Well, it's time for yet another installment in Virginia Tech
hacking. Yes, it's.... VTHACK #3!!!! Brought to you by the
Mad Hermit and crew. This time, we're going to focus on the OTHER
big network on campus: LocalNet. LocalNet (L-Net) has been around
for a much longer period of time, and as such has quite a few more
caves and back alleys to explore. Its main purpose is to connect
the faculty and grad students directly to mainframes, and thus
much of what is found when poking around are login prompts. An
aggrivating factor that has been added to this is the inclusion of
"Port Servers" (PS's). You know when you've hit a PS when L-Net
tells you you've connected, but no key that you press has any
effect. The purpose of a PS is to act as a deterrent to hackers.
It also might have the additional function of baud rate detection,
but though it sounds logical, we haven't found out for sure. We
must admit that it does protect. The best way to keep system
crashers away is not to tell them what they've found through simple
redialing. This is a lot like keeping party crashers away by
saying that there's a party going on at a certain place, but not
telling them who's invited or who's giving the bash. Effective for
the dim-witted, impatient, and amateur party crashers, but not for
others.
PS's sit and stare out at you until you start sending it
characters. If the first few aren't the specific ones it's looking
for, it will continue to gobble up everything else until you give
up and hang up. Typical PS "codes" are easy-to-remember sequences
like 'ZZ' or 'ASDF', and they then pass you on to the main login
prompt. These "codes" aren't like passwords, since the added
access they give you isn't worth beans unless you've got a line on
where to go from the login prompt. However, we here feel that
information like that is in fact "restricted" in that you are
gaining unauthorized additional access to systems. As such, we've
decided to leave the fun of figuring them out to those interested
in such weekend diversiions.
Before we give you what you're probably waiting for: neato
numbers to call on L-Net, we'd like to explain stuff. First, this
isn't a complete list, nor could it really be. L-Net addresses are
in Hexidecimal and range from 0000 to FFFF. That's 65536 different
possibilities. We only went through ten thousand of these, and are
only listing those that got any response. Second, L-Net addresses
may connect to any number of ports, but we haven't seen any more
than 4 or 5. Thus, the total possible connections assuming an
average of 2 ports per connection and an average of about 15
connections per thousand addresses comes to just under 2000.
Assuming this is correct (very doubtful), finding where these are
is quite a task. Third, and on the positive side, some connections
open up large worlds of access. These unpassworded gateways are
known as servers, and typically are DECservers. The biggest and
most notorious is listed at 0358 and can handle a max of 128 users.
You can use these servers to connect to multiple computers at once,
and have extensive help files telling you what to do. Fourth, and
also on the plus side, L-Net doesn't kick you off. Ever. Multiple
redialing is the name of the game, and listed below is a Red Ryder
script that works under version 9.4 that dials consecutive integers
at a rate of about 40 a minute. Fifth and finally, bum connections
don't just leave you in the cold. Hitting CONTROL-A twice pops you
immediately into local mode, where a STATUS tells you where you are
connected, and a "DONE X" will disconnect you from session number
X. Calling, by the way, is done by typing "CALL XXXX[,P]" where
XXXX is the hex address, and P is the optional port number, which
is seperated by a comma.
Red Ryder 9.4 Local-Net Scanner Script.
COPYINTO ~8,ENTER NUMBER TO START AT
(GET1)
QUERY1 ~1
EMPTY ~1
IF YES JUMPTO (GET1)
LET EQUAL `1,~1
LET EQUAL `3,`1
COPYINTO ~8,ENTER LENGTH OF SEARCH
(GET2)
QUERY1 ~2
EMPTY ~2
IF YES JUMPTO (GET2)
LET EQUAL `2,~2
ADD `3,`2
COPYINTO ~3,`3
SUBTRACT `1,1
(NEXT)
ADD `1,1
TEST `1=~3
IF YES JUMPTO (QUIT)
TYPE Call
TYPE `1
TYPE ^M
ALERT1 UNIT/JUMPTO (NEXT)
ALERT2 BUSY/JUMPTO (NEXT)
PANICAFTER 10
PROMPT CONNECTED
PAUSE
BELL
BELL
BELL
BELL
JUMPTO (QUIT)
(QUIT)
END
And here's what our illustrious, untiring crew have discovered:
Notes:
------
1) Node[20], popularly known as the Node Router, went out of
services shortly after VTHacker #2 was distributed. Apologies
are NOT extended to those who assumed that the list in VTHack2
was gospel. Things change all the time, and those things that
are especially good tend to go away. Apparently, number 40062
was used by CNS's chief diagnostician as a way to test the VA
Council of Higher Education's access to the Net and L-Net.
Poking around there was terminated, but our scan of L-Net turned
up another way in...
2) If you wondered why the Node Router was labelled "20" (really,
what happened to the other 19?), then this might clear things up.
