Start


Important

The author is not responsible for any abuse of this information. It is intended for educational use
only. You may be quite shocked at how vulnerable you are! As an afterthought I added a section
on database access due to a number of requests.
The majority of successful attacks on computer systems via the Internet can be traced to
exploitation of security flaws in software and operating systems. These few software
vulnerabilities account for the majority of successful attacks, simply because attackers are
opportunistic – taking the easiest and most convenient route. They exploit the best-known flaws
with the most effective and widely available attack tools. Most software, including operating
systems and applications, comes with installation scripts or installation programs. The goal of
these installation programs is to get the systems installed as quickly as possible, with the most
useful functions enabled, with the least amount of work being performed by the administrator. To
accomplish this goal, the scripts typically install more components than most users need. The
vendor philosophy is that it is better to enable functions that are not needed, than to make the user
install additional functions when they are needed. This approach, although convenient for the
user, creates many of the most dangerous security vulnerabilities because users do not actively
maintain and patch software components they don’t use. Furthermore, many users fail to realize
what is actually installed, leaving dangerous samples on a system simply because users do not
know they are there. Those unpatched services provide paths for attackers to take over computers.
For operating systems, default installations nearly always include extraneous services and
corresponding open ports. Attackers break into systems via these ports. In most cases the fewer
ports you have open, the fewer avenues an attacker can use to compromise your network. For
applications, default installations usually include unneeded sample programs or scripts. One of
the most serious vulnerabilities with web servers is sample scripts; attackers use these scripts to
compromise the system or gain information about it. In most cases, the system administrator
whose system is compromised did not realize that the sample scripts were installed. Sample
scripts are a problem because they usually do not go through the same quality control process as
other software. In fact they are shockingly poorly written in many cases. Error checking is often
forgotten and the sample scripts offer a fertile ground for buffer overflow attacks.
The simplest means to gain access to a system is by simple file and printer sharing. This is used to
allow others on say, a home local area network share files, printers, and internet connections. If
the computer having file and printer sharing enabled, this in fact allows these resources to be
shared, and on offer, to the entire internet! This is largely due to the fact that Netbios was
originally intended for use on local area networks (LAN’s), where trusted sharing of resources
made sense for many reasons. It was never intended to ‘go global’.
First, search using a Netbios scanner, for a system with sharing enabled. A program such as
Netbrute, by Raw Logic Software, is ideal. These programs can help the would-be hacker, as well
as the network administrator. Run the scan over a subnet at a time, for example an IP address
range from 80.1.1.1 to 80.1.1.254. Choose a system which has, preferably, it’s whole hard disk

Introduction


1

shared (You’d be amazed at some peoples stupidity!!!), this shows up as a result such as

\\80.5.7.2\C or similar. Simply copy & paste this link into the address bar of Windows Explorer, and hit enter! This is a screenshot of Netbrute in operation: For more comprehensive information, use a utility such as Languard Network Scanner. This returns a wealth of information such as domain names, login names, and more. Here is a shot of this in use:

2

Need I say more? If you find a system where the root directory of C: is shared, then on Windows 9.X systems, you’ll be able to access the whole of the hard drive. On Windows NT/2000 systems, you will have only access as according to NTFS file access permissions. Here is a screenshot of Windows Explorer pointed at the root directory:

3

You can even map it to a network drive (use tools > map network drive), it’s as easy as that!

For best results, I recommend choosing systems with ‘better than modem’ connections. If you don’t know where to start, try your own IP address. To get this, do the following:

For Windows 9.X, go to start > Run and type ‘Winipcfg’ to get your IP address.

For Windows NT/2000, got to start > programs > accessories > commend prompt, and type ‘ipconfig’.

This will return your IP address. If you are using a dialup connection, you will need to connect first. For ‘always on’ cable connection, omit this step. Then run your scan over the subnet; e.g. if your IP address is 164.99.34.212 then try a scan from 164.99.34.1 to 164.99.34.254. This should be enough to get you started. Have fun…

IP Scanning

This simple scan simply pings a range of IP addresses to find which machines are alive. Note that more sophisticated scanners will use other protocols (such as an SNMP sweep) to do the same thing. This is a very simple technique which requires little explanation. It is however, useful for the domain name to be returned also.

4

Port Scanning

This section introduces many of the techniques used to determine what ports (or similar protocol abstraction) of a host are listening for connections. These ports represent potential communication channels. Mapping their existence facilitates the exchange of information with the host, and thus it is quite useful for anyone wishing to explore their networked environment, including hackers. Despite what you have heard from the media, the Internet is NOT exclusively reliant on TCP port 80, used by hypertext transfer protocol (HTTP). Anyone who relies exclusively on the WWW for information gathering is likely to gain the same level of proficiency as your average casual surfer. This section is also meant to serve as an introduction to the art of port scanning, in which a host system can be persuaded to yield up it’s secrets. To accomplish this, you need to obtain a port scanner. There are many available both for free or for a small fee.

It should have all these features:

dynamic delay time calculations: Some scanners require that you supply a delay time between sending packets. Well how should I know what to use? You can always ping them, but that is a pain, and plus the response time of many hosts changes dramatically when they are being flooded with requests. For root users, the primary technique for finding an initial delay is to time the internal “ping” function. For non-root users, it times an attempted connect() to a closed port on the target. It can also pick a reasonable default value. Again, people who want to specify a delay themselves can do so with -w (wait), but you shouldn’t have to.

