API tools faq
paste
Guest User

Untitled

a guest
Mar 30th, 2013
260
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.28 KB | None | 0 0
raw download clone embed print report
  1. De antwoorden van de cybercrimechallenge zoals ik erop gekomen ben. Zoals vaak zijn er meer wegen die naar Rome leiden.
  2.  
  3. Vraag1:
  4. <info>
  5. ??????! ????????????? ??????????? ? ???????? ?????? ?????? ?? ???????? ?????????, ????????? ????? ?????????? ??????? ??????????? ????????: H4ck3nb3rg ?????? 0x7DD. ?????? ???? ??????? ??? ????? ????????????. ???? ????????? ???????? ??????? ???????????, ??????? ?????????? Windows, Mac ? Android. ???? ??????????? ????? ??????? ? ??????? ????? ????????? ??????????? ????????. ?? ????? ?????????? ????? ?? ????????? ??? ??????????? ?? ?????? ??????. ??????? ????? ???? ??????????????, ???????? ????? ? MeKash ??????? ??? ???????? ?????? ? ????????????? ???????????? ???????, ?????? ??? ????????? ????? ??????, BAN-?????? ? Arbo ?????. ????? H4ck3nb3rg 0x7DD ?? ?????????????? ?? ??????????? ????????????!?????????? ???????? ????? 5000 ????, ???????? ????? ???. ????-????? Tor. ?????? ? ??????? ????????? ????? ?? ????. ?????? ??? ???????? ????????!
  6.  
  7. Miss M.
  8. </info>
  9. https://www.cybercrimechallenge.nl/start
  10. translate.google.com
  11.  
  12. Antwoord:
  13. H4ck3nb3rg
  14.  
  15. Vraag2:
  16. <info>
  17. https://www.google.nl/search?q=missm+H4ck3nb3rg&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:nl:official&client=firefox-a
  18. http://pastebin.com/cqhEqjnD
  19. </info>
  20.  
  21. Antwoord:
  22. [email protected]
  23.  
  24. Vraag3:
  25. <info>
  26. Delivered-To: <[email protected]>
  27. Received: from 193.200.198.87 ([193.200.198.87])
  28. by mail.mailinator.com with SMTP (Postfix)
  29. for [email protected];
  30. Fri, 22 Feb 2013 10:09:01 +0000 (UTC)
  31. Received: by 193.200.198.87 with SMTP id j8so54729qah.8
  32. for <[email protected]>; Fri, 22 Feb 2013 02:09:01 -0800 (PST)
  33. MIME-Version: 1.0
  34. X-Received: by 10.224.185.141 with SMTP id co13mr800511qab.33.1361527741255;
  35. Fri, 22 Feb 2013 02:09:01 -0800 (PST)
  36. Received: by 10.49.71.168 with HTTP; Fri, 22 Feb 2013 02:09:01 -0800 (PST)
  37. Date: Fri, 22 Feb 2013 11:09:01 +0100
  38. Message-ID: <CAM-WngbS18XMX6utu-r3QzGf_34g25Z-E_Q2J5+m2z4h4hPrJg@mail.gmail.com>
  39. Subject: H4ck3nb3rg
  40. From: Miss M <[email protected]>
  41. To: Undisclosed Recipients
  42. Content-Type: text/plain; charset=ISO-8859-1
  43. Content-Transfer-Encoding: 7bit
  44.  
  45. Friends! Deploying ransomware to Western Europe is no longer a problem, thanks to our unique malware backend: H4ck3nb3rg. Many of our customers have already become millionaires. Our software is suitable to catch losers who use Windows, Mac or Android. Our software blocks the system by using our state-of-the-art botnet. It will display a default screen or an image of your choice. The system can only be unlocked by paying an amount in MeKash vouchers or to legitimate accounts with reputable European banks such as GNI, BAN-ROAM and Arbo Bank. The new H4ck3nb3rg is not detectable by Law Enforcement! A monthly license costs 5000 euro, delivery through our .onion-site at Tor. Please have someone’s credit card ready. Only three licenses left!
  46.  
  47. Miss M
  48. </info>
  49.  
  50. Antwoord:
  51. 193.200.198.87
  52.  
  53. Vraag4:
  54. <info>
  55. zie vraag 3.
  56. </info>
  57.  
  58. Antwoord:
  59. host 193.200.198.87
  60. 87.198.200.193.in-addr.arpa domain name pointer missmonotropa.com.
  61. monotropa
  62.  
  63. Vraag5:
  64. <info>
  65. Twitter
  66. https://twitter.com/MissMonotropa
  67. https://twitter.com/LouiseLandervor/status/305974860075642881
  68. </info>
  69.  
  70. Antwoord:
  71. Liselotte Landervore
  72.  
  73.  
