💾 Archived View for aphrack.org › issues › phrack68 › 4.gmi captured on 2021-12-03 at 14:04:38. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
==Phrack Inc.==
Volume 0x0e, Issue 0x44, Phile #0x04 of 0x13
|=-----------------------------------------------------------------------=|
|=-----------------------=[ L I N E N O I S E ]=-----------------------=|
|=-----------------------------------------------------------------------=|
|=-------------------------=[ various ]=-------------------------=|
|=-----------------------------------------------------------------------=|
Linenoise iz back! The last one was in Issue 0x3f (2005 ffs) and since we
had great short and sweet submissions we thought it was about time to
resurrect it. After all, "a strong linenoise is key" ;-)
So, dear hacker, enjoy a strong Linenoise.
--[ Contents
1 - Spamming PHRACK for fun and profit -- darkjoker
2 - The Dangers of Anonymous Email -- DangerMouse
3 - Captchas Round 2 -- PHRACK PHP
CoderZ Team
4 - XSS Using NBNS on a Home Router -- Simon Weber
5 - Hacking the Second Life Viewer For Fun and Profit -- Eva
6 - How I misunderstood digital radio -- M.Laphroaig
7 - The 1130 Guide to Growing High-Quality Cannabis -- 1130
|=[ 0x01 ]=---=[ Spamming PHRACK for fun & profit - darkjoker ]=---------=|
In this paper I'd like to explain how a captcha can be bypassed without
problems with just a few lines of C. First of all we'll pick a captcha to
bypass, and, of course, is there any better captcha than the one of this
site? Of course not, so we'll take it as example. You may have noticed
that there are many different spam messages in the comments of the
articles, which means that probably someone else has already bypassed the
captcha but, instead of writing an article about it, decided to spend his
time posting spam all around the site. Well, I hope that this article will
also be taken into account to make the decision to change captcha, because
this one is really weak.
First of all we're going to download some captchas, so that we'll be able
to teach our bot how to recognise a random captcha. In order to download
some captchas i've written this PHP code:
<?php
mkdir ("images");
for ($i=0;$i<200;$i++)
file_put_contents ("images/{$i}.jpg",file_get_contents
("http://www.phrack.com/captcha.php"));
?>
We're downloading 200 captchas, which should be enought. Ok, once we'll
have downloaded all the images we can proceed, cleaning the images (which
means we're going to remove the "noise". In these captchas the noise is
just made of some pixel of a lighter blue than the one used to draw the
letters. Well, it's kind of a mess to work with JPEG images, so we'll
convert all the images in PPM, which will make our work easier.
Luckily under Linux there's a command which makes the conversion really
easy and we won't need to do it manually:
convert -compress None input.jpg output.ppm
Let's do it for every image we have:
<?php
mkdir ("ppm");
for ($i=0;$i<200;$i++)
system ("convert -compress None images/{$i}.jpg ppm/{$i}.ppm");
?>
Perfect, now we have everything we need to proceed. Now, as I said
earlier, we've to remove the noise. That's a function which will load an
image and then removes the noise:
void load_image (int v) {
char img[32],line[1024];
int n,i,d,k,l,s;
FILE *fp;
sprintf (img, "ppm/%d.ppm",v);
fp = fopen (img, "r");
do
fgets (line, sizeof(line),fp);
while (strcmp (line, "255\n"));
i=0;
d=0;
k=0;
int cnt=0;
while (i!=40) {
fscanf (fp,"%d",&n);
captcha[i][d][k]=(char)n;
k++;
if (k==3) {
k=0;
if (d<119)
d++;
else {
i++;
d=0;
}
}
}
}
Ok, this piece of code will load an image into 'captcha', which is a 3
dimensional array (rows*cols*3 bytes per color). Once the array is loaded,
using clear_noise () (written below) the noise will be removed.
