💾 Archived View for aphrack.org › issues › phrack53 › 3.gmi captured on 2022-03-01 at 15:48:52. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
---[ Phrack Magazine Volume 8, Issue 53 July 8, 1998, article 03 of 15
-------------------------[ P H R A C K 5 3 L I N E N O I S E
--------[ Various
0x1>-------------------------------------------------------------------------
On not being a moron in public
- nihilis
(In response to why cantor kick-banned someone off of #Phrack
without warning:
<cantor:#phrack> you were an idiot near me
<cantor:#phrack> i hate that)
I wouldn't think normally that this is an article which needs to be written.
But as experience has shown, it may very well be.
Several months ago I was on the IRC EFnet's channel #phrack and one of the
users spouted a URL for a web page he and his cohorts had hacked. On it he
had kindly sent salutations to everyone he knew and to Phrack. We, the
other occupants of the channel all admitted that none of us spoke
authoritatively in the magazine's behalf, but that we were confident that
none of the editorial staff would appreciate being implicated in a felony by
association. The user didn't seem to understand.
The next day, when the user was asked to join some of the authorities at the
local station-house for a short interview, I'm sure he wet his pants. The
line of questioning was short: it merely established that he had not been the
culprit in further attacks on the same host. The police released him uncharged.
In discussions with him later on #Phrack, we weren't surprised to find that he
had been apprehended. As things played out, the user clearly felt no crime had
been committed: All he did was change a web page. He adamantly protested
that he didn't do any damage, he didn't put in any backdoors, he didn't know
that root's .rhosts contained four simple bytes: "+ +\n".
Clearly this user didn't look very hard in what were apparently his several
weeks of attempting to hack the site.
Interestingly enough, I haven't seen this user on IRC since about a week after
the episode.
There are several morals to this story: Hacking is a felony. Any
unauthorized access constitutes hacking. If you do hack something, don't be a
moron about it.
It's likely always been this way, but it's only been more recently I've been
paying attention, I suspect: The advent of information availability and a
rise in the number people for whom the net has always been "the norm" is
producing a class of users who cannot think for themselves. As reliance
upon scripted attacks increases, the number of people who personally possess
technical knowledge decreases.
Today I was lurking and watching the activity on #Phrack while tending to
issues at work. The two largest discussions which come to mind are that SYN
flooding cannot be prevented, even using the newest Linux kernel; and what
0x0D means and that, yes, it is interchangeable for 13 in a C program. For
the latter, the opposing point of view was presented by "an experienced C
programmer."
This was actually a civil conversation. People in-the-know were actually a
little more crude than necessary, and the groups in need of reeducation
admitted faults without needing four reference sources and three IETF
standards quoted. It was a good day.
People these days seem generally unwilling to concede that someone else on the
Internet has done their homework, has studied the standards, and has an
advantage. They consider themselves experienced because they got an
unpatched Windows NT to bring up the Blue Screen Of Death remotely using a
program published four months ago. They hack web pages and put their names
on it.
They seem unwilling to read the code given to them to establish exactly what
happens when the newest 0-day exploit runs. They do not find the holes. They
seem generally more interested in fucking someone over (unaware of potential
consequences) than in really solving any sort of technical problem. It's all
a race, it's all a game, it's all a matter of who has the newest tools.
I'm writing this now because I'm sick of that. I'm sick of people who think
they're smart and are intent on making sure I know it by putting their feet
in their mouths. I'm sick of people who persistently ignore advice given to
them and get angry when the consequences happen. I'm sick of people who
cannot contribute intelligently to a conversation.
So here are some tips for the future:
You're a lot more impressive if you say something right than if you say
something wrong. Someone nearby may be able to verify your claim and may
call you on it.
You're a lot more impressive if you can do something effortlessly because
you've done it before than if you bumble and stumble through an experience
because you thought you could do it and were wrong.
If you're caught in a lie, admit it. The people who caught you already know
more than you do: If you continue to spout bullshit, they'll know that too.
But do your homework. Don't let them catch you being an idiot twice.
If you do something illegal, don't broadcast it. This is especially stupid.
Chances are, someone will be looking for someone to blame soon. By
announcing that you're responsible, you're inviting them to contact you.
0x2>-------------------------------------------------------------------------
Portable BBS Hacking
Extra tips for Amiga BBS systems
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
After reading Khelbin's article from Phrack 50 (article 03), it reminded
me of the similar tricks I had learnt for Amiga BBS systems. So I decided to
write a small article covering the Amiga specific things.
As with Khelbin's article, the actual BBS software isn't particularly
important since they mostly all work the same way in the respect of archivers.
This trick can also be used on other users, but I'll cover that later in the
article.
Firstly, the Amiga supports patching. This means you can set up paths
which point to the directories where your commands are held. The Amiga OS
also automatically sets a path to the current directory. As far as I know,
you can't stop it doing this, but you don't need to anyway, if you're smart.
This firstly problem, relating to the patching of the current directory is more
common than you might expect, since it's such a simple thing to overlook.
What happens is this: The BBS receives a new file from you, and unarchives
it to a temporary dir for whatever reason. It virus checks the files (or
whatever) then it attempt to recompress the files. But, if your file
contained an executable named the same as the BBS's archiver, it would call
the one you uploaded, since the BBS would've CDed to the temp dir to
rearchive the files. As you can imagine, you can use this to activate all
sorts of trojans and viruses, as long as the virus checker doesn't
recognize them. A good idea is to make sure your trojan calls the proper
command as well, so the sysop doesn't notice immediately. The more
observant sysops will have circumvented this problem by calling the archive
with an absolute path, and/or using another method to rearchive the files,
without having to CD into the temp dir.
The second trick is very similar to Khelbin's method of hex-editing
archives. The only difference is, on the Amiga, the backslash and slash are
swapped. For example, you create a file containing a new password file for
the BBS in question.
> makedir temp/BBSData
> copy MyBBSPasswords.dat temp/BBSData/userdata
> lha -r a SomeFiles.lha temp
For the makedir, make the "temp" dir name to be however long it needs to be
when you overwrite the characters of it in the hex-editor. In this case, we
need 4.
Now, load the archive into a hex editor like FileMaster and find the
string:
"temp\BBSData\userdata"
and change it to whatever you need, for example:
"\\\\BBSData\userdata"
which will unarchive 4 levels back from his temporary directory into the real
BBSData dir. The only problem with this is that you need to know a little
about the BBS's directory structure. But, if you intend to hack it, you
should probably know that much anyway.
You'll notice that within the archive, the slash and backslash are swapped.
This is important to remember, since using the wrong one will mean your
archive will fail to extract correctly. The article about this from Phrack
50 was for PCs, which use backslash for directory operations. The Amiga
uses slash instead, but apart from that, the methods used in that article
will work fine for Amiga archives.
If you know the Sysop of the BBS has a program like UnixDirs installed, you
can even use the ".." to get to the root dir. The only other way to do that
is to use a ":", however, I am not sure if this works. I have a feeling LhA
would barf. Luckily, since the Amiga isn't limited by 8.3 filename problems,
you can traverse directories much easier than with the limit imposed on PC
systems.
The only real way the Sysop can fix this problem is by have his temp dir
for unarchiving to be a device which has nothing important on it, like RAM:.
That way, if the archive is extracted to RAM: and tries to step back 3
directories using "///", it'll still be in RAM: and won't screw with anything
important.
0x3>-------------------------------------------------------------------------
<++> EX/changemac.c
/*
* In P51-02 someone mentioned Ethernet spoofing. Here you go.
* This tiny program can be used to trick some smart / switching hubs.
*
* AWL production: (General Public License v2)
*
* changemac version 1.0 (2.20.1998)
*
* changemac -- change MAC address of your ethernet card.
*
* changemac [-l] | [-d number ] [ -r | -a address ]
*
* -d number number of ethernet device, 0 for eth0, 1 for eth1 ...
* if -d option is not specify default value is 0 (eth0)
*
* -h help for changemac command
*
* -a address address format is xx:xx:xx:xx:xx:xx
*
* -r set random MAC address for ethernet card
*
* -l list first three MAC bytes of known ethernet vendors
* (this list is not compleet, anyone who know some more
* information about MAC addresses can mail me)
*
* changemac does not change hardware address, it just change data in
* structure of kernel driver for your card. Next boot on your computer will
* read real MAC form your hardware.
*
* The changed MAC stays as long as your box is running, (or as long as next
* successful changemac).
*
* It will not work if kernel is already using that ethernet device. In that
* case you have to turn off that device (ifconfig eth0 down).
