____________________________________________________________________________________________________
,ad8888ba, 88
d8"' `"8b ,d 88
d8' 88 88
88 ,adPPYYba, MM88MMM ,adPPYba, ,adPPYb,d8 88 88 ,adPPYYba, ,adPPYb,88
88 "" `Y8 88 I8[ "" a8" `Y88 88 88 "" `Y8 a8" `Y88
Y8, ,adPPPPP88 88 `"Y8ba, 8b 88 88 88 ,adPPPPP88 8b 88
Y8a. .a8P 88, ,88 88, aa ]8I "8a ,d88 "8a, ,a88 88, ,88 "8a, ,d88
`"Y8888Y"' `"8bbdP"Y8 "Y888 `"YbbdP"' `"YbbdP'88 `"YbbdP'Y8 `"8bbdP"Y8 `"8bbdP"Y8
88
88888888888 88 88
88 88 88
88 88
88aaaaa 8b, ,d8 8b,dPPYba, ,adPPYba, ,adPPYba, ,adPPYba, ,adPPYb,88
88""""" `Y8, ,8P' 88P' "8a a8" "8a I8[ "" a8P_____88 a8" `Y88
88 )888( 88 d8 8b d8 `"Y8ba, 8PP""""""" 8b 88
88 ,d8" "8b, 88b, ,a8" "8a, ,a8" aa ]8I "8b, ,aa "8a, ,d88
88888888888 8P' `Y8 88`YbbdP"' `"YbbdP"' `"YbbdP"' `"Ybbd8"' `"8bbdP"Y8
88
88
____________________________________________________________________________________________________
The beginning of the end of your cybercrime career.
Prepare to meet your makers, CatSkids.
- by MLT && [REDACTED]
____________________________________________________________________________________________________
So, for the umpteenth time, a skid group has attempted to release a dox on me for no particular
reason. The main culprit is chFthecat, although his friends Meo/Heard and Krunk were also involved
in attempting to dox me. This is my retaliation to their pathetic dox attempts. This writeup will
primarily focus on Meo and Krunk, as those two helped with the dox, while chF was the ringleader
of the whole thing... therefore, I am creating a follow-up release focusing on chF alone.
To the new generation of script kiddies: let this serve as a reminder as to why you shouldn't mess
with people on the internet without knowing what they are capable of.
This release will include a compilation of doxes + other info on various members of catsquad,
although not all information here may be 100% confirmed, all possible leads will be included
in order to assist others in gathering more information on the group. For those of you who do
not know, catsquad is a group of 'hackers' who are evidently new to the scene, they originated
from Xbox Live and so far have shown no 'skill' other than the ability to dox and DDoS (and
even then, this will go on to show how their doxes are the majority of the time just outdated
info that has been posted in the past by people who actually know what they are doing). They
have the audacity to talk shit about real hackers, therefore I am releasing this and covering
all possible information on their group. Hopefully these skidiots will get the v& they deserve
____________________________________________________________________________________________________
.-'''-.
' _ \
__ __ ___ __.....__ / /` '. \
| |/ `.' `. .-'' '. . | \ '
| .-. .-. ' / .-''"'-. `. | ' | '
| | | | | | / /________\ \ \ \ / /
| | | | | | | | `. ` ..' /
| | | | | | \ .-------------' '-...-'`
| | | | | | \ '-.____...---.
|__| |__| |__| `. .'
`''-...... -'
____________________________________________________________________________________________________
Ok, lets begin with the German nub Heard aka Meo, before any dox is dropped, I'm going
to start with some hilarity to show everyone that he clearly has no fucking clue what he
is doing. Here are logs of me in the box for a pornsite that he owns, note the plaintext
passes stored:
____________________________________________________________________________________________________
me@ks4002422 ~ $ cd /home/heard/enudes.info
me@ks4002422 /home/heard/enudes.info $ ls
accounts girls index.py index.pyc sessions static templates
me@ks4002422 /home/heard/enudes.info $ cd accounts
me@ks4002422 /home/heard/enudes.info/accounts $ ls -la
total 320
drwxr-xr-x 2 root root 4096 Jan 10 23:54 .
drwxr-xr-x 7 heard heard 4096 Jan 10 22:54 ..
-rw-r--r-- 1 root root 165 Jan 10 21:59 %3Cscript%3Ealert%28%22injection%22%29;%3C%2Fscript%3E.txt
-rw-r--r-- 1 root root 60 Jan 10 23:16 69thathoe.txt
-rw-r--r-- 1 root root 107 Jan 10 23:51 Abraidism.txt
-rw-r--r-- 1 root root 45 Jan 10 21:51 AnonyMooseGawd.txt
-rw-r--r-- 1 root root 115 Jan 10 21:51 AnonyMoose.txt
-rw-r--r-- 1 root root 24 Jan 10 21:45 apple.txt
-rw-r--r-- 1 root root 24 Jan 10 21:39 asdasd.txt
-rw-r--r-- 1 root root 22 Jan 10 21:42 asdfasdf.txt
-rw-r--r-- 1 root root 81 Jan 10 22:12 banana.txt
-rw-r--r-- 1 root root 34 Jan 10 21:51 bezo.txt
-rw-r--r-- 1 root root 43 Jan 10 21:46 bigcock1842.txt
-rw-r--r-- 1 root root 62 Jan 10 22:19 Booboi127.txt
-rw-r--r-- 1 root root 138 Jan 10 21:50 Booboo127.txt
-rw-r--r-- 1 root root 36 Jan 10 21:43 Bshsnsjssj.txt
-rw-r--r-- 1 root root 35 Jan 10 21:44 Camos.txt
-rw-r--r-- 1 root root 45 Jan 10 21:42 chazwonder.txt
-rw-r--r-- 1 root root 57 Jan 10 23:09 ddbrad.txt
-rw-r--r-- 1 root root 30 Jan 10 21:52 dfgdfg.txt
-rw-r--r-- 1 root root 144 Jan 10 22:06 Dick.txt
-rw-r--r-- 1 root root 92 Jan 10 23:15 DLCK.txt
-rw-r--r-- 1 root root 30 Jan 10 21:43 Drxyy.txt
-rw-r--r-- 1 root root 28 Jan 10 21:45 eGod.txt
-rw-r--r-- 1 root root 28 Jan 10 21:46 Egod.txt
-rw-r--r-- 1 root root 36 Jan 10 21:57 erkngehrir.txt
-rw-r--r-- 1 root root 139 Jan 10 22:39 faggotlol.txt
-rw-r--r-- 1 root root 51 Jan 10 23:28 fffffff.txt
-rw-r--r-- 1 root root 50 Jan 10 22:44 fwefewf.txt
-rw-r--r-- 1 root root 43 Jan 10 21:43 gofuckyourself.txt
-rw-r--r-- 1 root root 57 Jan 10 22:51 Grimzy.txt
-rw-r--r-- 1 root root 21 Jan 10 22:28 g.txt
-rw-r--r-- 1 root root 29 Jan 10 21:55 Gypsy.txt
-rw-r--r-- 1 root root 25 Jan 10 21:44 hey.txt
-rw-r--r-- 1 root root 40 Jan 10 23:03 HI.txt
-rw-r--r-- 1 root root 19 Jan 10 21:47 Hjjnncgg.txt
-rw-r--r-- 1 root root 43 Jan 10 23:48 H.txt
-rw-r--r-- 1 root root 89 Jan 10 23:54 hugecock92.txt
-rw-r--r-- 1 root root 27 Jan 10 22:14 hzzg.txt
-rw-r--r-- 1 root root 50 Jan 10 23:03 Ihateneslo.txt
-rw-r--r-- 1 root root 26 Jan 10 21:44 jesse.txt
-rw-r--r-- 1 root root 29 Jan 10 21:47 Jsnsj.txt
-rw-r--r-- 1 root root 17 Jan 10 21:47 kfkdsn.txt
-rw-r--r-- 1 root root 56 Jan 10 22:15 Knave.txt
-rw-r--r-- 1 root root 6 Jan 10 21:49 k.txt
-rw-r--r-- 1 root root 31 Jan 10 21:43 Kush.txt
-rw-r--r-- 1 root root 57 Jan 10 22:04 Lackofshit.txt
-rw-r--r-- 1 root root 45 Jan 10 23:49 lol.txt
-rw-r--r-- 1 root root 111 Jan 10 22:02 Madness.txt
-rw-r--r-- 1 root root 44 Jan 10 22:12 matt.txt
-rw-r--r-- 1 root root 46 Jan 10 21:52 Mckay.txt
-rw-r--r-- 1 root root 43 Jan 10 22:01 meoisgay.txt
-rw-r--r-- 1 root root 41 Jan 10 22:18 meo.txt
-rw-r--r-- 1 root root 40 Jan 10 21:53 Minow322.txt
-rw-r--r-- 1 root root 34 Jan 10 21:48 Nice.txt
-rw-r--r-- 1 root root 97 Jan 10 21:54 nigger.txt
-rw-r--r-- 1 root root 34 Jan 10 21:45 Nigger.txt
-rw-r--r-- 1 root root 43 Jan 10 21:44 NoMods.txt
-rw-r--r-- 1 root root 26 Jan 10 21:43 None.txt
-rw-r--r-- 1 root root 39 Jan 10 21:43 nwtt lmao.txt
-rw-r--r-- 1 root root 106 Jan 10 22:57 Outcast.txt
-rw-r--r-- 1 root root 124 Jan 10 23:26 PartyRocker69.txt
-rw-r--r-- 1 root root 35 Jan 10 21:42 peso300.txt
-rw-r--r-- 1 root root 31 Jan 10 21:42 randm.txt
-rw-r--r-- 1 root root 41 Jan 10 21:40 Rezi.txt
-rw-r--r-- 1 root root 35 Jan 10 21:46 Signs jus.txt
-rw-r--r-- 1 root root 39 Jan 10 21:43 Smd111111.txt
-rw-r--r-- 1 root root 78 Jan 10 22:28 SMS.txt
-rw-r--r-- 1 root root 298 Jan 10 22:04 spencer.txt
-rw-r--r-- 1 root root 43 Jan 10 21:52 Thatguy561.txt
-rw-r--r-- 1 root root 317 Jan 10 22:27 TheMLGNation.txt
-rw-r--r-- 1 root root 118 Jan 10 22:10 Trendinq.txt
-rw-r--r-- 1 root root 35 Jan 10 21:43 trojan21.txt
-rw-r--r-- 1 root root 36 Jan 10 21:43 trojan.txt
-rw-r--r-- 1 root root 35 Jan 10 21:43 Tuqp.txt
-rw-r--r-- 1 root root 218 Jan 10 23:22 .txt
-rw-r--r-- 1 root root 12 Jan 10 21:47 WTFf.txt
-rw-r--r-- 1 root root 46 Jan 10 21:52 xCerebellum.txt
-rw-r--r-- 1 root root 37 Jan 10 21:55 YoloSwag.txt
-rw-r--r-- 1 root root 40 Jan 10 22:36 yolo.txt
____________________________________________________________________________________________________
These files contain usernames, passwords, IP addresses, and emails, and they are
written to the 'accounts' dir via his failed login system, here is their src code:
____________________________________________________________________________________________________
me@ks4002422 /home/heard/enudes.info $ cat index.py
#!/usr/bin/env python2
import web
import glob
import os.path
from recaptcha.client import captcha
urls = (
'/', 'register',
'/index.php', 'index',
'/girls', 'girls',
'/girls/(.*)', 'viewG',
'/boys/(.*)', 'viewB',
'/boys', 'boys',
'/upload', 'upload',
'/login', 'login',
)
app = web.application(urls, globals())
session = web.session.Session(app, web.session.DiskStore('sessions'))
web.config.debug = True
render = web.template.render('templates/')
class index:
def GET(self):
return render.index()
class girls:
def GET(self):
girlPics = []
for i in glob.glob("girls/*"):
i = i.replace('girls/', '')
i = "<a href=\"/girls/%s\">%s</a>" % (i, i)
girlPics.append(i)
return render.girls('<br \>\n'.join(girlPics))
class viewG:
def GET(self, filename):
return open('girls/%s' % filename).read()
class boys:
def GET(self):
girlPics = []
for i in glob.glob("boys/*"):
i = i.replace('boys/', '')
i = "<a href=\"/boys/%s\">%s</a>" % (i, i)
girlPics.append(i)
return render.boys('<br \>\n'.join(girlPics))
class viewB:
def GET(self, filename):
return open('boys/%s' % filename).read()
class upload:
def GET(self):
return 'closed temp'
class upload2:
def GET(self):
return render.upload()
def POST(self):
postData = web.input()
response = captcha.submit(postData['recaptcha_challenge_field'],
postData['recaptcha_response_field'],
'6Lfp0-wSAAAAAM35vqvGD9MybGjck70bjkzc-P18',
web.ctx['ip'])
if not response.is_valid:
return 'bad captcha..'
