Widget
2009-07-18 10:23:27
From what I can tell, he's an ex-RSBot staff member who's been using some random script to hijack Linux-based web servers and steal databases off them. He's the same guy who popped up a few months back and was all "liek 0mg i has ur sudoku," but he didn't do anything back then.
Anyway, this seems to concern RSBot's forum too, and I think it would be beneficial if the admins from both sites could work together to get rid of him. I'm not sure how Rizon IP masks work, but I think this should be sufficient evidence to get him arrested/fined by the cops wherever he lives.
Have some data/logs:
- Some script: http://ja.pastebin.ca/1442154 (backup http://hgisilhuasg.pastebin.com/f1e12511c )
- Some other thing: http://74.125.153.132/search?q=cache:9OqYAIB6CfwJ:de.pastebin.ca/1463914+%22prsb%22+%22owned%22+rsbot&cd=7&hl=en&ct=clnk&gl=in (backup http://fdsaw4t89.pastebin.com/m159d6f4 ) BE VERY CAREFUL WITH THIS, it contains tons of VBulletin hashes
Whois:
Chatlog from PM:
Chatlog from #SRL:
Anyway, this seems to concern RSBot's forum too, and I think it would be beneficial if the admins from both sites could work together to get rid of him. I'm not sure how Rizon IP masks work, but I think this should be sufficient evidence to get him arrested/fined by the cops wherever he lives.
Have some data/logs:
- Some script: http://ja.pastebin.ca/1442154 (backup http://hgisilhuasg.pastebin.com/f1e12511c )
- Some other thing: http://74.125.153.132/search?q=cache:9OqYAIB6CfwJ:de.pastebin.ca/1463914+%22prsb%22+%22owned%22+rsbot&cd=7&hl=en&ct=clnk&gl=in (backup http://fdsaw4t89.pastebin.com/m159d6f4 ) BE VERY CAREFUL WITH THIS, it contains tons of VBulletin hashes
Whois:
* [Guest12071] (~T@3E908FBB.BC7DCF12.5D8E99A8.IP): [00|USA|189598]
* [Guest12071] *.rizon.net :Where are you?
* [Guest12071] idle 00:00:11, signon: Fri Jul 17 23:21:57
* [Guest12071] End of WHOIS list.
Chatlog from PM:
<Guest12071> i lold @ dis random kid
<Guest12071> http://ja.pastebin.ca/1442154
<Guest12071> ur fukn wid da wrong perzon mate
<Widget> wizzup should wake up in about 4 hours
<Widget> you can take it up with him then
<Widget> it's pretty much the only problem of having a dutch admin :p
<Guest12071> ull be taking up hell
<Widget> like i said, please wait until wizzup gets on
<Guest12071> neway
<Guest12071> njoy thiz
<Guest12071> itz amonth old
<Guest12071> or so
<Guest12071> cuz i awt bored i pwnd some leecherz of rzbot
<Guest12071> http://74.125.153.132/search?q=cache:9OqYAIB6CfwJ:de.pastebin.ca/1463914+%22prsb%22+%22owned%22+rsbot&cd=7&hl=en&ct=clnk&gl=in
<Widget> go you, you're the best script kiddy evar?
<Guest12071> yuz
<Guest12071> i am
<Guest12071> u will join da ownd handle
<Guest12071> fukn promize from anti-sec
<Widget> what format are those hashes in?
<Guest12071> theyre saltd vb hashes
<Widget> i mean like md5(salt+md5(pass)) or something?
<Guest12071> md5(md5(pass)+salt)
<Guest12071> or sum shit, why dont u read da sourze
<Widget> lol, close
<Guest12071> leet programmr
<Widget> because i don't have it
<Widget> but anyway, what are you hoping to gain from this?
<Widget> attention?
<Guest12071> no
<Widget> your old rank?
<Widget> respect?
<Guest12071> im dedicated to owning your mom
<Guest12071> and villavu
<Widget> go ahead with my mom
<Widget> but why villavu?
<Guest12071> just something reminded me of runescape
<Guest12071> some random dood sent a link 2 runescapetube
<Guest12071> reminded me of srl & rsbot
<Widget> so you're just a bit loony?
<Guest12071> apparently runescapetube is spreading infected shiz, and ya im not sleepy and some kid glined like 30 ppl from our irc
<Guest12071> <~T> ninja
<Guest12071> <~T> grab da ex and p 4 me
<Guest12071> <~T> plox
<Guest12071> <~T> (10:32:58 AM) fr3sH: WTF is this your picture?! http://runescapetube.com/images/IMG00-53.JPG <— infected
<Guest12071> <~T> going now
<Guest12071> <~T> bye
<Widget> IE exploit or something?
