some Hacking Tutorials

01. How do I access the password file under Unix?
02. How do I crack Unix passwords?
03. What is password shadowing?
04. Where can I find the password file if it's shadowed?
05. What is NIS/yp?
06. What are those weird characters after the comma in my passwd file?
07. How do I access the password file under VMS?
08. How do I crack VMS passwords?
09. What can be logged on a VMS system?
10. What privileges are available on a VMS system?




01. How do I access the password file under Unix?

In standard Unix the password file is /etc/passwd. On a Unix system
with either NIS/yp or password shadowing, much of the password data may
be elsewhere. An entry in the password file consists of seven colon
delimited fields:
Username
Encrypted password (And optional password aging data)
User number
Group Number
GECOS Information
Home directory
Shell
]
] Sample entry from /etc/passwd:
]
] will:5fg63fhD3d5gh:9406:12:Will Spencer:/home/fsg/will:/bin/bash
]
Broken down, this passwd file line shows:
Username: will
Encrypted password: 5fg63fhD3d5gh
User number: 9406
Group Number: 12
GECOS Information: Will Spencer
Home directory: /home/fsg/will
Shell: /bin/bash

02. How do I crack Unix passwords?

Contrary to popular belief, Unix passwords cannot be decrypted. Unix passwords are encrypted with a one way function. The login program encrypts the text you enter at the "password:" prompt and compares that encrypted string against the encrypted form of your password.
Password cracking software uses wordlists. Each word in the word list is encrypted and the results are compared to the encrypted form of the target password. The best cracking program for Unix passwords is currently Crack by Alec Muffett. For PC-DOS, the best package to use is currently CrackerJack. CrackerJack is available via ftp from clark.net /pub/jcase/.

03. What is password shadowing?

Password shadowing is a security system where the encrypted password field of /etc/passwd is replaced with a special token and the encrypted password is stored in a separate file which is not readable by normal system users.To defeat password shadowing on many (but not all) systems, write a program that uses successive calls to getpwent() to obtain the password file.
Example:
#include
main()
{
struct passwd *p;
while(p=getpwent())
printf("%s:%s:%d:%d:%s:%s:%s\n", p->pw_name, p->pw_passwd,
p->pw_uid, p->pw_gid, p->pw_gecos, p->pw_dir, p->pw_shell);
}

04. Where can I find the password file if it's shadowed?
Unix Path Token
-----------------------------------------------------------------
"AIX 3 /etc/security/passwd !
or /tcb/auth/files/
of username>/
A/UX 3.0s /tcb/files/auth/?/*
BSD4.3-Reno /etc/master.passwd *
ConvexOS 10 /etc/shadpw *
ConvexOS 11 /etc/shadow *
DG/UX /etc/tcb/aa/user/ *
EP/IX /etc/shadow x
HP-UX /.secure/etc/passwd *
IRIX 5 /etc/shadow x
Linux 1.1 /etc/shadow *
OSF/1 /etc/passwd[.dir|.pag] *
SCO Unix #.2.x /tcb/auth/files/
of username>/
SunOS4.1+c2 /etc/security/passwd.adjunct ##username
SunOS 5.0 /etc/shadow
System V Release 4.0 /etc/shadow x
System V Release 4.2 /etc/security/* database
Ultrix 4 /etc/auth[.dir|.pag] *
UNICOS /etc/udb *"

05. What is NIS/yp?

NIS (Network Information System) in the current name for what was once known as yp (Yellow Pages). The purpose for NIS is to allow many machines on a network to share configuration information, including password data. NIS is not designed to promote system security. If your system uses NIS you will have a very short /etc/passwd file that includes a line that looks like this:
+::0:0:::
To view the real password file use this command "ypcat passwd"

06. What are those weird characters after the comma in my passwd file?

The characters are password aging data. Password aging forces the user to change passwords after a System Administrator specified period of time. Password aging can also force a user to keep a password for a certain number of weeks before changing it.
]
] Sample entry from /etc/passwd with password aging installed:
]
] will:5fg63fhD3d,M.z8:9406:12:Will Spencer:/home/fsg/will:/bin/bash
]
Note the comma in the encrypted password field. The characters after
the comma are used by the password aging mechanism.
]
] Password aging characters from above example:
]
] M.z8
]
The four characters are interpreted as follows:
1: Maximum number of weeks a password can be used without changing.
2: Minimum number of weeks a password must be used before changing.
3&4: Last time password was changed, in number of weeks since 1970.
Three special cases should be noted:
If the first and second characters are set to '..' the user will be forced to change his/her passwd the next time he/she logs in. The passwd program will then remove the passwd aging characters, and the user will not be subjected to password aging requirements again. If the third and fourth characters are set to '..' the user will be forced to change his/her passwd the next time he/she logs in. Password aging will then occur as defined by the first and second characters.
If the first character (MAX) is less than the second character (MIN), the user is not allowed to change his/her password. Only root can change that users password. It should also be noted that the su command does not check the password aging data. An account with an expired password can be su'd to without being forced to change the password.
Password Aging Codes+------------------------------------------------------------------------+
| |
| Character: . / 0 1 2 3 4 5 6 7 8 9 A B C D E F G H |
| Number: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
| |
| Character: I J K L M N O P Q R S T U V W X Y Z a b |
| Number: 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
| |
| Character: c d e f g h i j k l m n o p q r s t u v |
| Number: 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
| |
| Character: w x y z |
| Number: 60 61 62 63 |
| |
+------------------------------------------------------------------------+
07. How do I access the password file under VMS?