void clear_noise () {
int i,d,k,t,ti,td;
char n[3];
/* The borders are always white */
for (i=0;i<40;i++)
for (k=0;k<3;k++) {
captcha[i][0][k]=255;
captcha[i][119][k]=255;
}
for (d=0;d<120;d++)
for (k=0;k<3;k++) {
captcha[0][d][k]=255;
captcha[39][d][k]=255;
}
/* Starts removing the noise */
for (i=0;i<40;i++)
for (d=0;d<120;d++)
if (captcha[i][d][0]>__COL && captcha[i][d][1]>__COL &&
captcha[i][d][2]>__COL)
for (k=0;k<3;k++)
captcha[i][d][k]=255;
for (i=1;i<39;i++) {
for (d=1;d<119;d++) {
for (k=0,t=0;k<3;k++)
if (captcha[i][d][k]!=255)
t=1;
if (t) {
ti=i-1;
td=d-1;
for (k=0,t=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td=d-1;
ti=i;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td+=2;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td=d-1;
ti=i+1;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
if (t/3<=__MIN)
for (k=0;k<3;k++)
captcha[i][d][k]=255;
}
}
}
}
Well, what does this function do? It's really easy, first of all it clears
all the borders (because we know by looking at the downloaded images that
the borders never contain any character). Once the borders are cleaned,
the second part of the routine will remove all the light blue pixels,
turning them into white pixels. This way we'll obtain an almost perfect
image. The only issue is that there are some pixels which are as dark as
the ones which composes the characters, so we can't remove them with the
method explained above, we'll have to create something new. My idea was to
"delete" all the pixels which have no blue pixels near them, so that the
few blue pixels which doesn't compose the letters will be deleted. In
order to make the image cleaner I decided to delete all the pixels which
doesn't have at least 3 pixels near them. You may have noticed that __COL
and __MIN are not defined in the source above, these are two numbers:
#define __COL 0x50
#define __MIN 4*3
__COL is a number I used when I delete all the light blue pixels, I use it
in this line:
if (captcha[i][d][0]>__COL && captcha[i][d][1]>__COL &&
captcha[i][d][2]>__COL)
In a few words, if the pixel is lighter than #505050 then it will be
deleted (turned white). __MIN is the minimum number of conterminous pixels
under which the pixel is deleted. The values where obtained after a few
attempts.
Perfect, now we have a piece of code which loads and clears a captcha. Our
next goal is to split the characters so that we'll be able to recognise
each of them. Before doing all this work we'd better start working with 2
dimensional arrays, it'll make our work easier, so I've written some lines
which makes this happen:
void make_bw () {
int i,d;
for (i=0;i<40;i++)
for (d=0;d<120;d++)
if (captcha[i][d][0]!=255)
bw[i][d]=1;
else
bw[i][d]=0;
}
This simply transforms the image in a black and white one, so that we can
use a 2 dimensional array. Now we can proceed splitting the letters.
In order to get the letters divided we are supposed to obtain two pixels
whose coordinates are the ones of the upper left corner and the lower right
corner. Once we have the coordinates of these two corners we'll be able to
cut a rectangle which contains a character.
Well, we're going to begin scanning the image from the left to the right,
column by column, and every time we'll find a black pixels in a column
which is preceded by an entire-white column, we'll know that in that column
a new character begins, while when we'll find an entire-white column
preceded by a column which contains at least one black pixel we'll know
that a character ends there.
Now, after this procedure is done we should have 12 different numbers which
represents the columns where each character begins and ends. The next step
is to find the rows where the letter begins and ends, so that we can obtain
the coordinates of the pixels we need. Let's call the column where the Xth
character begins CbX and the column where the Xth character ends CeX. Now
we'll start our scan from the top to the bottom of the image to find the
upper coordinate and from the bottom to the top to find the lower
coordinate.
This time, of course, the scan will be done six times using as limits the
columns where each character is contained between.
When the first row which contains a pixel is found (let's call this row
RbX) the same thing will be done to find the lower coordinate. The only
difference will be that the scan will begin from the bottom, that's done
this way because some characters (such as the 'j') are divided into two
parts, and if the scan was done only from the bottom to the end the result
would have been just a dot instead of the whole letter.
After having scanned the image from the bottom to the top we'll have
another row where the letter ends (or begins from the bottom), we'll call
this row ReX (of course we're talking about the Xth character).
