home *** CD-ROM | disk | FTP | other *** search
How servers are cracked, by R a v e N. Session Start: Sat Jan 22 18:04:06 2000 [18:04] *** Now talking in #bsrf [18:04] *** Topic is 'Welcome to #bsrf | Our Website: http://blacksun.box.sk | Next IRC lecture: 'How Servers are Cracked' | See http://blacksun.box.sk/irc.html | Alright, I know the bot is down most of the time now, and that the channel is ultra insecure, so please don't abuse this... heh, yeah right' [18:04] *** Set by Raven on Wed Jan 19 07:22:58 [18:04] * #bsrf is being logged [18:04] <INTJ> okie [18:05] <INTJ> ready? [18:05] <Raven> alright [18:05] <Raven> is everyone ready? [18:05] <c0c0> yep [18:05] <Chaotic_Thought> Yes sir... [18:05] <Seeker> yup [18:05] <squiler> yup [18:05] <INTJ> 9 ppl overall [18:05] <SnIpEr_WoLf_> yeah [18:05] <Seeker> that good? [18:05] <Raven> including me [18:05] <Raven> :-) [18:05] <Raven> alright [18:05] <Raven> On your marks. [18:05] <Raven> Get set. [18:05] <Raven> Go! [18:05] <Raven> okay, so today's topic is... [18:06] <Raven> how servers are hacked [18:06] <Raven> basically, of course [18:06] <INTJ> cracked [18:06] <Raven> yeah, cracked [18:06] <Raven> terminology... [18:06] <Raven> hehe [18:06] <Raven> :-) [18:06] <INTJ> that's what you wrote on your website ;p [18:06] <squiler> :) [18:06] <Raven> anyway, most of those website defacements... [18:06] <Raven> dns cracks [18:06] <Raven> email cracks [18:06] <Raven> ftp cracks [18:06] <Raven> etc' etc' [18:06] <Raven> they're usually done in fairly easy and simple ways [18:06] <Raven> that do not require much knowledge [18:07] <Raven> they're usually done by little kids [18:07] <Raven> mostly little kids in "hacking" groups [18:07] <Raven> who want to show the world how smart they are [18:07] <Raven> Phase I [18:07] <Raven> -------- [18:07] <Raven> oops... [18:07] <Raven> ------- [18:07] <Raven> DAMN! [18:07] <Raven> lol [18:07] <Raven> okay, all over again [18:07] <Raven> Phase I [18:07] <Raven> ------- [18:07] <Raven> ahh... [18:07] <Raven> that's better [18:07] <Raven> any questions so far? [18:07] <Raven> okay, so phase one is... [18:07] <Raven> intelligence gathering [18:07] <TheJoker> why is it so easy? [18:08] <Raven> we'll get to that [18:08] <INTJ> because of ./i-0wn3d-u <server> <port> ;p [18:08] <Raven> exactly [18:08] <Raven> if some of u don't understand, don't worry [18:08] <Raven> we'll get to that [18:08] <Raven> so anyway, stage one is intelligence gathering [18:08] <Raven> this is the most important stage [18:08] <Raven> why? [18:08] <squiler> ... [18:09] <Raven> because otherwise you'll find yourself trying thousands of sunos 3.4 exploits [18:09] <Seeker> need to know what os [18:09] <TheJoker> you have to know what exploits apply [18:09] <Raven> while you're actually attacking an nt4.0 server [18:09] <Raven> what os... [18:09] <Raven> and what is the host running [18:09] *** c0c0_ has joined #bsrf [18:09] <Raven> those are the two most important phases in intelligence gathering [18:09] <c0c0_> damn i've disconnected [18:09] <Raven> getting them is fairly easy [18:09] *** c0c0 has quit IRC (Ping timeout) [18:09] <INTJ> welcome c0c0_, we're in the middle of the lecture [18:09] *** c0c0_ is now known as c0c0 [18:09] <Raven> poor soul [18:09] <TheJoker> nmap? [18:09] <Raven> :-) [18:10] <Raven> that's two [18:10] <Raven> nmap is too "advanced" for most script kiddies [18:10] <TheJoker> advanced? [18:10] <Raven> most people use really amateurish methods [18:10] <Raven> such as reading daemon banners [18:10] <Raven> (yes, it requires the "cracker" to have unix... ooh) [18:10] <TheJoker> hehe [18:10] <Seeker> whats a daemon banner? [18:10] <Raven> and to know how to install new software [18:10] <squiler> ha [18:10] <Raven> alright, i'll show u [18:10] <squiler> oo me oo me! [18:10] <Raven> everyone, do telnet mailgw.netvision.net.il [18:10] <Raven> this is my isp's smtp server [18:11] <Raven> smtp = simple mail transfer protocol [18:11] <INTJ> but daemon banner is trivial to be spoofed [18:11] <Raven> for outgoing mail [18:11] <Raven> yes, of course [18:11] <Raven> first, let's explain to those who don't know what daemon banners are [18:11] <Raven> what do u get when u telnet to mailgw.netvision.net.il? [18:11] <Seeker> oh, i think i know what you mean [18:11] <c0c0> Trying 194.90.1.14... [18:11] <squiler> "could not connect" [18:11] <squiler> :-) [18:11] <c0c0> telnet: connect to address 194.90.1.14: Connection refused [18:11] <c0c0> telnet: Unable to connect to remote host: Connection refused [18:11] <Raven> oops [18:11] *** SnIpEr_WoLf_ has left #bsrf [18:11] <Raven> telnet mailgw.netvision.net.il 25 [18:11] *** SnIpEr_WoLf_ has joined #bsrf [18:11] <Raven> telnet mailgw.netvision.net.il 25 [18:12] <Raven> port 25, this is important [18:12] <Raven> smtp runs on port 25 [18:12] <c0c0> yea [18:12] <Chaotic_Thought> I'm on... [18:12] <squiler> we get like sendmail version etc... [18:12] <TheJoker> running sendmail [18:12] <Chaotic_Thought> 8.9.3 sendmail [18:12] <Raven> yup [18:12] <Raven> 220 alpha.netvision.net.il ESMTP Sendmail 8.9.3/8.8.6; Sat, 22 Jan 2000 19:14:41 +0200 (IST) [18:12] <TheJoker> a linux/unix? [18:12] <Raven> this is what u get [18:12] *** Sniper_wolf__ has joined #bsrf [18:12] <Raven> this is a daemon banner [18:13] <c0c0> hmmmm, oki [18:13] <Raven> btw check blacksun.box.sk/ports.txt for a list of standard ports [18:13] <Raven> now, what does it tell us? [18:13] <Raven> ooh, sendmail [18:13] <Raven> the dumbest daemon ever [18:13] <Raven> it just gave us the version of the daemon that is running [18:13] <TheJoker> it's a unix type sys [18:13] <Raven> usually, in sendmail holes, the OS doesn't matter much [18:13] <Raven> yup [18:13] <Raven> now, suppose we're some script kiddie [18:14] <Raven> so we have the version [18:14] <Raven> of the daemon [18:14] <Raven> now we go to, say, packetstorm.securify.com [18:14] <Raven> or neworder.box.sk [18:14] <Raven> and we search [18:14] <INTJ> bugtraq [18:14] <INTJ> technotronic [18:14] <INTJ> ;p [18:14] <Raven> we use keywords such as "sendmail 8.9.3" [18:14] <Raven> yes, bugtraq is good too [18:14] <Chaotic_Thought> look for a crack/bug [18:14] <Raven> yup [18:14] <INTJ> ntbugtraq.com [18:14] <Raven> now, here is what we'll find [18:14] <Raven> we could find: [18:15] <TheJoker> that's pathetic! [18:15] <Raven> a) advisories [18:15] <Raven> these hardly mean anything to crackers [18:15] <Raven> they only explain to u how to fix the hole [18:15] <Raven> and a little technical backgruond [18:15] <Raven> and a little technical background [18:15] <Raven> which the common script kiddie won't be interested in [18:15] <Raven> b) texts [18:15] <Raven> texts will detail the hole [18:15] <Raven> how to exploit it [18:16] <Raven> and a workaround, if any [18:16] <Raven> c) an exploit [18:16] <Raven> BINGO! [18:16] <Raven> an exploit is a premade program [18:16] <Raven> that exploits a certain hole [18:16] <Raven> all the cracker has to do is to compile it [18:16] <Raven> (unless it's written in perl) [18:16] <Raven> (or another interpreted programming language) [18:16] <INTJ> bash [18:16] <Raven> ('cause they run in the form of source code) [18:16] <Chaotic_Thought> So crackers are usally lazy punks... [18:16] <Raven> yes, or a shell script [18:16] <Raven> although u'll hardly ever found exploits in the form of shell scripts [18:16] <INTJ> pamslam.sh [18:16] <INTJ> heheh ;p [18:17] <Raven> sniperwolf missed everything