|
Cover
story
Hack
attack: How do they do it?
Jeremy
Muraski, left, and Mike Knetzger, of Modern Policing Solutions
LLC., go over research material for their website: www.modernpolice.com
(photo by Tina Gohr).
|
By
Michael Dunn
EDITOR'S
NOTE: To avoid the use of this article for actual hacking,
some details have been fudged or deleted.
One way to stop hackers is to know how they do it. I am going
to show you how hackers can hack an unsecured IIS server,
something network administrators should know. Now, if hackers
want to hack Windows NT, they will use NT to hack into it
because they know that the best way to hack a computer is
to use the same type of computer.
Next, they dial into the Internet, and their IP address is
dynamically assigned. They know must find a victim. How can
you find a computer on the Internet running Windows NT and
IIS? Excite's search engine, www.excite.com. A search for
"batch files as CGI", the title of IIS online help that all
servers running IIS have, works because Excite's spider indexes
it, unfortunately.
Now you have a list of over 100 servers running IIS. Next
the hacker opens a command prompt and FTPs to www.victim.com;
they are just guessing that IIS is running the FTP service.
Now if they get a connection refused, then IIS is not running
the FTP service. But if they succeed the following appears.
C:\ftp www.company.com
Connected to www.victim.com.
220 saturn Microsoft FTP Service (Version 3.0).
User (www.victim.com:(none)):
This connection message tells them something important: the
NetBIOS name of the server : SATURN. From this they can deduce
the name of the anonymous Internet account that is used by
NT to allow people to anonymously use the WWW, FTP and Gopher
services on the machine. If the default account hasn't been
changed, and it is very rare if it has been changed, the anonymous
Internet account will be called IUSR_SATURN. This information
will be needed later to gain Administrator access to the machine.
For the FTP username the hacker will try the user name "Guest"
and the Password "Guest" or no password at all. A fresh install
of NT will have the guest account disabled, but sometimes
the System Administrator enables it with a weak password,
such as Guest or no password at all.
Now if that doesn't work the hacker will try to FTP in as
an anonymous user, which the system administrator would have
enabled also.
First off the hacker types "cd /c" because some admins will
make the the root of the drive a virtual ftp directory and
leave the default alias name: "/c". Next they see whether
they can actually "put" any files onto the site to test if
the write permissions are enabled for this ftp site. If so,
they type "dir" to see what they have access to. They want
to see a directory called "CGI-BIN". If they do, the Webmaster
of the NT machine has put this here with the rest of the WWW
site so he can remotely make changes to it. They know that
the CGI-BIN has the "Execute" permission so if they can manage
to put any program in here they can run it from his Web browser.
This can be prevented, using NTFS file-level security to cut
off write access to the anonymous Internet account to this
directory. Next they change directories to the CGI-BIN directory
and change the type to I by using the command "binary". Then
they type "put cmd.exe". If they receive this message they
are in.
200 PORT command successful.
150 Opening BINARY mode data connection for CMD.EXE.
226 Transfer complete.
208144 bytes sent in 0.06 seconds (3469.07 Kbytes/sec)
Next they place popular hacking scripts into the same directory.
With these three files in place they don't "close" the ftp
session; they just close the Command Prompt window, then connect
to America Online.
They do this because if logging is enabled on the NT machine
the IP address of AOL's proxy server will be left and not
their own ... not that it really matters, because soon they'll
edit the logfile and wipe out all traces of their presence.
Opening up the Web browser they enter a specific URL :
After about a 15-second wait the following appears on their
Web browser:
CGI Error
The specified CGI application misbehaved by not returning
a complete set of HTTP headers. The headers it did return
are:
Congratulations, now account IUSR_SATURN have administrator
rights! They have just made the anonymous Internet account
a local administrator and consequently using this account
can do pretty much what they want to. First, they have to
create an account for themselves so that they can use to connect
to the NT server using NT Explorer and most of the administrative
tools. They can't use the IUSR_SATURN account because they
don't know the randomly generated password. To create an account
they enter another URL:.This creates an account called "hack"
with the password "hack". To make the account a local administrator
he enters one more URL.
This has taken less than 10 minutes! They disconnect from
AOL and click on start, go to find and do a search for the
computer www.victim.com. After about a minute the computer
is found.
Next they right click on the "computer" and then click on
Explore. NT Explorer opens; then they are prompted for a user
name and password. They enter "hack" and "hack". Now they
can do anything, like erase the log files. If they get any
message about sharing violations all they have to do is change
the date on the computer with yet another URL:
All this took at most half an hour. This demonstrates weak
Windows security and weak administration.
Michael Dunn is a free-lance Web developer in Phoenix, Ariz.
Contact him at [email protected].
|
|
Business
directory
Advertising
Apartments
Auto
dealers
Automotive
parts
Automotive
search
Business
opportunity
Chiropractor
& relaxation
Computers
& repair
Computer
training
Education
Employment
Event
tickets and tours
Gardening
centers
Grocers
Homebuilders
Hospitals
Hotels
Legal
services
Mortgage
banker
Natural
health
Photography
Packer
merchandise
Performances
Realtors
Restaurants
Shopping
Slides
Technology
solutions
Tires
Upcoming
events
|
