Jump to content
begood

The carder forums 0wned by happy ninjas

By begood, in Stiri securitate

Recommended Posts

begood Newbie

begood

Posted
Posted 



                                                      |\___/|
              -=[ISSUE - NO 1]=-                     =) ^Y^ (=
                   -=[OF]=-                           \  ^  /
                                                       )=*=(
 ______________________________ __ ____________ _     /     \
|.-----.--.--.--.-----.-----.--|  |   ___ ___ _| ||   |     |
||  _  |  |  |  |     |  -__|  _  |  | . |   | . ||  /| | | |\
||_____|________|__|__|_____|_____|  |__,|_|_|___||  \| | |_|/\
|  | |                                   ______   |__//_// ___/ __ 
|  | |               .-----.--.--.-----.|      |.-----.--\_).--|  ||
|  | |               |  -__|_   _|  _  ||  ||  ||__ --|  -__|  _  ||
|  | |               |_____|__.__|   __||  ||  ||_____|_____|_____||
|_/   \__________________________|__|___|  ||  |___________________|
                                        |______|
         FEATURING             ~~~ |\                  A present
  Germanys next Darkmarket    ~~~ /()/              brought to you                                
         Carders.cc            ~~~`\|            by some happy ninjas

        /                 
*//////{<>===[TABLE OF CONTENTS]=====================================-
        \

[================[       INTRO       ]==--
[================[       OWNAGE      ]==--
[================[       RM          ]==--
[================[       PASSES      ]==--
[================[       IP'S        ]==--
[================[       OUTRO       ]==--

        /                 
*//////{<>===[INTRO]=================================================-
        \

Many of you guys may have noticed  this breeding German  "underground"
shit called carders.cc.  For those who don't: Carders is a marketplace
full of everything  that is illegal and bad.  Carding,  fraud,  drugs,
weapons and tons of kiddies.  They used to be only a small forum,  but
after we erased  1337-crew  they got  more  power.  The rats  left the
sinking  ship.  The voices  told us to own them  since carders is  our
fault and we had to fix our flaw. So we did.

During  the  ownage  they  also  gave  us  lulz  by  showing off their
ridiculous  configuration skills which had a specific  impact on their
security.  They actually managed to chmod and chown nearly  everything
to 777 and www-user readable. Including their /root directory.
 ____________________________________________________________________
|                         __          __                             |
|     .-----.--.--.-----.|  |_.-----.|  |--.-----.--.--.             |
|     |  _  |  |  |  _  ||   _|  -__||  _  |  _  |_   _|             |
|     |__   |_____|_____||____|_____||_____|_____|__.__|             |
|________|__|________________________________________________________|
|                                                                    |
| Zagerus: Zusaetzlich  schuetzen  auch   andere  Applikationen  wie |
|          beispielsweise "suhosin" die Scripte.                     |
|____________________________________________________________________|

Ya sure.  However, to put it in a nutshell, here is what we've got.  O
and  don't  forget  the  uncensored  database backup that we prepared,
including private messages, passes and their holy priv8 3rd level.
 ____________________________________________________________________
|                         __          __                             |
|     .-----.--.--.-----.|  |_.-----.|  |--.-----.--.--.             |
|     |  _  |  |  |  _  ||   _|  -__||  _  |  _  |_   _|             |
|     |__   |_____|_____||____|_____||_____|_____|__.__|             |
|________|__|________________________________________________________|
|                                                                    |
| KRON0S: Seitdem Thanatos und ich hier das sagen haben ,  haben wir |
|         sehr viel auf DDos protection und Sicherheit gesetzt .     |
|____________________________________________________________________|

       \
 ____________________________________________________________________
|                         __          __                             |
|     .-----.--.--.-----.|  |_.-----.|  |--.-----.--.--.             |
|     |  _  |  |  |  _  ||   _|  -__||  _  |  _  |_   _|             |
|     |__   |_____|_____||____|_____||_____|_____|__.__|             |
|________|__|________________________________________________________|
|                                                                    |
| THANAT0S: Nach wie vor werden hier keinerlei IPs geloggt, was euch |
|           jedoch nicht am Nutzen von VPNs hindern soll!            |
|____________________________________________________________________|