from phase one 'till "the dumbest daemon ever" [18:17] <INTJ> redhat and mandrake rooter [18:17] <Raven> can anyone plz help him? [18:17] <Raven> i'm kinda busy here with the lecture and everything [18:17] <Raven> :-) [18:17] <Raven> other daemons a cracker might want to look at: [18:17] <Raven> ftp [18:17] <Raven> by logging into ftp servers [18:17] <Raven> when logging into ftp servers [18:17] <Raven> u usually get technical information about the system [18:18] <Raven> u could also try to issue the syst command [18:18] <Raven> which will also give away some information [18:18] <Raven> webservers [18:18] <Raven> if u issue a bad url request [18:18] <Raven> it'll give u some info [18:18] <Raven> for example: try surfing to http://blacksun.box.sk/some-dead-link.html [18:18] <c0c0> like they are usun apache [18:18] <Raven> it'll give u an error msg [18:18] <Raven> and the name and version of the webserver program [18:18] <Raven> fairly easy [18:18] <Raven> all u need is a browser [18:19] <Raven> crackers can also utilize newsgroups daemons [18:19] <TheJoker> how bout pop mail? [18:19] <Raven> and others [18:19] <Raven> pop mail too [18:19] <Chaotic_Thought> Apache 1.3.6 port 80 [18:19] <Raven> pop3 usually reveals information [18:19] <Raven> ftp port 21 [18:19] <Raven> news port... [18:19] <Raven> 119, i think [18:19] <Raven> pop is... [18:19] <TheJoker> telnet [18:19] <Raven> uhh, damn [18:19] <INTJ> 110 = pop [18:19] <TheJoker> 110 [18:19] <Raven> yeah [18:19] <Raven> telnet too [18:19] <Raven> telnet to port 23 [18:19] <c0c0> yep 119 if it is not a secure connection [18:19] <Raven> go ahead and telnet to blacksun.box.sk on port 23 [18:19] <Raven> u'll get some info on the system [18:20] <Raven> but what if we change this information? [18:20] *** Sniper_wolf__ has quit IRC (IL.Quit: I was using Ghost_Rider Script version 2.0) [18:20] <Raven> most of today's server programs let u do it [18:20] <TheJoker> most admins do it. [18:20] <squiler> redhat linux 5.2 --- you learn the os [18:20] <c0c0> Kernel 2.0.36 on an i586 [18:20] <squiler> and the system [18:20] <Raven> so suppose we've changed the daemon banner [18:20] <TheJoker> Red Hat Linux release 1.2 (Apollo) [18:20] <Raven> but what if... [18:20] <squiler> ... [18:20] <Raven> we're dealing with a smarter script kiddie? [18:21] <Raven> (ph33r) [18:21] <squiler> they exist? [18:21] <Raven> yeah [18:21] <squiler> :) [18:21] <Raven> there are some [18:21] <TheJoker> nmap! [18:21] <INTJ> yes, unfortunately ;p [18:21] <Raven> yup [18:21] <Raven> www.insecure.org [18:21] <Raven> download nmap [18:21] <c0c0> queso may be? [18:21] <Raven> how does nmap work? [18:21] <INTJ> winfingerptint.exe [18:21] <Raven> queso too [18:21] <Raven> winfingerprint too [18:21] <Raven> winfingerprint is for windows [18:21] <Raven> the others are for unix [18:21] <Raven> get them all at packetstorm.securify.com [18:21] <INTJ> windows nt [18:21] <Raven> how do they work? [18:21] <Raven> pretty simple [18:21] <Raven> each OS has what we call tcp/ip fingerprints [18:21] <Raven> why? [18:22] <TheJoker> it trys all these same techniques don't it? [18:22] <Raven> because each os implements tcp/ip in a different way [18:22] <Raven> kinda [18:22] <Raven> yeah [18:22] <Raven> basically, nmap and the others are just port scanners [18:22] <TheJoker> ya now I remember [18:22] <Raven> but they do more [18:22] <Raven> they can detect these fingerprints [18:22] <Raven> and give definitive information [18:22] <INTJ> this irc server gives a lot if advertising msgs.. [18:22] <TheJoker> the win tcp/ip stack is easy to detect [18:22] <Raven> yes, it's the easiest [18:22] <Raven> windows is the easiest to detect [18:23] <Raven> detecting the difference between two