The Disclaimer

I don't encourage illegal activities, I really mean this! And if you really want

to try something against the law, and you get caught I have warned you, hehe :p

Introduction

This is the first tutorial I have wrote. It was intensely only written for BSRF

(Black Sun Research Facility), and it will be properly not the last one :)

though. So if you discover some errors, please let me remind you this was my

first one. Last note before I will begin writing about "Cracking Netware", at

the moment you can't contact me by e-mail or whatsoever... I rather remain

'hidden', for the moment.

Index Novell Netware tutorials:

Novell Netware - Cracking Netware

Maybe I'll write an advisory for system administrators or even my own found

vulnerabilities in Netware, but remember I can't guarantee anything!

It's possible that I'll write some other tutorials about different topics as

well.

Well this one will be about:

Novell Netware - Cracking Netware (v 1.04)

Like many other Operating Systems Netware original (before 5.xx) doesn't work

with the TCP protocol, it uses it's own protocol called Internet Packet eXchange

(IPX). This protocol isn't vulnerable at the moment to any kind of Denial of

Service (DoS) attacks like SYN-flood, while the TCP protocol is. Because Netware

didn't get much attention from crackers they thought there system was

impenetrable, and so they didn't much about security updates. Now many of you

guys think this is really cool, and think they can crack any Netware server with

some help from the many tools that are available online. Well, I can tell you

that's not that easy.

The most important reason; Which Netware version they run, if running version

4.1 or higher the change you will sneak in unnoticed will be really small.

Unless you have to deal with some really lame most times lazy system

administrators.

If the system administrators patch the Netware server(s) on regular base...

Also if you have some kind of permanent account with standard Netware rights,

not one who's adjusted.

You will need much time and don't be disturbed. Especially in classrooms this

will be difficult to get, so you have to find a way with Social Engineering to

accomplish this :(

Before I continue with Netware security and how to bypass it, first I'm going to

tell you something about Servers & Clients.

After a Netware client in Windows 9x has been installed it's possible to access

the Netware server. When you arrive in Windows you'll see a login screen. Before

you have logged into the network the "client <--> server" has already

established a connection with each other, only this connection isn't validated

by the user who created the connection! You can see this connection on the

console when monitor.nlm is loaded. You people don't know what the console

means? Ok, I'll explain. The server is nothing less but a computer, not a normal

one like a desktop or tower. No call it a very big tower. On this machine the

Netware server software is installed, when you turn on this machine first dos

(6.22 or lower) will be loaded. After this you can boot Netware by executing

file "server.exe", now many files will be loaded and you'll get a lot of

messages. It looks like when you're booting a Linux machine. After the boot

process you look at a sort of dos screen, this is called the console. At the

console you have the highest rights on the particularly Netware server. You can

down the server any time you want with just one simple command. So the main

group of crackers tries to get this access. But there are many different ways to

crack a Netware server. It just depends on what you want to do at the Netware

server.

By default you have the following rights on a Netware server:

User: Normal user who can access some files in //public, //login and //mail.

Mostly they have some print rights too, also have a home directory.

SuperUser: At school's this right has been given to teachers. They can view

students accounts and delete files if necessary. They cannot create,

delete or change accounts from the NDS.

SuperVisor: Only the system administrators are permitted to control everything

on the file system and the NDS. When they want to down the server they have to

walk to the console, or do it remote by starting a program called rconsole which

stands for "Remote Console". The word explains itself. For security reasons they

first have to load "remote.nlm" and "rspx.nlm" at the console. So by default

these NLM's aren't loaded.

Console: This is the highest right on a Netware server, once you have gained

this rights illegal nothing can stop you at the moment but a power failure. Also

be aware of the log files! Many crackers who have gained console right have been

snapped by them, and if you are dealing with very smart system administrators,

they have some program that automatically sends the logs to an off-line

location. And once they have arrived overthere you have a serious problem...

When you want to gain some high level access on a Netware server, remember

that this can be done in many ways I explain two differents ways.

A note before trying one of the two ways. Way one will require a lot of luck,

some skills of cracking and also some tools. Way two will require a lot of time

(two weeks maybe a month). You have to see for yourself what's the best way. O

by the way, if you want to get some high level access while trying way one...

remember it's critically you don't make any mistakes, because the properbility

you'll be caught is high (log files and some other things)!

Please first read the tutorial, before trying one way or another. I really

recommend it!!!

