698 lines
37 KiB
Plaintext
698 lines
37 KiB
Plaintext
_____________________________________________________________
|
|
|
|
GUIDE TO (mostly) HARMLESS HACKING
|
|
|
|
Vol. 2 Number 4
|
|
|
|
More intro to TCP/IP: port surfing! Daemons! How to get on almost any
|
|
computer without logging in and without breaking the law. Impress your
|
|
clueless friends and actually discover kewl, legal, safe stuph. I'll bet
|
|
se7en doesn't know how to do all this...
|
|
______________________________________________________________
|
|
|
|
A few days ago I had a lady friend visiting. She's 42 and doesn't own a
|
|
computer. However, she is taking a class on personal computers at a
|
|
community college. She wanted to know what all this hacking stuph is about.
|
|
So I decided to introduce her to port surfing. And while doing it, we
|
|
stumbled across something kewl.
|
|
|
|
Port surfing takes advantage of the structure of TCP/IP. This is the
|
|
protocol (set of rules) used for computers to talk to each other over the
|
|
Internet. One of the basic principles of Unix (the most popular operating
|
|
system on the Internet) is to assign a "port" to every function that one
|
|
computer might command another to perform. Common examples are to send and
|
|
receive email, read Usenet newsgroups, telnet, transfer files, and offer Web
|
|
pages.
|
|
|
|
|
|
************************
|
|
Newbie note #1: A computer port is a place where information goes in or out
|
|
of it. On your home computer, examples of ports are your monitor, which
|
|
sends information out, your keyboard and mouse, which send information in,
|
|
and your modem, which sends information both out and in.
|
|
|
|
But an Internet host computer such as callisto.unm.edu has many more ports
|
|
than a typical home computer. These ports are identified by numbers. Now
|
|
these are not all physical ports, like a keyboard or RS232 serial port (for
|
|
your modem). They are virtual (software) ports.
|
|
************************
|
|
|
|
So if you want to read a Web page, your browser contacts port number 80 and
|
|
tells the computer that manages that Web site to let you in. And, sure
|
|
enough, you get into that Web server computer without a password.
|
|
|
|
OK, big deal. That's pretty standard for the Internet. Many -- most --
|
|
computers on the Internet will let you do some things with them without
|
|
needing a password.
|
|
|
|
However, the essence of hacking is doing things that aren't obvious. That
|
|
don't just jump out at you from the manuals. One way you can move a step up
|
|
from the run of the mill computer user is to learn how to port surf. I'll
|
|
bet you won't find port surfing in a Unix manual.
|
|
|
|
The essence of port surfing is to pick out a target computer and explore it
|
|
to see what ports are open and what you can do with them.
|
|
|
|
Now if you are a lazy hacker you can use canned hacker tools such as Satan
|
|
or Netcat. These are programs you can run from Linux, FreeBSD or Solaris
|
|
(all types of Unix) from your PC. They automatically scan your target
|
|
computers. They will tell you what ports are in use. They will also probe
|
|
these ports for presence of daemons with known security flaws, and tell
|
|
you what they are.
|
|
|
|
********************************
|
|
Newbie note # 2: A daemon is not some sort of grinch or gremlin or 666 guy.
|
|
It is a program that runs in the background on many (but not all) Unix
|
|
system ports. It waits for you to come along and use it. If you find a
|
|
daemon on a port, it's probably hackable. Some hacker tools will tell you
|
|
what the hackable features are of the daemons they detect.
|
|
********************************
|
|
|
|
However, there are several reasons to surf ports by hand instead of
|
|
automatically.
|
|
|
|
1) You will learn something. Probing manually you get a gut feel for how the
|
|
daemon running on that port behaves. It's the difference between watching an
|
|
x-rated movie and (blush).
|
|
|
|
2) You can impress your friends. If you run a canned hacker tool like Satan
|
|
your friends will look at you and say, "Big deal. I can run programs, too."
|
|
They will immediately catch on to the dirty little secret of the hacker
|
|
world. Most hacking exploits are just lamerz running programs they picked up
|
|
from some BBS or ftp site. But if you enter commands keystroke by keystroke
|
|
your friends will see you using your brain. And you can help them play with
|
|
daemons, too, and give them a giant rush.
|
|
|
|
3) The truly elite hackers surf ports and play with daemons by hand because
|
|
it is the only way to discover something new. There are only a few hundred
|
|
hackers -- at most -- who discover new stuph. The rest just run canned
|
|
exploits over and over and over again. Boring. But port surfing by hand
|
|
is on the path to the pinnacle of hackerdom.
|
|
|
|
Now let me tell you what my middle-aged friend and I discovered while just
|
|
messing around.
|
|
|
|
First, we decided we didn't want to waste our time messing with some minor
|
|
little host computer. Hey, let's go for the big time!
|
|
|
|
So how do you find a big kahuna computer on the Internet? We started with a
|
|
domain which consisted of a LAN of PCs running Linux that I happened to
|
|
already know about, that is used by the New Mexico Internet Access ISP:
|
|
nmia.com.
|
|
|
|
*****************************
|
|
Newbie Note # 3: A domain is an Internet address. You can use it to look up
|
|
who runs the computers used by the domain, and also to look up how that
|
|
domain is connected to the rest of the Internet.
