447 lines
20 KiB
Plaintext
447 lines
20 KiB
Plaintext
|
|
|||
|
DWE Issue 5: A Basic UNIX Overview
|
|||
|
August, 1993
|
|||
|
Asriel
|
|||
|
|
|||
|
|
|||
|
UNIX FOR DOS ADDICTED WaReZ PuPPieZ AND THEIR PETS
|
|||
|
|
|||
|
|
|||
|
Introduction
|
|||
|
------------
|
|||
|
|
|||
|
One of the most common operating systems in existance is Unix. Unix
|
|||
|
exists in many different flavors, from Berkeley BSD to AT&T System V
|
|||
|
to SunOs. Basic working knowledge of Unix is almost essential to a
|
|||
|
hacker, as it is the system a hacker is most likely to come across.
|
|||
|
If you intend to use the internet at all, or to do any serious
|
|||
|
exploration of Telenet, the ability to navigate through Unix is a
|
|||
|
necessity. (Unix is also the single most interesting system in
|
|||
|
existance: it's just fun to fuck with).
|
|||
|
|
|||
|
Unix Logins
|
|||
|
-----------
|
|||
|
|
|||
|
Most Unix logins look essentially the same. A general Unix login
|
|||
|
prompt looks something like this:
|
|||
|
|
|||
|
connected to five.finger.com
|
|||
|
login:
|
|||
|
|
|||
|
That first line is the system identifier. Although it's not at all
|
|||
|
essential to what you are doing, it's good to know what system you are
|
|||
|
attempting to log on to.
|
|||
|
The second line is what typically identifies the system you are on as
|
|||
|
Unix. Almost all Unix systems greet a user with the same prompt:
|
|||
|
login:.
|
|||
|
Well, there's not much to do in Unix from the outside, and Unix
|
|||
|
systems are typically fairly secure at this point. You may be able to
|
|||
|
obtain a list of users, or current users, by logging in as 'who', but
|
|||
|
other than that there are few functions available here.
|
|||
|
Unless you are on the internet, or have accounts specifically for the
|
|||
|
specific machine you are on, the only way on to the system is to try
|
|||
|
the default passwords. What are the default passwords?
|
|||
|
Unix systems come installed with certain passwords automatically. In
|
|||
|
addition, some accounts must exist on a system. One such account is
|
|||
|
'root'. This user is the divine Kami of the Unix system... in short,
|
|||
|
an all access pass. Unfortunately, few systems allow root logins
|
|||
|
remotely, and even fewer leave 'root' unpassworded. Nevertheless, it's
|
|||
|
always worth a shot... try this:
|
|||
|
|
|||
|
connected to ren.stimpy.net
|
|||
|
login: root
|
|||
|
password: root
|
|||
|
invalid login
|
|||
|
login:
|
|||
|
|
|||
|
well, nice try anyways... other possible passwords for root include
|
|||
|
'sysadmin', 'sys', 'admin'... you get the idea. You may also want to
|
|||
|
try these passwords with a single digit appended (added, idiot) to
|
|||
|
them... meaning the password 'root' could be 'root1' or 'root2'.
|
|||
|
An interesting tip about passwords in general... many people that use
|
|||
|
passwords under 8 characters tend to add a digit or a non-alphanumeric
|
|||
|
character to the password. This is done in order to hinder guessing,
|
|||
|
and to stop password breakers (more on this later). In this case, you
|
|||
|
may want to try adding a space before root... or even an ascii 255 to
|
|||
|
the end.
|
|||
|
Fortunately, there is more than one default password in a unix
|
|||
|
system... a quick list:
|
|||
|
|
|||
|
sys sys
|
|||
|
bin bin
|
|||
|
daemon daemon
|
|||
|
rje rje
|
|||
|
setup setup
|
|||
|
uucp uucp/nuucp/anonymous
|
|||
|
nuucp uucp/nuucp/anonymous
|
|||
|
mountfsys mountfsys
|
|||
|
|
|||
|
In the System
|
|||
|
-------------
|
|||
|
|
|||
|
Ok, at this point, I'm going to assume you've gotten past the login...
