Novell Security Information
Novell Security Links Security Attacks and Solutions
Protecting Your Network
Learning and Applying Rules of NDS Security
NetWare Enhanced Security Administration
Netware Hack FAQ
Novell Auditing Toolkit Documentation
Novell Netware 3.1x Security Checklist
BorderManager Install & Config
Novell Minimum Patch List for all Products
Novell related Security Downloads
Netware Hacker The Novell Netware Hack-FAQ A good resource on basic Netware security. Lanicide Size: 12,782 LANicide is a TSR IPX message sender for Novell NetWare LANs ABOVE version 2.0a. LANicide is a DOS application and will not work in GUIs. It does crash Windows nicely though. Novell Cracker Size: 7,864 NETCRACK attempts, through trial-and-error, to divulge user passwords - using legal queries in NetWare! Novell Size: 8,614 This sets the password of the user "username" to "Password" on a 3.1x fileserver. Novell Cracker Size: 60,714 Advanced NetWare Security Cracker Novell Utils Size: 61,962 Novell Hacking Tools Burglar Size: 3,021 Create an account with supervisor privledges (Novell) Novell FAQ Size: 41,626 FAQ on Novell Netware Hacking Novell PW Cracker Size: 81,935 Novell Password Cracker Novell Util Size: 10,075 NOVELFFS 1.00, Novell Fake File Server Novell Hack Size: 20,906 Having Phun with Novell Novell Hack Size: 72,852 Replacement LOGIN.EXE for Novell Netware Novell Hack Size: 24,355 Expert UNIX Passwd Analyze Tool Novell Hack Size: 16,708 NWPCRACK is a simple brute force password cracker
Netware 3.x and 4.x Password and Login Exploits
CHKNULL
Checks for users that have no password.
GETIT (Thief) for DOS
Invisible Keylogger 97
Thief is a TSR (Terminate and Stay Resident) utility that attempts to steal Novell passwords. Invisible Keylog 97 records keystrokes to a file. Login passwords can be captured with commercial version.
NOVELBFH
Brute force login attack.
NWPCRACK
SETPWD
NLM to reset any user password from the console. Works for Netware 3.x and 4.x in bindery mode. Usage: Load SETPWD username Password This sets the password of the user.
KOCK
For Netware 3.11, exploits bug in a Netware attach to log in without a password.
userlook
Display user's Real name and current connections.
userdump
UserDump simply lists all users in the Bindery. Works for Netware 3.x and 4.x (in Bindery Mode)
view
Shows if supervisor or supervisor equivalent is logged in.
Supervisor Account Exploits
SUPER v2.0
SUPER.EXE allows to switch SV equivalence on/off when needed. Do your daily work as normal user, and be SV only when needed. Includes DOS and Windows version. SUPER will modify the security byte of your bindery property SECURITY_EQUALS (can only be done by somebody with supervisor equivalence) to 0x22 (read/write object).
NetWare v3.12 considerations:
This NetWare version does not allow to set the bindery property SECURITY_EQUALS to 0x22. On NetWare v3.12 SUPER will make the user manager of self and SUPERVISOR. Again, this is not a security breach, since s/he was SUPERVISOR equivalence anyway.
NetWare v4.x considerations:
SUPER affects only objects in the current bindery context. The 'Switchable' flag cannot be set, however. SUPER will try to make you equivalent to SUPERVISOR and (if available in the bindery context) to ADMIN.
HACK
NW-HACK (similar)
HACK spoofs packets to make them look like they came from the Supervisor (NODE ADDRESS & CONNECTION NUMBER)to add Supervisor equivalence to other users. For Netware 3.x.
BURGLAR
Burglar.nlm is a Netware Loadable Module. If you execute this program on the FILESERVER it will create an account with supervisor privledges. Put it on a floppy diskette. Take it to the server. Get to the console screen. Type load a:\burglar.nlm super2. For Netware 3.x.
NWL
Replacement LOGIN.EXE for Novell Netware. Run PROP.EXE from a Supervisor account to create a new property. Replace existing LOGIN.EXE in SYS:LOGIN. Each time a user logs in the text is stored in the new property. Use PROP.EXE to retrieve captured logins.
Bindery, NDS, and NLM Exploits
NLM
This is a Utility looks inside a NLM (Netware Loadable Module) to "see what it does." For Netware 3.x and 4.x
Bind Edit v1.0
This is a Utility to edit the Novell Netware bindery the way you can edit a file with a low-level Hex-editor. You can delete or edit properties of objects and you could delete whole objects. If you do not have Supervisor-Equivilence you can't see and do it all.
Pandora v4 Offline for Windows 95/98/NT
Pandora v4 Offline for Linux
Pandora v4 Online for Windows 95/98
Pandora v4 Online for Windows NT
Pandora v4 Full Source Code
Pandora v3.01 for DOS
panmount.tgz
Mount a Netware volume from a Linux IPX aware kernel with the password hash only. Includes NCP for Netware source code and a Linux binary. Tested on the latest Red Hat.
ds_strip.zip
Take a DSREPAIR.DIB file and recover all of the files it contains. On Netware 5 you get NDS files, on Netware 4 you get NDS files, login scripts, auditing files, even the license file.
Related Links
Novell NDS Security
Simple Nomad's Unofficial Netware Hack FAQ v6
Simple Nomad's Mobile Research Centre
| 