/-----------------------------\ | Xine - issue #2 - Phile 018 | \-----------------------------/ b0z0/iKx presents..... ------------------------------------------------------------------ | Gaining information about a site (an account) from the outside | ------------------------------------------------------------------ Of course before we start to crack or even attack an internet host we must first of all know at least some basic things about it: which operating system does that system use, who is logged there, which services are avaiable from there, which is the rule of that host in its network and so on and so on... In this article i'll try to explain how to get as much informations on a host (and in some cases on a specific account) from the outside using both very simple and also present programs up to a little more advanced and more interesting scanning. /\/\/\ finger \/\/\/ Finger is a very simple program that allows you to get many interesting informations. Infact with finger you can see who is currently logged on an internet server. ikx:~$ finger @coolhost.org [coolhost.org] Login Name Tty Idle Login Time Office OfficePhone root root 2 2d Nov 26 16:17 bozo da b0z0 p2 1 Nov 28 16:19 (shit.coolhost.o) As you see we now know who is currently logged on coolhost.org, on which tty the user is logged, if he is working or he just forgot to logout, when he logged in and from where. Obvisiously it seems that the supervisor forgot to logout, because there wasn't any keypress in two days. But finger offers you more. With finger we can take more informations also a specific account. If we are going to crack a password or hack a site it may be adeguate to use an account that is sometime used or the others may notice us. ikx:~$ finger bozo@coolhost.org [coolhost.org] Login: bozo Name: b0z0 Directory: /home/b0z0 Shell: /bin/ash Last login Thu Nov 28 16:19 (MET) on ttyp2 from shit.coolhost.org Mail last read Thu Nov 28 16:31 1996 (MET) No Plan. So we now know many interesting things about that account. Infact it is also interesting to see where the user home is located and which shell does it use and if the user has logged in recently. This may be very interesting also with some general more important account such as root. On the other side anyone can install a better finger (such as the cfingerd) or, in a more fast way, directly disable the finger daemon. So we must now look for something else.... /\/\ host \/\/ host is a very powerfull program, that gives you a lot of informations about an internet host. ikx:~$ host shitty shitty.coolhost.org is a nickname for shit.coolhost.org shit.coolhost.org has address 202.123.26.2 So we now know a little more about the host. It's IP and a nickame. But of course host isn't just this. Infact with host we can get many other interesting stuff like the mail excanger for that host, the operating system that it runs (this isn't really true. I am now talking about the "HINFO" which is basically a description of the server, generally set to the operating system and/or platform that the server uses), the authoritative name server, who is responsable for the server and so on. To get all the possible informations with host we can use the "-a" switch. For more infos look at host(1) and named(8). ikx:~$ host -a shitty Trying domain "coolhost.org" rcode = 0 (Success), ancount=1 shitty.coolhost.org 60480 IN CNAME shit.coolhost.org shit.coolhost.org 60480 IN HINFO VAX-11/780 VMS For authoritative answers, see: coolhost.org 60480 IN NS master.coolhost.org Additional information: master.coolhost.org 60480 IN A 202.123.26.1 Trying null domain rcode = 0 (Success), ancount=1 shit.coolhost.org 60480 IN A 202.123.26.2 For authoritative answers, see: coolhost.org 60480 IN NS master.coolhost.org Additional information: master.coolhost.org 60480 IN A 202.123.26.1 Nice. As you can see we got (again) the canonical name of the server and we also now know that it runs on a VAX machine using VMS. It will be of help when we will search for old known holes. For a complete list of possible platform and operating system names (there is a convention for the names that can be used as the HINFO that is generally