The Hackers Layer Handbook Version 1.0 Written/Assembled by The Hackers Layer Group Dedicated to all Newcoming Hackers Table of Contents =Part One= =Essential background Knowledge= [0.0.0] Preface [0.0.1] The Hackers Layer Team [0.0.2] Disclaimer [0.0.3] Thanks and Greets [1.0.0] Preface To NetBIOS [1.0.1] What is NetBIOS? [1.0.2] NetBIOS Names [1.0.3] NetBIOS Sessions [1.0.4] NetBIOS Datagrams [1.0.5] NetBEUI Explained [1.0.6] NetBIOS Scopes [1.2.0] Preface to SMB's [1.2.1] What are SMB's? [1.2.2] The Redirector [2.0.0] What is TCP/IP? [2.0.1] FTP Explained [2.0.2] Remote Login [2.0.3] Computer Mail [2.0.4] Network File Systems [2.0.5] Remote Printing [2.0.6] Remote Execution [2.0.7] Name Servers [2.0.8] Terminal Servers [2.0.9] Network-Oriented Window Systems [2.1.0] General description of the TCP/IP protocols [2.1.1] The TCP Level [2.1.2] The IP level [2.1.3] The Ethernet level [2.1.4] Well-Known Sockets And The Applications Layer [2.1.5] Other IP Protocols [2.1.6] Domain Name System [2.1.7] Routing [2.1.8] Subnets and Broadcasting [2.1.9] Datagram Fragmentation and Reassembly [2.2.0] Ethernet encapsulation: ARP [3.0.0] Preface to the WindowsNT Registry [3.0.1] What is the Registry? [3.0.2] In Depth Key Discussion [3.0.3] Understanding Hives [3.0.4] Default Registry Settings [4.0.0] Introduction to PPTP [4.0.1] PPTP and Virtual Private Networking [4.0.2] Standard PPTP Deployment [4.0.3] PPTP Clients [4.0.4] PPTP Architecture [4.0.5] Understanding PPTP Security [4.0.6] PPTP and the Registry [4.0.7] Special Security Update [5.0.0] TCP/IP Commands as Tools [5.0.1] The Arp Command [5.0.2] The Traceroute Command [5.0.3] The Netstat Command [5.0.4] The Finger Command [5.0.5] The Ping Command [5.0.6] The Nbtstat Command [5.0.7] The IpConfig Command [5.0.8] The Telnet Command [6.0.0] NT Security [6.0.1] The Logon Process [6.0.2] Security Architecture Components [6.0.3] Introduction to Securing an NT Box [6.0.4] Physical Security Considerations [6.0.5] Backups [6.0.6] Networks and Security [6.0.7] Restricting the Boot Process [6.0.8] Security Steps for an NT Operating System [6.0.9] Install Latest Service Pack and applicable hot-fixes [6.1.0] Display a Legal Notice Before Log On [6.1.1] Rename Administrative Accounts [6.1.2] Disable Guest Account [6.1.3] Logging Off or Locking the Workstation [6.1.4] Allowing Only Logged-On Users to Shut Down the Computer [6.1.5] Hiding the Last User Name [6.1.6] Restricting Anonymous network access to Registry [6.1.7] Restricting Anonymous network access to lookup account names and network shares [6.1.8] Enforcing strong user passwords [6.1.9] Disabling LanManager Password Hash Support [6.2.0] Wiping the System Page File during clean system shutdown [6.2.1] Protecting the Registry [6.2.2] Secure EventLog Viewing [6.2.3] Secure Print Driver Installation [6.2.4] The Schedule Service (AT Command) [6.2.5] Secure File Sharing [6.2.6] Auditing [6.2.7] Threat Action [6.2.8] Enabling System Auditing [6.2.9] Auditing Base Objects [6.3.0] Auditing of Privileges [6.3.1] Protecting Files and Directories [6.3.2] Services and NetBios Access From Internet [6.3.3] Alerter and Messenger Services [6.3.4] Unbind Unnecessary Services from Your Internet Adapter Cards [6.3.5] Enhanced Protection for Security Accounts Manager Database [6.3.6] Disable Caching of Logon Credentials during interactive logon. [6.3.7] How to secure the %systemroot%\repair\sam._ file [6.3.8] TCP/IP Security in NT [6.3.9] Well known TCP/UDP Port numbers [7.0.0] Preface to Microsoft Proxy Server [7.0.1] What is Microsoft Proxy Server? [7.0.2] Proxy Servers Security Features [7.0.3] Beneficial Features of Proxy [7.0.4] Hardware and Software Requirements [7.0.5] What is the LAT? [7.0.6] What is the LAT used for? [7.0.7] What changes are made when Proxy Server is installed? [7.0.8] Proxy Server Architecture [7.0.9] Proxy Server Services: An Introduction [7.1.0] Understanding components [7.1.1] ISAPI Filter [7.1.2] ISAPI Application [7.1.3] Proxy Servers Caching Mechanism [7.1.4] Windows Sockets [7.1.5] Access Control Using Proxy Server [7.1.6] Controlling Access by Internet