Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

S/party/hack like it's 1999

openwall.com

Post reply on HN
Print view View original

21–30 of 33 posts

Re: S/party/hack like it's 1999

#21

Post by rsync »

Early irc'ing involved simply typing:

NO CARRIER

or:

ATM0

... and watching 10-20-30 people suddenly disappear from the channel as their DOS based comm program passed them as commands directly to the modem.

Re: S/party/hack like it's 1999

#22

Post by chrishepner »

Mahn wrote: post #16

> You might be thinking "If I opened that in my browser, I would detect it being malicious!" Well, think again... One can have all sorts of fun with user-agents, something that can easily come to mind is verifying if the user-agent is from curl or wget, and make them download the malicious file, if not, redirect them to a legitimate file that looks like the original output. Your browser would fool you then. I can't d…

I wrote an mitmproxy script to do just this: https://github.com/chrishepner/sh-mitm

The kind of vulnerabilities that are basically just subverting a user's trust are totally fascinating to me.

Re: S/party/hack like it's 1999

#23

Post by arkaydee »

rsync wrote: post #21

Early irc'ing involved simply typing: NO CARRIER or: ATM0 ... and watching 10-20-30 people suddenly disappear from the channel as their DOS based comm program passed them as commands directly to the modem.

Sorry, it wasn't that easy.

ATM0 would just silence the speaker. What you want is:

+++ATH0

Wouldn't work on properly implemented modems, as the standard required a quarter (or possibly half) a second pause between the +++ escape, and the hayes command.

Now, you sending this to IRC wouldn't do much at all. What you would want to do was rather take a look at their IP address, and use the "ping -p" command, as that allows you to specify up to 16 bytes padding that will be echoed back. You would then encode +++ATH0 as the pattern, which would be sent back from them to you .. and if it was a silly modem, it would hang up.

Re: S/party/hack like it's 1999

#24

Post by simgidacav »

akkartik wrote: post #2

But it wouldn't fool any text editor, right? Or even less ?

Tried with vim, I see the escapes, cristal clear.

However, I honestly don't see why I should do something foolish as `curl | sh`, even though from time to time I see websites suggesting this crazy approach. The first thing I think of is "why should I give you control on my shell?".

…I guess, however, this is kind of a natural behavior for the user who doesn't know the shell-fu. I've seen a similar article once about Ubuntu Forums. Unfortunately I can't recall the URL.

Re: S/party/hack like it's 1999

#28

Post by PietdeVries »

rohansingh wrote: post #15

FTA: > Hint: > 'less' doesn't interpret escape sequences unless the -r switch is used, > so stop aliasing it to 'less -r' just because there's no colored output. Instead you can just use `less -R` which allows colored output but doesn't interpret any other escape sequences.

cat -v backdoor.sh also does the trick...

Re: S/party/hack like it's 1999

#30

Post by teh_klev »

zorked wrote: post #5

The ANSI driver that came with MS-DOS, ANSI.SYS, also allowed keys to be rebound to small macros. So you could TYPE (cat) a file and then later press a harmless key like D and ANSI.SYS could output something like whatever the DOS equivalent of "rm -fr /" was (probably DELTREE /Y C:\) as though it had come from your very keyboard. This was very common in the BBS era. Anti-virus software would usually detect those sequ…

   FORMAT C: /S /U
Good night boot disk.
Post reply on HN