|
|
*****************************
|
|
|
|
So to do this we first logged into my shell account with Southwest
|
|
Cyberport. I gave the command:
|
|
|
|
<slug> [66] ->whois nmia.com
|
|
New Mexico Internet Access (NMIA-DOM)
|
|
2201 Buena Vista SE
|
|
Albuquerque, NM 87106
|
|
|
|
Domain Name: NMIA.COM
|
|
|
|
Administrative Contact, Technical Contact, Zone Contact:
|
|
Orrell, Stan (SO11) SAO@NMIA.COM
|
|
(505) 877-0617
|
|
|
|
Record last updated on 11-Mar-94.
|
|
Record created on 11-Mar-94.
|
|
|
|
Domain servers in listed order:
|
|
|
|
NS.NMIA.COM 198.59.166.10
|
|
GRANDE.NM.ORG 129.121.1.2
|
|
|
|
Now it's a good bet that grande.nm.org is serving a lot of other Internet
|
|
hosts beside nmia.com. Here's how we port surfed our way to find this out:
|
|
|
|
<slug> [67] ->telnet grande.nm.org 15
|
|
Trying 129.121.1.2 ...
|
|
Connected to grande.nm.org.
|
|
Escape character is '^]'.
|
|
TGV MultiNet V3.5 Rev B, VAX 4000-400, OpenVMS VAX V6.1
|
|
|
|
Product License Authorization Expiration Date
|
|
---------- ------- ------------- ---------------
|
|
MULTINET Yes A-137-1641 (none)
|
|
NFS-CLIENT Yes A-137-113237 (none)
|
|
|
|
|
|
*** Configuration for file "MULTINET:NETWORK_DEVICES.CONFIGURATION" ***
|
|
|
|
Device Adapter CSR Address Flags/Vector
|
|
|
|
------ ------- ----------- ------------
|
|
|
|
se0 (Shared VMS Ethernet/FDDI) -NONE- -NONE- -NONE-
|
|
|
|
MultiNet Active Connections, including servers:
|
|
Proto Rcv-Q Snd-Q Local Address (Port) Foreign Address (Port) State
|
|
----- ----- ----- ------------------ ------------------ -----
|
|
TCP 0 822 GRANDE.NM.ORG(NETSTAT) 198.59.115.24(1569) ESTABLISHED
|
|
TCP 0 0 GRANDE.NM.ORG(POP3) 164.64.201.67(1256) ESTABLISHED
|
|
TCP 0 0 GRANDE.NM.ORG(4918) 129.121.254.5(TELNET) ESTABLISHED
|
|
TCP 0 0 GRANDE.NM.ORG(TELNET) AVATAR.NM.ORG(3141) ESTABLISHED
|
|
TCP 0 0 *(NAMESERVICE) *(*) LISTEN
|
|
TCP 0 0 *(TELNET) *(*) LISTEN
|
|
TCP 0 0 *(FTP) *(*) LISTEN
|
|
TCP 0 0 *(FINGER) *(*) LISTEN
|
|
TCP 0 0 *(NETSTAT) *(*) LISTEN
|
|
TCP 0 0 *(SMTP) *(*) LISTEN
|
|
TCP 0 0 *(LOGIN) *(*) LISTEN
|
|
TCP 0 0 *(SHELL) *(*) LISTEN
|
|
TCP 0 0 *(EXEC) *(*) LISTEN
|
|
TCP 0 0 *(RPC) *(*) LISTEN
|
|
TCP 0 0 *(NETCONTROL) *(*) LISTEN
|
|
TCP 0 0 *(SYSTAT) *(*) LISTEN
|
|
TCP 0 0 *(CHARGEN) *(*) LISTEN
|
|
TCP 0 0 *(DAYTIME) *(*) LISTEN
|
|
TCP 0 0 *(TIME) *(*) LISTEN
|
|
TCP 0 0 *(ECHO) *(*) LISTEN
|
|
TCP 0 0 *(DISCARD) *(*) LISTEN
|
|
TCP 0 0 *(PRINTER) *(*) LISTEN
|
|
TCP 0 0 *(POP2) *(*) LISTEN
|
|
TCP 0 0 *(POP3) *(*) LISTEN
|
|
TCP 0 0 *(KERBEROS_MASTER) *(*) LISTEN
|
|
TCP 0 0 *(KLOGIN) *(*) LISTEN
|
|
TCP 0 0 *(KSHELL) *(*) LISTEN
|
|
TCP 0 0 GRANDE.NM.ORG(4174) OSO.NM.ORG(X11) ESTABLISHED
|
|
TCP 0 0 GRANDE.NM.ORG(4172) OSO.NM.ORG(X11) ESTABLISHED
|
|
TCP 0 0 GRANDE.NM.ORG(4171) OSO.NM.ORG(X11) ESTABLISHED
|
|
TCP 0 0 *(FS) *(*) LISTEN
|
|
UDP 0 0 *(NAMESERVICE) *(*)
|
|
UDP 0 0 127.0.0.1(NAMESERVICE) *(*)
|
|
UDP 0 0 GRANDE.NM.OR(NAMESERV) *(*)
|
|
UDP 0 0 *(TFTP) *(*)
|
|
UDP 0 0 *(BOOTPS) *(*)
|
|
UDP 0 0 *(KERBEROS) *(*)
|
|
UDP 0 0 127.0.0.1(KERBEROS) *(*)
|
|
UDP 0 0 GRANDE.NM.OR(KERBEROS) *(*)
|
|
UDP 0 0 *(*) *(*)
|
|
UDP 0 0 *(SNMP) *(*)
|
|
UDP 0 0 *(RPC) *(*)
|
|
UDP 0 0 *(DAYTIME) *(*)
|
|
UDP 0 0 *(ECHO) *(*)
|
|
UDP 0 0 *(DISCARD) *(*)
|
|
UDP 0 0 *(TIME) *(*)
|
|
UDP 0 0 *(CHARGEN) *(*)
|
|
UDP 0 0 *(TALK) *(*)
|
|
UDP 0 0 *(NTALK) *(*)
|
|
UDP 0 0 *(1023) *(*)
|
|
UDP 0 0 *(XDMCP) *(*)
|
|
|
|
