8 ms·
Back in the good old days of the early(er) internet, back when you could do a port search on 21 to find random machines with anonymous FTP access, a lot of the
by koyote 8y ago
Back in the good old days of the early(er) internet, back when you could do a port search on 21 to find random machines with anonymous FTP access, a lot of the machines you'd find were inevitably Windows machines.
A 'trick' used by the file-sharing community in order to hide their files on these anonymous FTP servers was to create some nested directories with these kind of keywords. The FTP server allowed you to create the directories as well as access them (if you knew the full path) but on Windows they would just cause errors or crashes if someone tried to access them. Combine that with the ability of creating directories with just spaces as names and you could hide quite a bit of stuff from the unsuspecting FTP server administrator.
- enraged_camel 8y ago>>Back in the good old days of the early(er) internet, back when you could do a port search on 21 to find random machines with anonymous FTP access Man, I remember doing this to find video game executables. Good times.
- petters 8y agoHow did the Windows ftp create the files with protected names? Shouldn't it have crashed, like the blue screen-causing <img src="C:/con/con">
- zapzupnz 8y agoSince the special filenames were handled at the OS level, any crash would have required the OS to mount the FTP directories. I don't think Windows' FTP program ever mounted anything, meaning the directories were handled by the program and not by the OS. When you copied anything to your local Windows machine, the file would automatically be copied to a directory with a safe name rather than mimicking the directory hierarchy from the remote server.
- koyote 8y agoTo be honest, I don't know. This is nearly 20 years ago now. I assume the FTP server created the directories using a different file-system API call than Windows Explorer. Here's a post by someone who found one of these directory structures on his FTP server back in 2003: http://www.informit.com/articles/article.aspx?p=31278 http://www.informit.com/articles/article.aspx?p=31278
- nodja 8y agoMy guess is that there's 2 APIs to access files, a user mode API and a kernel mode API, and this special casing is only available in the user mode one. If the FTP server uses the kernel API it bypasses the special case file handling.
- gpvos 8y agoThe guy forgot to try to log into the ftp server itself to delete the files. After all, if the ftpd program used the correct APIs to create the directories and files, it would probably also use the right ones to delete them.
- d_k_f 8y agoJudging by how the article was written, that probably wouldn't have helped him. You couldn't delete these directories directly, but rather had to delete the nested "unnamed" directory: “/path/to/COM1/ /“, which is also how you would create the directories in the first place. Usually, the tag-directory would also go along with a list of directories explaining that you should not create "undeletable" directories on NT-based servers, as that would annoy the admin and might cause them to remove anonymous access. You were only supposed to create large mazes of directories to prevent other random anonymous users from finding and deleting your files.
- josefx 8y agoAs far as I know you can bypass that with a \\?\ prefix in the path. This tells the API that your path is a full NT file path, similarly the devices are mapped into \\.\ . Of course many tools on windows were not aware of that, so anyone trying to delete "C:/con/con" would run into the issue that they needed a tool which would delete "\\?\C:\con\con" instead.
- abtinf 8y agoThere has always been a discrepancy in capability between win32 file-related APIs and GUI tools. Even in Windows 10, it is possible to use the APIs (as simply as through, say, git bash) to create files and directories inaccessible (even for deletion) to Explorer.
- roel_v 8y agoBack around the turn of the millennium, this was a great way of getting the latest releases of all sorts of warez groups. Put a machine on a public network somewhere, install ftp server, 'forget' to disable anon access to /pub, watch crappy cams of the matrix in your dorm room before anyone else. And if anyone came knocking about the bandwidth use - duh silly me, those hackers had me fooled again... The only thing was that you had to access your own machines with an ftp client because of path tricks like this. (Or get a Linux box, and cross your fingers nobody would find yet another wuftpd buffer overflow)
- stevekemp 8y ago> cross your fingers nobody would find yet another wuftpd buffer overflow wuftp was responsible for the popularization of format-string attacks, which were magical at the time. We all knew about buffer-overflows, and when it was explained format-string attacks were obvious, but it was the first time I'd seen a genuinely new class of software attacks. Happy memories!
- achillean 8y agoCurrently, there are ~700,000 FTP servers that allow anonymous access and around 12% of them are running Microsoft FTP: https://www.shodan.io/report/oZpN8rpp https://www.shodan.io/report/oZpN8rpp
- sverige 8y agoAnd the rest are Linux boxes.