Now we know which are the horizontal and vertical coordinates of the two
corners we're interested in (which are C1X(CbX,RbX) and C2X(CeX,ReX)), so
we can procede by filling a (CeX-CbX)*(ReX-RbX) matrix which will contain
the Xth character. Obviously the matrix will be filled with the bits of the
Xth character.
void scan () {
int i,d,k,j,c,coord[6][2][2];
for (d=0,j=0,c=0;d<120;d++) {
for (i=0,k=0;i<40;i++)
if (bw[i][d])
k=1;
if (k && !j) {
j=1;
coord[c][0][0]=d;
}
else if (!k && j) {
j=0;
coord[c++][0][1]=d;
}
}
for (c=0;c<6;c++) {
coord[c][1][0]=-1;
coord[c][1][1]=-1;
for (i=0;(i<40 && coord[c][1][0]==-1);i++)
for (d=coord[c][0][0];d<coord[c][0][1];d++)
if (bw[i][d]) {
coord[c][1][0]=i;
break;
}
for (i=39;(i>=0 && coord[c][1][1]==-1);i--)
for (d=coord[c][0][0];d<coord[c][0][1];d++)
if (bw[i][d]) {
coord[c][1][1]=i;
break;
}
for (i=coord[c][1][0],j=0;i<=coord[c][1][1];i++,j++)
for (d=coord[c][0][0],k=0;d<coord[c][0][1];d++,k++)
chars[c][j][k]=bw[i][d];
dim[c][0]=j;
dim[c][1]=k;
}
}
Ok, now, using this function we're going to obtain all the characters
splitted into an array of 2 dimension arrays. The next step will be the
most boring, because we're going to divide all the characters by hand, so
that the program, after our work, will be able to recognise all of them and
learn how each character is made. Before that, we need a new directory
which will contain all the characters. A simple 'mkdir chars' will do.
Now we have to fill the directory with the characters. Here's a main
function whose goal is to divide all the captchas into characters and put
them in the chars/ directory.
int main () {
int i,d,k,c,n;
FILE *x;
char path[32];
for (n=0,k=0;n<200;n++) {
load_image (n);
clear_noise ();
make_bw ();
scan ();
for (c=0;c<6;c++,k++) {
sprintf (path,"chars/%d.ppm",k);
x=fopen (path,"w");
fprintf (x,"P1\n#asdasd\n\n%d %d\n",dim[c][1],dim[c][0]);
for (i=0;i<dim[c][0];i++) {
for (d=0;d<dim[c][1];d++)
fprintf (x,"%d",chars[c][i][d]);
fprintf (x,"\n");
}
fclose (x);
}
}
return 0;
}
Very well, now the chars/ directory contains all the files we need. Now it
comes the part where the human is supposed to divide the characters in the
right directories. To make this work faster I've used a simple PHP script
which helps a little:
<?php
$in=fopen ("php://stdin","r");
mkdir ("c");
for ($i=0;$i<26;$i++)
mkdir ("c/".chr(ord('a')+$i));
for ($i=0;$i<10;$i++)
mkdir ("c/".chr(ord('0')+$i));
for ($i=54;$i<1200;$i++) {
echo $i.": ";
$a = trim(fgets ($in,1024));
if ($a!='.')
system ("cp chars/{$i}.ppm c/{$a}/{$i}.ppm");
}
fclose ($in);
?>
I think there's nothing to be explained, it's just a few lines of code.
After the script is runned and someone (me) enters all the data needed
we're going to have a c/ directory with some subdirectories in which there
are all the characters divided.
Some characters ('a','e','i','o','u','l','0','1') never appear, which means
that probably the author of the captcha decided not to include these
characters.
Anyway that's not a problem for us. Now, we should work out a way to make
our program recognise a character. My idea was to divide the image in 4
parts (horizontally), and then count the number of black (1) pixels in each
part, so that when we have an unknown character all our program will be
supposed to do is to count the number of black pixels for each part of the
image, and then search the character with the closest number of black
pixels. I've tried to do it but I haven't kept into account that some
characters (such as 'q' and 'p') have a similar number of pixels for each
part, even though they're completely different.
After having realised that, I decided to use 8 parts to divide each
character: 4 parts horizontally, then each part is divided in other 2 parts
vertically.