|
|||
|
as painful as that may sound. Although Unix may be secure from the
|
|||
|
outside, without effort from the system administrators, the inside of
|
|||
|
the system is not.
|
|||
|
First off, you'll likely by asked for a terminal. vt100 serves your
|
|||
|
purposes sufficently, and it's typically the default, so hit enter.
|
|||
|
Now, hopefully, you have a prompt. There are many different types of
|
|||
|
unix prompts, some of which contain current directory information,
|
|||
|
some of which are just a single character. Just don't panic when my
|
|||
|
examples don't look exactly like what you've got on your screen.
|
|||
|
The first thing you *need* to do on the system is establish your tty
|
|||
|
paramters. As eldritch and arcane sounding as this term may seem, it's
|
|||
|
actually quite simple... you need to tell the system what keys are
|
|||
|
going to do what.
|
|||
|
The command to set these parameters is 'stty'. Watch:
|
|||
|
|
|||
|
squinkyB ] stty erase ^h
|
|||
|
squinkyB ]
|
|||
|
|
|||
|
There... that wasn't so bad, was it? Well, it's also pretty
|
|||
|
meaningless to you, unless you have the ascii table memorized and are
|
|||
|
pretty good at on-the-spot deduction.
|
|||
|
The tty erase parameters determines which key is to be used as a
|
|||
|
backspace. At times, this may already be set when you log in, or it
|
|||
|
may be set to a suitable alternate (such as delete). Most of the time
|
|||
|
the system will tell you when you log on if this is so. In this case,
|
|||
|
we've entered ^h in order to make the backspace key, appropriately
|
|||
|
enough, backspace.
|
|||
|
Another extremely important parameter is 'intr'. The 'intr' paramter
|
|||
|
tells the Unix system what you intend to use as a break character...
|
|||
|
you should have this set to ^c.
|
|||
|
|
|||
|
Getting Around
|
|||
|
--------------
|
|||
|
|
|||
|
A good thing to remember about Unix is that it's alot like DOS. Files
|
|||
|
are laid out in directories just as in DOS... in fact, the only
|
|||
|
immediate difference in the directory structures is that Unix uses a
|
|||
|
forward slash ("/", moron!) instead of a backwards one.
|
|||
|
Also, the basic Unix directory navigation command is identical to DOS.
|
|||
|
In order to change directories, you use the command 'chdir', or 'cd'.
|
|||
|
A quick example:
|
|||
|
|
|||
|
1 /usr1/astoria ] cd ..
|
|||
|
2 /usr ]
|
|||
|
|
|||
|
Wala. That simple. Quick notes:
|
|||
|
|
|||
|
<20> cd / will take you to root.
|
|||
|
<20> cd /*pathname* will take you to *pathname*
|
|||
|
<20> cd home will take you to your home directory.
|
|||
|
|
|||
|
You can make and delete your own directories with the mkdir/rmdir
|
|||
|
commands. Simply put, mkdir makes a subdirectory off of the current
|
|||
|
directory, and rmdir removes a subdirectory from the current
|
|||
|
subdirectory. Good to know if you plan to do a lot of file transfers.
|
|||
|
An important note about Unix directories, files, and concepts:
|
|||
|
Unix is a case-sensitive operating system. Thus, the files
|
|||
|
|
|||
|
<20> Spleen
|
|||
|
<20> spleen
|
|||
|
<20> SPLEEN
|
|||
|
<20> SpLeEn
|
|||
|
|
|||
|
are all different. This rule applies to directories and command line
|
|||
|
paramters, as well as most other Unix ideas.
|
|||
|
Another nice thing to know about Unix: Unix files are not subject to
|
|||
|
the normal DOS 8 character limit. Thus, you can have vast filenames,
|
|||
|
such as "this_file_ate_my_biscuit".
|
|||
|
|
|||
|
Some other important commands
|
|||
|
-----------------------------
|
|||
|
|
|||
|
First and foremost, you should know cp. cp is the basic Unix
|
|||
|
equivalent of the DOS COPY command. The command line for cp is
|
|||
|
identical to that of COPY.
|
|||
|
Next on the scale of cosmic import is cat. cat is the Unix equivalent
|
|||
|
of the DOS TYPE command, and once again, for simple file displaying,
|
|||
|
the command line is identical.