<Guest12071> <@Hellbinder> WTF is this your picture?! http://runescapetube.com/images/IMG00-53.JPG
<Guest12071> <@HellbindersMom> idk how to remove bish
<Guest12071> <d0g> DCC "startkeylogger" 0 0 0
<Guest12071> <@Hellbinder> lmao, how can anyone fall for that?
<Guest12071> <@HellbindersMom> i didnt
<Guest12071> <@HellbindersMom> newb
<Guest12071> <d0g> i just dled that
<Guest12071> <@HellbindersMom> lolz
<Guest12071> <d0g> okok, i need to spread my stealer naow
<Guest12071> <@HellbindersMom> d0g
<Guest12071> <@HellbindersMom> give me infoz
<Guest12071> <d0g> ?
<Guest12071> <@Hellbinder> yeah, macro will install it probably
<Guest12071> <d0g> he allready installed it yesterday
<Guest12071> <@Hellbinder> GG
<Guest12071> <@Hellbinder> this makes NO sense
<Guest12071> <&ninja> uhmm
<Guest12071> <&ninja> just use torrentz
<Guest12071> <&ninja> write aXXo
<Guest12071> <&ninja> done
<Guest12071> <&ninja> xD
<Guest12071> <&ninja> pick something new n write something reputable
<Guest12071> <&ninja> then put on thepiratebay
<Guest12071> <@Hellbinder> how does c++ translate "bool selected = false" into "selected = true"? >_>
<Guest12071> <&ninja> uhmm
<Guest12071> <&ninja> check it right after
<Guest12071> nah makes u dl shit
<Widget> wow, rizon really has leniant flood protection
<Guest12071> <&kasper5150> http://gltrs.grc.nasa.gov/Citations.aspx?id=5+and+1=1--+
<Guest12071> <opx> :)
<Guest12071> <opx> hello kasper
<Guest12071> <&kasper5150> sup bra
<Guest12071> <opx> chillin
<Guest12071> <&kasper5150> !access list
<Guest12071> <opx> you
<Guest12071> <&kasper5150> nm
<Guest12071> <&kasper5150> just brushing up on some sqli
<Guest12071> <opx> same
<Guest12071> <&kasper5150> gonna need it @ defcon
<Guest12071> <opx> :P
<Guest12071> <&kasper5150> hope ur going
<Guest12071> <opx> i need a blind one to train on
<Guest12071> <opx> na
<Guest12071> ya
<Guest12071> oops
<Guest12071> wrong logz
<Guest12071> lolz
<Guest12071> anyway
<Guest12071> elitexbytes hackd rizon 4 lolz
<Guest12071> hez da wrong guy 2 mezz with
<Guest12071> i grabd some pwdz from him and had fun while i cud, good mate
<Guest12071> (2:40:59 AM) Steem: didnt read da newz?
<Guest12071> (2:41:06 AM) Steem: http://mashable.com/2009/07/10/imageshack-hacked/
<Guest12071> (2:41:07 AM) Ben: no
<Guest12071> (2:42:22 AM) Steem: anti-sec:~/pwn# perl img-scan.pl Found img1.imageshack.us - lighttpd/1.4.18 - SSH-1.99-OpenSSH_4.5 [snip] Found img998.imageshack.us - lighttpd/1.4.18 - SSH-1.99-OpenSSH_4.5 anti-sec:~/pwn# perl mass-pwn.pl Connecting… Linux worf.imageshack.us 2.6.15-1.2054_FC5 #1 SMP Tue Mar 14 15:48:20 EST 2006 x86_64 x86_64 x86_64 GNU/Linux Replacing images… img1 –> img998 All images replaced: http://img998.imageshack.us/antis
<Guest12071> (10:32:58 AM) fr3sH: WTF is this your picture?! http://runescapetube.com/images/IMG00-53.JPG
<Guest12071> (11:48:12 AM) [email]macrosecurity@hotmail.com[/email] is now known as macrosecurity.
<Guest12071> (11:48:18 AM) [email]macrosecurity@hotmail.com[/email] is now known as fr3sH.
<Guest12071> (5:16:11 PM) fr3sH: WTF is this your picture?! http://runescapetube.com/images/IMG00-53.JPG
<Guest12071> (5:18:53 PM) fr3sH: WTF is this your picture?! http://runescapetube.com/images/IMG00-53.JPG
<Guest12071> datz wat reminded me of runescape botz
<Guest12071> ya>
<Guest12071> neway i got grantd some anti-sec warez
<Guest12071> so i thought id uze da mad warezx
<Widget> just so you know i haven't been paying attention the last 5 minutes or so
<Widget> no point in rambling on
<Guest12071> ok
<Guest12071> If you think that we oppose your website, our advise is to pack it up and shut it down, because we're coming for you.
<Guest12071> itz 2 late for you ^
<Guest12071> make sure you'll have a fn time before you get rm'd, only a matter of time
Chatlog from #SRL:
* Guest12071 (~T@3E908FBB.BC7DCF12.5D8E99A8.IP) has joined #SRL
* [kz] (kz@Rizon-556924C3.brodm3.vic.optusnet.com.au): kz
* [kz] #rsbot %#srl-dev #SRL @#srl-ops @#ssrl
* [kz] *.rizon.net :Where are you?
* [kz] has identified for this nick
* [kz] idle 00:00:04, signon: Fri Jul 17 08:52:39
* [kz] End of WHOIS list.
* ChanServ gives channel operator status to Widget
<Harry> lol
<Harry> hi :D
* Widget sets ban on *!*@*556924C3*
<Harry> who is Guest12071 ?
* Widget has kicked kz from #SRL (kz)
<Harry> why b&?
<R0b0t1> Lolwut?
<Harry> for #ssrl?
<Widget> trolling in #rsbot
<Guest12071> (10:44:53 PM) Wishing, Waiting, Wanting: so ja
* Abbott (~abbotta4@Rizon-33D2B60C.hsd1.pa.comcast.net) has joined #SRL
<Guest12071> (10:44:53 PM) Wishing, Waiting, Wanting: i was right about pimpinjg
<Guest12071> (10:45:02 PM) Steem: what he done
<Guest12071> (10:45:49 PM) Wishing, Waiting, Wanting: he haxed ircd
<Guest12071> (10:45:51 PM) Steem: hao
<Guest12071> (10:45:52 PM) Steem: fk
<Guest12071> (10:46:01 PM) Steem: isg got owned?
* Widget has kicked Guest12071 from #SRL (Guest12071)
* Guest12071 (~T@3E908FBB.BC7DCF12.5D8E99A8.IP) has joined #SRL
<Harry> inb4 mass highlight
<Guest12071> noo fuk
<Harry> lol
<Harry> pwnt
<Harry> Guest12071: rejoin #ssrl, you are unbanned
<Guest12071> ./care
* Topic for #SRL is: Talk about the SRL Resource Library here | Channel was being logged: http://www.thehhd.com/irc/ | More than three lines: www.pastebin.com | Be wise. No NSFW, Flaming, Cursing, Mass Highlighting/Noticing, etc. | Channel ops reserve the right to kick and/or ban for any reason | Keep bots laconic.
* Topic for #SRL set by Raym0nd`!~raymond@Rizon-F36676C1.cable.casema.nl at Fri Jul 17 09:02:31 2009
<Harry> rejoin.
<Harry> baka.
<Harry> (°∀°)
<Guest12071> im da guy who stole ur db a few monthz ago cuz i gawt bored, rite wizzup
<Harry> hurr
<Harry> yer kewl brah
<Guest12071> ty
<Harry> DIAF
<Abbott> Hey everyone
<Guest12071> and dw ur h8d by every1 here
<Harry> kaithx'
<Guest12071> well were
<Abbott> Could someone help me with Reflection?
<Guest12071> they think ur a tarded 13 yo old
<Guest12071> who fails @ trolling
<Harry> who?
<Guest12071> you rofl
<Harry> Lol, I know you
<Harry> hold on, IP lookup
<Harry> hmm, intersting
<Harry> Americunt
<Harry> gtfo.
* [Guest12071] (~T@3E908FBB.BC7DCF12.5D8E99A8.IP): [00|USA|189598]
* [Guest12071] #SRL
* [Guest12071] *.rizon.net :Where are you?
* [Guest12071] idle 00:00:35, signon: Fri Jul 17 23:21:57
* [Guest12071] End of WHOIS list.
<Guest12071> lol
<Guest12071> wut
<Widget> are you on ipv6?
<Guest12071> who
<Harry> No he is not.
<Guest12071> roflrofl
<Harry> he just does not have rdns
<Widget> i don't think i've seen an ip mask like that though
<Guest12071> anyway im pse
<Harry> Widget: it is what unreal does when it fails at rdns
<Guest12071> ex-sysadmin of rsbot
<Harry> Guest12071: we are not rsbot
<Harry> wrong room.
