mirror of
https://github.com/opsxcq/mirror-textfiles.com.git
synced 2025-09-28 12:38:57 +02:00
104 lines
4.4 KiB
Plaintext
104 lines
4.4 KiB
Plaintext
UNIX Abuse Collection
|
|
Written By ZeeBee Australia Jan 1990
|
|
|
|
|
|
Ok Hacksters...we all know the importance of a good
|
|
understanding of the UNIX V operating system, but I find that
|
|
just an understanding alone is quite simply not enough.
|
|
|
|
Our little articles are not intended for those wishing to
|
|
gain an understanding of the UNIX environment. Instead, we aim
|
|
to show you how to truly ABUSE the UNIX system to it's fullest
|
|
potential.(And lets face it, UNIX really does have some really
|
|
great abusable features!)..so....grab your UNIX accounts and
|
|
passwords, and lets go!
|
|
|
|
|
|
**UNIX ABUSE COLLECTION PART 01**
|
|
****INVISIBILITY AND COVER UP TECHNIQUES***
|
|
|
|
One thing that really used to bug me about using a UNIX
|
|
system was that I always felt like someone was watching me. It's
|
|
just too easy to see what other users are doing, and as soon as
|
|
you discover something good, everyone else sees what you are
|
|
doing, and VOOM!...there goes your big secret. System operators
|
|
too, can easily pinpoint just who is stuffing around with their
|
|
system simply by seeing what processes are running under your
|
|
name. So, I set out to find ways around this.
|
|
|
|
One way to cover up what you are doing is to find and copy
|
|
the command that you wish to perform. As an example, just say I
|
|
want to cat a whole load of bullshit to someones terminal, but I
|
|
dont want anyone to see that I am executing the cat command.
|
|
First of all I find the cat command. On most systems it will be
|
|
somewhere in the /bin directory. Once you have found the command
|
|
you must copy it (if possible) to your own directory and rename
|
|
it to something inconspicuous. Most commands can be found
|
|
somewhere in the /bin or /usr/bin directories, but if you cant
|
|
find them, just look at your path list and see where UNIX is
|
|
looking for them. (typing echo $PATH is one way to view your path
|
|
list.)
|
|
Keep it in mind that not all commands are copyable (do an ls
|
|
-al and look at the access flags to see if they are) if the
|
|
access flags have an 'r' in the column 3rd from the far right,
|
|
then you can read it, ie copy it !
|
|
One advantage to this technique is that if you find a bug
|
|
with a certain command, you have a copy of the faulty code, so
|
|
even if the computer staff fix the bug, you will have the old
|
|
version ! Neat !
|
|
|
|
BUT! Don't worry if you can't copy the file! The following
|
|
technique will do just the same job, without the need to copy the
|
|
file. To do this you will need to write a program in C, compile
|
|
it, and place it somewhere where it is safe for you to call
|
|
whenever you want.
|
|
|
|
|
|
This is the small, and usefull piece of code:
|
|
|
|
main()
|
|
{
|
|
execl("/bin/ls","a.out","-l",(char *)0);
|
|
}
|
|
|
|
|
|
The above piece of code will execute the ls -l command, but
|
|
will generally show up as a.out -l whenever someone has a look at
|
|
what you are doing!
|
|
The "/bin/ls" is the path of the 'ls' command. Put the path
|
|
of any program you wish to execute here.
|
|
The "a.out" is what anyone else will think you are running.
|
|
Put anything you want here. The command doesnt even have to
|
|
exist!
|
|
The "-l" is the flag being passed to the ls command. You
|
|
cant cover up flags which are passed. Damn!
|
|
|
|
|
|
So, by using this, you can run any program with execute
|
|
access and make it look like you are running something else. You
|
|
could even put in a whole path where I put the "a.out" and
|
|
really confuse the shit out of people when they go looking for
|
|
this great program you are running.
|
|
|
|
While we are on the topic, I would just like to stress the
|
|
importance of continually checking to see what others on the
|
|
system are doing. I find the "w -d" "ps -fu USERNAME" and "ps -
|
|
fa" commands to be most usefull at this. On one system I was
|
|
actually able to see system operators creating new accounts, and
|
|
the account names and passwords were being passed. So one of the
|
|
processes being executed by some priveleged user looked like
|
|
this:
|
|
|
|
megauser 273 10:00:12 createaccount john zephyr ;
|
|
|
|
* In the above example, john is the account name, zephyr is the
|
|
password.*
|
|
|
|
We got about 100 accounts that day !
|
|
|
|
And remember, as soon as any new toy is installed on the
|
|
system, somebody will be using it, so just keep an eye on them to
|
|
see what they do.
|
|
|
|
Downloaded From P-80 Systems 304-744-2253
|