computer hacking

Hello,
I am enrolled in a college security class. We have a final lab competition in there. There are 2 teams againt each other and we have 12 hours to attack and 12 hours to defend ourselves. The server/client we need to attack are on the same network as ours, and have Windows 2000 Gold on them. The network is completely isolated from the school network and the outside world:) I am not aware on what software or anti virus stuff the other team has on. Does anyone have any ideas on how we can attack them? We need to either bring their server down, or even alter the data in the database, or anything like this. If anyone can help with ideas, I would really appreciate it.
Thanks a lot!

Install a hardware Keylogger on server PC (link before task starts - when people go on lunch or whatever access keylogger - get password format C:

if I was your lecturer I'd give extra credit for highlighting that physical security is just as (if not more) important than what software systems are running :)

v_Ln

Physical security is at the very least, just as important as, software security. No matter how much you lock anything down, it is worthless when you can just ask for a password :)

There is also a really good tutorial written by our very own MsMittens on wargames such as this. You might want to give it a read. You will find it in the security tutorials section of this site

Quote:

---

it is worthless when you can just ask for a password

---

Or threaten him/hold him up with a .9 for the password, ey? :D :p

Thanks for the feedback. I just found out that the other team will install Sygate firewall to protect themselves. What can we use to break into that?
We used Superscan to scan for open ports. Do you suggest something else?

You can use google to search for Sygate Vulnerabilities or any flaw's in the firewall, way's to bypass, etc etc.. Do you know the version of the firewall? That would help in your search. Gather as much information as possible about your target, then search for vuln's and exploit's for the software they use.

P.S: BTW, when you scanned for open port's, what did you get? *smacks forhead* that would help, knowing what they got open.

Ok, I will look for vulnerabilities on Google. I do not know what version of Sygate they use, of course they won't tell us :D When one of my teamates scaned for ports he got that they had 52 open ports; however, none of them was port23 (telnet).
Today we just have to turn in the attack plan in class. So besides tha firewall and the open ports, what else can we hit them with?

Well use what you've found in your port scan.

Quote:

---

however, none of them was port23 (telnet).

---

HAHA! The world does not revolve around telnet my friend. What you need to do is to take a look at what ports you found were open, lookup what services those ports were, then look up some exploits and vuln's for those services that you can use to gain access. 52 open ports, ey? Wow.. your bound to get in. I'd have a field day! :D

Anyways, your main objective right now is to jot down the services for the ports that are open. Find out what services are on them, then google some vulnerabilities and exploit's for that service. You could probably even search AO's database for some help as well.

Do you have physical access to the computers? If you do, then there's no need to find a sygate vulnerability. Just try what Val told u, install a keylogger. If possible, try STARR's Proctor spyprogram which offers a wide array of spy techniques and offers a completely invisible install. (The user will almost-never become aware of the program, unless you screw up somewhere).

I'd give Nessus and LanGuard a thought too.

One more thought: If you have a physical access to the PC, there's a whole lot of other ways to bring the server down: Propane, gasoline, matches, Spiked Baseball Bat, Flame Thrower, Screw driver, Pliers, Water, Or just plain old picking the PC up and walking out the door with it, could take care of the issue, But I doubt that'll get ya any credit. I'm guessing you have to get in remotely.

Quote:

---

Originally posted here by Cybr1d
Do you have physical access to the computers? If you do, then there's no need to find a sygate vulnerability. Just try what Val told u, install a keylogger. If possible, try STARR's Proctor spyprogram which offers a wide array of spy techniques and offers a completely invisible install. (The user will almost-never become aware of the program, unless you screw up somewhere).

I'd give Nessus and LanGuard a thought too.

---

Whoa, you have physical access to their comp? Teh **** yeh! Keylogger, wait, then use their password and format c:/. LOL :D I'm so fuqqin' stupid. Cybr1d I'ma look into that Proctor spyprogram, sounds interesting! :)

Quote:

---

If possible, try STARR's Proctor spyprogram which offers a wide array of spy techniques and offers a completely invisible install. (The user will almost-never become aware of the program, unless you screw up somewhere).

---

only problem with these types of programs is you ahve to be able to login to the PC with sufficent rights to install it - a hardware keylogger like i mentioned above just plugs in between the keyboard and the back of the PC - that way there is nothing needs installing - it just captures all traffic between the keyboard and the machine.

v_Ln

True Val :)...after they get the physical keylogger and get inside....STARR might get them the xtra passwords ;) perhaps for extra credit.

I have a copy of the program, I'll put it up in the FTP site later on tonight...and send you a link where u can download it.

Uhm, I'm hoping for me to possibly d/l as well? :D

Lol I was talking to you.

:), I have to apologize, Proctor is not its name, I actually was mixing two of them together. its iOpus STARR, which does what I mentioned before. Proctor is another one.

