398 lines
17 KiB
Plaintext
398 lines
17 KiB
Plaintext
|
|
------------------------------------------------------------------------------
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
% %
|
|
% THE NEOPHYTE'S GUIDE TO HACKING %
|
|
% =============================== %
|
|
% 1993 Edition %
|
|
% Completed on 08/28/93 %
|
|
% Modification 1.1 Done on 10/10/93 %
|
|
% Modification 1.2 Done on 10/23/93 %
|
|
% by %
|
|
%% >>>>> Deicide <<<<< %%
|
|
%%% %%%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
|
< The author of this file grants permission to reproduce and >
|
|
< redistribute this file in any way the reader sees fit, >
|
|
< including the inclusion of this file in newsletters of any >
|
|
< media, provided the file is kept whole and complete, >
|
|
< without any modifications, deletions or ommissions. >
|
|
< (c) 1993, Deicide >
|
|
|
|
TABLE OF CONTENTS
|
|
=================
|
|
|
|
1. INTRODUCTION
|
|
|
|
2. ETHICS/SAFETY
|
|
|
|
3. WHERE TO START
|
|
|
|
4. PACKET-SWITCHED NETWORKS
|
|
A. Intro to PSNs
|
|
B. How packet-switching works
|
|
C. The Internet
|
|
1. Introduction
|
|
2. Getting access
|
|
3. FTP
|
|
D. X.25 Networks
|
|
1. NUAs
|
|
2. PADs & NUIs
|
|
3. CUGs
|
|
4. SprintNet
|
|
5. BT Tymnet
|
|
6. Datapac
|
|
7. DNIC List
|
|
|
|
5. SYSTEM PENETRATION
|
|
A. Unix
|
|
B. VMS
|
|
C. MPE (HP3000 mainframes)
|
|
D. VM/CMS
|
|
E. Primos
|
|
F. TOPS 10/20
|
|
G. IRIS
|
|
H. NOS
|
|
I. DECServer
|
|
J. GS/1
|
|
K. XMUX
|
|
L. Starmaster/PACX
|
|
M. Access 2590
|
|
N. PICK
|
|
O. AOS/VS
|
|
P. RSTS
|
|
Q. WindowsNT
|
|
R. Novell Netware
|
|
S. System75/85
|
|
T. AS400
|
|
U. TSO
|
|
|
|
6. BRUTE FORCE
|
|
A. Passwords
|
|
B. Usernames
|
|
C. Services
|
|
|
|
7. SOCIAL ENGINEERING
|
|
|
|
8. TRASHING
|
|
|
|
9. ACRONYMS
|
|
|
|
10. CONCLUSION
|
|
A. Last words
|
|
B. Recommended Reading
|
|
C. BBSes
|
|
D. References
|
|
E. And finally..
|
|
F. Disclaimer
|
|
|
|
|
|
INTRODUCTION:
|
|
============
|
|
------------
|
|
|
|
Over four years ago the final version of the LOD/H's Novice's Guide to
|
|
Hacking was created and distributed, and during the years since it has
|
|
served
|
|
as a much needed source of knowledge for the many hackers just beginning to
|
|
explore the wonders of system penetration and exploration.
|
|
The guide was much needed by the throng of newbies who hadn't the
|
|
slightest clue what a VAX was, but were eager to learn the arcane art of
|
|
hacking. Many of today's greats and moderates alike relied the guide as a
|
|
valuable reference during their tentative(or not) steps into the nets.
|
|
However, time has taken it's toll on the silicon networks and the guide
|
|
is
|
|
now a tad out of date. The basic manufacturer defaults are now usually
|
|
secured
|
|
, and more operating systems have come on the scene to take a large chunk of
|
|
the OS percentile. In over four years not one good attempt at a sequel has
|
|
been made, for reasons unbeknownst to me.
|
|
So, I decided to take it upon myself to create my own guide to hacking..
|
|
the "Neophyte's Guide to Hacking" (hey..no laughing!) in the hopes that it
|
|
might help others in furthering their explorations of the nets.
|
|
This guide is modelled after the original, mainly due to the fact that
|
|
the
|
|
original *was* good. New sections have been added, and old sections expanded
|
|
upon. However, this is in no means just an update, it is an entirely new
|
|
guide
|
|
as you'll see by the difference in size. This guide turned out to be over 4
|
|
times the size of The Mentor's guide.