Well, of course there's no way I could have done that by hand, and in fact
I've written a PHP script:
<?php
error_reporting (E_ALL ^ E_NOTICE);
$f = array (4,2,4/3,1);
$arr=array ('b','c','d','f','g','h','j','k','m','n','p','q','r','s','t',
'v','w','x','y','z','2','3','4','5','6','7','8','9');
$h = array ();
for ($a=0;$a<count($arr);$a++) {
$i = $arr[$a];
$x = array ();
$files = scandir ("c/{$i}");
for ($d=0;$d<count($files);$d++) {
if ($files[$d][0]!='.') { // Excludes '.' and '..'
$lines=explode ("\n",file_get_contents ("c/{$i}/{$files[$d]}"));
for ($k=0;$k<4;$k++)
array_shift ($lines);
array_pop ($lines);
$j = count ($lines);
$k = strlen ($lines[0]);
$r=0;
$h[$a] += $j;
if ($files[$d]=="985.ppm") {
for ($n=0;$n<4;$n++)
for (;$r<floor ($j/$f[$n]);$r++) {
for ($l=0;$l<floor($k/2);$l++)
$x[$n][0]+=$lines[$r][$l];
for (;$l<floor($k);$l++)
$x[$n][1]+=$lines[$r][$l];
}
print_r ($x);
}
}
}
$h [$a] = round ($h[$a]/(count($files)-2));
for ($n=0;$n<4;$n++) {
$x[$n][0] = round ($x[$n][0]/(count($files)-2));
$x[$n][1] = round ($x[$n][1]/(count($files)-2));
}
printf ("$i => %02d %02d %02d %02d / %02d %02d %02d %02d\n",$x[0][0],
$x[1][0],$x[2][0],$x[3][0],$x[0][1],$x[1][1],$x[2][1],$x[3][1]);
}
for ($i=0;$i<count ($arr);$i++)
echo "{$h[$i]}, ";
?>
It works out the average number of black pixels for each part. Moreover it
also prints the average height of each character (I'm going to explain the
reason of this below).
A character such as a 'z' is divided this way:
01111 111110
11111 111111
11111 111111
01111 111111
00000 111110
00000 111110
00000 111100
00001 111100
00001 111000
00011 110000
00011 110000
00111 100000
00111 111110
01111 111111
01111 111111
00111 111110
So the numbers (of the black pixels) in this case will be:
18 23
1 18
8 8
14 22
Well, once taken all these numbers from each character the PHP script
written above works out the average numbers for each character. In the
'z', for example, the average numbers are:
18 20
3 15
11 7
17 20
Which are really close to the ones written above (at least, they're closer
than the ones of the other characters). Now the last step is to do the
comparison between the character of the captcha we want our program to read
and the numbers we've stored. To do so we first need to make the program
count the number of black pixels of a character, and save the numbers
somewhere so that it'll be possible to do the comparison. read_pixels ()'s
aim is exactly to do that, using the same method used above in the PHP
script.
void read_pixels (int c) {
int i,d,k,r;
float arr[]={4,2,1.333333,1};
memset (bpix,0,8*sizeof(int));
for (k=0,i=0;k<4;k++) {
for (;i<(int)(dim[c][0]/arr[k]);i++) {
for (d=0;d<dim[c][1]/2;d++)
bpix[k][0] += chars[c][i][d];
for (;d<dim[c][1];d++)
bpix[k][1] += chars[c][i][d];
}
}
}
The next step is to compare the numbers, that's what the cmp () function is
supposed to do:
char cmp (int c) {
int i,d;
int err,n,min,min_i;
read_pixels (c);
for (i=0,min=-1;i<28;i++) {
n=abs(heights[i]-dim[c][0])*__HGT;
for (d=0;d<4;d++) {
n += abs(bpix[d][0]-table[i][0][d]);
n += abs(bpix[d][1]-table[i][1][d]);
}
if (min>n || min<0) {
min=n;
min_i = i;
}
}
return ch_list[min_i];
}
'table' is an array in which all the average numbers worked out before are
stored. As you can see there's a final number (n) which is the sum of a
number obtain in this way:
n += |x-y)
Where 'x' is the number of black pixels of each part of the character we
want to read, while 'y' is the average number of the character we're
comparing the character we want to read with. The smaller the resulting
number is, the closer to that character. I firstly thought that the
algorithm I used would have been good enough, but I soon realised that
there were too many "misunderstandings" while the program was trying to
read some characters (such as the 'y's, which were usually read as 'v's).
