----/ Chief Editor ..................... Wyzewun
(wyze1@syrex.co.za)
---/ Co-Editors ...................... Vortexia (vortexia@one.se)
--/ .................................. Marc Satur9
(satur9@usa.net)
--/ The Crew ....................... Moe1 (moe1@mailbox.co.za)
-/ ................................. Sniper
(sniper@h4x0rz.za.org)
-/ .................................. Gevil (gevil@hotmail.com)
You may contact any of us through e-mail, otherwise you will find
at least one
of us on #zahack on EFNet. We hope you enjoy the Zine, it is
nothing like the
last two issues, so please mail us and tell us what you think.
Please also keep in mind that because of us having to restart
production of
the zine completely half way through the month, and the fact that
many people
decided not to contribute their articles at the last minute, we
did not have
as much as we would've liked to have in this issue. However, I
feel that the
quality of the articles in this issue surpasses any in previous
editions of FK
and that we are definately heading for a good patch.
I have also dumped the stupid ASCII art stuff, and given the zine
an
all-around new look, which is simpler and easier to read. Please
mail me
telling me what you think of the new F0rbidden Knowledge
Cheers,
Wyzewun (wyze1@syrex.co.za)
-=-=-<< An automated response system under Unix using TCP Wrappers by Vortexia
Ok... here we go :) How to make a system respond to connection
attempts you
well.... dont like so much *grin* Well... there are a coupla
ways, I only
gonna cover the most simple one (with TCP Wrappers, which is a
standard
program on linux systems and can be installed under a bsd system
from
/usr/ports/security/tcp_wrapper)
Ok... first a brief explanation on how a tcp wrapper works....
Someone connects to your box... your box spawns tcpd (the tcp
wrapper daemon),
which then checks the connecting person's ip against your allow
and deny
lists, IF it likes that persons ip then it starts the program
they are
connecting to (the daemon the connecting client wants), and quits
itself...
if it doesnt, it either just drops the connection clients
connection, or it
runs a script before dumping the connecting clients connection :)
Ok... so now to the actual, how the hell to implement this
section...
First of all if ya wanna tcp wrapper something you gotta put it
in inetd.conf
2 sample entries from a bsd system:
This is without TCP Wrappers:
telnet stream tcp nowait root /usr/libexec/telnetd
/usr/libexec/telnetd
This is with TCP Wrappers:
telnet stream tcp nowait root /usr/local/libexec/tcpd
/usr/libexec/telnetd
Ok... this is pretty damn self explanatory... standard inetd.conf
entry is
first, I wont explain all the options they arent important at
this stage,
except you will notice that I inserted tcpd in the second entry,
following
that example will allow you to wrapper most things..... (backup
original
/etc/inetd.conf before you modify it incase you stuff up).
Ok... then you find out where hosts.allow and hosts.deny are on
your system
(if its linux its probably in /etc, if its FreeBSD probably
/usr/local/etc).
Then you add some options to them... Ok, we wanna deny all by
default...
we would put the following in hosts.deny for each daemon.
telnetd: ALL
popper: ALL
etc etc, the first entry has to be the NAME of the actual file
you are
denying, I.E if telnetd in inetd.conf is /usr/sbin/in.telnetd
then put there
in.telnetd, if its /usr/libexec/telnetd put telnetd etc etc etc.
Then we wanna allow something in for telnetd, so in hosts.allow
we put
something like:
telnetd: 34.23.42.38 235.34.129.38
This will allow those 2 ips in for telnetd, alternatively you can
put
wildcards in there.
Ok, now you got basic wrappers working allowing and disallowing
connections,
now you wanna do auto response, so first of all, I must say this,
now is a
good time to learn how to read man pages :P
man 5 hosts_access will show you the man page, section 5 for
hosts_access,
man 5 hosts_options can also help with what follows.
Ok... lets change our hosts.deny file slightly... we want auto
response on
pop3 that uses a daemon with filename popper... so we put in
something like
this....
popper: ALL: spawn (/root/security/wrapper.script %h %s %c %h)
This says, before dropping the denied connection, run the script
/root/security/wrapper.script with the parameters %h %s %c %h.
Note, you can tell it to run ANYTHING here with ANY parameters
(please dont
abuse *grin*, will explain HOW to abuse later)
Ok... the parameters... first lets cover what they do, there are
further
options than the ones covered by basic auto response only needs
the ones I
have specified, I will cover one other one later as well.
