odd finds

[kerbe]

I started a thread like this back when thebroken (before it be came the 1337 heaven it is now) first started out and it was pretty populaire. Anyways, on with the show; I know some of you are system administer or have had "access privlages" to private networks, post some of the interesting or unusual things your`ve found.

[TheCotMan]

I started a thread like this back when thebroken (before it be came the 1337 heaven it is now) first started out and it was pretty populaire. Anyways, on with the show; I know some of you are system administer or have had "access privlages" to private networks, post some of the interesting or unusual things your`ve found.

[joke]
I can think of 3 private networks and one, sort-of private network which I think are great!

There is the 192.168.x.y | {x,y are elements of Z where 0<= x <= 255, and 0<=y,=255}
and 172.168.x.y | {x,y are elements of Z where 0<= x <==31, and 0<=y,=255}
and 10.x.y.z | {x,y,z are elements of Z where 0<= x <= 255, 0<=y,=255, and 0<= z <= 255}

Another network which is sort of like a private network, but is really just a reserved range is:
127.x.y.z | {x,y,z are elements of Z where 0<= x <= 255, 0<=y,=255, and 0<= z <= 255}

I was really impressed with an IP (127.0.0.1) I found on this network. It had every single file I wanted on my machine! Very cool indeed.

When I hacked the127.0.0.1 machine, I found a machine just like my own machine. It was amazing! It was like the guy had the same exact users on his machine as me, and the same mounted volumes. Though it was tricky to look at some of the files as they appeared to have some sort of Double-XOR encoding (same 8 bit key) which took some time to figure out.

If you find you can ping my 127.0.0.1, stay away from it! It is all mine and you can't have it! It has my private data on it!
[/joke]

Joking aside, what do you mean by "private networks"? And what are you looking for in the way of "interesting things"?

[kerbe]

<sarcasm> o_OI hacked 127.0.0.1 once too, he likes to go by the handle "localhost" some times, he most of gotten to my system first since he also had the same files as me </sarcasm> ... Don`t look to far into it, like have you bee at school or work and explored an open file server and found something cool or unusual. Like funny pictures of other peoples family or something dumb yet, entertaining like that.

[TheCotMan]

<sarcasm> o_OI hacked 127.0.0.1 once too, he likes to go by the handle "localhost" some times, he most of gotten to my system first since he also had the same files as me </sarcasm> ... Don`t look to far into it, like have you bee at school or work and explored an open file server and found something cool or unusual. Like funny pictures of other peoples family or something dumb yet, entertaining like that.

Yes, the joke was funny, but what about my question? :

Joking aside, what do you mean by "private networks"? And what are you looking for in the way of "interesting things"?

With an understanding of what you want, someone might be able to better answer your question.

For example, are you looking for comments on odd traffic, results of honeypot tests, rogue users doing "bad" things, clueless users being trojaned with machine doing things they did not know their machines were doing?

And "private networks" can be ambiguous. Clarification may help you to get the answers you desire.

[kerbe]

Yes, the joke was funny, but what about my question? :



With an understanding of what you want, someone might be able to better answer your question.

For example, are you looking for comments on odd traffic, results of honeypot tests, rogue users doing "bad" things, clueless users being trojaned with machine doing things they did not know their machines were doing?

And "private networks" can be ambiguous. Clarification may help you to get the answers you desire.

Your really making me reach for this one. Well, its open ended; any thing form porno on the sex teacher computer to "rogue users" try to show off there skills by lunching DoS attacks on 255.255.255.0, just that its semi funny. Don`t think to far into it.... Hell even post some funny help desk calls if you might have resived.

[TheCotMan]

(Replying to myself so that my mistake is left for others to see...)

Sorry. I completely missed your example for each. :-/

I have some friends who ran windows NT 4.0 systems (years ago) who had open shares on their boxes. We shared an open-exchange with each other to target certain boxes we each had with whatever we wanted-- just so long as it did not lead to loss of data or DoS. We even went through the trouble of writing dated permission slips for each other just in case someone should change their mind later. (Dated, meaning they would expire at some future date.)

One of the more enjoyable things was using samba (then quite new) and the ability of samba tools to send winpopup messages to users of NT-class OS or users of Windows 9X/ME if they have winmesseging service running.

