home *** CD-ROM | disk | FTP | other *** search
-
- Well, it's time for yet another installment in Virginia Tech
- hacking. Yes, it's.... VTHACK #3!!!! Brought to you by the
- Mad Hermit and crew. This time, we're going to focus on the OTHER
- big network on campus: LocalNet. LocalNet (L-Net) has been around
- for a much longer period of time, and as such has quite a few more
- caves and back alleys to explore. Its main purpose is to connect
- the faculty and grad students directly to mainframes, and thus
- much of what is found when poking around are login prompts. An
- aggrivating factor that has been added to this is the inclusion of
- "Port Servers" (PS's). You know when you've hit a PS when L-Net
- tells you you've connected, but no key that you press has any
- effect. The purpose of a PS is to act as a deterrent to hackers.
- It also might have the additional function of baud rate detection,
- but though it sounds logical, we haven't found out for sure. We
- must admit that it does protect. The best way to keep system
- crashers away is not to tell them what they've found through simple
- redialing. This is a lot like keeping party crashers away by
- saying that there's a party going on at a certain place, but not
- telling them who's invited or who's giving the bash. Effective for
- the dim-witted, impatient, and amateur party crashers, but not for
- others.
- PS's sit and stare out at you until you start sending it
- characters. If the first few aren't the specific ones it's looking
- for, it will continue to gobble up everything else until you give
- up and hang up. Typical PS "codes" are easy-to-remember sequences
- like 'ZZ' or 'ASDF', and they then pass you on to the main login
- prompt. These "codes" aren't like passwords, since the added
- access they give you isn't worth beans unless you've got a line on
- where to go from the login prompt. However, we here feel that
- information like that is in fact "restricted" in that you are
- gaining unauthorized additional access to systems. As such, we've
- decided to leave the fun of figuring them out to those interested
- in such weekend diversiions.
- Before we give you what you're probably waiting for: neato
- numbers to call on L-Net, we'd like to explain stuff. First, this
- isn't a complete list, nor could it really be. L-Net addresses are
- in Hexidecimal and range from 0000 to FFFF. That's 65536 different
- possibilities. We only went through ten thousand of these, and are
- only listing those that got any response. Second, L-Net addresses
- may connect to any number of ports, but we haven't seen any more
- than 4 or 5. Thus, the total possible connections assuming an
- average of 2 ports per connection and an average of about 15
- connections per thousand addresses comes to just under 2000.
- Assuming this is correct (very doubtful), finding where these are
- is quite a task. Third, and on the positive side, some connections
- open up large worlds of access. These unpassworded gateways are
- known as servers, and typically are DECservers. The biggest and
- most notorious is listed at 0358 and can handle a max of 128 users.
- You can use these servers to connect to multiple computers at once,
- and have extensive help files telling you what to do. Fourth, and
- also on the plus side, L-Net doesn't kick you off. Ever. Multiple
- redialing is the name of the game, and listed below is a Red Ryder
- script that works under version 9.4 that dials consecutive integers
- at a rate of about 40 a minute. Fifth and finally, bum connections
- don't just leave you in the cold. Hitting CONTROL-A twice pops you
- immediately into local mode, where a STATUS tells you where you are
- connected, and a "DONE X" will disconnect you from session number
- X. Calling, by the way, is done by typing "CALL XXXX[,P]" where
- XXXX is the hex address, and P is the optional port number, which
- is seperated by a comma.
-
- Red Ryder 9.4 Local-Net Scanner Script.
-
- COPYINTO ~8,ENTER NUMBER TO START AT
- (GET1)
- QUERY1 ~1
- EMPTY ~1
- IF YES JUMPTO (GET1)
- LET EQUAL `1,~1
- LET EQUAL `3,`1
- COPYINTO ~8,ENTER LENGTH OF SEARCH
- (GET2)
- QUERY1 ~2
- EMPTY ~2
- IF YES JUMPTO (GET2)
- LET EQUAL `2,~2
- ADD `3,`2
- COPYINTO ~3,`3
- SUBTRACT `1,1
- (NEXT)
- ADD `1,1
- TEST `1=~3
- IF YES JUMPTO (QUIT)
- TYPE Call
- TYPE `1
- TYPE ^M
- ALERT1 UNIT/JUMPTO (NEXT)
