readx;

Many hackers never forget their first intrusion in their hacking careers, just as men and women never forget their first night. Pen "Fun" Pavilion www.biquge.info

Lin Hong's invasion, although there was a lot of luck in it, did let him experience the thrill of invasion.

The method of guessing passwords has been around since the dawn of computer user systems. It's simple, but it's never outdated, and even if you go back a few decades, it's still effective.

Computer invasion is actually an invasion of human nature. No matter how the protective measures of your computer system are in place, there will always be some users, who are lucky or simply do not have any sense of security, although they know that the password they set is very simple, but in order to save trouble, they think that others are not so lucky, and they can guess their passwords.

So, they simply set the password to something like "12345678", "654321", the same password and nickname, nickname + number, nickname + birthday...... and so on in the most common combinations.

The favorite of hackers is this kind of user, they collect these common passwords, and also collect all the information of the corresponding user, such as the other party's email nickname, the other party's date of birth, and even the name and date of birth of the other party's relatives and friends.

Some hackers directly use manual guessing, such as Lin Hong's time, which takes more time and requires better luck.

Some hackers directly arrange and combine the collected information to form a list of hundreds of items, and then use their own software to continuously try to log in, and finally there is a high probability that they can escape the real password.

This way. It's called brute-force hacking.

If the password is just a simple combination of numbers. With a good computer, it only takes a short time to try out all possible combinations of numbers.

Through this invasion, Lin Hong somewhat understands why Kevin said that he is mainly targeting the invasion of the human brain, not simply the invasion of computers.

After successfully logging in to the UNIX server, Lin Hong began to check what permissions his user had.

He constantly looked at the contents of various files in the directories he had access to, and also constantly tested the specific permissions that the user had.

Although this is not an administrator account, there is a surprise, that is, this user named E Day C actually has the execution permission of the GCC compiler.

This also means: Lin Hong can run his own programs on this server.

So, he used the cat command and started writing a small program.

This app is small, but the functionality is not simple. If it is executed successfully, the "$" symbol on the terminal can be successfully changed to the "#" symbol, which means that the privilege is greatly improved.

This applet exploits a local buffer overflow vulnerability in UNIX.

After a crackling keyboard click, all the code for the program was written.

Lin Hong used gcc to compile, and then after fixing a few minor problems, compiled, and then typed in the compiled program. Execution -

ok!

The prompt information that appeared on the monitor made Lin Hong cheer in a low voice.

“yes!”

Sure enough, the flashing prompt on the left side of the monitor immediately changed to a "#" symbol.

At this point, it also means that Lin Hong has officially captured this fortress completely, and he has the greatest authority to do whatever he wants inside.

Next, Lin Hong began to check if there were any other users in the server at the moment, he looked at the time, it was already more than two o'clock in the morning, and it stands to reason that the network administrator should sleep at home. If there are other logins, except for hardcore computer enthusiasts, then there is only one possibility, and that is - intruders.

Lin Hong began to use commands to check the processes that were running now to see if there were any suspicious processes and users who were now logged in.

The monitor was constantly swiping upwards with various information, and Lin Hong's eyes were staring intently at these information. The eyeballs trembled at great speed, not letting go of a single piece of information.

He is the only user who is logged in at the moment.

After the process check is completed, no suspicious processes are found.

Next, he starts monitoring the service port.

These ports are the gates that lead to the outside of this fortress, and some of them are special passages opened by the city lord (administrator) himself, such as the No. 21 city gate, you can only look at it, and transport some materials out from this passage, but people can't come in, and what you can see is only a specific place, and other places are forbidden areas and are strictly restricted from passing.

And others, which may not be known to the city lord, may be the unknown secret doors left over from the construction of this castle, or the back doors secretly dug up by hackers.

Lin Hong saw that the open ports in this server were "21", "23", "512", and "79......

"Huh? Port 111 is also open? ”

Lin Hong was slightly stunned.

The other ports are fine, but this 111 port is a bit of a problem.

In UNIX, port 111 is the port opened by Sun's RPC (Remote Procedure Call) service, which is mainly used for internal process communication between different computers in a distributed system.