else:
sex = web.input()['sex']
x = web.input(myfile={})
filename = x['myfile'].filename # This is the filename
if '..' in filename or '<' in filename or '>' in filename or '.php' in filename:
web.seeother('http://http://akk.li/pics/anne.jpg')
content = x['myfile'].value # This is the file contents
filename = filename.split(".")
filename[-1] = ''
filename = '.'.join(filename)
if os.path.isfile('%s/%s' % (sex, filename)):
return 'file exists'
file = open('%s/%s' % (sex, filename), 'w')
file.write(content)
file.close()
raise web.seeother('/%s' % sex)
class register:
def GET(self):
if session.get('logged_in', False):
web.seeother('/index.php')
return render.register()
def POST(self):
username = web.input()['username']
email = web.input()['email']
password = web.input()['password']
file = open('accounts/%s.txt' % username, 'a')
file.write('%s:%s:%s:%s\n' % (username, email, password, web.ctx['ip']))
file.close()
session.logged_in = True
web.seeother('http://enudes.info/index.php')
class login:
def GET(self):
return render.register()
def POST(self):
session.logged_in = True
raise web.seeother('/')
if __name__ == "__main__":
web.wsgi.runwsgi = lambda func, addr=None: web.wsgi.runfcgi(func, addr)
app.run()
____________________________________________________________________________________________________
BECAUSE THAT'S SECURE? RIGHT?!
Also yes, that is a "boys" directory, is this kid a fuckin pedophile??
____________________________________________________________________________________________________
Some logs of me digging around in his compromised server:
____________________________________________________________________________________________________
me@ks4002422 /home/heard $ uname -a ; id
Linux ks4002422.ip-198-100-147.net 3.10.25-gentoo-xxxx-grs-ipv6-64 #2 SMP Sat Jan 11 17:26:42
EST 2014 x86_64 Intel(R) Core(TM) i3-2130 CPU @ 3.40GHz GenuineIntel GNU/Linux
uid=1001(me) gid=1001(me) groups=1001(me)
me@ks4002422 /home/heard/enudes.info/sessions $ ls
003cfff8af67abcb74c79344090cec2ed42159d8
03dc92c51aa3968b1a24f2bf70e97c3ae8fe43b5
048dd8bb0c1e7278e59938d54328e4f3dd6c40fe
05045a02b4b93fb5c2b76e36ca7b528f0402da14
08f2af6c71ceb0cddb04e62fab352885b49ee15c
0b039aeb1b480536f879af314423561ec228237a
0e3107ab061e9cff7ddccbaac7da5db3b600f7df
15a996326d43a9a47b4099cfa686eba6d251beda
17fef826118fc71f0a1ba2773652708eda187d19
19b38cf6d3c762098209d1f1c3c4d8027c6dcc80
1bf67a41611a6da5852ca7ff10c1b6bca03781d5
1d153b775db2290acf57c16079ad0042964a31e6
1dfd6031ef17c27aa4d4b65f4f7e2a7b4cbe6d4a
1f0547ba01546981bab2590094b70b12c136dd5b
2b58b39199b03ad69e764d1100e9e5102bbc364f
2e12d4a59987c3966b73a54d14608f829ca6be69
344da690241f2a537b4c2f1866d996217715bb68
3662fb9b20c0512d52e6ed8f05dfe0108328edf4
3b4894c7fd5ac1edc088aaf67620cb67e14cb40a
46a65a74a5ada25fbf2bd7b870654483ef4c30c9
4957f82c9741d2a22897e835638c6b3dc0c3df63
4f5388a4bf55372c8fac5d98ddd6f9ea720e9131
54c142b81e1ae1b35522f51d58dc4231d9505d22
5c3e2fd26d9bc6d1533859f816e66c759b50a344
5db0b6d7c1764b465504eadca4302696f7e38211
60e37d542fd0b921daffd1eb966e3ff552d92f9d
60fd7c2770771f608585225e9a6b533428400d55
62116d964306bbbe525594eec453542b1b20fa48
64831fd54eff32cf1bccf877c1d31306e8d39d4c
6f57e5203d91e06f10efc1b8a8e663414694ebcc
73e97103f2ce4aceaffed7a39e5b261dc0c3091f
76e974a0a06837fc9ea4673ad59649d8463da299
7b9aa52026f92c2b82677545b5a3d8ba6bbeb044
7cb2e98e840b9edb58cecd0e3a7f336157138a50
812f0a86c480c3488a48615a038fe5960652d1c2
81ed47ca43350990702523bf0a6740acd6e5d06b
8500a020ab8b3fe1a68dc6261b7e285e1749c0ed
87e99fbf9732d9ebf679e08b60ff00dfcdcf874d
8b68a21379779276a079bf99a9cb181ca035456c
8bf0f8c3daae9d289408c8c6e4fc4389dfaa2d2e
8e9fb7895dac65969f829f8dbeb52946e2412ebb
90e34eace0bf40f7ef55ae72d3d594b426b8dff3
9157f4c8a910cd47c9ecf920d7f089083be14527
9858c21a28ea2737fc632a4cbbceec7e486623a4
9910c1f6b824fe645ee8e9c270ac2a53a5c446fa
a333edfdab79be54fb5b745d85a8e10c80c25af2
aadcadbfddb3eaec20de4dba0e42ffc3dddc05d9
af5d3fcbb157db15d980364bd85e84ac039fe639
b17856081e6dd292073e6ccd40729a82e89c5fd5
b22a1c6fbf3c37dbbf7ed58f25b5efbb529d4e8e
b4cb10d13812ecebcc161779d692d0ae16f74c10
bb253c0c94997f8883dadf1f69110f7fc048c3a6
c17e996bdd6dea685d26ae29e645ec1a73c53ce9
c1a730e20518537376a39787d9fd4ad2113a388e
d4383599e628374c99d28c7b67e9fe1e5ffd5d5a
d990885962dde900961adbda629d75c04d61e85f
e6caafd95dd7d256e4433538c039ab7dfe4bd805
e734f104d4d803e1853dd330806b7b5e1ba76a40
e796313f2753d0abc90df7f766576111a694eb50
e8996295e2c2f9b7922dfb199721b0d2411551a7
eac1939e29b61891eaeab4e4b950934c14b6c1bc
ec761217e4b43eb9461d77902a0d99d2213faea0
ec7a53b4104392ee02f54eea59d50f1cffafbd79
ef0ec3c6e3dd5e483ca3e8dbbabb356856e9ff77
fc2bd33aa810976c7c8de6febcd72c1c2ecbee02
____________________________________________________________________________________________________
According to Meo, having axx to this box means nothing as its 'shared'. By this logic,
anyone who uses shared hosting to host their site (ie the vast majority of sites) is
in theory 'unhackable', as if someone gains axx to the shared host and defaces their site,
it somehow doesn't count because it's shared? LOL OK
anyhow... moving on... here's Meo's dox just in case you feel like sending him a thank you gift
for being such a cool dude ;)
____________________________________________________________________________________________________
Confirmed dox:
- Name: Nico Weber
- Business Address: Mainzer Str. 8, D-66111 Saarbrücken
- Father's business address: Fallerweg, 7', 'Wittlich', '54516
- Home address: Wasserlohstrae 2a, Chieming, Bayern 83339
- Current IP address: 78.34.221.152
- Previous IP address: 78.35.62.66
- ISP: NetCologne
- xdsl-78-34-221-152.nc.de
- Personal phone number: +49.86649274547
- aliases: Meo, Heard, mest007, timo0034, timo9867, nico1921, zeitvertreib137,
byPsyK0, ixmeo
- Emails: [email protected], [email protected], [email protected], [email protected],
[email protected], [email protected]
____________________________________________________________________________________________________
Now, onto the results of some grep'd db's containing meo's email addresses and hashed
passwords (feel free to crack them, as this retard most likely re-uses his passwords:
____________________________________________________________________________________________________
root@a19s16:~/mysql# grep * -e
'mest007\|timo0032\|timo9867\|nico1921\|zeitvertreib137\|byPsyK0\|ixmeo'
Bugabuse\EazySubs.com.txt:17295,mest007,psykozz,[email protected],a0c449597a15121cb1fd5
5ad6cb82241,Bc/
Hacking\AdminDiscussion.com.sql: ,('5497', 'Levi', 'e0be7c79967535af50d68
cb72c14ebca', '3XfytB3b', 'WrS3lXJpEd7MkiKzhO2KyZlpJ8XWh2rxmrQbWYtg5cV8cIVSBL',
'[email protected]', '48', '0', './uploads/avatars/avatar_268.png?dateline=13432
14711', '170|170', 'upload', '2', '', '0', 'ááááááááááááááááááááááááááááááááááá'
, '1343214483', '1345194705', '1344986489', '1344393175', '', '0', '', '', '', '
', 'all', 'Levi, proud to be a member of CodMedia.net since Jul 2012.[align=righ
t][url=http://www.youtube.com/user/mest007?]My YouTube[/url][/align]\r\n[align=c
enter][IMG]http://i.imgur.com/l3XPX.png[/IMG][/align]\r\n', '1', '0', '1', '0',
'1', '0', '1', '0', 'linear', '1', '1', '1', '1', '0', '0', '0', '0', '0', '1',
'0', '2', '', '', '4', '0', '0', '0', '', '1**$%%$2**$%%$3**$%%$4**', '', '1', '
0', '0', '81.108.253.12', '81.108.253.12', '1366097164', '1366097164', '', '7762
8', '1', '1', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '1', '0', '', ''
, '', NULL)
Unsorted\EazySubscom\Part2DB.txt:"17295","mest007","psykozz","[email protected]","a0c44
9597a15121cb1fd55ad6cb82241","Bc/"
Hacking\thebotnet.txt: ,(37344, 2, NULL, 0, 'timo0034', '66a29c00f15fbaa7222fbf
136b90741d', '2011-02-08', '[email protected]', 0, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, 2, 0, 'They See Me Lurking', 0, 1297188041, 0, 1297188041, 129718810
3, 0, 0, 0, 0, 17, -8, 0, 0, 0, 0, 0, 11541591, 0, NULL, '0000-00-00', -1, -1, '
78.34.221.152', 0, 1, 0, 0, -1, 0, 0, '^R4:JC=A<]-BlLYH3U4GY,UQ!g=|+}', 0, 0, 0,
NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL, NULL, 1, 0, 0, 0, NULL, N
