Zoz pwned-by-the-owner

Pwned by the Owner
Zoz

% nslookup 72.193.81.105

Server: 127.0.0.1

Address: 127.0.0.1#53

Non-authoritative answer:

105.81.193.72.in-addr.arpa name = ip72-193-81-105.lv.lv.cox.net.

Authoritative answers can be found from:

81.193.72.in-addr.arpa nameserver = ns.cox.net.

81.193.72.in-addr.arpa nameserver = ns.east.cox.net.

81.193.72.in-addr.arpa nameserver = ns.west.cox.net.

ns.cox.net internet address = 68.1.16.107

ns.east.cox.net internet address = 68.1.16.108

ns.west.cox.net internet address = 68.111.106.68

PING fear-and-loathing.cannytrophic.com (72.193.81.105): 56 data bytes
64 bytes from 72.193.81.105: icmp_seq=0 ttl=50 time=587.550 ms
% while (1)
while? ping -t 60 fear-and-loathing.cannytrophic.com
%
while? endfear-and-loathing.cannytrophic.com (72.193.81.105) 56(84) bytes of data.
PING
--- fear-and-loathing.cannytrophic.com ping statistics ---
60 packets transmitted, 0 received, 100% packet loss, time 60998ms

% ssh fear-and-loathing.cannytrophic.com
Password:
Welcome to Darwin!
fear-and-loathing.cannytrophic.com:~ %

Fuck yeah!

