|
|
 |
|
|
|
register |
bbs |
search |
rss |
faq |
about
|
|
|
meet up |
add to del.icio.us |
digg it
|
|
|
|
Getting better access on any UNIX system
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
+---------------------------------------------------------------------------+
:PHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHA:
:pha+-------------------------------------------------------------------+pha:
:PHA: Phreakers/Hackers/Anarchists Present: :PHA:
:pha: =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= :pha:
:PHA: +=+ Gaining Better Access On Any Unix System +=+ :PHA:
:pha: =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= :pha:
:PHA: Written By Doctor Dissector (doctord@darkside.com) Date: 1/7/91 :PHA:
:pha+-------------------------------------------------------------------+pha:
:PHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHA:
+---------------------------------------------------------------------------+
+-----------------------------------------------------------------------------+
:=[ Disclaimer ]==============================================================:
+-----------------------------------------------------------------------------+
The author and the sponsor group Phreakers/Hackers/Anarchists will not be held
responsible for any actions done by anyone reading this material before,
during, and after exposure to this document. This document has been
released under the notion that the material presented herin is for
informational purposes only, and that neither the author nor the group
P/H/A encourage the use of this information for any type of illegal
purpose. Thank you.
+-----------------------------------------------------------------------------+
:=[ Introduction ]============================================================:
+-----------------------------------------------------------------------------+
Hello there again. Well, I just recently started getting back into the hacking
mode of things, and decided to throw together a quick-reference type of
deal on how to get better access on any unix driven system. Unix, in my
opinion is the best operating system out today for all-purpose use, and
is probably the most widely used operating system currently in use as
well. Anyway, the ideas in this document are probably far from original,
but are re-stated together in order to help devise new strategies for
cracking unix. Also note that this is not for novices, I will constantly
refer back to topics which are generally well known throughout unix
users, so don't expect me to elaborate. Enjoy...
+-----------------------------------------------------------------------------+
:=[ General Unix Hints ]======================================================:
+-----------------------------------------------------------------------------+
1. If you have write priv's to a directory but don't have write priv's to a
file in that directory, copy the file over to another directory, delete
the original file, modify your copy of the file to your tastes, and
recopy it back into the original directory. Example:
cp /canthack/cantwriteme /usr/mydir
rm /canthack/cantwriteme
cp /usr/mydir/gnuversion /usr/mydir/cantwriteme
cp /usr/mydir/cantwriteme /canthack
2. If you have read access to a file but can't copy it due to directory read
restrictions, you can still cat it into another file in another directory.
Example: "cat cantcopyme > /usr/mydir/IcopiedYOU!".
3. Always touch files up after you modify them so the date/time stamp is
the same/close to what it was before you modified it. This is done by
using the command "touch HHmmMMdd <filename>" where HH=hour, mm=minute,
MM=month, and dd=day.
+-----------------------------------------------------------------------------+
:=[ Gaining Better Access On A Unix ]=========================================:
+-----------------------------------------------------------------------------+
1. Grab /etc/passwd, you might be able to get an account that will put you in
a better position using password crackers; just having the list of users
puts you ahead if the password file is shadowed.
3. Use the command:
find / -perm -4000 -exec /bin/ls -lad {} ";"
It will show you all files with the UID bit set. You can then attempt to
create a shell with root/another user's uid priv's or modify them,
depending on what file priv's are set on them.
3. Check for write priv's to /usr/lib directory and /usr/lib/crontab file.
The /usr/lib/crontab file will execute certain commands at specific
times under the uid of root. If you don't know much about this file, I
advise you to stay away from it.
4. Check for write priv's to /usr/spool/crontabs directory and any crontab
files in that directory; since these scripts are run under the uid bit
of each listed user, if you could edit the root or other important
user's cron script, you might put yourself in a better position.
5. Check for write priv's to scripts/programs executed BY the /usr/lib/crontab
script or the scripts in /usr/spool/crontabs directory. If you could
modify a program/script used by these cron scripts (backdoor... eh?)
you could easily better your position on the system.
6. Check for write priv's to /bin, /usr/bin, /etc, /usr/lib, and any other
important directories with binaries or scripts owned by root or other
imporant users on the system, or just plain used a heck of a lot by
the users on a particular system. You might be able to modify certain
files (backdoors, etc) in order to better your position on the system.
7. Use a trojan. Some unix systems have faults in that a user who hangs up in
the middle of a connection will not be logged out of the system, and the
next person to log onto the system under the same tty will be placed into
that user's shell. You can create a trojan program simulating normal
login (many have been described by Shooting Shark and others) to gain
passwords (possibly root if you are REALLY REALLY lucky) to the system.
8. Read a terminal device (/dev/ttyXXX) using the "cat /dev/ttyXXX" command,
which requires you to own a uid shell of the current user on that ttyXXX,
but could be useful in gaining more accounts. The Prophet also had an
idea where you would read the ttyXXX until the superuser (using a
differnet account) would login, and then you would send him a write
message saying something like "I'm Gonna Format Your Winchesters!!!"
(as The Prophet would say it...), you could watch him su over to the
root account in order to boot you off the system; meanwhile, you are
watching him type in the password and all for the su, and you now have
root.
+-----------------------------------------------------------------------------+
:=[ Appendix ]================================================================:
+-----------------------------------------------------------------------------+
1. The following is a paritial listing of some programs/scripts under the unix
operating environment that generally (if not always) have the root
superuser uid bit set on them.
/bin/chfn /bin/chhd
/bin/chsh /bin/mail
/bin/passwd /bin/rcp
/bin/su /usr/lib/lpd
/usr/lib/sendmail /com/sigp
/com/xsubs /etc/find_orphans
/etc/lpc /etc/lprotect
/etc/ping /etc/salacl
/etc/suid_exec /etc/syncids
/etc/timedc /sys/net/netman
/sys/vtserver /usr/bin/login
/usr/bin/tb
+-----------------------------------------------------------------------------+
:=[ Conclusion & Credits ]====================================================:
+-----------------------------------------------------------------------------+
Well, that's pretty much it. I doubt that is even close to all the ideas a
great deal of people can come up with for gaining better access to any
given unix system, but it is a start. I'd also like to give credit to
So76 for getting this list started and The Prophet for his excellent
information in "Unix Use And Security From The Ground Up" textfile,
great stuff. Till next tyme....
dd/pha
+-----------------------------------------------------------------------------+
:=[ Greets & Messages ]=======================================================:
+-----------------------------------------------------------------------------+
To all the network hackers out there: Keep up the good work.
Yo! To Kryptic Night, PhantasMumble, Pain Hertz, Doc Holiday, Black Death,
Killer Korean, M.I.T., Anonymous Anarchist, Brownstone, and anyone else
I might have forgotten!
+-----------------------------------------------------------------------------+
:=======>> Unholy Temple EEE-light! PHA-HQ/NIA/PHRACK - XXX-PRI-VATE <<=======:
+-----------------------------------------------------------------------------+
"The future is forever..." + "The future is NOW!" - KL/PHRACK
|
|
|
To the best of our knowledge, the text on this page may be freely reproduced and distributed.
If you have any questions about this, please check out our Copyright Policy.
totse.com certificate signatures
|
|
|
About | Advertise | Bad Ideas | Community | Contact Us | Copyright Policy | Drugs | Ego | Erotica
FAQ | Fringe | Link to totse.com | Search | Society | Submissions | Technology
|
|
|
|
|
|