ULL, 0.00, 0.00, 0, 0, 0, NULL, NULL, NULL, 0, 0, 0, 1, 0, 379, 0, NULL, 0, 0, 0
, 0, 0, 0, 0, 0, 0, 0, 0)
Bugabuse\EazySubs.com.txt:16520,IMW3Area,psykoz,[email protected],eeccb8285bd492b
ffa2598537dd2b892,wL+
Hacking\Booters\Asylum Stresser.txt:meopeo:1e65451668fe271407673dc283869704b0cf5
aca:[email protected]
Unsorted\EazySubscom\Part2DB.txt:"16520","IMW3Area","psykoz","[email protected]",
"eeccb8285bd492bffa2598537dd2b892","wL+"
Gaming\HabboSt.txt:MW2King:94db9afd515e6a1bf1c1a09312b49eb1:[email protected]
:87.245.125.243
Gaming\HabboSt.txt:yassmin8:b00c36c9f2d8569db25e94dfeb594d5a:[email protected]:80.1
31.139.252
____________________________________________________________________________________________________
Now, it's time to pwn his LAN -- thanks to 0x80 for helping out w/ weaponizing the browser 0day
Below you can find internal information pertaining to his home network, including the password
to his wifi network:
____________________________________________________________________________________________________
SSID: NETCONNECT-8463
Password: 2764734468045714
ISP: NetCologne GmbH
IP: 78.35.62.66
Gateway: 195.14.226.43
Primary DNS: 81.173.194.69
Secondary DNS: 81.173.194.77
Mullvad VPN ID: 823576304322, Port: 21386
IP Type Port
192.168.0.128 All 27015
192.168.0.128 TCP 25565
192.168.0.130 UDP 88
192.168.0.130 TCP 80
192.168.0.130 TCP/UDP 53/53
192.168.0.130 TCP/UDP 3074/3074
192.168.0.131 TCP 27014-27050
eth0:
Link encap:Ethernet HWaddr 00:23:54:ec:79:21
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:45 Base address:0xc000
lo:
Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:161905 errors:0 dropped:0 overruns:0 frame:0
TX packets:161905 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:27992995 (26.6 MiB) TX bytes:27992995 (26.6 MiB)
tun0:
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:172.27.0.44 P-t-P:172.27.0.44 Mask:255.255.252.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:825351 errors:0 dropped:0 overruns:0 frame:0
TX packets:886392 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:364310483 (347.4 MiB) TX bytes:147951239 (141.0 MiB)
wlan0:
Link encap:Ethernet HWaddr 00:21:5d:2a:aa:90
inet addr:192.168.0.102 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::221:5dff:fe2a:aa90/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:866787 errors:0 dropped:0 overruns:0 frame:0
TX packets:934115 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:450710670 (429.8 MiB) TX bytes:251872777 (240.2 MiB)
>>[ Skid #1 rekt -- time to move onto skid #2 ]<<
____________________________________________________________________________________________________
. _..._ .
.'| .' '. .'|
.' | .-,.--. . .-. . .' |
< | | .-. | | ' ' | < |
| | ____ | | | | _ _ | | | | | | ____
| | \ .' | | | | | ' / | | | | | | | \ .'
| |/ . | | '- .' | .' | | | | | | |/ .
| /\ \ | | / | / | | | | | | /\ \
| | \ \ | | | `'. | | | | | | | \ \
' \ \ \ |_| ' .'| '/ | | | | ' \ \ \
'------' '---' `-' `--' '--' '--' '------' '---'
____________________________________________________________________________________________________
After he began to realize he'd bitten off more than he could chew, he decided to beg for mercy:
____________________________________________________________________________________________________
(2:24:15 PM) [email protected]: dude
(2:24:19 PM) [email protected]: ill pay u btc
(2:24:23 PM) [email protected]: to not drop me
(2:24:26 PM) [email protected]: dude plz
-- Sorry krunk, but we don't take bribes ;)
"(2:24:26 PM) [email protected]: dude plz" <--- maybe if you said pretty please with a cherry on top,
then we would have agreed to not drop you.
Oh well, looks like you got dropped regardless...
Dox found below:
____________________________________________________________________________________________________
Full Name: Matthew Blankenship
Aliases: Krunk, CGOD, Sequel, SaNiTaTioNz, xMKB y0, DDoS1337, TravyonTheGod, DNSPoison
Address: 429 Clearview Drive, Belleville, Illinois, 62223
Mothers Name: Julie Lynn Blankenship
Fathers Name: Keith W Blankenship
____________________________________________________________________________________________________
Now, time to target his other "hacking crew" aka "The Unknowns". If they cry about getting pwned,
we will be make sure to inform them that krunk is to blame ;)
____________________________________________________________________________________________________
root@unknowns:~$ id
uid=0(unknowns) gid=0(unknowns) groups=0(unknowns)
root@unknowns:~$ whoami
root
root@unknowns:~$ ls -la
total 21
drwxr-xr-x 22 root root 4096 2011-08-10 14:51 .
drwxr-xr-x 22 root root 4096 2011-08-10 14:51 ..
drwxr-xr-x 2 root root 4096 2011-08-10 14:50 bin
drwxr-xr-x 3 root root 4096 2011-08-10 14:56 bash
drwxr-xr-x 19 root root 4580 2011-11-23 20:29 dev
drwxr-xr-x 137 root root 12288 2011-11-23 20:29 etc
drwxr-xr-x 4 root root 4096 2011-08-10 14:42 home
lrwxrwxrwx 1 root root 37 2011-08-10 14:49 initrd.img -> boot/initrd.img-2.6.38-10-generic-pae
drwxr-xr-x 21 root root 4096 2011-08-11 22:37 lib
drwxr-xr-x 2 root root 4096 2011-04-21 17:50 mnt
drwxr-xr-x 2 root root 4096 2011-04-25 23:50 opt
dr-xr-xr-x 377 root root 0 2011-11-21 04:34 proc
drwx------ 8 root root 4096 2011-08-11 23:40 root
drwxr-xr-x 2 root root 4096 2011-08-10 14:54 sbin
drwxr-xr-x 2 root root 4096 2011-03-21 08:26 selinux
drwxr-xr-x 2 root root 4096 2011-04-25 23:50 srv
drwxr-xr-x 13 root root 0 2011-11-21 04:35 sys
drwxrwxrwt 19 root root 4096 2011-11-23 20:34 tmp
drwxr-xr-x 12 root root 4096 2011-08-10 14:55 usr
drwxr-xr-x 15 root root 4096 2011-04-26 00:06 var
lrwxrwxrwx 1 root root 34 2011-08-10 14:49 vmlinuz -> boot/vmlinuz-2.6.38-10-generic-pae
root@unknowns:~$ uptime
20:38:51 up 2 days, 16:02, 2 users, load average: 0.00, 0.06, 0.09
root@unknowns:~$ last
root pts/0 :0 Wed Nov 23 20:34 still logged in
root pts/2 :0 Tue Nov 22 12:28 - 20:37 (1+08:08)
root pts/1 :0 Tue Nov 22 12:28 - 15:15 (02:46)
root pts/1 :0 Tue Nov 22 12:27 - 12:28 (00:00)
root pts/0 :0 Tue Nov 22 12:21 - 15:15 (02:53)
root pts/0 :0 Tue Nov 22 12:13 - 12:14 (00:00)
root pts/0 :0 Tue Nov 22 12:13 - 12:13 (00:00)
root pts/0 :0 Tue Nov 22 12:12 - 12:13 (00:00)
root pts/0 :0 Tue Nov 22 12:11 - 12:12 (00:00)
root pts/0 :0 Tue Nov 22 12:08 - 12:09 (00:00)
root tty7 :0 Mon Nov 21 09:43 still logged in
root system boot 2.6.38-10-generi Mon Nov 21 04:35 - 20:41 (2+16:05)
root tty7 :0 Fri Nov 18 15:46 - crash (2+12:48)
root system boot 2.6.38-10-generi Fri Nov 18 05:18 - 20:41 (5+15:22)
root pts/1 :0.0 Sun Nov 13 21:03 - 21:03 (00:00)
root pts/1 :0 Wed Nov 9 19:31 - 20:57 (4+01:25)
root pts/0 :0 Tue Nov 8 19:52 - crash (9+09:25)
root pts/0 :0 Tue Nov 8 11:49 - 11:50 (00:00)
root pts/0 :0 Tue Nov 8 11:40 - 11:42 (00:01)
root pts/1 :0 Tue Nov 8 11:30 - 11:31 (00:00)
root pts/0 :0 Tue Nov 8 11:17 - 11:31 (00:14)
root pts/0 :0 Tue Nov 8 11:07 - 11:08 (00:01)
root pts/2 :0 Mon Nov 7 22:49 - 22:57 (00:08)
root pts/1 :0 Mon Nov 7 22:29 - 22:49 (00:20)
root pts/0 :0 Mon Nov 7 22:28 - 22:49 (00:20)
guest tty8 :1 Mon Nov 7 18:11 - crash (10+11:06)
root tty7 :0 Sat Nov 5 11:12 - crash (12+18:05)
reboot system boot 2.6.38-10-generi Sat Nov 5 11:12 - 20:41 (18+09:29)
root pts/0 :0 Thu Nov 3 21:28 - crash (1+13:43)
root pts/3 :0 Wed Nov 2 21:00 - 21:00 (00:00)
root pts/3 :0 Wed Nov 2 16:40 - 17:23 (00:43)
root pts/3 :0 Tue Nov 1 20:50 - 20:51 (00:00)
root@unknowns:/# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
sshd:x:101:65534::/var/run/sshd:/usr/sbin/nologin
spin:x:1000:1000:Spin,,,:/home/spin:/bin/bash
messagebus:x:102:104::/var/run/dbus:/bin/false
postfix:x:103:106::/var/spool/postfix:/bin/false
unknowns:x:1001:1001:unknowns,,,:/home/unknowns:/bin/bash
____________________________________________________________________________________________________
for some extra lulz, here's his leader crying about getting pwned:
____________________________________________________________________________________________________
"I will just post some ideas by the name of The Unknowns:
1- We admit it, you r00ted our site, we lost a fight but we didn't loose the war yet...