*
* I use changemac in /etc/rc.d/rc.inet1 (slackware, or redhat) just line
* before ifconfig for ethernet device (/sbin/ifconfig eth0 ...)
*
* The author will be very pleased if you can learn something form this code.
*
* Updates of this code can be found on:
* http://galeb.etf.bg.ac.yu/~azdaja/changemac.html
*
* Sugestions and comments can be sent to author:
* Milos Prodanovic <azdaja@galeb.etf.bg.ac.yu>
*/
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <unistd.h>
struct LIST
{
char name[50];
u_char mac[3];
};
/*
* This list was obtainted from vyncke@csl.sni.be, created on 01.7.93.
*/
struct LIST vendors[] = {
{"OS/9 Network ",'\x00','\x00','\x00'},
{"BBN ",'\x00','\x00','\x02'},
{"Cisco ",'\x00','\x00','\x0C'},
{"Fujitsu ",'\x00','\x00','\x0E'},
{"NeXT ",'\x00','\x00','\x0F'},
{"Sytek/Hughes LAN Systems ",'\x00','\x00','\x10'},
{"Tektronics ",'\x00','\x00','\x11'},
{"Datapoint ",'\x00','\x00','\x15'},
{"Webster ",'\x00','\x00','\x18'},
{"AMD ? ",'\x00','\x00','\x1A'},
{"Novell/Eagle Technology ",'\x00','\x00','\x1B'},
{"Cabletron ",'\x00','\x00','\x1D'},
{"Data Industrier AB ",'\x00','\x00','\x20'},
{"SC&C ",'\x00','\x00','\x21'},
{"Visual Technology ",'\x00','\x00','\x22'},
{"ABB ",'\x00','\x00','\x23'},
{"IMC ",'\x00','\x00','\x29'},
{"TRW ",'\x00','\x00','\x2A'},
{"Auspex ",'\x00','\x00','\x3C'},
{"ATT ",'\x00','\x00','\x3D'},
{"Castelle ",'\x00','\x00','\x44'},
{"Bunker Ramo ",'\x00','\x00','\x46'},
{"Apricot ",'\x00','\x00','\x49'},
{"APT ",'\x00','\x00','\x4B'},
{"Logicraft ",'\x00','\x00','\x4F'},
{"Hob Electronic ",'\x00','\x00','\x51'},
{"ODS ",'\x00','\x00','\x52'},
{"AT&T ",'\x00','\x00','\x55'},
{"SK/Xerox ",'\x00','\x00','\x5A'},
{"RCE ",'\x00','\x00','\x5D'},
{"IANA ",'\x00','\x00','\x5E'},
{"Gateway ",'\x00','\x00','\x61'},
{"Honeywell ",'\x00','\x00','\x62'},
{"Network General ",'\x00','\x00','\x65'},
{"Silicon Graphics ",'\x00','\x00','\x69'},
{"MIPS ",'\x00','\x00','\x6B'},
{"Madge ",'\x00','\x00','\x6F'},
{"Artisoft ",'\x00','\x00','\x6E'},
{"MIPS/Interphase ",'\x00','\x00','\x77'},
{"Labtam ",'\x00','\x00','\x78'},
{"Ardent ",'\x00','\x00','\x7A'},
{"Research Machines ",'\x00','\x00','\x7B'},
{"Cray Research/Harris ",'\x00','\x00','\x7D'},
{"Linotronic ",'\x00','\x00','\x7F'},
{"Dowty Network Services ",'\x00','\x00','\x80'},
{"Synoptics ",'\x00','\x00','\x81'},
{"Aquila ",'\x00','\x00','\x84'},
{"Gateway ",'\x00','\x00','\x86'},
{"Cayman Systems ",'\x00','\x00','\x89'},
{"Datahouse Information Systems ",'\x00','\x00','\x8A'},
{"Jupiter ? Solbourne ",'\x00','\x00','\x8E'},
{"Proteon ",'\x00','\x00','\x93'},
{"Asante ",'\x00','\x00','\x94'},
{"Sony/Tektronics ",'\x00','\x00','\x95'},
{"Epoch ",'\x00','\x00','\x97'},
{"CrossCom ",'\x00','\x00','\x98'},
{"Ameristar Technology ",'\x00','\x00','\x9F'},
{"Sanyo Electronics ",'\x00','\x00','\xA0'},
{"Wellfleet ",'\x00','\x00','\xA2'},
{"NAT ",'\x00','\x00','\xA3'},
{"Acorn ",'\x00','\x00','\xA4'},
