416 lines
20 KiB
Plaintext
416 lines
20 KiB
Plaintext
==Phrack Inc.==
|
|
|
|
Volume 0x0e, Issue 0x43, Phile #0x01 of 0x10
|
|
|
|
|=----------------------------------------------------------------------=|
|
|
|=--------------------------=[ Introduction ]=--------------------------=|
|
|
|=----------------------------------------------------------------------=|
|
|
|=----------------------=[ By The Phrack Staff ]=-----------------------=|
|
|
|=----------------------------------------------------------------------=|
|
|
|=----------------------=[ November 17, 2010 ]=-----------------------=|
|
|
|=----------------------------------------------------------------------=|
|
|
|
|
|
|
"The greatest trick the Devil ever pulled was convincing
|
|
the world he didn't exist"
|
|
--- Verbal Kint
|
|
|
|
|
|
It's 1.00 a.m., nobody hits this secondary road. Heck, I'm almost
|
|
sure half of it doesn't have a line to remind you that you should share it
|
|
with upcoming cars. It's raining, but not too hard. I'm going home.
|
|
|
|
It's Tuesday. What the hell am I doing out here, half an hour from
|
|
home, slowly driving under the rain? It's 1.05 a.m., I know this road, I
|
|
know this feeling, I recognize the shivering. I let it flow. Turn off the
|
|
music, I want silence.
|
|
|
|
It's 2.00 a.m., nobody hits this machine at this time of the day.
|
|
Logs track me, but I'll clean them. I know this road, I know this feeling,
|
|
I recognize the shivering. Turn on the music, the game is on. I'm sure
|
|
someone else is around here, someone else has seen this # before.
|
|
|
|
"I'll fuck you if you don't fuck me first, sir". Fair enough, this
|
|
is the rule. I'll go to sleep afterwards. I'm meeting some friends and I've
|
|
to take a train tomorrow. I'll sleep on the couch of someone I've never
|
|
seen before, yet I know him well.
|
|
|
|
It's 1.00 a.m., 10 years later. It's a GPG email from the guy that
|
|
once offered me a couch. Then another time. I can count the times I've seen
|
|
him in person on two hands, but I would overflow a 'short' counting the
|
|
words we exchanged. We meet again, thought you disappeared. Things change,
|
|
indeed. Life gave us something to lose and we are holding on it. We lost
|
|
people, money, opportunities, that's why we hold on. Once a hacker, forever
|
|
a hacker, right? Let's finish this code. Let's visit this city.
|
|
|
|
It's 2.00 a.m., today. Nothing in this story, in this Intro, is
|
|
real. I wasn't there, this is not me. This is just a stream of ASCII
|
|
characters. Someone out there pulled a great trick and convinced the world
|
|
that security was a cool business. Someone is pulling even greater tricks
|
|
and makes money out of his ignorance living on others slightly bigger
|
|
ignorance. Somewhere, a crackdown on some kids proves to be necessary to
|
|
keep the 'mistery' alive, to keep the bandwagon going. Someone spies on
|
|
former fellow friends, 'cause that's worth millions. Everybody is happy and
|
|
we slowly fade away. Away, towards a new Underground.
|
|
|
|
"I'll fuck you if you don't fuck me first, sir".
|
|
|
|
If you are shivering, if you have been there, if you feel it, you know what
|
|
I mean. PHRACK may die. Groups may die. Things as we know today may die.
|
|
The great trick might actually seem to work -- goodbye Underground, welcome
|
|
Security Industry. Not too fast.
|
|
|
|
"Once a hacker, forever a hacker, right?"
|
|
|
|
The Game is on.
|
|
|
|
|
|
-----( Phrack Issue #67 )-----
|
|
|
|
|
|
It's with incredible pleasure that we present you our newly released issue:
|
|
|
|
______ _ _ ______ _______ _______ _ _ _ _ _______ ______
|
|
(_____ \(_) (_|_____ \(_______|_______|_) | | _| U |_(_______|______)
|
|
_____) )_______ _____) )_______ _ _____| | (_ _)______ _
|
|
| ____/| ___ | __ /| ___ | | | _ _) _| O |_| ___ \ / )
|
|
| | | | | | | \ \| | | | |_____| | \ \ (_ _) |___) ) / /
|
|
|_| |_| |_|_| |_|_| |_|\______)_| \_) |_n_| |______/ (_/
|
|
|
|
- By the community, for the community. -
|
|
|
|
|
|
But wait ... the release date ... it sounds familiar ... OMFG!!!
