+HCU Millennium Strainer: 26 July 1999 "Here it is!"

A delayed strainer The "Millennium" strainer was plagued by a series of problems, the main ones being the long disappearence of +ORC and +Aesculapius and the syn-attacks against my site. As usual among us, you will be able to follow, if you are interested, the various phases that brought us to the Millennium Strainer (which is NOW ready, but see also "+Aesculapius intents" below). You are all allowed to criticize, as Olorin has done, anything that we did/do/will ever do :-) [The Millennium strainer 26 July 1999] [+Fravia's "placeholder" May 1999] [+Greythorne's suggestions May 1999] [Olorin critics the placeholder July 1999] [Fravia's and Steinowitz's "placeholder June 1999] [ENTRANCE TO THE 1999 +HCU COURSES July 1999] [VoxQuietis critics the "secret pages" concept July 1999]

Introduction

Since fravia+ is very busy with rebuking the attacks on fravia.org, he asked me to write down how the Millennium Strainer should be. Both fravia+ and I think that Reverse Engineering on the web is the future, therefore, this strainer is about Remotely Executing. While cracking software appz is done by the dozens of crackgroups which exist at the moment, elite reverse engineers like +HCUkers should move on to where the future is: the Internet.

Because of this, the +HCU strainer should not only test your reverse engineering skills. An elite reverse engineer needs knowledge of coding, reverse engineering and the Internet. This strainer requires you to know quite a lot about all three. Let's proceed with the assignment!

Remotely Executing

The main objective of this strainer is to make it possible to run any executables you choose on a target machine where you have had access. Let me explain to you how this should work.

• To make it possible to run any executables on a target machine, you should write two executables (REserver.exe and REclient.exe).
• Write these executables in C, using ANSI C functions where possible to make your programs as portable as possible.
• REserver.exe should run on the target machine, accept any connections requested by REclient.exe and then execute what REclient.exe orders.
• REserver should then catch the output of the program (and the exit code of the program) and send it back to REclient which shows it to the user.
• When you enter tn3270:// in your browser's address textbox, Windows will automatically start Telnet.
• The TN3270 protocol is a rarely used telnet-like protocol, invented by IBM.
• Re-associate the protocol with REclient.exe.
• Then, REclient.exe should be executed by entering the following:
  tn3270://212.212.75.75/C.d.bBatchfiles.bRun.2Ebat
      (which would run 'C:\Batchfiles\Run.bat' on a Windows system 212.212.75.75)
  tn3270://myserver.com/.sbin.scat.20.setc.spasswd
      (which would run '/bin/cat /etc/passwd' on a UNIX system myserver.com)
• Decoding/encoding works like this: slashes (/) are replaced with .s, backslashed (\) are replaced with .b, colons (:) are replaced with .d, all other special characters (non-alphanumerical) are replaced with a dot followed by their hexadecimal ASCII codes (for example, a point becomes .2E and a space becomes .20).
• REclient should decode the argument passed to it by the browser, connect to REserver running on the target machine and make REserver start the executable requested by its user.
• Find the specifications of the TN3270 protocol and implement it in both your server and client.
• If you managed to do all this, you should proceed implementing another function. Before, I only talked about catching the output of a program and sending it to the client, but what when I want to run /bin/bash or command.com? Indeed, we should also allow users to provide information (or new commands in case of a shell) to the executables running on the target machine. Use the TN3270 protocol for this and you'll be able to use this as a full shell account! And you don't need passwords to verify your access to the server (providing REserver.exe is running)!
• REserver should be able to handle more than one connection at the same time (with a maximum of 10).
• Think about how you can make sure that REserver is always running on a target machine! Think about adding a RunServices key to the Windows registry. Besides, for UNIX systems, you could write a sh script which checks if REserver is still running. Set a crontab for this sh script and you're settled even when your UNIX restarts!
• Don't forget to implement decent error trapping routines!

A complete solution should at least cover solutions for both Windows 95/98 systems and UNIX systems. Read 'Portability' for more info on this.

Web-interfaces

After coding all this and testing it well, it's obvious that this isn't as easy-to-use as it should be. What we need are a couple of decent interfaces which make it really easy for users to use REclient. Encoding commands like the examples I gave is easy to do, but I don't want to be forced to look up the hexadecimal ASCII codes for all kinds of special characters. Let's describe a couple of interfaces you should make it you want to do it perfect. I would waste time if I would explain to you why these interfaces should be web-interfaces. :-)

Interface 1 - JavaScript

If you don't know how to make webpages with standard HTML tags: learn it right now! Don't you dare to use M$ FrontPage (or any other WYSIWYG HTML editor) for this assignment, because that would be a serious insult. :-)
Notepad or pico/gvim is good enough for our purposes!

Alright, write a webpage where a user could enter 1) hostname/IP of the target machine and 2) the executable which REserver should start. When this user clicks the button, a JavaScript function should encode hostname/IP and command to execute in the URL format I explained earlier: tn3270://target_machine/encoded_command. Change the browser's location to this new URL and your REclient.exe will do what it should do... (If you re-associated the TN3270 protocol with it!)

Interface 2 - Perl

Write a Perl CGI script which does exactly the same as the JavaScript page described above. Don't forget that it should be a CGI script! (Thus: it shouldn't be executed as a program from your command prompt. If you don't have installed Perl on your local workstation, you could install your script on a webserver where you have CGI permissions. Don't forget that you'll still need REclient.exe installed on your local machine!)

Note If you're a real +HCUker, you also write Perl scripts which do exactly the same as REserver.exe and REclient.exe! Believe me, that it's easy if you finished your C version and know something about the differences between C and Perl!

Interface 3 - C (again)

Last, but not least, one more web-interface. As a matter of fact, this one isn't just an interface. This one should be both web-interface and REclient in one. I think you already understand what I mean with this. No? Ok, read on and you'll understand!

I started this essay writing that the Internet will become more and more important for all elite reverse engineers who want to keep up with the best. Therefore, for those who don't already know all about this, it's getting time to learn everything about CGI programming. Remember: you can't reverse engineer if you can't engineer! Why did you learn coding in assembly? Indeed, you couldn't reverse engineer without it! That's why this strainer also requires you to know quite a bit about the Internet and CGI, a.k.a. Common Gateway Interface. And since most servers are UNIX-based platforms, it's also getting time for all those Bill Gates-people to shutdown Windows, restart with some UNIX platform and see how long a system can be stable without restarting at all!

Remotely executing whatever you want sounds good, but remotely executing whatever you want by ordering a remotely hosted client to arrange this sounds even better! I really hope you can follow my deep thoughts. If you don't: get a glass with your favourite cocktail, sit back and relax, enjoy your drink and think about it. Believe me: it'll work! :-)

For those who didn't already understand: write a CGI program in C which provides your with a web-interface. When you enter data in the web-interface and submit it, the CGI program should behave as it were REclient.exe. All output should be correctly formatted HTML code. This CGI program should be installed on a webserver where you have CGI permissions. To prevent unauthorised users from using this interface, you should implement a password protection. Write another CGI program in C which the system administrator (you) can use to add/remove users to the user list. Passwords should always be stored in an encrypted format.

An example.
When I'm allowed to login on a UNIX system called target.com only once, I can upload the source of REserver, compile the program and run it. At that point, I have unlimited access.
I installed the REinterface CGI program I wrote in C on my ISP's server, www.myISP.com. I can now access this by surfing to http://www.myISP.com/~switz/REinterface. A nice interface appears on my screen. I enter the name of the target machine, target.com. I also enter the command I want to run on the target machine: '/bin/cat /etc/passwd'. Furthermore, I enter my login name and password. After I did all that, I click the button. A couple of moments later, the output appears on my screen: the contents of the file /etc/passwd! (And, of course, if the system admin of target.com configured his system well, I will only see 'No access to /etc/passwd' or an almost empty (shadowed) password file, but our REinterface and REserver work fine and that's the main point!)

Please note: This REinterface sure is a nice piece of web engineering, but you cannot provide any input to the executable after it started. For example, you can't provide any commands to '/bin/bash' or 'command.com' after you started it! A large benefit of this interface is that you don't need to install REclient.exe on your local machine: you can use this interface from wherever you are, provided that you have access to the Internet.

Reversing M$ Window$ Telnet

When you are able to accomplish everything above, you have proved that you have knowledge of both coding and the Internet. But you're not ready yet, no way! A Millennium Strainer isn't something which you solve in a couple of days! Take your time...

Some time ago, I wrote that telnet.exe is the program normally associated with the TN3270 protocol. Well, how about using that?? Notepad.exe has been the target of many reverse engineers: I have seen several Notepads with added functionality. I think that the standard M$ Window$ 95/98 Telnet executable is at least as interesting: a full reverse might be a very good exercise. However, that's not the objective of this strainer. Combine the section 'Remotely Executing' with what I just wrote and you'll understand what you're to do next.

When you arrive at this point, you already have written REclient.exe and you have written several web-interfaces. But there's one more client we want: use your reverse engineering skills to create a client out of telnet which you can use in combination with the same REserver as you used in all cases before. Yes, you're totally right when you conclude that you only have to code one server, but quite some interfaces/clients. :-)

Dive deep into telnet.exe. All code needed to communicate with a target machine is already available, but where is the code you need to modify? Micro$oft helped you a great deal by leaving so much wasted space in the executable: there's quite some room to add your own code. However, I wouldn't be surprised if it would be necessary to add more.

Here are some ideas about what you could try to achieve with telnet.exe.

• Don't associate the TN3270 protocol with REclient.exe. Instead, modify telnet.exe in such a way that it starts REclient.exe when telnet is started with an argument starting with tn3270://. (Telnet immediately closes.) It's not an efficient way of associating the TN3270 protocol with REclient, but it proofs that you know something about reverse engineering. When telnet is started with a normal telnet:// argument, normal communication should follow.
• You could also try to make telnet.exe work as REclient.exe. As I said before: many functions necessary for communication are already present. (Check out the differences between the telnet and tn3270 protocol if you managed to implement the tn3270 protocol in your REserver!)
• When you try to make telnet.exe work as REclient.exe, you could choose to replace functions not needed anymore. But you could also choose to keep it possible to use telnet.exe as your 'normal' telnet client.
• Finally, I always find it very annoying that telnet.exe only knows a couple of 'standard' ports: telnet, daytime, echo, qotd and chargen. Get a list with standard ports and add those ports of which you think they are useful to add. (Don't forget to add the port of your REserver! And don't forget that connecting to that port doesn't work like a normal connection!)

The more you do, the better! Just do what you think you are able to do. The other parts of the Strainer are pretty straight-forward. You should use your imagination (and Zen skills!) with this part: think of what you think would be a nice change to telnet.exe, as long as it is related to the rest of the Strainer!

Essay(s)

Since it's almost getting time for you to start with this assignment, I'll mention a couple ideas of things you could do to achieve a better final result. When you send in your results of this assignment, only sending (commented!) source codes, binaries and scripts isn't enough. Why did you do what you did? And how did you do it? Answer those questions in one or more essays about the development of your results. And since we may assume that you don't develop your final 'product' out of nothing, it probably wouldn't be a bad idea to include some pre-final versions of your programs. Think about it!

Portability

I already mentioned that you should at least make it possible to compile REserver and REclient (and REinterface!) under both UNIX and Windows. To make your programs that portable, you need to use ANSI C functions as much as possible. There are some functions, however, which you'll need, but are not portable. Since we don't want multiple versions of source and header files for Windows and UNIX, you'll have to think of something else. The solution is easy: use some preprocessor directives and a Windows/UNIX flag....

Since there are always differences between C compilers, it could happen that you were able to compile your executables under both Windows and UNIX, but anyone else trying to do the same (with another compiler) could have troubles compiling. To avoid this, don't forget to mention which compilers and operating systems you used. Include all version numbers!

Last words

I already wrote this before, but I can't repeat it often enough: the more you do, the better. Furthermore, you should work slow and basic. Don't try to do everything at once, because you won't succeed if you do it that way. Completing an assignment like this requires knowledge, patience and a little Zen. But I think it's even more important to show that you are willing to learn and that you're capable to do so.

A journey of a thousand miles is started by taking the first step.
-- Chines proverb

Civilisation advances by extending the number of important operations we can perform without thinking about them.
-- A.N. Whitehead

After these wise words, there's not much left to say. You should solve and send in the strainer before mid-September, as usual. If you think you're ready before September, I really think you haven't done enough, even if you did everything I mentioned in this essay. There's so much else you could do to make it even better! (Think of a good name for your project!) Use the time you have!

I'm really anxious to see the results: I can hardly wait till fravia publishes the results on his website. (That will take some time though.) In the mean time, I'll see if I have enough time to complete this assignment myself...

> By all means, +Aescu.
> The surrogate of a strainer I have posted on my site
> was just intended as a "place-holder".
>

>
> If you want to start, beside sending me the new strainer
> (we'll postpone the admission frist  accordingly), 
> you could send me your first lesson for the '99 levy: I'll
> open a password protected part of my fortress so that +Hcukers
> only (or almost, but those that will anyway find their way
> there will be also pretty good AFAICJ :-) will thus partecipate
> and give their precious feed-back. If you prefer an emaillist 
> approach just tell me, I'm sure that +Zero and +Malattia 
> would gladly take care of that.

>
> Happy to have you back on board.
> Lotta things to do.
> Let's sail and reverse along!
>
> Later, +brother
> fravia+
>

You'r deep inside fravia's pages of reverse engineering

  Choose another page! Main page Software reversing Lab Reality cracking Lab Anonymity Lab Site busting Lab How to search Lab --Search engines (light) --Search engines (heavy) Links Tools Javascript reversing Screaming truth Main entrance What's new on fravia's Mail fravia+ +Greythorne's Tools of our trade msgboard Main msgboard

homepage links anonymity +ORC students' essays academy database bots wars
antismut tools cocktails javascript wars search_forms mail_fravia
Is reverse engineering illegal?