|
|||
|
Variations on the theme:
|
|||
|
pg: displayes a file page by page. Type "pg x filename", where x is a
|
|||
|
number of lines to display before pausing and filename is the
|
|||
|
file you wish to display.
|
|||
|
more: displays a file screen by screen.
|
|||
|
Stupid pet trick:
|
|||
|
You can use your cat to copy files, simply by using the directional
|
|||
|
operators. To copy a file from here to there using cat, simply type:
|
|||
|
|
|||
|
% cat here
|
|||
|
this is the file here
|
|||
|
% cat there
|
|||
|
this is the file there
|
|||
|
% cat here > there
|
|||
|
% cat there
|
|||
|
this is the file here
|
|||
|
|
|||
|
The operator ">" simply takes the output from the cat command and
|
|||
|
places is in the location specified after it.
|
|||
|
Another vital command to know is 'rm'. rm deletes a file from the
|
|||
|
system, in the same way DEL would on a DOS system. Not to much else to
|
|||
|
say.
|
|||
|
Critical in your navigation of a Unix system is the ls command. ls is
|
|||
|
DOS DIR on heroin. Simply type ls and you get a nice, neat list of
|
|||
|
files in the directory.
|
|||
|
DIR on controlled substances:
|
|||
|
There are a few command line parameters that you should know...
|
|||
|
foremost is l. ls -l gets you a list of files, and valuable
|
|||
|
information about each file, including permissions (more on that
|
|||
|
later), size, and linked files.
|
|||
|
Another useful command for long file lists is C. ls -C gets you a
|
|||
|
list of files in multiple columns, much the same as DIR /W would
|
|||
|
merit a double column report of all existing files. A quick reminder:
|
|||
|
ls -C is NOT the same as ls -c. Unix = case sensitive.
|
|||
|
Another good command to know, mv will move a file from directory to
|
|||
|
directory. For those of you without DOS 6.0 <gasp>, mv simply copies a
|
|||
|
file to another directory and deletes the original.
|
|||
|
quick tip for files on the lam:
|
|||
|
if you want to rename a file (to protect the innocent), you need to
|
|||
|
mv a file to a different file name. A quick demo:
|
|||
|
|
|||
|
# ls
|
|||
|
myfile
|
|||
|
# cat myfile
|
|||
|
this is my file
|
|||
|
# mv myfile my_other_file
|
|||
|
# ls
|
|||
|
my_other_file
|
|||
|
# cat my_other_file
|
|||
|
this is my file
|
|||
|
|
|||
|
Another vastly important command is 'man'. In fact, man is probably
|
|||
|
one of the most important commands extant for a beginning user... it
|
|||
|
calls up the system's help files. To use man, simply type in 'man
|
|||
|
command', where command is a Unix command you seek to gain
|
|||
|
enlightenment regarding. It's a great way to gain an understanding of
|
|||
|
Unix commandline parameters.
|
|||
|
If you are interested in seeing who's been on of late, or just want a
|
|||
|
few names to try to hack, type 'who'. You get a quick list of users
|
|||
|
that have accessed the system lately. If you <god forbid> need to know
|
|||
|
who you are at this point, type 'whoami'.
|
|||
|
If you want to change your identity on the system, type 'su name'
|
|||
|
where name is an account on the system. It'll ask you for the account
|
|||
|
password, then, *presto*... instant transmogrification.
|
|||
|
A Caveat for smart alec hackers:
|
|||
|
Unix typically logs usage of the su command. While su may seem like a
|
|||
|
great opportunity to try to hack out passwords manually without
|
|||
|
worrying about the system hanging up after 3 attempts, it's typically
|
|||
|
not a good idea to do this, as it may alert the administrators to
|
|||
|
your presence.
|
|||
|
*Numero Uno on the list of commands NEVER to use on a Unix system:
|
|||
|
The 'passwd' command changes your password on a Unix system. Seems
|
|||
|
innocous enough, eh? Uh-uh. If your account is active, and there's a
|
|||
|
very strong chance that it either is or will be, there is no better
|
|||
|
way to lose the account than to change the password, only to have the
|
|||
|
legitimate user alert the sysadmins when he/she can't gain access to
|
|||
|
his/her normal account (well, there are better ways... you could
|
|||
|
simply mail the sysadmin and tell him you are trying to hack his
|
|||
|
grandmother's life support machine through your account).