|
|
Also, this guide is NOT an actual "sequel" to the original; it is not
|
|
LOD/H sponsored or authorized or whatever, mainly because the LOD/H is now
|
|
extinct.
|
|
One last thing.. this guide is in no way complete. There are many OS's I
|
|
did not include, the main reasons being their rarity or my non-expertise
|
|
with
|
|
them. All the major OS's are covered, but in future releases I wish to
|
|
include
|
|
Wang, MVS, CICS, SimVTAM, Qinter, IMS, VOS, and many more. If you
|
|
feel you could help, contact me by Internet email or on a board or net(if
|
|
you
|
|
can find me). Same thing applies for further expansion of current topics and
|
|
operating systems, please contact me.
|
|
Ok, a rather long intro, but fuck it.. enjoy as you wish..
|
|
Deicide - deicide@west.darkside.com
|
|
|
|
ETHICS/SAFETY:
|
|
=============
|
|
-------------
|
|
|
|
One of the most integral parts of a hacker's mindset is his set of
|
|
ethics.
|
|
And ethics frequently go hand in hand with safety, which is obviously the
|
|
most
|
|
critical part of the process of hacking and the system exploration, if you
|
|
plan to spend your life outside of the gaol.
|
|
A hacker's ethics are generally somewhat different from that of an
|
|
average
|
|
joe. An average joe would be taught that it is bad to break laws, even
|
|
though
|
|
most do anyways. I am encouraging you to break laws, but in the quest for
|
|
knowledge. In my mind, if hacking is done with the right intentions it is
|
|
not
|
|
all that criminal. The media likes to make us out to be psychotic sociopaths
|
|
bent on causing armageddon with our PCs. Not likely. I could probably turn
|
|
the
|
|
tables on the fearmongering media by showing that the average joe who cheats
|
|
on his taxes is harming the system more than a curious interloper, but I
|
|
refrain.. let them wallow..
|
|
The one thing a hacker must never do is maliciously hack(also known
|
|
as crash, trash, etc..) a system. Deleting and modifying files unnecessary
|
|
is
|
|
BAD. It serves no purpose but to send the sysadmins on a warhunt for your
|
|
head
|
|
, and to take away your account. Lame. Don't do it.
|
|
Anyways, if you don't understand all of these, just do your best to
|
|
follow
|
|
them, and take my word for it. You'll understand the reasoning behind these
|
|
guidelines later.
|
|
|
|
I. Don't ever maliciously hack a system. Do not delete or modify files
|
|
unnecessarily, or intentionally slow down or crash a system.
|
|
The lone exception to this rule is the modification of system logs and
|
|
audit trails to hide your tracks.
|
|
|
|
II. Don't give your name or real phone number to ANYONE, it doesn't matter
|
|
who they are. Some of the most famous phreaks have turned narcs
|
|
because
|
|
they've been busted, and they will turn you in if you give them a
|
|
chance. It's been said that one out of every three hackers is a fed,
|
|
and
|
|
while this is an exaggeration, use this as a rule and you should do
|
|
fine. Meet them on a loop, alliance, bbs, chat system, whatever, just
|
|
don't give out your voice number.
|
|
|
|
III. Stay away from government computers. You will find out very fast that
|
|
attempting to hack a MilTac installation is next to impossible, and
|
|
will
|
|
get you arrested before you can say "oh shit". Big Brother has
|
|
infinite
|
|
resources to draw on, and has all the time it needs to hunt you down.
|
|
They will spend literally years tracking you down. As tempting as it
|
|
may
|
|
be, don't rush into it, you'll regret it in the end.
|
|
|
|
IV. Don't use codes from your own home, ever! Period. This is the most
|
|
incredibly lame thing i've seen throughout my life in the
|
|
'underground';
|
|
incredible abuse of codes, which has been the downfall of so many
|
|
people.
|
|
Most PBX/950/800s have ANI, and using them will eventually get you
|
|
busted, without question. And calling cards are an even worse idea.
|
|
Codes are a form of pseudo-phreaking which have nothing to do with the
|
|
exploration of the telephone networks, which is what phreaking is
|
|
about.
|
|
If you are too lazy to field phreak or be inventive, then forget about
|
|
phreaking.
