177 lines
9.9 KiB
Plaintext
177 lines
9.9 KiB
Plaintext
|
|
%%% %%% %%%% %%% %% %%%%%
|
|
%%%% %%%% %% %%%% %% %% %%
|
|
%% %%% %% %% %% %% %% %% %%
|
|
%% % %% %% %% %%%% %% %%
|
|
%% %% %%%% %% %%% %%%%%
|
|
|
|
// // //// ////// ////// //
|
|
\\ \ \\ \\ \\ \\ \\ \\ \\ \\
|
|
// /// // //////// ////// ////// //
|
|
\\\\ \\\\ \\ \\ \\ \\ \\
|
|
/// /// // // // // // //
|
|
|
|
[ Mind Warp - Volume #0, Issue #9, File #009 ]
|
|
[ "Network Hacking #2/2" by Mustaine ]
|
|
|
|
------------------------------------------------------------------------------
|
|
Setting System Defaults once Supervisor acess has been gained
|
|
on a NovellNetWare 286 LAN.
|
|
[Mustaine/INFLUENZA]
|
|
|
|
One of the easiest things to do after gaining supervisor access to
|
|
your NovellNetware286 LAN is to change the system defaults. By doing so you
|
|
can custom tailor your own backdoor account, or change existing ones. Can we
|
|
spell CHAOS? You can also make your own new accounts, but that as we say, is
|
|
another text phile.
|
|
At any rate, the following information on NovellNetware is for users
|
|
who have hacked supervisor access only. ( If you have not gained supervisor
|
|
access already, please refer to the first file of this series. )
|
|
Many parameters can be induvidually set for each user account. If
|
|
all or some of those parameters are not entered, NetWare uses the system
|
|
default values established by the supervisor options of the SYSCON program.
|
|
|
|
Using SYSCOM:
|
|
|
|
Start SYSCOM by typing the program's name and pressing ENTER at the
|
|
system prompt. If the message "Bad Command or File Name" is displayed, one
|
|
of the following conditions are true:
|
|
1) The current directory is not \PUBLIC and you do not have a SEARCH
|
|
path to the \PUBLIC directory.
|
|
(* CAN WE SAY "SH*T OUT OF LUCK?" *)
|
|
2) You do not have at least ROS(read, open and search) rights in the
|
|
\PUBLIC directory.
|
|
|
|
After the SYSCON program starts, you are presented with an Available
|
|
Topics menu. To change the system defaults, select Supervisor Options by
|
|
moving the highlight bar and pressing ENTER or by pressing S and ENTER.
|
|
If you do not have Supervisor privlidges, a screen will pop of
|
|
indicating that you can not acess Supervisor Options. (* IF THIS IS THE
|
|
CASE, GET THE DAMN SUPERVISOR PW, AND LOG IN WITH IT. *)
|
|
If you do have supervisor provlidges, the Supervisor Options menu is
|
|
displayed. Notice the first two options begin with the word default. These
|
|
two choices affect items that are used as defualt values for any new user
|
|
added, unless specifically altered for the user.
|
|
|
|
Choices in the Supervisor Options Menu:
|
|
|
|
DEFAULT ACCOUNT VALUES\RESTRICTIONS:
|
|
|
|
This catagory of options affects the use of passwords in the system.
|
|
It also controls how users can login to the LAN. Seven major parameters must
|
|
be set for this option. Each of these may be overidden for the induvidual
|
|
users.
|
|
|
|
A) ACCOUNT HAS EXPIRATION DATE: Allowed values, (Yes, No). When set
|
|
for yes, the system prompts for an expiration date for the account.
|
|
The account autmatically becomes inactive at midnight on that date.
|
|
The account still exists, however, and can be reactivated by the
|
|
supervisor.
|
|
B) LIMIT CONCURRENT CONNECTIONS: Allowed values, (Yes, No). The
|
|
default for this option is NO. Concurrent connections means that
|
|
the same user name can be used to login on a workstation while it is
|
|
already in use on another station. When set to YES, the sytem
|
|
prompts for the maximum simultaneous connections allowed for this
|
|
account name. The acceptable values are 1 through 100.
|
|
C) REQUIRE PASSWORD: Allowed Values, (Yes, No). IF SET TO NO, A
|
|
PASSWORD FOR THE USER ACCOUNT IS OPTIONAL. If set to yes, a
|
|
password in mandatory for the account. In addition, the system
|
|
prompts for a minimum password length. The allowed values for the
|
|
minimum password length are 1 to 20, with a default of 5. Spaces are
|
|
not allowed in the password; spaces entered as part of the password
|
|
are converted to the underscore character (_), and this character
|
|
becomes part of the password.
|
|
D) FORCE PERIODIC PASSWORD CHANGES: Allowed Values, (Yes, No). If
|
|
set to NO, passwords have an indefinite life span. If set to YES,
|
|
the option activates other options that affect the life span of
|
|
passwords and the action of the system after a password has expired.
|
|
A) DAYS BETWEEN FORCED CHANGES: Allowed Values (1 through 365).
