≡ Menu

telnet command

My ISP provided me 5 free email ID, each with 1 GB size. However, one of the POP3 account has been spammed with over 2500+ spam messages. Getting those entire messages will not just waste my time but bandwidth too.

Sample shell script to delete all emails from POP3 server

So here is small shell script I wrote to get rid of all the messages on your POP server.

#!/bin/sh
username="me@myisp.com";
password="mypop3server-password";
MAX_MESS=$1
[ $# -eq 0 ] && exit 1 || :
sleep 2
echo USER $username
sleep 1
echo PASS $password
sleep 2
for (( j = 1 ; j <= $MAX_MESS; j++ ))
do
echo DELE $j
sleep 1
done
echo QUIT

Script usage:

First setup your POP3 username and password. Run this script as follows:
$ ./clean.pop3 2500 | telnet pop3.myisp.com 110
Output:

Trying 61.142.1xx.xxx...
Connected to pop3.myisp.com.akadns.net.
Escape character is '^]'.
+OK hello from popgate(2.34.1)
+OK password required.
+OK maildrop ready, 2501 messages (40690358 octets) (40690358 2147483648)
+OK message 1 marked deleted
+OK message 2 marked deleted
+OK message 3 marked deleted
....

Where,

  • 2500: Total number of POP3 messages to remove
  • telnet pop3.myisp.com 110: Telnet to ISP pop3 server and delete all emails from a POP3 server

If you are on dial-up internet connection this script is handy. If you prefer there is PHP version too .

Hacking the Dlink 502T router

I have upgraded my 256kbps ADSL to 512kbps and it is bundled with Dlink 502T router. Soon after installation I found that it runs Linux :). Hacker inside me decided to play around this router.

How do I Log in to router interface via telnet

You can login over telnet. This is common feature of all router these days and this the only way to hack into box:

=> Default IP: 192.168.1.1
=> Default Username: admin (or use root both are having UID 0)
=> Default Password: admin

WARNING! These examples are not about stealing other users bandwidth or passwords. Most A/DSL provider control many properties on their end. Hacker is a person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular. This article is not about stealing or cracking other users network equipment.

I have changed IP of router to 192.168.1.254 so here is my first session:
$ telnet 192.168.1.254
Sample output:

Trying 192.168.1.254...
Connected to 192.168.1.254.
Escape character is '^]'.
BusyBox on (none) login: root
Password:
BusyBox v0.61.pre (2005.05.30-08:31+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

Let us see password file, enter:
# cat /etc/passwd
Output:

root:x:0:0:Root,,,:/:/bin/sh
admin:x:0:0:Admin,,,:/:/bin/sh

Hack #3: Get more information about router hardware and Linux

Since this is tiny device most of the userland command such as free, uname etc are removed. However /proc file system provides all information.

Display CPU Information
# cat /proc/cpuinfo
Display RAM Information
# cat /proc/meminfo
OR
# free

Display Linux versions
# cat /proc/version
Output:

Linux version 2.4.17_mvl21-malta-mips_fp_le (jenny@fd6e) (gcc version 2.95.3 20010315 (release/MontaVista)) #70 Mon May 30 16:34:48 CST 2005

Display list of running Processes:
# ps

Display list of all kernel module:
# lsmod

Hack # 3: Get more information about network

Display list of all network interfaces:
# ifconfig
Get your Internet public IP info:
# ifconfig ppp0
Output:

ppp0      Link encap:Point-Point Protocol
          inet addr:61.xxx.xxx.xxx  P-t-P:61.xxx.xxx.xxx  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1  ASYMMTU:1500
          RX packets:69586 errors:0 dropped:0 overruns:0 frame:0
          TX packets:62540 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:80566538 (76.8 Mb)  TX bytes:5349581 (5.1 Mb)

Get default routing information i.e. find out your ISP's router:
# route
Output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
61.xxx.xxx.xxx  *               255.255.255.255 UH    0      0        0 ppp0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
239.0.0.0       *               255.0.0.0       U     1      0        0 br0
default         dsl-xx-00x.xx.x 0.0.0.0         UG    0      0        0 ppp0

Display ethernet statics such as speed and other details:
# cat /proc/avalanche/eth0_rfc2665_stats

Display DSL modem stats:
# cat /proc/avalanche/avsar_modem_stats

Display Iptables firewall rules:
# iptables -L -n

Flush/Stop firewall rules (don't flush untile and unless you have solid reason to do it )
# /etc/flush_firewall

Hack 4 : Secure your router

(A) Open a web browser such as firefox and login to web based interface. Type url http://192.168.1.1/

(B) Enable Firewall
By default firewall is disabled :/? turn it on to protect your router as it runs linux. Click on Home > Wan > Scroll down and select Firewall as Enabled. Click on Apply.

(C) Change default admin password
Click on Tools > Select Administrator and type the password. > Click apply

(D) Save changes and reboot router
Click on Tools > System > Click on Save and Reboot button

Please note that most ISP including Airtel, BSNL and others these days use this router. And by default admin password is not changed by user, in addition to that some software bug exists that allows remote administration via telnet/http. So turning on firewall saves your day.