  74. Vraag6:
  75. google op naam
  76. http://tweakers.net/gallery/500835#tab:profiel
  77. http://gathering.tweakers.net/forum/myreact/500835
  78. http://gathering.tweakers.net/forum/list_message/39826565#39826565
  79. http://www.flickr.com/people/93455800@N07/
  80. of
  81. op email adres zoeken bij Flickr
  82. Antwoord:
  83. monomiss19
  84.  
  85. Vraag7:
  86. http://farm9.staticflickr.com/8095/8509541391_2c7993d4a9_o.jpg
  87. Silostraat
  88. https://maps.google.nl/maps?q=Silostraat,+Winterswijk&hl=nl&ll=51.970858,6.712676&spn=0.001135,0.003117&sll=52.212992,5.27937&sspn=4.62497,12.766113&oq=silostraat&t=h&hnear=Silostraat,+Winterswijk,+Gelderland&z=19
  89. http://farm9.staticflickr.com/8381/8497019011_954fbd6eb4_o.jpg
  90. nummer 2
  91.  
  92. Antwoord:
  93. korenstraat 2 winterswijk
  94. Vraag8:
  95. PCAP files
  96. internet.pcap
  97. filter op "xmpp"
  98. 217732 13969.810871 192.0.2.5 198.51.100.201 XMPP/XML 203 MESSAGE < vultura@h4ck3nb3rg/BitlBee
  99.  
  100. Antwoord:
  101. vultura
  102. Vraag9:
  103. truecrypt container
  104.  
  105. internet.pcap
  106. filter op "xmpp"
  107. time
  108. 1361768607.060384000
  109. vultura -> missmonotropa: hey
  110. missmonotropa -> vultura: hi :*
  111. vultura -> missmonotropa: j ben te laat
  112. missmonotropa -> vultura: sry, tentamen
  113. vultura -> missmonotropa: ok
  114. missmonotropa -> vultura: harvest staat klaar
  115. vultura -> missmonotropa: kom mr door
  116. missmonotropa -> vultura: maar was niet zo goede week
  117. vultura -> missmonotropa: ??
  118. missmonotropa -> vultura: is weinig betaald
  119. missmonotropa -> vultura: 3x ofzo
  120. vultura -> missmonotropa: wtf
  121. vultura -> missmonotropa: moet minstens 20k euro zijn
  122. vultura -> missmonotropa: k zie tog hoeveel ze klikken!!1!
  123. vultura -> missmonotropa: j fokt niet met me
  124. vultura -> missmonotropa: dan lig j eruit
  125. missmonotropa -> vultura: heb je ff
  126. vultura -> missmonotropa: nee
  127. vultura -> missmonotropa: ben j nog
  128. vultura -> missmonotropa: LISELOTT!
  129. vultura -> missmonotropa: ???
  130. missmonotropa -> vultura: ben ik weer
  131. missmonotropa -> vultura: heb nu goede harvest
  132. missmonotropa -> vultura: had verkeerd gekeken
  133. vultura -> missmonotropa: LOL JY DURFT
  134. vultura -> missmonotropa: WAT HEB J AAN
  135. missmonotropa -> vultura: lol
  136. missmonotropa -> vultura: hier is de updated tc
  137. vultura -> missmonotropa: WERKT NIET
  138. vultura -> missmonotropa: MET JE JABBERPASS TOG??? <--- HINT
  139. missmonotropa -> vultura: ja
  140. missmonotropa -> vultura: ehm capslock? ;)
  141. vultura -> missmonotropa: lol
  142. vultura -> missmonotropa: was k vergeten
  143. vultura -> missmonotropa: ok is open
  144. missmonotropa -> vultura: ok
  145. vultura -> missmonotropa: nice
  146. vultura -> missmonotropa: lopen binne &gt;D
  147. missmonotropa -> vultura: moet nu koken
  148. vultura -> missmonotropa: wrom zit die hidden er nog in?
  149. missmonotropa -> vultura: kak
  150. missmonotropa -> vultura: sorry
  151. missmonotropa -> vultura: niemand die het ziet
  152. vultura -> missmonotropa: jy ben gevaarlijk
  153. missmonotropa -> vultura: niet voor jou..
  154. vultura -> missmonotropa: weet ik niet
  155. vultura -> missmonotropa: mr j ben het waart
  156. missmonotropa -> vultura: :*
  157. vultura -> missmonotropa: Message of the day:
  158. - there are no rules
  159. - allowed password format: ^[a-zA-Z0-9., _-]{4,6}$
  160.  
  161. http://xmpp.org/extensions/xep-0078.html
  162.  
  163. Concatenate the Stream ID received from the server with the password. [8]
  164. Hash the concatenated string according to the SHA1 algorithm, i.e., SHA1(concat(sid, password)).
  165. Ensure that the hash output is in hexidecimal format, not binary or base64.
  166. Convert the hash output to all lowercase characters.
  167.  
