Ŀ
 Presents
  ڿĴ VMag, Issue 3, 1 January 1999
  

  http://merlin.itep.ru

(c) Stepan Trubachev

   y p⢮ p   p p

   ppy IP-,  p室 y  p 
᭮ 쭮      ⥪  祭     p.
       짮⥫     ⥬    ,   
⠨⢥ 堪p ᯮᮡ, pp, 室  py  
p  "" y  p,  뢠 y  p .
 짮⥫ p  pᮢ  .
   p  ...
   p 쭮       y py,  񭭮y 
p,        y  ⨯:   y諥    ᮢp
py⨢  ⢨  p⨢  p  p   (pp,   p
"yp" 設y)     yp p.    ⥭樠
᭮  p p樮 ⥬ p.
   Hᬮp   ᠫ쭮   p Windows NT p樮
⥬ Unix   p  ⠭p⮬   p.  p⭮,  
易  ⥬,  Unix 砫쭮 p⠭  py     .
H   p⠢   Linux        ⥢      (pp
p⠢  p  ) ftpd,  httpd, named, telnetd  ..
H稥  ⠭p pᮢ 쭮   p 
p筮 TCP/IP  ⥪.  ⮬y    p室 y,    
  ⮬,   堪p yp   -pp.
    p稭     y梨 ⥬   ⠪,
,   p,  堫⭮ pp. ⫨⥫쭮 ᮡ
Linux    y  ⢠  ᯫ  y⨫  pp
稥    p    ᭮     ᮫⭮ p
ᮢ  ⨯  "py p p sendmail.     p
室    ᢥ".  ⢥ pp ⠪ pp
  p,  pp,  y SATAN  (Security Administrator's
Tool for  Analyzing Networks).  p ⮣,  p   py
p        p᪨ p   pﬨ,
⮬y  ⮫쪮         ᮡ⢥  py  y   
ppy  Linux-pp     ᥡ      p.   
 p᪨ pᨩ UNIX,  p, ⥫쭮 ᫥ 
⮢⥫.
   p     p  짮⥫ py⮢ M$.    
p  yp p   Windows py⥫쭮,    ᪫祭
 ᯮ짮  py BackOrifice.   py,
짮⥫ p ﭭ "ᠭ" p,      ⮦ 
᫨誮 p⭮,   ⮬y  p p  , , py襭
pᯮᮡ p樮 ⥬.  p祬,    p騩
祫  p  ⢥⢥   p樮 ⥬,  p 
p樯    ᯮᮡ   襥,  祬    p   py襪,
⭮  設    yp :)?   饭 p樨
맢,   筮,    yp筮  TCP/IP  ⥪  Windows,    
y ,    ᫥⢨,  p樯쭮 ᯮᮡ p樮
⥬  ⮣    p쭮  p⠢ p樮 pyp  
.    y  ⥪  py y⢨    ⠭p⭮
⠢ ⥢    p p祭 p  ᪨ y⨫
(host,  nslookup,  talk    ..)    yy  p  ⢮
pp    ᠬ  p  p  ᯮy 訡    ⥪
p⮪  ⮢  MicroSoft    ᯮᮡ  "yp"  Windows...
y  yyy y  yp ᪨  Windows    
᫨誮 p冷  ⮢⥫  p樮 ⥬ (.
    p樨  MS      BackOrifice).   ⮬y,  ⥫
"p祪",  騬  ᥡ   pp  p  
y⭨      쭮  ,   py  ᫥      砬
騬 p᪨  www.microsoft.com,      y砥 쭮
,  祭    p  y  p᪮襫    -y
p py p쥣 p⥫,  pp, Firewall-1 
CheckPoint.  p⨢ y砥, p y  ⮫쪮   p,
    IP       py  y-y ppy ⥫
  p᪨ .
    p,  ᫨  p ᭮   Unix  -    p
䨤樠쭮 p樨,   p ᭮  Windows - 
p pᯮᮡ ⮩ p樮 ⥬.
   H  y  ᪠ ᪮쪮 ᫮   񭭮   OS/2.
  p室 p   p   OS/2, ᬮp
  稥    TCP/IP-⥪ 筮  p ⥢ .
H  y  ⠪   p묨 y⨫⪠.  p ᥣ,
p稭y ᫥y ᪠  ⮬,  OS/2,  ⫨稥  Linux, p᪠
⥬,  ,     p,  IBM ⥫쭮  ⢥⢥,  祬,
pp,  MicroSoft ⭮   y p   py⮢.  
 ⭮  ⥪ TCP/IP 4.1 y  ᭮
⮫쪮 yy訫 -   p   ⥪ firewall,  telnetd ⠫
짮⥫᪨  ..  p p⨥ ᭮ p
OS/2      p            ppp   
y祭   ⥪ y諥.  p ⥬    pᬮp
p  ⠪,  ᯮ ᭮ p,  ⥬     p
易  ᭮  IP-:

   proxy -  pp-p, .. pp, 뫠  ᢮ 
     py ⮢.  p 뢠 p ⨯:
yp p -  http,  ftp,  pᯮp⭮ yp TCP/UDP - socks 
p py.
   router (  ppy⨧p,   pyp, p  - gateway)
- pp       ᯥ稢騥  ppy⨧  ⮢  y
p䥩ᠬ   p
   firewall  (    pyp)  -  ⢥ p,  p
y      p,   y,  p⥫쭮,  ⠪:  "⥬,
p稢 y        pyy".      p
,  pp,    pyp    p묨 p  y,
p騩     離     p-pp.     p  뢠
pyp ⮫쪮 ᯥ樠p pp .

   p  ⠪:

   IP spoofing

   y䨭 뢠  p p⥫   IP-
  楫  p  y⥭䨪,  ᭮y   p IP-p
筨 . Hᬮp  ,  ⢥    p
  ⠪y饬y,  y䨭  y訬  py  堪p-y諥 
p  ⢥ ⠢饩 ⢠ py ⠪.

   SYN flooding

     p  ⠪   ⨯   denial-of-service  (⪠  
y).  y⢫      ᮧ yp 
p   (half-open)   ᮥ.      p   ⥪   
p樮 ⥬      ⥪  ppy⨧p,  ᫨      
p⠢  -  TCP-p,   pp,   "echo".  ᬮp
p p y⠭ ᮥ  (ftp, http, telnet) 
pp:

   稭    p p SYN   y⠭ ᮥ 
pp.
   pp ⢥p⯮y祭 p SYN  p y ᮮ饭
SYN-ACK.
     p蠥 p y⠭ ᮥ p ᮮ饭
ACK.

     p,  ᮥ p,    pp    
⮬ ᯥ묨  p⭮ p 묨. ᫨ pp 
y稫 ᮮ饭 ACK,  y    祭 p p
(timeout) p,  祬  p  yp⮥ ᮥ.    p,
pp  p       pyypy    뢠  騥
y⠭ ᮥ.    pyyp   p  p,  
pp,  y襬 y砥, 蠥  p뢠  ᮥ
  p,   ᯨ᮪ yp ᮥ  .   y襬
y砥 pp    p.

   SMURF

    ⭮   ⠪ ⨯ denial-of-service   p⠥   
Internet  Control   Message  Protocol  (ICMP).   ,      
짮⥫      ⮣  p⮪,    饥
設⢮ p      ⠫   pp py饩
y      y権  -    "PING".      pp
p祭   p y -  (y񭭮
yp⢠ 饣 IP-p)  뫪   -p  ICMP.  ᫨
y祭   -⢥⮬,    ⠥ y.   
      p        py  p⭮  ,      
p⥫쭮y  (broadcast)  py  .  [p⥫ p
p⠢ ᮡ p,    p pp ⢥  p 
p .  Hpp,  10.255.255.255 -   p⥫ p
  10.0.0.0.  ᫨ ⠪   A p  256 ⥩, 
p⥫  p      10.50.0.0  y  10.50.255.255.
p祬,  ⥢ p,   p pp, ⢥  p ,
p  y,  ⮦   ᯥ p⥫ ⪫.]    ⮬
y砥  y ⠢ ᥬ  設   ⮩ .  祢,  
᫨  p⥫  ⢥ (y   ⢥ -  .)
᪮쪮 ⥭      設,    p-樠p -p
  p  p⪮ -⢥⮢.
   p祬,  p    p  ᫠ y諥.  奬  
⢨ p -   뫠 ICMP ,   p p p⥫
 pᮬ p (y䨭),     ⢥ y⥫ y뢠
p⥫  p     p.   p  p
⢥      y祭  -p   뫪  ⮢      py
p⥫,   ..   p   y諥   p⢥.   쭥襥
p᪠  py:  p    p    ᯮᮡ
p     ,     "y",           py襭
y樮p ᠬ  - pp p䨪.
       ⠪y   SMURF   y  ppy⨧p     
⥭樠쭮 p.  ᫨  䨫py p⥫ p䨪,
  ᮢ p襣   ⥢ pp     -
p   p y   yy p   py⨢
⢨ 譥  y諥 p⨢  ⭮ p.  p祬,
樠p  ⠪    室     yp  .     ⮬  y砥
ppy⨧p   y,    ⢥⢥   ⠪y  
, p ⠪   ⢥  broadcast ICMP .
     ᠭ  ⠪    ,   y,  ⮫쪮  p
pyp.   p  pᬮp  p     ⠪  p⠭
᪫⥫쭮  "p" ⥪.

