259 lines
12 KiB
Plaintext
259 lines
12 KiB
Plaintext
Why the "Fun with RA boards" hacking method is LAME!
|
||
(The REAL way to hack RemoteAccess)
|
||
-----------------------------------
|
||
|
||
Knocked up by ByTe RyDeR of the
|
||
ÚÂÄÄ ÄÄ Ä úú ú
|
||
ijÅÄÄ FundeMäNTAL CoNNeCtiON ijÄÄÄ
|
||
:ÃÄÄ ÄÄ Ä úú ú
|
||
|
||
|
||
"Saving the Brain Forest"
|
||
|
||
|
||
Well dewdz, ya seen the file text about hacking RemoteAccess and you wanna
|
||
crack that H/P or warez RA board for mega ratios? Get Real!
|
||
|
||
RA *CAN* be hacked but only in the same way as any other BBS sox... no
|
||
sysop reading that file was shat themselves .. here's why not:
|
||
|
||
Basically the technique outlined involved you writing a trojan and
|
||
disguising it as some program the sysop is really gagging for in the hope
|
||
is he'll run it on his system. Wot it'll really do is copy his USER.BBS
|
||
onto the filebase so you can call back later and d/l it... neat idea, and
|
||
one that in *theory* will work with most BBS sox (most are EVEN easier coz
|
||
they don't encrypt the users file like RA) but their execution of it sucks!
|
||
|
||
Firstly, their compiled batch file relied on the sysop running RA off their
|
||
C: drive from the directory \RA... Yeah, maybe some lame PD board they
|
||
hang out on is like that but most sysops I know run multiple drives and
|
||
many have more complex directory structures... Lame Hacker 0 - Sysop 1
|
||
|
||
Okay... letz assume they got on some lame fucking board and the users file
|
||
*is* C:\RA\USERS.BBS - next step is to copy the file into the filebase and
|
||
make it d/lable. How do they do that? (patronising Dez Lymon voice) <g>.
|
||
|
||
Their idea was to copy the file into D:\FILES\UPLOAD .. Yeah sure guyz...
|
||
EVERY board uses the D: drive for the filebase and happen to have a file
|
||
area in \FILES\UPLOAD - NOT!!!!!! Lame Hacker 0 - Sysop 2
|
||
|
||
Right, so they got better odds than winning the national fucking lottery and
|
||
all the above worked (yeah man, we're dreamin' but let's give 'em a chance).
|
||
What next? The file has to be d/lable... you found a sysop that makes
|
||
UNCHECKED & UNSCANNED files available for download? Fuck off! Get a life!
|
||
Lame Hacker 0 - Sysop 3
|
||
|
||
So... okay.... we got a sysop that's so fucking lame he doesn't deserve
|
||
to to breath the same air as the rest of the human race and uses all the
|
||
above paths and makes unchecked uploads d/lable. RA by default won't allow
|
||
files to be d/led UNLESS they're in the file database. Unless the USERS.BBS
|
||
destination ALREADY EXISTED in that area and was previously in the area
|
||
database there's NO WAY you can d/l it.
|
||
|
||
The way they "solved" this was to add an entry to FILES.BBS in the file
|
||
directory. Nice one... EXCEPT RA DOESN'T USE FILES.BBS AS IT'S FILE
|
||
DATABASE. Unless you happen to be lucky enough that the sysop does an
|
||
import from FILES.BBS to the REAL file database before checking out your
|
||
planted file (most RA sysops only import from FILES.BBS when adding CDROMs)
|
||
the addition of this entry will do FUCK ALL! Lame Hacker 0 - Sysop 4
|
||
|
||
To quote from the author "This is a generic program and you will have to
|
||
tailor it so it will meet your needs." - yeah man, fucking rethink, redesign
|
||
and rewrite it more like!
