+---------------------------------------------------------------------------+
 :PHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHA:
 :pha+-------------------------------------------------------------------+pha:
 :PHA:             Phreakers/Hackers/Anarchists Present:                 :PHA:
 :pha:  =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  :pha:
 :PHA:  +=+      Gaining Better Access On Any Unix System           +=+  :PHA:
 :pha:  =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  :pha:
 :PHA:  Written By Doctor Dissector (doctord@darkside.com) Date: 1/7/91  :PHA:
 :pha+-------------------------------------------------------------------+pha:
 :PHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHAphaPHA:
 +---------------------------------------------------------------------------+
 
+-----------------------------------------------------------------------------+
:=[ Disclaimer ]==============================================================:
+-----------------------------------------------------------------------------+
 
The author and the sponsor group Phreakers/Hackers/Anarchists will not be held
    responsible for any actions done by anyone reading this material before,
    during, and after exposure to this document. This document has been
    released under the notion that the material presented herin is for
    informational purposes only, and that neither the author nor the group
    P/H/A encourage the use of this information for any type of illegal
    purpose. Thank you.
 
 
+-----------------------------------------------------------------------------+
:=[ Introduction ]============================================================:
+-----------------------------------------------------------------------------+
 
Hello there again. Well, I just recently started getting back into the hacking
    mode of things, and decided to throw together a quick-reference type of
    deal on how to get better access on any unix driven system. Unix, in my
    opinion is the best operating system out today for all-purpose use, and
    is probably the most widely used operating system currently in use as
    well. Anyway, the ideas in this document are probably far from original,
    but are re-stated together in order to help devise new strategies for
    cracking unix. Also note that this is not for novices, I will constantly
    refer back to topics which are generally well known throughout unix
    users, so don't expect me to elaborate. Enjoy...
 
+-----------------------------------------------------------------------------+
:=[ General Unix Hints ]======================================================:
+-----------------------------------------------------------------------------+
 
1. If you have write priv's to a directory but don't have write priv's to a
    file in that directory, copy the file over to another directory, delete
    the original file, modify your copy of the file to your tastes, and
    recopy it back into the original directory. Example:
 
        cp /canthack/cantwriteme /usr/mydir
        rm /canthack/cantwriteme
        cp /usr/mydir/gnuversion /usr/mydir/cantwriteme
        cp /usr/mydir/cantwriteme /canthack
 
2. If you have read access to a file but can't copy it due to directory read
    restrictions, you can still cat it into another file in another directory.
    Example: "cat cantcopyme > /usr/mydir/IcopiedYOU!".
 
3. Always touch files up after you modify them so the date/time stamp is
    the same/close to what it was before you modified it. This is done by
    using the command "touch HHmmMMdd <filename>" where HH=hour, mm=minute,
    MM=month, and dd=day.
 
+-----------------------------------------------------------------------------+
:=[ Gaining Better Access On A Unix ]=========================================:
+-----------------------------------------------------------------------------+
 
1. Grab /etc/passwd, you might be able to get an account that will put you in
    a better position using password crackers; just having the list of users
    puts you ahead if the password file is shadowed.
 
3. Use the command:
 
    find / -perm -4000 -exec /bin/ls -lad {} ";"
 
    It will show you all files with the UID bit set. You can then attempt to
    create a shell with root/another user's uid priv's or modify them,
    depending on what file priv's are set on them.
 
3. Check for write priv's to /usr/lib directory and /usr/lib/crontab file.
    The /usr/lib/crontab file will execute certain commands at specific
    times under the uid of root. If you don't know much about this file, I
    advise you to stay away from it.
 
4. Check for write priv's to /usr/spool/crontabs directory and any crontab
    files in that directory; since these scripts are run under the uid bit
    of each listed user, if you could edit the root or other important
    user's cron script, you might put yourself in a better position.
 
5. Check for write priv's to scripts/programs executed BY the /usr/lib/crontab
    script or the scripts in /usr/spool/crontabs directory. If you could
    modify a program/script used by these cron scripts (backdoor... eh?)
    you could easily better your position on the system.
 
6. Check for write priv's to /bin, /usr/bin, /etc, /usr/lib, and any other
    important directories with binaries or scripts owned by root or other
    imporant users on the system, or just plain used a heck of a lot by
    the users on a particular system. You might be able to modify certain
    files (backdoors, etc) in order to better your position on the system.
 
7. Use a trojan. Some unix systems have faults in that a user who hangs up in
    the middle of a connection will not be logged out of the system, and the
    next person to log onto the system under the same tty will be placed into
    that user's shell. You can create a trojan program simulating normal
    login (many have been described by Shooting Shark and others) to gain
    passwords (possibly root if you are REALLY REALLY lucky) to the system.
 
8. Read a terminal device (/dev/ttyXXX) using the "cat /dev/ttyXXX" command,
    which requires you to own a uid shell of the current user on that ttyXXX,
    but could be useful in gaining more accounts. The Prophet also had an
    idea where you would read the ttyXXX until the superuser (using a
    differnet account) would login, and then you would send him a write
    message saying something like "I'm Gonna Format Your Winchesters!!!"
    (as The Prophet would say it...), you could watch him su over to the
    root account in order to boot you off the system; meanwhile, you are
    watching him type in the password and all for the su, and you now have
    root.
 
+-----------------------------------------------------------------------------+
:=[ Appendix ]================================================================:
+-----------------------------------------------------------------------------+
 
1. The following is a paritial listing of some programs/scripts under the unix
    operating environment that generally (if not always) have the root
    superuser uid bit set on them.
 
    /bin/chfn                          /bin/chhd
    /bin/chsh                          /bin/mail
    /bin/passwd                        /bin/rcp
    /bin/su                            /usr/lib/lpd
    /usr/lib/sendmail                  /com/sigp
    /com/xsubs                         /etc/find_orphans
    /etc/lpc                           /etc/lprotect
    /etc/ping                          /etc/salacl
    /etc/suid_exec                     /etc/syncids
    /etc/timedc                        /sys/net/netman
    /sys/vtserver                      /usr/bin/login
    /usr/bin/tb
 
+-----------------------------------------------------------------------------+
:=[ Conclusion & Credits ]====================================================:
+-----------------------------------------------------------------------------+
 
Well, that's pretty much it. I doubt that is even close to all the ideas a
    great deal of people can come up with for gaining better access to any
    given unix system, but it is a start. I'd also like to give credit to
    So76 for getting this list started and The Prophet for his excellent
    information in "Unix Use And Security From The Ground Up" textfile,
    great stuff. Till next tyme....
                                                    dd/pha
 
+-----------------------------------------------------------------------------+
:=[ Greets & Messages ]=======================================================:
+-----------------------------------------------------------------------------+
 
To all the network hackers out there: Keep up the good work.
 
Yo! To Kryptic Night, PhantasMumble, Pain Hertz, Doc Holiday, Black Death,
    Killer Korean, M.I.T., Anonymous Anarchist, Brownstone, and anyone else
    I might have forgotten!
 
+-----------------------------------------------------------------------------+
:=======>> Unholy Temple EEE-light! PHA-HQ/NIA/PHRACK - XXX-PRI-VATE <<=======:
+-----------------------------------------------------------------------------+
         "The future is forever..." + "The future is NOW!" - KL/PHRACK