In Many programmer anecdotes have been published. I enjoy reminiscing about my past foolishness. Well, hereās another such story.
I first got interested in computers, especially programming, when I was about 11 years old. In middle school,higher level of isolation, as if one controller is broken, the problem is confined to that specific context).I spent most of my free time tinkering with my C64 and writing in BASIC, and then cutting out bad code with scissors. .
After school (at around 16 years old), British kids typically go to college, where they choose three or four subjects to study before going to university. Given my love for the beige box and tape recorder at home, I decided that studying 'computing' at college was the right choice.
I enjoyed the course more than I expected; there I was first introduced to Pascal and Delphi.
In between classes, students could work at any available machine in the computer lab. Imagine: a huge room designed for about a hundred people, with rows of tables lined with machines ā like those where the monitor sits on the system unit. The constant hum of fans, mouse balls buzzing across tables without stopping for a second. Thereās a strange smell in the air, as if 50-100 hormonally charged teenagers are periodically replaced to cool down a hundred Pentium III chips.
Despite health risks, I enjoyed sitting at the computer whenever I got a free moment.
An admin was on duty, a short middle-aged man appointed to the role due to his relentless desire to become a tyrannical dictator, or so I assume. To say he was on duty is an understatement; the guy truly loved his job. He was tasked with keeping order so that no one used the student computers for anything inappropriate.
To this day, my intuition tells me that the admin's bonus was directly tied to the number of students he caught and kicked out of the computer lab. I'm pretty sure that guy paid off his mortgage early.
He sat in the far corner of the computer lab at a corner desk. One could confidently assume that his prolific monitors had found a way to reproduce with an impressively short gestation periodāthere were so many of them. It was left to wonder whether he could indeed keep track of them all. Of course, I'm jokingā¦ I did mention that he took his work very seriously?
At that time, the computer network was running on Windows 2000. Soon I discovered that each time I logged in, a script would run that launched the VNC server from an admin account for remote desktop access. Whenever that guy wanted to keep an eye on you, he would connect directly to your machine and watch. It was creepy, and now that I think about it, probably illegal.
Having sharpened my skills on BASIC and C64, I was now writing in C and even a bit in C++. Back then, I was also very fascinated by the D language, which addressed some of the shortcomings of C++, as I saw it then.
I usually entered the computer lab to read something new about D or to play around with the Digital Mars D compiler. Occasionally, distracted from thoughts about the great future of D, I wrote C code to hack other Win32 programs through their window descriptors.
Back in the good old days of Win32 programming, finding a window descriptor was the simplest method for hacking into other programs. Obviously, all GUI programs in Windows had a window, even if it wasnāt displayed on the screen. By writing a program to extract the descriptor of another process (in essence, a reference to it), you could send it messages. This would allow for some basic operations, like hiding/showing a program's window, as well as some really cool things, like forcing a process to load an arbitrary DLL into its memory space and start executing code. The fun really began after the DLL injection.
In the first month and a half, this detective didn't particularly bother me; he connected to the VNC server on my machine only once or twice. But one specific session likely piqued his interest. I was writing some code in C to hide the Minesweeper windows (without closing them) to make it easier to play in class, and then I noticed that the white VNC icon in the system tray had turned black. This meant he was now watching me.
I continued coding as usual, trying not to pay attention to him. Meanwhile, the machine began to noticeably lag, struggling to transmit the maximum frame rate to one of the countless monitors in the corner of the room. Windows nearly stopped responding, and when my patience wore thin, I logged off and called it a day.
During the following visits to the computer lab, Columbo showed a lively interest in what I was doing almost every time. After about the fourth visit, I decided that something needed to be done.
I admit that a reasonable, rational person could have simply raised this issue directly with him or his boss. However, I always fell prey to temptation and quickly convinced myself to adopt an entirely different strategy.
ā You won't be able to do anything without that VNC server! ā I calmly and firmly told myself a few times.
I needed to kill VNC.
I started entering the computer lab with large groups of students and sitting as far away from the monitor corner as possible. For a while, this worked and gave me some time to check ideas.
