A challenge from my teacher.

I would like to ask some help from you fellows. I'm a very big begginer
but I would like to learn. So please teach me.

My cisco(CCNA) teacher challenged my class to hack into his laptop. The only
info he gave us was the name of that laptop wich was LAP01.

I know a little bit so I gave it a try. Pingin the subnet(10.108.5.X) with angry
ip scanner we where on I found no computer named LAP01. Then I simply
pinged for the name. wich gave me only one reply after that all went dead.
The ip was 10.108.5.11. Blindly trying stuff I used telnet on a number of ports
but all were refused.

Wanting to know a little more I downloaded NMAP and scanned with that.
Basic SYN stealth and everything else I used failed. My teacher informed me he
had set up a firewall. And after some discussing with other students I basicly gave up.

But the challenge is still on. I would like to know if there is a way to get
past that firewall. If there is please tell me how to figure it out and don't give me something like this: "Yust do ... and ... with the ... and your in."

Thanks in andvance.

Try reading sources of exploits or known default passwords and such. If this is a beginner class than the system will not be locked down. It has never in many of my beginner classes. It was always a known exploit or a default password we needed to use to get in. Did you try logging in as guest?

You can never do enough READING..

Sounds like a fun challange, but.....

Please read the postings and Welcome to Antionline tutorials. This is a community that is more deticated to the preservation of network security and not a place to learn to hack your teachers PC.

Sorry if that sounds blunt....but just giving you a heads up that you may receive more similar responses.

HAHA and the other question is this....why is you CISCO teacher asking you to hack his laptop???? Either hes confused on what hes teaching....or he may be demonstrating the use of ACCESS LISTS........on a serious note, he may be sitting behing a access list on another subnet...and that access list might be dropping packets such as your ICMP ping packets, as well as blocking telnet.

This is all hypothetical though, because we dont know if he is on a different subnet or not, and we need to know his LAPTOP operating system as well.....lots of variables come into play here.

Once again, dont mean to sound harsh, and welcome to AntiOnline, just want to get you started off on the right foot :-)

If you ever have a question feel free to ask.

Hi MoonWolf,

Quote:

---

and don't give me something like this: "Yust do ... and ... with the ... and your in."

---

You mean it is a bit like a math exam......................1 mark for the correct answer and 29 for showing how you worked it out? :)

Please tell me a bit more about the rules of the challenge...................are you allowed physical access to the machine..............obviously not to take it apart, or there wouldn't really be a challenge? What I am saying is does it have to be remote access only, or do you have access to the keyboard & mouse.....and can you use the floppy and CD drives?

ITG is onto something with the default passwords I think. You do not say what operating system you are using so I had better wait for your replies before I make a total idiot of myself?

Cheers

if it is a windows system, try using netbios:

net view LAP01 (if there are shares here, then you can use them to access a little piece of his hdd)

net use x: \\10.108.5.11\c$ /user:LAP01\administrator
( this one will work if the administrator pw is empty or <blank>)

The password is: "challenge1". Well that was easy :D. Anyways, on a serious note, please follow what nihil told you. Do you have physical access to the machine? Let us know and we'll be able to help you out on that. Just thought it was worth pasting this one:

Quote:

---

What AntiOnline IS:
AO is a worldwide community of security, network and computer professionals, students and keen amateurs who come here to learn the principles and details of computer/network security.
AO is a place where the community share their knowledge to help the others learn and where people assist each other with identifying and mitigating security issues as they pertain to the many real life situations faced by us all.


What AntiOnline is NOT:
AO is not a place where the community's knowledge is used or passed on to others in order to carry out illegal or immoral acts.
AO is not a place where you should be asking how to exploit/damage/attack any system that you do not own nor have the explicit permission of the legal owner.


What can you expect from AntiOnline:
You can expect to be treated in the same way you treat the AO community.
If you understand what AO is and is not, you can expect to be helped and to help others learn the art of computer/network security.

If you request information in a way that implies your intent is illegal or immoral you will receive a rapid response from the community that may ban you from continued participation.