So I decided to make the final number also influenced by the height of the
character, so that a 'v' and a 'y' (which have different heights) can't be
misunderstood.
Before this change the program couldn't recognise 17 characters out of
1200. Then, after some tests, I found that by adding the difference of the
heights times a costant, the results were better: 3 wrong characters out of
1200.
n = |x-y|*k
Where 'x' is the height of the character we want to read while 'y' is the
height of the character we're comparing the character we want to read
with.
The costant (k) was calculated by doing some attempts, and finally it was
given the value 1.5. Now everything's ready, the last function I've
written is read_captcha () which will return the captcha's string.
char *read_captcha (char *file) {
char *str;
int i;
str = malloc(7*sizeof(char));
load_image (file);
clear_noise ();
make_bw ();
scan ();
for (i=0;i<6;i++)
str[i]=cmp(i);
str[i]=0;
return str;
}
And.. Done :) Now we can make our program read a captcha without any
problem. Now I should be supposed to code an entire spam bot, but, since
it requires some tests I think it wouldn't be good to post random comments
all around phrack, so my article finishes here.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define __COL 80
#define __MIN 4*3
#define __HGT 1.5
unsigned char captcha[40][120][3];
unsigned char bw[40][120];
unsigned char chars[6][40][30];
int dim[6][2];
int bpix[4][2];
int heights[] = {
23, 16, 23, 23, 22, 23, 29,
23, 16, 16, 22, 22, 16, 16,
20, 16, 16, 16, 21, 16, 23,
24, 23, 23, 23, 23, 24, 24 };
char ch_list [] = "bcdfghjkmnpqrstvwxyz23456789";
int table [28][2][4]= {
{ {18, 28, 26, 28}, { 0, 20, 25, 29}},
{ {10, 17, 17, 10}, {21, 1, 1, 20}},
{ { 0, 20, 25, 29}, {18, 31, 26, 31}},
{ {10, 24, 18, 17}, {23, 12, 6, 5}},
{ {21, 25, 20, 8}, {28, 25, 29, 27}},
{ {18, 28, 25, 22}, { 0, 20, 25, 22}},
{ { 1, 9, 0, 14}, {13, 27, 28, 25}},
{ {18, 24, 30, 22}, { 0, 15, 21, 23}},
{ {24, 21, 20, 17}, {21, 25, 24, 20}},
{ {17, 18, 16, 14}, {20, 17, 16, 14}},
{ {27, 25, 29, 22}, {24, 25, 25, 0}},
{ {25, 25, 24, 0}, {27, 25, 29, 22}},
{ {14, 16, 15, 13}, {19, 2, 0, 0}},
{ {15, 16, 2, 9}, {12, 4, 18, 17}},
{ {15, 20, 15, 12}, { 5, 10, 5, 19}},
{ {13, 17, 15, 11}, {14, 14, 14, 10}},
{ { 9, 17, 20, 13}, {12, 18, 22, 14}},
{ { 9, 11, 11, 13}, {12, 13, 13, 12}},
{ {15, 19, 14, 14}, {16, 20, 15, 9}},
{ {18, 3, 11, 17}, {20, 15, 7, 20}},
{ {21, 4, 8, 24}, {21, 26, 19, 24}},
{ {16, 0, 6, 24}, {29, 23, 25, 28}},
{ { 5, 12, 23, 5}, {23, 24, 32, 24}},
{ {23, 25, 10, 20}, {18, 12, 26, 23}},
{ { 3, 21, 28, 24}, {16, 15, 30, 27}},
{ {18, 1, 11, 20}, {27, 24, 14, 3}},
{ {25, 24, 26, 23}, {28, 26, 28, 28}},
{ {20, 27, 16, 16}, {25, 26, 28, 9}} };
void clear () {
int i,d,k;
for (i=0;i<40;i++)
for (d=0;d<120;d++)
for (k=0;k<3;k++)
captcha[i][d][k]=0;
for (i=0;i<40;i++)
for (d=0;d<120;d++)
bw[i][d]=0;
for (i=0;i<6;i++)
for (d=0;d<40;d++)
for (k=0;k<30;k++)
chars[i][d][k]=0;
for (i=0;i<6;i++)
for (d=0;d<2;d++)
dim[i][d]=0;
}
int numlen (int n) {
char x[16];
sprintf (x,"%d",n);
return strlen(x);
}