  168. Open mobile.pcap
  169. filter op "xmpp"
  170. 7644 11699.928347 192.0.2.5 203.0.113.7 XMPP/XML 220 STREAM < h4ck3nb3rg
  171. <?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' id='3807744839' from='h4ck3nb3rg' xml:lang='en'>
  172.  
  173. 3807744839 StreamID=salt
  174.  
  175. 7648 11699.937564 203.0.113.7 192.0.2.5 XMPP/XML 253 IQ(set) QUERY
  176. <iq type="set" id="2"><query xmlns="jabber:iq:auth"><username>missmonotropa</username><digest>b8f6a6eb3bd3f928647ce6b8b787eddb5dc13a74</digest><resource>old-client</resource></query></iq>
  177.  
  178. b8f6a6eb3bd3f928647ce6b8b787eddb5dc13a74 sha1(salt+passwd)
  179.  
  180. hashcat-cli64.exe -m 120 -n 8 -a 3 --salt-file salt.txt --pw-min=4 --pw-max=6 -o found.txt -1 ?l?d. hash.txt
  181. http://hashcat.net/hashcat/
  182. salt.txt: 3807744839
  183. hash.txt: b8f6a6eb3bd3f928647ce6b8b787eddb5dc13a74
  184. hashcat-cli64.exe -m 120 -n 8 -a 3 --salt-file salt.txt --pw-min=4 --pw-max=6 -o found.txt -1 ?l?d?u-_,. hash.txt ?1?1?1?1?1?1
  185. b8f6a6eb3bd3f928647ce6b8b787eddb5dc13a74:3807744839:u9.fwh
  186.  
  187. Antwoord:
  188. u9.fwh
  189.  
  190. rekening nummer: 6049474
  191.  
  192. Vraag10:
  193. Bekijk de briefings video.
  194. http://www.youtube.com/watch?feature=player_embedded&v=8phTlZyBKZA
  195.  
  196. Antwoord:
  197. Extra spatie achter het wachtwoord "u9.fwh "
  198.  
  199. in het bestand config
  200. #VrD8r4Nv
  201. Vraag11:
  202.  
  203. /*
  204. * irssi config voor wekelijkse meeting
  205. */
  206.  
  207. servers = (
  208. {
  209. address = "54.228.228.142";
  210. port = "50255";
  211. use_ssl = "yes";
  212. ssl_verify = "no";
  213. autoconnect = "yes";
  214. chatnet = "BOT";
  215. password = "GKqifIEeQhpgPv3po6R7m3Vv";
  216. }
  217. );
  218.  
  219. chatnets = {
  220. BOT = {
  221. type = "IRC";
  222. };
  223. };
  224.  
  225. channels = (
  226. { name = "#VrD8r4Nv"; chatnet = "BOT"; autojoin = "Yes"; },
  227. );
  228.  
  229. in irssi:
  230. /connect -SSL 54.228.228.142 50255 GKqifIEeQhpgPv3po6R7m3Vv
  231. /j #VrD8r4Nv
  232. 16:47:55 -!- Irssi: Changed to server 54.228.228.142
  233. 16:48:22 [54] -!- #VrD8r4Nv ojyysist H+ 0 [email protected] [None]
  234. 16:48:22 [54] -!- #VrD8r4Nv yplxfwwr H+ 0 [email protected] [None]
  235. 16:48:22 [54] -!- #VrD8r4Nv hlmarbar H+ 0 [email protected] [None]
  236. 16:48:22 [54] -!- #VrD8r4Nv Erik H 0 [email protected] [Mibbit]
  237. 16:48:22 [54] -!- #VrD8r4Nv pmiulvig H+ 0 [email protected] [None]
  238. 16:48:22 [54] -!- #VrD8r4Nv plmrhcyn H+ 0 [email protected] [None]
  239. 16:48:22 [54] -!- #VrD8r4Nv obwagrjc H+ 0 [email protected] [None]
  240. 16:48:22 [54] -!- #VrD8r4Nv dxntvpkm H+ 0 [email protected] [None]
  241. 16:48:22 [54] -!- #VrD8r4Nv cjkvmzrh H+ 0 [email protected] [None]
  242. 16:48:22 [54] -!- #VrD8r4Nv robzaoan H+ 0 [email protected] [None]
  243. 16:48:22 [54] -!- #VrD8r4Nv xrqszhsv H+ 0 [email protected] [None]
  244. 16:48:22 [54] -!- #VrD8r4Nv jgpdmsoc H+ 0 [email protected] [None]
  245. 16:48:22 [54] -!- #VrD8r4Nv utlexjax H+ 0 [email protected] [None]
  246. 16:48:22 [54] -!- #VrD8r4Nv kktqtskt H+ 0 [email protected] [None]
  247. 16:48:22 [54] -!- #VrD8r4Nv czbnjkfv H+ 0 [email protected] [None]
