The following section deals with Accounts on Unix systems.
All Unix systems have an account called root. This account is also commonly known as the SuperUser. Actually any account with a UID and GID of zero could be considered a SuperUser account. It is possible that a system administrator will rename the root account for obfuscation, but this is rather impractical as many applications not only require the UID zero but actually require the name of the account be "root" to run certain functions. As administrators do not wish to create more problem or have to patch more code than neccessary, this is a rare occurence.
Oh, and unless you've being living under a rock, you should already know that root is god on Unix.
Here are a few other accounts and passwords (if known) commonly found on Unix systems:
System Account Password Purpose -------- --------- -------- ----------------------------------------- Some guest (none) Guest access Some demo (none) Demo access Some games (none) Play games Some nuucp (none) UUCP access Some daemon (none) Typically invalid for direct access Some bin (none) Typically invalid for direct access Some man (none) Typically invalid for direct access Some lpd (none) Typically invalid for direct access Some sys (none) Typically invalid for direct access Some nobody (none) Typically invalid for direct access Some ftp (none) Anon FTP access, use email address as password AIX guest guest Guest access NeXT root NeXT god (default password on shipped systems) NeXT signa signa Guest account NeXT me (none) Not seen on all systems SGI/Irix 4DGifts (none) SGI/Irix lp (none) SGI/Irix tour (none) SGI/Irix tutor (none) SGI/Irix demos (none)
Remotely you have a few things you can try. Here are a few suggestions:
By typing in finger @targethost
you get get users that are currently
logged in. This will give you a few account. Also by typing finger account@targethost
you can
determine if that account is valid, and possibly the last time it has been accessed. Unfortunately
most Unix systems refuse finger requests from remote hosts, so this usually doesn't do you a lot of
good. But if finger is allowed, it can return a lot of information. Try running finger with a -l
for more verbose listings. If you gain local access, use finger account
to get info on other
accounts on the system. For example, if finger root
returns info about an administrator
named Fred, then finger fred
, which may reveil Fred's regular account.
You can run rusers targethost
which may return remote user info if the service is allowed.
Doing a whois domain
will return info about who is responsible for a domain, and usually
included a valid account name. You can use this to possibly determine other account names, and odds are very
good that the administrative contact and/or the technical contact have the system privileges you desire.
Often by telnetting to the mail server and trying to verify or expand names you can learn account
names. By typing telnet targethost 25
and typing in EXPN account
or VRFY account
will tell you if that account is valid. You may have to type in HELO
or some other commands before
you can do an EXPN
or VRFY
.
A lot of administrators are aware of the above techniques, and will often treat these probes as attacks themselves.
Many sites refuse finger and ruser accesses, and a lot of sites have configured their mailer to either not
respond to VRFY
and EXPN
or simply return nothing of value. Odds are good that sites that
refuse these types of probes are usually logging these types of probes, so you may wish to probe from one
location and attack from another.
If you can gain access locally, such as through a guest account, there are a number of things you can do to
view possible account names. Try using some of the finger
techniques from above minus the targethost,
try typing w
or who
or even more /etc/passwd
to get account names.