It was fun to send them messages like, "I like looking at naked ponies and to prove it, I will click OK." Of course, they would receive that message and an "OK" to dismiss it.

It was a great laugh -- especially when they were in earshot. They would yell my name with some explitives included and I would laugh.

Of course, they just turned off their messaging service after that or set up a network filter to limit their exposure on the Internet. Now there are spammers who will use this service to contact people. (Not nearly as common as web-browser based popups.)

As for work, we had a secretary who we thought liked to look at pornographic banner ads. Her supervisor received a report from our Networking/Telecommunications group that their NOC based network utilization system was reporting she was using about 5% (sustained) of our network throughput on our offsite link.

Her supervisor actually had a meeting with her and later found out it was unintentional. Her machine had some malware doing some evil deeds to generate money for some company.

[highwizard]

(Replying to myself so that my mistake is left for others to see...)

You replied to yourself once, and quoted yourself in a posting... You truly are a post-whore in the making. Congrats!

[TheCotMan]

You replied to yourself once, and quoted yourself in a posting... You truly are a post-whore in the making. Congrats!

In this case, I made an obvious mistake, and did not want to cover it up:
I asked the guy a question and did not have the decency to read that the user actually did answer it. Instead I assumed they only commented on the joke. I was lucky the guy did not flame me for such a mistake. (Thanks to kindness of this user, they let me get by.)

If I would have edited my post to cover it up, then there goes any reputation for not willing to admit fault in arguements and people would be suspect of any posts I had which were edited in a discussion.

So I had the choice:
Risk being called a post whore and being called inconsiderate for posting and then replying to my own post or
modfiy a message with risk of being labeled as a dishonest poster who will re-fabricate a post to break the chain pf events for a thread.

I'd rather be called a fool, post-whore, or a violator of manners than someone who can't be trusted because they alter their content to cover up mistakes like this. (I'll edit for spelling mistakes and grammatical errors, but to edit the above post in question would had far worse results.)

As for quantity of posts, I have tried to only offer posts which offer useful information. I try to avoid posting these simple one liners which:
flame people, do not seem to add content, and are generally useless.

As for posting a lot to these forums, I may be new to these forums, but I am not new to DC. Many would consider me a veteran after having attended DC5,6,7,8,9, and 10. I have visited these forums in years bfore, but never joined because I did not see any useful content; it was mostly about ego inflate this, ego deflate that-- there was little interesting content. This year, I decided to to try to offer content, and see if the idea caught-on. This is still an experiment in process. I'll give it two more months and see where it goes. :-)

OB Post: (Funny things seen on a network that were created by me)

Back around 1994-1995, I was heavily into using irc and learned about the irc protocols. Yes, I was one of those people who made "bots", and wrote them in ircii scripting language and used screen to keep them running.
I came across an idea to use ctcp messages to #channel names (instead of people) to send encoded messages. I tested overloading of ctcp messages and other protocols with encoded data. It seemed obvious that nobody could see what I was typing to any of the channels I frequented.
Next, I handed out copies of this code to a few friends to install on their ircii clients and we found we could encode messages, send them to the channel, and we were the only ones who could see them.
We had encoded data passing through channel data ignored by other clients. Very cool stuff.
However, after some time had passed, someone joined our channel and would be disconnected. When they returned, they said their client crashed. Eventually we made the correlation that these encoded messages seemed to be killing this macintosh irc client. I was not sure, so I visited the #mac on efnet, sent one message and one third of the client were disconnected. Bad news. :-/
I did admit to having done that, and asked where they got their clients, but was answered with a kickban. (rightfully so)
This is meant to illustrate two things:
When you are a newbie, attempting to overload existing protocols with things they were not designed is a very risky thing.
Don't assume programmers of projects have created exceptions handling or accounted for "bad data" when they wrote their code.

Eventually, the idea for the secret messages to channels was abandoned by me. I'm sure this has been done by people before me, and has been done since. It is not a new concept, and been around since before computers.

[highwizard]

<snip>

So I had the choice:
Risk being called a post whore and being called inconsiderate for posting and then replying to my own post....

<snip>

You speak of being a postwhore likes it's a bad thing.