{"Compatible Systems Corporation ",'\x00','\x00','\xA5'},
{"Network General ",'\x00','\x00','\xA6'},
{"NCD ",'\x00','\x00','\xA7'},
{"Stratus ",'\x00','\x00','\xA8'},
{"Network Systems ",'\x00','\x00','\xA9'},
{"Xerox ",'\x00','\x00','\xAA'},
{"Western Digital/SMC ",'\x00','\x00','\xC0'},
{"Eon Systems (HP) ",'\x00','\x00','\xC6'},
{"Altos ",'\x00','\x00','\xC8'},
{"Emulex ",'\x00','\x00','\xC9'},
{"Darthmouth College ",'\x00','\x00','\xD7'},
{"3Com ? Novell ? [PS/2] ",'\x00','\x00','\xD8'},
{"Gould ",'\x00','\x00','\xDD'},
{"Unigraph ",'\x00','\x00','\xDE'},
{"Acer Counterpoint ",'\x00','\x00','\xE2'},
{"Atlantec ",'\x00','\x00','\xEF'},
{"High Level Hardware (Orion, UK) ",'\x00','\x00','\xFD'},
{"BBN ",'\x00','\x01','\x02'},
{"Kabel ",'\x00','\x17','\x00'},
{"Xylogics, Inc.-Annex terminal servers",'\x00','\x08','\x2D'},
{"Frontier Software Development ",'\x00','\x08','\x8C'},
{"Intel ",'\x00','\xAA','\x00'},
{"Ungermann-Bass ",'\x00','\xDD','\x00'},
{"Ungermann-Bass ",'\x00','\xDD','\x01'},
{"MICOM/Interlan [Unibus, Qbus, Apollo]",'\x02','\x07','\x01'},
{"Satelcom MegaPac ",'\x02','\x60','\x86'},
{"3Com [IBM PC, Imagen, Valid, Cisco] ",'\x02','\x60','\x8C'},
{"CMC [Masscomp, SGI, Prime EXL] ",'\x02','\xCF','\x1F'},
{"3Com (ex Bridge) ",'\x08','\x00','\x02'},
{"Symbolics ",'\x08','\x00','\x05'},
{"Siemens Nixdorf ",'\x08','\x00','\x06'},
{"Apple ",'\x08','\x00','\x07'},
{"HP ",'\x08','\x00','\x09'},
{"Nestar Systems ",'\x08','\x00','\x0A'},
{"Unisys ",'\x08','\x00','\x0B'},
{"AT&T ",'\x08','\x00','\x10'},
{"Tektronics ",'\x08','\x00','\x11'},
{"Excelan ",'\x08','\x00','\x14'},
{"NSC ",'\x08','\x00','\x17'},
{"Data General ",'\x08','\x00','\x1A'},
{"Data General ",'\x08','\x00','\x1B'},
{"Apollo ",'\x08','\x00','\x1E'},
{"Sun ",'\x08','\x00','\x20'},
{"Norsk Data ",'\x08','\x00','\x26'},
{"DEC ",'\x08','\x00','\x2B'},
{"Bull ",'\x08','\x00','\x38'},
{"Spider ",'\x08','\x00','\x39'},
{"Sony ",'\x08','\x00','\x46'},
{"BICC ",'\x08','\x00','\x4E'},
{"IBM ",'\x08','\x00','\x5A'},
{"Silicon Graphics ",'\x08','\x00','\x69'},
{"Excelan ",'\x08','\x00','\x6E'},
{"Vitalink ",'\x08','\x00','\x7C'},
{"XIOS ",'\x08','\x00','\x80'},
{"Imagen ",'\x80','\x00','\x86'},
{"Xyplex ",'\x80','\x00','\x87'},
{"Kinetics ",'\x80','\x00','\x89'},
{"Pyramid ",'\x80','\x00','\x8B'},
{"Retix ",'\x80','\x00','\x90'},
{'\x0','\x0','\x0','\x0'}
};
void change_MAC(u_char *,int);
void list();
void random_mac(u_char *);
void help();
void addr_scan(char *,u_char *);
int
main(int argc, char ** argv)
{
char c;
u_char mac[6] = "\0\0\0\0\0\0";
int nr = 0,eth_num = 0,nr2 = 0;
extern char *optarg;
if (argc == 1)
{
printf("for help: changemac -h\n");
exit(1);
}
while ((c = getopt(argc, argv, "-la:rd:")) != EOF)
{
switch(c)
{
case 'l' :
list();
exit(1);
case 'r' :
nr++;
random_mac(mac);
break;
case 'a' :
nr++;
addr_scan(optarg,mac);
break;
case 'd' :
nr2++;
eth_num = atoi(optarg);
break;
default:
help();
