Hacking with Kazaa

###############################################################*
# S.A.B.R.O. Net Security Advisory
# home.earthlink.net/~wh1004989
###############################################################*
#Product: Kazaa
#Authors: Sabro
#Tools Needed : netcat, winfo
###############################################################*

#Overview#-----------------------------------------------------#
Kazaa is a popular P2P file sharing program that most are aware
of, however it can be used to find other systems to gain access
to.


#Method#-------------------------------------------------------#

First start Kazaa and once your connected look in the
Tool/Options/firewall area, and down towards the bottom you'll
notice the Incoming Ports section.

Record the port number listed in the Use Port **** for incoming
connections and select the Use Port 80 as alternative for
incoming connections checkbox. Now that you've done this
fire up netcat and issue the following commands :

nc -v -t 127.0.0.1 80 and once connected enter :
GET / HTTP 1.0

You should receiving something as the following

HTTP/1.0 404 Not Found
X-Kazaa-Username: sabro
X-Kazaa-Network: KaZaA
X-Kazaa-IP: 209.183.120.91:2957
X-Kazaa-SupernodeIP: 66.65.160.49:2436

Record the ip address and port of the X-Kazaa-SupernodeIP, shut
Kazaa down and repeat the process, you should receive a new
ip and port. Collect these for further use. Once you've got
what you want connect to these other ips with netcat, being
sure to try ports 80/TCP, 1214/TCP and the port you got from
the supernode.

You should then notice the different user names for Kazaa and you
should get the standard 404 not found. If you lucky enough to get
a listing of files shared by Kazaa, fire up your trusty web
brower at point it at the victim. You should be able to see
to see the same file listing, however when you click on most of
the files, you won't be prompted to save, merely a click and
nothing happens....on your end. The victim will see the following
example on their side :


Title | Artist | User | Participation Level | Progress | Status | Time | Uploaded/Reg
-------------------------------------------------------------------------------------------------------------------------
Hand in my Pocket | Alanis Morrisette | | Low(0) | | Aborted | | 128k/3474kb
--------------------------------------------------------------------------------------------------------------------------
World Needs a Hero| MegaDeth | | Low(0) | | Aborted | | 128/5481kb
--------------------------------------------------------------------------------------------------------------------------
Respect | Pantera | | Low(0) | | Aborted | | 128/4907kb
__________________________________________________________________________________________________________________________



While this is a mild annoyance to the victim, and hardly constitutes
a security flaw, we have used this method to identify win boxes
running Kazaa, and vunerable to other attacks such as open or
weakly passworded shares, BO, Netbus, etc etc without having to first
scan the host to see if they have these services available.


#eof

Sincerely,

Sabro

http://home.earthlink.net/~wh1004989

So you're one of those twats that sickened Kazaa the way it is now....

Bravo ! (ironic)

I for one am not impressed....

You'r a ****, what da hell do you think you gain from this? Nothing, you'v just show what a big fool you are! I pitty you....

- Noia

Well that was big of you ! this site like it has been said a thousand times is for security professionals and people with an interst in computer security not condoning or publishing "hacks" this is not a black hat hangout where you can find out how to destroy someones machine or annoy some kazaa user ! se your knowledge and skill in a productive way and certainly dont go shouting your mouth off about your so called prowess !

Grow up and stop ruining things for other users (kazaa etc).

Another not very impressed member !

Hmmm, I on the other hand disagree with the comments in this post. I mean, isnt this supposed to be "Hackers know the weakness in your system, should'nt you?" This method shown here is of interest. How would you defend yourself from this if you dont know how this works??? Maybe sabro should have tried to mention a work around for this problem. I on the other hand, now will use this information to see if:

1 - Its true and if it actually works.

2 - If it does work, and if it does cause a real threat (i fail to see the danger in it yet) then how to work around it.

3 - I will help make sure that this problem gets known, and hope for feedback on fixing it.

I admitt that the way sabro has posted it, it looks like an "evil" wannabe exploit, but this provided information is good in order to find means of protection.

Sabro: Remeber one thing, this site is for protecting data. Not evading it, if your going to point out weaknesses in detail, then atleast try to help in fixing that.