2- If you took down our site, which we barely use, we will take it back online in the next day...
3- If you Dox us, we don't care, all our friends, governments knows about us, and we're proud of it...
4- If The Unknowns Doxed you, your end will come...
5- Whatever you do, The Unknowns will never die, you shall always expect us Whatever happens...
6- We Will Strike back..."
-- Damn, sure shaking in my boots buddy. Krunk was the resident skiddie of this group. The quote
above from that moron is actually their leader. Let that sink in...
____________________________________________________________________________________________________
Leaked database entries with his info listed below.
Feel free to crack his hashes, but only if it is for purpose of messing with this fool!____________________________________________________________________________________________________
thebotnetcom.txt:(79790, 2, NULL, 0, 'xmkb', 'fe29851838397be19bcde4584052267b', '2012-04-11', '[email protected]',
0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 2, 0, 'I Leech Bots', 0, 1334179500, 0, 1334286782, 1340268794, 1334279921,
1031826, 6, 0, 17, -6, 0, 0, 0, 0, 0, 11541719, 0, NULL, '0000-00-00', -1, -1, '99.174.76.177', 0, 1, 0, 0, -1, 1, 1,
'~-0qS1G/|<-;]q@-=SyX`*g$(%cF2-', 0, 0, 0, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL, NULL, 1, 0, 0, 0, NULL,
NULL, 0.00, 0.00, 0, 0, 0, NULL, NULL, NULL, 0, 0, 0, 1, 0, 379, 0, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)
hackforums.sql:(589479, 'DDoS1337', '9787b9f43503ef4a5264865a97beb826', 'VdJt1S6R',
'z7WHG1tHg9cDWY9VWKawOu2b2KKyPkQji7oXghdhL68ZIqrTzn', '[email protected]', 35, 0, 0.00, 'images/avatars/killza.png',
'80|80', 'gallery', 2, NULL, 0, NULL, 1291814928, 1297212660, 1297210897, 1293693924, NULL, 0, NULL, NULL, NULL, '14-10-1990',
'all', '[img]danasoft.com/sig/Matts1337MadPwn.jpg[/img]\r\n\r\n[font=Arial][color=#4682B4]DDoS 1337[/color][/font]
(Tutorials, Hacks, and Services)\r\n\r\n-[color=#FF0000]Sniper Frags[/color]-\r\n', '\"[Image:\n\nDDoS 1337
(Tutorials, Hacks, and Services)\n\n-Sniper Frags-\n', 1, 0, 0, 0, 1, 1, 0, 'linear', 1, 1, 1, 1, 0, 0, 0, NULL, NULL, -6, 1, 1,
563935, NULL, 0, 0, 0, 0, NULL, '1**Inbox$%%$2**Sent Items$%%$3**Drafts$%%$4**Trash Can', NULL, 0, 0, -1, '99.174.76.177',
'99.174.76.177', 1672367281, 1672367281, 'english', 115599, 1, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, NULL)
forumkorner.sql:('8484','Respect.','925561f9dcabaf9601a0f6974fbe9cdf','WGARTqe4','','[email protected]','103','0','
./uploads/avatars/avatar_8484.png?dateline=1340525841','100|70','upload','7','','0','','1339623114','1340745282','1340741750',
'1340687038','','0','','','','1-1-1990','all','[b][color=#000000][size=medium][align=center]Selling the YouTube\'s \'Krunk\'
and \'Batman\'.
I am also selling the gamertag \'Peacock\'. HMU.[/align][/size][/color][/b]','1','0','0','0','1','0','2','0','linear',
'1','1','1','1','0','0','0','','','-8','1','2','','','35','0','0','0','','1**$%%$2**$%%$3**$%%$4**','','0','0','5','95.141.28.57','99.174.76.177','1603083321','1672367281','','90530','1','34','1','0','0','0','0',
'0','0','0','0','0','7','0','','0','','','','','','186','0.0000000000','0','',NULL,NULL,NULL,'0.00','1','1','
{\"rep\":1,\"pm\":1,\"buddylist\":1,\"quoted\":1,\"post_threadauthor\":1}');
forumkorner.sql:('8459','OHEKTA','4f84c8a5314a9d495a4882c586ed4944','9lk6TgVv','','[email protected]','2','0','','','','7','','0',
'','1339484022','1339622713','1339622713','1339484514','','0','','','','1-1-1990','all','','1','0','0','0','1','0','2','0','linear','1','1','1','1','0','0','0','','','-8','1','2','','','35',
'0','0','0','','1**$%%$2**$%%$3**$%%$4**','','0','0','0','95.141.28.53','99.174.76.177','1603083317','1672367281','','1959',
'1','1','1','0','0','0','0','0',
'0','0','0','0','1','0','','0','','','','','','18','0.0000000000','0','',NULL,NULL,NULL,'0.00','1','1','
{\"rep\":1,\"pm\":1,\"buddylist\":1,\"quoted\":1,\"post_threadauthor\":1}');
>>[ Skid #2 rekt -- skid #3 gun get got in next writeup ]<<
____________________________________________________________________________________________________
_..._
.-'_..._''.
.' .' '.\ . .--. __.....__
/ .' .'| |__| .-'' '. _.._
. ' < | .--. / .-''"'-. `. .' .._|
| | | | | | / /________\ \ | '
| | | | .'''-. | | | | __| |__
. ' | |/.'''. \ | | \ .-------------' |__ __|
\ '. . | / | | | | \ '-.____...---. | |
'. `._____.-'/ | | | | |__| `. .' | |
`-.______ / | | | | `''-...... -' | |
` | '. | '. | |
'---' '---' |_|
____________________________________________________________________________________________________
>>[CONGRATULATIONS MY MAN, YOU'VE MANAGED TO EARN YOUR OWN UNIQUE FOLLOW-UP PWNAGE TREATMENT!]<<
____________________________________________________________________________________________________
I guess maybe in future you'll think twice about attempting to target us.
So far, all these kiddies have managed to do is post some fail dox and once they realise that isn't going to
work, they resort to trying to get aurora to hack me.. lol.
(8:37:48 PM) [email protected]: this is Aurora, i'm not here to fight or anything
(8:37:54 PM) [email protected]/7604914431391891634716553: lol
(8:37:58 PM) [email protected]: just wanna ask what your problem is with me
(8:38:02 PM) [email protected]/7604914431391891634716553: with you?
(8:38:02 PM) [email protected]/7604914431391891634716553: what
(8:38:03 PM) [email protected]: like, what did i do to you
(8:38:10 PM) [email protected]/7604914431391891634716553: tf u talkin about
(8:38:15 PM) [email protected]: yeah im getting from like 3 different kiddies
(8:38:18 PM) [email protected]: that you hate me or something
(8:38:18 PM) [email protected]: lol
(8:38:20 PM) [email protected]/7604914431391891634716553: let me guess
(8:38:21 PM) [email protected]/7604914431391891634716553: chF
(8:38:22 PM) [email protected]: idk, it may all be hearsay
(8:38:23 PM) [email protected]/7604914431391891634716553: heard/meo
(8:38:23 PM) [email protected]/7604914431391891634716553: etc?
(8:38:26 PM) [email protected]: chf, hann, and meo
(8:38:27 PM) [email protected]: yeah
____________________________________________________________________________________________________
Also this made me laugh:
____________________________________________________________________________________________________
[10/02/2014 16:29:12] Scott Thomas - I guess you could say he.. got off Scott Free.: people I closesly associate with
[10/02/2014 16:29:13] Scott Thomas - I guess you could say he.. got off Scott Free.: taught chief
[10/02/2014 16:29:15] Scott Thomas - I guess you could say he.. got off Scott Free.: EVERYTHING
[10/02/2014 16:29:16] Scott Thomas - I guess you could say he.. got off Scott Free.: he knows
____________________________________________________________________________________________________
chF delusional lol:
____________________________________________________________________________________________________
http://ask.fm/chFtheCat/answer/109177573320
-- LOL, so you're calling TriCk a wannabe hacker? Lets compare, shall we.
chF's past work:
-- DDoSing steam (arguably at that), posting dox.
TriCk's past work:
-- hacking NASA, NATO, the United Nations, Scotland Yard / MI6, Tony Blair, BlackBerry, facebook.com
the list goes on but you should get the point :)
Now as soon as this is posted, these kids are gonna start retweeting it (as they have done with all of the failed
dox attempts against them - the reason for this is basic psyops, if they were to ignore it, then it would confirm
that the dox is infact correct. You're not fooling anyone)
chief - you may wonder why your hashes + other info aren't being posted yet, that is because i'm in the process of
writing up a zine specifically for you. You must feel special.
Enjoy :)
____________________________________________________________________________________________________
KEEP YOUR EYES PEELED FOR PART #2 - CHF IS OUR PRIMARY TARGET
GET READY TO WATCH THE REAL PWNAGE UNFOLD ;)
EOF
____________________________________________________________________________________________________ ,ad8888ba, 88 d8"' `"8b ,d 88 d8' 88 88 88 ,adPPYYba, MM88MMM ,adPPYba, ,adPPYb,d8 88 88 ,adPPYYba, ,adPPYb,88 88 "" `Y8 88 I8[ "" a8" `Y88 88 88 "" `Y8 a8" `Y88 Y8, ,adPPPPP88 88 `"Y8ba, 8b 88 88 88 ,adPPPPP88 8b 88 Y8a. .a8P 88, ,88 88, aa ]8I "8a ,d88 "8a, ,a88 88, ,88 "8a, ,d88 `"Y8888Y"' `"8bbdP"Y8 "Y888 `"YbbdP"' `"YbbdP'88 `"YbbdP'Y8 `"8bbdP"Y8 `"8bbdP"Y8 88 88888888888 88 88 88 88 88 88 88 88aaaaa 8b, ,d8 8b,dPPYba, ,adPPYba, ,adPPYba, ,adPPYba, ,adPPYb,88 88""""" `Y8, ,8P' 88P' "8a a8" "8a I8[ "" a8P_____88 a8" `Y88 88 )888( 88 d8 8b d8 `"Y8ba, 8PP""""""" 8b 88 88 ,d8" "8b, 88b, ,a8" "8a, ,a8" aa ]8I "8b, ,aa "8a, ,d88 88888888888 8P' `Y8 88`YbbdP"' `"YbbdP"' `"YbbdP"' `"Ybbd8"' `"8bbdP"Y8 88 88 ____________________________________________________________________________________________________ The beginning of the end of your cybercrime career. Prepare to meet your makers, CatSkids. - by MLT && [REDACTED] ____________________________________________________________________________________________________ So, for the umpteenth time, a skid group has attempted to release a dox on me for no particular reason. The main culprit is chFthecat, although his friends Meo/Heard and Krunk were also involved in attempting to dox me. This is my retaliation to their pathetic dox attempts. This writeup will primarily focus on Meo and Krunk, as those two helped with the dox, while chF was the ringleader of the whole thing... therefore, I am creating a follow-up release focusing on chF alone. To the new generation of script kiddies: let this serve as a reminder as to why you shouldn't mess with people on the internet without knowing what they are capable of. This release will include a compilation of doxes + other info on various members of catsquad, although not all information here may be 100% confirmed, all possible leads will be included in order to assist others in gathering more information on the group. For those of you who do not know, catsquad is a group of 'hackers' who are evidently new to the scene, they originated from Xbox Live and so far have shown no 'skill' other than the ability to dox and DDoS (and even then, this will go on to show how their doxes are the majority of the time just outdated info that has been posted in the past by people who actually know what they are doing). They have the audacity to talk shit about real hackers, therefore I am releasing this and covering all possible information on their group. Hopefully these skidiots will get the v& they deserve ____________________________________________________________________________________________________ .-'''-. ' _ \ __ __ ___ __.....__ / /` '. \ | |/ `.' `. .-'' '. . | \ ' | .-. .-. ' / .-''"'-. `. | ' | ' | | | | | | / /________\ \ \ \ / / | | | | | | | | `. ` ..' / | | | | | | \ .-------------' '-...-'` | | | | | | \ '-.____...---. |__| |__| |__| `. .' `''-...... -' ____________________________________________________________________________________________________ Ok, lets begin with the German nub Heard aka Meo, before any dox is dropped, I'm going to start with some hilarity to show everyone that he clearly has no fucking clue what he is doing. Here are logs of me in the box for a pornsite that he owns, note the plaintext passes stored: ____________________________________________________________________________________________________ me@ks4002422 ~ $ cd /home/heard/enudes.info me@ks4002422 /home/heard/enudes.info $ ls accounts girls index.py index.pyc sessions static templates me@ks4002422 /home/heard/enudes.info $ cd accounts me@ks4002422 /home/heard/enudes.info/accounts $ ls -la total 320 drwxr-xr-x 2 root root 4096 Jan 10 23:54 . drwxr-xr-x 7 heard heard 4096 Jan 10 22:54 .. -rw-r--r-- 1 root root 165 Jan 10 21:59 %3Cscript%3Ealert%28%22injection%22%29;%3C%2Fscript%3E.txt -rw-r--r-- 1 root root 60 Jan 10 23:16 69thathoe.txt -rw-r--r-- 1 root root 107 Jan 10 23:51 Abraidism.txt -rw-r--r-- 1 root root 45 Jan 10 21:51 AnonyMooseGawd.txt -rw-r--r-- 1 root root 115 Jan 10 21:51 AnonyMoose.txt -rw-r--r-- 1 root root 24 Jan 10 21:45 apple.txt -rw-r--r-- 1 root root 24 Jan 10 21:39 asdasd.txt -rw-r--r-- 1 root root 22 Jan 10 21:42 asdfasdf.txt -rw-r--r-- 1 root root 81 Jan 10 22:12 banana.txt -rw-r--r-- 1 root root 34 Jan 10 21:51 bezo.txt -rw-r--r-- 1 root root 43 Jan 10 21:46 bigcock1842.txt -rw-r--r-- 1 root root 62 Jan 10 22:19 Booboi127.txt -rw-r--r-- 1 root root 138 Jan 10 21:50 Booboo127.txt -rw-r--r-- 1 root root 36 Jan 10 21:43 Bshsnsjssj.txt -rw-r--r-- 1 root root 35 Jan 10 21:44 Camos.txt -rw-r--r-- 1 root root 45 Jan 10 21:42 chazwonder.txt -rw-r--r-- 1 root root 57 Jan 10 23:09 ddbrad.txt -rw-r--r-- 1 root root 30 Jan 10 21:52 dfgdfg.txt -rw-r--r-- 1 root root 144 Jan 10 22:06 Dick.txt -rw-r--r-- 1 root root 92 Jan 10 23:15 DLCK.txt -rw-r--r-- 1 root root 30 Jan 10 21:43 Drxyy.txt -rw-r--r-- 1 root root 28 Jan 10 21:45 eGod.txt -rw-r--r-- 1 root root 28 Jan 10 21:46 Egod.txt -rw-r--r-- 1 root root 36 Jan 10 21:57 erkngehrir.txt -rw-r--r-- 1 root root 139 Jan 10 22:39 faggotlol.txt -rw-r--r-- 1 root root 51 Jan 10 23:28 fffffff.txt -rw-r--r-- 1 root root 50 Jan 10 22:44 fwefewf.txt -rw-r--r-- 1 root root 43 Jan 10 21:43 gofuckyourself.txt -rw-r--r-- 1 root root 57 Jan 10 22:51 Grimzy.txt -rw-r--r-- 1 root root 21 Jan 10 22:28 g.txt -rw-r--r-- 1 root root 29 Jan 10 21:55 Gypsy.txt -rw-r--r-- 1 root root 25 Jan 10 21:44 hey.txt -rw-r--r-- 1 root root 40 Jan 10 23:03 HI.txt -rw-r--r-- 1 root root 19 Jan 10 21:47 Hjjnncgg.txt -rw-r--r-- 1 root root 43 Jan 10 23:48 H.txt -rw-r--r-- 1 root root 89 Jan 10 23:54 hugecock92.txt -rw-r--r-- 1 root root 27 Jan 10 22:14 hzzg.txt -rw-r--r-- 1 root root 50 Jan 10 23:03 Ihateneslo.txt -rw-r--r-- 1 root root 26 Jan 10 21:44 jesse.txt -rw-r--r-- 1 root root 29 Jan 10 21:47 Jsnsj.txt -rw-r--r-- 1 root root 17 Jan 10 21:47 kfkdsn.txt -rw-r--r-- 1 root root 56 Jan 10 22:15 Knave.txt -rw-r--r-- 1 root root 6 Jan 10 21:49 k.txt -rw-r--r-- 1 root root 31 Jan 10 21:43 Kush.txt -rw-r--r-- 1 root root 57 Jan 10 22:04 Lackofshit.txt -rw-r--r-- 1 root root 45 Jan 10 23:49 lol.txt -rw-r--r-- 1 root root 111 Jan 10 22:02 Madness.txt -rw-r--r-- 1 root root 44 Jan 10 22:12 matt.txt -rw-r--r-- 1 root root 46 Jan 10 21:52 Mckay.txt -rw-r--r-- 1 root root 43 Jan 10 22:01 meoisgay.txt -rw-r--r-- 1 root root 41 Jan 10 22:18 meo.txt -rw-r--r-- 1 root root 40 Jan 10 21:53 Minow322.txt -rw-r--r-- 1 root root 34 Jan 10 21:48 Nice.txt -rw-r--r-- 1 root root 97 Jan 10 21:54 nigger.txt -rw-r--r-- 1 root root 34 Jan 10 21:45 Nigger.txt -rw-r--r-- 1 root root 43 Jan 10 21:44 NoMods.txt -rw-r--r-- 1 root root 26 Jan 10 21:43 None.txt -rw-r--r-- 1 root root 39 Jan 10 21:43 nwtt lmao.txt -rw-r--r-- 1 root root 106 Jan 10 22:57 Outcast.txt -rw-r--r-- 1 root root 124 Jan 10 23:26 PartyRocker69.txt -rw-r--r-- 1 root root 35 Jan 10 21:42 peso300.txt -rw-r--r-- 1 root root 31 Jan 10 21:42 randm.txt -rw-r--r-- 1 root root 41 Jan 10 21:40 Rezi.txt -rw-r--r-- 1 root root 35 Jan 10 21:46 Signs jus.txt -rw-r--r-- 1 root root 39 Jan 10 21:43 Smd111111.txt -rw-r--r-- 1 root root 78 Jan 10 22:28 SMS.txt -rw-r--r-- 1 root root 298 Jan 10 22:04 spencer.txt -rw-r--r-- 1 root root 43 Jan 10 21:52 Thatguy561.txt -rw-r--r-- 1 root root 317 Jan 10 22:27 TheMLGNation.txt -rw-r--r-- 1 root root 118 Jan 10 22:10 Trendinq.txt -rw-r--r-- 1 root root 35 Jan 10 21:43 trojan21.txt -rw-r--r-- 1 root root 36 Jan 10 21:43 trojan.txt -rw-r--r-- 1 root root 35 Jan 10 21:43 Tuqp.txt -rw-r--r-- 1 root root 218 Jan 10 23:22 .txt -rw-r--r-- 1 root root 12 Jan 10 21:47 WTFf.txt -rw-r--r-- 1 root root 46 Jan 10 21:52 xCerebellum.txt -rw-r--r-- 1 root root 37 Jan 10 21:55 YoloSwag.txt -rw-r--r-- 1 root root 40 Jan 10 22:36 yolo.txt ____________________________________________________________________________________________________ These files contain usernames, passwords, IP addresses, and emails, and they are written to the 'accounts' dir via his failed login system, here is their src code: ____________________________________________________________________________________________________ me@ks4002422 /home/heard/enudes.info $ cat index.py #!