We  have good and bad news for you.  The good news first: THANAT0S did
not lie.  Their access.log  did not  include  real  user ips and  they
overwrote $_SERVER['REMOTE_ADDR'] with a random ip. Now what's the bad
news, you may ask. The Carders.cc admins seemded  actually too dumb to 
disable ALL of the logging,   giving  us  enough   possibilites to get 
what we wanted. Even a LOT more than enough,  means we  got a lot more
info than  you  might  think.   Sure, some  of you maybe always used a 
proxy... Most of the administrators and moderators didn't. Did you?

>>>ATTENTION! RETARDED PHP CODE ALERT!<<<

~$ cat checkit.php
<?php
        @mysql_connect("localhost", "cms_carders_cc", "CSiUvqD2MeTOBDSLIR4Am0DJWnQidedYqoX4Cutn");
        @mysql_select_db("smf_carders_cc");

        $query_ip = @mysql_query("UPDATE carders_smf_members SET member_ip='0', member_ip2='0' WHERE CHAR_LENGTH(member_ip) >= 2 OR CHAR_LENGTH(member_ip2) >= 2");
?>

This is how they wipe their logs. Sweet huh?

-=[ THANAT0S
  [ IP: 93.131.107.168 used at 11. May,2010,22:31:47    
  [ HOST: wprt-5d836ba8.pool.mediaWays.net
  [ LOCATION: DE, Germany
  [ ISP: 1&1 Internet AG Wuppertal, 07 - ]=-

-=[ KRON0S
  [ IP: 80.226.14.32 used at 11.May,2010,23:32:47   
  [ HOST:     ip-80-226-14-32.vodafone-net.de
  [ LOCATION: DE, Germany
  [ ISP: Vodafone D2 GmbH
  [ -
  [ IP: 79.221.31.254 used at 11. May,2010,22:16:31  
  [ HOST: p4FDD1FFE.dip.t-dialin.net
  [ LOCATION: DE, Germany
  [ ISP: Deutsche Telekom AG Frankfurt Am Main, 05 - ]=-

-=[ Zagerus
  [ IP: 62.227.86.213 used at 11. May,2010,23:37:27   
  [ HOST: p3EE356D5.dip.t-dialin.net
  [ LOCATION: DE, Germany
  [ ISP: Deutsche Telekom AG Hesel, 06 - ]=-
So all in all these  nice  addresses should  teach you a lesson.  Hope
you all get some visits soon.

        /
*//////{<>===[OUTRO]=================================================-
        \
 ____________________________________________________________________
|                         __          __                             |
|     .-----.--.--.-----.|  |_.-----.|  |--.-----.--.--.             |
|     |  _  |  |  |  _  ||   _|  -__||  _  |  _  |_   _|             |
|     |__   |_____|_____||____|_____||_____|_____|__.__|             |
|________|__|________________________________________________________|
|                                                                    |
| Zagerus: Alle  neuen   privaten   Nachrichten  werden  ab   sofort |
|          verschluesselt in der Datenbank gespeichert.              |
|____________________________________________________________________|

~$ grep -ri -A 1 -B 1 base64_encode Sources/Subs-Post.php
    // Encode the message
    $message = base64_encode($message);
    $encoded = 1;

Oh noes,  blimey.  We are screwed,  they encoded their  messages  with
base64. We had to surrender at this point. Their protection system was
just too good. Nearly unbreakable. Like THANAT0S said:
 ____________________________________________________________________
|                         __          __                             |
|     .-----.--.--.-----.|  |_.-----.|  |--.-----.--.--.             |
|     |  _  |  |  |  _  ||   _|  -__||  _  |  _  |_   _|             |
|     |__   |_____|_____||____|_____||_____|_____|__.__|             |
|________|__|________________________________________________________|
|                                                                    |
| THANAT0S: Ein   neuer  Rootserver,  mehr Protection!  (Hosting  in |
|           Moskau/Ukraine)                                          |
|____________________________________________________________________|

