HACKING WITH XP
HACKING WITH XP
by Carolyn Meinel
Part I: The Magic of DOS
In this guide you will learn how to telnet, forge
email, and use nslookup with Windows XP.
So you have the newest, glitziest, "Fisher Price" version of Windows:
XP. How can you use XP in a way that sets you apart from the boring millions of
ordinary users?
****************
Luser Alert: Anyone
who thinks this GTMHH will reveal how to blow up people's TV sets and steal
Sandra Bullock's email is going to find out that I won't tell them how.
****************
The key to doing amazing things with XP is as simple as D O S. Yes, that's
right, DOS as in MS-DOS, as in MicroSoft Disk Operating System. Windows XP (as
well as NT and 2000) comes with two versions of DOS. Command.com is an old DOS
version. Various versions of command.com come with Windows 95, 98, SE, ME,
Window 3, and DOS only operating systems.
The other DOS, which comes only with XP, 2000 and NT, is cmd.exe. Usually
cmd.exe is better than command.com because it is easier to use, has more
commands, and in some ways resembles the bash shell in Linux and other Unix-type
operating systems. For example, you can repeat a command by using the up arrow
until you back up to the desired command. Unlike bash, however, your DOS command
history is erased whenever you shut down cmd.exe. The reason XP has both
versions of DOS is that sometimes a program that won?t run right in cmd.exe will
work in command.com
****************
Flame Alert: Some
readers are throwing fits because I dared to compare DOS to bash. I can compare
cmd.exe to bash if I want to. Nanny nanny nah nah.
****************
DOS is your number one Windows gateway to the Internet, and the open sesame to
local area networks. From DOS, without needing to download a single hacker
program, you can do amazingly sophisticated explorations and even break into
poorly defended computers.
****************
You can go to jail warning:
Breaking into computers is against the law if you do not have permission to do
so from the owner of that computer. For example, if your friend gives you
permission to break into her Hotmail account, that won't protect you because
Microsoft owns Hotmail and they will never give you permission.
****************
****************
You can get expelled warning:
Some kids have been kicked out of school just for bringing up a DOS prompt on a
computer. Be sure to get a teacher's WRITTEN permission before demonstrating
that you can hack on a school computer.
****************
So how do you turn on DOS?
Click All Programs -> Accessories -> Command
Prompt
That runs cmd.exe. You should see a black screen with white text on it, saying
something like this:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\>
Your first step is to find out what commands you can run in DOS. If you type
"help" at the DOS prompt, it gives you a long list of commands.
However, this list leaves out all the commands hackers love to use. Here are
some of those left out hacker commands.
TCP/IP commands:
telnet
netstat
nslookup
tracert
ping
ftp
NetBIOS commands (just some examples):
nbtstat
net use
net view
net localgroup
TCP/IP stands for
transmission control protocol/Internet protocol. As you can guess by the name,
TCP/IP is the protocol under which the Internet runs. along with user datagram
protocol (UDP). So when you are connected to the Internet, you can try these
commands against other Internet computers. Most local area networks also use
TCP/IP.
NetBIOS (Net Basic
Input/Output System) protocol is another way to communicate between computers.
This is often used by Windows computers, and by Unix/Linux type computers
running Samba. You can often use NetBIOS commands over the Internet (being
carried inside of, so to speak, TCP/IP). In many cases, however, NetBIOS
commands will be blocked by firewalls. Also, not many Internet computers run
NetBIOS because it is so easy to break in using them. We will cover NetBIOS
commands in the next Guide to XP Hacking.
The queen of hacker commands is telnet. To get Windows help for telnet, in the
cmd.exe window give the command:
C:\>telnet /?
Here's what you will get:
telnet [-a][-e escape
char][-f log file][-l user][-t term][host
[port]]
-a Attempt automatic logon. Same as --l opttion except uses the currently logged
on user's name.
-e Escape character to enter telnet cclientt prompt.
-f File name for client side logging
-l Specifies the user name to log in with oon the remote system. Requires that
the remote system support the TELNET ENVIRON option.
-t Specifies terminal type. Supportedd termm types are vt100, vt52, ansi and vtnt
only.
host Specifies the hostname or IP address of the remote computer to connect to.
port Specifies a port number or service name.
****************
Newbie note: what is a
port on a computer? A computer port is sort of like a seaport. It's where things
can go in and/or out of a computer. Some ports are easy to understand, like
keyboard, monitor, printer and modem. Other ports are virtual, meaning that they
are created by software. When that modem port of yours (or LAN or ISDN or DSL)
is connected to the Internet, your computer has the ability to open or close any
of over 65,000 different virtual ports, and has the ability to connect to any of
these on another computer - if it is running that port, and if a firewall
doesn?t block it.
