122 lines
7.0 KiB
Plaintext
122 lines
7.0 KiB
Plaintext
|
|
HACKING NOVELL
|
|
LOCAL AREA NETWORKS
|
|
|
|
Fairfax County, Virginia
|
|
|
|
Pale Rider
|
|
(C) 1991
|
|
|
|
|
|
I wanted to share the information about hacking Novell networks that I
|
|
have acquired. My knowledge comes from working for a company that
|
|
installed and maintained Novell networks and from using Novell networks
|
|
in High School.
|
|
|
|
|
|
There are two programs that I know of that are designed to get Novell
|
|
passwords: one is a TSR password snagger, and the other is a password
|
|
hacker.
|
|
|
|
1) The TSR password snagger is called GETIT.COM. It is available on
|
|
Solsbury Hill in the file THIEFNOV.ZIP or GETIT.ZIP. GETIT.COM
|
|
is a TSR that activates itself and records the keystrokes that are entered
|
|
after the Novell LOGIN.EXE program is executed. It writes a hidden-
|
|
system attribute file to the C: hard disk. This file can be viewed with the
|
|
Norton (or any other) hex editor. The program works well, but only
|
|
starts recording keystrokes after "LOGIN" is executed, so the command
|
|
line parameters (which are not entered after "LOGIN" is executed) will
|
|
not be recorded. This means that if the user specifies their username on
|
|
the command line (ie "LOGIN supervisor"<CR>), then the program will
|
|
only capture the password entered, not the name, since the name was
|
|
entered before GETIT.COM started recording the keystrokes. If someone
|
|
just types "LOGIN" and hits return, they are prompted for a username and
|
|
then their password, so both things will be snagged by GETIT.COM and
|
|
written to the file. The source code for the program is included in
|
|
getit.zip, which is in assembly language. There are three factors that
|
|
must be true for the program to work and be successful:
|
|
|
|
a) The workstation must have a local hard disk ("C:")
|
|
b) The workstation must boot locally and not from the fileserver
|
|
c) To match the password to a username, the workstation must
|
|
either:
|
|
1) Have users login with no login command line
|
|
parameters (by just typing "LOGIN") and then
|
|
entering both their username and password when
|
|
prompted for them
|
|
-- or --
|
|
2) Have users login with or without command line
|
|
parameters as long as you know who was
|
|
sitting there at the time, or if the same person
|
|
always uses that machine, since you will only
|
|
have a password in the file written to the hard
|
|
disk
|
|
|
|
|
|
2) The password hacker is called NETCRACK.ZIP and it is available on
|
|
Solsbury Hill. This program uses repeated calls to the NetWare variable
|
|
Verify_Password to try to hack out passwords. You just run the program
|
|
and it sits there and trying to get the password for the username you
|
|
entered. I assume that the workstation that is running this program does
|
|
not need to be logged in to the network under an account, but only needs
|
|
to have run IPX.COM and NETx.EXE so that it sees the fileserver, but
|
|
I am unsure. In some experiments with this program, I (with the help of
|
|
a cool teacher in whose room we ran it) created an account with the one
|
|
letter password "A". The program hacked it out in about 10 minutes.
|
|
When the password length was increased to two letters, it took about 30
|
|
minutes. We then tried to run the program to hack out the password of
|
|
one of my friends, whose password was 5 letters long. We hacked for
|
|
the password on an IBM PS/2 Model 80 386/20 for an entire weekend.
|
|
We finally had to quit after something like 65 hours of hacking, still
|
|
without the password. This program obviously works, but requires a
|
|
*LONG* time. Perhaps you could whip out a pocket-Cray supercomputer
|
|
and hook it up to the network and hack out passwords, but otherwise the
|
|
program is not very ideal for subtle operation. While the program is
|
|
attempting to hack a password, it displays a message on the screen that
|
|
"This computer is trying to find the password of <user>." Perhaps the
|
|
message could be doctored up with a hexadecimal editor, of you may
|
|
want to turn the monitor off and put an "out o' order" sign on the
|
|
workstation...
|
|
|
|
3) The third way to get Novell passwords is a program I wrote myself
|
|
in Turbo Pascal 5.5. It is a fake login screen that works specifically at
|
|
my High School. All the Novell networks have an IBM menu overlay
|
|
program running on them called ICLAS. This ICLAS program is
|
|
apparently a universal thing throughout the High Schools in Fairfax
|
|
County (Don't now about elsewhere). It is an education classroom
|
|
management thing that everyone uses to log in, run programs, and log out
|
|
through. It is only an overlay however, so it still invokes the Novell
|
|
programs LOGIN.EXE, LOGOUT.EXE, and SETPASS.EXE to do its
|
|
stuff. The snagger that I developed is run from a batch file that says to
|
|
run my program and then run the real program. My program shows an
|
|
opening screen that looks just like the real opening screen. When <CR>
|
|
is pressed to continue, it then shows a screen that looks just like the real
|
|
second screen that asks for the username and then a password. After all
|
|
the information is entered, instead of logging the person in, my program
|
|
beeps and returns the exact error message that is given by Novell when
|
|
an incorrect password is entered. My program then ends, and the real
|
|
ICLAS program is run through the batch file. Since the error message
|
|
that my program gives the user is the same as the one that is given when
|
|
the wrong password is entered, and since the real program is loaded after
|
|
mine just as ICLAS would reset itself after the incorrect password error,
|
|
the person (or the baffled teacher) just figures that they mistyped their
|
|
password. My program then writes the date, time, fileserver, username,
|
|
and password to a file on the local hard drive of the workstation. I have
|
|
made it work, and have snagged about 50 accounts with usernames and
|
|
passwords, including the one for the supervisor. Once I had the
|
|
supervisor password, I realized that my computer teacher had a backup
|
|
supervisor security level account on every single fileserver in the whole
|
|
school, since he is the only one who can handle any of the computer stuff
|
|
at school (pretty sad...). I therefore had supervisor access (through this
|
|
back door account of his) to every file server in the school since he used
|
|
the same name and password on every one.
|
|
|
|
After attaining supervisor access, it was more of a challenge to clean up
|
|
the networky and keep it running (since the teachers can't) than to mess
|
|
things up and delete stuff. It is uncool to delete and damage stuff, incase
|
|
anyone is tempted. It should be seen as an excellent opportunity to learn
|
|
more about Novell.
|
|
|
|
Party on...
|
|
|
|
Pale Rider |