MultiNet registered RPC programs:
|
|
Program Version Protocol Port
|
|
------- ------- -------- ----
|
|
PORTMAP 2 TCP 111
|
|
PORTMAP 2 UDP 111
|
|
|
|
|
|
MultiNet IP Routing tables:
|
|
Destination Gateway Flags Refcnt Use Interface MTU
|
|
---------- ---------- ----- ------ ----- --------- ----
|
|
198.59.167.1 LAWRII.NM.ORG Up,Gateway,H 0 2 se0 1500
|
|
166.45.0.1 ENSS365.NM.ORG Up,Gateway,H 0 4162 se0 1500
|
|
205.138.138.1 ENSS365.NM.ORG Up,Gateway,H 0 71 se0 1500
|
|
204.127.160.1 ENSS365.NM.ORG Up,Gateway,H 0 298 se0 1500
|
|
127.0.0.1 127.0.0.1 Up,Host 5 1183513 lo0 4136
|
|
198.59.167.2 LAWRII.NM.ORG Up,Gateway,H 0 640 se0 1500
|
|
192.132.89.2 ENSS365.NM.ORG Up,Gateway,H 0 729 se0 1500
|
|
207.77.56.2 ENSS365.NM.ORG Up,Gateway,H 0 5 se0 1500
|
|
204.97.213.2 ENSS365.NM.ORG Up,Gateway,H 0 2641 se0 1500
|
|
194.90.74.66 ENSS365.NM.ORG Up,Gateway,H 0 1 se0 1500
|
|
204.252.102.2 ENSS365.NM.ORG Up,Gateway,H 0 109 se0 1500
|
|
205.160.243.2 ENSS365.NM.ORG Up,Gateway,H 0 78 se0 1500
|
|
202.213.4.2 ENSS365.NM.ORG Up,Gateway,H 0 4 se0 1500
|
|
202.216.224.66 ENSS365.NM.ORG Up,Gateway,H 0 113 se0 1500
|
|
192.132.89.3 ENSS365.NM.ORG Up,Gateway,H 0 1100 se0 1500
|
|
198.203.196.67 ENSS365.NM.ORG Up,Gateway,H 0 385 se0 1500
|
|
160.205.13.3 ENSS365.NM.ORG Up,Gateway,H 0 78 se0 1500
|
|
202.247.107.131 ENSS365.NM.ORG Up,Gateway,H 0 19 se0 1500
|
|
198.59.167.4 LAWRII.NM.ORG Up,Gateway,H 0 82 se0 1500
|
|
128.148.157.6 ENSS365.NM.ORG Up,Gateway,H 0 198 se0 1500
|
|
160.45.10.6 ENSS365.NM.ORG Up,Gateway,H 0 3 se0 1500
|
|
128.121.50.7 ENSS365.NM.ORG Up,Gateway,H 0 3052 se0 1500
|
|
206.170.113.8 ENSS365.NM.ORG Up,Gateway,H 0 1451 se0 1500
|
|
128.148.128.9 ENSS365.NM.ORG Up,Gateway,H 0 1122 se0 1500
|
|
203.7.132.9 ENSS365.NM.ORG Up,Gateway,H 0 14 se0 1500
|
|
204.216.57.10 ENSS365.NM.ORG Up,Gateway,H 0 180 se0 1500
|
|
130.74.1.75 ENSS365.NM.ORG Up,Gateway,H 0 10117 se0 1500
|
|
206.68.65.15 ENSS365.NM.ORG Up,Gateway,H 0 249 se0 1500
|
|
129.219.13.81 ENSS365.NM.ORG Up,Gateway,H 0 547 se0 1500
|
|
204.255.246.18 ENSS365.NM.ORG Up,Gateway,H 0 1125 se0 1500
|
|
160.45.24.21 ENSS365.NM.ORG Up,Gateway,H 0 97 se0 1500
|
|
206.28.168.21 ENSS365.NM.ORG Up,Gateway,H 0 2093 se0 1500
|
|
163.179.3.222 ENSS365.NM.ORG Up,Gateway,H 0 315 se0 1500
|
|
198.109.130.33 ENSS365.NM.ORG Up,Gateway,H 0 1825 se0 1500
|
|
199.224.108.33 ENSS365.NM.ORG Up,Gateway,H 0 11362 se0 1500
|
|
203.7.132.98 ENSS365.NM.ORG Up,Gateway,H 0 73 se0 1500
|
|
198.111.253.35 ENSS365.NM.ORG Up,Gateway,H 0 1134 se0 1500
|
|
206.149.24.100 ENSS365.NM.ORG Up,Gateway,H 0 3397 se0 1500
|
|
165.212.105.106 ENSS365.NM.ORG Up,Gateway,H 0 17 se0 1006
|
|
205.238.3.241 ENSS365.NM.ORG Up,Gateway,H 0 69 se0 1500
|
|
198.49.44.242 ENSS365.NM.ORG Up,Gateway,H 0 25 se0 1500
|
|
194.22.188.242 ENSS365.NM.ORG Up,Gateway,H 0 20 se0 1500
|
|
164.64.0 LAWRII.NM.ORG Up,Gateway 1 40377 se0 1500
|
|
0.0.0 ENSS365.NM.ORG Up,Gateway 2 4728741 se0 1500
|
|
207.66.1 GLORY.NM.ORG Up,Gateway 0 51 se0 1500
|
|
205.166.1 GLORY.NM.ORG Up,Gateway 0 1978 se0 1500
|
|
204.134.1 LAWRII.NM.ORG Up,Gateway 0 54 se0 1500
|
|
204.134.2 GLORY.NM.ORG Up,Gateway 0 138 se0 1500
|
|
192.132.2 129.121.248.1 Up,Gateway 0 6345 se0 1500
|
|
204.134.67 GLORY.NM.ORG Up,Gateway 0 2022 se0 1500
|
|
206.206.67 GLORY.NM.ORG Up,Gateway 0 7778 se0 1500
|
|
206.206.68 LAWRII.NM.ORG Up,Gateway 0 3185 se0 1500
|
|
207.66.5 GLORY.NM.ORG Up,Gateway 0 626 se0 1500
|
|