%h is the hostname, or ip if it cant find the hostname
%s is the daemon they tried to connect to, and the server
address, or as much
info is available to TCPD
%c is client information (the perosn who is connecting)
user@host, if identd
is running, or just the hostname again.
A further useful one I found is %a which doesnt return host, it
just returns
an ip address.
Ok... how to then write the script that it passes all this 2....
Lets look at a basic bash script...
Ok, we want this to portscan the host, finger the host, then
email the
results to someone so they will be aware that someone is trying
to connect...
(remeber anything other than the first line of whats below that
starts with a
# is a comment)
#!/bin/bash
nmap -o $1.$2.strobe.scan $1
# nmap is our portscanner, $1 refers to %h (the first parameter),
$2 is
# %s. What this says is run a portscanner against $1 (the
connecting
# host) and output it to a file with name containing the
connecting client
# and the daemon they tried to connect 2.
finger \w@$1 >$1.$2.finger.results
# This says run finger against the host and output to a file
echo "Strobe results for $1" >$1.$2.mail.output
cat $1.$2.strobe.scan >>$1.$2.mail.output
echo "Finger results for $1" >>$1.$2.mail.output
cat $1.$2.finger.results >>$1.$2.mail.output
cat $1.$2.mail.output |mail -s "Security Violation
Report" |mail root
(script ends here)
Ok... the last 5 lines are pretty simple really, the first line
says make a
file called $1.$2.mail.output ($1 and $2 being the information
specified
by %h and %s). The Second line says append the file
$1.$2.strobe.scan to the
mail file. The Third line says append a line that says:
"Finger Results for
$1" The forth line says append the finger resulsts to the
mail file the fifth
line says email the entire file to the local root account.
Simple huh? :)
Ok... now to auto respond *evil grin*, Say you felt REALLY nasty
and wanted to
smurf or nestea everyone connecting to your box... just replace
the nmap line
or one of the other lines with your favorite attack proggy :)
For example:
smurf $1 bcast.file -S 128 -n 2000
will happily smurf $1 with 2000 128k packets (dont try this on a
modem link or
anything with less bandwidth than dual channel ISDN, its just an
example
*grin*).
Anyway :) thats how you do it
If this article is confusing or you want more info on how to do
even more fun
things with tcpd or want explanations, I hang on #zahack on efnet
and Im
always willing to help anyone out with what I know
Cheers
Vortexia (vortexia@one.se)
-=-=-<< Fooling people on IRC into running Programs by Wyzewun
Getting a relatively smart person to run a program they recieved
off IRC is
actually a lot easier than one would normally think it is. I've
found that the
method that works best is to find some form of Lame DoS attack
that they are
vunerable to. (For Windows, I recommend trying Jolt or Click
because half of
the idiots on this planet are vunerable to those)
After kicking the target off IRC a couple of times, msg him and
tell him that
you know what is happening to him. Make up some bullshit name for
an exploit
and tell him that he is vunerable to it, and he must go and
download the patch
from Microsoft's site.
At this stage, tell him that you've just realised that you have
the patch for
it, and that if he wants he can have it from you, but make sure
that you offer
to let him search Micro$oft's site so that he doesn't think
something funny
is going on. After he can't find it and asks you to DCC him the
patch, just
send over Netbus, Back Orifice, Your new Virus, Whatever.
Easy as that. If you have a site you may want to put up the
executable there
to make him less suspicious. It's really all up to you, this
article gives you
a means to an end that is completely up to you.
-=-=-<< Cracking the EAN Barcode System by Moe1
The EAN or European Article Number System Barcode has 13 values,
making it
easy to spot. Value 1 is situated outside the "left hand
side" border.
Together with the second digit, it tells us the origin of the
product. Values
from 3-12 give's us the article code. And value 13 is a checksum
which checks
the validity of all the other numbers.
The checksum is calculated as follows:
1. Add all the odd position numbers except the last digit
(1+3+5+7+9+11)
2. Add all the even position numbers (2+4+6+8+10) and multiply
the answer
by 3. (Note that we are leaving out the last digit, which is our
checksum)
3. Add the answer in 1 with the answer in 2.
4. We divide the sum of 1 and 2 by the number 10 and if the
remainder is not
zero, then we substract the remainder from 10 and this should
give us our
last positioned number.
Once the checksum is done, we know that the barcode is valid.