|
|
|
|
|
|
\\\ ,
|
|
\ `|
|
|
) ( .-""-.
|
|
| | /_ { '.
|
|
| | (/ `\ } )
|
|
| | ^/ ^`} {
|
|
\ \ \= ( { )
|
|
\ \ '-, { {{
|
|
\ \_.' ) } )
|
|
\.-' ( (
|
|
/'-.'_. ) ( }
|
|
\_( { _/\
|
|
) '--' `-;\ \
|
|
_.-' / / /
|
|
<\/>_.' .' / /
|
|
<\/></\>/. ' /<\// /
|
|
</\> _ |\`- _ . -/|<// (
|
|
<\/> - _- ` _.-'`_/- | \
|
|
</\> - - - - \\\
|
|
}`<\/> <\/>`{
|
|
{ </\>-<\/>_<\/>_<\/>-</\> }
|
|
} </\> </\> </\> {
|
|
<\/>. <\/>
|
|
</\> </\>
|
|
{`<\/> <\/>`}
|
|
} </\>-<\/>_<\/>_<\/>_<\/>-</\> {
|
|
{ </\> </\> </\> </\> }
|
|
} }
|
|
{ H A P P Y {
|
|
} }
|
|
{ 25th {
|
|
<\/> <\/>
|
|
</\> B I R T H D A Y </\>
|
|
`<\/> <\/>'
|
|
jgs </\>-<\/>_<\/>_<\/>_<\/>_<\/>-</\>
|
|
</\> </\> </\> </\> </\>
|
|
|
|
|
|
Yes. That's right friends. This 67th issue is the celebration of Phrack's
|
|
25th birthday. Happy birthday Phrack!
|
|
|
|
|
|
-----( Coming from the past )-----
|
|
|
|
Once upon a midnight dreary, while I pondered, weak and weary, over many a
|
|
quaint and curious volume of forgotten lore...
|
|
|
|
Hello Cyberpals. It's your old friend Mike Schiffman AKA route AKA daemon9.
|
|
*Cyberhug!* It sure has been a long time! Well I'll be! You guys all look
|
|
the same, young and eager and hungry... Me? I'm still here, just older and
|
|
grayer and bit less conspicuous. Ok, I'll say it -- I'm downright honored
|
|
that you crazy rascals still remember me.
|
|
|
|
It sure has been many a fortnight that I've been in this business. I mean,
|
|
back in 1994, when I started poking around the scene in I was just a little
|
|
dork who use to work out a lot and bleach my hair white. Sure I was
|
|
probably the first muscle-bound white-haired guy with giant computer chip
|
|
tattoo on his back who had this tireless thirst for computers and hacking
|
|
and writing all sorts of Usenet posts and papers -- but there would legions
|
|
more to come...
|
|
|
|
Now in 2010 I'm a much bigger and more experienced dork. It's more than 16
|
|
years later. I have many more tattoos and the hair is getting white all by
|
|
itself. And I reminisce... I look back and reflect on those days. Some of
|
|
the stuff I use to do... My comp.security Usenet posts. "The Infinity
|
|
Concept" e-zine, the precursor to my Phrack editorial days. My netcom.com
|
|
.plan file. The PGP Attack FAQ.
|
|
|
|
I remember getting owned. I remember the first time my phones got done up
|
|
and you miscreants forwarded my calls to bridge and told people I had died
|
|
of AIDS. I remember my girlfriend at the time being scared shitless of what
|
|
was next. I remember my dox getting dumped to #phrack. I remember u4ea
|
|
threatening to insert my SSN into the NCIC. I remember Bane and u4ea
|
|
calling my house repeatedly. I also remember pictures of u4ea
|
|
cross-dressing. I remember Bane getting backhanded by Synapse at Defcon 4.
|
|
I remember Special Agent Peter Trahon and his partner who looked and
|
|
sounded like Sargent Slaughter from GI JOE both from the San Francisco FBI
|
|
Computer Crime task force picking me in a late model Crown Victoria and
|
|
taking me to Max's Opera Cafe in Walnut Creek, CA and shaking me down for
|
|
dirt on other cyber-dorks they were investigating... I remember teardrop.
|
|
I remember Loki. I remember TQBF telling me that I had better be real
|
|
careful in releasing the technique/code of ICMP covert channel tunneling as
|
|
I was "stepping on active people's toes"... I remember hooking an old
|
|
landline phone up to my neighbor's wiring to call him and discuss it... I
|
|
remember Carolyn Meinel... And her daughter Virginia at Defcon 5. I
|
|
remember Eric Bloodaxe tapping me to be a Phrack editor a long with Voyager
|
|
and Redragon. I remember overshadowing them and bringing my own editorial
|
|
team onboard... I remember how awesome it was to be a Phrack Editor.
|
|
|
|
I remember how awesome Phrack was. How amazing it still is. Kudos to the
|
|
current editorial team for keeping it alive, and here's to another 25
|
|
years. Come find me then, and prophile me.
|
|
|
|
XOXO Scene,
|
|
|
|
MS AKA Route AKA daemon9
|
|
|
|
|
|
-----( What you were waiting for )-----
|
|
|
|
Telling you that we're proud to release this issue would be an euphemism
|
|
for many reasons including, and that is the most important, the pleasure
|
|
you will have while reading it. Oh and by the way, we apologize for the
|
|
wait ...
|
|
|
|
08:21 | --->| su [~su@201.6.x.y] #phrack
|
|
08:23 | --->| arr[][] [arr@fledge.z.org] #phrack
|
|
08:29 | su | halfdead, are you having trouble in man gcc this time? is
|
|
that why phrack's issue is so late?
|
|
08:30 | Dreg | wtf
|
|
08:30 | @bab00n | hoho
|
|
|
|
Double. No. Triple private joke. You may have waited a long time but at
|
|
least we made it before ZF #06 ;>
|
|
|
|
$ cat p67/index.txt
|
|
|
|
<--------------------------( Table of Contents )-------------------------->
|
|
|
|
0x01 Introduction ....................................... Phrack Staff
|
|
|
|
0x02 Phrack Prophile on punk ............................ Phrack Staff
|
|
|
|
0x03 Phrack World News .................................. EL ZILCHO
|
|
|
|
0x04 Loopback (is back) ................................. Phrack Staff
|
|
|
|
0x05 How to make it in Prison ........................... TAp
|
|
|
|
0x06 Kernel instrumentation using kprobes ............... ElfMaster
|
|
|
|
0x07 ProFTPD with mod_sql pre-authentication ............ FelineMenace
|
|
|
|
0x08 The House Of Lore: Reloaded ........................ blackngel
|
|
|
|
0x09 A Eulogy for Format Strings ........................ Captain Planet
|
|
|
|
0x0a Dynamic Program Analysis and Software Exploitation . BSDaemon
|
|
|
|
0x0b Exploiting memory corruptions in Fortran programs .. Magma
|
|
under UNIX/VMS
|
|
|
|
0x0c PHRACKERZ: Two Tales ............................... Antipeace
|
|
&
|
|
The Analog Kid
|
|
|
|
0x0d Scraps of notes on remote stack overflow ........... pi3
|
|
exploitation
|
|
|
|
0x0e Notes Concerning the Security, Design and .......... The Philosopher
|
|
Administration of Siemens DCO-CS Digital
|
|
Switching Systems
|
|
|
|
0x0f Hacking the mind for fun and profit ................ lvxferis
|
|
|
|
0x10 International Scenes ............................... various
|
|
|
|
<------------------------------------------------------------------------->
|
|
|
|
Have you ever noticed how some issues seemed to have a thematic? Consider
|
|
for example p66. There are 4 papers dealing with heap exploitation. Now
|
|
take p63. 5 papers are about (anti)reverse engineering and binary
|
|
manipulation techniques and p62 clearly has a Windows color. Weird, isn't
|
|
it? Coincidence? Bias in the uniform distribution of hacking playgrounds?
|
|
I'll let you draw your own conclusions.
|
|
|
|
For this issue, with no doubts, the focus is on userland exploitation. Did
|
|
you really think that you had seen everything? Well how about debugging
|
|
some heap? While FelineMenace gives you tricks using an usual practical
|
|
case (hint: don't miss the source code), blackngel explains in detail the
|
|
House Of Lore technique. Having troubles with fortify? Go read Captain
|
|
Planet's excellent paper on format bugs as well as pi3's notes about
|
|
cookies. It might be handy.
|
|
|
|
Exploiting bugs is cool but finding them is de facto mandatory. That's when
|
|
BSDaemon's paper comes to play. Read it and learn about how to instrument
|
|
programs. Now what about a new playground? Discover the joy of Fortran
|
|
hacking with Magma. Oh btw he may just have lost it you know...
|
|
|
|
Missing kernel fun? Why not reading ElfMaster's paper. You'll certainly
|
|
learn a bit of useful things, truly. Missing the good old phreaking days?
|
|
Thank The Philosopher for his contribution (you made us crazy man !@#) and
|
|
go learning about old school DCO-CS hacking.
|
|
|
|
The best for the end. We have the luck to have no more than 4 non technical
|
|
papers for this issue. You don't care? Fucking idiot, go away.
|
|
|
|
Though we already thanked them, let us highlight EL ZILCHO, TAp, Antipeace,
|
|
The Analog Kid, lvxferis & the anonymous contributors of the "International
|
|
Scenes" phile. Phrack is without a doubt one of the most technical source
|
|
of knowledge of the whole hacking scene thanks to its writers. But the
|
|
most important aspect is not the technical one. Nowadays there are lots of
|
|
impressive sources of information (blogs, books, conferences) freely
|
|
available on Internet. However they all lack a soul. Phrack has a spirit
|
|
and that's its true power.
|
|
|
|
Now as a demonstration of the so-called spirit, we have the brilliant work
|
|
of EL ZILCHO. Tired of the crap published on zdnet? Then have a taste of
|
|
the Phrack World News. Eager to learn about life experiences? TAp is your
|
|
man with one of the most fascinating papers of this issue. You should also
|
|
consider alternative literature with lvxferis' paper. Ahah.
|
|
|
|
Oh and if you're just passing by, attracted by the hacking culture but not
|
|
yet ready/able to embrace it then Phrackerz paper is for you. It should
|
|
bring you answers.
|
|
|
|
-- The Phrack Staff
|
|
|
|
Ps: Oops sorry to forget o_O. It came to our attention after Pipacs'
|
|
profile publication in p66 that whitehats profile were the most wanted one.
|
|
Unfortunately Theo was already on holidays [1] when we needed to start the
|
|
interview. Sorry guyz ;> Have fun anyway with punk!
|
|
|
|
[1] http://kerneltrap.org/mailarchive/openbsd-misc/2010/8/13/6186
|
|
|
|
|
|
-----( GreetZ for issue #67 )-----
|
|
|
|
As always and because our staff would have done nothing but shit without
|
|
them, we'd like to thank (in no particular order)...
|
|
|
|
- route/daemon9: still able to make a kickass intro ;)
|
|
- The Analog Kid: the spirited kid
|
|
- nullcon guyz: nice people, visit their great country!
|
|
- EL ZILCHO: fuck1ng great job!
|
|
- TAp: peace bro :>
|
|
- ElfMaster: yet another kernel hax0r ;)
|
|
- lvxferis: who is this guy???
|
|
- FelineMenace: the LOLCats team counterattacks ;-)
|
|
- spacewalker: supportive & gifted belgian bro
|
|
- blackngel: malloc's worse enemy
|
|
- Captain Planet: fmt bugs' worse enemy (lake of inspiration
|
|
detected)
|
|
- argp & huku: kudos for kickass answers in no time
|
|
- BSDaemon: oi. Tudo bom?
|
|
- punk: the whitehat k1ll3r
|
|
- the VX scene: thanks for the support & various exchanges over
|
|
past months. Special thanks to izee, herm1t and
|
|
EOF writers.
|
|
- Magma: take your pills gramps
|
|
- The Philosopher: well done
|
|
- antipeace: ~_o
|
|
- pi3: Hi bulba! (oops wrong one)
|
|
- spy: our IRC bot
|
|
- halfdead: su said you contributed on IRC ;)
|
|
|
|
- the circle: kudos for your past work.
|
|
|
|
...for their contributions and support. Touching isn't it? But so true :-)
|
|
|
|
|
|
-----( Phrack Magazine's policy )-----
|
|
|
|
phrack:~# head -20 /usr/include/std-disclaimer.h
|
|
/*
|
|
* All information in Phrack Magazine is, to the best of the ability of
|
|
* the editors and contributors, truthful and accurate. When possible,
|
|
* all facts are checked, all code is compiled. However, we are not
|
|
* omniscient (hell, we don't even get paid). It is entirely possible
|
|
* something contained within this publication is incorrect in some way.
|
|
* If this is the case, please drop us some email so that we can correct
|
|
* it in a future issue.
|
|
*
|
|
*
|
|
* Also, keep in mind that Phrack Magazine accepts no responsibility for
|
|
* the entirely stupid (or illegal) things people may do with the
|
|
* information contained herein. Phrack is a compendium of knowledge,
|
|
* wisdom, wit, and sass. We neither advocate, condone nor participate
|
|
* in any sort of illicit behavior. But we will sit back and watch.
|
|
*
|
|
*
|
|
* Lastly, it bears mentioning that the opinions that may be expressed in
|
|
* the articles of Phrack Magazine are intellectual property of their
|
|
* authors.
|
|
* These opinions do not necessarily represent those of the Phrack Staff.
|
|
*/
|
|
|
|
-----( Contact Phrack Magazine )-----
|
|
|
|
|
|
< Editors : staff[at]phrack{dot}org >
|
|
> Submissions : staff[at]phrack{dot}org <
|
|
< Commentary : loopback[@]phrack{dot}org >
|
|
> Phrack World News : pwned[at]phrack{dot}org <
|
|
|
|
|
|
Submissions may be encrypted with the following PGP key:
|
|
(Hint: Always use the PGP key from the latest issue)
|
|
|
|
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
Version: PHRACK
|
|
|
|
mQGiBEucoWIRBACFnpCCYMYBX0ygl3LrH+WWMl/g6WZxxwLM2IT65gXCuvOEbLHR
|
|
/OdZ5T7Z6sO4O5b0EWkk5pa1Z8egNp44+Fn+ExI78cv7ML9ffw1WEAS+raQwvN2w
