lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050721093512.6FCF93BC23A@kyle.spoiled.org> Date: Thu Jul 21 10:35:19 2005 From: vh at thc.org (vh) Subject: RE: thctest (official response :-) Hi folks, here is some official response to the hack, or rather "hack" ... kudos to netsniper (or better: PHC) who really fooled us with this trick of a partial real and partial fake hack - it took us a day to figure things out :-) To clear things up: (1) The file thc-pwn3d.rar in alt.binaries.warez.quebec-hackers really contains password protected data from our web site, from our http://www.thc.org/root/tmp CMS directory to be specific. The bug was in our .htaccess file, which contained the following entry: <limit GET> require valid-user </limit> As netsniper found by testing, POST requests were therefore not protected with a password ... We use this directory to share stuff with friends from teso, phenoelite etc. hence its no secret stuff. Lots of photographs from events can be found on our web page without password protection. Note: not all people wearing a THC shirt there are from THC. This year we gave our t-shirt also to all our friends, fans and groupies :-) (2) The passwd and hosts file - clever trick. The PHC guys had legitimate accounts on the old segfault box about 1 1/2 years ago. From that time are these old files, directly copied because they were allowed to. proof: take the /etc/hosts entry for www.thc.org: 62.67.59.35 www.thc.org this is old, old, old. try it yourself, thc.org is now: Name: www.thc.org Address: 82.165.25.125 Also the passwd file is way old, however this is something someone without access to the box can not verify :-) (3) The phrack articles allegedly stolen from www.phrack.org (hosted on the same box as www.thc.org): Some months ago PHC disgused themselve on irc in the #phrack channel as editors and tricked two authors to send them their articles. Clever. Both texts are NOT articles in the phrack magazine to be published. As the hardcopy edition (to be given out for free on What-The-Hack) is already printed, no way to make something up here. In conclusion: one config mistake by us which was hard to find - congrats here - combined with information obtained otherwise (I like the social engineering trick for the phrack submissions) to fool everyone including us that www.thc.org was hacked. Neat. Last: Netsniper was hacking directly from his Ubuntu Linux 1.0.4 machine. And I thought real hackers only use Gentoo, Debian or SuSE, and prefer hacking with bouncers in between *g* Cheers, van Hauser / THC -----Original Message----- Date: Wed, 20 Jul 2005 02:37:25 -0400 From: netsniper <netsniper@...l.ru> To: full-disclosure@...ts.grok.org.uk Subject: [Full-disclosure] thctest I had some fun with The Hacker's Choice website and thought some of you may want to learn from their lack of proper security. THC.org hosts project files, source code, and many other things. It also includes pictures of members and CCC friends, some that seem to request anonymity from public. Anyways, here are segfault's passwd and hosts files. I'll leave it up to you to determine if they are legit. I have no idea... passwd: root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/dev/null bin:x:2:2:bin:/bin:/dev/null sys:x:3:3:sys:/dev:/dev/null sync:x:4:100:sync:/bin:/bin/sync games:x:5:100:games:/usr/games:/dev/null man:x:6:100:man:/var/cache/man:/dev/null lp:x:7:7:lp:/var/spool/lpd:/dev/null mail:x:8:8:mail:/var/spool/mail:/dev/null news:x:9:9:news:/var/spool/news:/dev/null uucp:x:10:10:uucp:/var/spool/uucp:/dev/null proxy:x:13:13:proxy:/bin:/dev/null alias:x:14:12::/var/qmail/alias:/bin/true qmaild:x:15:12::/var/qmail:/bin/true qmaill:x:16:12::/var/qmail:/bin/true qmailp:x:17:12::/var/qmail:/bin/true qmailq:x:18:11::/var/qmail:/bin/true qmailr:x:19:11::/var/qmail:/bin/true qmails:x:20:11::/var/qmail:/bin/true lists:x:30:30::/home/crew/lists:/bin/bash postgres:x:31:32:postgres:/usr/local/pgsql:/dev/null www-data:x:33:33:www-data:/var/www:/bin/sh