  248. 16:48:22 [54] -!- #VrD8r4Nv qlrbdihp H+ 0 [email protected] [None]
  249. 16:48:22 [54] -!- #VrD8r4Nv cjldqqgn H+ 0 [email protected] [None]
  250. 16:48:22 [54] -!- #VrD8r4Nv nstspjjg H+ 0 [email protected] [None]
  251. 16:48:22 [54] -!- #VrD8r4Nv ltoypqqs H+ 0 [email protected] [None]
  252. 16:48:22 [54] -!- #VrD8r4Nv lqcekqzp H+ 0 [email protected] [None]
  253. 16:48:22 [54] -!- #VrD8r4Nv olrvifim H+ 0 [email protected] [None]
  254. 16:48:22 [54] -!- #VrD8r4Nv rdwvablp H+ 0 [email protected] [None]
  255. 16:48:22 [54] -!- #VrD8r4Nv pvuadysl H+ 0 [email protected] [None]
  256. 16:48:22 [54] -!- #VrD8r4Nv btbrznuh H+ 0 [email protected] [None]
  257. 16:48:22 [54] -!- #VrD8r4Nv eakqbhkt H+ 0 [email protected] [None]
  258. 16:48:22 [54] -!- #VrD8r4Nv hgvffzyj H+ 0 [email protected] [None]
  259. 16:48:22 [54] -!- #VrD8r4Nv ptwlhohn H+ 0 [email protected] [None]
  260. 16:48:22 [54] -!- #VrD8r4Nv etpgocfw H+ 0 [email protected] [None]
  261. 16:48:22 [54] -!- #VrD8r4Nv kazphfpf H+ 0 [email protected] [None]
  262. 16:48:22 [54] -!- #VrD8r4Nv odrmrxhc H+ 0 [email protected] [None]
  263. 16:48:22 [54] -!- #VrD8r4Nv pehjjwyy H+ 0 [email protected] [None]
  264. 16:48:22 [54] -!- #VrD8r4Nv hoeahrew H+ 0 [email protected] [None]
  265. 16:48:22 [54] -!- #VrD8r4Nv mvlisdtp H+ 0 [email protected] [None]
  266. 16:48:22 [54] -!- #VrD8r4Nv Dennis H 0 [email protected] [Dennis]
  267. 16:48:22 [54] -!- #VrD8r4Nv sdasdsada H 0 [email protected] [sdasdsadas]
  268. 16:48:22 [54] -!- #VrD8r4Nv asd G 0 [email protected] [purple]
  269. 16:48:22 [54] -!- #VrD8r4Nv Marco H 0 [email protected] [Marco Jan]
  270. 16:48:22 [54] -!- #VrD8r4Nv root H 0 [email protected] [root]
  271. 16:48:22 [54] -!- #VrD8r4Nv anne_ H 0 [email protected] [UBUNTU1]
  272. 16:48:22 [54] -!- #VrD8r4Nv testje888 H 0 [email protected] [testje888]
  273. 16:48:22 [54] -!- #VrD8r4Nv wggds H 0 [email protected] [wggds]
  274. 16:48:22 [54] -!- #VrD8r4Nv Bushi__ H 0 [email protected] [Bushi]
  275. 16:48:22 [54] -!- #VrD8r4Nv Bushi_ H 0 [email protected] [Bushi]
  276. 16:48:22 [54] -!- #VrD8r4Nv t3j0nz_ H 0 [email protected] [Arthur]
  277. 16:48:22 [54] -!- #VrD8r4Nv Beagollum H 0 [email protected] [Niek]
  278. 16:48:22 [54] -!- #VrD8r4Nv Fossil H 0 [email protected] [...]
  279. 16:48:22 [54] -!- #VrD8r4Nv emile H 0 [email protected] [emile]
  280. 16:48:22 [54] -!- #VrD8r4Nv oytkjzjz H 0 [email protected] [oytkjzjz]
  281. 16:48:22 [54] -!- #VrD8r4Nv mouse H 0 [email protected] [Unknown]
  282. 16:48:22 [54] -!- #VrD8r4Nv diko H 0 [email protected] [diko]
  283. 16:48:22 [54] -!- #VrD8r4Nv splinter H 0 [email protected] [splinter]
  284. 16:48:22 [54] -!- #VrD8r4Nv du0ai1Oh H 0 [email protected] [du0ai1Oh]
  285. 16:48:22 [54] -!- #VrD8r4Nv blasty H 0 [email protected] [AHI]
  286. 16:48:22 [54] -!- #VrD8r4Nv stickybit H 0 [email protected] [Sticky Bit]
  287. 16:48:22 [54] -!- #VrD8r4Nv jeffk H 0 [email protected] [jeffk]
  288. 16:48:22 [54] -!- #VrD8r4Nv pectagta H+ 0 [email protected] [control bot] <--- HINT
  289. 16:48:22 [54] -!- #VrD8r4Nv CHANSERV H*@ 1 [email protected] [channel registration service]
  290. 16:48:22 [54] -!- End of /WHO list
  291.  