similar unix distributions is harder [18:23] <Raven> detecting the differences between, say, some unix and windows [18:23] <Raven> or mac and windows [18:23] <Raven> is fairly easy [18:23] <Seeker> could you spoof fingerprints? as an admin i mean [18:23] <Raven> so our smart and elite script kiddie grabs his copy of nmap [18:23] <INTJ> how bout between linux distro or *bsd? [18:23] <TheJoker> but nmap uses a combo of all the techniques. [18:23] <Raven> technically, u can, but it takes a lot of messing around with code and stuff [18:24] <Raven> and u probably won't be able to do it well [18:24] <Raven> nor hide from all techniques [18:24] <Raven> also, nmap does other things [18:24] <Raven> it's a portscanner that can also scan through firewalls [18:24] <TheJoker> but do your really have too hide? [18:24] <Raven> more on nmap's website and nmap's man pages [18:24] <Raven> (it installs a manpage) [18:24] <Raven> (so u type man nmap after u install it) [18:24] <Raven> (and it explains everything) [18:24] <Raven> www.insecure.org/nmap [18:25] <TheJoker> arent your lost in say ftp trafic when ftping? [18:25] <Raven> well, if u reveal critical information about ur system [18:25] <Raven> u might be helping a cracker [18:25] <Raven> TheJoker: say again plz? [18:25] <TheJoker> does the cracker have to worry about hiding? [18:26] <Raven> yes [18:26] <Raven> so the cracker would implement some techniques [18:26] <TheJoker> wont' he/she be lost in trafic? [18:26] <Raven> such as the ones described in blacksun.box.sk/anonymity.txt [18:26] <Raven> generally, yes [18:26] <Raven> but there are IDSs [18:26] <Raven> IDS = Intrusion Detection System [18:26] <TheJoker> dynamic IPs now days [18:26] <Raven> they go over traffic [18:26] <Raven> and highlight several parts in the logs [18:26] <squiler> is a proxy enough to hide? [18:26] <Raven> which might mean a cracking attempt [18:26] *** c0c0 has quit IRC (Ping timeout) [18:26] <Raven> bouncing ur connection would usually suffice [18:27] <Raven> okay, that's it. if u miss something, just wait for the logs to come out [18:27] <INTJ> if the proxy party cooperate w/ us ;p [18:27] <Raven> or... [18:27] <Raven> suppose we telnet to nether.net [18:27] <Raven> and get a free shell account [18:27] <Raven> and then break out [18:27] <Raven> and manage to get root [18:27] <Raven> (suppose we do it from a public place so they can't trace us back home) [18:27] <Raven> now we have a root shell on nether.net [18:27] <Raven> and we can run exploits and hack from them [18:27] <TheJoker> http://freebooks.hypermart.net/proxy/proxiesn.htm [18:28] <Raven> :-) [18:28] <TheJoker> free proxies worldwide [18:28] <squiler> nether.net is the best free shell provider [18:28] <Raven> okay, so these were phase one and two [18:28] <Raven> phase one - info gathering [18:28] <Raven> two - searching online databases [18:28] <Raven> now, suppose we're in [18:28] <Raven> now comes phase three [18:28] <Raven> no, not defacing the website! [18:28] <Raven> or dns database [18:28] <Raven> we have some other things to worry about [18:29] <Raven> first we need to clean out presence from the logs [18:29] <TheJoker> logs? [18:29] <Raven> or the admin might realize he got cracked [18:29] <squiler> thats what i'm doing right now [18:29] <Raven> and put more effort into security [18:29] <squiler> :) [18:29] <Raven> :-) [18:29] <INTJ> this is where rootkit comes in ;p [18:29] <Raven> not these logs! [18:29] <squiler> hahaha [18:29] <Raven> yeah, rootkits automate such processes [18:29] <TheJoker> :p) [18:29] *** INTJ has quit IRC (No route to host) [18:29] * Chaotic_Thought grins [18:29] <Raven> fun for the whole family [18:29] <squiler> how does a rootkit actaully work? [18:29] <Raven> so