💾 Archived View for gemini.spam.works › mirrors › textfiles › magazines › CRITICAL › critical.1st captured on 2022-06-12 at 10:43:27.
View Raw
More Information
-=-=-=-=-=-=-
_____________________________________________________________________________
\~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/
\ Critical Issue # 01 A Technical Text /
\ Mass ~~~~~~~~~~~ File Newsletter. /
\________________________________|____________________________________/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
__________________________
__________ l___________ | ___________l
// \ _______ _____ l|l _____ ______ ___
// /~~~~~~~\_\ l \ l l l|l l l // \ _ l l
// / l [] / ~l l~ l|l ~l l~ // /~~~\_\ / \ l l
<<<< ritical l / l l l|l l l // / / \ l l
\\ \ l < l l l|l l l <<<< / ___ \ l l
\\ \_______/~/ l l\ \ l l l|l l l \\ \____/~/ / / \ \ l l_____
\__________/ l__l \_\ l___l l_l l___l \_______/ /_/ \_\ l_______l
==--> ==-->
____ __ ____ ==--> (09/09/90)
l \ / l ass ==-->
l \ / l __ ______ ______
l \ / l / \ / \ / \ A Technical
l l\ \ / /l l / \ / /~~~~~~ / /~~~~~~ Text File Newsletter
l l\\ / l l / ____ \ \ ~~~~~~/ \ ~~~~~~/ ~~~~~~~~~~~~~~~~~~~~
l l \\____/ l l / / \ \ ~~~~/ / ~~~~/ / Issue: 1
l l l l /_/ \_\ /~~~~ / /~~~~ /
~~~~ ~~~~ ~~~~~~ ~~~~~~
_____________________________________________________________________________
l Writters l Special thanks to.... l
l__________________________l________________________________________________l
l l l
l The Beaver l The Baron (For info and a place for TLH area) l
l BIOC AGENT l (hackers to call .................) l
l Mark Tabas l Pink Floyd (Same as above....................) l
l l l
l l Cool Breeze, The Highwayman, Rowag, and all l
l l former members of Chaos Control, Copy Cat l
l l (excluding Doug Ferrell), and Special Forces. l
l l Also, Gator off of UF EitherNet, Mentilist, l
l l The Nut-Kracker ,The Sysop of the Hurrican l
l l Hole, and the sysop of Warriers Retreat. l
l__________________________l________________________________________________l
* Note: We, the writters and editors, of this text newsletter are not
respossible for any injuries or prosecutions due to the information
giving in this text.
EXPERIMENT AT YOUR OWN RISK!
Anybody who is willing, can submit an article! If you wish to
submit an article, please e-mail either 'The Beaver' or the 'Nut-
Kracker', via the 'Warriers Retreat' (904)422-3606. Also, All
sysops can freely download this text in the terms that it is not
altered and none of the credits are change. So.................
please act like a human! Also, for your convience,
every now and then a 'volume' of the Critical Mass is
created. That is, after three to five issues (roughly 50k to 70k
of text) a compiled text will be made containing the past issues,
so if you have missed any issues,you can download the volume you need.
In order for this text to keep on being produced, you the reader
needs to submit, either it be by asking questions (Which will
sometime be included in the text) or by submitting and article.
Any articles on Hacking, Fone Phreaking, Credit Card Surfing,
Pirating, Chemistry, etc. our welcome. Any general 'not accepted'
material is accepted here! Articles can be on anything from 'how
to rip off this type of coke machine' to 'how to build a Axis bomb
from spare car parts'. We hope you enjoy the information given and
find some use for it.