.xnxx.com TRUE / FALSE 1289019977 __utmz 92469890.1273251978.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=free%20porn
__utmz 92469890.1273251978.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr= free%20porn
.fling.com TRUE / FALSE 1275731323 geo_record 72.193.81%3BLas+Vegas%3BNV%3BNevada%3BUS%3BUnited+States
geo_record 72.193.81%3B Las+Vegas%3BNV%3BNevada%3BUS%3BUnited+States
.brandreachsys.com TRUE / FALSE 1274458209 geo_record 68.104.71%3BLas+Vegas%3BNV%3BNevada%3BUS%3BUnited+States
.blackphatbooty.com TRUE / FALSE 1289019665 __utmz 61776127.1273251666.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=sexy%20beautifull%20phat%20ass
__utmz 61776127.1273251666.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=sexy%20beautifull%20phat%20ass
__utmz 61776127.1273251666.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr= sexy%20beautifull%20phat%20ass
.bigbuttbrazilianmoms.com TRUE / FALSE 1281891944 nats_sess e14daa73ad854d24d4ee9cb052c11fdf
nats_sess e14daa73ad854d24d4ee9cb052c11fdf
nice-butt.org FALSE / FALSE 1422723945 d2ef33b9b6662a3cf9e0affda91a5170 1273251945-0-!0
freebigassporn.org FALSE /
/ FALSE 1436547940
FALSE 9317c784438f1c4c4845df7c31b2c0e6 1273251941-0-!0
9317c784438f1c4c4845df7c31b2c0e6 1273251941-0-!0
freebuttpornvideo.org FALSE / FALSE 1560963912 1c5b426681186ace122398bc38e4c252 1273251916-0-!0
1c5b426681186ace122398bc38e4c252 1273251916-0-!0
www.unrealbutts.com FALSE / FALSE 1273338252 whereFrom29 elephantasses.com
www.elephantasses.com FALSE / FALSE 1273338228 whereFrom17 blackphatbooty.com
.imlive.com TRUE / FALSE 1289019802 __utmz 71081352.1273251802.1.1.utmcsr=blackphatbooty.com|utmccn=(referral)|utmcmd=referral|utmcct=/
.blackteengirlfriends.com TRUE / FALSE 1274115763 nats NzM1OjM6Mg%2C0%2C0%2C0%2C110
.mightyfineass.com TRUE /
/ FALSE 1289019579
FALSE __utmz 97044739.1273251580.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=sexy%20beautifull%20phat%20ass
__utmz 97044739.1273251580.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=sexy%20beautifull%20phat%20ass
__utmz 97044739.1273251580.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr= sexy%20beautifull%20phat%20ass
.porntubular.com TRUE / FALSE 1289019538 __utmz 5274930.1273251539.1.1.utmcsr=linkass.com|utmccn=(referral)|utmcmd=referral|utmcct=/
linkass.com FALSE / FALSE 1273337696 adfreq 1
.myspace.com TRUE / FALSE 1273856068 MSCulture IP=72.193.81.105&IPCulture=en-US&PreferredCulture=en-US&Country=VVM
.facebook.com TRUE / FALSE 1334231569 datr 1271159548-4dd31e07fe0895b6e1e3a509fe7f814b33edbdc6088ba3c2343e7
mail.google.com FALSE /mail FALSE 1273422980 gmailchat mrguzmanmel@gmail.com/727907
www.google.com FALSE /accounts TRUE 1588609038 GAUSR mail:mrguzmanmel@gmail.com
.profile.myspace.com TRUE / FALSE 1334234257 __utma 35235168.487630587.1271162257.1271162257.1271162257.1
.profile.myspace.com TRUE / FALSE 1286930257 __utmz 35235168.1271162257.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=darlesia%20las%20vegas
.br.rk.com TRUE / FALSE 1273754164 geo_record 68.104.74%3BLas+Vegas%3BNV%3BNevada%3BUS%3BUnited+States
.yahoo.com TRUE / FALSE 1334951982 B ejoo1r95ss6qh&b=4&d=lpFcqjtpYEK72J1qbjz9ljcouT0oJJmob_UhOA--&s=un&i=HowMgQmyClEOLj9vd7EU
.craigslist.org TRUE / FALSE 1303966405 cl_def_hp lasvegas
cl_def_hp lasvegas
.blackplanet.com TRUE / FALSE 1273319464 C1C2 3g-R8MBN73FaBElM0KcywOxhummpkEi9XxEV3hrwyG62jeec4-gEEgg
.slutload.com TRUE / FALSE 1288908979 __utmz 175867232.1273140979.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=irl%20goes%20in%20for%20interview%20and
__utmz 175867232.1273140979.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr= irl%20goes%20in%20for%20interview%20and
%20getsfucked
.spankwirelive.com TRUE / FALSE 1586260715 nsui db1ee2ff8175e0b0
.adultfriendfinder.com TRUE / FALSE 1275411010 LOCATION_FROM_IP country&United+States&area_code&702&longitude&-115.2049&country_name&United
+States&lat&36.1515&country_code&US&region&NV&state&Nevada&zip&&city&Las+Vegas&postal_code&&latitude&36.1515&lon&-115.2049&dma_code&839&country_code3&USA
.freeviewmovies.com TRUE / FALSE 1275410983 fvmgeoc US
fvmgeoc US
.freeviewmovies.com TRUE / FALSE 1275410983 fvmgeon United+States
fvmgeon United+States
.freeviewmovies.com TRUE / FALSE 1275410983 fvmgeocity Las+Vegas
fvmgeocity Las+Vegas
.freeviewmovies.com TRUE / FALSE 1275410983 fvmgeoregion NV NV
fvmgeoregion
.freeviewmovies.com TRUE / FALSE 1275410983 fvmgeolong -115.2049
fvmgeolong -115.2049
.freeviewmovies.com TRUE / FALSE 1275410983 fvmgeolat 36.1515 36.1515
fvmgeolat
.adultfriendfinder.com TRUE / FALSE 1275411010 ffadult_tr r,FAVBPf_X850niGRyUIW0WVFqkwrGEFmrLBGcW0dkPRrJ0f7r5z3WGZ7Voe6SAbck
.pornhub.com TRUE / FALSE 1288586902 __utmz 81823753.1272818902.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=pon%20free
__utmz 81823753.1272818902.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr= pon%20free
members.blackcrush.com FALSE / FALSE 2217606844 SLUCE 1A084C57450252495D58515F5D5844161D5D100B0341435E42585442415F5746505B4C41470856484A5A525511
.18andabused.videosz.com TRUE / FALSE 1335552222 __utma 151411513.118282892.1272480223.1272480223.1272480223.1
.realexgirlfriends.com TRUE / FALSE 1335551888 __utma 253505418.1063252664.1272479884.1272479884.1272479884.1
www.thepornbunker.com FALSE / FALSE 1304015871 c_ref_986647 http%3A//www.google.com/search%3Fq%3Dporn%2520freee%26sourceid%3Dmozilla2%26ie%3Dutf-8%26oe%3Dutf-8
TRUE
.massagecreep.com / FALSE 1273343837 nats MTYzNjI6OTQ6NTg%2C0%2C0%2C0%2C0
.livecams.com TRUE / FALSE 1335551664 __utma 259216663.107940818.1272479657.1272479657.1272479657.1
.porn.com TRUE / FALSE 1288247519 __utmz 139135020.1272479520.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=bella%20moretti
.mycricket.com TRUE / FALSE 1287647051 __utmz 174607422.1271879052.3.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=cricket%20ringback%20tones
.walmartmoneycard.com TRUE / FALSE 1287831181 __utmz 118520207.1272063181.2.2.utmcsr=mygreendot.com|utmccn=(referral)|utmcmd=referral|utmcct=/greendot/
.mocospace.com TRUE / FALSE 1286668440 __utmz 60546097.1270900441.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.blackpeoplemeet.com TRUE / FALSE 1274473696 MRID 8370480
www.mycricket.com
FALSE / FALSE 1303580798 OAID 4c51a7a16392acdd3fc453bfd5a5bf72
.homemadeporn.com
TRUE / FALSE 1287634143 __utmz 269355368.1271866143.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.youporn.com TRUE / FALSE 1286757726 __utmz 60671397.1270989727.1.1.utmccn=(organic)|utmcsr=google|utmctr=beautiful+pussy|utmcmd=organic
.favouritenudes.com TRUE / FALSE 1286757695 __utmz 117594782.1270989695.1.1.utmccn=(organic)|utmcsr=google|utmctr=beautiful+pussy|utmcmd=organic