  292. /msg pectagta hoi
  293. <pectagta> dfI8J5hkgaQ6vtYtKK2d7Qlou650S9m1FZ697bZ01TCOTnCTWtyCzqyZe9UV4bBHZN9nkm4j/2PyZ/0L6ga3AQ==
  294.  
  295. Deel2:
  296. erik@ubuntu:/etc/apt$ sudo apt-get install linux-image-2.6.32-45-generic-pae
  297. erik@ubuntu:/etc/apt$ sudo apt-get install linux-headers-2.6.32-45-generic-pae
  298.  
  299. erik@ubuntu:~$ svn checkout http://volatility.googlecode.com/svn/trunk/ volatility
  300. erik@ubuntu:~/volatility/tools/linux$ sudo apt-get install dwarfdump
  301. erik@ubuntu:~/volatility/tools/linux$ make
  302. make -C //lib/modules/2.6.32-45-generic-pae/build CONFIG_DEBUG_INFO=y M=/home/erik/volatility/tools/linux modules
  303. make[1]: Entering directory `/usr/src/linux-headers-2.6.32-45-generic-pae'
  304. Building modules, stage 2.
  305. MODPOST 1 modules
  306. make[1]: Leaving directory `/usr/src/linux-headers-2.6.32-45-generic-pae'
  307. dwarfdump -di module.ko > module.dwarf
  308. make -C //lib/modules/2.6.32-45-generic-pae/build M=/home/erik/volatility/tools/linux clean
  309. make[1]: Entering directory `/usr/src/linux-headers-2.6.32-45-generic-pae'
  310. CLEAN /home/erik/volatility/tools/linux/.tmp_versions
  311. CLEAN /home/erik/volatility/tools/linux/Module.symvers /home/erik/volatility/tools/linux/modules.order
  312. make[1]: Leaving directory `/usr/src/linux-headers-2.6.32-45-generic-pae'
  313.  
  314. erik@ubuntu:~/volatility$ sudo zip volatility/plugins/overlays/linux/Ubuntu1004_4pae.zip tools/linux/module.dwarf /boot/System.map-2.6.32-45-generic-pae
  315. adding: tools/linux/module.dwarf (deflated 89%)
  316. adding: boot/System.map-2.6.32-45-generic-pae (deflated 74%)
  317.  
  318.  
  319. erik@ubuntu:~/volatility$ python vol.py --info
  320. Volatile Systems Volatility Framework 2.3_alpha
  321. Profiles
  322. --------
  323. LinuxUbuntu1004_4paex86 - A Profile for Linux Ubuntu1004_4pae x86
  324.  
  325.  
  326.  
  327.  
  328.  
  329.  
  330. erik@ubuntu:~/volatility$ python vol.py -f ~/Downloads/memory.raw --profile=LinuxUbuntu1004_4paex86 linux_psaux
  331.  
  332. Volatile Systems Volatility Framework 2.3_alpha
  333. Pid Uid Gid Arguments
  334. 1 0 0 /sbin/init
  335. 2 0 0 [kthreadd]
  336. 3 0 0 [migration/0]
  337. 4 0 0 [ksoftirqd/0]
  338. 5 0 0 [watchdog/0]
  339. 6 0 0 [events/0]
  340. 7 0 0 [cpuset]
  341. 8 0 0 [khelper]
  342. 9 0 0 [netns]
  343. 10 0 0 [async/mgr]
  344. 11 0 0 [pm]
  345. 12 0 0 [sync_supers]
  346. 13 0 0 [bdi-default]
  347. 14 0 0 [kintegrityd/0]
  348. 15 0 0 [kblockd/0]
  349. 16 0 0 [kacpid]
  350. 17 0 0 [kacpi_notify]
  351. 18 0 0 [kacpi_hotplug]
  352. 19 0 0 [ata/0]
  353. 20 0 0 [ata_aux]
  354. 21 0 0 [ksuspend_usbd]
  355. 22 0 0 [khubd]
  356. 23 0 0 [kseriod]
  357. 24 0 0 [kmmcd]
  358. 27 0 0 [khungtaskd]
  359. 28 0 0 [kswapd0]
  360. 29 0 0 [ksmd]
  361. 30 0 0 [aio/0]
  362. 31 0 0 [ecryptfs-kthrea]
  363. 32 0 0 [crypto/0]
  364. 36 0 0 [scsi_eh_0]
  365. 38 0 0 [scsi_eh_1]
  366. 40 0 0 [kstriped]
  367. 41 0 0 [kmpathd/0]
  368. 42 0 0 [kmpath_handlerd]
  369. 43 0 0 [ksnapd]
  370. 44 0 0 [kondemand/0]
  371. 45 0 0 [kconservative/0]
  372. 159 0 0 [scsi_eh_2]
  373. 165 0 0 [usbhid_resumer]
