=*^*=*^*=*^--------------------------------^*=*^*=*^*= =*---------HOW TO DESTROY AN RBBS-PC SYSTEM---------*= =*----------PRESENTED BY PHREAK'S CABARET-----------*= =*^*=*^*=*^---------612 755 3432-----------^*=*^*=*^*= IN THE COURSE OF YOUR HACKING AND PHREAKING ACTIVITIES, YOU WILL RUN ACROSS A GEEK SYSOP OR TWO. IN THIS SERIES OF ARTICLES, I AM GOING TO DESCRIBE WAYS TO DESTROY THESE GEEK BOARDS. I WILL COVER MOST OF THE MAJOR BBS PROGRAMS IN THE COURSE OF THIS TUTORIAL SET. THIS ISSUE WILL DEAL WITH THE RBBS SYSTEM. BASIC SYSTEM FACTS : -------------------- HARDWARE : IBM-PC (OR XT) 2 DRIVES 128K OR MORE HAYES SMARTMODEM FILES : COMMENTS TO SYSOP STORED IN "COMMENTS" MESSAGES STORED IN "MESSAGES" HELP FILES : "HELP01" - "HELP07" DOWNLOAD DIRCTORIES : "DIR" - "DIR 99" (DIR CONTIANS LIST OF DIRECTORIES ON CPC 12.1C AND OVER. IN EARLIER VERSIONS, ALL FILES ARE CONTAINED HERE.) USER FILES (PASSWORDS, ETC) : "USERS" SYSTEM CONFIG FILE (SYSOP'S PASSWORD, ETC) : "RBBS-PC.DEF" BUG #1 : DOWNLOADING THE USER FILE ---------------------------------- VERSIONS THAT MAY BE ATTACKED THIS WAY : CPC 12.1C AND BEFORE. PROCEDURE : DOWNLOAD "USERS." READ PASSWORDS. HAVE PHUN. NOTE : LOOK FOR PASSWORDS MARKED "SYSOP". THESE PASSWORDS ON CPC 12.1F HAVE THE ABILITY TO DROP TO DOS. EXPLAINATION : -------------- IBM'S BASIC (BY MICROSOFT) IS A RATHER HIGH LEVEL BASIC, WITH MANY POWERFUL COMMANDS. PC DOS, HOWEVER, IS A RATHER IDIOT-PROOF DISK SYSTEM. THE PROBLEM LIES IN THE DIFFERENT WAYS DOS AND BASIC INTERPRET A STRING OF CHARACTERS. IN THE RBBS PROGRAM IS A LINE THAT SAYS : IF FN$ = USERS$ THEN 13520 FN$ IS THE NAME OF THE FILE YOU REQUESTED FOR DOWNLOAD. USER$ IS THE NAME OF THE USER FILE (USERS). 13520 IS THE LINE THAT PRINTS "FILE XXXX NOT FOUND. TYPE L FOR DIR" NOW THAT YOU KNOW HOW RBBS WAS MEANT TO TRAP HACKERS, IT IS EASY TO EXPLAIN THE FALACY OF IT'S WAYS. BASIC SAYS THAT "USERS" IS NOT EQUAL TO "USERS." (AND FOR GOOD REASON!!!). BUT PC DOS SAYS THAT "USERS" IS EQUAL TO "USERS.". SO YOU ARE ACCESSING THE SAME FILE, BUT UNDER 2 DIFFERENT NAMES. SINCE THE SYSTEM ONLY TRAPS ONE OF THEM, YOU CAN USE THE OTHER ONE AND GET THE SAME DATA. THIS PROBLEM IS WELL KNOWN AND MOST RBBS SYSTEMS HAVE BEEN FIXED TO AVOID THIS BUG. BUG #2 : DOWNLOADING THE SYSOP'S PASSWORD ----------------------------------------- VERSIONS ATTACKABLE : ANY RBBS UP TO VERSION 12.2, WHICH IS STILL IN TESTING BY TOM MACK. PROCEDURE : DOWNLOAD "RBBS-PC.DEFF" READ PASSWORD HAVE PHUN THE SYSOP'S PASSWORD IS CONTAINED IN A FILE CALLED "RBBS-PC.DEF". THERE IS A TRAP IN THE RBBS CODE TO PREVENT YOU FROM DOWNLOADING IT. BUT, HERE AGAIN, BASIC AND DOS ARE NOT IN AGREEMENT ABOUT THE EQUIVILANCE OF STRINGS. BASIC SAYS THAT "RBBS-PC.DEFF" <> "RBBS-PC. DEF" (AGAIN, RIGHTFULLY SO!!). BUT DOS TRUNCATES THE EXTRA CHARACTER, AND ALLOWS YOU TO GET THE SAME FILE UNDER THIS NAME. (NOTE THAT ANY CHARACTER WILL WORK AFTER THE "F" IN .DEF. SO IF THE SYSOP HAS FIXED THIS BUG, TRY ANOTHER CHARACTER. HE MIGHT HAVE BEEN TOO DUMB TO SET UP A LENGTH TEST AND JUST TRAPPED "RBBS-PC.DEFF"). THIS BUG, TOO, IS WELL KNOWN, AND MAY BE FIXED ON SOME BOARDS. BUG #3 : OVERLOADING THE USER FILE ---------------------------------- VERSIONS ATTACKABLE : ALL PROCEDURE : WRITE A PROGRAM THAT CALLS THE BOARD REPEATEDLY UNDER NEW NAMES EACH TIME. EXPLAINATION : -------------- THIS IS RATHER OBVIOUS. IF YOU KEEP FILLING UP THE USERLOG WITH BULLSHIT I.D.'S, YOU WILL CAUSE IT TO BECOME TOO LARGE, AND DOS WILL NOT ALLOW IT TO BE WRITTEN TO. THIS WILL CAUSE IT TO "FATAL ERROR" WHENEVER A CALLER LOGS ON. WELL, THAT ABOUT WRAPS IT UP FOR THIS TIME. NEXT TIME : HOW TO CRASH A NET-WORKS SYSTEM.