respected) give a look at the RFC 1700 (Assigned Numbers). /\/\/\/\ nslookup \/\/\/\/ With nslookup you can get basically get all the informations that you can get with host and finger at the same time. It is an interactive program. Well (watch out, the commands i'll type are preceeded by the ">"): ikx:~$ nslookup Default Server: master.coolhost.org Address: 202.123.26.1 > shitty Server: master.coolhost.org Address: 202.123.26.1 Name: shit.coolhost.org Address: 202.123.26.2 Aliases: shitty.coolhost.org > finger [shit.coolhost.org] Login Name Tty Idle Login Time Office Office Phone bozo b0z0 4 1:02 Nov 28 16:19 > set querytype=HINFO > shitty Server: master.coolhost.org Address: 202.123.26.1 shitty.coolhost.org canonical name = shit.coolhost.org shit.coolhost.org CPU = VAX-11/780 OS = VMS coolhost.org nameserver = master.coolhost.org master.coolhost.org internet address = 202.123.26.1 > exit ikx:~$ As you may see we got all the information that we may also get with the other services i described above. But the cool thing of nslookup is that you can also examine an entire domain. > ls coolhost.org [master.coolhost.org] coolhost.org. server = master.coolhost.org dalamah 202.123.26.3 master 202.123.26.1 shit 202.123.26.2 otherone 202.123.26.22 localhost 127.0.0.1 And using the various switches you can obtain the various informations (such as HINFO for example) for all the other hosts in the network. For example to get the OS and platform (of course where avaiable) of the various servers just do a "ls -h %host%". As for many other services also here some things may be limitated. Expecially the domain examination part is usually restricted. /\/\/\/\ dnsquery \/\/\/\/ Another useful tool to comunicate to the name server is dnsquery. This is a better tool that may replace nslookup and such. Basically with this you can get the same (well DNS requests don't change with the client, hehe :) ) data as with traceroute. So no examples for this, just read the manpage and you will find that there are some more features. /\/ dig \/\ As with for example nslookup also with dig you can do domain name queryes to name servers. Read the manuals and get the right switches :) You can do quite interesting things, for example a zone transfer (this is getting a lot of infos of the enitre network) if it wasn't disabled. Definitely a really cool utility, don't forget about this one :)) /\/\/\/\/\ traceroute \/\/\/\/\/ traceroute is a program that displays you the route that a packet must do to a host on the network. This may be very useful to obtain informations on how the packet you send (or the victim sends) go throught the net, so you can plan where you may modify or inject some packet for him or for example where you can alteratively break his connection. On the other side you may just also try to understand who is his ISP or which is the gateway in his net. So very useful for sniffing, packet injecting or also denial of service attacks. Let's see: ikx:~$ traceroute warz.tradz.net traceroute to warz.tradz.net (193.4.1.13), 30 hops max, 40 byte packets 1 pk-who-6.iam.dk (123.45.101.66) 469.262 ms 256.949 ms 329.12 ms 2 pk-who-3.iam.dk (123.45.101.32) 769.212 ms 546.742 ms 539.42 ms 3 pk-who-1.iam.dk (123.45.101.1) 742.262 ms 956.299 ms 1239.98 ms 4 pk-main-1.danger.net (154.123.4.32) 801.148 ms 1039.42 ms 950.054 ms 5 cool.danger.net (114.23.0.17) 1129.75 ms 954.136 ms 1560.16 ms 6 lamahs.com (204.41.23.12) 1280.69 ms 914.573 ms 1379.91 ms 7 warz.tradz.net (193.4.1.13) 1594.3 ms 1648.09 ms 1234.3ms Want an example of traceroute use? You got it: denial of service attack. The most classic, UDP war. You know that the host we would like to attack has UDP services active. Of course you must also get another host that will "fight" with him. So instead of chosing one on the other side of the world, examine the traceroute output and choose the closer :) (UDP war in the local network may be really funny, yea :-)) ) /\/\/\/ rpcinfo \/\/\/\ rpcinfo is a program that makes an rpc call to an rpc server and reports what it finds. Basically this is useful to see if services like nfs are running on the host. ikx:~$ rpcinfo -p coolhost.org