Section 3 - Hacking

3.0 Hacking

In the sections below I frequently use the terms hackers and cracker, the actual meaning of the words will always be debated, but here is how I am using them. A Cracker is someone who breaks passwords, often without the need for a great deal of knowledge of the systems they are breaking into, just a few tools and techniques. A hacker on the other hand will take a great deal of time to learn about the system (s)he is hacking. A hacker will read all the manuals and documentation possible and newsgroups such as comp.security.misc

To learn about cracking read alt.2600 and sit on various irc channels, to learn about hacking RTFM, read everything you can get your hands on, have a desire to understand the machine you are hacking.

3.1 About UNIX hacking

Unix is a fully multi-tasking, multi-user operating system, written in C, one of its strengths is its ability to network. There are versions of Unix for most systems from DEC AXPs to 386 PCs. A very large proportion of the hosts on the internet are running UNIX.

The net is full of unix security info, but a good starting point is Arny's UNIX hacking page (see section 5).

3.1.1 How do I crack UNIX passwords ?

On some systems /etc/passwd contains and encrypted copy of your passwd Cracking programs (Alex Muffits 'crack' for UNIX, and CrackerJack for OS/2 and DOS are just two) try to *guess passwords by encrypting each word in a dictionary and comparing each encrypted word against each entry into /etc/passwd

On other systems /etc/passwd doesn't store the password. It can be stored in a shadow file (that is not normally readable to normal users). To obtain the (encrypted) passwords you have to have a special program to read it. The source for a program to do this is obtainable from the alt.2600 faq

A third method is to use NIS (which again may or may not be shadowed). This may be readable by using the ypcat command. Again, see the alt.2600 faq again.




+-BEGIN Cut here [ami.com] ------------------+

begin fe4 ami.com

MZQ8WH`(!YG#K`/X&`@&`/@(!/W0JY''#Z.C_)/”(Q.CA_PC`=!E0,,DXX'0+

MJ.%Z`?G0T/[!=?&(R,TI6.O>,,##+R\@0G5GR`H8RDN($-R86-K06UI0FEO

6R`Q+C$@+R^._#/2`E4IXQ.+P@/#:2\@

`

end

+- END Cut here [ami.com] -------------------+

Other PCs (Dells come to mind), have a jumper that can be moved to disable passwords

3.3.2 How can I crack the windows screen saver password ?

[ I haven't had chance to check either of these Can someone please confirm / disprove them please ]
To remove the password all together (presuming it hasn't locked already) edit control.ini, edit the line that says PWProtected=1 to =0 and in the [ScreeSaver] section, where it says Password=12345 (where 12345 is the encrypted password) change it to Password=
Now when prompted for a password just press return

If it is active, drag the window prompting you for the password around with the mouse (making the active window). Then press ctrl-alt-del (having 3 hands would be a help :). This should then give you the option to quit active application
[ You may have to put something in control.ini to enable this ? - Info anyone ]

Learn low leve TCP/IP. Basically with IP you can pretend to be any machine you want to be, i.e. you dont *have* to put your own IP address as the 'source address' in the datagrams (or packets) that you send out. Unfortunately though, any reply to your faked packets will normally go to the real machine, which kinda makes it difficult to use TCP since TCP envolves a two way flow of IP datagrams both to and from your machine. However you can to some extent get round this by guessing some of the contents (i.e. the sequence numbers) of the lost datagrams that were sent to the real machine.)

If anyone has had any success with this, plaese tell us :)