Service [7.1.7] Controlling Access by IP, Subnet, or Domain [7.1.8] Controlling Access by Port [7.1.9] Controlling Access by Packet Type [7.2.0] Logging and Event Alerts [7.2.1] Encryption Issues [7.2.2] Other Benefits of Proxy Server [7.2.3] RAS [7.2.4] IPX/SPX [7.2.5] Firewall Strategies [7.2.6] Logical Construction [7.2.7] Exploring Firewall Types [7.2.3] NT Security Twigs and Ends =Part Two= =The Techniques of Survival= [8.0.0] NetBIOS Attack Methods [8.0.1] Comparing NAT.EXE to Microsoft's own executables [8.0.2] First, a look at NBTSTAT [8.0.3] Intro to the NET commands [8.0.4] Net Accounts [8.0.5] Net Computer [8.0.6] Net Config Server or Net Config Workstation [8.0.7] Net Continue [8.0.8] Net File [8.0.9] Net Group [8.1.0] Net Help [8.1.1] Net Helpmsg message# [8.1.2] Net Localgroup [8.1.3] Net Name [8.1.4] Net Pause [8.1.5] Net Print [8.1.6] Net Send [8.1.7] Net Session [8.1.8] Net Share [8.1.9] Net Statistics Server or Workstation [8.2.0] Net Stop [8.2.1] Net Time [8.2.2] Net Use [8.2.3] Net User [8.2.4] Net View [8.2.5] Special note on DOS and older Windows Machines [8.2.6] Actual NET VIEW and NET USE Screen Captures during a hack [9.0.0] Frontpage Extension Attacks [9.0.1] For the tech geeks, we give you an actual PWDUMP [9.0.2] The haccess.ctl file [9.0.3] Side note on using John the Ripper [10.0.0] WinGate [10.0.1] What Is WinGate? [10.0.2] Defaults After a WinGate Install [10.0.3] Port 23 Telnet Proxy [10.0.4] Port 1080 SOCKS Proxy [10.0.5] Port 6667 IRC Proxy [10.0.6] How Do I Find and Use a WinGate? [10.0.7] I have found a WinGate telnet proxy now what? [10.0.8] Securing the Proxys [10.0.9] mIRC 5.x WinGate Detection Script [10.1.0] Conclusion [11.0.0] What a security person should know about WinNT [11.0.1] NT Network structures (Standalone/WorkGroups/Domains) [11.0.2] How does the authentication of a user actually work [11.0.3] A word on NT Challenge and Response [11.0.4] Default NT user groups [11.0.5] Default directory permissions [11.0.6] Common NT accounts and passwords [11.0.7] How do I get the admin account name? [11.0.8] Accessing the password file in NT [11.0.9] Cracking the NT passwords [11.1.0] What is 'last login time'? [11.1.1] Ive got Guest access, can I try for Admin? [11.1.2] I heard that the %systemroot%\system32 was writeable? [11.1.3] What about spoofin DNS against NT? [11.1.4] What about default shared folders? [11.1.5] How do I get around a packet filter-based firewall? [11.1.6] What is NTFS? [11.1.7] Are there are vulnerabilities to NTFS and access controls? [11.1.8] How is file and directory security enforced? [11.1.9] Once in, how can I do all that GUI stuff? [11.2.0] How do I bypass the screen saver? [11.2.1] How can tell if its an NT box? [11.2.2] What exactly does the NetBios Auditing Tool do? [12.0.0] Cisco Routers and their configuration [12.0.1] User Interface Commands [12.0.2] disable [12.0.3] editing [12.0.4] enable [12.0.5] end [12.0.6] exit [12.0.7] full-help [12.0.8] help [12.0.9] history [12.1.0] ip http access-class [12.1.1] ip http port [12.1.2] ip http server [12.1.3] menu (EXEC) [12.1.4] menu (global) [12.1.5] menu command [12.1.6] menu text [12.1.7] menu title [12.1.8] show history [12.1.9] terminal editing [12.2.0] terminal full-help (EXEC) [12.2.1] terminal history [12.2.2] Network Access Security Commands [12.2.3] aaa authentication arap [12.2.4] aaa authentication enable default [12.2.5] aaa authentication local-override [12.2.6] aaa authentication login [12.2.7] aaa authentication nasi [12.2.8] aaa authentication password-prompt [12.2.9] aaa authentication ppp [12.3.0] aaa authentication username-prompt [12.3.1] aaa authorization [12.3.2] aaa authorization config-commands [12.3.3] aaa new-model [12.3.4] arap authentication [12.3.5] clear kerberos creds [12.3.6] enable last-resort [12.3.7] enable use-tacacs [12.3.8] ip radius source-interface [12.3.9] ip tacacs source-interface [12.4.0] kerberos clients mandatory [12.4.1] kerberos credentials forward [12.4.2] kerberos instance map [12.4.3] kerberos local-realm [12.4.4] kerberos preauth [12.4.5] kerberos realm [12.4.6] kerberos server [12.4.7] kerberos