|
|||
|
I've seen this single, quick command turn a extremely lax system
|
|||
|
into an ironclad security compound in less than a day.
|
|||
|
DONT-FUCK-WITH-IT.
|
|||
|
*Numero Dos on that same list:
|
|||
|
The 'mail' command reads and sends mail. So what? Well, unless your
|
|||
|
account is stable (and it isn't unless you either paid for it or
|
|||
|
killed the original owner in such a way that his body cannot claw it's
|
|||
|
way out of it's grave to it's keyboard), the user is more likely than
|
|||
|
not going to know if you read his mail. In addition, if you send mail
|
|||
|
out of the system (type 'mail', and a username/address; type in your
|
|||
|
message and end it with a ^d on it's own line), the response from your
|
|||
|
message will likewise alert the user to your presence.
|
|||
|
|
|||
|
System Spelunking
|
|||
|
-----------------
|
|||
|
|
|||
|
The first place you want to check out in the wild uncharted directory
|
|||
|
tree of your friendly neighborhood Unix system is the "/etc"
|
|||
|
directory. What's in it? The single most intensely important file on
|
|||
|
the system (besides a world writable root owned SUID file... but don't
|
|||
|
worry about that)... the passwd file.
|
|||
|
What is in the passwd file?
|
|||
|
|
|||
|
<20> a list of all accounts on the system
|
|||
|
<20> a list of the passwords for these accounts
|
|||
|
<20> a list of access levels for these accounts
|
|||
|
<20> a list of the home directories for these accounts
|
|||
|
<20> a list of information pertaining to these accounts.
|
|||
|
|
|||
|
Why the hell the Unix designers decided this file should be world
|
|||
|
readable is beyond me. Be content to know that your standard everyday
|
|||
|
run-of-the-mill-lacking-in-certified-cosmic-power 'cat' command WILL
|
|||
|
display this file. As will pg and more. However, because most users
|
|||
|
don't have write permissions (more on that later) to the /etc
|
|||
|
directory, 'cat' is pretty much the only applicable command here.
|
|||
|
However, if you need to copy the file to your own directory (for
|
|||
|
whatever reason), just cat it there with the directional operator (>).
|
|||
|
The catch:
|
|||
|
Well, there are two catches here. First off, regardless of system
|
|||
|
security, if the passwords are in the file, they are encrypted. You
|
|||
|
can't decrypt them. Although you can get a list of accounts without
|
|||
|
passwords this way (just look for accounts with no entry in the
|
|||
|
password field), and a list of accounts that can't be logged onto
|
|||
|
remotely/at all (NO LOGIN), you can't get much else. Sucks, don't it?
|
|||
|
Notice I said 'if' the passwords are there.
|
|||
|
<ominous soundtrack please>
|
|||
|
Some horrible, paranoid, draconian system administrators mutilate
|
|||
|
their passwd files in such a way that (*gasp*) the passwords don't
|
|||
|
show up. All you get is one cold, icy X staring at you from the bowels
|
|||
|
of Unix Shell Siberia, mocking you as you pull your hair out in
|
|||
|
frustration (sorry, but this is a sore spot with me). The kidnapped
|
|||
|
passwords reside in the shadow file in the /etc directory, available
|
|||
|
with your standard everyday run-of-the-mill-but-distinct-in-the-fact-
|
|||
|
that-only-root-level-accounts-can-use-it-to-this-extent 'cat' command.
|
|||
|
Well, if the passwords are encrypted, what good are they?
|
|||
|
By themselves, nothing. A account with a Unix encrypted password will
|
|||
|
get you no further than an account with no listed password at all. You
|
|||
|
can't even deduce the amount of characters in the password if it's
|
|||
|
encrypted. So what's the use?
|
|||
|
The Unix method of encrypting files is available to the public. It is
|
|||
|
also, to most mortals, irreversable. Essentially, this means you can
|
|||
|
encrypt a string of characters, but not decrypt it. Even the unix
|
|||
|
system itself doesn't decrypt the password when you log on...
|
|||
|
When you log on, the Unix system takes whatever you enter at the
|
|||
|
password prompt, encrypts it, and matches it to the entry in the
|
|||
|
passwd file. Thus, the Unix system never decrypts the password... it
|
|||
|
only compares it to a different encrypted string.
|
|||
|
While this may not sound too particularly useful at first, it is.
|
|||
|
There are programs that have been written to do the same thing on a
|
|||
|
personal computer... you supply it a list of passwords and a list of
|
|||
|
words to attempt to use as passwords (called dictionaries), and it
|
|||
|
spends the night encrypting dictionaries and matching them to password
|
|||
|
entries. By running a dictionary through a passwd file, on a typical
|
|||
|
system, you can usually get 10-20 accounts. Good personal computer
|
|||
|
examples of this program idea include Killer Cracker (the industry
|
|||
|
standard, so to speak) and CrackerJack (faster than Killer Cracker).
|
|||
|
Quick tips for CrackerJunkies with leech access at an H/P BBS:
|
|||
|
A standard dictionary will not uncover passwords protected with an
|
|||
|
appended digit or non-alphanumeric character. In order to get around
|
|||
|
this, you need only grab a program that processes the dictionary file
|
|||
|
to add that digit to each entry in the dictionary... although this
|
|||
|
takes longer, and you'll need to do it multiple times, you can
|
|||
|
typically get 10 more accounts just by adding a 1 to every entry.
|
|||
|
Files and directories in Unix are characterized further by their
|
|||
|
permissions. Permissions are a standard system of who gets access to a
|
|||
|
specific function of that file or directory. Standard permissions
|
|||
|
include read, write, and execute. You can get a list of permissions by
|
|||
|
typing 'ls -l'. The first field in the listing contains the
|
|||
|
permissions, grouped as follows:
|
|||
|
|
|||
|
owner group world
|
|||
|
--------------------
|
|||
|
rwx rwx rwx
|
|||
|
|
|||
|
(Not drawn to scale... in fact, it doesn't look anything like that).
|
|||
|
Essentially, as long as the letter is there, you have access to that
|
|||
|
facet of the file. If the letter is not there, you'll see a dash...
|
|||
|
meaning you don't have access to that function. An example:
|
|||
|
|
|||
|
rwxr-x--x
|
|||
|
|
|||
|
In this case, the owner of the file can Read the file, Write to the
|
|||
|
file, and eXecute the file; members of his group (a bunch of linked
|
|||
|
accounts) can Read the file, CANNOT Write to the file, and can eXecute
|
|||
|
the file; and the rest of the user population CANNOT Read or Write to
|
|||
|
the file, but CAN eXecute the file.
|
|||
|
|
|||
|
rwx---rwx
|
|||
|
|
|||
|
is a WORLD-READABLE, WORLD-WRITABLE, WORLD-EXECUTABLE file. This
|
|||
|
simply means that anyone can read, write, or execute the file.
|
|||
|
|
|||
|
Another permission sometimes set to a file is the SUID bit. An SUID
|
|||
|
file contains a smallcase s in the user executable section of the
|
|||
|
permissions list...
|
|||
|
|
|||
|
rws--x--x
|
|||
|
|
|||
|
When you execute an SUID file, your user ID becomes that of the owner
|
|||
|
of the file. While this may not look to important at first, by now you
|
|||
|
should know that no really important super elite hacker concept does.
|
|||
|
Take a look at this:
|
|||
|
|
|||
|
rwsr-x--x
|
|||
|
|
|||
|
Synopsis? It's a world executable SUID file. In essence, anyone can
|
|||
|
execute the file, and in doing so, become the owner of the file for
|
|||
|
the duration of the time that file is operating. However, this doesn't
|
|||
|
get you much, because you typically can't do anything while the
|
|||
|
programis running. More likely than not, it's calculating how many
|
|||
|
pencils it needs to order for school tomorrow or some other such
|
|||
|
drivel.