/\
/\/\ Chief Editors Brought To You By
/\/\/\ ~~~~~~~~~~~~~ Members of
/\/\/\/\ The Beaver (SC/HA)
/\/\/\/\/\ The Nut-Kracker
/\/\/\/\/\/\
/\/Critical\/\
\/\/\Mass/\/\/ (SC/HA)
\/\/\/\/\/\/
\/\/\/\/\/
\/\/\/\/
\/\/\/
\/\/
\/
______________________________________________________________________________
l This issue contains articles of the following..... l
l____________________________________________________________________________l
l l
l I - Editorial about Critical mass, written by 'The Beaver' l
l II - Hacker DEC200 and Preformance 4000 networks, written by 'The Beaver'l
l III - Destructive Viruses, Trojans, etc for your IBM PC!, by 'The Beaver' l
l IV - Basic Telecomunication, written by 'BIOC AGENT' l
l V - Better Homes and B-Boxing, written by Mark Tabas(c) C.C.C l
l VI - Virus Scare, written by 'The Beaver' for Online Magazine. l
l VII - Virus Storys, written by 'The Beaver', for Online Magazine. l
l____________________________________________________________________________l
____________________________________________________________________________
l I. Editorial: What is Critical Mass? l
l Written By 'The Beaver' l
l__________________________________________________________________________l
I have been involved with telecomunications via modem since the age
of 13. I'm now currently 18, and still telecommunicating strong. Over the
years I have seen many changes in telecommunications in my area. When I
first started using a modem, I quickly noticed the free exchange of information
on various bulletin boards in my town. People know as 'hackers','fone phreaks',
and 'pirates' constantly exchange information. This is not the case now. All
the old boards have closed down, and the 'modem police' have arrived setting
examples for other bulletin boards in our town, except for an extreme few.
Now it seems that ever conversion on every board, except for two that I can
think of, is along the lines of 'Gee, hi bob, hows the wife and kids?'. I
usually think to myself 'WHO THE HELL CARES?' and 'Gee, it would be nice
to know of several BBS's in my town that you could comunicate freely, and
not be kicked off. I don't mean that every BBS in town, you should be able
to post up other peoples credit card numbers, but at least be a little open
minded. Well before this starts to sound like the Nut-Krackers NFSA text,
I will get to the point of why this text newsletter was created. I have
lately, as stated earlier, noticed a null in the coversions on the local
area BBS's along with a null of comunication between the hackers, pirates,
fone phreaks, etc in our area. One reason I feel is that the there aren't
that many local area hackers left along with pirates and fone phreaks (At
least fone phreaks have a reason for going a little bit under, that is
because of AT&T equipment replacing) is because the methods, and traditions
, along with basic information was never pasted on. I mean how many people
out there can honestly say that they could tell the difference between a
ANI and a customer loop in telefone terms? Can YOU set up a decoy to hack
into a system? How about a trojan horse? Can you write a virus, or have
you even seen one in action? Or maybe the question is do you care. If
your a human, odds are you do have at least a small bit of intrest. This
is who technology increases. Can you honestly tell me that computer securitys
methods would not have tight'in up if hackers, fone phreaks, virus creators,
and trojan horse creators, had never exsisted. Im not trying to imply that
it is 'ok' to create a virus, but do you really think that by not discussing
the matter and not getting information is going to help? Of course not. Any
programer who has the urge to destroy your system will do so. So basicly,
this text was written to get the young hacker/fone phreak/pirate started. If
you do not like it, so sue me. After all, it is completely legal to write
and discuss and ,yes, give detail information out on these and other issues,
so no, your not a criminal for simply downloading this text. That choice
is made when you decide how you would like to use the information given......
As for myself, I bet you can guess how I use alot of the information given.
At any rate, take it for what it worth, and I hope you enjoy the text, and
the others to follow!!! Well, lets cut the editorial short, and get some
information flowing.
______________________________________________________________________________
l II. Hacking DEC200 and Preforance 4000 network Servers l
l Written By 'The Beaver' l
l Part I l
l____________________________________________________________________________l
After vigerous, and intensive research by myself and The Nut-Kracker
(Members of SC/HA - Sterling Cracking/Hacking Association), this article was
written and contains information never disclosed in another text files,
newsletter, etc, to the best of our knowlege.
The DECserver 200 and Preformance 4000 is a popular networking
equipment used by anything from coporations to universitys system. We did
most of our 'research' illegally on the dozens of ethier networks off of
FIRN (Florida Information Resource Network (904)488-0650 - (904)488-0657) and
Tymnet. We have pretty much wore out our welcome on FIRN, but if you care to,
you can test some of the information given in this article out on some of
the DECserver 200 and Preformance 4000's on FIRN. Who knows, you may strike
it lucky!!
Basic commands by nonprivileged access.
First off, on DECsevers and Performance 4000 you are either a
privileged user or a non-privileged user. As a privileged user, you may use
commands that no normal user can use. As a privileged user, you can logout
users, set up services, initilize the system, changes the servers
charateristics, and much, much more, but first you must be know how to use
some of the more basic nonprivileged commands and you must no some of the more
basic terms. The commands with the `*`. beside them sometimes require that you
are privileged. This all depends on the servers charateristics. The short
hand for each command is written beside the commands.