Hack # 5: Miscellaneous information

Display developer information i.e. the people behind this router development:
# cat /proc/avalanche/developers

Quickly reboot the router:
# reboot

All your binary stored in /bin/ /usr/bin /sbin directory.

More Resources:

BIND is the Berkeley Internet Name Domain, DNS server. It is wildly used on UNIX and Linux like oses. You can use following tools to troubleshoot bind related problems under UNIX or Linux oses.

Task: Port 53 open and listing requests

By default BIND listen DNS queries on port 53. So make sure port 53 is open and listing user requests. by running any one of the following tests. See if you can telnet to port 53 from remote computer:
$ telnet remote-server-ip 53
OR
telnet ns1.nixcraft.org domain
Output:

Trying 192.168.0.5...
Connected to ns1.nixcraft.org.
Escape character is '^]'.

If you cannot connect make sure firewall is not blocking your requests. Next use netstat command to list open and listing port 53 on server itself:
$ netstat -tulpn | grep :53
OR
# netstat -atve
Output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode
tcp        0      0 ns1.nixcraft.org:domain *:*                     LISTEN      named      10386
tcp        0      0 rhx.test.com:domain     *:*                     LISTEN      named      10384
tcp        0      0 *:ssh                   *:*                     LISTEN      root       1785
tcp        0      0 rhx.test.com:rndc       *:*                     LISTEN      named      10388
tcp        0      0 rhx.test.com:smtp       *:*                     LISTEN      root       1873
tcp        0      0 ns1.nixcraft.org:ssh    w2k.nixcraft.org:1057   ESTABLISHED root       10501
tcp        0      0 rhx.test.com:32773      rhx.test.com:domain     TIME_WAIT   root       0
tcp        0      0 ns1.nixcraft.org:32775  ns1.nixcraft.org:domain TIME_WAIT   root       0
tcp        0      0 rhx.test.com:32774      rhx.test.com:domain     TIME_WAIT   root       0

Make sure iptables firewall is not blocking request on server:
# iptables -L -n
OR
# iptables -L -n | less
Make sure named is running:
# /etc/init.d/named status
If not start named:
# chkconfig named on
# service named start

Task: Use log files

You can use log files after starting/restarting bind to see error messages:
# tail –f /var/log/message
Output:

Nov 17 16:50:25 rhx named[3539]: listening on IPv4 interface lo, 127.0.0.1#53
Nov 17 16:50:25 rhx named[3539]: listening on IPv4 interface eth0, 192.168.0.5#53
Nov 17 16:50:25 rhx named[3539]: command channel listening on 127.0.0.1#953
Nov 17 16:50:25 rhx named[3539]: zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700
Nov 17 16:50:25 rhx named[3539]: nixcraft.org.rev:1: no TTL specified; using SOA MINTTL instead
Nov 17 16:50:25 rhx named[3539]: zone 0.168.192.in-addr.arpa/IN: loaded serial 12
Nov 17 16:50:25 rhx named[3539]: zone localhost/IN: loaded serial 42
Nov 17 16:50:25 rhx named[3539]: zone nixcraft.org/IN: loaded serial 12
Nov 17 16:50:25 rhx named[3539]: running

Task: Check zone file for errors

You can check zone file syntax and /etc/named.conf file using following utilities. named-checkconf command is named (BIND) configuration file syntax checking tool.
# named-checkconf /etc/named.conf
Output:

/etc/named.conf:32: missing ';' before 'zone'

Plesse note that if named-checkconf did not find any errors it will not display in output on screen.

Check zone file syntax for errors. named-checkzone is zone file validity checking tool. named-checkzone checks the syntax and integrity of a zone file. It performs the same checks as named does when loading a zone. This makes named checkzone useful for checking zone files before configuring them into a name server.
# named-checkzone localhost /var/named/localhost.zone
OR
#named-checkzone nixcraft.org /var/named/nixcraft.org.zone
Output:

zone nixcraft.org/IN: loaded serial 12
OK

Task: Testing BIND/DNS with utilities

You can use host and dig utilties to test your bind configuration.

  • host: host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa.
  • dig: dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than dig.

List IP address associated with host names:
# host nixcraft.org
OR
# host www
Output:

www.nixcraft.org has address 192.168.0.6

Perform a zone transfer for zone name using -l option:
# host -l nixcraft.org

nixcraft.org SOA ns1.nixcraft.org. admin.nixcraft.org. 12 10800 900 604800 86400
nixcraft.org name server ns1.nixcraft.org.
nixcraft.org mail is handled by 10 mail.nixcraft.org.
nixcraft.org has address 192.168.0.5
gw.nixcraft.org has address 192.168.0.254
mail.nixcraft.org has address 192.168.0.7
ns1.nixcraft.org has address 192.168.0.5
w2k.nixcraft.org has address 192.168.0.1
www.nixcraft.org has address 192.168.0.6
nixcraft.org SOA ns1.nixcraft.org. admin.nixcraft.org. 12 10800 900 604800 86400

Other examples
# dig mail.nixcraft.org
# dig 192.168.0.5