204.134.69 GLORY.NM.ORG Up,Gateway 0 7990 se0 1500
|
|
207.66.6 GLORY.NM.ORG Up,Gateway 0 53 se0 1500
|
|
204.134.70 LAWRII.NM.ORG Up,Gateway 0 18011 se0 1500
|
|
192.188.135 GLORY.NM.ORG Up,Gateway 0 5 se0 1500
|
|
206.206.71 LAWRII.NM.ORG Up,Gateway 0 2 se0 1500
|
|
204.134.7 GLORY.NM.ORG Up,Gateway 0 38 se0 1500
|
|
199.89.135 GLORY.NM.ORG Up,Gateway 0 99 se0 1500
|
|
198.59.136 LAWRII.NM.ORG Up,Gateway 0 1293 se0 1500
|
|
204.134.9 GLORY.NM.ORG Up,Gateway 0 21 se0 1500
|
|
204.134.73 GLORY.NM.ORG Up,Gateway 0 59794 se0 1500
|
|
129.138.0 GLORY.NM.ORG Up,Gateway 0 5262 se0 1500
|
|
192.92.10 LAWRII.NM.ORG Up,Gateway 0 163 se0 1500
|
|
206.206.75 LAWRII.NM.ORG Up,Gateway 0 604 se0 1500
|
|
207.66.13 GLORY.NM.ORG Up,Gateway 0 1184 se0 1500
|
|
204.134.77 LAWRII.NM.ORG Up,Gateway 0 3649 se0 1500
|
|
207.66.14 GLORY.NM.ORG Up,Gateway 0 334 se0 1500
|
|
204.134.78 GLORY.NM.ORG Up,Gateway 0 239 se0 1500
|
|
204.52.207 GLORY.NM.ORG Up,Gateway 0 293 se0 1500
|
|
204.134.79 GLORY.NM.ORG Up,Gateway 0 1294 se0 1500
|
|
192.160.144 LAWRII.NM.ORG Up,Gateway 0 117 se0 1500
|
|
206.206.80 PENNY.NM.ORG Up,Gateway 0 4663 se0 1500
|
|
204.134.80 GLORY.NM.ORG Up,Gateway 0 91 se0 1500
|
|
198.99.209 LAWRII.NM.ORG Up,Gateway 0 1136 se0 1500
|
|
207.66.17 GLORY.NM.ORG Up,Gateway 0 24173 se0 1500
|
|
204.134.82 GLORY.NM.ORG Up,Gateway 0 29766 se0 1500
|
|
192.41.211 GLORY.NM.ORG Up,Gateway 0 155 se0 1500
|
|
192.189.147 LAWRII.NM.ORG Up,Gateway 0 3133 se0 1500
|
|
204.134.84 PENNY.NM.ORG Up,Gateway 0 189 se0 1500
|
|
204.134.87 LAWRII.NM.ORG Up,Gateway 0 94 se0 1500
|
|
146.88.0 GLORY.NM.ORG Up,Gateway 0 140 se0 1500
|
|
192.84.24 GLORY.NM.ORG Up,Gateway 0 3530 se0 1500
|
|
204.134.88 LAWRII.NM.ORG Up,Gateway 0 136 se0 1500
|
|
198.49.217 GLORY.NM.ORG Up,Gateway 0 303 se0 1500
|
|
192.132.89 GLORY.NM.ORG Up,Gateway 0 3513 se0 1500
|
|
198.176.219 GLORY.NM.ORG Up,Gateway 0 1278 se0 1500
|
|
206.206.92 LAWRII.NM.ORG Up,Gateway 0 1228 se0 1500
|
|
192.234.220 129.121.1.91 Up,Gateway 0 2337 se0 1500
|
|
204.134.92 LAWRII.NM.ORG Up,Gateway 0 13995 se0 1500
|
|
198.59.157 LAWRII.NM.ORG Up,Gateway 0 508 se0 1500
|
|
206.206.93 GLORY.NM.ORG Up,Gateway 0 635 se0 1500
|
|
204.134.93 GLORY.NM.ORG Up,Gateway 0 907 se0 1500
|
|
198.59.158 LAWRII.NM.ORG Up,Gateway 0 14214 se0 1500
|
|
198.59.159 LAWRII.NM.ORG Up,Gateway 0 1806 se0 1500
|
|
204.134.95 PENNY.NM.ORG Up,Gateway 0 3644 se0 1500
|
|
206.206.96 GLORY.NM.ORG Up,Gateway 0 990 se0 1500
|
|
206.206.161 LAWRII.NM.ORG Up,Gateway 0 528 se0 1500
|
|
198.59.97 PENNY.NM.ORG Up,Gateway 0 55 se0 1500
|
|
198.59.161 LAWRII.NM.ORG Up,Gateway 0 497 se0 1500
|
|
192.207.226 GLORY.NM.ORG Up,Gateway 0 93217 se0 1500
|
|
198.59.99 PENNY.NM.ORG Up,Gateway 0 2 se0 1500
|
|
198.59.163 GLORY.NM.ORG Up,Gateway 0 3379 se0 1500
|
|
192.133.100 LAWRII.NM.ORG Up,Gateway 0 3649 se0 1500
|
|
204.134.100 GLORY.NM.ORG Up,Gateway 0 8 se0 1500
|
|
128.165.0 PENNY.NM.ORG Up,Gateway 0 15851 se0 1500
|
|
198.59.165 GLORY.NM.ORG Up,Gateway 0 274 se0 1500
|
|
206.206.165 LAWRII.NM.ORG Up,Gateway 0 167 se0 1500
|
|
206.206.102 GLORY.NM.ORG Up,Gateway 0 5316 se0 1500
|
|
160.230.0 LAWRII.NM.ORG Up,Gateway 0 19408 se0 1500
|
|
206.206.166 LAWRII.NM.ORG Up,Gateway 0 1756 se0 1500
|
|
205.166.231 GLORY.NM.ORG Up,Gateway 0 324 se0 1500
|
|
198.59.167 GLORY.NM.ORG Up,Gateway 0 1568 se0 1500
|
|
206.206.103 GLORY.NM.ORG Up,Gateway 0 3629 se0 1500
|
|
198.59.168 GLORY.NM.ORG Up,Gateway 0 9063 se0 1500
