Chapter Twelve: The Elements of Cracking

Introduction

Welcome to the most "black hat" chapter in the book, devoted to exposing the black art of "cracking" computer security. Understanding how crackers work is vital to any systems administrator, as they need to understand that before a cracker starts trying to breach the system security of remote systems, the cracker already understands *why* they want to gain access. Once the cracker knows why they need to gain access to a site, then this determines how long they will spend trying to gain access, and will prevent them from wasting time cracking a site that has no value. Note that experienced crackers pick their targets for good reasons, rather than trying to randomly attack everything in sight, and once they have their target, they will go through everything persistently and methodically, and almost certainly gain access.

With this in mind, systems administrators who need to know more about system cracking should find this chapter particularly useful, as knowing how crackers operate will help keep systems secure.

Of course, anybody who has read this far doesn't need to be reminded that "black hat" hacker actions may lead them into difficulties with the legal system, so if anyone is thinking of cracking systems against the owner's wishes, then don't do it. However, just knowing how to do something illegal isn't against the law, otherwise Agatha Christie would have been jailed for multiple homicide, so if you need to understand how crackers operate when they crack into systems, read on.

There are several ways to penetrate system security, and a good cracker would know as many of them as possible. Remote hosts with half decent security should be able to block 90% of this stuff, but the real trick of gaining access is that crackers are persistent. Crackers know that any long term attack is going to show up in the logs and alert any sensible systems administrator that something is up, so they will spread their attacks across a number of different originating remote sites and across time, so that they minimise any changes of detection.

Password Attacks

One of the oldest ways to gain access is to get access to the password file and use a tool like CRACK to get the plaintext passwords. It used to be that a cracker could lift the password file from the majority of boxes on the Internet by using Trivial File Transfer Protocol, but everyone turns it off these days. If the target is running Sun's Network Information Service (NIS), then the cracker can get hold of a tool like YPX and try guessing the NIS domain. Get it right and they'll get the password file for the whole domain. Password attacks on "shadowed" password files are harder, as they need to get an un-shadowing tool from the net, but the cracker really needs to be inside already to run it. The old trick of writing an attack program which repeatedly try userid password combinations on the login prompt is also dead, most systems now disconnect after three failed attempts, and log repeated failed login attempts. However, it should be pointed out that the majority of password schemes used on websites *do not* disconnect after every failed attempt, so this technique hasn't lost all its uses. For this reason systems administrators are highly recommended to check the systems logs whenever possible, and also try and ensure that web developers write code to log failed log attempts on their web services.

System "Backdoors".

System "backdoors" were discussed in more detail in Chapter 7: "Hacking the Web", so there is very little to be said about them here. Suffice it to say that a cracker's understanding of IP network protocols, odd switches on user and system commands and knowledge of underlying design features in the target operating system greatly increase their chances of gaining access. System backdoors can be found in a variety of ways, crackers often read the average security book and see what it recommends is done to *secure* a site, then they work out *why* this is necessary. For example, if they learn that the "r" commands should be disabled, and that "rdist" should be removed, the cracker will immediately try to find out as much as possible about how these commands work, reading RFCS, man pages, books on writing TCP/IP code and anything else they can get their hands on.

Ultra-Hacker Stuff

One of the ways of breaking system security is to use a deep knowledge of the fundamental way that networks and systems work such that the cracker can access the internals of a computer using normal tools. A very good hacker once commented to me that "the boundaries between being logged in and not being logged in were blurred" because "he didn't need a password to gain access to remote systems". What he meant by this was the deep hacker magic that allows remote users to penetrate system security and spawn shells, even beyond firewalls, and that allowed the hacker to enter commands to the computer as though he had logged in using the normal Access Control procedures. Here are a few examples of "ultra-hacker" activity, but it is impossible to define this sort of thing because something new comes up all the time.

• Any technique that uses knowledge of TCP/IP to launch Denial of Service (DoS) attacks against hosts in concert with IP spoofing or other penetration technique. An example of this would be the use of SYN/ACK DoS attacks against a "trusted" host, followed by IP spoofing using TCP number prediction to gain a one-way connection to the target host. I would also include attacks launched via LANs that manipulate the ARP table, or any attack that manipulates any other routing protocol to spoof host identity, or uses DoS attacks against nameservers to subvert the normal trust relationships and allow IP spoofing to occur.
• Any techniques which use system backdoors or buffer overflow attacks to bind a shell to a higher port or install code that allows commands to be "tunneled" through a firewall using source routed packets or ICMP commands.
• Any "buffer overflow" attack which the hacker has discovered and coded the exploit for themselves. A buffer or stack overflow attack is one in which the original programmer has failed to check that input is not going to overflow the allocated space. If they fail to check the input, then it is possible to append arbitrary code at the overflow and get the program to execute it. The only buffer overflow exploits I have any respect for are when they have been discovered and coded by the cracker, not just downloaded off the web, compiled and run by some script kiddy who doesn't understand it. Learning how to code buffer overflows isn't hard *if* if the cracker understands ASSEMBLER and low-level compiler internals and *if* they work hard at it.
• Any low level spoofing attack that uses knowledge of low level protocols such as ARP. Any low level attack that uses knowledge of TCP/IP internals i.e. ICMP_REDIRECTS. Any higher level attack that subverts the targets view of the Internet by e.g. subverting the normal DNS name service.