Now on to the lines (yeah doze pesky lines above the values)
Note: 7 lines make's up 1 value.
There are 3 graphic codes that are used and we have 2 groups of
values as
explained above. From those 3 graphic codes, 2 codes (A,B) are
used in the
first group of values and code (C) is used in the second group of
values.
Below shows us the different graphic code that makes up the
different numbers
of the values. Take notice of the different lines.
BLACK LINE REPRESENTED BY 1
WHITE SPACE REPRESENTED BY 0
CODE A CODE B CODE C
if code A were: | if code B were: | if code C were:
0 ----> 0001101 | 0 ----> 0100111 | 0 ----> 1110010
1 ----> 0011001 | 1 ----> 0110011 | 1 ----> 1100110
2 ----> 0010011 | 2 ----> 0011011 | 2 ----> 1101100
3 ----> 0111101 | 3 ----> 0100001 | 3 ----> 1000010
4 ----> 0100011 | 4 ----> 0011101 | 4 ----> 1011100
5 ----> 0110001 | 5 ----> 0111001 | 5 ----> 1001110
6 ----> 0101111 | 6 ----> 0000101 | 6 ----> 1010000
7 ----> 0111011 | 7 ----> 0010001 | 7 ----> 1000100
8 ----> 0110111 | 8 ----> 0001001 | 8 ----> 1001000
9 ----> 0001011 | 9 ----> 0010111 | 9 ----> 1110100
NOTE: only in group 1 are CODE A & B used, in group 2 it's
all CODE C. So look
at group 1 and identify which CODE forms the number.
EXAMPLE:
I buy a Sunday Times Newspaper, and I look at the bottom of the
front page and
see a nice little barcode. Due to my curiosity I wanna know how
that shit
works so I decide I wanna try and crack that scheme those
newspaper boys use.
First I look at the numbers and find that there are 13 numbers
(9 770039 533008) immediately I know that they are using the EAN
system.
Since I know how to crack this system, its no problem. I first do
a checksum
to see if any screws up occur...
9+7+0+9+3+0 = 28
(7+0+3+5+3+0) x 3 = 54
28+54 = 82
82 divided by 10 = 8 remainder 2
10 - 2 = 8 = CHECKSUM (value 12 or 13th position no. in barcode)
Ok Checksum done.
Now we see what makes up 770039 and we find that its the code
pattern: ABBABA
And our code pattern for 533008 is: CCCCCC (check and see the
lines would be
exactly the same as the lines in CODE C) Right so we know:
BARCODE: 9 770039 533008
977 tells us its a book or some sort of reading material
770039 is ABBABA and 533008 is CCCCCC
and our checksum is 8
I took the Sunday Times Newspaper for an example because it seems
it's the
easiest to do. If you still dont understand how barcodes can be
of any
assistance to you then "ERM" think harder.
Bye!
Moe1 (moe1@mailbox.co.za)
respond to this article, and how many spelling mistakes and
grammatical
screw-ups Wyzewun can try to edit out of the article before he
faints :P>
-=-=-<< More Beigeboxing Methods by Wyzewun
In Issue Two, I covered use of the Blue and Green Telkom boxes to
box. This
Issue, I'll be looking at some alternative methods...
Method Number One
~~~~~~~~~~~~~~~~~
Go to an abandoned building that used to be an office (South
Africans - Watch
out for squatters *grin*) and it is extremely likely that it will
have working
phone lines running into it. Of course, it is also very likely
that there will
be no form of phone jack to be found - Are we using a phone jack?
No. We're
using Crocodile Clips. Problem Solved. :)
Method Number Two
~~~~~~~~~~~~~~~~~
Try using the phone of some-one who has recently moved out of a
house, or use
your neigbours' phone when they are on holiday. Simply find the
cord that runs
from their phone out of their house, cut it open, and connect up
your box. If
the tenants have moved out and have had their phone disconnected,
phone up
Telkom and tell them that the disconnection of the phone was a
mistake and
ask them to reconnect it. :) This way, you can keep a phone
working for up to
three months before Telkom finally cut it off.
Method Number Three
~~~~~~~~~~~~~~~~~~~
Find the point where a cable goes from the overhead poles into
the ground.
