[Reprinted]Introduction

	==Phrack Inc.==                 Volume 0x0e, Issue 0x43, Phile #0x01 of 0x10 |=----------------------------------------------------------------------=| |=--------------------------=[ Introduction ]=--------------------------=| |=----------------------------------------------------------------------=| |=----------------------=[ By The Phrack Staff ]=-----------------------=| |=----------------------------------------------------------------------=| |=----------------------=[  November 17, 2010  ]=-----------------------=| |=----------------------------------------------------------------------=|         "The greatest trick the Devil ever pulled was convincing          the world he didn't exist"                                   --- Verbal Kint         It's 1.00 a.m., nobody hits this secondary road. Heck, I'm almost sure half of it doesn't have a line to remind you that you should share it with upcoming cars. It's raining, but not too hard. I'm going home.         It's Tuesday. What the hell am I doing out here, half an hour from home, slowly driving under the rain? It's 1.05 a.m., I know this road, I know this feeling, I recognize the shivering. I let it flow. Turn off the music, I want silence.         It's 2.00 a.m., nobody hits this machine at this time of the day. Logs track me, but I'll clean them. I know this road, I know this feeling, I recognize the shivering. Turn on the music, the game is on. I'm sure someone else is around here, someone else has seen this # before.         "I'll fuck you if you don't fuck me first, sir". Fair enough, this is the rule. I'll go to sleep afterwards. I'm meeting some friends and I've to take a train tomorrow. I'll sleep on the couch of someone I've never seen before, yet I know him well.         It's 1.00 a.m., 10 years later. It's a GPG email from the guy that once offered me a couch. Then another time. I can count the times I've seen him in person on two hands, but I would overflow a 'short' counting the words we exchanged. We meet again, thought you disappeared. Things change, indeed. Life gave us something to lose and we are holding on it. We lost people, money, opportunities, that's why we hold on. Once a hacker, forever a hacker, right? Let's finish this code. Let's visit this city.         It's 2.00 a.m., today. Nothing in this story, in this Intro, is real. I wasn't there, this is not me. This is just a stream of ASCII characters. Someone out there pulled a great trick and convinced the world that security was a cool business. Someone is pulling even greater tricks and makes money out of his ignorance living on others slightly bigger ignorance. Somewhere, a crackdown on some kids proves to be necessary to keep the 'mistery' alive, to keep the bandwagon going. Someone spies on former fellow friends, 'cause that's worth millions. Everybody is happy and we slowly fade away. Away, towards a new Underground.         "I'll fuck you if you don't fuck me first, sir". If you are shivering, if you have been there, if you feel it, you know what I mean. PHRACK may die. Groups may die. Things as we know today may die. The great trick might actually seem to work -- goodbye Underground, welcome Security Industry. Not too fast.         "Once a hacker, forever a hacker, right?"         The Game is on.                       -----( Phrack Issue #67 )----- It's with incredible pleasure that we present you our newly released issue: ______  _     _ ______  _______ _______ _     _      _ _   _______ ______ (_____ \(_)   (_|_____ \(_______|_______|_)   | |   _| U |_(_______|______) _____) )_______ _____) )_______ _       _____| |  (_     _)______       _   |  ____/|  ___  |  __  /|  ___  | |     |  _   _)   _| O |_|  ___ \     / ) | |     | |   | | |  \ \| |   | | |_____| |  \ \   (_     _) |___) )   / /   |_|     |_|   |_|_|   |_|_|   |_|\______)_|   \_)    |_n_| |______/   (_/                     - By the community, for the community. - But wait ... the release date ... it sounds familiar ... OMFG!!!                                  \\\ ,                                   \ `|                                    ) (   .-""-.                                    | |  /_  {  '.                                    | | (/ `\   } )                                    | |  ^/ ^`}   {                                    \  \ \=  ( {   )                                     \  \ '-, {   {{                                      \  \_.'  ) }  )                                       \.-'   (     (                                       /'-.'_. ) (  }                                       \_(    {   _/\                                        ) '--' `-;\  \                                    _.-'       /  / /                             <\/>_.'         .'  / /                         <\/></\>/.  '      /<\// /                         </\>  _ |\`- _ . -/|<// (                      <\/>    - _- `  _.-'`_/- |  \                      </\>        -  - -  -     \\\                       }`<\/>                <\/>`{                       { </\>-<\/>_<\/>_<\/>-</\> }                       }      </\> </\> </\>      {                    <\/>.                         <\/>                    </\>                          </\>                     {`<\/>                     <\/>`}                     } </\>-<\/>_<\/>_<\/>_<\/>-</\> {                     {      </\> </\> </\> </\>      }                     }                               }                     {           H A P P Y           {                     }                               }                     {             25th              {                  <\/>                               <\/>                  </\>        B I R T H D A Y        </\>                    `<\/>                          <\/>'                 jgs </\>-<\/>_<\/>_<\/>_<\/>_<\/>-</\>                          </\> </\> </\> </\> </\> Yes. That's right friends. This 67th issue is the celebration of Phrack's 25th birthday. Happy birthday Phrack!                     -----( Coming from the past )----- [hide]Once upon a midnight dreary, while I pondered, weak and weary, over many a quaint and curious volume of forgotten lore... Hello Cyberpals. It's your old friend Mike Schiffman AKA route AKA daemon9. *Cyberhug!* It sure has been a long time! Well I'll be! You guys all look the same, young and eager and hungry... Me? I'm still here, just older and grayer and bit less conspicuous. Ok, I'll say it -- I'm downright honored that you crazy rascals still remember me. It sure has been many a fortnight that I've been in this business. I mean, back in 1994, when I started poking around the scene in I was just a little dork who use to work out a lot and bleach my hair white. Sure I was probably the first muscle-bound white-haired guy with giant computer chip tattoo on his back who had this tireless thirst for computers and hacking and writing all sorts of Usenet posts and papers -- but there would legions more to come... Now in 2010 I'm a much bigger and more experienced dork. It's more than 16 years later. I have many more tattoos and the hair is getting white all by itself. And I reminisce... I look back and reflect on those days. Some of the stuff I use to do... My comp.security Usenet posts. "The Infinity Concept" e-zine, the precursor to my Phrack editorial days. My netcom.com .plan file. The PGP Attack FAQ. I remember getting owned. I remember the first time my phones got done up and you miscreants forwarded my calls to bridge and told people I had died of AIDS. I remember my girlfriend at the time being scared shitless of what was next. I remember my dox getting dumped to #phrack. I remember u4ea threatening to insert my SSN into the NCIC. I remember Bane and u4ea calling my house repeatedly. I also remember pictures of u4ea cross-dressing. I remember Bane getting backhanded by Synapse at Defcon 4. I remember Special Agent Peter Trahon and his partner who looked and sounded like Sargent Slaughter from GI JOE both from the San Francisco FBI Computer Crime task force picking me in a late model Crown Victoria and taking me to Max's Opera Cafe in Walnut Creek, CA and shaking me down for dirt on other cyber-dorks they were investigating... I remember teardrop. I remember Loki. I remember TQBF telling me that I had better be real careful in releasing the technique/code of ICMP covert channel tunneling as I was "stepping on active people's toes"... I remember hooking an old landline phone up to my neighbor's wiring to call him and discuss it... I remember Carolyn Meinel... And her daughter Virginia at Defcon 5. I remember Eric Bloodaxe tapping me to be a Phrack editor a long with Voyager and Redragon. I remember overshadowing them and bringing my own editorial team onboard... I remember how awesome it was to be a Phrack Editor. I remember how awesome Phrack was. How amazing it still is. Kudos to the current editorial team for keeping it alive, and here's to another 25 years. Come find me then, and prophile me.                                                 XOXO Scene,                                         MS AKA Route AKA daemon9                   -----( What you were waiting for )----- Telling you that we're proud to release this issue would be an euphemism for many reasons including, and that is the most important, the pleasure you will have while reading it. Oh and by the way, we apologize for the wait ... 08:21 |     --->| su [~su@201.6.x.y] #phrack 08:23 |     --->| arr[][] [arr@fledge.z.org] #phrack 08:29 |      su | halfdead, are you having trouble in man gcc this time? is                   that why phrack's issue is so late? 08:30 |    Dreg | wtf 08:30 | @bab00n | hoho Double. No. Triple private joke. You may have waited a long time but at least we made it before ZF #06 ;> $ cat p67/index.txt <--------------------------( Table of Contents )--------------------------> 0x01  Introduction ....................................... Phrack Staff 0x02  Phrack Prophile on punk ............................ Phrack Staff 0x03  Phrack World News .................................. EL ZILCHO 0x04  Loopback (is back) ................................. Phrack Staff 0x05  How to make it in Prison ........................... TAp 0x06  Kernel instrumentation using kprobes ............... ElfMaster 0x07  ProFTPD with mod_sql pre-authentication ............ FelineMenace 0x08  The House Of Lore: Reloaded ........................ blackngel 0x09  A Eulogy for Format Strings ........................ Captain Planet 0x0a  Dynamic Program Analysis and Software Exploitation . BSDaemon 0x0b  Exploiting memory corruptions in Fortran programs .. Magma        under UNIX/VMS 0x0c  PHRACKERZ: Two Tales ............................... Antipeace                                                                 &                                                             The Analog Kid 0x0d  Scraps of notes on remote stack overflow ........... pi3        exploitation 0x0e  Notes Concerning the Security, Design and .......... The Philosopher        Administration of Siemens DCO-CS Digital        Switching Systems                                                 0x0f  Hacking the mind for fun and profit ................ lvxferis 0x10  International Scenes ............................... various <-------------------------------------------------------------------------> Have you ever noticed how some issues seemed to have a thematic? Consider for example p66. There are 4 papers dealing with heap exploitation. Now take p63. 