|
|||
|
The real power of the SUID file comes into play in this situation:
|
|||
|
|
|||
|
rwsrwxrwx
|
|||
|
|
|||
|
You won't see a lot of these, but when you do, look out. What you have
|
|||
|
here is a world writable SUID file... and a world writable program can
|
|||
|
be any program on the system you have read access to. Like, say,
|
|||
|
/bin/sh... the Unix shell...
|
|||
|
Quick command line example... 'diablo' is a root owned, world writable
|
|||
|
SUID file. I'm going to ignore the rest of the output of the ls
|
|||
|
command.
|
|||
|
|
|||
|
#ls -l
|
|||
|
rwsrwxrwx... ...diablo
|
|||
|
#cat /bin/sh > diablo
|
|||
|
#diablo
|
|||
|
$
|
|||
|
|
|||
|
Oh, just so you know, the $ prompt denotes root access.
|
|||
|
Good deal, huh? In general, if you have right privs to an SUID file,
|
|||
|
copy it to your own directory and cat /bin/sh into it. You now have an
|
|||
|
instant gateway to the account of the owner of that file.
|
|||
|
If you want to find files that you can do this with, try this out:
|
|||
|
|
|||
|
#find / -user root -perm -4000 -exec /bin/ls -al {} ";"
|
|||
|
|
|||
|
This will give you a list of all root owned SUID files. If you want
|
|||
|
more info on the 'find' command, just 'man find'.
|
|||
|
|
|||
|
Well, I'm overdo for an appointment on the IRC in #warez... so I'll
|
|||
|
cut off here. I hope I've been of assistance to you.
|
|||
|
|
|||
|
----------------------------------------------------------------------------
|
|||
|
A C T U A L A R T I C L E E N D S H E R E . . .
|
|||
|
|
|||
|
Please feel free to save an extra 1k of file space and invoke the DOS
|
|||
|
EDIT CUT command at the dotted line. Do not remove the rest of this
|
|||
|
article on penalty of law.
|
|||
|
|
|||
|
S00P3R GR00P-3SQU3 GR33TZ / +HANX
|
|||
|
|
|||
|
Greets go out to Nowhere Man, INC, THG, UNT, SaD, SoD, PTA, SOB
|
|||
|
Thanks to... ________________________
|
|||
|
your ad here
|
|||
|
|
|||
|
Current DWE Akshul M3mbre Boards:
|
|||
|
|
|||
|
Nitro Burnin' Funny Cars WHQ/DWEnet HOST (312)582-1115 <XANAX>
|
|||
|
The Prodigal Sun CHQ/MECCA (312)238-3585 <ASRIEL>
|
|||
|
Dark Waters HQ/Infosite (312)667-0222 <MONK>
|
|||
|
PyroTechnics II Infosite (708)991-9403 <PYRO>
|
|||
|
|
|||
|
DWE M3/\/\B3R LiST
|
|||
|
|
|||
|
President and Dictator for Life: Xanax
|
|||
|
Head Courier/Warez Cracker: Asriel
|
|||
|
Head Fisherman/Trout Expert: Changeling
|
|||
|
Head Person That Gets Asriel Free CDs: Monk
|
|||
|
Head Person That Gets DWE Members Free WaReZ: Pyro
|
|||
|
Head Person That Knows More Than Asriel (Honorary Title): LVX
|
|||
|
Head Person That Actually Wrote for DWE without Coercion: Cosmos
|
|||
|
Head Know-It-All Stoner that runs 386bsd: Goldstein
|
|||
|
|
|||
|
Want to write for DWE? Neither do we. But if the spirit moves you,
|
|||
|
write up an article about anything we haven't discussed already, and
|
|||
|
post it somewhere in DWEnet or at any of the member boards, or call
|
|||
|
any of the members voice and dictate it to them, or submit it to them
|
|||
|
school newspaper of any of the members, or tack it on a bulletin board
|
|||
|
in the Third Coast Cafe in Century Mall, and chances are it'll be
|
|||
|
released as a s00per c00l DWE article.
|
|||
|
|
|||
|
W H A T F O L L O W S M U S T N O T B E D E L E T E D
|
|||
|
---------------------------------------------------------------------------
|
|||
|
(c) 1993 Dark World Enterprises
|
|||
|
Asriel(tm) appears courtesy of Hasbro, Inc.
|