Linuxers July 2001

linuxers@mm.ilug-bom.org.in

117 participants
352 discussions

Re: Web Server bufferoverflow
by Pankaj Jangid 21 Jul '01

21 Jul '01

This is what I received in Apache Week. In the news IIS vulnerabilities show up in Apache log files We've received a large number of messages over the last few days from system administrators who have seen worrying entries in their Apache access logs. The requests look like this: 192.168.2.12 - - [19/Jul/2001:16:55:47 +0100] "GET /default.ida?NNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 252 - If you are running Apache there is nothing to worry about, these requests are part of the [3]Code Red Worm virus designed to search out vulnerable IIS servers running on Windows. However if you'd like to become vulnerable to attacks such as this, Microsoft have a toolkit that will let to migrate from [4]Apache to IIS. (Allegedly the last step is append the text "3L33T crew ownz you" to the bottom of all your web pages to save the crackers some time) Regards pankaj

1 0

problem with java
by tushar kanti mohanty 21 Jul '01

21 Jul '01

i have been able to compile java my java programs but iam not able to run them.when i type java classfilename in the xterm nothing seems to happen i have not been able to print a single statement in the console could someone please send all the necesary info to setup my java development envirnoment. i have got kaffe but i dont want to use it i got jdk1.3 installed in /usr/java/ drectory. almost desperate ____________________________________________________ http://www.monsterindia.com - The Best Jobs. For the Best Minds.

2 1

Change in my mail address
by Nikhil Joshi 21 Jul '01

21 Jul '01

I have been having trouble with my existing mail account . I am changing my mail address from nikhiljosh(a)runbox.com to nikhiljoshy(a)yahoo.com I have not been able to check messeges for about 15 hours . I will try to get in touch soon. Sorry for the inconvenience.

1 0

Re: boycott adobe
by Philip S Tellis 21 Jul '01

21 Jul '01

Apparently, Adobe used the DMCA to get Skylarov. We should all be opposed to the DMCA. What's interesting is to see the different reports on newssites. While MSNBC completely bashes Skylarov, Yahoo shows both sides of the story, even commenting on the DMCA itself. Philip -- If the facts don't fit the theory, change the facts. -- Albert Einstein Visit my webpage at http://www.ncst.ernet.in/~philip/ Read my writings at http://www.ncst.ernet.in/~philip/writings/ MSN philiptellis Yahoo! philiptellis

1 0

Web server buffer overflows
by Philip S Tellis 21 Jul '01

21 Jul '01

Somebody's trying to request this: (adjusted to fit the page) GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9 090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u00 78%u0000%u00=a from my web server (Apache 1.3.17) Does it look like a standard buffer overflow exploit? Doesn't seem to have caused any harm yet, but this has been tried over and over again. Philip -- I got a new shadow. I had to get rid of the other one -- it wasn't doing what I was doing. -- Stephen Wright Visit my webpage at http://www.ncst.ernet.in/~philip/ Read my writings at http://www.ncst.ernet.in/~philip/writings/ MSN philiptellis Yahoo! philiptellis

5 11

Highly OT: Where is MINIX?
by Fart Crimson 20 Jul '01

20 Jul '01

Hi guys, I understand my query is heavily OT to the extent of even starting off a Flame Jamboree. Does anybody know the status of Minix? I want to see the code for learning purposes (FlameBait) I want to know where can I get Minix. Thanks Fart

3 2

[OT]the boycott Adobe site
by Kishor Bhagwat 20 Jul '01

20 Jul '01

hi you guys might want to chk out www.boycottadobe.com its a result of the FBI arresting a guy who demonstrated weaknesses in the e-book security model. regards, kishor

1 0

[OT] How copy protection schemes are implemented
by S. Krishnan 20 Jul '01

20 Jul '01

There was a thread about how to protect CDs etc against copying - basic copy protection techniques. When checking one of my ancient archives before blowing it away entirely, I happened upon the following piece of code that was written to circumvent a basic key-disk floppy based copy protection scheme. I had written it to show someone how easy these schemes were to get around (actually, some, based on hardware hasps and self-modifying code are pretty tough, so beware!). I reproduce the code here for anyone who is interested in the guts of a fairly trivial copy protection scheme and its antidote. The code is pretty heavily commented, since it was in the nature of a tutorial, so that you should not have any trouble following it if you are at all familiar with x86 architecture and the DOS/ BIOS system call scheme. Old timers like me who date back to the days of the 2 x 360 KB FDD based PCs may wax nostalgic at the mention of Central Point Software's CopyIINokey (nokey.com). Incidentally, although this code works, it probably will render your PC's floppy unusable without a reboot, since it does not do any process based vaildation. Also, although it circumvents a copy protection scheme, PLEASE DO NOT USE IT FOR SOFTWARE PIRACY! It is intended for use as an educational exercise for people to learn about program design and the PC's architecture, and not as a cracker shortcut. I am definitely not a cracker! Here goes: ; kundli key disk buster program ; v 1.2 coded 1.6.98 ; ; Copyleft (sic) S. Krishnan, 1998 ; ; This software is freely copyable and distributable provided the above ; version and copyright info are retained in whole. Send your comments, ; questions, flames et al to sri_krishnan(a)yahoo.com. ; ; You will find kundli, a multilingual MS-DOS Indian astrology program, on the ; infamous Installer 4 CD that is a part of every hardware assembler's armoury. ; Incidentally, kundli is coded in MS QuickBasic. ; ; ------------------------------------------------------------------ ; Written for MS-DOS and NASM; will NOT assemble under MASM or TASM or A86 ; Anyone who wants to assemble under the latter programs will have to do a little rewriting. ; ;------------------------------------------------------------------ ; ; The kundli program is copy protected through a key disk scheme. ; It checks for a key disk in drive a: by issuing a BIOS int 13h ; disk read using service 02h, for reading one sector. This sector ; presumably exists on the key disk as follows: ; ; Track No. 19, Sector No. 01, Head No. 0, Drive No. 0 (FDD) ; No. of sectors to be read: 1; results to be placed as usual in es:bx ; ; The result is one word read into the buffer pointed to by es:bx ; This word is compared with 434Bh, using a cmp operation, as follows, ; by the kundli.exe program: ; ; cmp wo ptr es:[bx], 434Bh ; jne exit ; ; Eureka! If the word pointed to by es:bx !=0x434B, then exit. ; ; Incidentally I got this information by disassembling kundli.exe in ; bxd 2.6 (the BrandX debugger by Sonam S. Gyato; you can download it ; off simtel.net if you want). ; ; The scheme may therefore be broken if one intercepts int 13h, function ; 02h. If the read request for Function 02h is for Track No. 19, Sector No.1, ; then we can be sure it is for kundli. Hence one performs an iret with all ; the details that the program expects, including placing 434Bh at the ; location pointed to by es:bx. It is also essential to clear the carry flag, ; since a set carry flag means error, and kundli.exe incorporates processing ; to ; check for the results of the carry flag after the int. ; ; On to programming, then! org 100h ; align psp for com program segment .text ; standard for bin files under NASM jmp start tsr_start: nokey: ; far procedure for interrupt servicing ; named in memory of Central Point Software cs pop word [useraddr] ; save caller's ip return address cs pop word [useraddr+2] ; save caller's cs popf ; get rid of old flags push ax ; save caller's registers push bx ; -do- push cx ; -do- push dx ; -do- push es ; -do- pushf ; simulate int call by pushing flags on stack cs call far [old_int13] ; call the original int 13h ISR ; after servicing the original int 13h request, our ISR is reentered at ; this point. First we save the old ax since int 13h returns the results ; in ah or ax, and then restore the registers to what they were when our isr ; was entered. We then check to see if the call conditions were that of ; kundli.exe : service no.2, 1 sector to be read, track no. 19, drive 0, etc. ; if so we return with the preset reply of 434Bh, else we jump to exit, which ; restores the ax returned by the original int 13h isr, pushes the flags, ; caller's cs: and caller's ip: on to the stack and executes an iret to ; return to the calling program mov word [cs:temp], ax ; save ax contents returned by old int 13 call pop es ; restore caller's registers pop dx ; -do- pop cx ; -do- pop bx ; -do- pop ax ; -do- cmp ah, 02h ; cmp. al - is the request for service No.2 jnz exit ; no - then return to caller cmp dl, 00h ; cmp dl - is request for FDD No.1 jnz exit cmp ch, 19h ; cmp ch - is track no.==19h jnz exit cmp cl, 01h ; cmp cl - is sector no.==01 jnz exit ; Now that we've come this far, it appears that the request is indeed by the ; kundli program Hence we stuff 434Bh into the buffer pointed to by es:bx mov word [es:bx], 434Bh ; stuff the code into kundli's disk read buffer clc ; clear the carry flag mov ah, 00h ; disk read sucessful mov al, 01h ; 1 sector read jmp far [cs:useraddr] ; return to kundli.exe with pseudo-disk read exit: ; normal exit if caller is not kundli.exe mov ax, word [cs:temp] ; restore ax returned by old int 13 isr pushf ; save the flags rtd. by original int 13h call push word [cs:useraddr+2] ; push caller's saved cs on stack for iret push word [cs:useraddr] ; push push caller's ip on stack for iret iret ; return to calling program temp dw 0 old_int13 dd 0 useraddr dd 0 tsr_end: start: ; initialization code for loading the int vector ; get and save the vector for int 13h xor ax, ax ; set ax to 0 mov ah, 35h ; Int 21h function 35h mov al, 13h ; Int 13h vector to be obtained int 21h ; go for it mov word [old_int13], bx ; save old int 13h offset mov word [old_int13+2], es ; save old int 13h segment ; next, install our new handler for int 13h push ds ; save data seg. mov ax, cs ; code seg to be loaded into ds for seg add of mov ds, ax ; new interrupt handler mov dx, nokey ; offset of our new int 13h ISR mov ah, 25h ; Func. 25h for setting int. vect. mov al, 13h ; vector to substitute with our isr int 21h pop ds ; restore ds mov ah, 09h ; display line mov dx, msg1 ; address of message int 21h ; sign on message mov ax, tsr_end shr ax, 4 add ax, 01h mov dx, ax mov ax, 3100h int 21h ; terminate and stay resident SEGMENT .data msg1 db ' The Kundli Buster program: written by S. Krishnan, 1998$' last db 0 SEGMENT .bss __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

2 1

problem with java
by tushar kanti mohanty 20 Jul '01

20 Jul '01

1 0

Can anyone help me in making a Linux Based Mail Server :))
by Passport Assistance 20 Jul '01

20 Jul '01

Hello All, I am keen to get some consultation on making a Linux Based Mail Server, and a Mail Frontend. Id love to hear from relevant professionals who can help me in this Thanks and Regards Gurmeet Singh, Mumbai, India 9820193721 dynamics(a)vsnl.net

3 2

← Newer
1
...
12
13
14
15
16
17
18
...
36
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Linuxers July 2001