The following connections were observed:
Node What
---- ----
0 Passworded
1 L-Net
3 the Net
5 Passworded
6 Passworded
9 Dead End
10 Dead End
12 L-Net
20 Restricted (*)
*) This did connect you to a really screwed up L-Net port, which
continually spewed out garbage and error messages, but we think
our poking around in it got it shut off, due to the incredible
quickness with which it was restricted (we were still on-line!)
3) Ah, what a joy it is to explore, and find a pristine cavern
laden with sweet delight, and a menu to boot! Well, what I'm
talking about is BAMBI and THUMPR, two side-by-side DECServers.
Calling the listed numbers with port 0 gets you BAMBI, and using
port 1 gets you THUMPR. In our experience, nobody has ever been
dumped for staying on too long, and though the computers you can
connect to aren't all that interesting (all Mechanical Engineering)
the services and privileges allowed to ordinary users is about
as generous as possible. The listings that follow are vebatim
text sent by the servers, and we think that you'll be able to
figure out what's going on.
DECserver 200 Terminal Server V2.0 (BL29) - LAT V5.1
AMDF Network - Server BAMBI
Please type HELP if you need assistance
Enter username> Jack Meoff
The online HELP facility allows you to access reference and tutorial information about the DECserver 200. Choose one of the following options:
o Enter TUTORIAL to see a succession of HELP frames with "getting
started" information on basic DECserver functions (for beginners)
o Enter HELP for full information on how to use the HELP facility
o Choose a HELP topic from the following list:
BACKWARDS FORWARDS RESUME
BROADCAST HELP SET
CONNECT LIST SHOW
DEFINE LOCK TEST
DISCONNECT LOGOUT
Topic? list
LIST
Use the LIST command to display information from the permanent database.
LIST option
The option value is a topic about which you need information.
Additional HELP is available for the LIST options:
PORTS SERVER SERVICES
LIST Subtopic? server
SHOW/LIST SERVER
Use the SHOW SERVER command to display information about the current
operational state of the server. Use LIST SERVER to show values for the
permanent server characteristics.
Command formats:
SHOW SERVER [CHARACTERISTICS]
[COUNTERS ]
[STATUS ]
[SUMMARY ]
LIST SERVER [CHARACTERISTICS]
[SUMMARY ]
The default option for SHOW/LIST SERVER is CHARACTERISTICS.
Additional help available for:
CHARACTERISTICS COUNTERS STATUS SUMMARY
SHOW/LIST SERVER Subtopic?
LIST Subtopic?
Topic? show
SHOW
Use SHOW commands to display current status or information from the server's
operational database.
SHOW option
The option value is the topic about which you need information.
Additional HELP is available for the SHOW options:
NODES PORTS QUEUE SERVER SERVICES SESSIONS USERS
SHOW Subtopic?
Topic?
Local> show server
DECserver 200 V2.0 BL29 LAT V5.1 ROM BL20 Uptime: 6 08:14:20
LOGGING INTO THE DECSERVER
To login to the DECserver you may be required by your server manager to enter a login password. If you are not required to do so, go on to the next screen. If you are, here are the steps to take to log in.
1 Press <RETURN> twice; a number sign (#) appears along with an audible "beep".
2 Enter the login password. (You get the password from your server manager.)
For example, to log in with the password A1B2C3...
<RETURN> <RETURN> enter <RETURN> twice
# A1B2C3 type the password (which is not echoed)
3 If you make a mistake, the prompt reappears (and the "beep") to let you try again. You have several chances to enter the correct password.
4 If you use a dial-in modem, you have 60 seconds to respond to the # prompt with the correct password. If you don't, the server disconnects your modem.
If you do not need to enter a login password, press <RETURN> twice to log into
your DECserver.
When you log in, an introductory line of text appears...
DECserver 200 Terminal Server V1.0 (BL20) - LAT V5.1
If your port does not have a permanent username defined, enter your name (1 to
16 keyboard characters) after the following text appears...
Please type HELP if you need assistance
Enter username>
The Local> prompt appears after you type your username.
If your port does have a permanent username, here's what you see...
Please type HELP if you need assistance
Local>
USING ONLINE HELP
Online help is documentation about DECserver commands that is
stored in server memory. You can see this documentation
interactively on your terminal while you are using the DECserver. The HELP command gives you access to online help. You
can use it in two ways:
You can type HELP at the Local> prompt...
Local> HELP
This generates a succession of HELP "frames", "menus", and prompts.
Frames are made up of the information that can fit on one or more
terminal screens. Menus are lists of topics you can choose from.
Alternatively, you can specify topics and subtopics when you
enter the HELP command. For example...
Local> HELP SET PORT
This command produces online documentation that describes the SET
PORT command.