- icebraining 8y agoDo they allow write access, though?
- TimTheTinker 8y agoIn my high school’s Windows For Workgroups 3.11 lab, we used to hide local installs of Doom, Descent, and other DOS games under a folder named the character Alt+255 (which looks like a space in DOS and was invisible to Windows Explorer). The lab admin had disabled Ctrl+C and Ctrl+Break to keep folks from breaking out of the DOS-based login prompt to a C:\ prompt, but I somehow figured out that Alt+3 passed an equivalent character and had the same effect. I once got yelled at for being “in the lab too much” by one of the teachers, but I never got in any trouble. I suspect the lab admin (a kind older programming and math teacher) knew what we were up to.
- PopeDotNinja 8y agoMy friends & I used to play Netrek in the Mac lab, which was against the rules. When the lab assistant would walk into the lab, we'd all hit the reboot button. Hearing ~10 simultaneous ding noises was pretty hilarious. He knew what we were doing, but never caught us in the act, and I suspect he found it more amusing than not.
- classichasclass 8y agoAround my branch of the University of California it was Marathon. When the lab got Power Mac 7100s, it was full at all hours with people playing, which made it impossible to get any actual coursework done.
- xvf22 8y agoI had a similar experience but amongst other things I got everyone's passwords and figured out how to bypass / control this weird bookshelf launcher whose name escapes me now. The head computer teacher found out but didn't make a big deal about it. Instead, me and a friend ended up getting hired by the school for our last year and got an office with a coffee machine since we were easier to deal with than the school boards IT.
- ndespres 8y agoI wonder if you're talking about the launcher for managed classic Mac workgroups, At Ease. I have an almost identical experience to you, including the coffee machine (though more of a closet than an office).
- aaaaaaaaaab 8y agoNowadays you can do the same with random S3 buckets of various companies (:
- agumonkey 8y agoMemories of fxp
- ru999gol 8y agoI also remember people hacking IIS, SQL Server, WebDAV or exploiting one of the hundreds of RPC/DCOM/LSASS vulnerabilities in Windows, the servers were then used to start private FTP servers used to sharing warez. At least that was something the FXP community did, the FTP servers were then filled very quickly from other FTP servers (hence the name FXP, File eXchange Protocol). Thinking back to it, it was quite astonishing how horrific Windows security was, to think that people (to this day even) are seriously considering Windows a viable server operating system still makes me laugh.
- cesarb 8y ago> exploiting one of the hundreds of RPC/DCOM/LSASS vulnerabilities in Windows And then Microsoft got tired of it, and (IIRC starting with Windows XP SP2) locked it down. Now if you have a legitimate need to use DCOM (for instance, OPC-DA), you have to jump through a series of hoops.
- cakes 8y agoI'd forgotten all about interop with DCOM until just now! Several years ago (when I last had to do it) I recall having to horribly mess with services on my local machine just to get anything to appear to work...let alone actually knowing if it did what I wanted (consistently) and then how to get that to work at a customer site (we were told to document it and throw it over the wall to support...)
- cesarb 8y agoSee chapter 4 of this PDF for an idea of the amount of settings you need to change to make it work: https://www.kepware.com/getattachment/04042e47-c690-467c-a931-a1ca126575db/Remote-OPC-DA-Quick-Start-Guide-(DCOM).pdf https://www.kepware.com/getattachment/04042e47-c690-467c-a93...
- berti 8y agoOPC-DA is the worst. Fortunately at least a few vendors are pushing OPC-UA (no DCOM!), but the whole industry moves like molasses.
- nawtacawp 8y agoIt all seems like a fuzzy memory now. My exposure to warez started with BBS then migrated to IRC/FTP. As a teenager during this time I remember how many enterprise networks were easily compromised. Seeing this from the outside, I just figured that security wasn’t important to them — or they didn’t know how to manage their security. I wonder if that was really the case in the early internet at an enterprise level. Did security take a backseat to functionality?
- ProuGrammer 8y agoFrom first hand experience, it still does.
- dopeboy 8y agoThis was a common exploit during the hey day of the FXP scene.
- fatnoah 8y agoIronically, I downloaded my first copy of Windows 95 from one of these FTP sites.