Commands Terms
--------------- ----------------------
- Show users - Sho u Inactivity Timer
Show ports - Sho por Keepalive Timer
Show ports (#) - Sho por (#) Init Timer
Broadcast port - Bro por (#) Console port
- Show server - Sho serv
- Show nodes - Sho no
Connect (name) - c (service name)
Most of these commands are explain themself, but lets lets explain
them anyway.........
Commands.
-----------------------------------------------------------------------------
Show Users - Does exactly as it states, show all the users and shows
what services they are connected to.
Show Port - Shows all the charateristics of the port you are
currently connected too.
Show port (#) - Shows a specific port charateristics that can be other
than the port your own port. It can also be in the form
of 'sho por all'. This will show on a DECsever 200 all
the ports charateristics. On a performace 4000, it will
show all the ports and there current states. That is,
if they are 'connected','idle' or are in 'local' mode.
To get this effect on a DECserver 200, you type 'sho
por all brief'.
Broadcast port (#) - This will send a message to a specific port. On DECserver
200's, it poses a problem because you can interrupt a
command. So, when your typing a command and someone sends
you a message, it interrupts the command and you have to
re-type it. On Performance 4000's, this does not happen.
Show Server - Shows the servers charateristics. It shows the console
port, keepalive timers, inactivity timers, etc, of that
server.
Show Nodes - Show services that are not currently up in the service
list. Any nodes that are not in the service list is
not reachable by non-privileged users.
Connect - self explanitory
Terms
-------------------------------------------------------------------------------
Inactivity Timer - Logs ports out if no activities or connections are
created. It is usually set to 30 minutes. Thats its
default.
Keepalive Timer - Keep a port active when any illegal logout has been
done. This is usually set to 30 minutes. This is also
its default.
Init Timer - Show when the next initilization of the server will take
place. When a initilization happens, everything is
back to its default and all counters are reset to
zero. (*Note: Sometimes a you can type 'show counters'
to see there values.)
Console port - The main port where privileged is usually set under. On
a initilization, all information of the server is dumped
to the console port.
If you would like to get more help on commands or would like to learn
more commands, type 'help' at the local prompt of and DEC made server. Here
are somemore commands you need to know under a privileged port. The
non-privileged commands will still work on a privileged port. Heres the list
of what is covered.
Command list
------------------------------------------------------------------------------
Set server password (password) - set serve pass (0-32 chr$)
Set inactivity (enabled/disabled) - set inact (e/d)
Set keepalive (enabled/disabled) - set keep (e/d)
Set interrupt (enabled/disabled) - set inter (e/d)
Logout port (#) - lo por (#)
Set service (service name) (enabled/disabled) - set servi (name) (e/d)
zero (service name) - z (name)
Set node (node name) (enabled/disabled) - (none)
Commands
------------------------------------------------------------------------------
Set server password - This is used to change the privileged password. If
you care to remain a network operator, then DON'T
CHANGE IT! There are usually no logs kept of people
who have logged in, so you can stay privileged for
a LOOOOONNNNNGGGGGG time.
Set inactivity - This sets the inactivity timer. If a user is not
doing anything on a network, he will be logged out.
By disabling it, you will never be logged out for
not doing anything.
Set keepalive - This keeps 'alive' a port if it is logged out. Not
to be confused with the inactivity timer. This keeps
a session active after logoffs.
Set interrupt - This makes it so that you can 'interrupt' sessions
to broadcast a message. You can set your interrupts
as a non-privileged user, but you can't set other
peoples interrupts. To set some other port besides
your port , you would type 'set inter por (#) enabled'.
Logout port (#) - With non-privileged access you just type 'lo' or
'logout', but with a privileged access you can logout
other members on the network. If you want to play with
being a network operator, then don't do this. I only
did it when I was busted by another user, and then
I wouldn't let them back on the network while I was
on.
Set service - This disables/enables so other user can use them.
You can also disable services for specific ports
like thus, 'set servi (service name) por (#) disabled'.
Zero (Name) - This takes down services (fake or real, explained
later on) and takes them off the service the service
list and puts them in the node list (if there real
services) to where non-privileged users cannot access
them.
