A N O N Y M I T Y	Survival strategies in a corporation environment Fravia's Nofrill Web design '98 ~ '99		updated September 1999	Fravia's Anonymity Academy Survival strategies in a corporation environment You're an insignificant worm from a sysad point of view. It is in part true, of course. The might of your censors and controllers is enormous and you are weak, isolated and at danger... Yet you may try to play a little your own tunes nevertheless. On this page "corporate survival" essays dll taming technical basic work psychological basic work useful tricks disable Webnannys censorships One for "public" computers A bag of tricks

REM WIN.BAT


You may fire Winice, type winice


or start windows normally


typing win.com

[Paths]


WinDir=C:\WINDOWS


WinBootDir=C:\WINDOWS


HostWinBootDrv=C





[Options]


BootMulti=1


BootGUI=1


Network=1

(1)


Where should you keep the files the slave masters would not want you 


to use/have on your PC?





Put all the programs you should NOT have installed on your PC inside


C:\WINDOWS or C:\WINDOWS\SYSTEM, never create subdirectories. The 


total mess and confusion (which is anyway a charachteristic of the poor 


OS we are compelled to use) can in this case be turned to our advantage :-)





(2)


How to defeat censorship software checking for files deemed "illegal"


by the slave masters and yet use the programs





Quite a lot of software allows the slave masters to know if you 


have or if you have not in your harddisk files deemed "illegal"


by them. Change the names of the *.exe files! If necessary edit the 


*.dll files too (this is slightly more complicated, since you'll 


have to hexedit a little the calling programs and procedures) 


Change the names of *.exe and *.dll files to non significant names like 


		hggq67.exe


		87771ll.dll


		etcetera


The censorship software used by your corporation will not be able to


fetch them this way (this idea was pilfered from +ORC's 4.2 :-)





(3)                       DLL taming


Modify ("tame") the *.dlls and get some "secret snoopers" for free :-)





As you will probably already have seen/studied in the students' essays 


section, a very useful form of reversing is "object oriented reversing".

Dynamic-link libraries modifying (dll-taming) is one of the most promising 

reversing activities, as many essays of our student section attest. Modern 

windoze's applications rely quite a lot onto *.dlls that are already inside 

your system, and keep a very interesting interchange of parameters (and data) 

with their functions. Nothing more simple (and obvious) than modifying these 

*.dlls in order to redirect those data wherever you fancy. This is *.dll 

taming. I won't go into too much details on the technical aspect of dll 

taming. The tools and techniques you'll use are, of course, the same that 

have been thoroughly explained in the student section (and on my tools 


page). If you are (or will be) a reverse engineer it won't be all too 

difficult, believe me.


Most of the programs and applications that the slave masters use in order 

to snoop onto you or to perform their "mysterious activities" (the one that 

you would like to "study"), do rely on *.dlls that are located like sitting 

ducks inside your /windows and /windows/system directory (MSPWL32.DLL for 

enhanced password cache security, to cite but one :-)


Well, here is one of the very few sectors where YOUR competentces should be 

by far superior to the capacities of your system administrators: it's our 

field: reversing!


"Take home" your target *.dlls and, working on your own machines, modify them 

until they will work the way YOU want (and not the way the applications of the 

system administrators expect them to :-)


You don't even need to worry much about eventual length differences between the 

untamed and the tamed dll... I have never seen any application checking the 

length of the *.dlls (there are much too many variants and versions of the 

main dlls... windoze is a total mess, never forget it :-), yet, if you want 

to go "NUMMERSICHER", don't alter their length and just patch them "inside", 

using the many tricks, like "snake-patching", explained in the student section.


Once you are ready (and you have thoroughly tested them) reinsert the transformed 

*.dll onto your machine, at work.