/usr/bin/env python2 import web import glob import os.path from recaptcha.client import captcha urls = ( '/', 'register', '/index.php', 'index', '/girls', 'girls', '/girls/(.*)', 'viewG', '/boys/(.*)', 'viewB', '/boys', 'boys', '/upload', 'upload', '/login', 'login', ) app = web.application(urls, globals()) session = web.session.Session(app, web.session.DiskStore('sessions')) web.config.debug = True render = web.template.render('templates/') class index: def GET(self): return render.index() class girls: def GET(self): girlPics = [] for i in glob.glob("girls/*"): i = i.replace('girls/', '') i = "<a href=\"/girls/%s\">%s</a>" % (i, i) girlPics.append(i) return render.girls('<br \>\n'.join(girlPics)) class viewG: def GET(self, filename): return open('girls/%s' % filename).read() class boys: def GET(self): girlPics = [] for i in glob.glob("boys/*"): i = i.replace('boys/', '') i = "<a href=\"/boys/%s\">%s</a>" % (i, i) girlPics.append(i) return render.boys('<br \>\n'.join(girlPics)) class viewB: def GET(self, filename): return open('boys/%s' % filename).read() class upload: def GET(self): return 'closed temp' class upload2: def GET(self): return render.upload() def POST(self): postData = web.input() response = captcha.submit(postData['recaptcha_challenge_field'], postData['recaptcha_response_field'], '6Lfp0-wSAAAAAM35vqvGD9MybGjck70bjkzc-P18', web.ctx['ip']) if not response.is_valid: return 'bad captcha..' else: sex = web.input()['sex'] x = web.input(myfile={}) filename = x['myfile'].filename # This is the filename if '..' in filename or '<' in filename or '>' in filename or '.php' in filename: web.seeother('http://http://akk.li/pics/anne.jpg') content = x['myfile'].value # This is the file contents filename = filename.split(".") filename[-1] = '' filename = '.'.join(filename) if os.path.isfile('%s/%s' % (sex, filename)): return 'file exists' file = open('%s/%s' % (sex, filename), 'w') file.write(content) file.close() raise web.seeother('/%s' % sex) class register: def GET(self): if session.get('logged_in', False): web.seeother('/index.php') return render.register() def POST(self): username = web.input()['username'] email = web.input()['email'] password = web.input()['password'] file = open('accounts/%s.txt' % username, 'a') file.write('%s:%s:%s:%s\n' % (username, email, password, web.ctx['ip'])) file.close() session.logged_in = True web.seeother('http://enudes.info/index.php') class login: def GET(self): return render.register() def POST(self): session.logged_in = True raise web.seeother('/') if __name__ == "__main__": web.wsgi.runwsgi = lambda func, addr=None: web.wsgi.runfcgi(func, addr) app.run() ____________________________________________________________________________________________________ BECAUSE THAT'S SECURE? RIGHT?! Also yes, that is a "boys" directory, is this kid a fuckin pedophile?? ____________________________________________________________________________________________________ Some logs of me digging around in his compromised server: ____________________________________________________________________________________________________ me@ks4002422 /home/heard $ uname -a ; id Linux ks4002422.ip-198-100-147.net 3.10.25-gentoo-xxxx-grs-ipv6-64 #2 SMP Sat Jan 11 17:26:42 EST 2014 x86_64 Intel(R) Core(TM) i3-2130 CPU @ 3.40GHz GenuineIntel GNU/Linux uid=1001(me) gid=1001(me) groups=1001(me) me@ks4002422 /home/heard/enudes.info/sessions $ ls 003cfff8af67abcb74c79344090cec2ed42159d8 03dc92c51aa3968b1a24f2bf70e97c3ae8fe43b5 048dd8bb0c1e7278e59938d54328e4f3dd6c40fe 05045a02b4b93fb5c2b76e36ca7b528f0402da14 08f2af6c71ceb0cddb04e62fab352885b49ee15c 0b039aeb1b480536f879af314423561ec228237a 0e3107ab061e9cff7ddccbaac7da5db3b600f7df 15a996326d43a9a47b4099cfa686eba6d251beda 17fef826118fc71f0a1ba2773652708eda187d19 19b38cf6d3c762098209d1f1c3c4d8027c6dcc80 1bf67a41611a6da5852ca7ff10c1b6bca03781d5 1d153b775db2290acf57c16079ad0042964a31e6 1dfd6031ef17c27aa4d4b65f4f7e2a7b4cbe6d4a 1f0547ba01546981bab2590094b70b12c136dd5b 2b58b39199b03ad69e764d1100e9e5102bbc364f 2e12d4a59987c3966b73a54d14608f829ca6be69 344da690241f2a537b4c2f1866d996217715bb68 3662fb9b20c0512d52e6ed8f05dfe0108328edf4 3b4894c7fd5ac1edc088aaf67620cb67e14cb40a 46a65a74a5ada25fbf2bd7b870654483ef4c30c9 4957f82c9741d2a22897e835638c6b3dc0c3df63 4f5388a4bf55372c8fac5d98ddd6f9ea720e9131 54c142b81e1ae1b35522f51d58dc4231d9505d22 5c3e2fd26d9bc6d1533859f816e66c759b50a344 5db0b6d7c1764b465504eadca4302696f7e38211 60e37d542fd0b921daffd1eb966e3ff552d92f9d 60fd7c2770771f608585225e9a6b533428400d55 62116d964306bbbe525594eec453542b1b20fa48 64831fd54eff32cf1bccf877c1d31306e8d39d4c 6f57e5203d91e06f10efc1b8a8e663414694ebcc 73e97103f2ce4aceaffed7a39e5b261dc0c3091f 76e974a0a06837fc9ea4673ad59649d8463da299 7b9aa52026f92c2b82677545b5a3d8ba6bbeb044 7cb2e98e840b9edb58cecd0e3a7f336157138a50 812f0a86c480c3488a48615a038fe5960652d1c2 81ed47ca43350990702523bf0a6740acd6e5d06b 8500a020ab8b3fe1a68dc6261b7e285e1749c0ed 87e99fbf9732d9ebf679e08b60ff00dfcdcf874d 8b68a21379779276a079bf99a9cb181ca035456c 8bf0f8c3daae9d289408c8c6e4fc4389dfaa2d2e 8e9fb7895dac65969f829f8dbeb52946e2412ebb 90e34eace0bf40f7ef55ae72d3d594b426b8dff3 9157f4c8a910cd47c9ecf920d7f089083be14527 9858c21a28ea2737fc632a4cbbceec7e486623a4 9910c1f6b824fe645ee8e9c270ac2a53a5c446fa a333edfdab79be54fb5b745d85a8e10c80c25af2 aadcadbfddb3eaec20de4dba0e42ffc3dddc05d9 af5d3fcbb157db15d980364bd85e84ac039fe639 b17856081e6dd292073e6ccd40729a82e89c5fd5 b22a1c6fbf3c37dbbf7ed58f25b5efbb529d4e8e b4cb10d13812ecebcc161779d692d0ae16f74c10 bb253c0c94997f8883dadf1f69110f7fc048c3a6 c17e996bdd6dea685d26ae29e645ec1a73c53ce9 c1a730e20518537376a39787d9fd4ad2113a388e d4383599e628374c99d28c7b67e9fe1e5ffd5d5a d990885962dde900961adbda629d75c04d61e85f e6caafd95dd7d256e4433538c039ab7dfe4bd805 e734f104d4d803e1853dd330806b7b5e1ba76a40 e796313f2753d0abc90df7f766576111a694eb50 e8996295e2c2f9b7922dfb199721b0d2411551a7 eac1939e29b61891eaeab4e4b950934c14b6c1bc ec761217e4b43eb9461d77902a0d99d2213faea0 ec7a53b4104392ee02f54eea59d50f1cffafbd79 ef0ec3c6e3dd5e483ca3e8dbbabb356856e9ff77 fc2bd33aa810976c7c8de6febcd72c1c2ecbee02 ____________________________________________________________________________________________________ According to Meo, having axx to this box means nothing as its 'shared'. By this logic, anyone who uses shared hosting to host their site (ie the vast majority of sites) is in theory 'unhackable', as if someone gains axx to the shared host and defaces their site, it somehow doesn't count because it's shared? LOL OK anyhow... moving on... here's Meo's dox just in case you feel like sending him a thank you gift for being such a cool dude ;) ____________________________________________________________________________________________________ Confirmed dox: - Name: Nico Weber - Business Address: Mainzer Str. 8, D-66111 Saarbrücken - Father's business address: Fallerweg, 7', 'Wittlich', '54516 - Home address: Wasserlohstrae 2a, Chieming, Bayern 83339 - Current IP address: 78.34.221.152 - Previous IP address: 78.35.62.66 - ISP: NetCologne - xdsl-78-34-221-152.nc.de - Personal phone number: +49.86649274547 - aliases: Meo, Heard, mest007, timo0034, timo9867, nico1921, zeitvertreib137, byPsyK0, ixmeo - Emails: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] ____________________________________________________________________________________________________ Now, onto the results of some grep'd db's containing meo's email addresses and hashed passwords (feel free to crack them, as this retard most likely re-uses his passwords: ____________________________________________________________________________________________________ root@a19s16:~/mysql# grep * -e 'mest007\|timo0032\|timo9867\|nico1921\|zeitvertreib137\|byPsyK0\|ixmeo' Bugabuse\EazySubs.com.txt:17295,mest007,psykozz,[email protected],a0c449597a15121cb1fd5 5ad6cb82241,Bc/ Hacking\AdminDiscussion.com.sql: ,('5497', 'Levi', 'e0be7c79967535af50d68 cb72c14ebca', '3XfytB3b', 'WrS3lXJpEd7MkiKzhO2KyZlpJ8XWh2rxmrQbWYtg5cV8cIVSBL', '[email protected]', '48', '0', './uploads/avatars/avatar_268.png?dateline=13432 14711', '170|170', 'upload', '2', '', '0', 'ááááááááááááááááááááááááááááááááááá' , '1343214483', '1345194705', '1344986489', '1344393175', '', '0', '', '', '', ' ', 'all', 'Levi, proud to be a member of CodMedia.net since Jul 2012.