Quote:

---

Security Software Description:
All-round, award-winning Computer and Internet Monitoring software tool with Network and email tool. It allows companies and individuals to track the use of PCs easily and invisibly. It logs screenshots, keystrokes, user names, passwords, path names, access times, windows titles, BOTH sides of a CHAT conversation, AOL and visited websites. With Network (LAN) and email support.

---

Mine's a little out of date...but still does what it promises :). Here's an Update:


http://www.iopus.com/actmon/index.htm
http://www.iopus.com/download.htm
http://www.allthesoft.com/utility/se...r-pro-edition/

System Requirements:

Windows 98, ME, 2000, XP or Server 2003
32MB RAM
PC with 486 or higher processor
10 MB hard disk space


Talk about convenience ^

We may have physical access to the computers before the hacking day, ie, before they get their specific drives into the computers. We will not have physical access to them during the competition. We will try to put Keylogger on before that time.
Thanks a lot for your suggestions, they help a lot!!!

Let me know when you put STARR on the FTF later so I can dowload it.
No, we cannot run with the computer out of the room::)))

If it were me, and I wanted to keep in the true spirit of the game (no tempest etc) I would install a "vulnerable" server, and utilize a smidge of social engineering to lure the other team into pulling a trojan from my system, perhaps one that looks like a web application protection scheme module or some other security relevant module that they would want try and leverage more access from.

best of luck,

catch

Nmap is argueably the best scanner in the world, find a copy of that and give it a try. What other methods have you thought of to secure the machine? Be very alert with the other people, they may try a social engineering ploy to get something out of you, so don't talk to them about the project at ALL.

Do a Google or Yahoo! Search for social engineering and learn a bit about that. some people may say it's not real hacking, or no talent, but when you get good, you know it is. I specialise in operating systems and social engineering. Those are my strong points.

If you give me an OS and a computer to use it on I can usually have it figured out in a day, and then for the art of bullshitting, I am fairly good at that.

I'm no Kevin Mitnick, but I can hold my own in bullshitting.

Also, don't let anyone here tell you he is a lamer, he served his time for what he did and more, and has turned around, don't let people here tell you different. He is an awesome guy, and from what I understand very nice.

He has taken enough **** from others, he doesn't need it here too.

As for voulnerabilies, just look around online and see if you can find an exploits fo the software they use, and go from their.

Also;

I'd like to personally thank everyone in this thread for actually helping this dude. Any other time someone asks for help like this, it seems they get flamed and negged, which is bullshit. In My Linux + class I was asked to do a "Hack" so to speak.

I am also in charge of security in my school network now.

So I know now first hand, that teachers DO in fact ask sometimes for a hacking demo.

So now, I reward you all, with a green pat on the back.

I know away you can distroy there secutity get a trojan (rat) to delete the files you want to delete. first get a trojan with antivirus and firewall kill feature next send them the trojan server file binded with something then use trojan stealth tool (will work against antivirus detection). then change the icon of the file to look different send it to them (find out away to send it ).ounce they open the program their security will be disabled and their ip will be sent to you. use the ip to connect to the rat then delete lots of files and get out.

i hope that this helped :xbones:

yeah cause durring an exercise to test people's knowledge of security they are going to open a random attachment(!?)

Quote:

---

first get a trojan with antivirus and firewall kill feature

---

ok yes these features would be nice when trying to instal malware - esp in this case and the firewall will prevent connecting to your RAT but an AVP kill feature? hrm to in order for it to run and kill the AV it would....ummm correct me if am wrong here....but wouldn't it need to be ran?

now I must be extra special cause my AVP stops me from running any malware - i suppouse if active scanning was halted before hand then it could work - but of course people doing this kind of course are gonna have it disabled, just like they are goingto download unknown programs.

v_Ln

Quote:

---

before they get their specific drives into the computers. We will not have physical access to them during the competition. We will try to put Keylogger on before that time.

---

If there arent drives in the machine then you wont be able to put a keylogger (at least a software one) on. The keylogger unless memory resident will need to be on a harddisk. Although you might be able to write/ modify a memory resident virus / program that to log key strokes. There might be viri that already do this.

U could go for security though obsecurity on your box and get a bootable linux cd distro, boot that up theyll still be trying to run windows 2000 exploits agaisnt you when your actually running knoppix or something. There likely to only run a port scan once and ge the OS off that. if you give them some time to do this, then boot linux cd I doubt there gonna notice until they realise that your ttl values are different (If they know about that)

A hardware keylogger could be the way to go, there very simple to build your own. Its just getting the Data back, your could implement this using the MBUS/ FBUS on a mobile phone and a serial eeprom and PIC, maybe thats beyond you im not sure.

There is a way to modify the registry in windows 2000 that allows your box to be stealthed on a network, other computers cant see it, but it continues to have network connectivity. If anyone knows what this is can they let me know? I saw it first on astalavista.com about 1.5 - 2yrs ago and cant find it in searchs.

whats the network setup? it just a piece of crossover cable? hows the room laid out? you in 2 seperate rooms?

