Stealing the Network: How to Own a Shadow

450 Pages·2007·9.127 MB·English

by  Johnny Long, Timothy Mullen, Ryan Russell

363_Web_App_FM.qxd 12/19/06 10:46 AM Page ii
384_STS_FM.qxd 1/3/07 10:04 AM Page i
Visit us at
www.syngress.com
Syngress is committed to publishing high-quality books for IT Professionals and
delivering those books in media and formats that fit the demands of our cus-
tomers. We are also committed to extending the utility of the book you purchase
via additional materials available from our Web site.
SOLUTIONS WEB SITE
To register your book, visit www.syngress.com/solutions. Once registered, you can
access our [email protected] Web pages. There you may find an assortment
of value-added features such as free e-books related to the topic of this book, URLs
of related Web sites, FAQs from the book, corrections, and any updates from the
author(s).
ULTIMATE CDs
Our Ultimate CD product line offers our readers budget-conscious compilations of
some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect
way to extend your reference library on key topics pertaining to your area of exper-
tise, including Cisco Engineering, Microsoft Windows System Administration,
CyberCrime Investigation, Open Source Security, and Firewall Configuration, to
name a few.
DOWNLOADABLE E-BOOKS
For readers who can’t wait for hard copy, we offer most of our titles in download-
able Adobe PDF form. These e-books are often available weeks before hard copies,
and are priced affordably.
SYNGRESS OUTLET
Our outlet store at syngress.com features overstocked, out-of-print, or slightly hurt
books at significant savings.
SITE LICENSING
Syngress has a well-established program for site licensing our e-books onto servers
in corporations, educational institutions, and large organizations. Contact us at
[email protected] for more information.
CUSTOM PUBLISHING
Many organizations welcome the ability to combine parts of multiple Syngress
books, as well as their own content, into a single volume for their own internal use.
Contact us at [email protected] for more information.
384_STS_FM.qxd 1/3/07 10:04 AM Page ii
384_STS_FM.qxd 1/3/07 10:04 AM Page iii
STEALING THE NETWORK
How to Own
a Shadow
T C K
HE HASE FOR NUTH
Johnny Long
Timothy (Thor) Mullen
Ryan Russell
384_STS_FM.qxd 1/3/07 10:04 AM Page iv
Syngress Publishing,Inc.,the author(s),and any person or firm involved in the writing,editing,or production
(collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from
the Work.
There is no guarantee of any kind,expressed or implied,regarding the Work or its contents.The Work is sold AS
IS and WITHOUT WARRANTY.You may have other legal rights,which vary from state to state.
In no event will Makers be liable to you for damages,including any loss of profits,lost savings,or other inci-
dental or consequential damages arising out from the Work or its contents.Because some states do not allow the
exclusion or limitation of liability for consequential or incidental damages,the above limitation may not apply to
you.
You should always use reasonable care,including backup and other appropriate precautions,when working with
computers,networks,data,and files.
Syngress Media®,Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author
UPDATE®,”and “Hack Proofing®,”are registered trademarks of Syngress Publishing,Inc.“Syngress:The
Definition of a Serious Security Library”™,“Mission Critical™,”and “The Only Way to Stop a Hacker is to
Think Like One™”are trademarks of Syngress Publishing,Inc.Brands and product names mentioned in this
book are trademarks or service marks of their respective companies.
KEY SERIAL NUMBER
001 HJIRTCV764
002 PO9873D5FG
003 829KM8NJH2
004 YRT43998KL
005 CVPLQ6WQ23
006 VBP965T5T5
007 HJJJ863WD3E
008 2987GVTWMK
009 629MP5SDJT
010 IMWQ295T6T
PUBLISHED BY
Syngress Publishing,Inc.
800 Hingham Street
Rockland,MA 02370
StealingtheNetwork:HowtoOwnaShadow
Copyright © 2007 by Elsevier,Inc.All rights reserved.Except as permitted under the Copyright Act of 1976,no
part of this publication may be reproduced or distributed in any form or by any means,or stored in a database
or retrieval system,without the prior written permission of the publisher,with the exception that the program
listings may be entered,stored,and executed in a computer system,but they may not be reproduced for
publication.
1 2 3 4 5 6 7 8 9 0
ISBN-10:1-59749-081-4
ISBN-13:978-1-59749-081-8
Publisher:Andrew Williams Page Layout and Art:Patricia Lupien
Editor:D.Scott Pinzon Copy Editor:Christina LaPrue