now that we've cleaned our presence from the logs [18:30] <Raven> it's just an automated script [18:30] <Raven> it automates some tasks for u [18:30] <Raven> they only work on specific configurations [18:30] *** INTJ has joined #bsrf [18:30] <Raven> of course, if we only clean the standard logs like klog (kernel logger) and syslog (system logger) [18:30] <INTJ> shoot, israel.net closed me [18:30] <Raven> it might now be enough [18:30] <Raven> don't worry, just get someone to give u the logs at the end of the lecture [18:31] <Raven> okay, so if we only cleaned syslog and klog [18:31] <Raven> we might have still left some trace [18:31] <Raven> maybe the admin is using an external logging system? [18:31] <Raven> could be... [18:31] <TheJoker> in being rooted? [18:31] <Raven> hey, when ur done with the lecture, plz send the logs to tplec@zipmail.com.br (sniper wolf) and to me (barakirs@netvision.net.il) [18:31] <Raven> now, suppose we're a cracker [18:31] <Raven> and we've cleaned syslog and klog [18:32] <Raven> but the admin was using some external logger [18:32] <Raven> WHOOPS! [18:32] <Raven> we've left some presence [18:32] <TheJoker> dead [18:32] <Seeker> wed be screwed.. [18:32] <Raven> now, phase 4 [18:32] <Chaotic_Thought> Do u want logs edited somewhat? [18:32] *** SnIpEr_WoLf_ has quit IRC (IL.Quit: 12Delta 3.4 15,1- 14 Dark15 Il16lu15mina14tion 15- - [ http://delta.cjb.net ]) [18:32] <squiler> how do you get around that? [18:32] <Raven> so u need to do some research on the machine [18:32] <Raven> browse around in it's directories [18:32] <Raven> see what u can find [18:32] <Raven> and of course, u must have a lot of experience [18:32] <Seeker> can one practice that? [18:32] <Raven> install some log cleaners on urself [18:33] <Raven> mess around with external logging programs [18:33] <Raven> etc' etc' [18:33] <TheJoker> skript kiddies dont though [18:33] <INTJ> rootkit [18:33] <Raven> that's right [18:33] <Raven> u can practice that on ur own box [18:33] <Raven> script kiddies hardly ever practice [18:33] <Raven> the average script kiddie would skip phases 3 and 4 [18:33] <Raven> phase 3 - deleting urself from the logs [18:33] <INTJ> rootkit can make logging exclude our doings [18:33] <Raven> phase 4 - installing a backdoor [18:33] <Raven> (we'll get to that) [18:34] <Raven> btw, DO NOT just delete the logs! [18:34] <Raven> this will surely get the admin to notice [18:34] <Raven> DUH!! [18:34] <Raven> that's the dumbest thing u could possibly do [18:34] <TheJoker> just your intries! [18:34] <Raven> exactly [18:34] <Raven> u can also change ur entries [18:34] <Raven> and make them look like something more legitimate [18:34] <Raven> of course, u have to make sure they look authentic [18:34] <TheJoker> skript kiddies would'nt know thier entries form others would they? [18:35] <Raven> yup - experience with loggers [18:35] <Raven> yeah [18:35] <Raven> okay, let's move on [18:35] <Raven> suppose this whole process of cracking into the machine and cleaning the logs [18:35] <Raven> took u... [18:35] <Raven> 5 minutes... [18:35] <Raven> 30 minutes... [18:35] <Raven> maybe a couple of hours [18:35] <Raven> a day? [18:35] <Raven> ;-) [18:35] <Seeker> *g* [18:35] <Raven> u wouldn't want to repeat that whenever u step in, would u? [18:36] <Raven> this is what backdoors are for [18:36] <squiler> hell no [18:36] <TheJoker> no [18:36] <TheJoker> ya! [18:36] <Raven> the most basic one is: [18:36] <Raven> useradd my-backdoor [18:36] <Raven> password my-backdoor my-new-pass [18:36] <Raven> we've just added a new user [18:36] <INTJ> passwd [18:36] <Raven> oops [18:36] <TheJoker> you would'nt use my-backdoor! [18:36] <Raven> passwd my-backdoor my-new-pass [18:36] <Raven> sorry [18:36] <Raven> yes, of course [18:37] <INTJ> adduser [18:37] <Raven> or useradd [18:37] <TheJoker> haha [18:37] <Raven> :-) [18:37] <Raven> depends on the system [18:37] <Raven> and on... [18:37] <Raven> nevermind! [18:37] <Raven> off-topic [18:37] <TheJoker> hehe [18:37] <Raven> it really doesn't matter [18:37] <INTJ> you wanna do clickings in win ;p [18:37] <Raven> now we edit the passwd file [18:37] <Raven> and give the new account uid 0 and gid 0 [18:37] <Raven> user id 0 = root access! [18:37] <Raven> access to ANYTHING [18:37] <Seeker> not always [18:37] <Raven> group id 0 = root's group [18:38] <Raven> yes, of course [18:38] <Raven> but usually [18:38] <Raven> u can change anything on unix boxes [18:38] <Seeker> SuSE has extreme restrictions, then you cant do some stuff [18:38] <TheJoker> the admin would notice a new god mode user! [18:38] <Raven> exactly! [18:38] <Raven> that's why it's the most obvious backdoor [18:38] <INTJ> there's a program for unix that can restrict uid 0 guid 0 permissions [18:38] <Raven> a new god user would fire up some alarms, now wouldn't it? [18:38] <Raven> that's also true [18:38] <TheJoker> ya! [18:39] <Raven> so no smart cracker would use this method [18:39] <Raven> another possible method: [18:39] <Raven> taking some backdoor noone uses [18:39] <Raven> and trojan it [18:39] <Raven> oops, i mean daemon [18:39] <Raven> taking some daemon [18:39] <Raven> and trojaning it [18:39] <TheJoker> what about cracking the passwd file? [18:39] <Raven> no, we already have root access [18:39] <INTJ> sshd daemon is a good one [18:39] <Raven> usually u won't need root's password [18:40] <Raven> u'll just run an exploit and get a root shell [18:40] <TheJoker> but after your in [18:40] <Raven> another possible backdoor: [18:40] <Raven> trojaning some daemon [18:40] <TheJoker> crack it and then you'll be able to get back in [18:40] <Raven> so the daemon would appear to be working just fine [18:40] <Raven> and will do everything naturally [18:40] <Raven> but will also allow the cracker to get a root shell [18:40] <Raven> but... [18:40] <Raven> what if the admin is running checksum checks? [18:41] <INTJ> tripwire [18:41] <Seeker> change them too... only problem left: time stamps [18:41] <Raven> there are programs out there, such as tripwire, which check the file sizes of files [18:41] <Raven> and let's the admin know when they're changed [18:41] <Raven> critical files [18:41] <Raven> that's true too [18:41] <Raven> the file's "last changed date" would also change [18:41] <Raven> sure, u can go around all of this... [18:41] <Raven> but this only means more variables [18:41] <Raven> more places where u can fail [18:41] <Raven> or make a mistake [18:41] <TheJoker> you could change sys time before you mod the file :p) [18:42] <Raven> and reveal urself [18:42] <Raven> of course, but that would be noticed [18:42] *** [S]hun has joined #bsrf [18:42] <Raven> this is one of the main reasons that u need to make sure the admin is not present when u crack [18:42] <Raven> using finger [18:42] <Raven> if finger is available [18:42] <Raven> finger @target-host.com [18:42] <TheJoker> not much anymore. [18:42] <Raven> yeah [18:42] <Raven> it's hard to find an admin [18:42] <Raven> that is dumb enough [18:42] <Raven> to run finger! [18:43] <INTJ> who [18:43] <Raven> suppose netvision.net.il (my isp) was running fingerd (finger daemon) [18:43] <INTJ> run 'who' [18:43] <Raven> ppl would just be able to do finger barakirs@netvision.net.il [18:43] <Raven> and get tons of information about me [18:43] <Raven> yes, of course, once you're in, u can use commands such as who [18:43] <squiler> you would have to be on the system to use who [18:43] <INTJ> ps aux [18:43] <Raven> exactly [18:43] <Raven> ps -aux [18:43] <Raven> this will show ALL running processes [18:43] <Raven> useful too [18:43] <Raven> sometimes to find loggers [18:44] <Raven> but the admin can change the process names of the loggers [18:44] <INTJ> we can send the admin xxx passwd to distract him ;p [18:44] <Raven> now, here's another method [18:44] <Raven> using the r services [18:44] <Raven> especially rlogin [18:44] <Raven> go read rlogin's man page [18:44] <Raven> wait, lemme quote it [18:44] <Raven> okay, nm, lemme write something of my own [18:45] <Raven> rlogin is based on trust systems [18:45] <Raven> for example: [18:45] <Raven> suppose u require anyone who comes over to ur house to give a password [18:45] <Raven> three knocks or something [18:45] <Raven> some password... [18:45] <Raven> but suddenly, ur best friends comes over [18:45] <TheJoker> 4 is better [18:45] <Raven> and he doesn't know the password [18:45] <Raven> :-) [18:45] <Raven> will u let him in? [18:45] <Raven> of course u will! [18:45] <Seeker> no [18:45] <Raven> u trust him [18:45] <Raven> lol [18:45] <TheJoker> heck no! [18:45] <Raven> u wouldn't [18:45] <Raven> trust systems would [18:46] <TheJoker> they suck! [18:46] <Raven> they're also good for more user-friendlyness [18:46] <TheJoker> I don't want my ps to be friendly [18:46] <squiler> send me the log please i must go [18:46] <Raven> so dumb clerks won't have to type in passwords all the time [18:46] <TheJoker> sorry pc [18:46] <Seeker> micro$oft? *eg* [18:46] *** squiler has quit IRC (IL.Quit: Leaving) [18:46] <Raven> now, trust systems are also serious security hazards [18:47] <Raven> go to blacksun.box.sk/books.html and read 'IP Spoofing Demystified' later [18:47] <Raven> now, let's take rlogin for example [18:47] <TheJoker> it was good. [18:47] <Raven> suppose u put a file: [18:47] <Raven> called /etc/rhosts [18:47] <Raven> put a file called rhosts in /etc [18:47] <Raven> which will look like this: [18:48] <Raven> somehost.com someuser [18:48] <Raven> the user someuser from somehost.com will be able to do: [18:48] <TheJoker> loggers would catch it? [18:48] <Raven> just a sec [18:48] <Raven> he'll be able to use rlogin [18:48] <Raven> to remotely login to this bx [18:48] <Raven> to remotely login to this box [18:48] <Raven> as ANY user [18:48] <Raven> or if u put an .rhosts file in a user's home directory [18:48] <Raven> he'll be able to log in as that user [18:48] <Raven> ANOTHER POSSIBLE BACKDOOR! [18:48] <Raven> but wait... [18:49] <Raven> that's fairly noticable, isn't it? [18:49] <TheJoker> ya [18:49] <Raven> most backdoors are [18:49] <Raven> so we need to put a lot of thought into it [18:49] <Raven> and some luck [18:49] <Raven> and make sure the admin is as dumb as possible [18:49] <TheJoker> should you make backup back doors? [18:49] <Raven> yes [18:49] <Raven> always [18:49] <Raven> on the other hand [18:49] <Raven> more backdoors [18:49] <Raven> would mean more chances [18:49] <Raven> that the admin will notice something wrong [18:49] <Raven> suppose u were an admin [18:50] <TheJoker> like a stupid one to make them think that they got you? [18:50] <Raven> and u would have suddenly noticed a backdoor [18:50] <Raven> u would panic, right? [18:50] <Raven> and put a lot more effort into security [18:50] <Raven> download every scanner u can find [18:50] <Raven> roam your system for backdoors and holes [18:50] <Raven> perhaps [18:50] <Raven> but they might find the stupid backdoor [18:50] <Raven> and then go crazy [18:50] <Raven> search the system [18:50] <Raven> and find ur other backdoors [18:50] <TheJoker> ya it's all luck, [18:50] <INTJ> but a very smart admin had setup a honeypot ;p [18:50] <Raven> exactly [18:50] <Raven> yup [18:50] <Raven> honeypots are kewl [18:51] <Raven> he would attract a cracker [18:51] <Raven> and then... [18:51] <Raven> KABOOM!! [18:51] <[S]hun> Whats honeypot ? [18:51] <TheJoker> ;P) [18:51] <Raven> or something... [18:51] <TheJoker> boobie trap [18:51] <Raven> a honeypot is a host or a certain situation that will attract crackers [18:51] <INTJ> KABOOM? the mail bomber? ;p hahaha [18:51] <Raven> the admin will monitor his honeypot [18:51] <Raven> see if there are any bees trapped inside [18:52] <Raven> and then, once he sees something... [18:52] <Raven> he would realize that he's being attacked [18:52] <Raven> and maybe call the police [18:52] <Raven> or Robert Frost!! [18:52] <Raven> MWHAHAHAHA!! [18:52] <Raven> (the poet) [18:52] <Raven> nevermind, forget it [18:52] <Chaotic_Thought> :) [18:52] <Raven> private joke [18:52] <TheJoker> sounds like a personal problem [18:52] <Raven> so that was phase 4 [18:53] <Raven> now, we're in [18:53] <Raven> we've cleaned the logs [18:53] <Raven> we have a backdoor [18:53] <Raven> now we only have one thing left to do: [18:53] <INTJ> inflate ego in irc [18:53] <Raven> utilize the box [18:53] <Raven> perhaps for mailbombing someone [18:53] <Raven> perhaps for installing bots on it [18:53] <Raven> or flooding [18:53] <INTJ> vhost [18:53] <Raven> or defacing the website on the box [18:53] <INTJ> hack another box [18:53] *** rekaerf has joined #bsrf [18:53] <Raven> yup, u can also set a virtual host on this box [18:53] <rekaerf> hey [18:54] <Raven> yes, or start other attacks against other hosts from this newly cracked one [18:54] <TheJoker> or just screw the system and kill a business [18:54] <Raven> yes, that's also true [18:54] <Raven> or... [18:54] <Raven> corporate espionage [18:54] <TheJoker> yummy! [18:54] <Raven> if ur a corporate spy [18:54] <INTJ> credit card numbers ;p [18:54] <Raven> u could get info and stuff [18:54] *** blu3h4z3 has joined #bsrf [18:54] <Raven> or maybe acccess credit card databases [18:54] <Raven> or other sensitive information [18:54] <Raven> so that was phase 5 [18:55] <Raven> which is... [18:55] <Raven> well, the last phase [18:55] <Seeker> LOL [18:55] <Raven> thank u all for coming over to the lecture [18:55] <[S]hun> hmm, I think I missed the first few parts [18:55] <[S]hun> where can I get the logs ? [18:55] <blu3h4z3> argh, I missed the whole thing@ [18:55] <Chaotic_Thought> it was cool [18:55] <Raven> ouch [18:55] <[S]hun> on blacksun/ ? [18:55] <TheJoker> na ni na na boo boo! [18:55] <Seeker> it was good yes [18:55] <Raven> someone send me his logs plz [18:55] <INTJ> hahaha [18:55] <Seeker> interesting [18:55] <TheJoker> nice job Raven [18:56] <Chaotic_Thought> RaveN, u want logs sorta edited? [18:56] <INTJ> edit the personal joke!!! hahaha ;p [18:56] <Raven> sorta edited? [18:56] <Raven> whaddya mean? [18:56] <Chaotic_Thought> Like, I was talking before lecture [18:56] <Raven> seeker, u didn't miss any parts of the lecture, right? [18:56] <blu3h4z3> no uncut and unedited [18:56] <Chaotic_Thought> Want that out? [18:56] <Raven> nm, seeker is sending me his logs [18:57] *** rekaerf has quit IRC (IL.Quit: I was using Ghost_Rider Script version 2.0) [18:57] <Raven> in a whopping 0.6429k per second speed [18:57] <[S]hun> haha [18:57] <Raven> # │ Type │ Nick │ Percent Complete │ K/s │ File [18:57] <Raven> ────────────────────────────────────────────────────────────────────────────── [18:57] <Raven> 1# GET seeker ▒▓█▓▒░ ░▒░ 94.6% 00:02 0.6395 #bsrf_20000122.log [18:57] <Raven> ∙φ∙ DCC Warning: incoming file is larger than the handshake said [18:57] <Raven> ∙φ∙ DCC Warning: GET: closing connection [18:57] * Seeker grins [18:57] <Raven> send again plz Session Close: Sat Jan 22 18:57:32 2000 