To the carders.cc admins: Recommendation No.1 - THE ANAL PROBINATOR
                                  ______                
                                 / ____ \               
                     ___________/_|----|_\_____________ 
                 _______/||/,-.\|||||||----|__    ____ .--' 
              ,-|    __/--' |o| `-----|____|-'   |    \ \   
             (  |___(o7     \4b\      |    |___   >---< <`. 
              >-|  __/------.\4b\ ,---|    |--'  |    /db`.>
             (  | (o7|||||||| |o| |||||----|____ |   /d88[( 
              `-|__/----,-""""""""">--|____|---' |__/d88P / 
                  <____/----------<___|____|_____________/  
                                \ `----' /              
                                 `------' 

AND NOW ITS TIME FOR OUR FIRST ... 
______________________________________________________________________
IlapslapslapslapslapslapslapslapslapslapslapslapslapslapslapslapslapsI
Isl_______l__slapslapslapsla_______a__lap__apslapslapslaps__pslap__apI
Ip|     __|  |.---.-.-----.|   _   |  |_|  |_.---.-.----.|  |--.|  |aI
Ia|__     |  ||  _  |  _  ||       |   _|   _|  _  |  __||    < |__|lI
Il|_______|__||___._|   __||___|___|____|____|___._|____||__|__||__|sI
Islapslapslapslapsla|__|pslapslapslapslapslapslapslapslapslapslapslapI
IpslapslapslapslapslapslapslapslapslapslapslapslapslapslapslapslapslaI
                Addressed to all the lamers out there

DEIM0S  - You get a SlapAttack since you were responsible for security
          we heard. You did a great job dude, n1.
 ____________________________________________________________________
|                         __          __                             |
|     .-----.--.--.-----.|  |_.-----.|  |--.-----.--.--.             |
|     |  _  |  |  |  _  ||   _|  -__||  _  |  _  |_   _|             |
|     |__   |_____|_____||____|_____||_____|_____|__.__|             |
|________|__|________________________________________________________|
|                                                                    |
| Juri: alles was von Deimos gemacht worden war ,war 100 % fach-     |
|       maennisch und 1000% sicher.                                  |
|____________________________________________________________________|

Zagerus - The "techadmin". Who taught you to be techadmin?  You wrote
          this anti ddos script right? SlapAttack for you!

$~ cat ipz.php
<?php
        $logfile= './ddoslogz.html';
        $IP = getenv("HTTP_X_FORWARDED_FOR");
        $logdetails=  date("F j, Y, g:i a") . ': ' . '<a href=http://dnsstuff.com/tools/city.ch?ip='.$IP.'>'.$IP.'</a>';
        /*$fp = fopen($logfile, "a");
        @fwrite($fp, $logdetails);
        @fwrite($fp, "<br>");
        @fclose($fp);*/
        echo "<center><h3>DDoS-Attacke</h3></center>\nWir stehen zur Zeit unter DDoS. Der Login blockt die Abfragen etwas ab.<br /><br />\n<strong>Bitte geben Sie als Benutzernamen und Passwort \"ddos\" ein.</strong><br /><br />Vielen Dank fuer Ihr Verstaendnis!";
?>

THANAT0S, 
KRON0S  - Great admins,  everyone should be like you. And btw you suck
          at choosing nicknames. SlapAttack!

fred777 - You have actually not a lot to do with  this, but you  get a
          SlapAttack because we hate you. Ok not only for that...  You
          are simply lame and dumb and you suck  at  almost everything
          you do.  We recommend  you to fuck  off and  take our orders
          at burger king THANX.

So thats all actually.
And btw to all the  other supporters of pseudo German undergroud shit:
The ninja guys piss on you and  your  half trained monkeys or whatever 
your leet underground team consists of.   If you continue, you will be 
owned over again and rm'd twice. Also we will punch you in the face.

           Have a good day   |\_ 
                        /()/
                        `\|   and stay happy <3

http://www.pastie.org/966482.txt?key=9qnkkrnoqukzk4zl9g7og

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...