Howdy Ya'll

07-24-06, 06:37 PM

Hiya
I'm Dragon from the Heartland o the U.S.

I've been a avid reader of subsim for a long wihle but never been thinkin o joining because I felt I had nothing to say or contribute. Well today I think differantly.

I was reinstalling my ol SH2 and went a huntin for Seeadler's weather mod. I havn'a found much luck with it but I came across something rather upsetting.

http://mpgtext.net/u-boot/component/...limitstart,52/

Seems someone has gone gotten the gaul to hack Uboot!

I'm a security system's analyst so I decided to take a snapshot of the culprits work and figured I'd post up their calling card so's it can help you trak'em down.

Here's that info.

Code:

<!--==========================================================\
|             |
| ########  ##        ########  ##    ## ########             | 
| ##     ## ##    ##  ##     ## ##   ##       ##         |
| ##     ## ##    ##  ##     ## ##  ##       ##          |
| ##     ## ##    ##  ########  #####       ##           |
| ##     ## ######### ##   ##   ##  ##     ##             |
| ##     ##       ##  ##    ##  ##   ##   ##              |
| ########        ##  ##     ## ##    ## ########        |
|             |
|                          &                 |
|             |
| ##     ## ##        ##    ## ##    ##  #######  ########    |
| ###   ### ##    ##  ###   ## ###   ## ##     ## ##     ##   |
| #### #### ##    ##  ####  ## ####  ##        ## ##     ##   |
| ## ### ## ##    ##  ## ## ## ## ## ##  #######  ########    |
| ##     ## ######### ##  #### ##  ####        ## ##   ##     |
| ##     ##       ##  ##   ### ##   ### ##     ## ##    ##    |
| ##     ##       ##  ##    ## ##    ##  #######  ##     ##   |
|              |
|                                                             |
|  ########  ########   #######   ######                 |
|  ##     ## ##     ## ##     ## ##    ##                |
|  ##     ## ##     ## ##     ## ##                      |
|  ########  ########  ##     ##  ######                 |
|   ##     ## ##   ##   ##     ##       ##                |
|  ##     ## ##    ##  ##     ## ##    ##                |
|  ########  ##     ##  #######   ######                 |
|              |
|                                                             |
|              |
|             |
|=============================================================|
|=============================================================|
|=============================================================|
|             |
|      >< MSN/Mail  : d4rkz@d4rkz.com & ribonuklekasit@gmail.com    |
|      >< ICQ  : 333000755            ><        |
|             |
|=============================================================|
|=============================================================|
|=============================================================|
|             |
|       ©2006                |
\==========================================================--> 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
<html>
<head>
<title>Hacked by d4rkz & m4nn3r bros..</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
</head>
<body bgcolor="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<!-- ImageReady Slices (19.jpg) -->
<script language="JavaScript1.2">
if (window.Event) // Only Netscape will have the CAPITAL E.
  document.captureEvents(Event.MOUSEUP); // catch the mouse up event
function nocontextmenu()  // this function only applies to IE4, ignored otherwise.
{
 event.cancelBubble = true
 event.returnValue = false;
 return false;
}
function norightclick(e) // This function is used by all others
{
 if (window.Event) // again, IE or NAV?
 {
  if (e.which == 2 || e.which == 3)
   return false;
 }
 else
  if (event.button == 2 || event.button == 3)
  {
   event.cancelBubble = true
   event.returnValue = false;
   return false;
  }
 
}
document.oncontextmenu = nocontextmenu;  // for IE5+
document.onmousedown = norightclick;  // for all others
</script>
<center>
<img border="0" src="http://denemelol.sitemynet.com/son.gif" width="576" height="432"></p>
<p>Hacked by d4rkz & m4nn3r bros..</p><br>
<p>Her$eyin bir sonu vardir..</p>
</center>
</body>
</html><br />
<b>Warning</b>:  main(/includes/version.php): failed to open stream: No such file or directory in <b>/home/mpgtext/public_html/u-boot/includes/mambo.php</b> on line <b>37</b><br />
<br />
<b>Fatal error</b>:  main(): Failed opening required '/includes/version.php' (include_path='.:/usr/lib/php:/usr/local/lib/php') in <b>/home/mpgtext/public_html/u-boot/includes/mambo.php</b> on line <b>37</b><br />

they went and added a NO|Click script to try and hide their code and info from the public eyes so other hackers could take note but that's easily bypassed by using (View/Source) in your Internet Explorer toolbar.

They even left their ICQ numbers so good hunting, lemme know if you need help with anything and I'd appreciate it muchly if one of y'all could send a link to Seeadler's weather FX mod for SH2.

Dragon

SUBMAN1 · 07-24-06, 07:49 PM

That D4rkz guy is pretty funny. Leaves his imprint across the net. Probably just a script kiddie trying to hack as many unpatched sites as possible. Makes me think I should go check my web server at work to make sure it is all up to date tomorrow!

-S

07-24-06, 07:49 PM	#2
SUBMAN1 Rear Admiral Join Date: Apr 2005 Posts: 11,866 Downloads: 0 Uploads: 0	That D4rkz guy is pretty funny. Leaves his imprint across the net. Probably just a script kiddie trying to hack as many unpatched sites as possible. Makes me think I should go check my web server at work to make sure it is all up to date tomorrow! -S __________________

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode