Untitled

name server because its OS wasn't that up
to date. In an attempt to figure out where
exactly the name server was placed 1 did a
traceroute to it. Then 1 ran a traceroute to a
few other computers. The result: each
traceroute turned up cisco-7k.
something. net. I am gonna bet that that is a
Cisco 7000 router (some nice hardware).
On the last two computers where I ran a
traceroute was anyname.something.net. I
believe that to be a firewall because almost
all traceroutes pass through that computer,
and it appears just after the router. But it
didn't appear when I did a traceroute to
what 1 believed was the secondary domain
name server. So then I decided to do a
whois something. net and found what the
two name servers were (why didn't I think
of this before): nsl .something.net and
ns2.something.net and of course the outdated
freebsd machine was ns2.something.
net. All right, I'm in business.
I then ran a traceroute to ns1.something.
net and it didn't pass through the firewall,
which meant that they had their name
servers set up outside of the firewall. (It's
very typical to put name servers in front of
the firewall.) So 1 searched the sploit
archives for a freebsd exploit, and a named
exploit came up - talk about my lucky day.
So I compiled and ran it. I then got myself a
root shell on the name server. (No, I will
not give you the source of the exploit; that
would be aiding you in attacking a computer).
Too bad it was outside the firewall.
So was there anything of any use to me?
Yes, of course. The master.passwd but it's
only good I imagine if they are running NIS
or NIS+. So I issued the ftp command back
to some computer on the Internet (not my
computer, that would be stupid) and downloaded
it. Eventually I got it back to my
computer. I started good old John The Ripper
right away and continued to explore the
network because what good is a username/password
if you can't get in because
of a fucking firewall?
Anyhow, on one machine I found an
anonymous ftp server. So 'I decided to
check it out, and I found that the machine
was running SunOS 5.5.1, and it was vulnerable
to an ftp bounce attack! Hell yeah.
So now I went and grabbed that script and
ran the little devil; it bounced me straight
through the anonymous ftp and to a telnet
port on the subnet. Now all I had to do was
crack that password file. So I waited a long
while as John The Ripper went to town, day
and night on the password file. Then finally
I just took the first login I got, and boom, I
was on this system which was inside a firewall!
Hell yeah!
So I had to get root. Would su work? If it
did, kickass, but if it didn't I may have been
screwed. Since I always play it safe, I
looked for something I could run on the
shell to get me root. Now that I had passed
the firewall, I could just use any remote
buffer overflow and get root on any of the
computers. Or, I could just log into another
system anywhere and run a local root exploit.
I had a wide range of exploits to
choose from.
I figured I'd look around and see if I
could find another freebsd machine lying
around to screw with and bam! freebsd
2.2.1. This one had a local root exploit in
the /proc filesystem. I got the list of username/passwords
and I was past the firewall
so I figured this would be pretty simple. I
telnetted over to the freebsd 2.2.1 box, and
ftp'd the exploit source over, compiled the
thing, ran it, waited a few minutes, and
bam, root shell!
Anyhow, I searched around the network
for what I came for and ran those nifty little
cloaking programs to cover my ass. I wiped
all the necessary logs to hide my punkass
and got out. It was rather daring to jump
around to so many machines, but since I
only came for one reason and got what I
needed, I didn't leave any backdoors for
myself. And I didn't change anything. So I
should get off scot-free.
Fall 1998 2600 Magazine Page 17