5 papers are about (anti)reverse engineering and binary manipulation techniques and p62 clearly has a Windows color. Weird, isn't it? Coincidence? Bias in the uniform distribution of hacking playgrounds? I'll let you draw your own conclusions. For this issue, with no doubts, the focus is on userland exploitation. Did you really think that you had seen everything? Well how about debugging some heap? While FelineMenace gives you tricks using an usual practical case (hint: don't miss the source code), blackngel explains in detail the House Of Lore technique. Having troubles with fortify? Go read Captain Planet's excellent paper on format bugs as well as pi3's notes about cookies. It might be handy. Exploiting bugs is cool but finding them is de facto mandatory. That's when BSDaemon's paper comes to play. Read it and learn about how to instrument programs. Now what about a new playground? Discover the joy of Fortran hacking with Magma. Oh btw he may just have lost it you know... Missing kernel fun? Why not reading ElfMaster's paper. You'll certainly learn a bit of useful things, truly. Missing the good old phreaking days? Thank The Philosopher for his contribution (you made us crazy man !@#) and go learning about old school DCO-CS hacking. The best for the end. We have the luck to have no more than 4 non technical papers for this issue. You don't care? Fucking idiot, go away. Though we already thanked them, let us highlight EL ZILCHO, TAp, Antipeace, The Analog Kid, lvxferis & the anonymous contributors of the "International Scenes" phile. Phrack is without a doubt one of the most technical source of knowledge of the whole hacking scene thanks to its writers. But the most important aspect is not the technical one. Nowadays there are lots of impressive sources of information (blogs, books, conferences) freely available on Internet. However they all lack a soul. Phrack has a spirit and that's its true power. Now as a demonstration of the so-called spirit, we have the brilliant work of EL ZILCHO. Tired of the crap published on zdnet? Then have a taste of the Phrack World News. Eager to learn about life experiences? TAp is your man with one of the most fascinating papers of this issue. You should also consider alternative literature with lvxferis' paper. Ahah. Oh and if you're just passing by, attracted by the hacking culture but not yet ready/able to embrace it then Phrackerz paper is for you. It should bring you answers.                                     -- The Phrack Staff Ps: Oops sorry to forget o_O. It came to our attention after Pipacs' profile publication in p66 that whitehats profile were the most wanted one. Unfortunately Theo was already on holidays [1] when we needed to start the interview. Sorry guyz ;> Have fun anyway with punk! [1] http://kerneltrap.org/mailarchive/openbsd-misc/2010/8/13/6186                     -----( GreetZ for issue #67 )----- As always and because our staff would have done nothing but shit without them, we'd like to thank (in no particular order)...     - route/daemon9:      still able to make a kickass intro ;)     - The Analog Kid:     the spirited kid        - nullcon guyz:       nice people, visit their great country!     - EL ZILCHO:          fuck1ng great job!     - TAp:                peace bro :>     - ElfMaster:          yet another kernel hax0r ;)     - lvxferis:           who is this guy???     - FelineMenace:       the LOLCats team counterattacks ;-)     - spacewalker:        supportive & gifted belgian bro     - blackngel:          malloc's worse enemy     - Captain Planet:     fmt bugs' worse enemy (lake of inspiration                                                  detected)     - argp & huku:        kudos for kickass answers in no time     - BSDaemon:           oi. Tudo bom?     - punk:               the whitehat k1ll3r     - the VX scene:       thanks for the support & various exchanges over                           past months. Special thanks to izee, herm1t and                           EOF writers.     - Magma:              take your pills gramps     - The Philosopher:    well done     - antipeace:          ~_o     - pi3:                Hi bulba! (oops wrong one)     - spy:                our IRC bot     - halfdead:           su said you contributed on IRC ;)     - the circle:         kudos for your past work. ...for their contributions and support. Touching isn't it? But so true :-)                   -----( Phrack Magazine's policy )----- phrack:~# head -20 /usr/include/std-disclaimer.h /* *  All information in Phrack Magazine is, to the best of the ability of *  the editors and contributors, truthful and accurate.  When possible, *  all facts are checked, all code is compiled.  However, we are not *  omniscient (hell, we don't even get paid).  It is entirely possible *  something contained within this publication is incorrect in some way. *  If this is the case, please drop us some email so that we can correct *  it in a future issue. * * *  Also, keep in mind that Phrack Magazine accepts no responsibility for *  the entirely stupid (or illegal) things people may do with the *  information contained herein.  Phrack is a compendium of knowledge, *  wisdom, wit, and sass.  We neither advocate, condone nor participate *  in any sort of illicit behavior.  But we will sit back and watch. * * *  Lastly, it bears mentioning that the opinions that may be expressed in *  the articles of Phrack Magazine are intellectual property of their *  authors. *  These opinions do not necessarily represent those of the Phrack Staff. */                   -----( Contact Phrack Magazine )-----             <  Editors           : staff[at]phrack{dot}org   >             >  Submissions       : staff[at]phrack{dot}org   <             <  Commentary        : loopback[@]phrack{dot}org >             >  Phrack World News : pwned[at]phrack{dot}org   <     Submissions may be encrypted with the following PGP key:     (Hint: Always use the PGP key from the latest issue) 复制代码