|
||
|
||
Oh yeah... EVEN IF YOU DO get a copy of the USER.BBS file downloaded THE
|
||
PASSWORDS ARE ENCRYPTED!!! Lame Hacker :( - Sysop:-)
|
||
|
||
|
||
So how can U hack RA? Well, the idea was okay but, like hacking any system,
|
||
you gotta KNOW the system ya gonna hack b4 U stand a chance.
|
||
|
||
Most sysops will use the DOS environment variable RA set to the RA system
|
||
directory so that external doors can find the system files... that's very
|
||
helpful of the sysop, to show us where we can find his config files. <g>
|
||
|
||
In the RA system directory should be the file CONFIG.RA. You might want to
|
||
include a check for this file within your program and possibly do a disk
|
||
and directory scan for the file if RA isn't defined or is set incorrectly.
|
||
|
||
I'm not *entirely* sure about other versions of RA, but in the current
|
||
release (2.02) the CONFIG.RA offset &h3E4 is where the name of the mail
|
||
directory starts. This is the path where USERS.BBS will be found.
|
||
|
||
Next you need to know for SURE the name of a directory which stores the
|
||
files for a filearea from which you are able to download.
|
||
|
||
I suggest you do this in one of three ways:
|
||
|
||
1) Interogate the file FILES.RA in the RA system directory which contains
|
||
the filebase area configs. You *could* just search the directory for a
|
||
valid path but you'd wouldn't know if you had d/l access to the area.
|
||
|
||
2) If you want to be a bit more clever you could interpret the file and
|
||
find out the minimum security level required to d/l from each area and
|
||
dump your copy of USERS.BBS in the area with the lowest access level,
|
||
pretty much guaranteeing that you'll be able to get to the file. This
|
||
doesn't take security flags into account so there's still a SLIM
|
||
possiblity you won't be able to d/l the file unless you also write flag
|
||
testing into your program.
|
||
|
||
3) My favourite technique is to have the program read a small config file
|
||
which is uploaded with your archive. This file just contains the name
|
||
of a file you KNOW you have d/l access from. You can then either do a
|
||
global search for that filename or, preferably (coz it's faster) read
|
||
FILES.RA for the paths used by the filebase and search those.
|
||
|
||
So now you have the location of the USERS.BBS and the destination directory
|
||
you simply need to copy the file. However, even though the file is sitting
|
||
in a filebase directory it STILL isn't available for d/l... why? Because
|
||
it's not in the filearea database.
|
||
|
||
You could get clever and find amend filearea database files directly if you
|
||
get the fileareas path from CONFIG.RA (offset &hC12) and write to the files
|
||
HDR\FBD#####.HDR (header) IDX\FDB#####.IDX (index) and, if you want to add
|
||
a description, TXT\FBD#####.TXT, where ##### is the RA file area number.
|
||
|
||
There *is* an easier way. Shell out to DOS and execute the RAFILE utility
|
||
from the RA program path, passing the arguments "ADOPT filename #####".
|
||
|
||
E.g. the BASIC command would be:
|
||
|
||
SHELL "RAFILE ADOPT "+filename$+STR$(areanum)
|
||
|
||
Where filename$ contains the name of your USERS.BBS copy and areanum is the
|
||
RA filearea number. If your filename was USERTEST.ZIP and you'd copied it
|
||
to the directory used for RA file area 10 you'd be executing:
|
||
|
||
RAFILE ADOPT USERTEST.ZIP 10
|
||
|
||
This will "adopt" the file, adding it to the RA file database, making it
|
||
available for d/l (assuming you have the appropriate rights to the area).