****************
****************
Newbie note: How do
you address a computer over the Internet? There are two ways: by number or by
name.
****************
The simplest use of telnet is to log into a remote computer. Give the command:
C:/>telnet targetcomputer.com (substituting the name of the computer you want
to telnet into for targetcomputer.com)
If this computer is set up to let people log into accounts, you may get the
message:
login:
Type your user name here, making sure to be exact. You can't swap between lower
case and capital letters. For example, user name Guest is not the same as guest.
****************
Newbie note: Lots of
people email me asking how to learn what their user name and password are. Stop
laughing, darn it, they really do. If you don't know your user name and
password, that means whoever runs that computer didn't give you an account and
doesn't want you to log on.
****************
Then comes the message:
Password:
Again, be exact in typing in your password.
What if this doesn't work?
Every day people write to me complaining they can't telnet. That is usually
because they try to telnet into a computer, or a port on a computer that is set
up to refuse telnet connections. Here's what it might look like when a computer
refuses a telnet connection:
C:\ >telnet 10.0.0.3
Connecting To 10.0.0.3...Could not open connection to the host, on port 23. A
connection attempt failed because the connected party did not properly respond
after a period of time, or established connection failed because connected host
has failed to respond.
Or you might see:
C:\ >telnet techbroker.com
Connecting To techbroker.com...Could not open connection to the host, on port
23. No connection could be made because the target machine actively refused it.
If you just give the telnet command without giving a port number, it will
automatically try to connect on port 23, which sometimes runs a telnet server.
**************
Newbie note: your
Windows computer has a telnet client program, meaning it will let you telnet out
of it. However you have to install a telnet server before anyone can telnet into
port 23 on your computer.
*************
If telnet failed to connect, possibly the computer you were trying to telnet
into was down or just plain no longer in existence. Maybe the people who run
that computer don't want you to telnet into it.
Even though you can't telnet into an account inside some computer, often you can
get some information back or get that computer to do something interesting for
you. Yes, you can get a telnet connection to succeed -without doing anything
illegal --against almost any computer, even if you don't have permission to log
in. There are many legal things you can do to many randomly chosen computers
with telnet. For example:
C:/telnet freeshell.org 22
SSH-1.99-OpenSSH_3.4p1
That tells us the target computer is running an SSH server, which enables
encrypted connections between computers. If you want to SSH into an account
there, you can get a shell account for free at http://freeshell.org . You can
get a free SSH client program from http://winfiles.com .
***************
You can get punched in the nose warning:
Your online provider might kick you off for making telnet probes of other
computers. The solution is to get a local online provider and make friends with
the people who run it, and convince them you are just doing harmless, legal
explorations.
*************
Sometimes a port is running an interesting program, but a firewall won't let you
in. For example, 10.0.0.3, a computer on my local area network, runs an email
sending program, (sendmail working together with Postfix, and using Kmail to
compose emails). I can use it from an account inside 10.0.0.3 to send emails
with headers that hide from where I send things.
If I try to telnet to this email program from outside this computer, here's what
happens:
C:\>telnet 10.0.0.3 25
Connecting To 10.0.0.3...Could not open connection to the host, on port 25. No
connection could be made because the target machine actively refused it.
However, if I log into an account on 10.0.0.3 and then telnet from inside to
port 25, here's what I get:
Last login: Fri Oct 18 13:56:58 2002 from 10.0.0.1
Have a lot of fun...
cmeinel@test-box:~> telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1... [Carolyn's note: 127.0.0.1 is the numerical address meaning
localhost, the same computer you are logged into]
Connected to localhost.
Escape character is '^]'.
220 test-box.local ESMTP Postfix
The reason I keep this port 25 hidden behind a firewall is to keep people from
using it to try to break in or to forge email. Now the ubergeniuses reading this
will start to make fun of me because no Internet address that begins with 10. is
reachable from the Internet. However, sometimes I place this
"test-box" computer online with a static Internet address, meaning
whenever it is on the Internet, it always has the same numerical address. I'm
not going to tell you what its Internet address is because I don't want anyone
messing with it. I just want to mess with other people's computers with it,
muhahaha. That's also why I always keep my Internet address from showing up in
the headers of my emails.
***************
Newbie note: What is
all this about headers? It's stuff at the beginning of an email that may - or
may not - tell you a lot about where it came from and when. To see full headers,
in Outlook click view -> full headers. In Eudora, click the "Blah blah
blah" icon.