First way

If you are very, and I mean very lucky the system administrators could have

loaded "remote.nlm & rspx.nlm" on the Netware console. Try to find a program

called "rconsole.exe", normally you can find this program in the following

directory on the Netware server "//public". If you haven't file scan or read

rights on this directory, you have to get this program at another way. The

program needs alot of other files before you can execute it, so download these

too! To make it a little harder for our 'beloved' system administrators to trace

you (and give you more time), don't verify yourself to the server while trying

access the console by remote! Before they know who's trying to establish a

connection to the Netware server, they have to walk to the server and load

monitor.nlm. Now they can see the attackers ethernet address, from at this

moment they can close your connection to the server any time they feel fit. But

mostly they want to collect some evidence against you, so they just let you

'crack

the server'. In meantime you have already spend some minutes guessing the

correct console password, and every attempt has been written automatically to a

logfile. Or even worse, every attempt has also been written to their monitor

including (again) your ethernet address, and if you guessed the password right

or not. This sucks, doesn't it? Well we can combine these two problems into one

solution. But again you'll need some luck! Here we go:

The most difficult problem will be getting the password, because you don't have

enough time to guess the password, even with some kind of bruteforce-crack

program you haven't, we need to approach this problem from another way. Now

you'll need some luck because for this trick the following nlm's have to be

loaded: "remote & rspx" at the console! The system administrators will only

load these if they want to check the console (remote) regularly, as I explained

before. Just try to access the console with "rconsole.exe" to verify if those

nlm's are loaded, note only try this once! If you get a blue empty window, well

skip to part two! Well when you are sure those two nlm's are loaded, continue

reading, if not skip to the second way to crack Novell Netware.

When the system administrators are accessing the console they also have to enter

a password. This password is being send in plain text over the network ( plain

text means: unencrypted). If you're dealing with Netware version 4.11 or higher,

skip to way two because the transmitted console password is encrypted!

When you have the same node address as the system administrators have, it's

possible to intercept (sniffing) the packets from the system administrators to

the console. You are questioning yourself "How do I know?", the answer: If

you're on a small network with approximately 10-50 users you are on the same

node address. Unless you're dealing with some paranoid system administrator. If

you're dealing with some bigger kind of network you have to get yourself a copy

of a program called "getconn.exe" that reveals the node address of the Netware

server. Again you do need some luck, if you're not on the same node address as

they are, skip to way two.

Dont's make the following mistake: When an user or the system administrator is

logging into netware, it's completely senceless to 'sniff' this password.

Because this password is encrypted with RSA encryption. The next time the person

will (re-)login the encryption will be changed.

We now arrive at properly the most difficult part of all.

What we now need is a packetsniffer that supports IPX sniffing, I recommend

"SpyNet" for the job. Install and execute SpyNet. Configure SpyNet so it will

write all captured packets to one file. Let the program run a couple of hours,

because the system administrators have to access the console remote. You can use

your social engineering skills to speed up this process. One way to do this is

to call them and say you think someone is trying to crack their network. Don't

sound to professional because they could suspect you're the one doing something

illegal! Remember when you're sniffing, and write the packets to disk:

First: This will take really some network occupence, so if you'll run the

program to long (a day or more) the system administrator will detect an

intruder... Oohw by the way, if the network is protected by some intrusion

Detection Programs your sniff attemps will automaticly reported to the system

administrator's. There are (as usually) some anti-anti-sniffers. But this is a

whole other story, so I decided NOT to mention it any further.

Second: It's almost impossible to write all sniffed packets(frames) to disk,

especially not when the network is overloaded... also remember your ethernet

card is 10/100 mbit/s, and almost all times the network traffic does exceed

above this value.

Almost all sniffers does have an option to only write packets from a specified

address to disk. This has ofcourse some advantages... (more stealthy and less

disk space is needed).

Once you've the packets which contain the password, you have to find a way

yourself to extract the password from Spynet's logfile. Note, the password is

separated into many packets. Example: If the password would be "Netware" you'll

could find the password in this order:

packet 34643: j

packet 34644: 6

packet 34645: n

packet 34646:g

packet 34647: 8

packet 34648: e

packet 34649: f

packet 34650: t

packet 34651:2

packet 34652:w

packet 34653:a

packet 34654: l

packet 34655:r

packet 34656: d

packet 34657: 4

packet 34658:e

packet 34659: v

As you see, this could take some time before you find it, note netware is not

case sencetive! When you get the password, access the console remote as soon as

possible and create a supervisor account. If you don't know how to create one,

just download burglar.nlm from (blacksun.box.sk) and before trying anything with

the program, first take a good look at the readme.

When you're finished with anything you want to do at the Netware server,

remember to erase the logfile! You'll find the file in the /etc/console.log, you

can delete this file at the console. Just unload "conlog.nlm" and then load it

again! Now the old logfile is being overwritten by the new one, if you terminate

the connection between you and the server your ethernet address will be written

to the new logfile! So before quitting I suggest to unload once more the

"conlog.nlm". Now you can quit the remote session with ALT-F1.