[align=righ t][url=http://www.youtube.com/user/mest007?]My YouTube[/url][/align]\r\n[align=c enter][IMG]http://i.imgur.com/l3XPX.png[/IMG][/align]\r\n', '1', '0', '1', '0', '1', '0', '1', '0', 'linear', '1', '1', '1', '1', '0', '0', '0', '0', '0', '1', '0', '2', '', '', '4', '0', '0', '0', '', '1**$%%$2**$%%$3**$%%$4**', '', '1', ' 0', '0', '81.108.253.12', '81.108.253.12', '1366097164', '1366097164', '', '7762 8', '1', '1', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '1', '0', '', '' , '', NULL) Unsorted\EazySubscom\Part2DB.txt:"17295","mest007","psykozz","[email protected]","a0c44 9597a15121cb1fd55ad6cb82241","Bc/" Hacking\thebotnet.txt: ,(37344, 2, NULL, 0, 'timo0034', '66a29c00f15fbaa7222fbf 136b90741d', '2011-02-08', '[email protected]', 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 2, 0, 'They See Me Lurking', 0, 1297188041, 0, 1297188041, 129718810 3, 0, 0, 0, 0, 17, -8, 0, 0, 0, 0, 0, 11541591, 0, NULL, '0000-00-00', -1, -1, ' 78.34.221.152', 0, 1, 0, 0, -1, 0, 0, '^R4:JC=A<]-BlLYH3U4GY,UQ!g=|+}', 0, 0, 0, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL, NULL, 1, 0, 0, 0, NULL, N ULL, 0.00, 0.00, 0, 0, 0, NULL, NULL, NULL, 0, 0, 0, 1, 0, 379, 0, NULL, 0, 0, 0 , 0, 0, 0, 0, 0, 0, 0, 0) Bugabuse\EazySubs.com.txt:16520,IMW3Area,psykoz,[email protected],eeccb8285bd492b ffa2598537dd2b892,wL+ Hacking\Booters\Asylum Stresser.txt:meopeo:1e65451668fe271407673dc283869704b0cf5 aca:[email protected] Unsorted\EazySubscom\Part2DB.txt:"16520","IMW3Area","psykoz","[email protected]", "eeccb8285bd492bffa2598537dd2b892","wL+" Gaming\HabboSt.txt:MW2King:94db9afd515e6a1bf1c1a09312b49eb1:[email protected] :87.245.125.243 Gaming\HabboSt.txt:yassmin8:b00c36c9f2d8569db25e94dfeb594d5a:[email protected]:80.1 31.139.252 ____________________________________________________________________________________________________ Now, it's time to pwn his LAN -- thanks to 0x80 for helping out w/ weaponizing the browser 0day Below you can find internal information pertaining to his home network, including the password to his wifi network: ____________________________________________________________________________________________________ SSID: NETCONNECT-8463 Password: 2764734468045714 ISP: NetCologne GmbH IP: 78.35.62.66 Gateway: 195.14.226.43 Primary DNS: 81.173.194.69 Secondary DNS: 81.173.194.77 Mullvad VPN ID: 823576304322, Port: 21386 IP Type Port 192.168.0.128 All 27015 192.168.0.128 TCP 25565 192.168.0.130 UDP 88 192.168.0.130 TCP 80 192.168.0.130 TCP/UDP 53/53 192.168.0.130 TCP/UDP 3074/3074 192.168.0.131 TCP 27014-27050 eth0: Link encap:Ethernet HWaddr 00:23:54:ec:79:21 UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) Interrupt:45 Base address:0xc000 lo: Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:161905 errors:0 dropped:0 overruns:0 frame:0 TX packets:161905 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:27992995 (26.6 MiB) TX bytes:27992995 (26.6 MiB) tun0: Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:172.27.0.44 P-t-P:172.27.0.44 Mask:255.255.252.0 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:825351 errors:0 dropped:0 overruns:0 frame:0 TX packets:886392 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:364310483 (347.4 MiB) TX bytes:147951239 (141.0 MiB) wlan0: Link encap:Ethernet HWaddr 00:21:5d:2a:aa:90 inet addr:192.168.0.102 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::221:5dff:fe2a:aa90/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:866787 errors:0 dropped:0 overruns:0 frame:0 TX packets:934115 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:450710670 (429.8 MiB) TX bytes:251872777 (240.2 MiB) >>[ Skid #1 rekt -- time to move onto skid #2 ]<< ____________________________________________________________________________________________________ . _..._ . .'| .' '. .'| .' | .-,.--. . .-. . .' | < | | .-. | | ' ' | < | | | ____ | | | | _ _ | | | | | | ____ | | \ .' | | | | | ' / | | | | | | | \ .' | |/ . | | '- .' | .' | | | | | | |/ . | /\ \ | | / | / | | | | | | /\ \ | | \ \ | | | `'. | | | | | | | \ \ ' \ \ \ |_| ' .'| '/ | | | | ' \ \ \ '------' '---' `-' `--' '--' '--' '------' '---' ____________________________________________________________________________________________________ After he began to realize he'd bitten off more than he could chew, he decided to beg for mercy: ____________________________________________________________________________________________________ (2:24:15 PM) [email protected]: dude (2:24:19 PM) [email protected]: ill pay u btc (2:24:23 PM) [email protected]: to not drop me (2:24:26 PM) [email protected]: dude plz -- Sorry krunk, but we don't take bribes ;) "(2:24:26 PM) [email protected]: dude plz" <--- maybe if you said pretty please with a cherry on top, then we would have agreed to not drop you. Oh well, looks like you got dropped regardless... Dox found below: ____________________________________________________________________________________________________ Full Name: Matthew Blankenship Aliases: Krunk, CGOD, Sequel, SaNiTaTioNz, xMKB y0, DDoS1337, TravyonTheGod, DNSPoison Address: 429 Clearview Drive, Belleville, Illinois, 62223 Mothers Name: Julie Lynn Blankenship Fathers Name: Keith W Blankenship ____________________________________________________________________________________________________ Now, time to target his other "hacking crew" aka "The Unknowns". If they cry about getting pwned, we will be make sure to inform them that krunk is to blame ;) ____________________________________________________________________________________________________ root@unknowns:~$ id uid=0(unknowns) gid=0(unknowns) groups=0(unknowns) root@unknowns:~$ whoami root root@unknowns:~$ ls -la total 21 drwxr-xr-x 22 root root 4096 2011-08-10 14:51 . drwxr-xr-x 22 root root 4096 2011-08-10 14:51 .. drwxr-xr-x 2 root root 4096 2011-08-10 14:50 bin drwxr-xr-x 3 root root 4096 2011-08-10 14:56 bash drwxr-xr-x 19 root root 4580 2011-11-23 20:29 dev drwxr-xr-x 137 root root 12288 2011-11-23 20:29 etc drwxr-xr-x 4 root root 4096 2011-08-10 14:42 home lrwxrwxrwx 1 root root 37 2011-08-10 14:49 initrd.img -> boot/initrd.img-2.6.38-10-generic-pae drwxr-xr-x 21 root root 4096 2011-08-11 22:37 lib drwxr-xr-x 2 root root 4096 2011-04-21 17:50 mnt drwxr-xr-x 2 root root 4096 2011-04-25 23:50 opt dr-xr-xr-x 377 root root 0 2011-11-21 04:34 proc drwx------ 8 root root 4096 2011-08-11 23:40 root drwxr-xr-x 2 root root 4096 2011-08-10 14:54 sbin drwxr-xr-x 2 root root 4096 2011-03-21 08:26 selinux drwxr-xr-x 2 root root 4096 2011-04-25 23:50 srv drwxr-xr-x 13 root root 0 2011-11-21 04:35 sys drwxrwxrwt 19 root root 4096 2011-11-23 20:34 tmp drwxr-xr-x 12 root root 4096 2011-08-10 14:55 usr drwxr-xr-x 15 root root 4096 2011-04-26 00:06 var lrwxrwxrwx 1 root root 34 2011-08-10 14:49 vmlinuz -> boot/vmlinuz-2.6.38-10-generic-pae root@unknowns:~$ uptime 20:38:51 up 2 days, 16:02, 2 users, load average: 0.00, 0.06, 0.09 root@unknowns:~$ last root pts/0 :0 Wed Nov 23 20:34 still logged in root pts/2 :0 Tue Nov 22 12:28 - 20:37 (1+08:08) root pts/1 :0 Tue Nov 22 12:28 - 15:15 (02:46) root pts/1 :0 Tue Nov 22 12:27 - 12:28 (00:00) root pts/0 :0 Tue Nov 22 12:21 - 15:15 (02:53) root pts/0 :0 Tue Nov 22 12:13 - 12:14 (00:00) root pts/0 :0 Tue Nov 22 12:13 - 12:13 (00:00) root pts/0 :0 Tue Nov 22 12:12 - 12:13 (00:00) root pts/0 :0 Tue Nov 22 12:11 - 12:12 (00:00) root pts/0 :0 Tue Nov 22 12:08 - 12:09 (00:00) root tty7 :0 Mon Nov 21 09:43 still logged in root system boot 2.6.38-10-generi Mon Nov 21 04:35 - 20:41 (2+16:05) root tty7 :0 Fri Nov 18 15:46 - crash (2+12:48) root system boot 2.6.38-10-generi Fri Nov 18 05:18 - 20:41 (5+15:22) root pts/1 :0.0 Sun Nov 13 21:03 - 21:03 (00:00) root pts/1 :0 Wed Nov 9 19:31 - 20:57 (4+01:25) root pts/0 :0 Tue Nov 8 19:52 - crash (9+09:25) root pts/0 :0 Tue Nov 8 11:49 - 11:50 (00:00) root pts/0 :0 Tue Nov 8 11:40 - 11:42 (00:01) root pts/1 :0 Tue Nov 8 11:30 - 11:31 (00:00) root pts/0 :0 Tue Nov 8 11:17 - 11:31 (00:14) root pts/0 :0 Tue Nov 8 11:07 - 11:08 (00:01) root pts/2 :0 Mon Nov 7 22:49 - 22:57 (00:08) root pts/1 :0 Mon Nov 7 22:29 - 22:49 (00:20) root pts/0 :0 Mon Nov 7 22:28 - 22:49 (00:20) guest tty8 :1 Mon Nov 7 18:11 - crash (10+11:06) root tty7 :0 Sat Nov 5 11:12 - crash (12+18:05) reboot system boot 2.6.38-10-generi Sat Nov 5 11:12 - 20:41 (18+09:29) root pts/0 :0 Thu Nov 3 21:28 - crash (1+13:43) root pts/3 :0 Wed Nov 2 21:00 - 21:00 (00:00) root pts/3 :0 Wed Nov 2 16:40 - 17:23 (00:43) root pts/3 :0 Tue Nov 1 20:50 - 20:51 (00:00) root@unknowns:/# cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh sshd:x:101:65534::/var/run/sshd:/usr/sbin/nologin spin:x:1000:1000:Spin,,,:/home/spin:/bin/bash messagebus:x:102:104::/var/run/dbus:/bin/false postfix:x:103:106::/var/spool/postfix:/bin/false unknowns:x:1001:1001:unknowns,,,:/home/unknowns:/bin/bash ____________________________________________________________________________________________________ for some extra lulz, here's his leader crying about getting pwned: ____________________________________________________________________________________________________ "I will just post some ideas by the name of The Unknowns: 1- We admit it, you r00ted our site, we lost a fight but we didn't loose the war yet... 2- If you took down our site, which we barely use, we will take it back online in the next day... 3- If you Dox us, we don't care, all our friends, governments knows about us, and we're proud of it... 4- If The Unknowns Doxed you, your end will come... 5- Whatever you do, The Unknowns will never die, you shall always expect us Whatever happens... 