However, as far as Lin Hong knows, there is a relatively big vulnerability in Sun's RPC service, that is, there is a remote buffer overflow vulnerability in the xdr_array function when multiple RPC services are served, which allows an attacker to obtain root privileges remotely or locally.

This is a relatively common vulnerability, if Lin Hong had started to hack from here before, it would not have taken so much time at all, and he would not have to rely on luck to get into this system.

The reason why this port was not found was because Lin Hong started with the smallest port and tested them one by one, but as a result, he had lost patience and changed his intrusion strategy. Good luck later. I just guessed the password of one of the users.

Lin Hong was about to continue checking to see if anyone had exploited this vulnerability to hack inside, when suddenly a sentence appeared in the monitor.

I didn't expect you to start invading for so long.

Lin Hong was slightly startled, and he immediately understood that this was someone sending a message to him, that is, there was at least one other person on this server at the moment, and the other party was likely to have been observing his behavior.

Combined with the content of this sentence, he judged that the other party was Kevin. But I can't be sure.

So, Lin Hong had no choice but to remain silent, and had already decided that once he found out that the signs were wrong. He immediately quit and went offline.

Don't worry, it's me, the one who gave you the list.

Sure enough, it was Kevin.

When Lin Hong saw this, he immediately relaxed, and he replied:

E Day C: I was shocked, I thought it was discovered by the administrator.

Hehe. The administrator of this server is not that diligent, he leaves work on time at half past five in the afternoon. And this server is the Department of Computer Science of Duke University.,Specially designed for students to learn Unix on the computer.,Although it's a little strange for you to log in now.,But sometimes there are students who log in in the early hours of the morning.。

When Lin Hong saw Kevin's words, he was immediately relieved. When he first started, he was worried that when he was hacking, he happened to run into the administrator going online, and then found that he was logging into someone else's account to hack.

When Lin Hong told Kevin about this worry, Kevin told him a little story.

Kevin was trying to hack into a server. Due to the fact that the other party's security measures were very good, Kevin tried all kinds of ways to do it without success.

In the end, he had to use the method of social engineering, through telephone and fax, disguised as the head of the technical department, and asked the other party's logistics department to mail the raw materials containing key technologies to the other party by courier.

He then disguised himself as a courier. Pick up the mail, but at that moment, he happened to meet the other party's technical director who happened to go to the logistics department to handle things, and he took a picture with the other party, but in the end, he relied on his "talent" to save the day, and successfully photocopied the information.

Kevin told Lin Hong that when a hacker encounters the most dangerous thing, he must not be completely calm, because no one can know in what direction things will develop until the last moment.

Day C: How do you know I'm going to hack into this server today?

I set up an intrusion alert reminder. The series of servers I've given you are relatively secure, either for students to practice in universities, or for average administrators and rarely online. You just have to invade the past in order, and trust that your skills can be greatly improved.

Day C: Thank you.

Lin Hong felt very grateful that Kevin was so enthusiastic about helping himself, and it can be said that in this regard, Kevin was completely his enlightenment teacher.

After Lin Hong said this, the other party did not answer for a long time.

Just when he was confused, the other party suddenly sent a message:

There is a situation where today the admin doesn't know why it's online now. It's not a big deal, but I'd recommend that you log out first. Because E Day C is usually a good student, he rarely connects to the server at more than two o'clock in the morning, which can easily arouse the suspicion of the administrator.

I'll help you clean up the trails.

Finally, Kevin added.

Lin Hong was slightly stunned, and before he had time to think about it, he immediately disconnected from the server. At that moment, his heart beat violently a few times.

Although it didn't matter if he was discovered, but in this atmosphere, Lin Hong still felt a trace of nervousness uncontrollably, and at the same time, there was an inexplicable sense of excitement. It's like you're doing something bad and you're going to be discovered all of a sudden.

Lin Hong thought about it, or decided to log in to the cqcq software, originally Kevin would use this chat software to contact him like last time, but after waiting for a long time, there was still no news.

He wanted to log in to that server again to take a look, but he was worried that he would be exposed and discovered by the other party.

Under the contradiction in his heart, Lin Hong finally put this matter behind him for the time being.

He switched to the minix system and continued to enrich the bash system call instructions in the Linus system, after all, the PoSix standard books have been borrowed, and the common system calls will be implemented as soon as possible. (To be continued)