exit(1);
}
if (nr2 > 1 || nr > 1)
{
printf("too many options\n");
exit(1);
}
}
change_MAC(mac,eth_num);
return (0);
}
void
change_MAC(u_char *p, int ether)
{
struct ifreq devea;
int s, i;
s = socket(AF_INET, SOCK_DGRAM, 0);
if (s < 0)
{
perror("socket");
exit(1);
}
sprintf(devea.ifr_name, "eth%d", ether);
if (ioctl(s, SIOCGIFHWADDR, &devea) < 0)
{
perror(devea.ifr_name);
exit(1);
}
printf("Current MAC is\t");
for (i = 0; i < 6; i++)
{
printf("%2.2x ", i[devea.ifr_hwaddr.sa_data] & 0xff);
}
printf("\n");
/* an ANSI C ?? --> just testing your compiler */
for(i = 0; i < 6; i++) i[devea.ifr_hwaddr.sa_data] = i[p];
printf("Changing MAC to\t");
/* right here i am showing how interesting is programing in C */
printf("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
0[p],
1[p],
2[p],
3[p],
4[p],
5[p]);
if (ioctl(s,SIOCSIFHWADDR,&devea) < 0)
{
printf("Unable to change MAC -- Is eth%d device is up?\n", ether);
perror(devea.ifr_name);
exit(1);
}
printf("MAC changed\n");
/* just to be sure ... */
if (ioctl(s, SIOCGIFHWADDR, &devea) < 0)
{
perror(devea.ifr_name);
exit(1);
}
printf("Current MAC is: ");
for (i = 0; i < 6; i++) printf("%X ", i[devea.ifr_hwaddr.sa_data] & 0xff);
printf("\n");
close(s);
}
void
list()
{
int i = 0;
struct LIST *ptr;
printf("\nNumber\t MAC addr \t vendor\n");
while (0[i[vendors].name])
{
ptr = vendors + i;
printf("%d\t=> %2.2x:%2.2x:%2.2x \t%s \n",
i++,
0[ptr->mac],
1[ptr->mac],
2[ptr->mac],
ptr->name);
if (!(i % 15))
{
printf("\n press enter to continue\n");
getchar();
}
}
}
void
random_mac(u_char *p)
{
srandom(getpid());
0[p] = random() % 256;
1[p] = random() % 256;
2[p] = random() % 256;
3[p] = random() % 256;
4[p] = random() % 256;
5[p] = random() % 256;
}
void
addr_scan(char *arg, u_char *mac)
{
int i;
if (!(2[arg] == ':' &&
5[arg] == ':' &&
8[arg] == ':' &&
11[arg] == ':' &&
14[arg] == ':' &&
strlen(arg) == 17 ))
{
printf("address is not in spacified format\n");
exit(0);
}
for(i = 0; i < 6; i++) i[mac] = (char)(strtoul(arg + i*3, 0, 16) & 0xff);
}
void
help()
{
printf(" changemac - soft change MAC address of your ethernet card \n");
printf(" changemac -l | [-d number ] [ -r | -a address ] \n");
printf(" before you try to use it just turn ethernet card off, ifconfig ethX down\n");
printf(" -d number number of ethernet device \n");
printf(" -h this help \n");
printf(" -a address address format is xx:xx:xx:xx:xx:xx \n");
printf(" -r set random generated address \n");
printf(" -l list first three MAC bytes of known ethernet vendors\n");
printf(" example: changemac -d 1 -a 12:34:56:78:9a:bc\n");
}
/* EOF */
<-->
0x4>-------------------------------------------------------------------------
The Defense Switched Network
By: DataStorm <havok@tfs.net>
This is an extremely shortened tutorial on the DSN. More information
is available through the DoD themselves and various places on the Internet. If
you have any comments or suggestions, feel free to e-mail me.