srvtab entry [12.4.8] kerberos srvtab remote [12.4.9] key config-key [12.5.0] login tacacs [12.5.1] nasi authentication [12.5.2] ppp authentication [12.5.3] ppp chap hostname [12.5.4] ppp chap password [12.5.5] ppp pap sent-username [12.5.6] ppp use-tacacs [12.5.7] radius-server dead-time [12.5.8] radius-server host [12.5.9] radius-server key [12.6.0] radius-server retransmit [12.6.1] show kerberos creds [12.6.2] show privilege [12.6.3] tacacs-server key [12.6.4] tacacs-server login-timeout [12.6.5] tacacs-server authenticate [12.6.6] tacacs-server directed-request [12.6.7] tacacs-server key [12.6.8] tacacs-server last-resort [12.6.9] tacacs-server notify [12.7.0] tacacs-server optional-passwords [12.7.1] tacacs-server retransmit [12.7.2] tacacs-server timeout [12.7.3] Traffic Filter Commands [12.7.4] access-enable [12.7.5] access-template [12.7.6] clear access-template [12.7.7] show ip accounting [12.7.8] Terminal Access Security Commands [12.7.9] enable password [12.8.0] enable secret [12.8.1] ip identd [12.8.2] login authentication [12.8.3] privilege level (global) [12.8.4] privilege level (line) [12.8.5] service password-encryption [12.8.6] show privilege [12.8.7] username [12.8.8] A Word on Ascend Routers [13.0.0] Known NT/95/IE Holes [13.0.1] WINS port 84 [13.0.2] WindowsNT and SNMP [13.0.3] Frontpage98 and Unix [13.0.4] TCP/IP Flooding with Smurf [13.0.5] SLMail Security Problem [13.0.6] IE 4.0 and DHTML [13.0.7] 2 NT Registry Risks [13.0.8] Wingate Proxy Server [13.0.9] O'Reilly Website uploader Hole [13.1.0] Exchange 5.0 Password Caching [13.1.1] Crashing NT using NTFS [13.1.2] The GetAdmin Exploit [13.1.3] Squid Proxy Server Hole [13.1.4] Internet Information Server DoS attack [13.1.5] Ping Of Death II [13.1.6] NT Server's DNS DoS Attack [13.1.7] Index Server Exposes Sensitive Material [13.1.8] The Out Of Band (OOB) Attack [13.1.9] SMB Downgrade Attack [13.2.0] RedButton [13.2.1] FrontPage WebBot Holes [13.2.2] IE and NTLM Authentication [13.2.3] Run Local Commands with IE [13.2.4] IE can launch remote apps [13.2.5] Password Grabbing Trojans [13.2.6] Reverting an ISAPI Script [13.2.7] Rollback.exe [13.2.8] Replacing System .dll's [13.2.9] Renaming Executables [13.3.0] Viewing ASP Scripts [13.3.1] .BAT and .CMD Attacks [13.3.2] IIS / \ Problem [13.3.3] Truncated Files [13.3.4] SNA Holes [13.3.5] SYN Flooding [13.3.6] Land Attack [13.3.7] Teardrop [13.3.8] Pentium Bug [14.0.0] VAX/VMS Makes a comeback (expired user exploit) [14.0.1] Step 1 [14.0.2] Step 2 [14.0.3] Step 3 [14.0.4] Note [15.0.0] Linux security 101 [15.0.1] Step 1 [15.0.2] Step 2 [15.0.3] Step 3 [15.0.4] Step 4 [15.0.5] Step 5 [15.0.6] Step 6 [16.0.0] Unix Techniques. New and Old. [16.0.1] ShowMount Technique [16.0.2] DEFINITIONS [16.0.3] COMPARISION TO THE MICROSOFT WINDOWD FILESHARING [16.0.4] SMBXPL.C [16.0.5] Basic Unix Commands [16.0.6] Special Chracters in Unix [16.0.7] File Permissions Etc [16.0.8] STATD EXPLOIT TECHNIQUE [16.0.9] System Probing [16.1.0] Port scanning [16.1.1] rusers and finger command [16.1.2] Mental Hacking, once you know a username [17.0.0] Making a DDI from a Motorola Brick phone [18.0.0] Pager Programmer [19.0.0] The End ==============Part One============== ===================Needed Background Knowledge=================== [0.0.0] Preface This book was written/compiled by The Hackers Layer Team as a document for the modern hacker. We chose to call it the Hackers Layer Handbook because it mostly deals with Networking Technologies and Windows95/ NT issues. Which, as everyone knows, is a must knowledge these days. Well, The Hackers Layer, is the premiere Hacking/Cracking source, we have continually given to the H/P/V/A/C community freely. We continue this tradition now with this extremely useful book. This book covers Windows95/NT security issues, Unix, Linux, Irix, Vax, Router configuration, Frontpage, Wingate and much much more. [0.0.1] The Hackers Layer Team At the time of release, the Hackers Layer team from the message board is: Main Page: http://www.lordsomer.com, go to the bottom of the page for the message board entrance. Lord Somer [Head