   Land?Teardrop

   p⭮ 襥 ⢮ p権      p窠.
p ,       ⢮ pp ᯮy 
   ⠪.
   p樯 p p 筮 p  -  p⢥ p ,
pp, SYN  pᮬ  ᮥ,  p p y⥫, ..
p  p,   祭  py  p⥫  (᭮  y䨭).  ᫨
TCP/IP-⥪ p樮 ⥬ p  ᮮ⢥y騩 ,   
ᬮ  pp   y⢥ ᮧ y諥 y樥,
  ᫥⢨ y  ᠬ 砫 -      ...
⢨ Teardrop ⠪ ᭮   ᯮ짮  訡 
TCP/IP-⥪   p.    y諥   ppy   ᫥⥫쭮
pp ⮢,  p p pp뢠. ᫨ p 
ᡮp  p室  訡,    짮⥫    "p"  
,   設  p p⢮ y.  Windows NT 4.0  
p ⮩ ⠪ ⮫쪮   Service Pack 3   postSP3fix,  Windows 95
⠪ y  ᮮ⢥y 䨪.

   Back Orifice,   BO

     p  ppy쪠  pp  ᥣ     120k(!)   
"p᪨ ".        ᫨誮   -    "ᥣ "
p⠢ y  y񭭮y  짮⥫   p  
Windows9x 祭y  p. y ᠬ:

   * y  ⪮y y p p pyp;
   * pp pp;
   *  p  䠩 ⥬;
   *    p;
   *  p;
   * pᬮp ⥢ pypᮢ 祭  p⢥;
   * yp ᯨ᪮ pᮢ;
   * y񭭠 ppy;
   * y񭭮   믮   pp      pp
     ᮫;
   * y (᢮ p ⥫).

   p ᯨ᮪ ⥩  ,  ⠪  Back Orifice 
p񧭮     p  ⥢   pp     ⢥
ᯫ⭮ p⨢ ⠪  py⠬  Landesk Management
Suite  Managewise,  筥, 室騬    p⢠ y 
⮯ p. py BO   y p   py
http://www.cultdeadcow.com   .   쬠   p⥫쭮  뫠   p
MicroSoft   Back Orifice:  "   p 讣 祭 
⮩ pp,    y,    ᫥y p  訬
⠬".    ⮩ ⮩  ⠪   py .  
ᠬ  -  y "p p", y "", y " p",
 BackOffice- y!  ᫨ 짮⥫ py ,  
anonymous y  p y pp pp,  ⠪    p
짮⥫...        p⢠ y񭭮 pp,  BO
⮨  y ⥩ -  pp  . pp y᪠  p
 設 p,   p p뢠  y ᥡ,   y
 yᯥ p  p Win95 ⠪,     ᫥ .
pp BO  祭 p -  p   y y稫
(  ,  筮 :)) "y᪮p⥫ IRC", "  ICQ", p祬 
 ⮣  pp 120k...  Back Orifice yy  Unix, OS/2
  Win32.  p  ⮣,  pp  p p⠢ y  y񭭮y
pypy ⪨ ,    p  Win9x.      
pyp  ᤥ  download    upload...    p⠢  ᮡ
⥪⮢y  y     p  ,   筮  yy   
ᯮ짮.   win32  GUI-,  ,  y樮쭮
뢠 ᮬ (   win32 :))).  pᥭ   䠪: Win95
  y⠭ pp BO  p ⪠    ⢨
⠪.  , BO   p?!
   H   ⮨  y     樮  py,     ⥬
᭮  y     py  http://lockdown2000.com  ,   p
⭮y    www.hackerfree98.com.     짮⥫    BO
ᮮ騫,    py  yy ppy   y񭭮 p,
ypy,  p  p 室   ᭮.

   

   ᫨    -  짮⥫ Linux,    ᠬ  y  p  
pp   p p  IP-⥩.    ,  p  p
"make"     訢 ᢮ 設y ᥬ 묨 ,  y,  
y묨  pᠬ.

   ᫨  -  짮⥫ Windows,    ⮦  ⠫쭮 :).    
  񦭥訩  ᯮᮡ  ᯥ  ᭮     -  
砩  p.  p祬,  y⪠. H ⮨ y,  
p饭 p묨 堪p, p ⮫쪮   ⥬,  p
 p⨢ 짮⥫ Windows,     饥 設⢮.
,  y IRC  ICQ,  .. y,   p, 
y  IP-p,  y   ᥡ     pᨩ 
ᮡᥤ  ⠢ ᮮ⢥y騥 䨪  ,  ᫨,  筮,
  頥 pyp.

   짮⥫ OS/2    y        -  IBM  
  ᢮ ,   ,    ,    񦭮 
⢥.

    뫪:

http://www.cultdeadcow.com
http://www.hackzone.ru
http://www.cert.org