Under VMS, the password file is SYS$SYSTEM:SYSUAF.DAT. However, unlike Unix, most users do not have access to read the password file.

08. How do I crack VMS passwords?

Write a program that uses the SYS$GETUAF functions to compare the results of encrypted words against the encrypted data in SYSUAF.DAT. Two such programs are known to exist, CHECK_PASSWORD and GUESS_PASSWORD.

09. What can be logged on a VMS system?

Virtually every aspect of the VMS system can be logged for investigation. To determine the status of the accounting on your system use the command SHOW ACCOUNTING. System accounting is a facility for recording information about the use of the machine from a system
accounting perspective (resource logging such as CPU time, printer usage etc.), while system auditing is done with the aim of logging information for the purpose of security. To enable accounting:
$ SET ACCOUNTING [/ENABLE=(Activity...)]
This enables accounting logging information to the accounting log file SYS$MANAGER:ACCOUNTING.DAT. This also is used to close the current log file and open a new one with a higher version number.The following activities can be logged:
BATCH Termination of a batch job
DETACHED Termination of a detached job
IMAGE Image execution
INTERACTIVE Interactive job termination
LOGIN_FAILURE Login failures
MESSAGE Users messages
NETWORK Network job termination
PRINT Print Jobs
PROCESS Any terminated process
SUBPROCESS Termination of a subprocess
To enable security auditing use:
$ SET AUDIT [/ENABLE=(Activity...)]
The /ALARM qualifier is used to raise an alarm to all terminals approved as security operators, which means that you need the SECURITY privileges. You can determine your security auditing configuration using $ SHOW AUDIT /ALL The security auditor can be configured to log the following activities:
ACL Access Control List requested events
AUTHORIZATION Modification to the system user
authorization file SYS$SYSTEM:SYSUAF.DAT
BREAKIN Attempted Break-ins
FILE_ACCESS File or global section access
INSTALL Occurrence of any INSTALL operations
LOGFAILURE Any login failures
LOGIN A login attempt from various sources
LOGOUT Logouts
MOUNT Mount or dismount requests

10. What privileges are available on a VMS system?

ACNT :Allows you to restrain accounting messages
ALLSPOOL :Allows you to allocate spooled devices
ALTPRI :Allot Priority. This allows you to set any priority value
BUGCHK :Allows you make bug check error log entries
BYPASS :Enables you to disregard protections
CMEXEC/
CMKRNL :Change to executive or kernel mode. These privileges allow a process to execute optional routines with KERNEL and EXECUTIVE access modes. CMKRNL is the most powerful
privilege on VMS as anything protected can be accessed if you have this privilege. You must have these privileges to gain access to the kernel data structures directly.

DETACH :This privilege allow you to create detached processes of arbitrary UICs
DIAGNOSE :With this privilege you can diagnose devices
EXQUOTA :Allows you to exceed your disk quota
GROUP :This privilege grants you permission to affect other processes in the same rank
GRPNAM :Allows you to insert group logical names into the group logical names table.
GRPPRV :Enables you to access system group objects through
system protection field
LOG_IO Allows you to issue logical input output requests
MOUNT May execute the mount function
NETMBX Allows you to create network connections
OPER Allows you to perform operator functions
PFNMAP Allows you to map to specific physical pages
PHY_IO Allows you to perform physical input output requests
PRMCEB Can create permanent common event clusters
PRMGBL Allows you to create permanent global sections
PRMMBX Allows you to create permanent mailboxes
PSWAPM Allows you to change a processes swap mode
READALL Allows you read access to everything
SECURITY Enables you to perform security related functions
SETPRV Enable all privileges
SHARE Allows you to access devices allocated to other users.
This is used to assign system mailboxes.
SHMEM Enables you to modify objects in shared memory
SYSGBL Allows you to create system wide permanent global
sections
SYSLCK Allows you to lock system wide resources
SYSNAM Allows you to insert in system logical names in the
names table.
SYSPRV If a process holds this privilege then it is the same as
a process holding the system user identification code.
TMPMBX Allows you create temporary mailboxes
VOLPRO Enables you to override volume protection
WORLD When this is set you can affect other processes in the
world
To determine what privileges your process is running with issue the command:
$ show proc/priv

Digg Google Bookmarks reddit Mixx StumbleUpon Technorati Yahoo! Buzz DesignFloat Delicious BlinkList Furl

0 comments: on "some Hacking Tutorials"

Post a Comment