|
|
|
|
V. Don't incriminate others, no matter how bad you hate them. Turning in
|
|
people over a dispute is a terrible way to solve things; kick their
|
|
ass,
|
|
shut off their phones/power/water, whatever, just don't bust them.
|
|
It will come back to you in the end..
|
|
|
|
VI. Watch what you post. Don't post accounts or codes over open nets as a
|
|
rule. They will die within days, and you will lose your new treasure.
|
|
And the posting of credit card numbers is indeed a criminal offense
|
|
under a law passed in the Reagan years.
|
|
|
|
VII. Don't card items. This is actually a worse idea than using codes, the
|
|
chances of getting busted are very high.
|
|
|
|
VIII. If for some reason you have to use codes, use your own, and nothing
|
|
else. Never use a code you see on a board, because chances are it has
|
|
been abused beyond belief and it is already being monitored.
|
|
|
|
IX. Feel free to ask questions, but keep them within reason. People won't
|
|
always be willing to hand out rare accounts, and if this is the case
|
|
don't be surprised. Keep the questions technical as a rule. Try and
|
|
learn as much as you can from pure hands on experience
|
|
|
|
X. And finally, be somewhat paranoid. Use PGP to encrypt your files, keep
|
|
your notes/printouts stored secretly, whatever you can do to prolong
|
|
your stay in the h/p world.
|
|
|
|
XI. If you get busted, don't tell the authorities ANYTHING. Refuse to
|
|
speak
|
|
to them without a lawyer present.
|
|
|
|
XII. If police arrive at your residence to serve a search warrant, look it
|
|
over carefully, it is your right. Know what they can and can't do, and
|
|
if they can't do something, make sure they don't.
|
|
|
|
XIII. If at all possible, try not to hack off your own phoneline. Splice
|
|
your
|
|
neighbour's line, call from a Fortress Fone, phreak off a junction
|
|
box,
|
|
whatever.. if you hack long enough, chances are one day you'll be
|
|
traced or ANI'd.
|
|
Don't believe you are entirely safe on packet-switched networks
|
|
either,
|
|
it takes a while but if you scan/hack off your local access point they
|
|
will put a trace on it.
|
|
|
|
XIV. Make the tracking of yourself as difficult as possible for others.
|
|
Bounce the call off several outdials, or try to go through at least
|
|
two
|
|
different telco companies when making a call to a dialup.
|
|
When on a packet-switched network or a local or wide area network,
|
|
try and bounce the call off various pads or through other networks
|
|
before you reach your destination. The more bounces, the more red tape
|
|
for the investigator and the easier it is for you to make a clean
|
|
getaway.
|
|
Try not to stay on any system for *too* long, and alternate your
|
|
calling
|
|
times and dates.
|
|
|
|
XV. Do not keep written notes! Keep all information on computer, encrypted
|
|
with PGP or another military-standard encryption program.
|
|
Written notes will only serve to incriminate you in a court of law.
|
|
If you write something down originally, shred the paper.. itty bitty
|
|
pieces is best, or even better, burn it! Feds DO trash, just like us,
|
|
and throwing out your notes complete will land in their hands, and
|
|
they'll use it against you.
|
|
|
|
XVI. Finally, the day/night calling controversy. Some folks think it is a
|
|
better idea to call during the day(or whenever the user would normally
|
|
use his account) as to not arouse the sysadmin's suspicion of abnormal
|
|
calling times, while others think it is better to call when nobody is
|
|
around.
|
|
This is a tough one, as there is no real answer. If the sysadmin keeps
|
|
logs(and reads over them) he will definetly think it strange that a
|
|
secretary calls in at 3 am.. he will probably then look closer and
|
|
find
|
|
it even stranger that the secretary then grabbed the password file and
|
|
proceeded to set him/herself up with a root shell.
|
|
On the other hand, if you call during the time the user would normally
|
|
call, the real owner of the account may very well log in to see his
|
|
name already there, or even worse be denied access because his account
|
|
is already in use.
|
|
In the end, it is down to your opinion.
|
|
And remember, when you make a decision stick to it; remember the time
|
|
zone changes.
|
|
|
|
WHERE TO START
|
|
==============
|
|
--------------
|
|
|
|
Probably the hardest period in hacking is that of when you are first
|
|
starting. Finding and penetrating your first system is a major step, and can
|
|
be approached in many ways. The common ways to find a system to hack are;
|
|
|
|
- UNIVERSITIES : Universities commonly have hundreds of users, many
|
|
of
|
|
which aren't too computer literate, which makes
|
|
hacking a relatively simple chore. And security is
|
|
often poor, so if you don't abuse the system too
|
|
much
|
|
your stay could be a long one.