Please feel free to look around but before you post a message please read the FAQ carefully. Many subjects have been covered on AO in it's years of operation and most of the discussions are still relevant today so please search before you ask.

Welcome again to AO and we hope your stay here is as fun for you as it is for our numerous members.

Gain access to all that AntiOnline has to offer:

- Access To Thousands Of Programs In Our Archives
- Access To Thousands Of Security Related Text Files
- Read And Post To All Major Security News Groups
- Interact With Thousands Of Other Security-Minded Individuals
- Customize AntiOnline To Suit Your Needs

---

Hope you get my point :)


Cheers,

I agree with Cybr1d

Hi guys,

Yes, you are absolutely correct about what "We" are all about...............and I admire the polite and restrained way in which you have expressed it.

However, I have a feeling about this one? What I see is a teacher trying to impress the class............HELL!!!...........that is guaranteed to get an "old trout" (steelhead) like me to rise to the bait :) ............done it enough with math teachers in my time.

He is asking to "cheat on his homework"...........well I guess I am a bit of a "cheat" at heart?

So long as it is not dangerous to the general public, and only lets him into the teacher's machine I am inclined to help.

Have I really been "socially engineered"?

I hope not

Cheers

Well :)...I dont believe that the teacher told them they couldnt use outside sources:). If he has to write a report, and quotes us...he might get extra credit.

Curiousity is blossoming! How far along in cisco are you?

You need to feed us some info for us to help you out and I don't think your teacher would be too upset for using all the resources available to you. Don't expect to be led through the whole process because you need to learn some this on your own. But maybe we can stimulate some thoughts.

Hopefully his challenge is class related, and at the risk of self-destruction, I would recommend that you focus on the different ways you can gain access to a router. Network, console port, and so forth, how would you do it, and what can you do once you get there? He nixed your telnet, but how about hyperterminal, tftp server, etc., you do have the IP and the Computer Name! I don't think he would slam the door on every port, and since you are on the same network, as simplistic as this may sound, you may even be able to walk right in with a browser.

So let us know.....

Good Luck

I'll bite.


Here is my analysis on the situation:

Teacher sets up laptop, firewall -> Block all incomming requests.
You attack - everything fails due to firewall dropping it.

Basically, the firewall setting has you screwed over; he expects to win. In this game with your teacher, he lulled you into a trap that you can't break. Why? His computer is probably set to ignore yours, and everyone else's. IPC (Windows/Network) shares will not work if that is true, nothing will since you are ignored and nothing can connect to him. It is almost like unplugging the computer you are attacking...and he has no services to attack. (at least on webservers, there is a web server service or server side programs you can try to attack) So, simply put, you will probably lose unless you bend the rules a lot, which will probably get you into trouble, so don't waste your time on it.


BTW, I think he is trying to show off... I haven't taken any Cisco courses (I think they want to train me to sell stuff for them) so I don't know what the circulum covers, so it may also be remotely possible he might share some insight into computer security from his own expirence?

I'm 17 years old live in holland and i'm following the sisco course at my school.
If you want to know more about cisco courses read this
cisco courses
The teacher in this case is a cool guy and I don't know why he asked
us to break into his laptop he yust did. Although it is like him to do a thing
like that. :D He's been challenging us all the time.

For instance the first thime we had him he introduced us to the concept
of Net Send, the basterd was sending net send bombs to our computers saying the first person to figure out wat those messeges were and how to stop them from popping up
on the computers could get another chance on one test if it wasn't above 70 %.
I know that doesn't look like much but thats I nice thing to have in your pocket.
After some nice searching on google I found the answer pretty fast. So next lesson I
bombed his computer with a vbs script I wrote around a netsend spoofer for the
windows command line. I still have that second chance in case I need it someday.

I yust rounded of the first semester wich is networking basics. And next monday
wich is the day I have my classes we are starting on semester 2. I know what this site
is all about but this isn't about breaking in he's trying to teach us something.(I hope) Everytime someone figures something like this out he makes them tell the whole class how they did it. I do think he made this a little more complicated though. And yes I can use outside resources. (If you don't know it yourself find someone who can teach you.)

