FBI 0wned! 0day found by Lotus 1337

FBI LEAKED!! Hi guys this is L0TU5 1337 from IndoHackerTeam and we have found a 0day in fbi.gov which allowed to us to get access to their whole server. This was extremely difficult as they had many filters on and their CMS is closed-source so the exploit was both web-app and server based. We have shelled their server and hid and crypted our shells in many hidden directories which they will almost never find, we also made backups like saving senior agent's login's and adding more root accounts so if the files are found we can still have access.
==============================================
           [!] SAMPLE LEAK [!]
==============================================
lisa.narendra@fbi.gov - ncuwn27874gtvdj
akiraa79.williams@fbi.gov - Jdbopah2699jbdkii
patrick1123us@fbi.gov - p@ssw0rds966684Agent
 Rogers.birdchan@fbi.gov - 7Kgwkdfrs&1auikb7
lisa.shirazi222@fbi.gov - m00re.lisa987
thomas.jeanbee@fbi.gov - thomas.gancsoo00ario
eddie.mahon@fbi.gov - jh2i888921bhuid
deborah.coldwaterfish@fbi.gov - Iuk269g78a57athsd2
pccebu.mcrae@fbi.gov - J8UY2hja9sh0rv
jobsinworld@fbi.gov - Hnguaih^&*jsdk977
Raul.roldan@fbi.gov - Bufg8^%^2jlor
Tini.dswlmbt@fbi.gov - Hst99g&&92nj
==============================================

Small code of the 0day which was used. This will also be publicized as we don't think people will actually know how to use it, but we're grey hats.
===============================================
0xb5d9d87c is located 0 bytes to the right of 163964-byte region
[0xb5d75800,0xb5d9d87c)
allocated by thread T0 here:
    #0 0xb72c3ae4 in operator new(unsigned int)
(/usr/lib/i386-linux-gnu/libasan.so.1+0x51ae4)
    #1 0x8340cce in xercesc_3_1::MemoryManagerImpl::allocate(unsigned int)
xercesc/internal/MemoryManagerImpl.cpp:40
    #2 0x8094cb2 in xercesc_3_1::XMemory::operator new(unsigned int,
xercesc_3_1::MemoryManager*) xercesc/util/XMemory.cpp:68
==================================================
All the data is here, there is users, emails, phones, addresses, names, badge numbers, documents, credit cards, etc etc. The data is compressed so the file would be faster. And the full 0day is there too, feel free to inspect it.
==================================================
Download: OVER 100,000 users, pass, credit cards, and 0day: http://adf.ly/1HLBCb
==================================================
Tutorial: In truth, the 0day took us a very long time to find and was very hard, considering their CMS is closed source we first went server sided and combined it with a web app based source code.
===================================================
REQUIREMENTS:
PHP (cURL needed)
C
Windows/Mac/Linux
===================================================
L0TU5 1337 - OuT
Greetz: PakCyberCrew - Dr.TU[N]A - Hmei7 - Gantengers Crew- d3b~x