Theres not allot of point in putting trojans and stuff on there unless thats the main aim. Theres enough things in 2000 to use against them as it is...remote desktop, net messenger RPC and the list goes on,

Are the boxes updated/ patched? or a clean install?

(why is it that my schools years didnt have cool stuff like this?)

HTH

i2c

while everyones ideas seem to be in the right area I think if you only have to take out the server then you guys should wheel in a EMP (electro magnetic pulse) machine and start it up and blast em :D just a thought.... if that doesnt work make your way down to the electric box and flip the breaker.

Just a couple of thoughts for ya.

Spyrus: they wont be expecting that, I was gonna suggest bugging them so you could hear everything they say. I thought I was getting carried away then you suggested EMP!

i2c

Given you don't have access to the computer.... Social engineering would be most effective against a janitor or something after class... Just write up a fake note that says "permission to let so and so in at this and that time" with 2 random initials. Don't even try social engineering the other team or teacher, its a waste of time.

Don't forget dumpster diving! Steal the teachers garbage can... in class and office. Maybe their will be an outline of some sort for the other team!

if you don't have any of their suggestions, and if by chance you could switch the keyboards to
your own computer (that is, if your pc and theirs is near or in back to back location) then you could get their passwords as they logon by installing key logger to your own computer.. they would complain to their instructor that their keyboard is not functional or their computer hangs up, they might secretly go to their instructor coz they expect their computer was been attacked already as the cause of the hangup, then you can quickly switch back the keyboards... then there, you have their passwords on your computer... an idiot suggestion hehe but might work on to idiot users...

one trick i have found that works with both sygate and ZA is to set your source port as 53. They turn a blind eye to almost any packet with 53 as a source.

Quote:

---

Originally posted here by marginasc
Hello,
I am enrolled in a college security class. We have a final lab competition in there. There are 2 teams againt each other and we have 12 hours to attack and 12 hours to defend ourselves. The server/client we need to attack are on the same network as ours, and have Windows 2000 Gold on them. The network is completely isolated from the school network and the outside world:) I am not aware on what software or anti virus stuff the other team has on. Does anyone have any ideas on how we can attack them? We need to either bring their server down, or even alter the data in the database, or anything like this. If anyone can help with ideas, I would really appreciate it.
Thanks a lot!

---

Did professor X say Denial of Service attacks are out of the question & cannot be used?
On the defense side of things I would expect some type of Denial of Service attack....so many ways to create one, cutting someones cables,stealing the NIC, modem,creating sharp bends in coax will have a effect. Hell, even exposing and removing the sheild braid exposing the copper line or somthing you rigged for disturbance from RADIO SHACK that might slow or cut off the connection by remote. (making a jammer(3 in), 12Volt comes to mind) all those can be set off by remote.

Become and think like a Dedicated Educated Attacker, think and go outside the box. Use all possible options, the only boundaries here are set by professor X right?

We can use Denial of Services. Boundaries are set by the instructor.
The 2 teams will be in 2 separate rooms. I think the network is just a piece of a crossover cable.
Thank you for all your help!

so when is the "competition"? I am sure im not the only memeber ofthis comunity that is interested in hearing how things go.

The competition will probably come up in about 1-2 weeks. Today we need to turn in the attach and defense strategies.
Which firewall and antivirus software should we install? If possible, a free one:)
How can we change our port to port 53?
I will keep you posted to what's going on.
Thanks a lot!!!

I use Kerio Personal Firewall. Just search for some on google. There are many free ones.

For a firewall I would use Sygate Personal Firewall, it's free and if you add advanced rules to block all ports but the server you have to run then that should keep them out for a while.

http://www.simtel.net/product.downlo...s.php?id=53687

During the 12 hours when you are being attacked you might want to run ethereal and look at all the packets going by to see what they are doing and if they might have found a hole, you will have to play with ethereal a little before to get used to it, if you right click on a sespecious packet and hit follow TCP steam you will be able to see what data is in the packets.

http://www.ethereal.com/distribution/win32/

AVG antivirus is a free AV program that as far as I know is as good at stopping viruses as Norton or McAfee.

http://www.grisoft.com/us/us_dwnl_free.php

Hope this helps some.

BTW, what server does your instructor require you to run during the 12 hour defense part?

Maybe I am not thinking about this correctly , perhaps I have the wrong idea all together, couldn't you install cain and abel and perhaps ARP-poison them as well, redirect there attacks back at them? Or at least get some decent idea (without the use of ethereal) as to how they are attacking you?

Fifty-two ports open, but no Telnet...(Try SSH?)

Fifty-two ports sounds a little bit iffy, and suspicious in a war-game such as this. Sygate has never, for me, allowed a single port to appear to even EXIST.

If I were you, I might suspect a honeypot....so be careful.

Good-luck.

can any one help so that we do business the security here is not effective ...... ghana

What? That doesn't make any sense.