It is sometimes covered with a concrete or asbestos cover, so you
may have to
get past that. Assuming you somehow have done so, open up the
cable, and you
should find twisted pairs of wires like this...
pair #%# <--scotch lock
2 pairs | //
| /><><><>
///><><><>
//\<><><><>\
| \><><><><\
twisted- \\
together #%#
<< ASCII Art Stolen from Kokey>>
The wires are colour coded to indicate negative and positive
wires. When in
doubt of how to connect your box, consult Kokey's handy
Table-O-Colours...
Base colours Negative legs
------------ -------------
blue white
orange red
green black
Or alternatively, if you can get down far enough to see where the
wires
un-ravel to, you can just do that. ;-)
Well, that's all the ways I'm going to cover on beigeboxing in SA
for this
issue, yes, there are more, but I'm going to have to research
them in a bit
more detail, so yes, FK4 will have more beigeboxing stuff! Just
remember to
tell me when you get sick of this... :)
-=-=-<< Affirmative Car Shopping by Hitsquad
Since Wyzewun explained how to borrow a bus in the previous
months, I thought
we should move up a level and explain how to, um borrow a car for
a short
time before he gets picked up by the police.
Anyway, with many older car alarms, when the car is bumped, the
alarm sounds
and the lights flash. Like most electrical systems, there is a
fuse in case
there is a power fails in some way and this fuse will break the
circuit,
thereby killing the alarm.
Now this is all good and fine if nobody can reach the fuse, but
if you can
reach the fuse, then there's trouble. With the older car systems,
the fuse is
behind the left front light that flashes, so simply break the
light and the
fuse behind it and that is the end of one alarm system. Simple
huh?
So now if there is an old car down the road from you, with an
alarm that keeps
waking you up at night, you know how to switch it off. ;-)
This method however does not disable the engine/battery cut offs
so it might
be harder to steal the car. (This method was tried on an old
Porsche and it
worked, unfortunetly, the money I won on the bet was less than
the light I had
to replace and I did have the owners permission :-<)
Also, according to Jaguar magazine, there are over 500 000
jaguars in South
Africa. Now if you
fairly simple and not so destructive way to get your keys and you
don't need a
brick. The lock mechanism has been placed behind the rear-view
mirror. Simply
remove the mirror and there is the lock mechanism which you can
then open your
car. Easy as that.
Hitsquad
Things To Ponder - #06
Should you trust a stockbroker who is married to a travel agent?
-=-=-<< More affirmative car shopping by Wyzewun
Allright, if we're going to go into the whole car theft thing
this issue then
thats fine with me - I also have a new trick or two to share...
The Lock
Mechanism on a BMW with Central Locking is in fact located in the
boot of the
car. So, to get yourself a new BMW, you will need a tennis ball
and a brick.
No, I am NOT going to write an article on Tennis Ball Theft! Shut
up and Stop
Laughing at me!@#! :P
Cut the Tennis Ball in half, place it over the lock on the boot
and hit it
with the brick as hard as you can. All the doors should open.
Note that this can also be done with a nail instead of a tennis
ball, which is
more effective, but also requires practice and will fuck up the
lock if you
don't do it right.
-=-=-<< News in Brief by The Editors
-/- Konr@d magazine (Berlin, Germany) set to publish article on
Johannesburg
Computer Culture in their March Issue. The article includes the
results
of interviews with Wyzewun as well as mentions of many other
prominent
South African hackers and what they do.
-/- Wyzewun has insisted that he is going to drink Tequila until
his liver
explodes unless some-one designs a nice ASCII Art Logo for FK.
Then again,
he may enjoy that... Damn...
-=-=-<< Thanks and Greets
Group Greets:
Cult of the Dead Cow, Hacker News Network, L0pht, Legions of
Underground,
Phrozen Crew, r00t, Technotronic, The Hackers Choice
Personal Greets:
Aleph1, Cache, Caliburn, Crazyg*y, Cyber Demon, Cyclotron, fern,
FireIce,
Grey Wolf, kokey, Mnemonic, Mudge, optiklenz, opium, Pavlov,
Radix, route, Sector12, Sledge, Spy, The Keyboard Caper
***********************
Lamer of the Month:
***********************
NICK: HOTMETAL!
REASON: Has a habit of posting bullshit on mailing lists and
making himself
look like a fool
REAL NAME: Cami (Camihose?)
***********************
-=-=-<< When and Where to get the Next Issue
Issue Number: Four
Release Date: 5th March 1999
Distrib Site: www.posthuman.za.net
Notes: FK4 will be even better than this issue, I promise :)