|
|
206.206.104 GLORY.NM.ORG Up,Gateway 0 7333 se0 1500
|
|
206.206.168 GLORY.NM.ORG Up,Gateway 0 234 se0 1500
|
|
204.134.105 LAWRII.NM.ORG Up,Gateway 0 4826 se0 1500
|
|
206.206.105 LAWRII.NM.ORG Up,Gateway 0 422 se0 1500
|
|
204.134.41 LAWRII.NM.ORG Up,Gateway 0 41782 se0 1500
|
|
206.206.169 GLORY.NM.ORG Up,Gateway 0 5101 se0 1500
|
|
204.134.42 GLORY.NM.ORG Up,Gateway 0 10761 se0 1500
|
|
206.206.170 GLORY.NM.ORG Up,Gateway 0 916 se0 1500
|
|
198.49.44 GLORY.NM.ORG Up,Gateway 0 3 se0 1500
|
|
198.59.108 GLORY.NM.ORG Up,Gateway 0 2129 se0 1500
|
|
204.29.236 GLORY.NM.ORG Up,Gateway 0 125 se0 1500
|
|
206.206.172 GLORY.NM.ORG Up,Gateway 0 5839 se0 1500
|
|
204.134.108 GLORY.NM.ORG Up,Gateway 0 3216 se0 1500
|
|
206.206.173 GLORY.NM.ORG Up,Gateway 0 374 se0 1500
|
|
198.175.173 LAWRII.NM.ORG Up,Gateway 0 6227 se0 1500
|
|
198.59.110 GLORY.NM.ORG Up,Gateway 0 1797 se0 1500
|
|
198.51.238 GLORY.NM.ORG Up,Gateway 0 1356 se0 1500
|
|
192.136.110 GLORY.NM.ORG Up,Gateway 0 583 se0 1500
|
|
204.134.48 GLORY.NM.ORG Up,Gateway 0 42 se0 1500
|
|
198.175.176 LAWRII.NM.ORG Up,Gateway 0 32 se0 1500
|
|
206.206.114 LAWRII.NM.ORG Up,Gateway 0 44 se0 1500
|
|
206.206.179 LAWRII.NM.ORG Up,Gateway 0 14 se0 1500
|
|
198.59.179 PENNY.NM.ORG Up,Gateway 0 222 se0 1500
|
|
198.59.115 GLORY.NM.ORG Up,Gateway 1 132886 se0 1500
|
|
206.206.181 GLORY.NM.ORG Up,Gateway 0 1354 se0 1500
|
|
206.206.182 SIENNA.NM.ORG Up,Gateway 0 16 se0 1500
|
|
206.206.118 GLORY.NM.ORG Up,Gateway 0 3423 se0 1500
|
|
206.206.119 GLORY.NM.ORG Up,Gateway 0 282 se0 1500
|
|
206.206.183 SIENNA.NM.ORG Up,Gateway 0 2473 se0 1500
|
|
143.120.0 LAWRII.NM.ORG Up,Gateway 0 123533 se0 1500
|
|
206.206.184 GLORY.NM.ORG Up,Gateway 0 1114 se0 1500
|
|
205.167.120 GLORY.NM.ORG Up,Gateway 0 4202 se0 1500
|
|
206.206.121 GLORY.NM.ORG Up,Gateway 1 71 se0 1500
|
|
129.121.0 GRANDE.NM.ORG Up 12 21658599 se0 1500
|
|
204.134.122 GLORY.NM.ORG Up,Gateway 0 195 se0 1500
|
|
204.134.58 GLORY.NM.ORG Up,Gateway 0 7707 se0 1500
|
|
128.123.0 GLORY.NM.ORG Up,Gateway 0 34416 se0 1500
|
|
204.134.59 GLORY.NM.ORG Up,Gateway 0 1007 se0 1500
|
|
204.134.124 GLORY.NM.ORG Up,Gateway 0 37160 se0 1500
|
|
206.206.124 LAWRII.NM.ORG Up,Gateway 0 79 se0 1500
|
|
206.206.125 PENNY.NM.ORG Up,Gateway 0 233359 se0 1500
|
|
204.134.126 GLORY.NM.ORG Up,Gateway 0 497 se0 1500
|
|
206.206.126 LAWRII.NM.ORG Up,Gateway 0 13644 se0 1500
|
|
204.69.190 GLORY.NM.ORG Up,Gateway 0 4059 se0 1500
|
|
206.206.190 GLORY.NM.ORG Up,Gateway 0 1630 se0 1500
|
|
204.134.127 GLORY.NM.ORG Up,Gateway 0 45621 se0 1500
|
|
206.206.191 GLORY.NM.ORG Up,Gateway 0 3574 se0 1500
|
|
|
|
MultiNet IPX Routing tables:
|
|
Destination Gateway Flags Refcnt Use Interface MTU
|
|
---------- ---------- ----- ------ ----- --------- ----
|
|
|
|
MultiNet ARP table:
|
|
Host Network Address Ethernet Address Arp Flags
|
|
-------------------------------------------- ---------------- ---------
|
|
GLORY.NM.ORG (IP 129.121.1.4) AA:00:04:00:61:D0 Temporary
|
|
[UNKNOWN] (IP 129.121.251.1) 00:C0:05:01:2C:D2 Temporary
|
|
NARANJO.NM.ORG (IP 129.121.1.56) 08:00:87:04:9F:42 Temporary
|
|
CHAMA.NM.ORG (IP 129.121.1.8) AA:00:04:00:0C:D0 Temporary
|
|
[UNKNOWN] (IP 129.121.251.5) AA:00:04:00:D2:D0 Temporary
|
|
LAWRII.NM.ORG (IP 129.121.254.10) AA:00:04:00:5C:D0 Temporary
|
|
[UNKNOWN] (IP 129.121.1.91) 00:C0:05:01:2C:D2 Temporary
|
|
BRAVO.NM.ORG (IP 129.121.1.6) AA:00:04:00:0B:D0 Temporary