6- We Will Strike back..." -- Damn, sure shaking in my boots buddy. Krunk was the resident skiddie of this group. The quote above from that moron is actually their leader. Let that sink in... ____________________________________________________________________________________________________ Leaked database entries with his info listed below. Feel free to crack his hashes, but only if it is for purpose of messing with this fool!____________________________________________________________________________________________________ thebotnetcom.txt:(79790, 2, NULL, 0, 'xmkb', 'fe29851838397be19bcde4584052267b', '2012-04-11', '[email protected]', 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 2, 0, 'I Leech Bots', 0, 1334179500, 0, 1334286782, 1340268794, 1334279921, 1031826, 6, 0, 17, -6, 0, 0, 0, 0, 0, 11541719, 0, NULL, '0000-00-00', -1, -1, '99.174.76.177', 0, 1, 0, 0, -1, 1, 1, '~-0qS1G/|<-;]q@-=SyX`*g$(%cF2-', 0, 0, 0, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL, NULL, 1, 0, 0, 0, NULL, NULL, 0.00, 0.00, 0, 0, 0, NULL, NULL, NULL, 0, 0, 0, 1, 0, 379, 0, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) hackforums.sql:(589479, 'DDoS1337', '9787b9f43503ef4a5264865a97beb826', 'VdJt1S6R', 'z7WHG1tHg9cDWY9VWKawOu2b2KKyPkQji7oXghdhL68ZIqrTzn', '[email protected]', 35, 0, 0.00, 'images/avatars/killza.png', '80|80', 'gallery', 2, NULL, 0, NULL, 1291814928, 1297212660, 1297210897, 1293693924, NULL, 0, NULL, NULL, NULL, '14-10-1990', 'all', '[img]danasoft.com/sig/Matts1337MadPwn.jpg[/img]\r\n\r\n[font=Arial][color=#4682B4]DDoS 1337[/color][/font] (Tutorials, Hacks, and Services)\r\n\r\n-[color=#FF0000]Sniper Frags[/color]-\r\n', '\"[Image:\n\nDDoS 1337 (Tutorials, Hacks, and Services)\n\n-Sniper Frags-\n', 1, 0, 0, 0, 1, 1, 0, 'linear', 1, 1, 1, 1, 0, 0, 0, NULL, NULL, -6, 1, 1, 563935, NULL, 0, 0, 0, 0, NULL, '1**Inbox$%%$2**Sent Items$%%$3**Drafts$%%$4**Trash Can', NULL, 0, 0, -1, '99.174.76.177', '99.174.76.177', 1672367281, 1672367281, 'english', 115599, 1, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, NULL) forumkorner.sql:('8484','Respect.','925561f9dcabaf9601a0f6974fbe9cdf','WGARTqe4','','[email protected]','103','0',' ./uploads/avatars/avatar_8484.png?dateline=1340525841','100|70','upload','7','','0','','1339623114','1340745282','1340741750', '1340687038','','0','','','','1-1-1990','all','[b][color=#000000][size=medium][align=center]Selling the YouTube\'s \'Krunk\' and \'Batman\'. I am also selling the gamertag \'Peacock\'. HMU.[/align][/size][/color][/b]','1','0','0','0','1','0','2','0','linear', '1','1','1','1','0','0','0','','','-8','1','2','','','35','0','0','0','','1**$%%$2**$%%$3**$%%$4**','','0','0','5','95.141.28.57','99.174.76.177','1603083321','1672367281','','90530','1','34','1','0','0','0','0', '0','0','0','0','0','7','0','','0','','','','','','186','0.0000000000','0','',NULL,NULL,NULL,'0.00','1','1',' {\"rep\":1,\"pm\":1,\"buddylist\":1,\"quoted\":1,\"post_threadauthor\":1}'); forumkorner.sql:('8459','OHEKTA','4f84c8a5314a9d495a4882c586ed4944','9lk6TgVv','','[email protected]','2','0','','','','7','','0', '','1339484022','1339622713','1339622713','1339484514','','0','','','','1-1-1990','all','','1','0','0','0','1','0','2','0','linear','1','1','1','1','0','0','0','','','-8','1','2','','','35', '0','0','0','','1**$%%$2**$%%$3**$%%$4**','','0','0','0','95.141.28.53','99.174.76.177','1603083317','1672367281','','1959', '1','1','1','0','0','0','0','0', '0','0','0','0','1','0','','0','','','','','','18','0.0000000000','0','',NULL,NULL,NULL,'0.00','1','1',' {\"rep\":1,\"pm\":1,\"buddylist\":1,\"quoted\":1,\"post_threadauthor\":1}'); >>[ Skid #2 rekt -- skid #3 gun get got in next writeup ]<< ____________________________________________________________________________________________________ _..._ .-'_..._''. .' .' '.\ . .--. __.....__ / .' .'| |__| .-'' '. _.._ . ' < | .--. / .-''"'-. `. .' .._| | | | | | | / /________\ \ | ' | | | | .'''-. | | | | __| |__ . ' | |/.'''. \ | | \ .-------------' |__ __| \ '. . | / | | | | \ '-.____...---. | | '. `._____.-'/ | | | | |__| `. .' | | `-.______ / | | | | `''-...... -' | | ` | '. | '. | | '---' '---' |_| ____________________________________________________________________________________________________ >>[CONGRATULATIONS MY MAN, YOU'VE MANAGED TO EARN YOUR OWN UNIQUE FOLLOW-UP PWNAGE TREATMENT!]<< ____________________________________________________________________________________________________ I guess maybe in future you'll think twice about attempting to target us. So far, all these kiddies have managed to do is post some fail dox and once they realise that isn't going to work, they resort to trying to get aurora to hack me.. lol. (8:37:48 PM) [email protected]: this is Aurora, i'm not here to fight or anything (8:37:54 PM) [email protected]/7604914431391891634716553: lol (8:37:58 PM) [email protected]: just wanna ask what your problem is with me (8:38:02 PM) [email protected]/7604914431391891634716553: with you? (8:38:02 PM) [email protected]/7604914431391891634716553: what (8:38:03 PM) [email protected]: like, what did i do to you (8:38:10 PM) [email protected]/7604914431391891634716553: tf u talkin about (8:38:15 PM) [email protected]: yeah im getting from like 3 different kiddies (8:38:18 PM) [email protected]: that you hate me or something (8:38:18 PM) [email protected]: lol (8:38:20 PM) [email protected]/7604914431391891634716553: let me guess (8:38:21 PM) [email protected]/7604914431391891634716553: chF (8:38:22 PM) [email protected]: idk, it may all be hearsay (8:38:23 PM) [email protected]/7604914431391891634716553: heard/meo (8:38:23 PM) [email protected]/7604914431391891634716553: etc? (8:38:26 PM) [email protected]: chf, hann, and meo (8:38:27 PM) [email protected]: yeah ____________________________________________________________________________________________________ Also this made me laugh: ____________________________________________________________________________________________________ [10/02/2014 16:29:12] Scott Thomas - I guess you could say he.. got off Scott Free.: people I closesly associate with [10/02/2014 16:29:13] Scott Thomas - I guess you could say he.. got off Scott Free.: taught chief [10/02/2014 16:29:15] Scott Thomas - I guess you could say he.. got off Scott Free.: EVERYTHING [10/02/2014 16:29:16] Scott Thomas - I guess you could say he.. got off Scott Free.: he knows ____________________________________________________________________________________________________ chF delusional lol: ____________________________________________________________________________________________________ http://ask.fm/chFtheCat/answer/109177573320 -- LOL, so you're calling TriCk a wannabe hacker? Lets compare, shall we. chF's past work: -- DDoSing steam (arguably at that), posting dox. TriCk's past work: -- hacking NASA, NATO, the United Nations, Scotland Yard / MI6, Tony Blair, BlackBerry, facebook.com the list goes on but you should get the point :) Now as soon as this is posted, these kids are gonna start retweeting it (as they have done with all of the failed dox attempts against them - the reason for this is basic psyops, if they were to ignore it, then it would confirm that the dox is infact correct. You're not fooling anyone) chief - you may wonder why your hashes + other info aren't being posted yet, that is because i'm in the process of writing up a zine specifically for you. You must feel special. Enjoy :) ____________________________________________________________________________________________________ KEEP YOUR EYES PEELED FOR PART #2 - CHF IS OUR PRIMARY TARGET GET READY TO WATCH THE REAL PWNAGE UNFOLD ;) EOF