Retransmission: Some scanners just send out all the query packets, and collect the responses. But this can lead to false positives or negatives in the case where packets are dropped.

This is especially important for “negative” style scans like UDP and FIN, where what you are looking for is a port that does NOT respond.

Parallel port scanning: Some scanners simply scan ports linearly, one at a time, until they do all 65535. This actually works for TCP on a very fast local network, but the speed of this is not 5

at all acceptable on a wide area network like the Internet. It is best to use non-blocking i/o and parallel scanning in all TCP and UDP modes. Flexible port specification: You don’t always want to scan all 65535 ports! Also, the scanners which only allow you to scan ports 1 - N often fall short of my need. The scanner should allow you to specify an arbitrary number of ports and ranges for scanning. For example, ‘21-25,80-113’ is often useful if you are only probing the most frequently running services.

Flexible target specification: You may often want to scan more then one host, and you certainly don’t want to list every single host on a large network! It is useful to scan, say a subnet at once, e.g. 131.111.11.0 – 131.111.11.254.

Detection of down hosts: Some scanners allow you to scan large networks, but they waste a huge amount of time scanning 65535 ports of a dead host! Annoying! You are advised to choose a scanner which allows timeout intervals to be adjusted.

Detection of your IP address: For some reason, a lot of scanners ask you to type in your IP address as one of the parameters. You don’t want to have to ‘ifconfig’ and figure out your current IP address every time you connect. Of course, this is better then the scanners I’ve seen which require recompilation every time you change your address! If you are using a cable

‘always on’ connection, you may find that the IP address remains constant, as in my own case.

There are actually 65536 ports in all; however by convention services with which we are most familiar tend to use the lower numbers. Here are a few: FTP

21

Telnet

23

SMTP

25

HTTP

80

POP3

110

Although the services can be configured to use other ports, this is very unusual. Ports above 1024

tend to be used by the operating system. Essentially a port scanner sends packets of data on each port in tern, and listens for replies to determine what services are running. A detailed list is available at the end of the document. This is an example of a simple port scanner in use: 6

Network Topology Views

This may be useful on occasion. It provides a graphical view of the resources on your network.

For example, it may show which systems are behind a firewall, and which routers are on-line.

A ‘network viewer’.

Packet Sniffing

A packet sniffer or protocol analyser is a wire-tap device that plugs into computer networks and eavesdrops on the network traffic. Like a telephone wiretap allows one to listen in on other people’s conversations, a “sniffing” program lets someone listen in on computer conversations.

However, computer conversations consist of apparently random binary data. Therefore, network wiretap programs also come with a feature known as “protocol analysis”, which allow them to

“decode” the computer traffic and make sense of it. Sniffing also has one advantage over telephone wiretaps: many networks use “shared media”. This means that you don’t need to break into a wiring closet to install your wiretap, you can do it from almost any network connection to eavesdrop on your neighbours. This is called a “promiscuous mode” sniffer. However, this

“shared” technology is moving quickly toward “switched” technology where this will no longer be possible, which means you will have to actually tap into the wire.

There is no single point on the Internet where it is possible to ‘see’ all of the traffic. The connectivity of the Internet looks similar a fisherman’s net. Traffic flows through a mesh, and no single point will see it all! The Internet was built to withstand a nuclear attack—and to survive any “single point of failure”. This likewise prevents any single point of packet sniffing. Consider this situation: you have two machines in your own office talking to each other, and both are on the Internet. They take a direct route of communication, and the traffic never goes across the outside public portion of the Internet. Any communication anywhere in the net follows a similar

“least-cost-path” principle.

Ethernet was built around a “shared” principle: all machines on a local network share the same wire. This implies that all machines are able to “see” all the traffic on the same wire. Therefore, 7

Ethernet hardware is built with a “filter” that ignores all traffic that doesn’t belong to it. It does this by ignoring all frames whose MAC address doesn’t match their own. A wiretap program effectively turns off this filter, putting the Ethernet hardware into “promiscuous mode”. Thus, Mark can see all the traffic between Alice and Bob, as long as they are on the same Ethernet wire.

Since many machines may share a single Ethernet wire, each must have an individual identifier.

This doesn’t happen with dial-up modems, because it is assumed that any data you send to the modem is destined for the other side of the phone line. But when you send data out onto an Ethernet wire, you have to be clear which machine you intend to send the data to. Sure, in many cases today there are only two machines talking to each other, but you have to remember that Ethernet was designed for thousands of machines to share the same wire. This is accomplished by putting a unique 12-digit hex number in every piece of Ethernet hardware. To really understand why this is so important, you might want to review the information in section 5.4 below. Ethernet was designed to carry other traffic than just TCP/IP, and TCP/IP was designed to run over other wires (such as dial-up lines, which use no Ethernet). For example, many home users install

“NetBEUI” for File and Print Sharing because it is unrelated to TCP/IP, and therefore hackers from across the Internet can’t get at their hard-drives.

Raw transmission and reception on Ethernet is governed by the Ethernet equipment. You just can’t send data raw over the wire, you must first do something to it that Ethernet understands. In much the same way, you can’t stick a letter in a mailbox, you must first wrap it in an envelope with an address and stamp.

Following a is a brief explanation how this works: Alice has IP address: 10.0.0.23

Bob has IP address: 192.168.100.54

In order to talk to Bob, Alice needs to create an IP packet of the form 10.0.0.23-->192.168.100.54