Getting Privileges

So the cracker is in, what next? Unless they are just going to sit around reading dumb user's email or using the normal user facilities, then they will need to get some form of system privileges to make it all worth while. If they don't care about getting caught, they might not bother with this stuff, but most crackers want to be able to cover their tracks when the time comes to get out. A systems administrator must be aware of how the cracker mind works, and why they are so keen to get root, admin or supervisor status depending on the system they are hacking.

There are several good reasons why they might want to get admin privileges, and they mostly depend on why the remote host is a target in the first place. A cracker would always know *why* they are picking on the remote target prior to starting, and that determines *why* they are trying to get system privileges. Here's a few good reasons why a cracker might want to get privved up. This is not an exhaustive list, just a few that spring to mind, and the cracker's imagination is the only limit to the possible reasons to hack system privs.

• To install Internet services that run on a low, privileged port.
• To install bogus users to make getting back in easier.
• To place one or more ethernet interfaces into promiscuous mode.
• To be able to hide their presence on the system by manipulating system tables.
• To make any adjustments to the system that only privileged users can do. This could be installing any software needed for personal use, right through to re-compiling the kernel with new options included.
• To be able to edit the computer logs prior to exit and cover their break-in (see below).

• Crashing or killing processes that run with privileges that leave temporary or coredump files e.g. internal sendmail and internal ftp exploits.
• Internal subversion of the access control system using system tools that have been poorly written with regards to system security e.g. using "rdist" to create SUID shells.
• Internal subversion of the file access control system using knowledge of the internal representation of the file system to write low-level access programs to read files otherwise protected by the operating system.
• Using a Trojan, sniffer or password attack to gain the system administrator's password.
• Any form of social engineering that lead to system privileges.
• Abusing trust relationships between two hosts to move from host C to host B by apparently being a privileged user on host A who has similar rights on host B.
• Abusing "group" permissions with respect to file ownership in order to access or change files or programs.
• Where systems have Dynamic Load or Link Libraries to keep down the size of binary files, the internal loading process of the library can be spoofed by path redirection to force the program to run the cracker's version of the library routines instead of the system routines.

Once they have the necessary system privileges they can then take control of the computer and do whatever they need to do. Needless to say most crackers would never destroy data on a cracked computer, as it gets all hackers a bad name. The only people who disagree with this are some "ethical" crackers, who on discovering a "kiddy porn" site, do their best to destroy it. This is not just for the obvious moral reasons, but also because some people think that "kiddy porn" should be obliterated from the Internet before it forces governments to introduce controls and censorship to kill the freedom of the Internet once and for all.

Exploiting Trust Relationships

Because the Internet was designed with cooperative computing in mind, many of the early TCP/IP tools were a security nightmare. Many of these tools have been designed to allow remote access and remote execution of program code they are ideal attack points for any cracker who is inside the network already. If a trust relationship exists between host A and host B then a cracker on host C posing as host A can gain access to services on host B. Here are some of the more common system services that open up systems to crackers willing to exploit insecurities inherent in trust relationships.

• Network Filing Systems

One of the commonest services offered on any LAN is Network Filing Service which allow access to files stored remotely on a server as though those files were available locally. Network Filing Services work by mapping a network connection containing "file handles" to the actual physical filing system on the server. When a user needs a file on the server, their computer makes a connection to the program providing network filing services via the LAN, the server then calls operating system routines to provide access to the local file which it then sends back to the client via another connection.

• Remote Printing & Spooling Services

The second commonest service provided by servers in a client-server environment are remote printing and spooling services which allow users at remote hosts to direct printing to a centralized spooling system, and redirect output to remote printers. Once again these printing services tend to run in privileged mode on the server, and call operating system routines to manipulate and redirect print jobs in the print queue.

Remote printing and spooling services are open to the same sorts of attack as remote filing services, and several buffer overflows have been found in these services. In addition, a new spin on things has come about due to printers coming with their own ethernet card enabling them to be assigned an IP address and connected to the LAN, opening up a whole new world of possible spoofing activities using the remote printers IP address.

• Remote Procedure Calls (RPC)

Many computer systems designed for networking, such as UNIX, provide a mechanism for users on remote hosts to execute commands on a server. These Remote Procedure Calls (RPC) can be abused if the correct precautions are not taken by the systems administrator. We have already seen network filing services and remote printing services, and these services are often offered as an RPC service on the remote server. These are not the only services offered via RPC however, and a cracker will often ascertain which services are also running using the "rpcinfo" command.

redhat6% rpcinfo  -p slack
program vers proto   port
100000    2   tcp    111  portmapper
100000    2   udp    111  portmapper
100005    1   udp    674  mountd
100005    1   tcp    676  mountd
100003    2   udp   2049  nfs
100003    2   tcp   2049  nfs