  374. 178 0 0 [kdmflush]
  375. 182 0 0 [kdmflush]
  376. 196 0 0 [jbd2/dm-0-8]
  377. 197 0 0 [ext4-dio-unwrit]
  378. 240 0 0 upstart-udev-bridge --daemon
  379. 243 0 0 udevd --daemon
  380. 319 0 0 udevd --daemon
  381. 321 0 0 udevd --daemon
  382. 385 0 0 [kpsmoused]
  383. 497 101 103 rsyslogd -c4
  384. 557 0 0 /sbin/getty -8 38400 tty4
  385. 566 0 0 /sbin/getty -8 38400 tty5
  386. 573 0 0 /sbin/getty -8 38400 tty2
  387. 575 0 0 /sbin/getty -8 38400 tty3
  388. 579 0 0 /sbin/getty -8 38400 tty6
  389. 583 0 0 cron
  390. 584 0 0 atd
  391. 636 0 0 /sbin/getty -8 38400 tty1
  392. 637 0 0 [flush-1:0]
  393. 638 0 0 [flush-1:1]
  394. 639 0 0 [flush-1:2]
  395. 640 0 0 [flush-1:3]
  396. 641 0 0 [flush-1:4]
  397. 642 0 0 [flush-1:5]
  398. 643 0 0 [flush-1:6]
  399. 644 0 0 [flush-1:7]
  400. 645 0 0 [flush-1:8]
  401. 646 0 0 [flush-1:9]
  402. 647 0 0 [flush-1:10]
  403. 648 0 0 [flush-1:11]
  404. 649 0 0 [flush-1:12]
  405. 650 0 0 [flush-1:13]
  406. 651 0 0 [flush-1:14]
  407. 652 0 0 [flush-1:15]
  408. 653 0 0 [flush-8:0]
  409. 654 0 0 [flush-251:0]
  410. 665 0 0 dhclient3 -e IF_METRIC=100 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp3/dhclient.eth0.leases eth0
  411. 681 0 0 /usr/sbin/sshd -D
  412. 780 0 0 sshd: monotropa [priv
  413. 849 1000 1000 sshd: monotropa@pts/0
  414. 850 1000 1000 -bash
  415. 866 1000 1000 ./crypto
  416.  
  417.  
  418. erik@ubuntu:~/volatility$ python vol.py -f ~/Downloads/memory.raw --profile=LinuxUbuntu1004_4paex86 linux_proc_maps -p 866
  419. Volatile Systems Volatility Framework 2.3_alpha
  420. Pid Start End Flags Pgoff Major Minor Inode File Path
  421. -------- ---------- ---------- ------ ---------- ------ ------ ---------- --------------------------------------------------------------------------------
  422. 866 0x08048000 0x0810a000 r-x 0x0 251 0 142435 /home/monotropa/crypto
  423. 866 0x0810a000 0x08115000 rw- 0xc1000 251 0 142435 /home/monotropa/crypto
  424. 866 0x08115000 0x08117000 rw- 0x0 0 0 0
  425. 866 0x0991c000 0x0993e000 rw- 0x0 0 0 0 [heap]
  426. 866 0xb7701000 0xb7703000 rw- 0x0 0 0 0
  427. 866 0xb7703000 0xb7704000 r-x 0x0 0 0 0
  428. 866 0xbfa26000 0xbfa3c000 rw- 0x0 0 0 0 [stack]
  429.  
  430. erik@ubuntu:~/volatility$ python vol.py -f ~/Downloads/memory.raw --profile=LinuxUbuntu1004_4paex86 linux_dump_map -p 866 0x0991c000 --dump-dir ~
  431. Volatile Systems Volatility Framework 2.3_alpha
  432. Task VM Start VM End Length Path
  433. ---------- ---------- ---------- ---------- ----
  434. 866 0x08048000 0x0810a000 0xc2000 /home/erik/task.866.0x8048000.vma
  435. 866 0x0810a000 0x08115000 0xb000 /home/erik/task.866.0x810a000.vma
  436. 866 0x08115000 0x08117000 0x2000 /home/erik/task.866.0x8115000.vma
  437. 866 0x0991c000 0x0993e000 0x22000 /home/erik/task.866.0x991c000.vma
  438. 866 0xb7701000 0xb7703000 0x2000 /home/erik/task.866.0xb7701000.vma
  439. 866 0xb7703000 0xb7704000 0x1000 /home/erik/task.866.0xb7703000.vma
  440. 866 0xbfa26000 0xbfa3c000 0x16000 /home/erik/task.866.0xbfa26000.vma
  441.  
  442.  
  443.  
  444. /home/erik/task.866.0xbfa26000.vma STACK
  445. /home/erik/task.866.0x991c000.vma HEAP
  446.  