And im an onhest guy im not socially engineering you(had to look that word up).
He will want me to tell how I figured this out to the class so if applicable credit goes to antionline and its members.

So here's all the info:( I hope )
I know the Name of the laptop wich is LAP01
I figured out the IP of the laptop wich is 10.108.5.11
We are on the subnet 10.108.5.X
I don't have physical access to the laptop.(It's on his desk but he won't allow us)
I gues his OS is Win2000. With a very good securety policy.
He's got a firewall, but don't ask me witch.
The firewall has been blocking my packets.(most of them anyway)

I have access to a computer with CD and disk drive and internet and windows
2000 without restricsions login in throug novell. The school supplied us a
portable hard disk on witch I have a windows 2000 advanced server and windows xp pro.

As far as myself. I know how to work with telnet( a bit ). NMAP, ipscanners, portscanners
programming in (basic), C, C++, vbs. I have basic networking knowlidge know how to do a search with google am willing(eager, dieing) to learn. And my english is crap.


Thats about it.(That took me longer than I thought it would)

Looks like you are goigng to have to try a little bit of social engineering yourself.
Does your prof connect to his laptop using the novell connection or does he log on locally?
Have you tried going up to him with a question when he is connected to the laptop. This might let you see some usefull information. Small things like the name of his user account. Is there any reconnisable icons for the fire wall. For example norton uses a small globe on the taskbar.
You may be able to confirm his operating system also like this.
Also this is probalbly not the first time he has given the challange.

Iwould also try a tracert on his computer name and his ip address. this will let you see if his laptop is on the same subnet.
any these are just a couple of quick thoughts that may help in the challenge.

I don’t know **** about hacking into computers But questions that came to mind:

Since this is a cisco class I think maybe Relyt might be on the right track.
How is the router administered? Does he access it from his laptop?
Did you find it in your scans?
Did he tell you the model router or would you have to fingerprint it?
Is the router doing any NAT to his computer ?
And where exactly is the firewall?

At the stage you are at would he reasonably expect you to set up a sniffer for passwords, etc?

Again as Info Tech Geek said I would be looking for use of default passwords here.

The point here might be to show that the routers need to be set up properly.

my 2 cents.

try this site for default passwords:
http://www.phenoelit.de/dpl/dpl.html

perhaps it can be of help...

I have an idea. Set up a trap for your teacher. Use Cain and Abel password recovery or LC4, and have it sniff the network. Go to class early and set everything up. After that, wait for your teacher to sign into his PC and hope it works. I'm not sure if a firewall would interrupt LC4 and Cain. Let me know if it doesn't work, i'll think of something else :).

1. Use the force.
2. Port scan.
3. Exploit Scan, mso's are still buggy on some 2000 p.cs
4. Search for c$ share if you ain't done so.
5. Look at major geeks for bootable CD with Sam password removal system.
6. Repeatedly kick this lecturer in the head if he wins this challenge.

Just a couple of suggestions....

Many personal firewalls now have an integrated IDS. If this is the case with his your port scans may be failing because the scan is to agressive. Try slowing the scan down to the slowest speed. Maybe you can sneak something through.

You could also try spoofing the IP address to make it look like the requests comming from your computer are comming from his. Here again most personal firewalls and IDS will detect this but he has probably left you a hole somewhere.

Good luck.

Here is what I would look at also (besides the other very good suggestions already posted)

Since this is a Cisco class, I assume your class is all connect via a router or switch? Have you tried telnetting to the router/switch, and from there, telnetting to the teachers laptop?

The firewall may be blocking all traffic except that originating from the router...

Just a thought

A few more thoughts...

Try searching for 'passive OS scanning' on Google. If your class is on a shared network i.e. a hub, you might be able to use a passive OS scanner to find more information about the operating system on his laptop.

Also, if you are all on the same subnet (10.108.5.x) then he is most likely using a personal firewall. You might look for vulnerabilities associated with these types of firewalls. Zone Alarm is a very popular and FREE personal firewall that has a few major bugs in past releases. A few other personal firewalls are Black Ice Defender, Tiny Firewall and the Microsoft Personal Firewall.

Keep in mind that the laptop is participating in some kind of netbios browser negotiations (unless a WINS server is present) otherwise you would not be able to resolve the name LAP01 to an IP address. I would definitely spend a fair amount of time looking around with the 'net' command at the DOS prompt. Also, if it is a W2K host, it might be listening for RDP connections on TCP port 3389. You can attempt a telnet connection to this port or use the MS Terminal Services client to make a connection to the host.

Lastly, do an 'arp -a' from the command prompt and check for another IP address that is sharing the same mac address as the 10.108.5.11 IP. He might have two IP addresses assigned to the same interface of the laptop. If so, his firewall might permit various types of connections to the other IP. Just a few thoughts. Hope it helps and good luck!

-Tom

Antionline is not for Hacking purpose... You may go to another forum which provide hacker information. there's web site which you can look for... just need some effort... "http://www.antionline.com/toplist.php?s=" here bunch of lists site.

I would just bust the firewall and go from there....

i agree wit c1bryd and i dont trust with your "****"
what class do you take ?
i hope not a joking class
ok

Well Small Big Mouth

All my friends tell me that... though its true GOOD THINGS COMES IN SMALLER PACKAGES... hehehe. Well MoonWolf a little bit of social engineering is not cheating... For the timebeing dont discuss it with your teacher... and accept your failure... then get hold of a trojan horse like "Tron" from www.xpaperx.com or RIP from www.riptrojan.da.ru and try to execute that trojan server.exe in your teachers lappy... how do you?... thats upto you... yes ofcourse if its a windows OS... thats where ur social engineering skill will be tested... then BOOM... put the ip in the client and connect.

Sorry fellas for sugesting this in here but i dont like to be mean cus if its concerned with computers then its all right discussing in here... dont know what the senious will feel or judge this post like but this is not hacking methodology i wanted to discuss rather i look it as a way things can be manipulated... if his teacher is cautious enough he wont suceed... sometimes i feel good knowledge can be obtained doing some very little unscrupulous activity... finally isnt it true that to Knowledge is bliss... whichever way it comes... good way or little roundabout way... doesnt matter... the main reason for me to post this reply is that i need him to get aware as well as his teacher to get aware of the reality...

You could try booting a live linux distro like Knoppix STD and use ettercap to sniff all his network traffic until you find something juicy.

If theres no traffic able to come into the laptop by means of a firewall, chances are there is no data that will go out so that you can sniff it.

I would still try and bust the firewall by means of ddos, just flood it until so much cpu power is taken up on the lappy to filter and drop packets, so that it either halts, or windows it forced to end the task.

Then go from there. Cuz if nothing can come in, then, well, your completely screwed.

Well, a good idea would be that trojan idea if used properly...first of all if he has an AV it will most likely detect this trojan, although if he doesn't you can set it to auto-start on a CD-ROM (don't know exactly how) then you pop in the CD while he isn't looking then when he isn't looking again take it back out then try to disable the firewall or install a keylogger might get something usefull out of it. The LC4 idea is really good as well as the idea to slow your port scanner speed down a bit. Look for some security bugs and pray that he hasn't already patched them :P Social Engineering would be your best bet. Can't think of any good ideas at the moment. How long does this challenge last?

Ok...

Here's a technique I use in school all the time. If I can't finish an assignment, I change the assignment. You might not be intended to infiltrate the box at all... the rules that are set up might be insanely paranoid. Maybe instead of writing the whitepaper on how you cracked it, write a whitepaper on how you couldn't. Try as many abstract techniques as you can, including telneting every port like you said you did (although that rarely does anything). Give a huge analysis on every technique you can think of to crack the box, and say what methods were taken to prevent it. Could be a better grade than what you would have gotten...?