Cheers.


//addon

The reason why im giving sabro a greenie here is, hes a total newbie to this site, so i think another chance should be given. In addition, i also see Sabro as a person who does posses some knowledge, wether this knowledge is desctructive or productive time will tell. Lets not judge by the person himself, but by the information provided by this person. If this person is destructive to the internet, then it does make him whatever you have named him. If his knowledge though helps the security communuty, then let this knowledge me welcome and helpful. Sabro, please Read the sites FAQ and the rules.

I keep reading many sites with new exploits all the time, its part of the information i need in order to secure a system. The easiness shown here by sabro just demonstrates the dangers that kazaa offers.

Cheers.

Well i think geepod Sabro doesn't mean that

Bat21, im not here to judge what sabro means, im here to see if the information provided by him us useful or not. I think it is useful, i mean, how would you fight back a problem that you dont know about? Some people here link to exploits on certain services and applications, sabro did not link to one, he actually posted it here. Where is the difference?

So if you would make a post saying "Windows XP has a flaw on this and that" and you would provide a link to the full story describing the problem, that would be ok then or not?

In order to secure a system, you need to know the weaknesses. Dont bitch at weaknesses presented to you first hand. Kazaa is so popular, that this problem must be made publice. Thanx to the information provided by sabro, a fix for it is only a matter of time.

Cheers.

Instronics,

I can understand your point of view, but the manor it was brought is asking to try his way to hack kazaa.
If he wanted to bring it in a security-related manor, he should have said :
" this is a possibility to hack Kazaa and/or Kazaa-users " or something like that...
and btw he promoted it due to he wrote this himself and quoting
himself as author (I'm not arguing on the authenticity), but I stick with my point of view,
he should have brought it to us otherwise...

Greetz,

Quote:

---

While this is a mild annoyance to the victim, and hardly constitutes
a security flaw, we have used this method to identify win boxes
running Kazaa, and vunerable to other attacks such as open or
weakly passworded shares, BO, Netbus, etc etc without having to first
scan the host to see if they have these services available.

---

Hmm....need I say more? Obviously this wasn't just to show us that Kazaa could be exploited to annoy a user, but a method of finding points of entery....Thus...not Apropriate, or atleast not in my eyes...

- Noia

I agree with you shrekkie about the way he has chosen his words. Indeed you are right, but i still think there should be a chance given to him, and not to neg the hell out of him. I mean its his second post here on AO. Let us show some understanding. Let him see the way we have reacted to his thread here, and give him the chance to make it up. Many of the people here on AO have evaded computer security at some point, their skill(z) prove that. I too have w00ted a service or 2 in my life (sorry dad :p ). The manner of his post was indeed wrong. Patience will show us what sabro can provide to the security community. Lets just wait and see.

Cheers.


//addon

Dear Noia, i do understand your point of view, aswell as shrekkies, and i respect it. But please, lets try to use the information provided to help fix this weaknes, and not to get a n00b banned from AO just yet. His next post should help to reveal his true intensions. Has anyone here yet considered looking for a work around to this problem?

Cheers everyone, and forgive me if my opinions are not the same as yours ;)

BTW this is old really old google for it. Ok a long shot what if he doesent know how to patch the vuln he posted info here regarding it maybe some one here could provide a explanation to prevent this or a patch instead of handing out negs do something constructive give suggestions on how to prevent it . I dont have the resources here to play around with it but i am sure some one does ;) and it does work im not sure if it only particular versions that is exploitable. Told you it was old
An advisory for a recent vuln 8/1/2003

I'm with instronics on this mather. When there's an exploit wich can be used for malicious things, why shouldn't it be posted on a security forum ? I think the security people of all internet folks should know first. Wether he's a newbie or wether it's about a subject people feel lame about (sub7, netbus, back orifice) we should know about it. I don't know with what intention Sabro posted, still I saw way to freaking many simple "bugtraq copies" on here turn beyond extremely positive, why should a copy from a newbie get the same ?
I think none of those plain copies should be rewarded, but yet they are, so this one deserves it as much as the others do. You'd better just sign up for bugtraq or the like, or maybe it should be put in those top rows on the mainpage...

Perception is everything, especially when reading posts that do not convey intent or tone very well. I for one welcome known exploits as long as they are posted in an ojective fashion, not something like, "L33t H4x0r attack on hotmail...". I feel, like others in this thread, that it is important to have members post known exploits with the caveat that it comes along with some type of suggested countermeasure.

That said, this is good post but it would be even better if they posted this additional info:

This exploit is rendered useless if the checkmark is removed from the setting that allows the client running Kazaa to funtion as a supernode. (which is true by the way).

--TH13

well it used to be much simpler, to where you would start downloading a file from someone on kazaa, then open dos and type netstat -a

which would return ports that had foreign addresses of :1214

then you could simply go to the web browser, put in the ip, with an appending :1214 and get the very same results as that one up there, however i do believe this was patched in versions ago of kazaa. I could be wrong, but this is a simple way to do it.

Quote:

---

Originally posted here by er0k
well it used to be much simpler, to where you would start downloading a file from someone on kazaa, then open dos and type netstat -a

which would return ports that had foreign addresses of :1214

then you could simply go to the web browser, put in the ip, with an appending :1214 and get the very same results as that one up there, however i do believe this was patched in versions ago of kazaa. I could be wrong, but this is a simple way to do it.

---

Yep it s patched!

****. Did ANYONE in here read the guy's website. It is obviously security focused and aimed at informing people about possible exploits.

I agree that the post could have been worded differently, but I think some of you were a little too quick to jump on him for this one. I know we're all supposed to be paranoid by nature and not give people the benefit of the doubt, but a few simple clicks and you can see what this poster's true intent was.

i would have to agree with bluebeard, thats why i didnt take part in the flaming but rather wanted to continue the discussion. However, i do believe it would have been better if he had posted a patch as well as the exploit instead of just the exploit, and maybe added some information about why he is posting this instead of just posting a random sploit on these boards..

What port does KaZaA run on?

depends on what you specify, when i used it, i had it running on 1214, but i know it can run on others

First and foremost, our intentions were not to promote actually attacking Kazaa users, just
as information since most Kazaa users feel they are anon due to the fact Kazaa doesn't
show the ip address in the client. We've found alot of hidden Kazaa users (non-irc'ers, etc)
that didn't even know people knew their machines existed and it was very easy to gain access to their machines thru misconfigurations, etc because they figured they was hidden.

Second of all we've found older Kazaa clients running on 1214/TCP, 80/TCP and various other ports and would suggest as a quick 'fix' that you upgrade to the lastest client.

The newer clients seems to only monitor 1214/UDP and will only open communications after receiving speically crafted packets, which tends to be alittle bit more technical and out of the
relm of your average script kiddes.

I see no problems with publishing how they did it. It's not the flaws you share, but what you do with that knowledge.

While posting a patch along with the problem would be nice, not everyone has the skills or the ability to create a patch for the problem.

This is nothing new and you really are displaying your ignorance by posting this.

It has been argued here on a few occasions if this is hacking or illegal and the concensus was it is not. The reason...Its nothing you couldn't get by using Kazaa itself only going threw more trouble to get it. Your only viewing what the user intends for you to see and the user name is given with each file kazaa finds.

Your use of NetCat shows a lack of knowledge in using it. Your using -t to make it emulate telnet when its not necessary and the entire process should be automated.

Because its not hacking or illegal ill show you.

you can either use a scanner that can output to a file or cut and past the results. heres the output from a simple scanner outputing to a file named c:\kazaa.txt.