Hancho/Supreme Hacker/Programmer Superb] deKaulbe [Security/Master Hacker/Unix-Linux Advisor/Senior Member] CRAXD [Editer/Software Research/Cracking Advisor/Senior Member] Judg3 [Security/AOL Master Hacker/Java Script Guru/Senior Member] CeSsNa340 [WAREZ Anylyst/Senior Member] ragman [Security/mIRC Bot Manager/Senior Member] TopGun [SecurityHacker//Still rubbing his eyes from Linux hehehe/Senior Member] And to all the other members of the page as I know at the time of this writing, I'm leaving a few out. [0.0.2] Disclaimer This text document is released FREE of charge to EVERYONE. The Hackers Layer team made NO profits from this text. This text is NOT meant for re-sale, or for trade for any other type of material or monetary possesions. This text is given freely to the Internet community. The authors of this text do not take responsibility for damages incurred during the practice of any of the information contained within this text document. [0.0.3] Thanks and Greets Extra special greetings to all newbies who have come to our pages. Special props to deKaulbe for his Unix contributions and quick DNS traces he has performed for all of us. Greetings to Fravias Page of Reverse Engineering, #1 Crack Site, Hackers Supply, L0pht, Lord Caligos,Phrack Magazine, and 2600 Magazine (thanks for your vigilance on the Mitnick case). [1.0.0] Preface to NetBIOS Before you begin reading this section, understand that this section was written for the novice to the concept of NetBIOS, but - it also contains information the veteran might find educational. I am prefacing this so that I do not get e-mail like "Why did you start your NetBIOS section off so basic?" - Simple, its written for people that may be coming from an enviroment that does not use NetBIOS, so they would need me to start with basics, thanks. [1.0.1] Whats is NetBIOS? NetBIOS (Network Basic Input/Output System) was originally developed by IBM and Sytek as an Application Programming Interface (API) for client software to access LAN resources. Since its creation, NetBIOS has become the basis for many other networking applications. In its strictest sense, NetBIOS is an interface specification for acessing networking services. NetBIOS, a layer of software developed to link a network operating system with specific hardware, was originally designed as THE network controller for IBM's Network LAN. NetBIOS has now been extended to allow programs written using the NetBIOS interface to operate on the IBM token ring architecture. NetBIOS has since been adopted as an industry standard and now, it is common to refer to NetBIOS-compatible LANs. It offers network applications a set of "hooks" to carry out inter-application communication and data transfer. In a basic sense, NetBIOS allows applications to talk to the network. Its intention is to isolate application programs from any type of hardware dependancies. It also spares software developers the task of developing network error recovery and low level message addressing or routing. The use of the NetBIOS interface does alot of this work for them. NetBIOS standardizes the interface between applications and a LANs operating capabilities. With this, it can be specified to which levels of the OSI model the application can write to, making the application transportable to other networks. In a NetBIOS LAN enviroment, computers are known on the system by a name. Each computer on the network has a permanent name that is programmed in various different ways. These names will be discussed in more detail below. PC's on a NetBIOS LAN communicate either by establishing a session or by using NetBIOS datagram or broadcast methods. Sessions allow for a larger message to be sent and handle error detection and correction. The communication is on a one-to-one basis. Datagram and broadcast methods allow one computer to communicate with several other computers at the same time, but are limited in message size. There is no error detection or correction using these datagram or broadcast methods. However, datagram communication allows for communication without having to establish a session. All