NDS Addon:

If you really want to do some damage you have to delete the files where the NDS

(Netware Directory Structure) is being stored. These four files are located in

an hidden directory named "/_netware". You can only access this directory from

the console with the program "monitor.nlm". Remember: If the system

administrator's doesn't have backup's of these files, they have a really big

problem.

Some problems i'm aware of:

Nobody can log into Netware anymore, even the admin can't!

All information about the users, containers, scripts, printers, bordermanager

are permently lost!

If there are multiple Netware servers (almost always) connected to eachother,

who are sharing one NDS... well they have to install the Netware Server software

again on all servers.

And the system administrator's have an hell of a job to backup all data from

console.

I really recommend and I seriously do, to backup these four files to a

floppydisk, in case you'll get caught. And if you have a little respect for them

please send them the disk with those four files anonymously. Because it will

take weeks to restore everything. I do really mean this!

Second Way

The primairy goal here is to gain access to all files and folders at a Netware

server. This is NOT the same as console access! Note: This way takes very lot of

time and patience.

When you have a normal user account on any particularly Netware server, you only

have read&write&remove rights at your homedirectory. But what you proberly don't

know is that you also have some read rights at: //public, //login and //mail.

But you cannot 'see' these directory's because they aren't mapped to a logically

drive. I explain... Whenever you have typed in your username and password, the

Netware server will granted you the rights to all directory's and files the

system administrators have allowed you. If your homedirectory is at

//home/yourhomedir you have to browse to //home/yourhomedir to view files over

there.. But if your homedirectory is located somewhere 'deeper' in the

directorystructure , like //home//school/it/it2/class2c/yourhomedir then it

takes some time to get to your own directory. So here's where drivemapping comes

along. When you have created a drivemapping to

//home/school/it/it2/class2c/yourhomedir, just click onto the specific station

(by default "z:\") and now you are directly transmitted to yourhomedir. The

local system administrators have created a login script that will do this task

for you every time when you're logging into the network. Now you know what drive

mapping means... So as I told before, by default all users (including normal

users) have only read access to //public, //login and //mail.To access these

directory's you'll have to create a drivemapping to them. The most important one

is //public. In this directory you'll find all sorts of binary files and some

clients like "rconsole.exe". So, map this directory to a logically drive for

example "y:\".

It will really come in handy if we have some 'other' accounts for the following

part. Otherwise you'll have to explain to the system administrators what you

were doing last week in the late afterhours at school or work. In other words we

need a few other accounts at the netware server. It's really not advisible to

use an account from a student or college at work, if you know his/her password

ofcourse! The best accounts for the crack job is one of the printer or backup,

and most times it has a NULL password! Sounds good, doesn't it? Well I can make

it even better, remember I told you that ALL users have (by default) read rights

to //public, //login and //mail? So does these accounts have them too... The

only problem is to guess the correct usernames. Many Novell Netware tutorials

will give you some default printer accounts, but many times these accounts

doesn't exists anymore. So I'm going to explain how to get existing usernames at

your local Netware server. Here weg go:

First you'll need to run a binary file at //public/win95/nwclnt95.exe, when all

the loading work is done you'll see a window like 'explorer' from Windows.

You're now viewing at the NDS (Netware Directory Structure). Inhere all

information (containers, scripts, printers & accounts) about the netware server

is being strored. Search inhere for a name with the word(s) print, printer, ps

or pservice. It's possible you find multiple printer accounts like printerti,

printersys or psserv. If you didn't find anything you have to try to get some

accounts a different way, grab a program called "chknull.exe" made by NOMAD (The

Noturious Netherlands Hacker). This program will check all existing netware

account for NULL passwords. If this program didn't find anything, you really

have a bad day and it's advisible to stop reading this tutorial right here :'(.

If you did found something, always doublecheck before you are doing anything

(wrong) with it. You really have to be sure if it's really a printer or

backup...

Now you have some Netware accounts with NULL passwords we can continue.

Note: Never change passwords from hijacked accounts, the properbility the system

administrator will discover it, is way to riscy. And if you change the password

from a printer, nobody can print anything anymore! You can guess that it only

take a few hours before the system administrator's will discover the leak. Now

log into the Netware network with the 'stolen' accountinformation, and if you

are lucky the system administrator's have granted some dir&filerights. By the

way if the system administrators are using Netware Bordermanager as Firewall and

/ or HTTP Gateway you can't surf the web without suffients rights. But most

proberly you can surf the web when you are logged in as printer (i could)! This

could come in handy when you need to reach the database from packetstorm for

some kind of exploit. Nevertheless use HTTP only when it's really necessary!

Because the firewall will log all requests to the outside world. And we don't

want to make the job to easy for the system administrator's!

Again I hadn't enough time to complete this tutorial so I will continue this

subject in Version 1.04. My problem is always the goddamn time.