|
||
|
||
All you need to do now is to package this trojan file to entice the sysop
|
||
into running it... In the LAME method for hacking RA the author used DSZ
|
||
as an example. That was about the most realistic part of the file and the
|
||
only bit worth leaching! <g>
|
||
|
||
|
||
Your archive:
|
||
DSZ.EXE (your program)
|
||
DSZ.DAT (the *real* DSZ.EXE)
|
||
DSZ.CFG (small file containing the name of a *known*
|
||
d/lable file - preferabbly encrypted)
|
||
+ any other files that normally come with DSZ
|
||
|
||
|
||
|
||
Flow diagram for DSZ.EXE trojan:
|
||
|
||
_______
|
||
/ \
|
||
| Start |
|
||
\_______/
|
||
|
|
||
|
|
||
+--------+--------+
|
||
| Read enviroment |
|
||
| variable RA |
|
||
+--------+--------+
|
||
|
|
||
|
|
||
/ \
|
||
/ \
|
||
/CONFIG.RA\ +---------------------+
|
||
/ exist in \___>____| Scan drives & paths |
|
||
\ that path / No | search for the file |
|
||
\ ? / +----------+----------+
|
||
\ / |
|
||
\ / |
|
||
Yes | |
|
||
+------------<-------------+
|
||
|
|
||
+--------+--------+
|
||
| Read CONFIG.RA |
|
||
| to get location |
|
||
| of USERS.BBS |
|
||
+--------+--------+
|
||
|
|
||
|
|
||
+--------+--------+
|
||
| Read DSZ.CFG to |
|
||
| get a filename |
|
||
+--------+--------+
|
||
|_____________<____________
|
||
| |
|
||
+--------+--------+ |
|
||
| Read FILES.RA to| |
|
||
| get name of the | |
|
||
| next filearea | |
|
||
+--------+--------+ |
|
||
| |
|
||
| |
|
||
/ \ |
|
||
/ \ |
|
||
/does area\ |
|
||
/ contain the \________>__________|
|
||
\ file / No
|
||
\ ? /
|
||
\ /
|
||
\ /
|
||
Yes |
|
||
|
|
||
+--------+--------+
|
||
| Copy USERS.BBS |
|
||
| to the filearea |
|
||
| directory |
|
||
+--------+--------+
|
||
|
|
||
|
|
||
+--------+--------+
|
||
| Run RAFILE with |
|
||
| ADOPT to update |
|
||
| RA database |
|
||
+--------+--------+
|
||
|
|
||
|
|
||
+--------+--------+
|
||
| Delete DSZ.EXE |
|
||
| and DSZ.CFG |
|
||
+--------+--------+
|
||
|
|
||
|
|
||
+--------+--------+
|
||
| Rename DSZ.DAT |
|
||
| to DSZ.EXE |
|
||
+--------+--------+
|
||
|
|
||
___|___
|
||
/ \
|
||
| Stop! |
|
||
\_______/
|
||
|
||
Once you've uploaded the file, preferably using a pseudonym, post the sysop
|
||
a message telling him how c00l your upload is. Wait a day or so and dial
|
||
back. Do a filename search using the name you decided to use for your copy
|
||
of USERS.BBS and d/l it.
|
||
|
||
The next step, now you have the USERS.BBS file is to crack the passwords.
|
||
I only know of ONE crack program out there which has the RA password
|
||
encryption algorythm, a program based on the popular Unix CRACKERJACK
|
||
program called RA-CRACK. This simply takes a given word, encrypts it, and
|
||
compares it to the USERS.BBS file to find a user with a matching password.
|
||
|
||
RA-CRACK takes it's source words from a text file so it would be possible
|
||
to either:
|
||
|
||
a) Use a TXT dictionary file as the source. All passwords that are
|
||
normal words will be found. This method will usually find about 90%
|
||
of the user passwords.
|
||
|
||
b) Write a "brute force" cracker using a small routine that "counts"
|
||
through valid ASCII character combinations from "!" (ASCII 33) upto
|
||
a string containing 25 (max length of a RA password) null characters
|
||
(ASCII 255), passing these via a text file to RA-CRACK. This SHOULD
|
||
be _100%_ successful, but SLOW!
|
||
|
||
l8r!
|
||
|
||
>ByTe<>RyDeR<
|
||
|