Set node - This command sets up 'nodes' as 'services' so you
access them. Sometimes in the node list, there are
sometimes nodes nobody is allowed to have access to.
This changes that. You can also set up nodes so only
certain ports can access them by typing 'set node
(node name) por (#) (enabled/disabled). Actually there
is probably a short hand way of doing this, but I
remember the format. Its probably something like 'set
no', or 'set nod'.
Ok, now that we have discussed some basic terms and operations (thanks
to all the people who know all this, and had to bare through it) now we can
talk about basic hacking information.
DECserver and 4000 Default password.
On most DECserver and 4000's, when the network is set up, the operator
is given a default password. That is, the are given a password that all DEC
servers and 4000's are given. It is the network operator that must change it,
but the majority they leave it as there default. Beside 'who would want to hack
a network sever anyway?'. Actually, there are many, many advantages in hacking
network servers. I have only been on two DECserver 200 that had already change
there default before I got there. Thats out of 14 servers. Hell thats a 2:14
ratio! I got into a companys network in boston via tymnet using a default!!
The odds that the default hasn't been changed! My guess is that since the
network doesn't have to be accessed as an operator, and since the network
pretty much runs itself, nobody really notices whats going on on the the
net. I advise that the first thing you do 'define' the password. That is,
when you 'set' a function, it is only set till you logout, but if you define
a function, it will change it the next time the system is initilized. You see,
if you set the servers password, then it is set for that call, but as soon
as you disconnect it is changed back to its original value. If you define
it, it will change only when the server is initilized. So as soon as you
get on, set the inactivity to disabled, so you have as much time as you want
to play with the system, and type.......
define serv password system
If you got the network operations password by some other means, then
replace the word 'system' with the password you got in under. This command
will only work if you are already privileged, natually. To become privileged
you type.....
set privileged (*Short hand:set priv)
password: (used the default first, and you will probably have access as network
operations)
so........type......
password:system
After this, define it as the password you got in on. The reason is
that most servers automaticly initilizes itself, so if you caught, in a
month or so, when the system is initilize, the password will change back to
the old password you got in under! Odds are that they won't notice for months!
Everytime you get access on the system after you get kicked off, repeat this
process. My guess would be that you can stay as a network operator for 6 months
to a year by getting caught or not!
Setting up loops
Loops can be used for a varity of reasons, if it be security or for
the 'fallinf in' method. Here is an example of a loop. We'll call the nets
A, B, and C. The first example will use only A and B. For this example we
will say that all these are DECserver 200's just to keep to simple. Let me
note that it doesn't have to be only a DEC200 that loops will work on. These
have been choose to keep the example simple......Heres the first, starting
at A.
DEC 'A' --------------------> DEC 'B' --l
l l l
l l<----------------------------------l
l
l----------------------------> To Your desired service.
Here's the second.......
DEC 'A' -------------------> DEC 'B' --l
l
---- DEC 'C' <----------------l
l
l------------------> To your desired service.
If you are caught by a system operators under a loop, they will be lead
all over the network (you can loop as many times as you like). The one
problem I found with loops was that there is a delay in transmissions of data
because of all the networks it is being sent though. I usually don't worry to
much about loops, but it can be handy for falling in (mentioned later in text).
Heres two example of what loops would look like if you started at A.........
DECserver 200 Terminal Server V2.0 (BL29) - LAT V5.1
Please type HELP if you need assistance
Local>connect B
Session established to B
DECserver 200 Terminal Server V2.0 (BL29) - LAT V5.1
Please type HELP if you need assistance
Local>connect A
Session established to A
DECserver 200 Terminal Server V2.0 (BL29) - LAT V5.1
Local>(from here your looped once, yuo can either do this process again or
continue from here)
Heres an example of the secound example........
DECserver 2000 Terminal Server V2.0 (BL29) - LAT V5.1
Please type HELP if you need assistance
Local>connect B
Session established to B
DECserver 200 Terminal Server V2.0 (BL29) - LAT V5.1
Please type HELP if you need assistance
Local>connect C
Etc,Etc, They may not look to different, but they are........
(Note:You do not have to be privileged to preform a loop)
Falling in Behind users.....
