165 lines
9.0 KiB
Plaintext
165 lines
9.0 KiB
Plaintext
The Novell Network Hacking Guide
|
||
|
||
By
|
||
|
||
PeRSeUs/LoRd psYChobeTa of EmC
|
||
|
||
|
||
|
||
Hey what'z up ?!? When my computer science teacher put up *his* new toy in
|
||
our class, novell network 3.x, i knew that i would hack this baby sooner
|
||
or later... since u can find novell networkz and LANs more and more often
|
||
out there I decided to write this guide... it might help u sometime e.g.
|
||
if u go to college or in your office... this guide is about the basic things
|
||
u can do in a novell network... i also added the best programs that i could
|
||
find and my SPY program..
|
||
|
||
1.LOGIN
|
||
|
||
First u turn on the computer and u see the computer booting up
|
||
(usually it boots with some kind of net-bios that is on the net work
|
||
cards in the ROM or so)... then u see, e.g. in our network, this big IBM
|
||
screen and then u are supposed to press <enter> and input your name and
|
||
sometymes password... first of all
|
||
check out these standard IDs for novell networks 3.x for passwords:
|
||
|
||
Id PassWord
|
||
------- ----------
|
||
Admin 'School Name', none or private
|
||
Sysop 'School Name', none or private
|
||
SuperVisor 'School Name', none or private
|
||
OfficeAdmin 'School Name', none or private
|
||
Guest none or private
|
||
|
||
If you are really lucky then one of the sysop/supervisor accounts doesn't
|
||
have a password and u can mess with the net. BUT that will be quite unreal-
|
||
istic.. whatever.. give it a try.. so if u can login either with one of those
|
||
IDs or with your own you get to the next screen, the main menu...
|
||
|
||
2.Main Menu (and how to get to dos)
|
||
|
||
If you are in here you will usually only find some boring crap like works
|
||
or word 5.5 or some shit... what we want to do is get out of here and drop
|
||
to dos so we can use some of our nice programs.. but u probably won't find
|
||
a normal way to get to dos.. try some of this stuf.: if u see "Access A:"
|
||
near the bottom of the menu or as one of the menu choices and try to use it
|
||
but with no disk in the drive... u will
|
||
get an error message.. if u press abort it won't help u here and u are back
|
||
in the menu... instead of that press something like ctrl-c, ctrl-brk OR --
|
||
a less well-known combo -- pressing ctrl-2... yeahh it really works..
|
||
but after we used that method too many times my teacher disabled the whole
|
||
"Access A:" menu choice so we were phucked.. but there are still other ways :)
|
||
first of all hold ALT and press E, S, C one key at a time... that is the
|
||
normal way for novell technicians to get into dos... if that doesn't work
|
||
press ctrl-x (sometimes you have to do it from the main menu).... that works
|
||
pretty often too... well but when the sysop finds
|
||
out about all that he can even disable that if he's determined enuff (like my
|
||
Mr. Li'l Adolf :-P... in this case i know only of one last way and that he
|
||
can't disable (unless he's not dumb)... haha.. ok.. use any texteditor like the turbo pascal editor
|
||
or word for windows.. then check all drives (a: - z:) until u find a ram
|
||
drive .. here u find a batch file (g.bat) for yur personal main menu and since
|
||
it's the ram drive of ur computer u can even change it..u just add one line
|
||
in the menu prompts that looks like this:
|
||
|
||
z: lemme to DOS !!!^C:\
|
||
|
||
if u get out of the word processor to the menu u will see ur new option and
|
||
it will drop you to dos in drive c:\ .. another very easy thing is this...
|
||
u just run an application like turbo pascal 7.0 or so on ur computer and
|
||
shell to dos... well unfortunately our crappy school could only afford
|
||
turbo pascal 3.0... :(
|
||
|
||
3.Important commands in DOS
|
||
|
||
ok now u are in dos and want to find out about the network... go into all
|
||
possible directories and look around... try to find a program just
|
||
called help.exe... it is a novell network reference with all kinds of
|
||
information on every dos command and so on... anyways.. here are the most
|
||
important commands that u will use: if u type RIGHTS u will see a
|
||
number of attribute rights that tells u what u can do in the specified/
|
||
current directory... usually that will be only [ F R ] or so and means
|
||
u can file-scan (or type dir:) and can only read files... yeahh that sux..