program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100003 2 udp 2049 nfs 100003 2 tcp 2049 nfs 100005 1 udp 664 mountd 100005 1 tcp 666 mountd Or for example you can directly check if a RPC service is avaiable (using UDP or TCP). For example to see if the NFS daemon is running on the machine: ikx:~$ rpcinfo -u coolhost.org nfs program 100003 version 2 ready and waiting /\/\/\/\/ showmount \/\/\/\/\ showmount is a program that displays which parts of the filesystem can be exported and from where. ikx:~$ showmount -e shit Export list for shit: /cdrom *.coolhost.org /files/warez otherone.coolhost.org So of course you may have to read (or even also write) to some part of his filesystem. /\/\/\ rusers \/\/\/ rusers is another program that can be useful to see who is currently logged on the machine. To see who is currently online just ikx:~$ rusers -l coolhost.org hurd coolhost.org:ttyp0 Nov 28 16:17 :05 (shit.coolhost.or) root coolhost.org:ttyp3 Nov 28 16:26 :03 (shit.coolhost.or) As you may see the output is very similiar to the finger one. Anyway generally, as far as i saw around various servers, there aren't many (to be sincere there are just a few) servers that run the rusers daemon, so generally you will just get a: rusers: RPC: Program not registered /\/\ ping \/\/ it might sound stupid but also ping can became of use when observing a host. Infact it may be useful to see the speed of the host, if a host even replyes or something like, but in a very fast way. ikx:~$ ping coolhost.org PING master.coolhost.org (202.123.26.1): 56 data bytes 64 bytes from 202.123.26.1: icmp_seq=0 ttl=64 time=2.1 ms 64 bytes from 202.123.26.1: icmp_seq=1 ttl=64 time=1.7 ms 64 bytes from 202.123.26.1: icmp_seq=2 ttl=64 time=1.7 ms --- master.coolhost.org ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 1.7/1.8/2.1 ms /\/\/\/\/ using ftp \/\/\/\/\ Also FTP can be used to get some interesting information about the site that you would like to examine. With the command "syst" infact you can get the operating system that is running on their machine. ikx:~$ ftp coolhost.org Connected to master.coolhost.org 220 master FTP server server (Version 5.60) ready Name (master:gurgo): --> ftp 331 Guest login ok, send ident as password. Password: --> cool@mail.org 230 Guest login ok, access restrictions apply. ftp> --> syst 215 UNIX Type: L8 ftp> Well, it doesn't tell you a lot of things. It is a UNIX like operating system (again look at RFC 1700 for used names) and every byte is composed by 8 bits (this is the mean of L8). Well, some ftpds will give you some more infos. For example on a FreeBSD machine i can get: 215 UNIX Type: L8 Version: BSD 199306 /\/\/\/\/\/\/\/\/\/\ IP adresses scanning \/\/\/\/\/\/\/\/\/\/ Since usually name servers doesn't allow zone transfers (this is to get the entire list of machines in the net using for example "ls xxxx.yyy" with nslookup) you may not be able to know about all the machines are in a network. Of course it may be very usefull to know about all (or at least many) of the servers in the netowrk. So we will now practise IP scanning, this is very simply and it is basically just a trivial scanning of all the IPs of a network or of a part of it. As for example you want to know more about the 123.123.123.* computers. You may manually ping or try in some way to look for each one, but you may more likely get a IP scanner (one in included in this zine) that will do the work for you. The scanner included in this zine will basically try to determinate if a host is there by sending a ping and, if requested, by doing a name server look up. Let's see a sample: ikx:~$ ipscan -H 123.123.123.1 -e 5 -z 1 IPScan - by b0z0/iKx Looking for 123.123.123.1 ..... Seems reachable 1.123.123.123.in-addr.arpa PTR first.onetwothree.com Looking for 123.123.123.2 ..... Seems unreachable 2.123.123.123.in-addr.arpa PTR second.onetwothree.com Looking for 123.123.123.3 ..... Seems unreachable 3.123.123.123.in-addr.arpa PTR third.onetwothree.com Looking for 123.123.123.4 ..... Seems unreachable Host not found. Looking for 123.123.123.5 ..... Seems reachable 5.123.123.123.in-addr.arpa PTR fifth.onetwothree.com As you may see .1 and .5 seems to