|
|
On the other hand, for a nominal fee you can usually
|
|
pick up a cheap *legitimate* (now there's a concept)
|
|
account. Or you could enroll in the university for
|
|
a few credits, and just go until the accounts are
|
|
handed out. Unfortunely, if you are caught hacking
|
|
off your own account it won't be hard to trace it
|
|
back to you. If you get a legimate account at first,
|
|
you might be best to hack a student's account for
|
|
your
|
|
other-system hacking.
|
|
The other fun part about universities is often they
|
|
will provide access to a number of nets, usually
|
|
including the Internet.
|
|
Occasionally you'll have access to a PSN as well.
|
|
|
|
- CARRIER SCANNING: Carrier scanning in your LATA(Local Access Transport
|
|
Area), commonly known as wardialing, was popularized
|
|
in the movie War Games.
|
|
Unfortunely, there are a few problems inherent in
|
|
finding systems this way; you are limited to the
|
|
systems in your area, so if you have a small town
|
|
you
|
|
may find very little of interest, and secondly,
|
|
ANI is a problem within your own LATA, and tracing
|
|
is
|
|
simple, making security risks high. If you are going
|
|
to hack a system within your own lata, bounce it at
|
|
least once.
|
|
There are many programs, such as ToneLoc and
|
|
CodeThief
|
|
(ToneLoc being superior to all in my humble
|
|
opinion),
|
|
which will automate this process.
|
|
|
|
- PACKET-SWITCHED : This is my favorite by far, as hacking on PSNs is
|
|
how
|
|
NETWORKS I learned nearly all I know. I've explored PSNs
|
|
world-wide, and never ran out of systems to hack.
|
|
No matter what PSN you try you will find many
|
|
different, hackable systems. I will go more indepth
|
|
on PSNs in the next section.
|
|
|
|
|
|
PACKET-SWITCHED NETWORKS
|
|
========================
|
|
------------------------
|
|
|
|
Intro to PSNs
|
|
=============
|
|
|
|
First off, PSNs are also known as PSDNs, PSDCNs, PSSs and VANs to name
|
|
a few. Look up the acronyms in the handy acronym reference chart<g>.
|
|
The X.25 PSNs you will hear about the most are; Sprintnet(formerly
|
|
Telenet), BT Tymnet(the largest), and Datapac(Canada's largest).
|
|
All these networks have advantages and disadvantages, but i'll say this;
|
|
if you are in the United States, start with Sprintnet. If you are in Canada,
|
|
Datapac is for you.
|
|
The reason PSNs are so popular for hackers are many. There are literally
|
|
thousands of systems on PSNs all around the world, all of which(if you have
|
|
the right facilities) are free of charge for you to reach. And because of
|
|
the
|
|
immense size of public PSNs, it is a rare thing to ever get caught for
|
|
scanning. Tracing is also a complicated matter, especially with a small
|
|
amount of effort on your part to avoid a trace.
|
|
|
|
How packet-switching works
|
|
==========================
|
|
|
|
The following explanation applies for the most part to all forms of
|
|
packet-switching, but is specifically about PSNs operating on the X series
|
|
of
|
|
protocols, such as Datapac & SprintNet, as opposed to the Internet which
|
|
operates on TCP/IP. It is the same principle in essense, however.
|
|
Packet-Switched Networks are kinda complicated, but I'll attempt to
|
|
simplify the technology enough to make it easy to understand.
|
|
You, the user, connect to the local public access port for your PSN,
|
|
reachable via a phone dialup. You match communications parameters with the
|
|
network host and you are ready to go.
|
|
From there, all the data you send across the network is first bundled
|
|
into
|
|
packets, usually of 128 or 256 bytes. These packets are assembled using
|
|
Packet Assembly/Disassembly, performed by the public access port, also known
|
|
as a public PAD(Packet Assembler/Disassembler), or a DCE(Data Communicating
|
|
Equipment or Data Circuit-Terminating Equipment).
|
|
The packets are sent along the network to their destination by means of
|
|
the various X protocol
|
|
|
|
|