- ALERT2 BUSY/JUMPTO (NEXT)
- PANICAFTER 10
- PROMPT CONNECTED
- PAUSE
- BELL
- BELL
- BELL
- BELL
- JUMPTO (QUIT)
- (QUIT)
- END
-
- And here's what our illustrious, untiring crew have discovered:
-
- Node Port# What
- ---- ----- ----
- 0008 1
- 0074 0,1 VTME (Mechanical Engineering)
- 0116 0,1
- 0124 0,1
- 0126 0,1
- 000A 1
- 000B 0,1
- 000C 0,1
- 000E 0,1
- 00FF 0,1
- 0170 0,1
- 0175 0,1 Popeye (Computer Science)
- 0350 0 VTCC1
- 0351 0,1 " "
- 0352 0,1 " "
- 0354 0,1 " "
- 0355 1 " "
- 0356 0,1 " "
- 0357 0,1 " "
- 0358 0,1 DECServer 500
- 0359 0,1 DECServer 500 (same as above, different port bank)
- 0400 0,1 VTME (again)
- 0401 0,1 " " "
- 0402 0,1 " " "
- 0403 0,1
- 0404 0,1 VTME (yet again)
- 0405 0 " " " "
- 0450 0,1 DECServers (see note 3)
- 0451 0,1 " " "
- 0452 0,1 " " "
- 0453 0,1 " " "
- 0454 0,1 " " "
- 0455 0,1 " " "
- 0536 0,1
- 600-601 "Remote Ports Busy"
- 603-607 "Remote Ports Busy"
- 1010 0,1
- 1100-1103 "Remote Ports Busy"
- 1300 0 VTVM1
- 5100 1 VTVM1
- 5300 0,1
- 5500-5503 "Remote Ports Busy"
- 5510 0,1
- 5512 0,1
- 5514 0,1
- 5516 0,1
- 5518 1
- 5530 0,1
- 5534 0,1
- 5536 0,1
- 5548 0,1
- 5548 0,1
- 5550 0,1
- 5552 0,1
- 5554 0
- 6000 1
- 6002 0 Node[20] (see note 1)
- 6003 0,1
- 6100-6103 "Remote Ports Busy"
- 6200 1 Node[2] (see note 2)
- 6230-6231 "Remote Ports Busy"
- 6300 0,1
- 6301 0,1
- 6302 0,1 Node[2] (see note 2)
- 6303 0
- 6410 1
- 6414 0
- 6419 1
- 6420 1
- 6428 0,1
- 6429 1
- 6433 0
- 6437 1
- 643A 1
- 643B 0
- 6502 0 VTVMS
- 6503 0 " "
- 6504 0 " "
- 6505 0 " "
- 6506 0 " "
- 6507 0 " "
- 6508 0 " "
- 6509 0 " "
- 8001 1
- 8002 0
- 8003 0
- 8004 0,1
- 8005 0
- 8006 1
- 8007 1
- 8008 0
- 8009 0
- 8080 0,1
- 9000-9016 "Remote Ports Busy"
- 9018-9019 "Remote Ports Busy"
- 9302 0
- 9300 0,1,2,3,4
-
- Notes:
- ------
- 1) Node[20], popularly known as the Node Router, went out of
- services shortly after VTHacker #2 was distributed. Apologies
- are NOT extended to those who assumed that the list in VTHack2
- was gospel. Things change all the time, and those things that
- are especially good tend to go away. Apparently, number 40062
- was used by CNS's chief diagnostician as a way to test the VA
- Council of Higher Education's access to the Net and L-Net.
- Poking around there was terminated, but our scan of L-Net turned
- up another way in...
-
- 2) If you wondered why the Node Router was labelled "20" (really,
- what happened to the other 19?), then this might clear things up.
- The following connections were observed:
- Node What
- ---- ----
- 0 Passworded
- 1 L-Net
- 3 the Net
- 5 Passworded
- 6 Passworded
- 9 Dead End
- 10 Dead End
- 12 L-Net
- 20 Restricted (*)
-
- *) This did connect you to a really screwed up L-Net port, which
- continually spewed out garbage and error messages, but we think
- our poking around in it got it shut off, due to the incredible
- quickness with which it was restricted (we were still on-line!)
-
- 3) Ah, what a joy it is to explore, and find a pristine cavern
- laden with sweet delight, and a menu to boot! Well, what I'm
- talking about is BAMBI and THUMPR, two side-by-side DECServers.
- Calling the listed numbers with port 0 gets you BAMBI, and using
- port 1 gets you THUMPR. In our experience, nobody has ever been
- dumped for staying on too long, and though the computers you can
- connect to aren't all that interesting (all Mechanical Engineering)
- the services and privileges allowed to ordinary users is about
- as generous as possible. The listings that follow are vebatim
- text sent by the servers, and we think that you'll be able to
- figure out what's going on.
-
- DECserver 200 Terminal Server V2.0 (BL29) - LAT V5.1
- AMDF Network - Server BAMBI
-
- Please type HELP if you need assistance
- Enter username> Jack Meoff
-
- Local> show nodes all
-
- Node Name Status Identification
-
- BAMBI Reachable AMDF Network - Server BAMBI
- BERT Reachable AMDF VAXstation I (VMS 4.2)
- ERNIE Reachable AMDF VAXstation I (VMS 4.2)
- POOH Reachable AMDF MicroVAX II (VMS 4.6)
- SPOCK Reachable ZONIC Lab VAXstation 2000 (VMS 4.6)
- SULU Unreachable AMDF Cluster VAXstation 2000 (Color)
- THUMPR Reachable AMDF Network - Server THUMPR
- UHURA Unreachable AMDF Cluster VAXstation 2000 (B & W)
- VTME Reachable ME VAX 11/780 (VMS 4.4)
- VTMEX Reachable AMDF Cluster VAXserver 3600 (VMS 4.7)
-
- Local> show ports all
-
-
- Port Access Status Services Offered
-
- 1 Dynamic Idle