communication in these enviroments are presented to NetBIOS in a format called Network Control Blocks (NCB). The allocation of these blocks in memory is dependant on the user program. These NCB's are divided into fields, these are reserved for input and output respectively. NetBIOS is a very common protocol used in todays enviroments. NetBIOS is supported on Ethernet, TokenRing, and IBM PC Networks. In its original induction, it was defined as only an interface between the application and the network adapter. Since then, transport like functions have been added to NetBIOS, making it more functional over time. In NetBIOS, connection (TCP) oriented and connectionless (UDP) communication are both supported. It supports both broadcasts and multicasting and supports three distinct services: Naming, Session, and Datagram. [1.0.2] NetBIOS Names NetBIOS names are used to identify resources on a network. Applications use these names to start and end sessions. You can configure a single machine with multiple applications, each of which has a unique NetBIOS name. Each PC that supports an application also has a NetBIOS station name that is user defined or that NetBIOS derives by internal means. NetBIOS can consist of up to 16 alphanumeric characters. The combination of characters must be unique within the entire source routing network. Before a PC that uses NetBIOS can fully function on a network, that PC must register their NetBIOS name. When a client becomes active, the client advertises their name. A client is considered to be registered when it can successfully advertise itself without any other client claiming it has the same name. The steps of the registration process is as follows: 1. Upon boot up, the client broadcasts itself and its NetBIOS information anywhere from 6 to 10 to ensure every other client on the network receives the information. 2. If another client on the network already has the name, that NetBIOS client issues its own broadcast to indicate that the name is in use. The client who is trying to register the already in use name, stop all attempts to register that name. 3. If no other client on the network objects to the name registration, the client will finish the registration process. There are two types of names in a NetBIOS enviroment: Unique and Group. A unique name must be unique across the network. A group name does not have to be unique and all processes that have a given group name belong to the group. Each NetBIOS node maintains a table of all names currently owned by that node. The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits these names to 15 characters and uses the 16th character as a NetBIOS suffix. A NetBIOS suffix is used by Microsoft Networking software to indentify the functionality installed or the registered device or service. [QuickNote: SMB and NBT (NetBIOS over TCP/IP work very closely together and both use ports 137, 138, 139. Port 137 is NetBIOS name UDP. Port 138 is NetBIOS datagram UDP. Port 139 is NetBIOS session TCP.] The following is a table of NetBIOS suffixes currently used by Microsoft WindowsNT. These suffixes are displayed in hexadecimal format. Name Number Type Usage ======================================================================== == <computername> 00 U Workstation Service <computername> 01 U Messenger Service <\\_MSBROWSE_> 01 G Master Browser <computername> 03 U Messenger Service <computername> 06 U RAS Server Service <computername> 1F U NetDDE Service <computername> 20 U File Server Service <computername> 21 U RAS Client Service <computername> 22 U Exchange Interchange <computername> 23 U Exchange Store <computername> 24 U Exchange Directory <computername> 30 U Modem Sharing Server Service <computername> 31 U Modem Sharing Client Service <computername> 43 U SMS Client Remote Control [...]