|
|
PENNY.NM.ORG (IP 129.121.1.10) AA:00:04:00:5F:D0 Temporary
|
|
ARRIBA.NM.ORG (IP 129.121.1.14) 08:00:2B:BC:C1:A7 Temporary
|
|
AZUL.NM.ORG (IP 129.121.1.51) 08:00:87:00:A1:D3 Temporary
|
|
ENSS365.NM.ORG (IP 129.121.1.3) 00:00:0C:51:EF:58 Temporary
|
|
AVATAR.NM.ORG (IP 129.121.254.1) 08:00:5A:1D:52:0D Temporary
|
|
[UNKNOWN] (IP 129.121.253.2) 08:00:5A:47:4A:1D Temporary
|
|
[UNKNOWN] (IP 129.121.254.5) 00:C0:7B:5F:5F:80 Temporary
|
|
CONCHAS.NM.ORG (IP 129.121.1.11) 08:00:5A:47:4A:1D Temporary
|
|
[UNKNOWN] (IP 129.121.253.10) AA:00:04:00:4B:D0 Temporary
|
|
|
|
|
|
MultiNet Network Interface statistics:
|
|
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Collis
|
|
---- --- ------- -------------- ----- ----- ----- ----- ------
|
|
se0 1500 129.121.0 GRANDE.NM.ORG 68422948 0 53492833 1 0
|
|
lo0 4136 127.0.0 127.0.0.1 1188191 0 1188191 0 0
|
|
|
|
MultiNet Protocol statistics:
|
|
65264173 IP packets received
|
|
22 IP packets smaller than minimum size
|
|
6928 IP fragments received
|
|
4 IP fragments timed out
|
|
34 IP received for unreachable destinations
|
|
704140 ICMP error packets generated
|
|
9667 ICMP opcodes out of range
|
|
4170 Bad ICMP packet checksums
|
|
734363 ICMP responses
|
|
734363 ICMP "Echo" packets received
|
|
734363 ICMP "Echo Reply" packets sent
|
|
18339 ICMP "Echo Reply" packets received
|
|
704140 ICMP "Destination Unreachable" packets sent
|
|
451243 ICMP "Destination Unreachable" packets received
|
|
1488 ICMP "Source Quench" packets received
|
|
163911 ICMP "ReDirect" packets received
|
|
189732 ICMP "Time Exceeded" packets received
|
|
126966 TCP connections initiated
|
|
233998 TCP connections established
|
|
132611 TCP connections accepted
|
|
67972 TCP connections dropped
|
|
28182 embryonic TCP connections dropped
|
|
269399 TCP connections closed
|
|
10711838 TCP segments timed for RTT
|
|
10505140 TCP segments updated RTT
|
|
3927264 TCP delayed ACKs sent
|
|
666 TCP connections dropped due to retransmit timeouts
|
|
111040 TCP retransmit timeouts
|
|
3136 TCP persist timeouts
|
|
9 TCP persist connection drops
|
|
16850 TCP keepalive timeouts
|
|
1195 TCP keepalive probes sent
|
|
14392 TCP connections dropped due to keepalive timeouts
|
|
28842663 TCP packets sent
|
|
12714484 TCP data packets sent
|
|
1206060086 TCP data bytes sent
|
|
58321 TCP data packets retransmitted
|
|
22144036 TCP data bytes retransmitted
|
|
6802199 TCP ACK-only packets sent
|
|
1502 TCP window probes sent
|
|
483 TCP URG-only packets sent
|
|
8906175 TCP Window-Update-only packets sent
|
|
359509 TCP control packets sent
|
|
38675084 TCP packets received
|
|
28399363 TCP packets received in sequence
|
|
1929418386 TCP bytes received in sequence
|
|
25207 TCP packets with checksum errors
|
|
273374 TCP packets were duplicates
|
|
230525708 TCP bytes were duplicates
|
|
3748 TCP packets had some duplicate bytes
|
|
493214 TCP bytes were partial duplicates
|
|
2317156 TCP packets were out of order
|
|
3151204672 TCP bytes were out of order
|
|
1915 TCP packets had data after window
|
|
865443 TCP bytes were after window
|
|
5804 TCP packets for already closed connection
|
|
941 TCP packets were window probes
|
|
10847459 TCP packets had ACKs
|
|
222657 TCP packets had duplicate ACKs
|
|
1 TCP packet ACKed unsent data
|
|
1200274739 TCP bytes ACKed
|
|
141545 TCP packets had window updates
|
|
13 TCP segments dropped due to PAWS
|
|
