The following section deals with Accounts on Unix systems.
All Unix systems have an account called root. This account is also commonly known as the SuperUser. Actually any account with a UID and GID of zero could be considered a SuperUser account. It is possible that a system administrator will rename the root account for obfuscation, but this is rather impractical as many applications not only require the UID zero but actually require the name of the account be "root" to run certain functions. As administrators do not wish to create more problem or have to patch more code than neccessary, this is a rare occurence.
Oh, and unless you've being living under a rock, you should already know that root is god on Unix.
Here are a few other accounts and passwords (if known) commonly found on Unix systems:
System Account Password Purpose
-------- --------- -------- -----------------------------------------
Some guest (none) Guest access
Some demo (none) Demo access
Some games (none) Play games
Some nuucp (none) UUCP access
Some daemon (none) Typically invalid for direct access
Some bin (none) Typically invalid for direct access
Some man (none) Typically invalid for direct access
Some lpd (none) Typically invalid for direct access
Some sys (none) Typically invalid for direct access
Some nobody (none) Typically invalid for direct access
Some ftp (none) Anon FTP access, use email address as password
AIX guest guest Guest access
NeXT root NeXT god (default password on shipped systems)
NeXT signa signa Guest account
NeXT me (none) Not seen on all systems
SGI/Irix 4DGifts (none)
SGI/Irix lp (none)
SGI/Irix tour (none)
SGI/Irix tutor (none)
SGI/Irix demos (none)
Remotely you have a few things you can try. Here are a few suggestions:
By typing in finger @targethost you get get users that are currently
logged in. This will give you a few account. Also by typing finger account@targethost you can
determine if that account is valid, and possibly the last time it has been accessed. Unfortunately
most Unix systems refuse finger requests from remote hosts, so this usually doesn't do you a lot of
good. But if finger is allowed, it can return a lot of information. Try running finger with a -l
for more verbose listings. If you gain local access, use finger account to get info on other
accounts on the system. For example, if finger root returns info about an administrator
named Fred, then finger fred, which may reveil Fred's regular account.
You can run rusers targethost which may return remote user info if the service is allowed.
Doing a whois domain will return info about who is responsible for a domain, and usually
included a valid account name. You can use this to possibly determine other account names, and odds are very
good that the administrative contact and/or the technical contact have the system privileges you desire.
Often by telnetting to the mail server and trying to verify or expand names you can learn account
names. By typing telnet targethost 25 and typing in EXPN account or VRFY account
will tell you if that account is valid. You may have to type in HELO or some other commands before
you can do an EXPN or VRFY.
A lot of administrators are aware of the above techniques, and will often treat these probes as attacks themselves.
Many sites refuse finger and ruser accesses, and a lot of sites have configured their mailer to either not
respond to VRFY and EXPN or simply return nothing of value. Odds are good that sites that
refuse these types of probes are usually logging these types of probes, so you may wish to probe from one
location and attack from another.
If you can gain access locally, such as through a guest account, there are a number of things you can do to
view possible account names. Try using some of the finger techniques from above minus the targethost,
try typing w or who or even more /etc/passwd to get account names.