<Guest12071> i know
<Guest12071> ;)
<Guest12071> but i remember you people
<Guest12071> we used to use yo script when we played runescape
<Guest12071> the sudoku oe
<Guest12071> one
<Widget> oh, i think i know who you are
<Guest12071> rogue trader
<Guest12071> etc
<Widget> can't remember the name though
<Guest12071> you do
<Guest12071> :)
<Widget> you're the one who got banned from rsbot though, right?
<Guest12071> i quit myself
<Guest12071> because of a fiht with a fag calld ruski
<Widget> i have a feeling spel just said gtfo
<Widget> especially if you can't english properly
<Guest12071> i took spel out of power
<Guest12071> lolz
<Guest12071> i demoted him
<Guest12071> i rootd their box and demoted & deleted speljohan
<Widget> ohnoes, they had to put a full line of sql back in from the backup?
<Harry> yeah right. lern to speak engrish before comming in bragging about your l33th4x abilities
<Guest12071> Widget
<R0b0t1> Gtfo
<Guest12071> i got pissed off cuz of qauters
<R0b0t1> Who is T?
<Guest12071> got raged
<Guest12071> and rm -rf /*
<Guest12071> he rebuilt the vps
<Widget> because he can actually program unlike you?
<Guest12071> o
<Guest12071> ask him if he knows me ;)
<Harry> hey Guest12071, are you not the same guy who came in saying you could crack my md5 hash? Did you ever finish it?
<Harry> no, you never did
<R0b0t1> RSbot are nooblets, they seem to be getting money from a free project.
<R0b0t1> Which is wrong.
<Harry> you fail at life and computing.
<Guest12071> R0b0t1
<Guest12071> no money
<Guest12071> tbh
<R0b0t1> Lol sure.
<Guest12071> ask ins3
<R0b0t1> Uhm
<R0b0t1> Why would he have any reason to tell me the truth?
<Harry> /exec -o /home/h/.irssi/scripts/sysinfo.pl
<Guest12071> R0b0t1
<Harry> hey Guest12071, my port 22 is open on my box, and my password is less than 5 characters for root. I bet you 400 bucks you can not get into it, within the next 24 hrs.
<Guest12071> because he makes no money out of it
<R0b0t1> Lol
<R0b0t1> Donations are always open.
<Guest12071> ye
<R0b0t1> How do you know they're not skimming that?
<Guest12071> u donate 2$
<Guest12071> and u get vip
<Guest12071> its lame
<Harry> yeah Guest12071 is ignoring me, as I just pwnt him.
<Harry> Now piss off.
<Harry> DIAF.
<Harry> kaithx
<Guest12071> sdfu failtroll
<Harry> DIAF. ^_^
<Harry> (°∀°)
<Guest12071> anyway leaseweb was 1337 az hell
<Harry> villavu has leaseweb. doubt you can hack shit. Come on, hack my home box, all ports opened, including ssh. passwd is less than 5 characters
<Guest12071> GOOD FOR YOU
<KingdomZero> Harry, villavu doesnt have leaseweb anymore
<Guest12071> NOW SDFU
<Guest12071> TARD
<Harry> KingdomZero: they do.
<Guest12071> KingdomZero it does
<Harry> 01:58:40 < Guest12071> <caps>Good for you</caps>
<KingdomZero> Harry, who is villavu
<Harry> lol @ fail caps.
<Abbott> Can anyone help me with a Reflection script? I just need help updated hooks and such. I cant get Scapians fletcher to work
<Harry> this guy fails. just ignore him and he will pz soon
<Harry> (°∀°)
-Harry- ban him preese
<Guest12071> ye
<Guest12071> he will
* Widget has kicked Guest12071 from #SRL (Guest12071)
<Abbott> lol
<Harry> doesnt even have autorejoin
<Harry> luls
<Harry> Widget: b&
<Widget> Harry, aren't you supposed to be banned?
<Harry> No.
<Harry> (°∀°)
* Lolikon (~Loli@I.liek.teh.loli) has joined #SRL
<Lolikon> sup kids
<R0b0t1> Widget: He is
* Guest12071 (~T@3E908FBB.BC7DCF12.5D8E99A8.IP) has joined #SRL
<Guest12071> Widget
<Lolikon> who here likes lolicon?
<Guest12071> how i got admin
<Lolikon> Toot^Bed, do you like loli?
<R0b0t1> Please leave.
<Lolikon> :)
<Lolikon> :(
* Lolikon has quit ()
* Widget sets ban on *!*@3E908FBB.BC7DCF12.5D8E99A8.IP
* Widget has kicked Guest12071 from #SRL (Guest12071)