4658158 TCP segments were predicted pure-ACKs
|
|
24033756 TCP segments were predicted pure-data
|
|
8087980 TCP PCB cache misses
|
|
305 Bad UDP header checksums
|
|
17 Bad UDP data length fields
|
|
23772272 UDP PCB cache misses
|
|
|
|
MultiNet Buffer Statistics:
|
|
388 out of 608 buffers in use:
|
|
30 buffers allocated to Data.
|
|
10 buffers allocated to Packet Headers.
|
|
66 buffers allocated to Socket Structures.
|
|
57 buffers allocated to Protocol Control Blocks.
|
|
163 buffers allocated to Routing Table Entries.
|
|
2 buffers allocated to Socket Names and Addresses.
|
|
48 buffers allocated to Kernel Fork-Processes.
|
|
2 buffers allocated to Interface Addresses.
|
|
1 buffer allocated to Multicast Addresses.
|
|
1 buffer allocated to Timeout Callbacks.
|
|
6 buffers allocated to Memory Management.
|
|
2 buffers allocated to Network TTY Control Blocks.
|
|
11 out of 43 page clusters in use.
|
|
11 CXBs borrowed from VMS device drivers
|
|
2 CXBs waiting to return to the VMS device drivers
|
|
162 Kbytes allocated to MultiNet buffers (44% in use).
|
|
226 Kbytes of allocated buffer address space (0% of maximum).
|
|
Connection closed by foreign host.
|
|
<slug> [68] ->
|
|
|
|
Whoa! What was all that?
|
|
|
|
What we did was telnet to port 15 -- the netstat (network statistics)
|
|
port-- which on some computers runs a daemon that tells anybody who cares
|
|
to drop in just about everything about the connections made by all the
|
|
computers linked to the Internet through this computer.
|
|
|
|
So from this we learned two things:
|
|
|
|
1) Grande.nm.org is a very busy and important computer.
|
|
|
|
2) Even a very busy and important computer can let the random port surfer
|
|
come and play.
|
|
|
|
So my lady friend wanted to try out another port. I suggested the finger
|
|
port, number 79. So she gave the command:
|
|
|
|
<slug> [68] ->telnet grande.nm.org 79
|
|
Trying 129.121.1.2 ...
|
|
Connected to grande.nm.org.
|
|
Escape character is '^]'.
|
|
finger
|
|
?Sorry, could not find "FINGER"
|
|
Connection closed by foreign host.
|
|
<slug> [69] ->telnet grande.nm.org 79
|
|
Trying 129.121.1.2 ...
|
|
Connected to grande.nm.org.
|
|
Escape character is '^]'.
|
|
help
|
|
?Sorry, could not find "HELP"
|
|
Connection closed by foreign host.
|
|
<slug> [69] ->telnet grande.nm.org 79
|
|
Trying 129.121.1.2 ...
|
|
Connected to grande.nm.org.
|
|
Escape character is '^]'.
|
|
?
|
|
?Sorry, could not find "?"
|
|
Connection closed by foreign host.
|
|
<slug> [69] ->telnet grande.nm.org 79
|
|
Trying 129.121.1.2 ...
|
|
Connected to grande.nm.org.
|
|
Escape character is '^]'.
|
|
man
|
|
?Sorry, could not find "MAN"
|
|
Connection closed by foreign host.
|
|
<slug> [69] ->
|
|
|
|
At first this looks like just a bunch of failed commands. But actually this
|
|
is pretty fascinating. The reason is that port 79 is, under IETF rules,
|
|
supposed to run fingerd, the finger daemon. So when she gave the command
|
|
"finger" and grande.nm.org said ?Sorry, could not find "FINGER," we knew
|
|
this port was not following IETF rules.
|
|
|
|
Now on may computers they don't run the finger daemon at all. This is
|
|
because finger has so properties that can be used to gain total control of
|
|
the computer that runs it.
|
|
|
|
But if finger is shut down, and nothing else is running on port 79, we
|
|
should get the answer:
|
|
|
|
telnet: connect: Connection refused.