|
|
0WUsfztWHZqPf4HMefX92pv+1kVcio/b0aRT5lRbvD7IdYLrtYb0V7RYGwCgi6Or
|
|
dJ5iN+YVDMx8lkUICI8kPxcD/1aHZqCzFx7lI//4OtZQN0ndP1OEH+C7GDfYWi4P
|
|
DcLNlF812h1qyJf3QCs93PQR+fu7XWAIyyo5rLHpFfuU29ZZH1Oe0VR6pLJTas2Z
|
|
zXNdU48Bhj1uf4Xv0NaAYlQ5ffIJ4a37uIKYRn28sOwH/7P8VGD7K7EZn3MMyewo
|
|
aPPsA/4ylQtKkaPB9iTKUlimy5ZZorPwzhNliEbIanCGfePgPz02QMG8gnId40/o
|
|
luE0YK1GnUbIMOb6LzI2A5EuQxzGrWzDGOM3uLDLzJtBCg8oKFrUoRVu1dnPEqc/
|
|
NQzRYjRK8R8DoDa/QZgyn19pXx4oQ3tAldI4dAQ022ajUhEoobQfUGhyYWNrIFN0
|
|
YWZmIDxzdGFmZkBwaHJhY2sub3JnPohgBBMRAgAgBQJLnKFiAhsDBgsJCAcDAgQV
|
|
AggDBBYCAwECHgECF4AACgkQxgxUfYgthE7RagCeL/XirVrcUzgKBrJGcvo0xjIE
|
|
YlkAoIBqC2GuYJrXxPO/KaJtXglJjd7zuQQNBEucoWIQEADrU+2GAZbWbTElblRp
|
|
/MyoUNHm0gxOo7afqVdQe8epub/waQD1bnE+VucI7ncmQWUdD0qkkyzaXlFDlvId
|
|
LYh/dMu4/h+nTyuCLNqoycqvf1k8Dax6QOADq0BZlM5lGTL6VOBnCitWCvgYCmLO
|
|
aPO1bacJlNx0/cpWKe+YELlZss7Q+o4SBvDOyX8B78eEs62dbRAudubFQ/tjQd3z
|
|
cXZOSli9Du9DAa2vzk8tq1c6RAs0NY4KxBu+6VW/lxvGt3iNRlFQAdya6Kx3fhog
|
|
zVjkt3OOgNDJ6u/9zYbMbtjtoFqSIJDR4DhZ9NbS57nuTkJqh0GDVOtxfKcc8QxH
|
|
wyYiH47M9znHFtHHvT0PzGc2Fl8s3EUFvlXZUW3ikcFbkyqTgnseqv5k9YQ8FDHX
|
|
IvBVpj8nqLi3CBADy8z2gy5r4TryV3sfOlTT40r0GtiG3Weeb0wuMj5+hr303zgN
|
|
/aH+ps8JvL0TeyXjsDMcTCF1fHSIxPJouSWjOkFMrumAg/rikdn3+dPCCowcLKvQ
|
|
isYC60yKEhcYvUDiKKzXrGyM/38Kp/73RA9ZLQ3VjCSX550UCU46hF6u6Qzbd5Jk
|
|
T8WesPYqz4jpPzlF1MbaVki4+g5myTR8y1IIarX08mk6l+1YZyjjzmlhKyhdaIiI
|
|
QY4uv3EYYFDHiyd0/3ZBfkz62wADBQ//bVf698IFhoLHeCG3USyl/rHyjVUatsCx
|
|
ZCwPlWEGzR+RP3XdqwoeFZNA4hXYy3Qr1vJSytbCRDYOK2Rp3Eos1Gncqp3KbUhQ
|
|
ZRBxGNbhskZ7VHOvBHIIZ7QU3TDnWLDlWs9oha8zv9XWEmaBmCjBtmRwunphwdv2
|
|
O7JpqLbW45l/WAas6CuRi+VxXllQPM2nKX9JwzyWlvnU3QayO+JJwH5bfeW0Wz53
|
|
wqMBJz9hvVaClfAzwEnPnWQxxgA6j7S9AuEv7NRLZsC6nHyGwB7vFfL4dCKt4cer
|
|
gYOk5RjhHVNuLJSLhVWRfcxymPRKg07harb9adrPcjJ7fCKXN1oPCcacG0O6vcTb
|
|
k58MTzs3CShJ58iqVczU6ssGiVNFmfnTrYiHXXvo/+36c+TizwoXJD7CNGDc+8C0
|
|
IxKsZbxgvpFuyRRwrzr3PpecY0I2cWZ7wN3WtFZkDi5OtsIKTXHOozmddhAwxqGK
|
|
eURB/yI/4L7t2Kh2EaVOyRbXNa4hwPbqbFiofihjKQ1fFsYCUUW0CAOaXu14QrrC
|
|
IepRMQ2tabrYCfyNuLL3JwUFKinXs6SrFcSiWkr9Cpay7Ozx5QosV8YKpn6ojejE
|
|
H3Xc0RNF/wjYczOSA6547AzrnS8jkVTV2WIJ5g1ExvSxIozlHU5Dcyn5faftz++y
|
|
ZMHT0Ds1FMGISQQYEQIACQUCS5yhYgIbDAAKCRDGDFR9iC2ETsN0AJ9D3ArYTLnd
|
|
lvUoDsu23bN4bf7gHwCfUGDsUSAWE/G7xQaBuB50qXecJPo=
|
|
=cK7U
|
|
-----END PGP PUBLIC KEY BLOCK-----
|