My first attempt, I think you'll agree, was rather weak. Right-clicking on the VNC icon in the system tray, I saw a menu with the magic letters E-X-I-T. Unfortunately, the letters were displayed in gray outline text. The administrator had disabled the 'Exit' menu item via the group policy editor. I tried to kill the process from Task Manager, but of course, it was invisible to me, as it was running under another, more privileged account. Nothing came of it.
The VNC server runs on TCP port 5900, I remembered. My next plan was to send corrupted packets to that port to freeze it.
For several days, I was analyzing the protocol, sending various forms of correctly structured nonsense to port 5900 and hoping it would break. Eventually, that didn't work either.
I had already started to think I wouldnāt be able to get rid of this thing when it suddenly struck me: there should be a window! I need to display it. Maybe it has a nice juicy 'Shutdown' button that I can put to good use!
I ran my nearly perfect C code to find the main window handle of another processāand I actually found VNC. I felt elated when my fingers typed WM_SHOWWINDOW. Can you guess what I saw before me?
Nothing!
Now I was curiousā¦ it had a window, but it was ignoring my messages. I double-checked my code to make sure it was working. I tested it on several other processes, and it worked perfectly. I tried sending other messages to the VNC window, but still nothing.
And then it struck me again!
Thanks to a very thick book by Charles Petzold, I had thoroughly studied how Win32 processes work within the system. Every Win32 application has a window and a 'message queue.' Messages from user interactions, as well as messages sent by Windows itself, go into the queue, and the application decides how to handle them.
Not too interesting on its own. But when I realized that a sufficiently large unhandled message queue acts as a heuristic for intervention into a frozen process by the Window Process Manager, I was sweating pure serotonin.
Without losing a second, I returned to my C code, ready to send another message to the VNC main window WM_SHOWWINDOW. In a loop. Eternal. So, a multitude of messages WM_SHOWWINDOW, which I now knew VNC would try to completely ignoreā¦ at its own risk.
I compiled and ran the 4 KB of the most free-spirited code of my life. About three seconds later, Windows reported that the process vncserver.exe was not responding and made an offer I simply couldnāt refuse:
Do you want to end this process?
Hell YES!
Let me confess, for the rest of the day I was unbearably pleased with myself.
After several hours spent processing my new superpower, I decided how I would use it. Simply killing the session right in front of him was too easy. I had a better idea ā to disappear completely.
After I realized that I could write code that would do two things. First, it would occupy the recently freed TCP port 5900, which was previously occupied by an ignorant VNC server process. Then it would create a new TCP connection to the VNC server of the specified machine. The code would simply proxy all data between the two sockets, and Columbo would think he was connecting to me when, in reality, he would be connecting to a completely different VNC server.
My code would act as a secret bridge between me and some other poor soul of my choosing. It was brilliant.
I immediately started writing my fake VNC bridge. Columbo connected to me several times, but I kept programming right in front of him. I concluded that he had no idea about my actions, even though I was writing obvious things like port numbers and comments such as // ŠŃŠ¾ŃŠ°Š¹, Š¶ŃŃŠŗŠøŠ¹ ŃŠæŠøŠ¾Š½ VNC.
A couple of days later, I couldnāt get the code to work correctly. What's worse, I was practically continuously working with the black VNC icon in the system tray. As long as it was connected, I couldn't free the port to test my code.
If only I had known about netcat!
Eventually, my nerves couldn't take it anymore; after all, I was an impatient 17-year-old guy. Watching the white VNC server icon turn black again, I flipped out, opened the original code that filled the message queue, and ran it in front of him. I even waited a couple of seconds before pressing End Process, just to make sure he saw it.
If pressing that button hadnāt fully convinced me it was worth it, his leap from behind his fortress of monitors to quickly approach me and kick me out of the room definitely made it worth it.
In the end, I was banned from the network for two weeks. I thought it was a fair punishment. About three weeks later, the VNC server disappeared from the boot scripts and never appeared again. I never found out if my incident played any role in this, but it completely ruined my plan for fantastical enrichment by selling my VNC tool to oppressed students in computer labs across the country.
Source: habr.com