be reachable, so we suppose they are up and running. We also see that .2 and .3 seem to be configured in the network, but currently down or something. /\/\/\/\/\/\/\/\/ TCP port scanning \/\/\/\/\/\/\/\/\ TCP port scanning is one of the most classic and also most useful parts when gaining informations about a site. Infact with TCP port scanning i intend the act to try to look at all (well, generally only to a part of them) of the TCP ports of a server to see if a service is running on it. For example the smtp is usually running at port 25. Of course it would be very nice to see if the site that we would like to examine has that service activated and/or what is the response on that port (we may would like to see which version of Sendmail is running there for example). Of course you are not going to scan every port manually doing a telnet. Generally such called "TCP Port scanners" are used. There are many scanners of this type around, one if for example the TUPoSca that is also included with this zine. Let's try to see which services are active on a host. In this case we may not scan all the ports, but for example we will start from port 19 (which is chargen) up to 25 (smtp): ikx:~$ tuposca -H pirolo.coolhost.org -l 19 -h 25 TUPoSca v0.1b - by b0z0/iKx Looking if server seems reachable.... Well, it seems that it is reachable Service chargen at port 19 present! Service Unknown at port 20 not present! Service ftp at port 21 present! Service ssh at port 22 not present! Service telnet at port 23 present! Service Unknown at port 24 not present! Service smtp at port 25 not present! As you may see the host has for example activated chargen, ftp and telnet, but it doens't have smtp running. So for example you can already forgot all the attacks that may be possible by using some weakness of Sendmail. Well, the host has ftp active. But this isn't really enought for us. Infact we may also need to know which version of ftp is running. Maybe a buggy ftp may be of help for us. By the way we may also see which system is running there, so: ikx:~$ tuposca -H pirolo.coolhost.org -l 21 -h 21 -o 1 -s 'SYST' [snip] Service ftp at port 21 present! 220 pirolo FTP server (Version wu-2.4(1) Tue Aug 8 15:50:43 CDT 1995) ready. 215 UNIX Type: L8 [snip] Nice. So we now know that is in a UNIX based (not a lot of interesting info from this :-( ) and that it is running wuftpd 2.4(1). It is cool to know that a buggy ftp daemon is installed. As for the ftp you may also want to log the replyes of all the other active services (expecially for those that you have already a bug report). From all this data then you may have to see for weakness or for probable tipical (as encountered usually on systems or as founded on distribuitions) misconfiguration errors. But pay attention! When you use a TCP scanner (or at least most of TCP scanners works in this way) the target host will of course log that someone has logged into it. So if you are going to scan massively a host the sysadm may notice a lot of consequential logins (on various ports of course) from your host. There are also some utilityes that checks for this scans automatically (one of these is for example Courtney). They basically checks the number of connections (on one, all, or also on a set of TCP ports) in a determinate interval of time. If more than X (say for example 10 or 15) connections have been done in a very small amount of time (1 minute would be a good example) then the program will hypotize that a scan is being done (well, it will be very probable, because not very frequently a normal user connects to 10-15 different ports at once). Don't try to get all the information in a small amount of time. Place a small pause between each connection or better scan a few ports at a day. \/\/\/\/\/\/\/\/\ UDP port scanning /\/\/\/\/\/\/\/\/ Some services also listen/work on UDP ports. There aren't many of them, but some may result quite interesting. With the difference from TCP, UDP is connectionless, so you can't just try to connect at an UDP port to see if it is active. To check if it is you must try to send a packet and see if you get an error from the host (to be more precise if no service