|
||
the next important thing is GRANT and with that u can grant urself or any-
|
||
body access to a directory if u have the A attribute in that dir. With
|
||
REVOKE u can remove the rights from some lusers :-).. with TLIST u can
|
||
find out who else has rights to a certain directory or so (VERY
|
||
IMPORTANT WITH HACK.EXE LATER ON)... then use USERLIST to see who's logged
|
||
in.. and SEND to send anybody messages.. in my class some stupid kids were
|
||
sending messages all the time and annoyed me like shit.. well in this case
|
||
just type CASTOFF and u won't receive no more messages... there are lot of
|
||
other interesting commands that i forgot rite now but these listed here
|
||
are the most important ones...
|
||
|
||
4.Novell Network Hackers
|
||
To get sysop access i tried almost every possible thing and I got it a couple
|
||
of times that's the reason why i am gettin' an F this year in computer
|
||
science.. there are some real nice programs out there that I put together
|
||
with this doc so u can use 'em too...
|
||
Hack.exe Hack exe fools the file-server, but it requires that a
|
||
SuperVisor (*not the sysop*) is logged on... if he is then
|
||
just start the program and the file-server thinks u are sysop
|
||
and u have all rights (granting time!! :)... i did this but
|
||
my computer science teacher used tlist.exe to find out that
|
||
i had access to *his* directories, so he just deleted my
|
||
account... don't grant access to those kind of dirs..
|
||
View.exe Use that to see if the supervisor is logged on
|
||
Netcrack.exe This program simply checks all possible passwords for a given
|
||
ID. that means it can take 30 hrs. to find a [long] password...
|
||
but i just included it .. who knows..
|
||
Knock.exe This program is the patched ATTACH command... the ATTACH com-
|
||
mand lets u change from one ID to another one... but here
|
||
u don't have to input the password..:-)..unfortunately it
|
||
isn't compatible with all netbios versions or so and it just
|
||
froze the computer in my school's network...
|
||
|
||
!*!*!*! THERE ARE SECURITY PATCHES FOR ALL THOSE PROGRAMS BY NOVELL !*!*!*!
|
||
|
||
5. SPY/SPY_VIEW
|
||
This one was my last hope... i coded it myself in a mixture of asm/tp...
|
||
it's a tsr program that captures all keys to ram... well u might thinks that's
|
||
lame cuz u have seen tools like SPY all over.. no way.. yeah way.. the reason
|
||
is that the usualy key capture programs change either interrupt 09h/21h/16h to
|
||
get the key value... that's what i tried first but it doesn't work... during
|
||
the login process novell network uses its own keyboard routines or they just
|
||
restore those interrupts mentioned earlier but u fucking can't capture keys..
|
||
hmm.. i thought to myself there got to be some damn way... well i finally had
|
||
the idea while sh***ing on the toilet... instead of using those interrupts
|
||
i finally used timer interrupt 8h and i also used I/O port 60h to read the
|
||
keys... the problem was that the scan codes from port 60h are not ascii format
|
||
so i had to kinda decrypt them with my viewer program... whatsoevr.. just
|
||
run my SPY and enter the segment memory adress.. this should be somewhere at
|
||
the end of conventional memory, e.g. i usually use 9000 and it works fine..
|
||
then it's resident in memory and log out... call ur teacher or any person
|
||
that they show u something on your computer with turbo pascal or so... my
|
||
teacher and i worked on some problems with the net but b4 he logged on i had
|
||
installed SPY... it captured his login name + password... if u use SPY_VIEW
|
||
u will probably find some bs like this:
|
||
|
||
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
||
|
||
SPY Viewer coded by PeRSeUs oF EmC...
|
||
Segmend address: 9000h Number of keys pressed: 101
|
||
9000:0000 LLOGOUTLLOOGINNSSYSOOPHHUUGGOODDIRCLSSPPY???--VVIIEWW ??
|
||
9000:0040 ????????????????????????????. T.TTXT???????????????????????????
|
||
|
||
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
||
|
||
first it might look pretty weird cuz instead of 'LOGOUT' u see 'LLOGOUT'..
|
||
well.. that's one of the disadvantages using timer int. 8h and port 60h...
|
||
but it seems to be the only way and it's better than nuthin' :-)
|
||
ok.. here u see login, sysop and then hugo... here we got his password...
|
||
(even if it's a real dumb one)... the viewer only "translates" letters and
|
||
numbers and a couple of other chars. from raw scan code into ascii... the ?
|
||
indicates that it was some key like shift or f10... also.. where u see the
|
||
dash -- i actually pressed the key+shit (i.e. __) but as i said it can't
|
||
record that... so that's about all i learned/hacked about LANs... if u got
|
||
any ideas or whatever.. please contact me at the MiLLENiUM BbS..EmC USHQ..3o5
|
||
Nup Found on any quality h/p or - Warez Board
|
||
|
||
... cy'around in cyberspace ...
|
||
|
||
|
||
|
||
|
||
|