Nobody but you will know it (hopefully) yet you will now have some powerful 

tools as allies in your battle! You may have redirected the output (with the 

data you are interested in) to the screen or to a file (careful!) or to the 

printer, you may have tsrred an activation switch, or you may keep a copy of 

the tamed dll under another name inside your windows directory, and just 

batch it on or off when you need it (so that most of the time the real, untamed 

dll will be the one working, and your tamed one will sleep inside the directory 

under another non-meaningful name until your simple dos batch "awakes" it :-)


Imagine (just imagine, of course :-) that you modify the OpenPasswordCache 

function of the above mentioned mspwl.dll so that you will be notified (with 

the possibilities of having a look at the parameters) every time that function 

will be called... well: you are NOT using Winice or another debugger in order 

to get those data, so there is no "alien" application running onto your system. 

Everything looks "normal" from the sysad standpoint: -"stupid user sits in 

front of his stupid screen and our SuperhyperSnoopo version 4.2 checks what the 

hell he is really doing, how long and how much!". Ah! Your screen gets all the 

activities of their SuperhyperSnoopo version 4.2 instead! (or whatever they use... 

most of the time it will be an overbloated *.dll intensive app :-)
  

See: you are playing at a level that most system administrators cannot even 

understand (they would not dream of modifying a windows *.dll, they have 

enough problems with the "normal" bugged Micro$oft's own ones :-) and you 

can, if you tame wisely and if you choose wisely your target dlls, gather a 

LOT of information on your system in this way. 



(4)

Batch alternative on how to defeat censorship software checking for 

files deemed "illegal" by the slave masters when you do not need to

use the programs



Create two batch file (inside c:\windows as well), that will change

on-the-fly, when you run it, the extension of all the executable 

you should NOT have installed on your PC to *.myn and back to real:

When you are offline (or when you feel like it)



REM re3444g1.BAT

REM fuck the censors, recreate

cd c:\windows\system

ren GHHA12.myn ultima_9.exe

ren GHGG12.myn chess730.exe

ren GHHA12.myn snooplan.exe

ren GHHA12.myn bombchef.exe

REM OK, recreated names



Before being online (or going home at the evening)



REM ob3444g1.BAT

REM deceive the censors, obscure

cd c:\windows\system

ren ultima_9.exeG HHA12.myn 

ren chess730.exe GHGG12.myn

ren snooplan.exe GHHA12.myn

ren bombchef.exe GHHA12.myn

REM OK, obscured names



(5)

How to install everything you want without a CD-ROM



Buy a zip drive and use the 100 Megabyte zip cartridge in order to

install whatever you like on your PC even without a CD-ROM, and in

order to save/keep/move files as you fancy without leaving much

traces behind you. The zip connects trhrough the parallel port

and its data transfer ratio is acceptable. You may even RUN programs

from there WITHOUT LEAVING ANY PHYSICAL TRACE INSIDE YOUR PC.



(6)

How to download files on the web without leaving traces

on the http:// grep filelog of the slave masters



Never download from http:// sites, they would immediatly get

your traces through the log files. 


Get all the files that you want through ftp-mail.


(7)	Visit the site with the warez you are interested in with


        your browser, but DO NOT DOWNLOAD.


2)	Write down the exact name of the *.zip file you want.


3)	Get it through ftpmail emailed to you (this leaves traces, 


	but it is selten monitored because few know that you can


	freely download this way... you may eventually use the


	path option to get the files emailed to your home account


	or to an absent colleague whose password you happen to 


        have found)





GOOD FTPMAILERS:


(just send to each of them an email with the word "help" in the


subject and in the body. Keep in mind that some of them at times


simply do not work... just try again later):


MAIL SERVER MIT		        mail-server@rtfm.mit.edu


DEARN DE			BITFTP@DEARN


PRINCETON			BITFTP@PUCC		(files until 17.825.792 bytes!)


BRYANT			        ftpmail@ftpmail.bryant.vix.com


DNA AFFRC JP		        ftpmail@dna.affrc.go.jp


W3MAIL GMD.DE		        w3mail@gmd.de	(Max 5 Megabytes)


WWWMAIL CIESIN		        www.mail@ciesin.org


NETMOR			        wwwfmail@linux.netmor.com (QUERIES INSIDE FTP SITES!)


GARBO FI			ftpmail@garbo.uwasa.fi


GETWEB HEALTHNET		getweb@usa.healthnet.org


MOGLI DE			w3mail@mogli.gmd.de (the best one for images)





(8)


How to download images


	


I assume that there is no track on the loggings if you just save images


using the right mouse button... but you may choose to get the images


ftpmailed to you as well. See point 5 and use w3mail@mogli.gmd.de





(9)


How to get administrator rights (privileges)





	Use some resident keyboard trapper on a PC of a collegue that


has NOTHING to do with you. Damage (slightly) some obvious booting 


function of that PC, wait until the sysad's slaves come and repair it. 


Fetch the administrator slave's password afterwards and 


use it THE SAME DAY (they have most of the time rotating passwords). 


A good idea is to give privileges, inside your intranet, to a WHOLE bunch


of people at the same time, try always to be a fish among many.








(A)


How to disable Webnannys censorships





Web nannys are censorship programs whose stupidity goes beyond


belief... they block anything that is deemed "dangerous" by their 


puritan idiotic programmers... whole geocities (for instance Athen)


have been banned "en block" because somebody used somewhere the 


image of a pepper with the name "hot.gif". Few corporations are so


stupid to use this shit, but you never know... should they use these


programs, here is how to destroy them :-)






A.1.	Cyber Patrol


You need a special cracking program, you'll find it 


on the web: name= cypatrol.zip





A.2.	Net Nanny


A.2.1)	Windows 95


CTRL+ALT+DEL (Get close program menu)


Choose OCRAWARE


End Task





A.2.2)	Windows 3.1/DOS


C:\


edit config.sys


type rem in front of DEVICE=C:\NN\NNDRV.SYS





A.3.	Cybersitter


A.3.1) 	Disable totally


CD /WINDOWS


copy win.cyb win.ini





A.3.2)	Block action (still logging, see 8.3.3 below)


CTRL+ALT+DEL


end task Tcpwait


create c:\windows\temp_holder


move the file cywin0.opt there


restart internet applications... Cybersitter does not


					   block anymore





A.3.3)	Remove any record from the log file


Find file cywin.alt (usually inside c:\windows)


remove read only switch


notepad cywin.alt


remove any line that begins with the word blocked


save the file


remake it read only





(B)


How to check what's going on in your system





Start using the instruments that you ALREADY HAVE inside


the huge windows conundrum (if you don't have them, 


bring them from home):





C:\WINDOWS\NETSTAT.EXE	netstat > letsee	and then edit letssee


C:\Program Files\Common Files\Microsoft Shared\MSinfo\MSINFO32.EXE


(active modules)


C:\WINDOWS\WINIPCFG.EXE





Then fetch these two files:


ps 


kill


And use them to see/terminate the applications that are working 


on your system... you'll find an explanation inside LordClito's "old" 


essay on my student page.





(C)


First and foremost Winice is a good weapon!





Install Winice 3.2. (there is a whole project of the student section that explains 


how to fetch and use this most powerful debugger. You'll find softice 


everywhere on the web: search, or buy it, it's a very good tool and deserves it)


Find the correct drivers for your PC (you may download them from


Numega's site if you do not have them). No checking software in a 


intranet can resist the CTRL+D shot :-)





(D)


Remove all limits that the sysads have imposed on you





Use the policy editor (you'll not find it inside your machine at work, 


you'll find it HOME, on your own windows 95 cd-rom under \Admin\Apptools\Poledit 


or you'll easily fetch it from the web).


Push F8 during boot choose start without register informations (therefore 


start without limits) start poledit open register configuration delete 


all limits





IF YOU DO NOT SEE any start menu, have a look at CONFIG.SYS,


you'll find there the command


	switches /n


eliminate it and restart anew.





...And if you don't see EVEN THIS, take a look at the c:\msdos.sys 


again (thanks Ivan :-) and may be you'll see among:





[Options]


BootMulti=1


BootGUI=1


Network=1 


etcetera





the following:





BootKeys=0





-this one causes the same shit, so you have to change it to:





Bootkeys=1





Or remove it... but this would NOT be so clever, would it?





(D)


Another trick: the SAFE MODE boot





As anyone (should) know, you can boot the windows bazaar in SAFE MODE (press F8 at start 


until the windows' choose your boot menu appears).



If you do choose safe mode, you'll notice pretty interesting new possibilities, which 


were disabled in the "normal" booting configuration. Among other things you'll be able 


to choose the "update information tool" and have a look at what your sysads have made 


in the last months (and which *.dll you should "intercept", see point three :-)



As long as you are in safe mode you are, moreover, relatively 'safe', so experiment around  


a little and take note of everything in sight!



(E)


Blowfishes are for ever





Well, let's not forget all the advantages of a quick and reliable encryptor. I use blowfish 


advanced 97 beta 1 (see the reversing essay by Jon).



Blowfish advanced 97 by Markus Hahn hahn(at)flix(point)de is an extremely powerful 


(and quick) encryptor, that will blowfish all the files you want, at work and at home, 


in a couple of seconds. You may (probably) get a beta version from Markus' page at 


http://www-hze.rz.fht-esslingen.de/~tis5maha/software.html






A legitime question: should you be paranoid?


Actually no, you should not. Most of the files and data that we have on our harddisks


are perfectly legal (reversing software is not an illegal activity, you may want to


read my Is reverse engineering legal? essay), and there is 


no real need to encrypt anything whatsoever. Yet there are (at least) two sound reasons 


to blowfish a lot nevertheless:


1)	it's great spass to have everything you do encrypted at work just to 


	avoid ANY administrator's sniffing. Of course, once they find all your 


	text files blowfished they will know that you have something to hide


	(once more a good dos batch can transform all those funny secret.txt.bfa


        names into something more "neutral" like Cirrus.drv :-) yet the mere fact 


	that they wont be able to know what you are hiding is fun enough :-)


2)	it's a good PRACTICE. Once you get used to routinely blowfish your data, 


	you'll learn also to KEEP those data in some places (and not everywhere 


	inside your PC, and you'll get used to encrypt sensible data, which, in


	an epoque like the one we are living in, is a very sensible thing to do


	anyway.

No matter what the reason is, we are always constantly trying 


to get to a computer connected to Internet. One possibility is 


to get Internet connection from Public computers. There are a


couple of good advantages.





1.  You could do any kind of activity in a more obscure way (no great 


    worry of trace-back from uninvited sources, high degree of anonymity)


2.  Youíll enjoy a free Internet service (and the Web should be free, nicht wahr?)








It is still hard to get a shell account free and without giving much 


information about yourself, but this access still helps you keep up with 


news and stuff with minimized activities. Hey, it is a gatewayÖ J





But it is not as unobstructed as it sounds. Most of these public places 


(Libraries mainly) do use restriction methods to keep people from having 


a total control of services. Some of them use a 


limitation software called KIOSK, for instance, 


which basically prevents user from 


accessing certain features of a menu, for example the "General 


Preferences" of "Options" in Netscape, or the "Connect To" field of some Windoze's  


telnet programs (you should know the POWER of telnetting if you are reading 


these pages). Now this really bores, because there are times when you 


donít even have access to the basic Programs and Settings menus of the Start 


Button.





Now, how would one run programs, install programs, and read files from 


these restricted systems if they donít even let you boot (Boot 


passwords)? Impossible!





Not really





#1


One of the more remarkable things on these public computers is that they 


often "forget" a nice 'old' program called TaskMan. This is a small program 


activated by pressing Ctrl+Esc at the Password Screen (yes, try to 


figure out what is the purpose :). This program will allow you the 


Run Application option, and from there you could try your luck with 


Programs. GRP (whichíll pop up all the groups of Windows thatíd have 


otherwise been hidden through censorware like IKIOSK.) And then thereís 


COMMAND.COM. Mind you, you should always have a system disk with you  


not to boot from it (Network Computers) but to run some important 


programs like COMMAND.COM on your own





#2





You know, they could have killed TaskMan after finding out what you have 


been doing with it (or even 'beforehand' if the sysads are smart, which, 


fortunately, does not happen all too often). What do we do now?! No 


worry, thereís still another way. These public computers using Windoze95 


as OS always have something on their menu (duh!): confusion and random 


behaviour: source of bugs and source of delights (for us crackers :)





Chances are theyíll have at least one single program, somewhere, which 


requires a standard file input from a disk. NotePad may be disabled, Write 


may have been crippled, but the censors won't probably have maimed that 


'vital tool':  Windows Explorer. 


Let's say good old 'cracker's TaskMan' is dead, so WindowsExplorer is 


probably the only other file utility on the marketplace of your library 


computer. Well, one possible way to get to it is to start one of these 


standard file input files [write, Notepad, Netscape (if 'they' did not 


disable the 'delicate' menu options, etc) and when you get to the "Open 


File" or  "Save" or "Save AS" sections, just go ahead to one of the 


yellow folders and click the RIGHT mouse button on it. 


What do you see?! Well, thereís the silly M$ 'rightclick' list: "Open Explore" 


(YES!!!), "Cut", "Paste", "Send To", "Delete" and more... 


The big point is that You now have access to Windows Explorer. From then 


on... well... 





#3


But again, our nasty censors and sysads world is not as forgiving as the we 


hoped it would be. 


Now, what if they have also removed EXPLORER from the RightClickOnFolderList? 


"Man, thatís it. Die public computers are too heavy censored... I give up". 


Eh? Not so fast sunny boy... 


Thereís one more way. There is still one more option: the "Open" section in 


the RightClickOnFolder!


You could click on anything and it would open it through the software you 


want it to. Could even be a software 'sort of'... try ProgramManager... youíll 


be surprised.





















A bag of tricks












*** One idea to play around is to get to a file browser (somehow) and if 


you find all executable programs have been disabled for direct access, try 


it 'indirectly'!


What I mean is: click on the files made for that particular program, 


then you just might be able to run the program you wanted, even if direct 


disabled. 


If not, hey, come to think of it, another hope is to have the "Browse" button 


as a choice...





*** Also try installing some programs (like PIRCH). Even though I donít 


know why, if you are able to run them, then theyíll automatically start 


the Program Manager (no matter what the restrictions were set from the 


outside) and once you can start Program Manager you'r done!





*** Dead  end with "OneEyed" (no buttons, no buttons) with Netscape? 


Try our famous Easter Egg shortcuts! Press Ctrl+Alt+F. Then a road will 


appear, explore! Try "Netscape Home Page". Try their silly and slow search 


engines, try downloading useful programs. Try whatever... main thing is you 


break the chains and you are free to roam!








Tricks by Stacker (September 1999)





Entering a network which uses user authentication via NT domains and has the


auth. needed for logon 'vinkje' set. (vinkje is a word describing the windows


thing of checking a box, and it is also used in: hey <thisnthat> doesn't work!


Well you need to put a check somewhere)





Some networks need a usercode and password to log you on, or you won't be able


to use the machines (even). Well, i got in useing the following. type something


totally wrong. 


type it again. Try cancel a lot of times (this very often works in such


networks, cause sysadmins mostly don't even know about this one (i do, and i am


a sysadmin (at the moment))). The third time entered a wrong u/p the machine


gladly assisted me in 'hacking my way in' by pointing out: "You have entered a


wrong password, you may try to login as guest", which i promptly did, and


tataaa your on... :) 





ofcourse another way is asking the guy/gall who is at the pc to type :


start->run, winipcfg and then after he/she left, boot in safe mode and enter


the ip adres manually (so no bootp or DHCP is needed).


And you are in aswell.





regards,


Stacker

---

To the essays on this page

---

homepage links anonymity +ORC tools cocktails students' essays
antismut CGI-scripts Javascript tricks search_forms mail_fravia+
Is reverse engineering legal?