void load_image (char *img) {
char line[1024];
int n,i,d,k,l,s;
FILE *fp;
fp = fopen (img, "r");
do
fgets (line, sizeof(line),fp);
while (strcmp (line, "255\n"));
i=0;
d=0;
k=0;
int cnt=0;
while (i!=40) {
fscanf (fp,"%d",&n);
captcha[i][d][k]=(char)n;
k++;
if (k==3) {
k=0;
if (d<119)
d++;
else {
i++;
d=0;
}
}
}
}
void clear_noise () {
int i,d,k,t,ti,td;
char n[3];
/* The borders are always white */
for (i=0;i<40;i++)
for (k=0;k<3;k++) {
captcha[i][0][k]=255;
captcha[i][119][k]=255;
}
for (d=0;d<120;d++)
for (k=0;k<3;k++) {
captcha[0][d][k]=255;
captcha[39][d][k]=255;
}
/* Starts removing the noise */
for (i=0;i<40;i++)
for (d=0;d<120;d++)
if (captcha[i][d][0]>__COL && captcha[i][d][1]>__COL &&
captcha[i][d][2]>__COL)
for (k=0;k<3;k++)
captcha[i][d][k]=255;
for (i=1;i<39;i++) {
for (d=1;d<119;d++) {
for (k=0,t=0;k<3;k++)
if (captcha[i][d][k]!=255)
t=1;
if (t) {
ti=i-1;
td=d-1;
for (k=0,t=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td=d-1;
ti=i;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td+=2;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td=d-1;
ti=i+1;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
td++;
for (k=0;k<3;k++)
if (captcha[ti][td][k]!=255)
t++;
if (t<__MIN)
for (k=0;k<3;k++)
captcha[i][d][k]=255;
}
}
}
}
void make_bw () {
int i,d;
for (i=0;i<40;i++)
for (d=0;d<120;d++)
if (captcha[i][d][0]!=255)
bw[i][d]=1;
else
bw[i][d]=0;
}
void scan () {
int i,d,k,j,c,coord[6][2][2];
for (d=0,j=0,c=0;d<120;d++) {
for (i=0,k=0;i<40;i++)
if (bw[i][d])
k=1;
if (k && !j) {
j=1;
coord[c][0][0]=d;
}
else if (!k && j) {
j=0;
coord[c++][0][1]=d;
}
}
for (c=0;c<6;c++) {
coord[c][1][0]=-1;
coord[c][1][1]=-1;
for (i=0;(i<40 && coord[c][1][0]==-1);i++)
for (d=coord[c][0][0];d<coord[c][0][1];d++)
if (bw[i][d]) {
coord[c][1][0]=i;
break;
}
for (i=39;(i>=0 && coord[c][1][1]==-1);i--)
for (d=coord[c][0][0];d<coord[c][0][1];d++)
if (bw[i][d]) {
coord[c][1][1]=i;
break;
}
for (i=coord[c][1][0],j=0;i<=coord[c][1][1];i++,j++)
for (d=coord[c][0][0],k=0;d<coord[c][0][1];d++,k++)
chars[c][j][k]=bw[i][d];
dim[c][0]=j;
dim[c][1]=k;
}
}
void read_pixels (int c) {
int i,d,k,r;
float arr[]={4,2,1.333333,1};
memset (bpix,0,8*sizeof(int));
for (k=0,i=0;k<4;k++) {
for (;i<(int)(dim[c][0]/arr[k]);i++) {
for (d=0;d<(int)(dim[c][1]/2);d++)
bpix[k][0] += chars[c][i][d];
for (;d<dim[c][1];d++)
bpix[k][1] += chars[c][i][d];
}
}
}
char cmp (int c) {
int i,d;
int err,n,min,min_i;
read_pixels (c);
for (i=0,min=-1;i<28;i++) {
n=abs(heights[i]-dim[c][0])*__HGT;
for (d=0;d<4;d++) {
n += abs(bpix[d][0]-table[i][0][d]);
n += abs(bpix[d][1]-table[i][1][d]);
}
if (min>n || min<0) {
min=n;
min_i = i;
}
}
return ch_list[min_i];
}
char *read_captcha (char *file) {
char *str;
int i;
str = malloc(7*sizeof(char));
load_image (file);
clear_noise ();
make_bw ();
scan ();
for (i=0;i<6;i++)
str[i]=cmp(i);
str[i]=0;
return str;
}
int main (int argc, char *argv[]) {
printf ("%s\n",read_captcha ("test.ppm"));
return 0;
}
Oh, if you want to have some fun and the staff is so kind as to leave
captcha.php (now captcha_old.php) you can run this PHP script:
<?
