[Jоey]

User's Profile: https://hackforums.net/member.php?action...uid=303649

Hello.

As some of the HF users may of already know, reBOOT was recently hacked. The hacking was done at around 4 AM est on Novemember 30th.
Through the countless people asking who did it, I've just decided to release this thread. DaL33T was the person behind the hacking of reBOOT.

I originally purchased DaL33T's source back in September, I was looking for something custom and innovative. I sent him a message on HF and requested for the source and a database converter, I bought this for $275. In hopes of getting the source a couple hours after purchasing, I was very wrong. Not only did it take over a week for him to even send/upload the source. Take note, he did not even finish the database converter I paid for. I would have to PM day after day how there was countless errors. I just completely gave up on him and decided to hold off on it in hopes to find a fix. The only reason I was actually able to get the source up and running was because I bought the twBooter project and replaced the broken files with the ones on twBooter to get it working.

Little did I know, he planted a shell in one of the subdirectories of the source. I had NO idea that there was a backdoor on the source, and I would of never expected such a reputable member to backdoor something I paid decent money for, right?

Not only did he hack reBOOT, he also went to the extent of rm -rf'ing all my attack servers, prolonging this whole process.

Around a week ago, I went to him in regards for a reverse proxy.
Spoiler (Click to View)

Let's go ahead and check this 162.219.58.5 IP.
Spoiler (Click to View)

So the company is FastReturn, remember that name.

Anyways the day of the hacking, I get on HF with around 50 private messages and to see the global message set to "you've been hax0red" on my website:
Spoiler (Click to View)

Clueless about the whole situation, I get a message from him on Skype:
Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)

Looking at the SQL file, I find this a bit phishy, take a look at the timestamps:
Spoiler (Click to View)

Little did I know, CJ wasn't even the hacker nor would he do such a thing. He was actually a pretty cool guy that I've been talking to him over Skype daily now.

After hours of testing incoming traffic, history logs and whatnot. There was no sign of anything suspcious. So I started to look for shells on the source, I immediatley find this suspcious file on the source. Take a look at the date modified:
Spoiler (Click to View)

Taking a look at this file, it is encoded and whenever I went to it on my web browser, it would prompt me asking for a username and password.
Spoiler (Click to View)

If you are interested in the encoded file, check:
http://pastebin.com/55r93aeb

Anyways, a good friend of mine who was helping me to locate anything suspcious decodes the file into:
http://pastebin.com/raw.php?i=WEXpqNA7

A fucking shell made in 2005, awesome.

Anyways after I located the shell, I started to look through the access logs under the filename 288.php. Found a number of matches at the time 11/30 at 4AM est.
I discover:
Spoiler (Click to View)

Those are OBVIOUSLY parameters used for a simple shell.
I take a look at the IP address navigating on the shell and I find this in the reverse dns:
Spoiler (Click to View)


FastReturn, DaL33T's company. How lovely, I pay him $275 for a broken source, a converter that was about 10% completed and I was a customer of his reverse proxy. To get my stresser hacked? Wow, he must be great to his customers!

Anyways this is to answer all the PM's I have got about who hacked reBOOT and why it was down. Thanks for reading.

[m0n0p0ly]

I am not sure why he would do such a thing considering his status and the amount of wealth surrounding him.
A bit odd if you ask me.

[DООM!]

If DaL33t thinks he can take advantage of someone, he won't hesitate to do so.
Unfortunate this happened.

[m0n0p0ly]

If DaL33t thinks he can take advantage of someone, he won't hesitate to do so.
Unfortunate this happened.

Ain't that the truth.
Sorry for your loss, Joey.

[Stapleton]

It's quite unfortunate to have this happen. Thanks for the heads up.

[Decentral]

As funny as this is, you paid $275 for the source and (almost) a database converter. He basically sold you the source jsut so he could take advantage of you, that's messed up.

[Bat™]

OH. You have some decent proof. Next time keep regular backups of your db's in another servers incase they get deleted.

[FaggotFlounder]

Vouch for this report. Dal33t fucked me over multiple times before.
Looks like exactly the thing he would do.

[iLikePonys]

Joey, great discover, sadly that this happened to you tho.

I must say that it's really low from his side to do this. Can't win? Stay out, simple as that.

As for you Joey, next time, think about who you're buying your source from. Not really a smart move.

Good luck, bud.

[OwnerORAdminPlease]

None of this would happen if people learn to code their own sources.

true, joey is the biggest skid I know tbh.

[FaggotFlounder]

true, joey is the biggest skid I know tbh.

But he is a great salesman and marketeer.

[Bat™]

true, joey is the biggest skid I know tbh.

Obvious multi-accounting is obvious. Who are you ? Another Orgy ? 🤣

[OwnerORAdminPlease]

Obvious multi-accounting is obvious. Who are you ? Another Orgy ? 🤣

no lool you can report me if you want but im not multiaccounting. Joey scammed me for his API a while back.

[Legеnd]

If DaL33t thinks he can take advantage of someone, he won't hesitate to do so.
Unfortunate this happened.

This is just human nature
I find it all rather funny 🤣

[personalproblems]

I doubt dal33t would do this, no reason to, let's wait for his response though