sshd:x:34:34:sshd:/var/empty:/dev/null mysqladm:x:36:36:database:/home/nobody:/dev/null ircd:x:39:39:ircd:/home/nobody:/dev/null phrackwww:x:40:40:phrackwww:/dev/null:/dev/null dnslog:x:62:62:dnslog:/home/nobody:/dev/null tinydnszone:x:63:63:tunydnszone:/etc/tinydns:/bin/chroot_bash tinydnsaxfr:x:64:64:tinydnsaxfr:/etc/djbdns:/bin/chroot_bash who:x:74:74:who:/home/nobody:/dev/null named:x:76:76:named:/dev/null:/dev/null lastword:x:77:77:lastword:/home/nobody:/dev/null tinydns:x:78:78:tinydns:/nonexistend:/dev/null namedop:x:89:89:named operator:/home/someone:/bin/bash crewuser:x:101:101:crew:/home/nobody:/dev/null cvs:x:85:85:cvs:/home/cvs:/dev/null ircs:x:86:86:ircs:/dev/null:/dev/null dnscache:x:90:90:dnscache:/nonexistend:/dev/null nobody:x:65534:65534:nobody:/home/nobody:/bin/sh pauthor:x:500:11:author.phrack.org:/var/qmail/alias/author.phrack.org:/nonexistend phrack:x:501:11:phrack.org:/var/qmail/alias/phrack.org:/nonexistend thccvs:x:800:800:thc,,,:/home/noshell/thccvs:/bin/chroot_cvssh vhcvs:x:801:800:van Hausercvs,,,:/home/noshell/vhcvs:/bin/chroot_cvssh tickcvs:x:802:800:tickcvs,,,:/home/noshell/tickcvs:/bin/chroot_cvssh dhcvs:x:803:800:doc holidaycvs,,,:/home/noshell/dhcvs:/bin/chroot_cvssh phrackcvs:x:804:804:phrackcvs:/home/noshell/phrackcvs:/bin/chroot_cvssh tesocvs:x:850:850:tesocvs,,,:/home/noshell/tesocvs:/bin/chroot_cvssh hertcvs:x:851:851:hertcvs:/home/noshell/hertcvs:/bin/chroot_cvssh tesocron:x:900:850:tesocron,,,:/home/nobody:/bin/sh thcadmin:x:901:901:THC Admin:/home/thc/thcadmin:/bin/bash thcdb:x:902:902:THC DB:/home/thc/thcdb:/bin/bash skyper:x:1000:1000:skyper,,,:/home/crew/skyper:/bin/bash gamma:x:1001:1001:gamma,,,:/home/crew/gamma:/bin/bash vax:x:1002:1002:vax,,,:/home/vax:/bin/bash muskrat:x:1005:1005:muskrat,,,:/home/crew/muskrat:/bin/bash rpunk:x:1006:1006:rpunk,,,:/home/rpunk:/bin/bash oxigen:x:1007:1007:oxigen,,,:/home/oxigen:/bin/bash andi:x:1009:1009:andi,,,:/home/andi:/bin/bash rm:x:1010:1010:Richard Miller,,,:/home/rm:/bin/bash helferlein:x:1013:1013:helferlein,,,:/home/chrooted/helferlein:/bin/chroot_bash typo:x:1014:1014:typo,,,:/home/typo:/bin/bash plasmoid:x:1016:1016:plasmoid,,,:/home/thc/plasmoid:/bin/bash pimmel:x:1016:11:pimmel.com:/var/qmail/alias/pimmel.com:/nonexistend wilkins:x:1018:1018:wilkins,,,:/home/thc/wilkins:/bin/bash thcwww:x:1020:1020:thcwww,,,:/home/thc/thcwww:/bin/bash stealth:x:1021:1021:stealth,,,:/home/stealth:/bin/bash hendy:x:1022:1022:hendy,,,:/home/hendy:/bin/bash jobe:x:1023:1023:jobe,,,:/home/jobe:/bin/bash caddis:x:1024:1024:caddis,,,:/home/caddis:/bin/bash mgma:x:1004:1004:gamma,,,:/home/mgma:/bin/bash scut:x:1025:1025:scut,,,:/home/scut:/bin/bash palmers:x:1026:1026:palmers,,,:/home/palmers:/bin/bash owen:x:1027:1027:owen,,,:/home/owen:/bin/bash lorian:x:1011:1011:lorian,,,:/home/lorian:/bin/bash paul:x:1029:1029:paul,,,:/home/paul:/bin/bash edi:x:1030:1030:edi,,,:/home/edi:/bin/bash zip:x:1031:1031:zip,,,:/home/zip:/bin/bash thok:x:1032:1032:thok,,,:/home/thok:/bin/bash tmogg:x:1034:1034:tmogg,,,:/home/tmogg:/bin/bash duke:x:1036:1036::/home/duke:/bin/bash gaius:x:1037:1037:gaius,,,:/home/gaius:/bin/bash ultor:x:1038:1038::/home/ultor:/bin/bash grugq:x:1039:1039::/home/grugq:/bin/bash rd:x:1040:1040::/home/thc/rd:/bin/bash random:x:1041:1041:random,,,:/home/random:/bin/bash jc:x:1042:1042:jc,,,:/home/jc:/bin/bash mayhem:x:1043:1043:,,,:/home/mayhem:/bin/bash bbp:x:1044:1044:,,,:/home/bbp:/bin/bash dvorak:x:1045:1045:,,,:/home/dvorak:/bin/bash disque:x:1046:1046:,,,:/home/disque:/bin/bash whyking:x:1047:1047:,,,:/home/thc/whyking:/bin/bash vh:x:1049:1049:,,,:/home/thc/vh:/bin/bash nil:x:1050:1050:,,,:/home/thc/nil:/bin/bash hosts: 127.0.0.1 localhost 213.131.229.154 segfault 10.1.1.1 wu.sec wu 62.67.59.35 www.thc.org I also ripped some nice stuff from the site, rarred it up, and posted it on alt.binaries.warez.quebec-hackers if you take a look. Nothing special, but just for fun :-) This hack was pretty lame, seriously...read the nfo netsniper _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists