-------[  Phrack Magazine --- Vol. 9 | Issue 55 --- 09.09.99 --- 01 of 19  ]


-------------------------[  P H R A C K     5 5     I N D E X  ]


--------[  Return of the Genius Loci  ]


Lies!  Lies!  Lies!  Lord of the Lies.  That's me.  I promised a timely Phrack
and look what happened.  A 9 month lapse.  Whew.  Wow.  Ri-friggin-diculous.
Holy crap I suck.  To all you patient/ambivalent readers out there -- terribly
sorry about that.  To all you whiners/complainers in the end, it just goes to
show you: Fuck Off.  For all you people that contributed nothing except
negative commentary over the past few months, I'd like to introduce you to
the real world.  The real world is where free computer security technical
journals don't pay bills or get you chicks.  Or get you chicks that pay bills
for that matter.

THAT'S THE WORLD I LIVE IN.

TRUST ME WHEN I TELL YOU I WOULD CHANGE IT IF I COULD.

But I can't.  So I do what I do to make ends meet.  Sometimes it gets in the
way.

Hrm.  You think 9 months is bad?  Let's take a look at the publishing history
of Phrack Magazine, since its inception, way back in November of 1985.  I
present to you the publishing schedule of Phrack Magazine from 1985 - 1999.

______________________________________________________________________________
Jan |      02?  10        23                                           52
Feb |      03   11        24
Mar |      04   12        25             37   42   45
Apr |      05   13   17   26             38             47        50
May |                          31
Jun |      06        18   27             39
Jul |           14   19                       43                       53
Aug |           15                       40
Sep |      07                       33             46        48   51        55
Oct |      08?  16?  20   28        34
Nov | 01             21   29   32   35        44             49
Dec |      09?       22   30        36   41                            54
------------------------------------------------------------------------------
    | 85   86   87   88   89   90   91   92   93   94   95   96   97   98   99
------------------------------------------------------------------------------

Ok..  Things look pretty good for the first year...  8 issues in one year.
Not bad fellas, not bad...  Uh-oh!  A 6 month gap between 16 and 17!  What's
up?  Apparently, the editors at that time (Phrack's founding fathers TK and
KL) had gone off to college and left the Magazine in the hands Elric of
Imrryr.  Mmmhmm.  A FLIMSY EXCUSE!  The next large gap we see is between 32
and 33.  Apparently there was some crap going on having to do with the Secret
Service shutting Phrack down and something about issues 31 and 32 not being
sanctioned or something...  Blah blah blah.  Ok great.  This was like 8 years
ago.  Who the hell carez.  At any rate, things appear to be pretty much
business as usual after that.  Then something amazing -- Chris Goggans takes
over.  First a 3 month gap.  Then a 4 month lapse.  Then back down to 3.  Then
up to 5.  Then 6.  Then the unthinkable happens.  A 16 month coma.

THEN YOURS TRULY TAKEZ OVER AT THE HELM AND BREATHEZ SOME LIFE INTO THIS DEAD
BODY!

BOOM BAP!  Check out THESE NUMBERS: 2 months, 4 months, 4 months, 3 months, 5
months!...  Um.  9 months.  Ok.  Well.  Oops.  My point is...  Well.  9 months
isn't as bad as Goggans.  So there you have it!  Basically, when all's said
and done, at the end of the day, I am not as bad as Goggans.

In any event, this issue has a surplus of good articles.  Read them.

In other news, we heard a nasty rumor.  Starting September 11th, 1999 Network
Solutions "the dot com people" (*how adorable*) are going to start their
policy of requiring prepayment at the time of domain-name registration.  What
does this mean to you?  NO MORE FREE DOMAINS FOR THREE MONTHS!  No more `try
before you buy`, no more `cooling-off` period.  If you fuck up and register
`masster-ninja.com` brother, you're stuck with it!  So check your spelling.

Oh yah.  I have something very un-P.C. to say, something very controversial... 
Something you're not going to like..  But I have to say it:  

                            GOD BLESS CANADA!

WAIT.  HOLD ON.  Before you rm this issue, give me a chance to explain why
Canada rules.  If it wasn't for Canada, there would be no t00nces.  There.
That's the sole reason why Canada rules.  If it wasn't for t00nces, there
would have probably been a murder at the last Phrack sponsored BBQ (or at
the very least, some serious battery).  On 3 separate occasions he quelled
major rucki.  The largest of which would have resulted in drunken dirtbag
being pummeled into chowder.  He would have been a little smudgie on my
front lawn.  As much as I am usually down for a drunken dirtbag pummeling,
we can't have that at the house.  t00nces is an all-around great guy.  He's
definitely my favorite Canadian-American citizen.

Besides.  I lost our Country's pride when I played him in our monthly America
vs. Canada pool game.  My penance was to write a treatise on how much Canada
rules.  Well.  The best I can do is how much t00nces rules.

Phrack Magazine mourns the recent passing of W. Richard Stevens.  For a special
tribute, please see P55-04.

Enjoy the magazine.  It is by and for the hacking community.  Period.


-- Editor in Chief ----------------[  route
-- Phrack World News --------------[  disorder
-------- Elite -------------------->  daveg
-- Official Phrack King Crab ------[  loadammo
-- Official Phrack Girlfriend  ----[  A.R.A.
-- B.A. Baracus Phrack Fracas -----[  PETE F. vs. KRIS C.
-- Official Phrack Long Gun -------[  Bennelli M1 Super 90 (tactical)
-- WHOA HO HO ---------------------[  aaronb
-- Netris Championz ---------------[  prym & ReDragon
-- Ketel One Connoisseur ----------[  vision
-- Official Phrack Bouncer --------[  t00nces
-- Congratulations to -------------[  W.O.F. and N.R.A.
-- Special Thankz to --------------[  kweiheri, kamee
-- Shout Outs and Thank Yous ------[  h4g1z, felix, WAYNE, rfp, nocarrier, dug
-----------------------------------|  song, incr, dreck, nicnoc, e5, sw_r,
-----------------------------------|  greg hoglund and dark spyrit, sangfroid,
-----------------------------------|  dnm
- You're not in the club if -------[  you don't recognize half of these people

Phrack Magazine V. 9, #55, September 09, 1999.  ISSN 1068-1035
Contents Copyright (c) 1999 Phrack Magazine. All Rights Reserved.  Nothing
may be reproduced in whole or in part without written permission from the
editor in chief.  Phrack Magazine is made available to the public, as often as
possible, free of charge.  Go nuts people.

Contact Phrack Magazine
-----------------------
Editor in Chief:    [email protected]
Submissions:        [email protected]
Associate Editor:   [email protected]
Commentary:         [email protected]
Phrack World News:  [email protected]

Submissions to the above email address may be encrypted with the following key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGPfreeware 5.0i for non-commercial use

mQGiBDdmijIRBADrabrDFYw6PRDrRRZsgetOOGo8oGROn4/H7q4L7rLm7weszn4L
8j1zY4AV4f3jFis0A/AqXPicxUHz0I3L6PzTMg11mmLbcj6wnAvr78LZ65y3Z5aA
PEm/F7fNqAzFl9MCnUWa+53eH0TBKW7JdjpfCELeXTMLNsJREjL7f5qvyQCg/xqD
g7dUtdIiDb7tm5DRhWqgDmED/iPUmujMt5x40bmf135vjev1Rle3nhHIe4fh58a7
VkZOmzqz/s3LninBuWcmuyZWShVGd8Hhd758yt41Xe/YHtEW4jSzYtE/1woYmp0K
sZnFt+zIVAEm1mcVVV9+qrpEKVmbBLTR/oa+6A+t5/hFUjriTpAQUGF0xLzXNLYu
c7cSA/0Q0rziq5xyuPbtUMKWE9zhxrt/SwfhunWx/n2vm2q9eFPfWqb9fDVuFrtv
gwpaPVJ2CbM6F6c21pNGqm8zrSO8TYzgTScBKM80wn7ase3RBth36++N/Oq4Zczm
froc9Och7qkgdZ7TkPCuorsyMc1169DXBxBSGfiQ85ylUYrbrLQRTWlrZSBELiBT
Y2hpZmZtYW6JAEsEEBECAAsFAjdmijIECwMBAgAKCRAWHraAlbJmQSdiAKCjaUrs
InxTXebFlAX5aUmdEKsD1wCfRZMfzv3BvQMKa6Rmbwlfzat0DFS5Ag0EN2aKMxAI
APZCV7cIfwgXcqK61qlC8wXo+VMROU+28W65Szgg2gGnVqMU6Y9AVfPQB8bLQ6mU
rfdMZIZJ+AyDvWXpF9Sh01D49Vlf3HZSTz09jdvOmeFXklnN/biudE/F/Ha8g8VH
MGHOfMlm/xX5u/2RXscBqtNbno2gpXI61Brwv0YAWCvl9Ij9WE5J280gtJ3kkQc2
azNsOA1FHQ98iLMcfFstjvbzySPAQ/ClWxiNjrtVjLhdONM0/XwXV0OjHRhs3jMh
LLUq/zzhsSlAGBGNfISnCnLWhsQDGcgHKXrKlQzZlp+r0ApQmwJG0wg9ZqRdQZ+c
fL2JSyIZJrqrol7DVekyCzsAAgIH/jCj4drT8VSrxI2N3MlgkiQOMcaGLE8L3qbZ
jyiVolqIeH+NEwyWzCMRVsFTHWfQroPrF30UsezIXuF0GPVZvlzSSB/fA1ND0CBz
9uK9oSYPwI8i513nMaF03bLWlB07dBqiDUcKgfm/eyPGu5SP+3QhVaERDnBOdolZ
J6t3ER8GRgjNUyxXOMaZ4SWdB7IaZVph1/PyEgLLA3DxfYjsPp5/WRJcSbK3NZDG
cNlmozX5WUM7cHwEHzmYSRDujs/e3aJLZPa7stS9YGYVPZcjxQoE6wr+jx4Vjps4
pW+f6iWvWEfYnYRJqzwe8318rX6OojqHttaQs8xNEqvPOTfkt12JAD8DBRg3Zooz
Fh62gJWyZkERAj61AJ41XyTBasgKKYlOVnI4mWZYJemQIQCgiqaTkhpM6xCnqKD9
BKnOvDsNc44=
=IQ3Y
-----END PGP PUBLIC KEY BLOCK-----

As always, ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED.  Phrack goes out
plaintext.  You certainly can subscribe in plaintext.

phrack:~# head -20 /usr/include/std-disclaimer.h
/*
 *  All information in Phrack Magazine is, to the best of the ability of the
 *  editors and contributors, truthful and accurate.  When possible, all facts
 *  are checked, all code is compiled.  However, we are not omniscient (hell,
 *  we don't even get paid).  It is entirely possible something contained
 *  within this publication is incorrect in some way.  If this is the case,
 *  please drop us some email so that we can correct it in a future issue.
 *
 *
 *  Also, keep in mind that Phrack Magazine accepts no responsibility for the
 *  entirely stupid (or illegal) things people may do with the information
 *  contained herein.  Phrack is a compendium of knowledge, wisdom, wit, and
 *  sass.  We neither advocate, condone nor participate in any sort of illicit
 *  behavior.  But we will sit back and watch.
 *
 *
 *  Lastly, it bears mentioning that the opinions that may be expressed in the
 *  articles of Phrack Magazine are intellectual property of their authors.
 *  These opinions do not necessarily represent those of the Phrack Staff.
 */

-------------------------[  T A B L E   O F   C O N T E N T S  ]

01 Introduction                                     Phrack Staff        014 K
02 Phrack Loopback                                  Phrack Staff        051 K
03 Phrack Line Noise                                various             037 K
04 Phrack Tribute to W. Richard Stevens             Phrack Staff        004 K
05 A Real NT Rootkit                                Greg Hoglund        066 K
06 The Libnet Reference Manual                      route               181 K
07 PERL CGI Problems                                rfp                 017 K
08 Frame Pointer Overwriting                        klog                020 K
09 Distributed Information Gathering                hybrid              010 K
10 Building Bastion Routers with IOS                Brett / Variable K  037 K
11 Stego Hasho                                      Conehead            037 K
12 Building Into The Linux Network Layer            kossak / lifeline   044 K
13 The Black Book of AFS                            nicnoc              011 K
14 A Global Positioning System Primer               e5                  015 K
15 Win32 Buffer Overflows...                        dark spyrit         078 K
16 Distributed Metastasis...                        Andrew J. Stewart   031 K
17 H.323 Firewall Security Issues                   Dan Moniz           015 K
18 Phrack World News                                disorder            021 K
19 Phrack Magazine Extraction Utility               Phrack Staff        021 K

                                                                        711 K

-----------------------------------------------------------------------------

    "...Yeah, yeah, Phrack is still active you may say. Well let me tell you
    something.  Phrack is not what it used to be. The people who make Phrack
    are not Knight Lightning and Taran King, from those old BBS days. They
    are people like you and me, not very different, that took on themselves
    a job that it is obvious that is too big for them. Too big? hell, HUGE.
    Phrack is not what it used to be anymore. Just try reading, let's say,
    Phrack 24, and Phrack 54."

    - bjx of "PURSUiT" trying to justify his `old-school` ezine.  bjx wrote
      a riveting piece on "Installing Slackware" article.  Fear and respect
      the lower case "i".


    "We might get a PURSUiT meeting at DefCon 9 which will take place in year
    2001.  Meenwhile, it's an idea, because I belive 40% of the PURSUiT crew
    are going to DefCon 9, so we will try to convince the rest of the crew
    to join us."

    - bjx of "PURSUiT" on his distant defcon plans.  Hey, buddy, if you
      save a dollar a day for the next two years, you should have enough!


    "I assume she did a jiggly +liar search on altavista..."

    - gheap, when asked to venture a guess as how a certain person was found
      on a random corporate webpage.


    "Hrm..  There just arent enough web sites that use the word `jiggly`."

    - gheap, after putting some thought into it.

-----------------------------------------------------------------------------

----[  EOF