SOME DEFINITIONS
The primary function of the DECserver is to allow you to connect to "services" offered on your network. A service can be a computer system that you can use just as though your terminal were attached directly to the system, or it can be a function offered by such a system. In addition, services can be set-up to
allow access to printers, dial-out modems, personal computers and terminal switches. To connect to a service, you only need to know the service name.
A "service node" is a computer system or server that offers services.
A "session" is a connection to a service. You can have one or more simultaneous sessions with one service, or more than one service. The connection you are using at any one time is called your "current session". Your other sessions are inactive, but can be resumed by using server commands or session switches.
"Service mode" is your environment when you interact with a service. For example, if the service is a computer system, your environment is the same as a terminal directly wired to the system. You can all use the system's commands and resources.
"Local mode" is your environment when you interact with the DECserver using commands entered at the Local> prompt.
CONNECTING TO A SERVICE
Use the local mode SHOW SERVICES command to display a list of services you can use.
Local> SHOW SERVICES
To connect to a service (establish a session with the service) enter the DECserver CONNECT command with the name of the service you want. For example, for a service called SALES, enter the following command:
Local> CONNECT SALES
This command places you in service mode in an active session with the service SALES.
RETURNING TO LOCAL MODE FROM A SERVICE SESSION
To return to local mode without ending your session, press <BREAK> or press your local switch character. Both these characters are, in effect, DECserver commands that instruct the server to go back to local mode.
The <BREAK> character must be set up to permit this (by default it is), and the local switch character must be defined (by default it is not).
Use the HELP command for more details on setting up the <BREAK> character and local switch character.
NOTE
Some modems interprets the <BREAK> character as a command to end
your dial-in connection. If you are using one of these modems,
do not use <BREAK> to return to local mode.
Your session, now inactive, is still your current session because
it is the session your were using most recently.
RESUMING YOUR SERVICE SESSION FROM LOCAL MODE
To resume your current session (and service mode) while your are in local mode, enter the DECserver RESUME command.
Local> RESUME
You go back to where you left off when before returning to local mode.
DISCONNECTING FROM A SERVICE
To end your current session while in service mode, use the command that terminates whatever process you are using. For example, you can terminate a session on a VAX/VMS system by typing the VMS LOGOUT command. Refer to the documentation for the service node that offers the service.
To end your current session while in local mode, enter the DECserver DISCONNECT command.
Local> DISCONNECT
You cannot resume a service session after you end the connection with DISCONNECT.
CONNECTING TO A SECOND SERVICE
The DECserver allows you to have several sessions at one time, to the same or to different services. To connect to a second (or subsequent) service, simply enter another CONNECT command from local mode, specifying the name of the service. For example, to connect to the service PRODUCTION, enter the following command:
Local> CONNECT PRODUCTION
To resume one of your non-current sessions, use the FORWARDS command to switch to your next session, or the BACKWARDS command to switch to your previous session. Alternatively, you can use the RESUME command and specify the session
number. You can find this number from the SHOW SESSIONS display:
Local> RESUME SESSION 2
To disconnect a particular session, use the DISCONNECT command and specify the session number. For example:
Local> DISCONNECT SESSION 1
LOGGING OUT OF THE DECSERVER
To logout from the DECserver, enter the DECserver LOGOUT command (in local mode).
Local> LOGOUT
LOGOUT disconnects all sessions. A DECserver message appears verifying the logout.
DCSSVX Unavailable VT CC DCSS VS2000 Ultrix 2.2/UNIX
DSW Unavailable VT CNS dataswitch
GOLEM Unavailable VT Mathematics VAXstation I VMS - Node
LAN Unavailable VT CNS LocalNet
MTHOPR Unavailable VT Mathematics VAXstation I VMS - Node
MTHSUN Unavailable VT Mathematics Sun 3/50 - MTHSUN