It's a badge of honor, wear it with pride.

[KinoEye]

Being called anything _____whore is a badge of honor as far as I'm concerned.

[lil_freak]

Being called anything _____whore is a badge of honor as far as I'm concerned.

You may want to rethink that. I don't think being called a media or scene whore is a good thing, however I guess some people might consider being called one an honor.

[bascule]

You speak of being a postwhore likes it's a bad thing.

It's a badge of honor, wear it with pride.

postcount++?

Somehow that doesn't make me feel better

[TheCotMan]

postcount++?
Somehow that doesn't make me feel better

Ahh... that might be because you evaluated your happiness (feeling better) with the postcount having undergone a post-increment operation.

Would it make a difference if you used a preincrement operation so that the evaluation of postcount as an arg passed to the function for evaluation of your happiness, passed the increased value instead of the value before the increase?

Try ++postcount (preincrement of postcount). In many compilers, the resulting code can actually be more efficient (memory-wise and instruction wise) than the postcount++. I am not sure if this will have any effect on how it works for this forum though... ;-)


OB: (OBligitory post to topic)
Another thing on networks which I found funny...
Ages ago, I had a web server on a DSL link. The DSL link offered me 4 IP addresses as part of a Class-C sized subnet. There were other people on this subnet who also had 4 IP address blocks. Many would either go to their "network neighborhood" and do some browsing for open network shares within the shared subnet.
Broadcasts to the shared subnet were not blocked by the ISP at this time, and so most anyone running windows could see anyone else's computers (if they were advertised) when they were on. (This was also before the time when we had so many products that call themselves "firewalls" advertised and available for consumers.)
At this time, I was running Linux from home (120MHz Cyrix 586 / 16MB RAM, 2GB HD to give you a reference to timeline) as my gateway, filter, redirector, etc. Through this gatewaye/filter, I opened ports and layer3/4 redirects (so my logs show correct incoming IP addresses) to services which included: smb/nmb (samba), AppleShare/IP (netatalk), apache, ssh, etc.
Samba would tell me when people were connecting, and such things were logged and mailed to me as part of my normal admin work.
Even this early in the game, samba had some impressive features. I was able to configure the system to require authorization, and if the authorization was unsuccessful, I could offer them a "default share" for connection. My machine also advertised itself as things like "MS WIndows 1901 Advanced Server: Y2K complient!"
This caused people who looked for open windows boxes to find mine, and try connecting. They would think they had success because the share would actually map a network drive, or they would at least be able to double click to see the share.
In this share, I created a text file which had some very nice things to say to the people who happened to find it. Then, as part of samba, you could enable triggers based on people's browsing of your folders to trigger certain other events.
As a result, I set up a script to be called anytime anyone accessed this folder/share which was the default:
1) It would perform a netbios name lookup for the IP address which was connection
2) Use that name as part of a smbclient -L listing request for open shares.
3) The results of that were then stored (appended) in other text files in the default shared directory with the filenames being the IP address of the connecting parties.
4) A windows message would then be sent to the user (I knew most windows 95/98/ME users would not see it, but the occasional Windows NT user might) which told the user (in so many words) they should not be doing what they were doing.

Now, when future people came to find this share, their connections and open shares and IP address would be listed in a file named by their IP address and they would see other people's IP addresses with open shares.

Sure, it was childish, but it "seemed like a good idea at the time" and I only did it for about 1 year, but it was an enjoyable learning process to make it work. I eventually migrated to a home-built ssl-based cgi with 2 layer authentication for authorized users to dynamically add and remove filtering rules from the filter/gateway based on the services needed by the users. I still use this today, but have primarily moved to webdav over ssl for my users as it helps to eliminate the need for samba and netatalk to just apache.

It is really impressive what you can do with the software that is available. :-D

[KinoEye]

You may want to rethink that. I don't think being called a media or scene whore is a good thing, however I guess some people might consider being called one an honor.

Thank you for pointing that out. Believe it or not I actually forgot about the whole scenewhore thing.

Mediawhore I can deal with.

Scenewhore I cannot.

[Xodia]

So what would someone who is a whore and is posting a ton of retarded banter be called?

Banterwhore?