For information on rights,translations,and bulk sales,contact Matt Pedersen,Director of Sales and Rights,email
[email protected].
384_STS_FM.qxd 1/3/07 10:04 AM Page v
Acknowledgments
Syngress would like to acknowledge the following people for their kindness
and support in making this book possible.
A special thank you to all of the authors and editors who worked on the first
three books in the “Stealing”series,each of whom is listed individually later in
this front matter.
To Jeff Moss and Ping Look of Black Hat,Inc.who have been great friends and
supporters of the Syngress publishing program over the years.The Black Hat
Briefings have provided the perfect setting for many Stealing brainstorming
sessions.
v
384_STS_FM.qxd 1/3/07 10:04 AM Page vi
384_STS_FM.qxd 1/3/07 10:04 AM Page vii
Authors
Johnny Long:Author,Technical Edit, Primary
Stealing Character: Pawn
Who’s Johnny Long? Johnny is a Christian by grace,a
family guy by choice,a professional hacker by trade,a
pirate by blood,a ninja in training,a security researcher
and author.My home on the web is
http://johnny.ihackstuff.com.
This page can support only fraction of all I am thankful for.Thanks first
to Christ without whom I am nothing.Thanks to Jen,Makenna,Trevor and
Declan.You guys pay the price when deadlines hit,and this book in partic-
ular has taken me away from you for far too long.Thanks for understanding
and supporting me.You have my love,always.
Thanks to Andrew and Christina (awesome tech edit) and the rest of
my Syngress family.Thanks to Ryan Russell (Blue Boar) for your contribu-
tions over the years and for Knuth.What a great character!
Thanks to Tim “Thor”Mullen.We work so well together,and your
great ideas and collaborative contributions aside,you are a great friend.
Thanks to Scott Pinzon for the guidance and the editorial work.Your
contribution to this project has literally transformed my writing.
Thanks to Pawn.If I have my say,we’ll meet again.
Thanks to the johnny.ihackstuff.com mods (Murf,Jimmy Neutron,
JBrashars,CP Klouw,Sanguis,ThePsyko,Wolveso) and members for your
help and support.Thanks to RFIDeas for the support,and to Pablos for the
RFID gear.Thanks to Roelof and Sensepost for BiDiBLAH,to NGS for
the great docs,to nummish and xeron for Absinthe.
Thanks to everyone at the real Mitsuboshi dojo,including Shidoshi and
Mrs.Thompson,Mr.Thompson,Mr.Stewart,Mrs.Mccarron,Mrs.Simmons,
Mr.Parsons,Mr.Birger,Mr.Barnett,Ms.Simmons,Mr.Street,Mrs.Hebert,
Mrs.Kos,Mrs.Wagner and all those not listed on the official instructor
sheet.
vii
384_STS_FM.qxd 1/3/07 10:04 AM Page viii
Shouts:Nathan “Whatever”Bowers,Stephen S,Mike “Sid A.Biggs”,
John Lindner,Chaney,Jenny Yang,SecurityTribe,the Shmoo Group,
Sensepost,Blackhat,Defcon,Neal Stephenson (Baroque),Stephen King
(On Writing),Ted Dekker (Thr3e),Project86,Shadowvex,Green Sector,
Matisyahu,Thousand Foot Krutch,KJ-52 (Slim Part 2).To Jason Russell,
Bobby Bailey and Laren Poole for the Invisible Children movement
(http://www.invisiblechildren.com).
Timothy (Thor) Mullen: Created concept for this
book,Author,Technical Edit, Primary Stealing
Character: Gayle
Thor has been educating and training users in the tech-
nology sector since 1983 when he began teaching
BASIC and COBOL through a special educational pro-
gram at the Medical University of South Carolina
(while still a high school senior). He then launched his professional
career in application development and network integration in 1984.
Timothy is now CIO and Chief Software Architect for Anchor
Sign,one of the 10 largest sign-system manufacturers in America.
He has developed and implemented Microsoft networking security
solutions for institutions like the US Air Force,Microsoft,the US
Federal Courts,regional power plants,and international
banking/financial institutions.He has developed applications ranging
from military aircraft statistics interfaces and biological aqua-culture
management to nuclear power-plant effects monitoring for private,
government,and military entities.Timothy is currently being
granted a patent for the unique architecture of his payroll processing
engine used in the AnchorIS accounting solutions suite.
Timothy has been a columnist for Security Focus’Microsoft
section,and is a regular contributor of InFocus technical articles.
Also known as “Thor,”he is the founder of the “Hammer of God”
security co-op group.His writings appear in multiple publications
such as Hacker’s Challenge,the Stealing the Network series,and in
Windows XP Security.His security tools,techniques and processes
viii