is active on a certain UDP port you will get an ICMP of the Destination Unreachable[Port] type). Some UDP services like for example chargen (port 19) will also give a response to you. On the other side some services like for example the talk (port 517) will need an appropriately composed packet or it will seem that nothing is on there. UDP ports aren't usually used for cracking a site but are rather used in denial of service attacks. Infact a host that isn't configured fine can be very vulnerable to denial of service attacks. An UDP war (this mean a continuous sending of packet from an UDP port to another UDP war) between two hosts may drastically lower the two hosts performance. Please take note of some very hot servics based on udp. First of all the Internet name service. This means that name resolution is easly subverted. Another class of UDP based services are those built on RCP. The most useful (and those that may be a good target also) are NFS and NIS. /\/\/\/\/\/\/\ using sendmail \/\/\/\/\/\/\/ When searching for some information on an account also sendmail may be of a little use. Infact we can see who belongs to an Login ID and where the mail for that user is really sent. (the "-->" are what i typed) ikx:~$ telnet coolhost.org 25 Trying 202.123.26.1... Connected to master.coolhost.org. Escape character is '^]'. 220-master.coolhost.org Sendmail 8.6.12/8.6.12 ready at Thu, 28 Nov 1996 18:26:51 +0100 220 ESMTP spoken here ---> VERB ---> VRFY b0z0 050 /etc/aliases: 8 aliases, longest 4 bytes, 100 bytes total 250 ---> EXPN b0z0 050 /etc/aliases: 8 aliases, longest 4 bytes, 100 bytes total 250 Lt. Joe Doe Boe BoZo ---> EXPN forwy 050 /etc/aliases: 8 aliases, longest 4 bytes, 100 bytes total 050 forwy... aliased to someone 250 Of course these options can be easily disabled, but not many sysadms take care of this. Anyway if it is disabled you may get: EXPN joedoe 502 Sorry, we do not allow this operation VRFY joedoe 252 Who's to say? /\/\/\/\/\/\ using httpds \/\/\/\/\/\/ Of course really a lot of servers around have a www server activated. Generally you can get it on the standard 80 port, often on 8080 as proxy also. Often the used server will tell you his name when an error occours, but this may also not be true. So with the classic command "GET / HTTP/1.0" you can get some more interesting info about the running, let's see: [snip] HTTP/1.1 200 OK Date: Tue, 11 Feb 1997 16:07:22 GMT Server: Apache/1.2b4 Connection: close Content-Type: text/html Last-Modified: Tue, 5 Feb 1997 11:21:33 GMT ETag: "13d04-b3-11226543" Content-Length: 666 Accept-Ranges: bytes [snip] You got the real server type and some not very interesting info. Another may give you some more informations (for example the cookies one). After this stage you may for example (to continue the www server speech) look for interesting buggy cgis that are shipped by default with a specific kind of server. Just to mention to continue the Apache example you may try to get some interesting configuration files trought the old phf, or maybe just see how is composed the directory structure using the test-cgi or the nph-test-cgi. But that's old stuff and doesn't even have really any connection with this article. /\/\/\/\/\ using auth \/\/\/\/\/ The auth service is used by some programs to authentificate a user access. The identd (the daemon that offers the auth service) stays on port 113. With this you can know which user from a remote server is currently working on a port of the your server. So this may be of use if you are looking who is accessing actually on a port of your server. For example ikx:~$ telnet coolhost.org 113 Trying 202.123.26.1... Connected to master.coolhost.org. Escape character is '^]'. --->1296,25 1296 , 25 : USERID : UNIX : Manzo Connection closed by foreign host. The line with "--->" is what we sent. Well in this example we have asked coolhost.org who is connecting from the port 1296 to our 25 port. As you can see the user was Manzo. As you noticed with auth you won't get directly some new information about the other host. But this may be of course useful in some cases where you want to determinate some transactions to your server.