  447. xxd task.866.0x991c000.vma > heap.hex
  448. xxd task.866.0xbfa26000.vma > stack.hex
  449.  
  450. chmod a+x crypto
  451.  
  452. ./crypto
  453. password 1234567890
  454.  
  455. erik 3329 0.0 0.0 1064 260 pts/0 S+ 10:21 0:00 ./crypto
  456. erik 3331 0.0 0.0 3328 884 pts/2 S+ 10:21 0:00 grep --color=auto crypto
  457.  
  458. erik@ubuntu:~/volatility$ cat /proc/3329/maps
  459. 08048000-0810a000 r-xp 00000000 08:01 927135 /home/erik/crypto
  460. 0810a000-08115000 rw-p 000c1000 08:01 927135 /home/erik/crypto
  461. 08115000-08117000 rw-p 00000000 00:00 0
  462. 085c9000-085eb000 rw-p 00000000 00:00 0 [heap]
  463. b771e000-b7720000 rw-p 00000000 00:00 0
  464. b7720000-b7721000 r-xp 00000000 00:00 0 [vdso]
  465. bfcfc000-bfd11000 rw-p 00000000 00:00 0 [stack]
  466.  
  467. erik@ubuntu:~/volatility$ gdb --pid 3329
  468. GNU gdb (GDB) 7.1-ubuntu
  469. Copyright (C) 2010 Free Software Foundation, Inc.
  470. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
  471. This is free software: you are free to change and redistribute it.
  472. There is NO WARRANTY, to the extent permitted by law. Type "show copying"
  473. and "show warranty" for details.
  474. This GDB was configured as "i486-linux-gnu".
  475. For bug reporting instructions, please see:
  476. <http://www.gnu.org/software/gdb/bugs/>.
  477. Attaching to process 3329
  478. Reading symbols from /home/erik/crypto...(no debugging symbols found)...done.
  479. 0x080925ae in __read_nocancel ()
  480. (gdb) dump memory /home/erik/erikstack 0xbfcfc000 0xbfd11000
  481. (gdb) dump memory /home/erik/erikheap 0x085c9000 0x085eb000
  482. (gdb) quit
  483. A debugging session is active.
  484.  
  485. Inferior 1 [process 3329] will be detached.
  486.  
  487. Quit anyway? (y or n) y
  488. Detaching from program: /home/erik/crypto, process 3329
  489.  
  490. erik@ubuntu:~$ xxd erikheap > erikheap.hex
  491. erik@ubuntu:~$ xxd erikstack > erikstack.hex
  492.  
  493.  
  494. erik@ubuntu:~$ diff erikheap.hex heap.hex
  495. 132,133c132,133
  496. < 0000830: 3098 5c08 084f 1108 3098 5c08 0000 0000 0.\..O..0.\.....
  497. < 0000840: 2004 72b7 0004 3a16 0000 0000 0000 0000 .r...:.........
  498. ---
  499. > 0000830: 30c8 9109 084f 1108 30c8 9109 0000 0000 0....O..0.......
  500. > 0000840: 2034 70b7 00f2 27b7 0000 0000 0000 0000 4p...'.........
  501. 140c140
  502. < 00008b0: 6000 d1bf 0000 0000 0000 0000 0000 0000 `...............
  503. ---
  504. > 00008b0: 90ad a3bf 0000 0000 0000 0000 0000 0000 ................
  505. 206,208c206,208
  506. < 0000cd0: 0000 0000 1900 0000 f09c 5c08 189d 5c08 ..........\...\.
  507. < 0000ce0: 409d 5c08 689d 5c08 0000 0000 b909 0000 @.\.h.\.........
  508. < 0000cf0: 189d 5c08 5ae5 0f08 0000 0000 40eb 0f08 ..\.Z.......@...
  509. ---
  510. > 0000cd0: 0000 0000 1900 0000 f0cc 9109 18cd 9109 ................
  511. > 0000ce0: 40cd 9109 68cd 9109 0000 0000 b909 0000 @...h...........
  512. > 0000cf0: 18cd 9109 5ae5 0f08 0000 0000 40eb 0f08 ....Z.......@...
  513. 210c210
  514. < 0000d10: 0000 0000 0000 0000 409d 5c08 5ae5 0f08 ........@.\.Z...
  515. ---
  516. > 0000d10: 0000 0000 0000 0000 40cd 9109 5ae5 0f08 [email protected]...
  517. 213c213
  518. < 0000d40: 689d 5c08 5ae5 0f08 0000 0000 50eb 0f08 h.\.Z.......P...
  519. ---
  520. > 0000d40: 68cd 9109 5ae5 0f08 0000 0000 50eb 0f08 h...Z.......P...
  521. 386,387c386,387
  522. < 0001810: 655a 5154 3536 3738 3930 0000 0000 0000 eZQT567890......
  523. < 0001820: 0000 0000 0000 0000 0000 0000 0000 0000 ................