Port# 80 on host xxx.149.251.12 is active
Port# 80 on host xxx.149.251.88 is active
Port# 80 on host xxx.149.251.85 is active
Port# 80 on host xxx.149.251.70 is active
Port# 80 on host xxx.149.251.94 is active
Port# 80 on host xxx.149.251.102 is active
Port# 80 on host xxx.149.251.26 is active
Port# 80 on host xxx.149.251.54 is active

or 1214 or both if you so desire

now open a command prompt. type the statement below all on one line and enter:

FOR /F "tokens=5" %X in (c:\kazaa.txt) DO echo GET /http1.0 \n\n |nc -vv %X 80 |more |find "Kazaa-IP" >>newport.txt

"tokens=5" says only use the fifth element in this line, and store it in %X


the output in newport.txt will look something like this

X-Kazaa-IP: xxx.149.251.71:2156
X-Kazaa-IP: xxx.175.243.233:2625
X-Kazaa-IP: xxx.149.251.88:3702
X-Kazaa-IP: xxx.149.251.12:1117
X-Kazaa-IP: xxx.143.174.72:2387
X-Kazaa-IP: xxx.149.251.146:3071

(remember the super node is still only just a user)

If you dont have a port scanner simply select an address range, say.. 202.11.21.0-202.11.21.255. now open a command prompt and type:

FOR /L %X in (2,1,254) DO echo GET /http1.0 \n\n |nc -vv 202.11.21.%X 80 |more |find "Kazaa-IP" >>newport.txt

this way will try to connect to every address in the range at port 80 and take much longer...but it works.

now you can have an entire list of address and ports you can waste your time looking for things that you could find much easier by using Kazaa itself.

oh by the way the above method requires an NT based system. if your using *nix you shouldn't have to be shown.

/me sniffs... well said tedob...

We've found tons of Kazaa clients not even using these ports, buttttttttttt we won't even
get in to subject of playing with portscanning ;) We'll continue to gain access you continue to surf.80 ..nuff said, sorry for the rest of ya =)

different ppl with different oppinions.. i am with instronics, coz now alot of ppl know that their kazaa isn't that safe.. but still, sabro should do something about how he/she present it in ao.

cheers again :)

i would just like to say that it seems there are varying oppinions on this matter, i would like to apologise to sabro for the way i jumped on him. in retrospect it was a bit harsh.

the information itself was useful and of course that is why we are all here, it was just the way it was interpreted that initially made me flame ! alot of these forum do spend too much time just dissing others instead of focusing on the information we are all after.

I for one am now going to make a concerted efoort to concentrate more on the content than the intent and give people a little more leeway, of course i dont want to see the usual crap about "how do you hack this etc" but will not be so quick to jump in future.

Again i apologise sabro and thanks for the info just present it a little differently next time.

live well and love life to all.

Oh contraire:

These are the IPs and ports from which the html listing of files that are shared can be viewed if the user is sharing any :

X-Kazaa-IP: xxx.149.251.71:2156
X-Kazaa-IP: xxx.175.243.233:2625
X-Kazaa-IP: xxx.149.251.88:3702
X-Kazaa-IP: xxx.149.251.12:1117
X-Kazaa-IP: xxx.143.174.72:2387
X-Kazaa-IP: xxx.149.251.146:3071

Hardly port 80. But on ports 80 or 1214 are kept the records as to which port a request must be made to.

I do agree with you that a list of kazaa user can be used for further exploitation. These are usually the most fool-hearted. Some using the same user name for everything.

Kazaa Lite is a sweet hacked version of Kazaa!

oooookkkk.....

Are we so bored that all we have to talk about is how to "hack" Kazaa? I mean get a life people and start posting about important stuff!

"Are we so bored that all we have to talk about is how to "hack" Kazaa? I mean get a life people and start posting about important stuff!"

Important stuff! You mean like this:

Unwritten AntiOnline rules:

http://www.antionline.com/showthread...309#post623309

"Some one negged me the other day and didn't give an explanation, how could they do that?"


Gotta love Google:

http://www.antionline.com/showthread...672#post629672

"Why is it that most of these posts in this thread arn't about Google?"


Hacking the Matrix:

http://www.antionline.com/showthread...886#post629654

I agree with melencholy about the negs because some 1 once negged me on a post that was not contraversial in any wayand didn't leve an explanation at all! The point of negs are to punish people for making incorrect or stupid posts. How can you learn from youre mistakes if you don't know what you did?

I'm a hacker, that's security, it's life. That's a very good post and I will try that and get back to you on if it works. If it does, then I'll tell you and you can figure out how to stop it, if not, your basically SOL. If all you can do is down other peoples post, you don't really deserve to be here, now do you.

That is all for now.