|
|
|
|
But instead we got connected and grande.nm.org was waiting for a command.
|
|
|
|
Now the normal thing a port surfer does when running an unfamiliar daemon
|
|
is to coax it into revealing what commands it uses. "Help," "?" and "man"
|
|
often work. But these didn't help us.
|
|
|
|
But even though these commands didn't help us, they did tell us that the
|
|
daemon is probably something sensitive. If it were a daemon that was meant
|
|
for anybody and his brother to use, it would have given us instructions.
|
|
|
|
So what did we do next? We decided to be good Internet citizens and also
|
|
stay out of jail. We decided we'd beter log off.
|
|
|
|
But there was one hack we decided to do first: leave our mark on the shell
|
|
log file.
|
|
|
|
The shell log file keeps a record of all operating system commands made on a
|
|
computer. The administrator of an obviously important computer such as
|
|
grande.nm.org is probably competent enough to scan the records of what
|
|
commands are given by whom to his computer. Especially on a port important
|
|
enough to be running a mystery, non-IETF daemon. So everything we typed
|
|
while connected was probably saved on a log.
|
|
|
|
So my friend giggled and left a few messages on port 79 before logging
|
|
off. Oh, dear, I do believe she's hooked on hacking. What a good way to
|
|
meet cute sysadmins...
|
|
|
|
So, port surf's up! If you want to surf, here's the basics:
|
|
|
|
1) Get logged onto a shell account. That's an account with your ISP that
|
|
lets you give Unix commands. Or -- run Linux or some other kind of Unix on
|
|
your PC and hook up to the Internet.
|
|
|
|
2) Give the command "telnet <hostname> <port number>" where <hostname> is the
|
|
internet address of the computer you wnat to visit and <port number> is
|
|
whatever looks phun to you.
|
|
|
|
3) If you get the response "connected to <hostname>," then surf's up!
|
|
|
|
Following are some of my favorite ports. It is legal and harmless to pay
|
|
them visits so long as you don't figure out how to gain superuser status
|
|
while playing with them. However, please note that if you do too much port
|
|
surfing from your shell account, your sysadmin may notice this in his or her
|
|
shell log file. Or, the sysadfmin of your target computer may report you
|
|
to your sysadmin. Yau will be identifieable by the headers on the packets
|
|
carrying your commands to the target computer. Then if your sysadmin is
|
|
kicked off your ISP. So you may want to explain in advance that you are
|
|
merely a harmless hacker looking to have a good time, er, um, learn about
|
|
Unix. Yeh, that sounds good...
|
|
|
|
Port number Service Why it's phun!
|
|
|
|
7 echo Whatever you type in, the host repeats back to you
|
|
|
|
9 discard Dev/null -- how fast can you figure out this one?
|
|
|
|
11 systat Lots of info on users
|
|
|
|
13 daytime Time and date at computer's location
|
|
|
|
15 netstat Tremendous info on networks
|
|
|
|
19 chargen Pours out a stream of ASCII characters. Use ^C to stop.
|
|
|
|
21 ftp Transfers files
|
|
|
|
23 telnet Where you log in.
|
|
|
|
25 smpt Forge email from Bill.Gates@Microsoft.org.
|
|
|
|
37 time Time
|
|
|
|
39 rlp Resource location
|
|
|
|
43 whois Info on hosts and networks
|
|
|
|
53 domain Nameserver
|
|
|
|
70 gopher Out-of-date info hunter
|
|
|
|
79 finger Lots of info on users
|
|
|
|
80 http Web server
|
|
|
|
110 pop Incoming email
|
|
|
|
119 nntp Usenet news groups -- forge posts, cancels
|
|
|
|
443 shttp Another web server
|
|
|
|
512 biff Mail notification
|
|
|
|
513 rlogin Remote login
|
|
who Remote who and uptime
|
|
|
|
514 shell Remote command, no password used!
|
|
syslog Remote system logging
|
|
|
|
520 route Routing information protocol
|
|
|
|
**************************
|
|
Propeller head tip: Note that in most cases an Internet host will use these
|
|
port number assignments for these services. More than one service may also
|
|
be assigned simultaneously to the same port. This numbering system is
|
|
voluntarily offered by the Internet Engineering Task Force (IETF). That
|
|
means that an Internet host may use other ports for these services. Expect
|
|
the unexpected!
|
|
|
|
If you have a copy of Linux, you can get the list of all the IETF
|
|
assignments of port numbers in the file /etc/services.
|
|
***************************
|
|
_________________________________________________________
|
|
Want to see back issues of Guide to (mostly) Harmless Hacking? See
|
|
http://www.feist.com/~tqdb/evis-unv.html. Want to subscribe to this list?
|
|
Email majordomo@edm.net with the message "subscribe happyhacker." Want to
|
|
share some kewl stuph with the Happy Hacker list? Send your messages to
|
|
hh@edm.net. To send me confidential email (please, no discussions of
|
|
illegal activities) use cmeinel@techbroker.com. Please direct flames to
|
|
dev/null@techbroker.com. Happy hacking!
|
|
|
|
Copyright 1996 Carolyn P. Meinel. You may forward the GUIDE TO (mostly)
|
|
HARMLESS HACKING as long as you leave this notice at the end..
|
|
________________________________________________________
|
|
|
|
|
|
|
|
--------------------------------------------------------------------
|
|
This message is from the HappyHacker mailing list. To unsubscribe,
|
|
send mail to |