MTHUNH Unavailable VT Mathematics VS2000 Ultrix 2.2 - Node
MTHUNX Unavailable VT Mathematics VS2000 Ultrix 2.2 - Node
NFNITY Unavailable VT Mathematics VS2000 VMS - Node NFNITY
POPEYE Unavailable Systems Research Center VAX-11/785 SVR2/
QUANTM Unavailable VT Mathematics VS2000 Ultrix 2.2 - Node
VTAGE1 Unavailable Ag. Engineering MicroVAX II / MicroVMS V
VTCC1 6 Connected TechCluster - Node VTCC1
VTCPE1 Unavailable VT EE Department VS2000 Ultrix 2.2/UNIX
VTCPE2 Unavailable VT EE Department VS2000 Ultrix 2.2/UNIX
VTCPE3 Unavailable VT EE Department VS2000 Ultrix 2.2/UNIX
VTCPE4 Unavailable VT EE Department VS3200 Ultrix 2.2/UNIX
VTCS1 Unavailable Va Tech CS Lab: VMS Service
VTDAL3 Unavailable VT EE Department VS2000 Ultrix 2.0/UNIX
VTDAL4 Unavailable VT EE DAL VS3200 Ultrix 2.2/Unix
VTDAL5 Unavailable VT EE DAL VS3200 Ultrix 2.2/UNIX
VTDAL6 Unavailable VT EE DAL VS3200 Ultrix 2.2/Unix
VTHCL Unavailable Va Tech Human/Computer Interface Lab
VTMAP Unavailable CE-Geography SDA Lab -Node VTMAP - Micro
VTMATH Available TechCluster - Node VTCC1
VTMILO Unavailable Human/Computer Lab - VAXStation II
VTODIE Unavailable VT CS Department MicroVax 2000 Ultrix 2.0
VTSDA Unavailable Spatial Data Analysis Lab - Vax 11/785
VTUNIX Available VT CC VAX 11/785 Ultrix 2.2/UNIX
VTYR Unavailable VT Mathematics VS2000 VMS - Node VTYR
XPRT549 Unavailable Fifth floor printer
Local> show ports all
Port Access Status Local Services
1 Local Idle
2 Local Idle
3 Local Idle
4 Local Idle
5 Local Connected
6 Local Connected
7 Local Connected
8 Local Connected
9 Local Offline
10 Local Offline
11 Local Offline
12 Local Offline
13 Local Offline
14 Local Offline
15 Local Offline
16 Local Offline
17 Local Idle
18 Local Idle
19 Local Idle
20 Local Idle
21 Local Local mode
22 Local Idle
23 Local Idle
24 Local Idle
25 Local Offline
26 Local Offline
27 Local Offline
28 Local Offline
29 Local Offline
30 Local Offline
31 Local Offline
32 Local Offline
33 Local Idle
34 Local Connected
35 Local Idle
36 Local Idle
37 Local Idle
38 Local Idle
39 Local Idle
40 Local Idle
41 Local Offline
42 Local Offline
43 Local Offline
44 Local Offline
45 Local Offline
46 Local Offline
47 Local Offline
48 Local Offline
49 Local Idle
50 Local Idle
51 Local Idle
52 Local Idle
53 Local Idle
54 Local Idle
55 Local Idle
56 Local Idle
57 Local Offline
58 Local Offline
59 Local Offline
60 Local Offline
61 Local Offline
62 Local Offline
63 Local Offline
64 Local Offline
65 Local Idle
66 Local Idle
67 Local Connected
68 Local Idle
69 Local Idle
70 Local Idle
71 Local Idle
72 Local Idle
73 Local Offline
74 Local Offline
75 Local Offline
76 Local Offline
77 Local Offline
78 Local Offline
79 Local Offline
80 Local Offline
81 Local Idle
82 Local Idle
83 Local Idle
84 Local Idle
85 Local Idle
86 Local Idle
87 Local Idle
88 Local Idle
89 Local Offline
90 Local Offline
91 Local Offline
92 Local Offline
93 Local Offline
94 Local Offline
95 Local Offline
96 Local Offline
97 Local Idle
98 Local Idle
99 Local Idle
100 Local Idle
101 Local Idle
102 Local Idle
103 Local Idle
104 Local Idle
105 Local Offline
106 Local Offline
107 Local Offline
108 Local Offline
109 Local Offline
110 Local Offline
111 Local Offline
112 Local Offline
113 Local Idle
114 Local Idle
115 Local Idle
116 Local Idle
117 Local Idle
118 Local Idle
119 Local Idle
120 Local Idle
121 Local Offline
122 Local Offline
123 Local Offline
124 Local Offline
125 Local Offline
126 Local Offline
127 Local Offline
128 Local Offline
Enough stuff, huh? Well, we've got MORE news. If you're going to
poke around L-Net, the following numbers into L-Net have been known
to be dead (i.e. CONNECTED, but no response): 40499, 40507, 40482.
And here's an update on VTHack #2's list of Net numbers:
40600-40615 No Answer
40625-40656 Originate Only
40657 Not Accessable
40658 No Answer
40659-40686 Not a Dataline
40687 No Answer
40688-40690 Not Accessable
40691 1200 baud line
40692 No Answer
40693-40699 Not a Dataline
40700-40723 Connection Failed
40724 No Answer
40725-40799 VM/XA VT
40800-40817 VM/XA VT
40818-40833 Originate Only
40834-40837 Not Accessable
40838-40839 Originate Only
40840-40899 Not a Dataline
40900-40999 Not a Dataline
And what about the other 55 thousand L-Net addresses we didn't try?
Hey, why don't YOU try them, and then share the news...? We're
already moving on to brighter futures in hacking, so stay tuned on
your local BBS or pass-the-disk network for: VTHacker #4 - Viruses,
reader response, Telenet, and more updates on previous info...