|
|
This option is pretty much self-explanitory.
|
|
B) LIMIT GRACE LOGINS: Allowed Values, (Yes, No). This option
|
|
determines Netware's actions after the password has expired.
|
|
The user CAN continue with the same password indefinity. The
|
|
user will be prompted at login, however, with the following
|
|
message:
|
|
|
|
Password has expired.
|
|
Would you like to change your password on server XXXXXX? (Y/N)
|
|
|
|
At this point, the user may elect to change the password, but
|
|
is not forced to do so. When set to yes, this option activates
|
|
the GRACE LOGINS ALLOWED option.
|
|
|
|
GRACE LOGINS ALLOWED: Allowed Values, (1 to 200). Basically, if
|
|
the password in NOT changed before the alloted Grace values are
|
|
used, the user cannot login again without the supervisor giving
|
|
the user more grace logins or extending the password experation
|
|
date.
|
|
|
|
E) REQUIRE UNIQUE PASSWORDS: Allowed Values, (Yes, No). If no, the
|
|
user can reuse passwords. If yes, the user must establish a
|
|
password never used before. They CAN be the same as another user.
|
|
F) ACCOUNT BALANCE: Allowed Values (-99999999 to 99999999). This
|
|
is only used if accounting features are installed. (FORGET IT.)
|
|
G) ALLOW UNLIMITED CREDIT: Allowed Values, (Yes, No). (FORGET IT.)
|
|
|
|
|
|
DEFAULT TIME RESTRICTIONS: Change the values that appear on
|
|
the display in front of you by using the spacebar. The usage time
|
|
blocks are in thiry minute increments. ( PLAY WITH THIS ONE, I THINK
|
|
IT'S PRETTY SELF-EXPLANITORY.)
|
|
A) EDIT SYSTEM AUTOEXEC FILE: ( UM....DUH...)
|
|
B) FILE SERVER CONSOLE OPERATORS: After selecting this, a screen
|
|
containing existing file server console operators appears. To insert
|
|
new entries, press INS. Select these users or groups by pressing the
|
|
arrow keys.
|
|
C) INTRUDER DETECTION\LOCKOUT: This determines what NetWare will do
|
|
if a user repeatadly attempts to login incorrectly. If set to No,
|
|
Netware does nothing. If set to Yes, te following options are
|
|
presented:
|
|
A) INCORRECT LOGIN ATTEMPTS: Allowed Values, (1 to 10000).
|
|
Now because NetWare maps just the \LOGIN directory while
|
|
users login, nothing prevents a user from finding a valid
|
|
user name. However, if an invalid user name is entered,
|
|
NetWare prompts for a passoword. ( NETWARE ASSUMES WE
|
|
HACKERS ARE MORONS. )
|
|
B) BAD LOGIN COUNT RETENTION TIME: Allowed Values (40 days,
|
|
23 hours, 59 minutes; minimum 0 minutes.) These reset the
|
|
Incorrect Login Attempts count when no additional login
|
|
attempts are made for a specfic amount of time.
|
|
C) LOCK ACCOUNT AFTER DELETION: Allowed Values, (Yes, No).
|
|
If NO, a detected intruder does not cause the account to be
|
|
locked. The valid user still could login using his or her
|
|
name. The entry IS recorded. If yes, the account is locked.
|
|
No one can login using that name, unless the supervisor
|
|
enables the account through SYSCON. This is displayed
|
|
when attempted:
|
|
|
|
Intruder detection locout has disabled this account.
|
|
Acess to server denied.
|
|
You are attached to server XXXXXXXX.
|
|
|
|
Now, if you attempt to break into the supervisor account and
|
|
this happens, the account CAN be re-enables from the SERVER
|
|
by typing ENABLE LOGIN.
|
|
D) LENGTH OF ACCOUNT LOCKOUT: Allowed Values (40 days, 23
|
|
hours, 59 minutes; minimum 1 minute.) This establishes the
|
|
amount of time that the user name remains locked out after
|
|
an intruder has been detected.
|
|
D) SYSTEM LOGIN SCRIPT: (UM...DUH.)
|
|
E) VIEW FILE SERVER ERROR LOG: This includes intruders and unresolved
|
|
or excessive data transmission errors. (* TO SAVE YOUR ASS, CLEAR
|
|
IT WHEN YOU EXIT.) This can only be done by the supervisor.
|
|
|
|
Anywayz, have phun with these options, and be careful not to get
|
|
caught. Maheym serves no purpose if you get your ass fired from your
|
|
company, or if you get sent to detention. ( For all you school kiddies. )
|
|
Remember, you can only use these options if you have supervisor acess, and
|
|
that in itself is a hard thing to do.
|
|
|
|
-=iNFLueNZa iNC.=-
|
|
-=1994=-
|
|
|
|
|
|
==============================================================================
|
|
Call Arsonist's Arsenal BBS the Mind Warp WHQ - (301) 208-0847
|
|
==============================================================================
|