mrguzmanmel@gmail.com

✓ Location: Las Vegas

✓ Name: Mel Guzman

✓ Photos:

✓ GMail account: mrguzmanmel@gmail.com

✓ Keylogger installed

LogKext Daemon starting up : Mon May 10 22:14:25 2010

<esc><esc><tab>>>kljhghggbjj<down><down><up><up>??
>><:KLBYYYBYLL:&NN&:&&&&&BJ<cmd>BJHZXUY<cmd>&S^&N<del>
AMBERVALLEYLANE LAS VEGAS<tab>nnnnnnn<tab>
youtube.com
dont lea<del>irs.com
irs
<cmd>tmocospace.com
1flyricanpapi<tab>guzman85
mrguzmanmel@gmail.com
melvin<tab>guzman<tab> amv<del>ber
valleylane<del><del><del><del>ln<shift><tab> <del>MFG
FGUVUTYRTERWEW#W#QW$SW$#D$W$#E$$RR%%T^%^&Y&&R
$&**YR*TYJ*BR&B&B&HJHJJJUJYBUBJNICKJRN(<del>ICK JR
<cmd>CV XZ
{}}{+}{}

mocospace.com: 1flyricanpapi / guzman85

gmail: mrguzmanmel@gmail.com / guzman85

PayPal: mrguzmanmel@gmail.com / guzman85

Facebook: timrican@yahoo.com / guzman85

Yahoo: timrican / guzman85

BlackPlanet.com: fricanpapi85 / guzman85

BlackCrush.com: fricanpapi / guzman85

yourfuckbook.com: fricanpapi / guzman85

planetsuzy.com: fricanpapi / guzman85

cect-forums.com: melguzman85 / guzman85

eBay: mguzman1985

Name: Melvin Guzman-Rosa

Address: Amber Valley Lane, Las Vegas, NV

Birthday: March 27, 1985

Lessons Learned
➡ Better security = non-recovery

➡ Perp could log in

➡ Network settings editable

➡ Recovered hardware & some data

➡ Potential vulns (against trained threat)
were boons against low-tech threat

➡ ssh, VNC, IP tracking daemon

➡ Keychain vs keyloggers

➡ Note your serial #s for the cops

➡ Don’t fuck with a hacker’s machine

Zoz pwned-by-the-owner

Recommended

Recommended

More Related Content

Recently uploaded

Recently uploaded (9)

Featured

Featured (20)

Zoz pwned-by-the-owner