime, you can use your shell account to practice just about
|
|||
|
|
anything Unixy that won<6F>t make your sysadmin go ballistic.
|
|||
|
|
|
|||
|
|
*************************************************************
|
|||
|
|
Would you like a shell account that runs industrial strength Linux -- with
|
|||
|
|
no commands censored? Want to be able to look at the router tables, port
|
|||
|
|
surf all.net, and keep SATAN in your home directory without getting kicked
|
|||
|
|
out for suspicion of hacking? Do you want to be able to telnet in on ssh
|
|||
|
|
(secure shell)so no one can sniff your password? Are you willing to pay $30
|
|||
|
|
per month for unlimited access to this hacker playground? How about a seven
|
|||
|
|
day free trial account? Email haxorshell@techbroker.com for details.
|
|||
|
|
*************************************************************
|
|||
|
|
|
|||
|
|
In case you were wondering about all the input from jericho in this Guide,
|
|||
|
|
yes, he was quite helpful in reviewing this and making suggestions. Jericho
|
|||
|
|
is a security consultant and also runs his own Internet host,
|
|||
|
|
obscure.sekurity.org. Thank you, jericho@dimensional.com, and happy hacking!
|
|||
|
|
|
|||
|
|
_________________________________________________________
|
|||
|
|
Want to see back issues of Guide to (mostly) Harmless Hacking? See either
|
|||
|
|
http://www.cs.utexas.edu/users/matt/hh.html (the official Happy Hacker
|
|||
|
|
archive site)
|
|||
|
|
http://www.geocities.com/TimesSquare/Arcade/4594
|
|||
|
|
http://www.silitoad.org
|
|||
|
|
http://base.kinetik.org
|
|||
|
|
http://www.anet-chi.com/~dsweir
|
|||
|
|
http://www.tacd.com/zines/gtmhh/
|
|||
|
|
http://ra.nilenet.com/~mjl/hacks/codez.htm
|
|||
|
|
http://www.ilf.net/brotherhood/index2.html
|
|||
|
|
|
|||
|
|
Subscribe to our discussion list by emailing to hacker@techbroker.com with
|
|||
|
|
message "subscribe"
|
|||
|
|
Want to share some kewl stuph with the Happy Hacker list? Correct mistakes?
|
|||
|
|
Send your messages to hacker@techbroker.com. To send me confidential email
|
|||
|
|
(please, no discussions of illegal activities) use cmeinel@techbroker.com
|
|||
|
|
and be sure to state in your message that you want me to keep this
|
|||
|
|
confidential. If you wish your message posted anonymously, please say so!
|
|||
|
|
Direct flames to dev/null@techbroker.com. Happy hacking!
|
|||
|
|
Copyright 1997 Carolyn P. Meinel. You may forward or post this GUIDE TO
|
|||
|
|
(mostly) HARMLESS HACKING on your Web site as long as you leave this notice
|
|||
|
|
at the end.
|
|||
|
|
________________________________________________________
|
|||
|
|
Carolyn Meinel
|
|||
|
|
M/B Research -- The Technology Brokers
|
|||
|
|
|
|||
|
|
|