  524. ---
  525. > 0001810: 6051 7931 6f48 5745 4130 7274 4d76 4178 `Qy1oHWEA0rtMvAx
  526. > 0001820: 5748 0000 0000 0000 0000 0000 0000 0000 WH..............
  527.  
  528.  
  529. erik@ubuntu:~$ grep -B 3 -A 3 56789 erikstack.hex
  530. 0013f70: 2a4b 4524 5577 6621 6258 3a25 4979 784b *KE$Uwf!bX:%IyxK
  531. 0013f80: 6076 7a31 2b48 6a5c 6b79 546a 7052 2e79 `vz1+Hj\kyTjpR.y
  532. 0013f90: 5752 2265 2942 666a 7925 6e48 3132 3334 WR"e)Bfjy%nH1234
  533. 0013fa0: 3536 3738 3930 486f 2321 4c78 4427 3344 567890Ho#!LxD'3D
  534. 0013fb0: 5254 3b4b 787a 5572 5730 3d2b 4d66 2964 RT;KxzUrW0=+Mf)d
  535. 0013fc0: 6a50 4834 2d49 5c2f 232e 6146 6873 4373 jPH4-I\/#.aFhsCs
  536. 0013fd0: 2637 4458 3752 296d 6145 5133 d93b 9416 &7DX7R)maEQ3.;..
  537.  
  538. erik@ubuntu:~$ grep -B 3 -A 3 HWEA0 stack.hex
  539. 0014ca0: 5c5e 2929 7564 5b4f 4a62 6d4c 6735 6670 \^))ud[OJbmLg5fp
  540. 0014cb0: 2d65 714a 4378 585a 5a57 4721 5431 3c69 -eqJCxXZZWG!T1<i
  541. 0014cc0: 6e45 7242 622c 7065 4763 3734 3765 5343 nErBb,peGc747eSC
  542. 0014cd0: 6f48 5745 4130 7274 4d76 4178 5748 5370 oHWEA0rtMvAxWHSp
  543. 0014ce0: 382f 5556 2f59 6f5e 3456 5072 5d67 2932 8/UV/Yo^4VPr]g)2
  544. 0014cf0: 722c 3e4f 366a 5c62 5c41 2b50 2637 4572 r,>O6j\b\A+P&7Er
  545. 0014d00: 4553 4d2e 3142 6b78 5174 6f68 6c99 160e ESM.1BkxQtohl...
  546.  
  547.  
  548. 7eSCoHWEA0rtMvAxWH
  549.  
  550. ./crypto
  551. password: 7eSCoHWEA0rtMvAxWH
  552.  
  553. decrypt
  554. message: dfI8J5hkgaQ6vtYtKK2d7Qlou650S9m1FZ697bZ01TCOTnCTWtyCzqyZe9UV4bBHZN9nkm4j/2PyZ/0L6ga3AQ==
  555.  
  556. erik@ubuntu:~$ ./crypto
  557. password:
  558.  
  559. 1. encrypt
  560. 2. decrypt
  561. 0. quit
  562. menu: 2
  563.  
  564. msg: dfI8J5hkgaQ6vtYtKK2d7Qlou650S9m1FZ697bZ01TCOTnCTWtyCzqyZe9UV4bBHZN9nkm4j/2PyZ/0L6ga3AQ==
  565. decrypted: supported commands: info, help, history, stats, zombies
  566.  
  567. menu: 1
  568.  
  569. msg: history
  570. encrypted: 3x6o42tX97fE/EceLRTn6A==
  571.  
  572. 18:39:39 <Erik> 3x6o42tX97fE/EceLRTn6A==
  573. 18:39:39 <pectagta> 7cK6NZ3unxXBwreX2W0Zljqs4kk//eUKoMu9SCLRtdnPMdPtgZD2rDDxHOTBZpK3bWBDlUa4qWOIB16y/2PAbs0+4u/8AfXWY7gRwicWI6E6VItvWsdtWBLKusITToby
  574.  
  575. msg: 7cK6NZ3unxXBwreX2W0Zljqs4kk//eUKoMu9SCLRtdnPMdPtgZD2rDDxHOTBZpK3bWBDlUa4qWOIB16y/2PAbs0+4u/8AfXWY7gRwicWI6E6VItvWsdtWBLKusITToby
  576. decrypted: last login from [email protected] on 2013-03-19 18:36:41
  577.  
  578. Antwoord:
  579. home7eb463.vulturacommunicationhq.com
  580.  
  581. Vraag12:
  582. whois vulturacommunicationhq.com
  583.  
  584. Registrant:
  585. Zevendees, Oscar
  586. Roosveldstraat 404
  587. Haarlem, NH 2013 cc
  588. NL
  589.  
  590. Domain Name: VULTURACOMMUNICATIONHQ.COM
  591.  
  592. Antwoord:
  593. Oscar Zevendees
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!