This method is good for getting a 'peek' at a system you need to want
to get into. If a witty programer uses this method, he may be able to set up
a trojan horse, but the problem is is that when you logout under an account
that you 'fall in' behind, you will more than likely to be never be able to
get in on that account ever again. Let me explain. On networks, when you
log on from a certain region, you will get the same port always, unless that
port is already taken, in which you are re-routed to a port that is open.
Above I explained the opertation of the keepalive timer, this is where we take
advantage of it. Lets say, in theory, you call (or routed via another network
) to a DECserver (either it be a DEC200 or 4000) as somebody illegally logged
out, by say, hanging up without typing 'logout' or what not. As they logout
, the keepalive timer keeps there session open and active. If by luck you
happen to get the port just as they logout (within the timers limits), you
would fall into there session. That is, the keepalive timer keeps the session
they logged out under and you go on right as they hang up and instead of
getting the DECserver you get another prompt of they system that was perviously
being used. Believe it or not, this can happen. Both with luck and skill. I
have had this happen several times not knowing what happened, but still the
odds are against you. You will be happy to know that with a little skill,
patents and using loops, this can be done. The only problem is, as I stated
before, is that when you logout, you lose that account. One time I used this
method and found myself on a VAX under VMS. I was under someones account using
someones password. The easy part is finding the username your under, but you
still don't have the password! So, Im sitting in this system and I think
'hey, no big deal, I will change the password so that I can use it for several
days?'. What I had forgotten was that it asks for the old password in order
to change it to a new one. It does get frustrating to be sitting inside of
a system and know the secound you disconnect, its gone, but you can gain alot
still. If you try to change the password, your back to password hacking again.
Let me attempt to explain what happens and how to use this method. In order
to understand, you must understand loops.......the example networks I will
use is A and B, we will make them both DEC preformance 4000's in this case
(*Note: it is not always nessasary for them to be DEC servers)
We will start at network A first. This method is easier if you are
accessed as a privileged user. If you are privileged, the first thing you
want to do is set you inactivity to disabled so you have plenty of time. If
you don't, the don't worry about this. Now you need to show you port (sho por)
to see what port your in, after this write down what the results where. Now
we start the loop. Now we would connect to B. When we got onto B we would
show the port again and write down the results again. Next we would connect
back to port A again (we will be under a different port) and show the port
again and write down the results. From here we would logout of A and now
be put on B. It would be extremely helpful to set your inactivity to disabled
here also. Now re-connect to A again , and write down the port you in. You
should be on the same port you logged into the first time unless someone has
logged onto the port before you. Thats why I suggest you do this late at night
when nobody is on yet. Now we know what port you always get logged into
from B to A. Now you wait till someone logs onto the port you always get on
when you login from B to A. To do this, log back onto A every once and a while
and check your port. If you get logged onto a port a different port, show the
users and see who is on your port, and what they are connected too. Now we
wait even more and do some praying inbetween. We pray that the user will
illegally logout. This is common, because normal users find it a hassle to
type in 'logout' so usually they will simply hang up. When someone does
finnally log onto the port you always get, we wait and simply log onto A from
B and see if where in. If we are not, then we sho the users to make sure
the user hasn't properly logout. Heres what happens graphicly..........
User --------- DEC A ---------------- To Session
Us --------> DEC A -------> DEC B ------l
l l
l<------------------------l
In this case it didn't work.... Heres when it does work.......
User l-> DEC A ----------------- To Sesion
l
l------------ DEC B
l
Us --------> DEC A ------>l
Confusing Huh?, if this didn't cover it to where you can understand
E-mail me and I will gladly answer any questions...........
A Trap Door......
On A DEC server, The Nut-Kracker and I hit ona trap door (also called
a back door). Actually , it is an error in the DECserver software. Im not sure
if it works on Preformance 4000's but on some DECservers that are working on
a VAX that also runs other operations, it does seem to work. What happened
was that I was on a DEC200 and I wasn't to worried about lossing privileged
access. So I set myself up as a network operator and began re-initilizing
the system. I noticed that there was a console port so I begain to get help
on setting up ports as consoles. It told me that if I were a ture console that
it would give me a downline dump of all data on the server. Well naturally I
wasn intrested in this dump, just to see what it would give me. So I set my
port up as a console (set console port (#) enabled) and proceeded
initializing the system. It didn't send me a down line dump but instead booted
me off! I tried to reconnect several times, but it wouldn't let me do so until
about two minutes later, but instead of getting a local prompt I got a '