****************
Want a computer you can telnet into and mess around with, and not get into
trouble no matter what you do to it? I've set up my techbroker.com
(206.61.52.33) with user xyz, password guest for you to play with. Here's how to
forge email to [email protected] using telnet. Start with the command:
C:\>telnet techbroker.com 25
Connecting To Techbroker.com
220 <techbroker.com> Service ready
Now you type in who you want the message to appear to come from:
helo [email protected]
Techbroker.com will answer:
250 <techbroker.com> host ready
Next type in your mail from address:
mail from:[email protected]
250 Requested mail action okay, completed
Your next command:
rcpt to:[email protected]
250 Requested mail action okay, completed
Your next command:
data
354 Start main input; end with <CRLF>.<CRLF>
Carolyn's note: <CRLF> just means hit return. In case you can't see that
little period between the <CRLF>s, what you do to end composing your email
is to hit enter, type a period, then hit enter again. Anyhow, try typing:
This is a test.
.
250 Requested mail action okay, completed
quit
221 <techbroker.com> Service closing transmission channel
Connection to host lost.
Using techbroker's mail server, even if you enable full headers, the message we
just composed looks like:
Status: R
X-status: N
This is a test.
That's a pretty pathetic forged email, huh? No "from", no date.
However, you can make your headers better by using a trick with the data
command. After you give it, you can insert as many headers as you choose. The
trick is easier to show than explain:
220 <techbroker.com> Service ready
helo [email protected]
250 <techbroker.com> host ready
mail from:[email protected]
250 Requested mail action okay, completed
rcpt to:[email protected]
250 Requested mail action okay, completed
data
354 Start main input; end with <CRLF>.<CRLF>
from:[email protected]
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
.
250 Requested mail action okay, completed
quit
221 <techbroker.com> Service closing transmission channel
Connection to host lost.
The message then looks like:
from:[email protected]
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
The trick is to start each line you want in the headers with one word followed
by a colon, and the a line followed by "return". As soon as you write
a line that doesn't begin this way, the rest of what you type goes into the body
of the email.
Notice that the [email protected] from the "mail from:" command
didn't show up in the header. Some mail servers would show both "from"
addresses.
You can forge email on techbroker.com within one strict limitation. Your email
has to go to someone at techbroker.com. If you can find any way to send email to
someone outside techbroker, let us know, because you will have broken our
security, muhahaha! Don't worry, you have my permission.
Next, you can read the email you forge on
techbroker.com via telnet:
C:\>telnet techbroker.com 110
+OK <[email protected]> service ready
Give this command:
user xyz
+OK user is known
Then type in this:
pass test
+OK mail drop has 2 message(s)
retr 1
+OK message follows
This is a test.
If you want to know all possible commands, give
this command:
help
+OK help list follows
USER user
PASS password
STAT
LIST [message]
RETR message
DELE message
NOOP
RSET
QUIT
APOP user md5
TOP message lines
UIDL [message]
HELP
Unless you use a weird online provider like AOL, you can use these same tricks
to send and receive your own email. Or you can forge email to a friend by
telnetting to his or her online provider's email sending computer(s).
With most online providers you need to get the exact name of their email
computer(s). Often it is simply mail.targetcomputer.com (substitute the name of
the online provider for targetcomputer). If this doesn't work, you can find out
the name of their email server with the DOS nslookup program, which only runs
from cmd.exe. Here's an example:
C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11
> set q=mx
> dimensional.com
Server: DNS1.wurld.net
Address: 206.61.52.11
dimensional.com MX preference = 5, mail exchanger =
mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =
mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =
mx3.dimensional.com
dimensional.com nameserver = ns.dimensional.com
dimensional.com nameserver = ns-1.dimensional.com
dimensional.com nameserver = ns-2.dimensional.com
dimensional.com nameserver = ns-3.dimensional.com
dimensional.com nameserver = ns-4.dimensional.com
mail.dimensional.com internet address = 206.124.0.11
mx2.dimensional.com internet address = 206.124.0.30
mx3.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.10
ns.dimensional.com internet address = 206.124.26.254
ns.dimensional.com internet address = 206.124.0.254
ns.dimensional.com internet address = 206.124.1.254
ns.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.32
ns.dimensional.com internet address = 206.124.0.30
ns.dimensional.com internet address = 206.124.0.25
ns.dimensional.com internet address = 206.124.0.15
ns.dimensional.com internet address = 206.124.0.21
ns.dimensional.com internet address = 206.124.0.9
ns-1.dimensional.com internet address = 206.124.26.254
ns-2.dimensional.com internet address = 209.98.32.54
ns-3.dimensional.com internet address = 206.124.1.254
ns-4.dimensional.com internet address = 206.124.0.254
>
The lines that tell you what computers will let you forge email to people with @dimensional.com
addresses are:
dimensional.com MX preference = 5, mail exchanger =
mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =
mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =
mx3.dimensional.com
MX stands for mail exchange. The lower the preference number, the more they
would like you to use that address for email.If that lowest number server is too
busy, then try another server.