file_put_contents ("a.jpg",file_get_contents
("http://www.phrack.com/captcha_old.php"));
system ("convert -compress None a.jpg test.ppm");
system ("./captcha");
?>
I'm done, thanks for reading :)!
darkjoker - darkjoker93 _at_ gmail.com
|=[ 0x02 ]=---=[ The Dangers of Anonymous Email - DangerMouse ]=---------=|
In this digital world of online banking, and cyber relationships there
exists an epidemic. This is known simply as SPAM.
The war on spam has been costly, with casualties on both sides. However
finally mankind has developed the ultimate weapon to win the war...
email anonymizers!
Ok, so maybe this was a bit dramatic, but the truth is people are
getting desperate to rid themselves of the gigantic volumes of
unsolicited email which plagues their inbox daily. To combat this problem
many internet users are turning to email anonymizing services such as
Mailinator [1].
Sites like mailinator.com provide a domain where any keyword can be
created and appended as the username portion of an email address.
So for example, if you were to choose the username "trustno1", the email
address trustno1@mailinator.com could be used. Then the mailbox can be
accessed without a password at http://trustno1.mailinator.com. There is
no registration required to do this, and the email address can be created
at a whim. Obviously this can be used for a number of things. From a
hackers perspective, it can be very useful to quickly create an anonymous
email address whenever one is needed. Especially one which can be checked
easily via a chain of proxies. Hell, combine it with an anonymous visa
gift card, and you've practically got a new identity.
For your typical spam adverse user, this can be an easy way to avoid
dealing with spam. One of the easiest ways to quickly gain an inbox
soaked in spam is to use your real email address to sign up to every
shiney new website which tickles your fancy. By creating a mailinator
account and submitting that instead, the user can visit the mailinator
website to retrieve the sign up email. Since this is not the users
regular email account, any spam sent to it is inconsequential.
The flaw with this however, is that your typical user just isn't
creative enough to work with a system designed this way. When creating
a fresh anonymous email account for a new website a typical users
thought process goes something like this:
a) Look up at URL for name of site
b) Append said name to mailinator domain
c) ???
d) Profit
This opens up a nice way for the internet's more shady characters to
quickly gain access to almost any popular website via the commonly
implemented "password reset" functionality.
But wait, you say. Surely you jest? No one could be capable of such
silly behavior on the internet!
Alas... Apparenly Mike & Debra could.
"An email with instructions on how to access Your Account has been sent to
you at netflix@mailinator.com"
"Netflix password request
"Dear Mike & Debra,
We understand you'd like to change your password. Just click here and
follow the prompts. And don't forget your password is case sensitive."
;) ?
At least security folk would be immune to this you say! There's no way
that gmail@mailinator.com would allow one to reset 2600LA's mailing list
password...
As you can imagine it's easy to wile away some time with possible
targets ranging from popular MMO's to banking websites. Just make sure
you use a proxy so you don't have to phone them up and give them their
password back... *cough*
Have fun! ;)
--DangerMouse <Phrack@mailinator.com>
P.S. With the rise in the popularity of social networking websites
mailinator felt the need to go all web 2.0 by including a fancy list of
people who "Like" mailinator on Facebook. AKA a handy target list for a
bored individual with scripting skillz.
References:
[1] Mailinator: http://www.mailinator.com
[2] Netflix: http://www.netflix.com
|=[ 0x03 ]=---=[ Captchas Round 2 - phpc0derZ@phrack.org ]=--------------=|
[ Or why we suck even more ;> ]
Let's face it, our lazyness got us ;-) So what's the story behind our
captcha? Ironically enough, the original script is coming from this URL:
http://www.white-hat-web-design.co.uk/articles/php-captcha.php <-- :)))))))
8<----------------------------------------------------------------------->8
<?php
session_start();
/*