... the end of the packet, not in the header When these packets are received by the other end, of course all the headers are removed The Ethernet interface removes the Ethernet header and the checksum It looks at the type code Since the type code is the one assigned to IP, the Ethernet device driver passes the datagram up to IP IP removes the IP header It looks at the IP protocol field Since the protocol... used on the same network So you can use TCP/IP, DECnet, Xerox NS, etc at the same time Each of them will put a different value in the type field Finally, there is a checksum The Ethernet controller computes a checksum of the entire packet When the other end receives the packet, it recomputes the checksum, and throws the packet away if the answer disagrees with the original The checksum is put on the end... broadcast to the entire LAN As with other datagram services, the NetBIOS datagrams are connectionless and unreliable The Send_Datagram command requires the caller to specify the name of the destination If the destination is a group name, then every member of the group receives the datagram The caller of the Receive_Datagram command must specify the local name for which it wants to receive datagrams The Receive_Datagram... at the beginning and end) [2.1.3] The Ethernet level Most of our networks these days use Ethernet So now we have to describe Ethernet's headers Unfortunately, Ethernet has its own addresses The people who designed Ethernet wanted to make sure that no two machines would end up with the same Ethernet address Furthermore, they didn't want the user to have to worry about assigning addresses So each Ethernet... came from.) The destination Internet address is the address of the other machine (This is necessary so any gateways in the middle know where you want the datagram to go.) The protocol number tells IP at the other end to send the datagram to TCP Although most IP traffic uses TCP, there are other protocols that can use IP, so you have to tell IP which protocol to send the datagram to Finally, the checksum... another computer as if the remote resources were local to the client computer The Redirector communicates with other computers using the protocol stack The Redirectors primary function is to format remote requests so that they can be understood by a remote station (such as a file server) and send them on their way through the network The Redirector uses the Server Message Block (SMB) structure as the. .. character or other command that interrupts output The other fields are beyond the scope of this document [2.1.2] The IP level TCP sends each of these datagrams to IP Of course it has to tell IP the Internet address of the computer at the other end Note that this is all IP is concerned about It doesn't care about what is in the datagram, or even in the TCP header IP's job is simply to find a route for the datagram... it to the other end In order to allow gateways or other intermediate systems to forward the datagram, it adds its own header The main things in this header are the source and destination Internet address (32-bit addresses, like 128.6.4.194), the protocol number, and another checksum The source Internet address is simply the address of your machine (This is necessary so the other end knows where the datagram... they adopted a kludge The assumption is that most of the networks will be small So they set up three different ranges of address Addresses beginning with 1 to 126 use only the first octet for the network number The other three octets are available for the host number Thus 24 bits are available for hosts These numbers are used for large networks But there can only be 126 of these very big networks The. .. can send the maximum datagram size they can handle The smaller of these numbers is used for the rest of the connection This allows two implementations that can handle big datagrams to use them, but also lets them talk to implementations that can't handle them However this doesn't completely solve the problem The most serious problem is that the two ends don't necessarily know about all of the steps . [0.0.1] The Hackers Layer Team At the time of release, the Hackers Layer team from the message board is: Main Page: http://www.lordsomer.com, go to the bottom. see the TCP spec). The result is put in the header. TCP at the other end computes the checksum again. If they disagree, then something bad happened to the