Sometimes when you ask about a mail server, nslookup will give you this kind of
error message:
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to [207.217.120.202] timed-out
To get around this problem, you need to find out what are the domain servers for
your target online provider. A good place to start looking is http://netsol.com/cgi-bin/whois/whois
. If this doesn't work, see http://happyhacker.org/HHA/fightback.shtml for how
to find the domain servers for any Internet address.
****************
Newbie note: A domain
name server provides information on the names and numbers assigned to computers
on the Internet. For example, dns1.wurld.net and dns2.wurld.net contain
information on happyhacker.org, techbroker.com, securitynewsportal.com,
thirdpig.com and sage-inc.com. When you query dns1.wurld.net about other
computers, it might have to go hunting for that information from other name
servers. That's why you might get a timed out failure.
***************
Once you know the domain servers for an online service, set one of them for the
server for your nslookup program. Here's how you do it:
C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11
Now give the command:
> server 207.217.126.41
Default Server: ns1.earthlink.net
Address: 207.217.126.41
Next command should be:
> set q=mx
> earthlink.net
Server: ns1.earthlink.net
Address: 207.217.126.41
earthlink.net MX preference = 5, mail exchanger = mx04.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx05.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx06.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx00.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx01.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx02.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx03.earthlink.net
earthlink.net nameserver = ns3.earthlink.net
earthlink.net nameserver = ns1.earthlink.net
earthlink.net nameserver = ns2.earthlink.net
mx00.earthlink.net internet address = 207.217.120.28
mx01.earthlink.net internet address = 207.217.120.29
mx02.earthlink.net internet address = 207.217.120.79
mx03.earthlink.net internet address = 207.217.120.78
mx04.earthlink.net internet address = 207.217.120.249
mx05.earthlink.net internet address = 207.217.120.31
mx06.earthlink.net internet address = 207.217.120.23
ns1.earthlink.net internet address = 207.217.126.41
ns2.earthlink.net internet address = 207.217.77.42
ns3.earthlink.net internet address = 207.217.120.43
>
Your own online service will usually not mind and may even be glad if you use
telnet to read your email. Sometimes a malicious person or faulty email program
will send you a message that is so screwed up that your email program can't
download it. With telnet you can manually delete the bad email. Otherwise tech
support has to do it for you.
If you think about it, this ability to forge email is a huge temptation to
spammers. How can your online provider keep the bad guys from filling up a
victim's email box with garbage? The first time a bad guy tries this, probably
nothing will stop him or her. The second time the online provider might block
the bad guy at the firewall, maybe call the bad guy's online provider and kick
him or her and maybe get the bad guy busted or sued.
**************
You can go to jail warning:
Sending hundreds or thousands of junk emails to bomb someone's email account is
a felony in the US.
***************
***************
You can get sued warning:
Spamming, where you send only one email to each person, but send thousands or
millions of emails, is borderline legal. However, spammers have been
successfully sued when they forge the email addresses of innocent people as
senders of their spam.
****************
Now that you know how to read and write email with telnet, you definitely have
something you can use to show off with. Happy hacking!
Oh, here's one last goodie for advanced users. Get netcat for Windows. It's a
free program written by Weld Pond and Hobbit, and available from many sites, for
example
http://www.atstake.com/research/tools/#network_utilities . It is basically
telnet on steroids. For example, using netcat, you can set up a port on your
Windows computer to allow people to telnet into a DOS shell by using this
command:
C:\>nc -L -p 5000 -t -e cmd.exe
You can specify a different port number than 5000. Just make sure it doesn't
conflict with another port by checking with the netstat command. Then you and
your friends, enemies and random losers can either telnet in or netcat in with
the command:
C:\>nc -v [ipaddress of target] [port]
Of course you will probably get hacked for setting up this port. However, if you
set up a sniffer to keep track of the action, you can turn this scary back door
into a fascinating honeypot. For example, you could run it on port 23 and watch
all the hackers who attack with telnet hoping to log in. With some programming
you could even fake a unix-like login sequence and play some tricks on your
attackers.
___________________________________________________________________