💰Hacking the Scammers

How someone I don't know hacked the scammers back

DISCLAIMER: This is not my work. I would never and don't condone illegal hacking of scammers

I have since decided to take credit for this work after a lot of consideration, it was obvious anyways.

A short while ago I got a text from a random number saying the following:

Scam Text

I knew right away this was a scam but also knew that others fall for this all the time, my own wife had fallen for it a few months back. I posted about it in a channel online and someone, lets call them s1n, was ready to get revenge on these lowlifes who wanted to just scam random people out of their hard-earned cash.

S1n started out by doing some initial recon. First was a nmap scan (yielding them more domains they use and their region):

FTP SSL cert showing Region

HTTP SSL-Cert showing other DNS names that can be used

Along with this they started browsing the site while intercepting traffic with Burp Suite. The site looked to be a clone of the actual USPS site (Wayback Machine URL):

Scammer Site

There were a few interesting requests being made, but all to a different url. Hm... Gotta make sure this is still the scammers:

nslook confirming same IP

Great, they are! The first of these interesting requests was web socket communications where the client would send a filename and the contents were returned.

WSS

Interesting... This looks like an easy LFI. And it is!

WSS LFI

The LFI gave S1n more info about the environment so that they could look around more effectively than fuzzing.

/proc/self/cmdline

Upon using this new directory found, S1n was able to grab all the PHP files they had seen while browsing the scam site. These files are highly obfuscated and almost impossible to read. There are also many Chinese characters making it even worse for English speakers, they are linked below. Though they do seem safe, use at own risk.

143KB

reconstruction.zip

archive

Open

Files taken from scam webserver

Looking through these files they could observe that they were using a telegram channel to communicate back to them and were storing data in a MySQL server. S1n could not find any sensitive data with the LFI that would allow them to get further access into the web server. Most things were setup an run with supervisord and, though it had SSH, it had not been used it seemed.

Telegram token variable being used

While looking around S1n also found the nginx access log and it revealed one of the IPs of the people setting it up, if they didn't use a VPN.

nginx access.log

IPlocation info on the IP

Based on the certificate information and this IP, and we are just getting started, I think we can agree that this is likely Chinese scammers.

Now after browsing around S1n looked at some of the files he had grabbed and looked back at some of the requests he intercepted and found something that looked like and SQL injection.

Single quote in a POST param causing error

Firing up SQLMap they tried it and it worked! They were into the scammers database!

Scammers database

Now that we are inside the database lets take a peek around. First lets DOXX the scammers running this site:

Database: facaisss_top
Table: admin
[9 entries]
+------+----------------------------------+---------+-------------------------------+--------+---------+-----------------+----------------------------------+--------------------------+---------------------+------------+
| id   | token                            | desc    | name                          | type   | avatar  | login_ip        | password
         | username                 | login_time          | permission |
+------+----------------------------------+---------+-------------------------------+--------+---------+-----------------+----------------------------------+--------------------------+---------------------+------------+
| 9527 | qHJK7M0rNUy7UYulDi05qojUSFM9pM3C | ???     | ???TG:https://t.me/wangduoyu0 | 1      | <blank> | 106.226.19.70   | 2d028f8ca2b73eb7d4546d7994c742ff | Twez7K15Vd5Gpan4C/uaqw== | 2024-01-02 22:05:25 | <blank>    |
| 9531 | jLgco5RMvFqgyxONDUVk2JmxEqFEkovq | <blank> | NULL                          | 3      | NULL    | 38.207.142.214  | d42fe63b6643993a8f97dc47985d982a | jQVmD0P+gg055h7ZJHznaQ== | 2023-12-19 12:59:36 | NULL       |
| 9532 | 2fCCgWhzw7waNNQReGf1Ycmcp42rTn5v | <blank> | NULL                          | 2      | NULL    | 178.173.225.134 | 0a283f0b0d570adc1bfb51572955d37f | K87+QTqJTMy6qVxRJXxpeQ== | 2024-01-02 22:16:54 | NULL       |
| 9533 | d5EOAVfo0HZsprmAACK7iH9pTz56zNhN | <blank> | NULL                          | 2      | NULL    | 5.161.50.112    | 782e3af2dd3da9f7ebc9f05332872dc4 | d3m9yTko9mXTJD0B5yO0zg== | 2023-12-28 07:59:08 | NULL       |
| 9537 | a3zps4dfc3cuZOV3G1RtWMWPcUdCmjGn | <blank> | NULL                          | 2      | NULL    | 89.185.30.226   | 4f8a2379bb3c474680354c63bc1ee6fc | OyaHyjxHRDOhrh39bXqR6Q== | 2024-01-03 07:32:38 | NULL       |
| 9539 | jAYkPihKE768TpoGnQ3pTsYZ4pNQ3C18 | <blank> | NULL                          | 2      | NULL    | 182.84.160.242  | 5b73c2e8c152520b55e15b14c45e3f49 | TJzkjGwJ+dFQ9tOGVtyHGw== | 2024-01-03 02:50:19 | NULL       |
| 9540 | wi3g2ZnGFV4vnUn2LiVPFmAhOfKfbKlJ | <blank> | NULL                          | 2      | NULL    | 106.226.19.70   | 9c7115ddce2c84b3ac7efd12f667f662 | nAHd7K32eSgwpYU2xRCJdA== | 2024-01-02 22:05:40 | NULL       |
| 9541 | TTTCcT3YWljq0isK5RDnN7PpfkMcN3OK | <blank> | NULL                          | 2      | NULL    | 39.144.169.135  | d0a44137ee2002fda76053c3607ec5cd | F7/lmK6VJ682vkqgERb00Q== | 2024-01-03 05:38:43 | NULL       |
| 9542 | bPBaUEoFrI3xpwMjJoE8Dp5zRMVWVgLa | <blank> | NULL                          | 2      | NULL    | 137.184.82.92   | d0f364e103cb423430a1c419a4278bf6 | 7+KbdbgLprg1HxWnDiIVQA== | 2024-01-03 11:20:37 | NULL       |
+------+----------------------------------+---------+-------------------------------+--------+---------+-----------------+----------------------------------+--------------------------+---------------------+------------+

That Telegram link as a description looks interesting ;)

Now lets take a look at the configuration:

Database: facaisss_top
Table: config
[1 entry]
+-------+---------+-----+--------------------------+---------+-------+-------+--------------------------------------------------+--------+---------+------------------------+---------+---------+---------+---------+---------+----------+----------+-----------+------------+------------+------------+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------------------+-----------------------+--------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------+-------------------+---------------------+----------------------+
| pid   | tg_uid  | otp | key                      | url     | mount | state | title                                            | is_tor | tg_msg  | order                  | bt_file | captcha | ht_type | tg_open | timeout | allow_pc | tg_token | two_title | allow_once | pay_status | store_name | succ_count | title_desc                                                                                                          | unattended | success_url           | redirect_url          | refresh_rate | refuse_cards | two_title_desc | highlight_cards                                                                                       | is_ip_detection | country_whitelist | refuse_cards_type | display_filled_card | is_refuse_cards_type |
+-------+---------+-----+--------------------------+---------+-------+-------+--------------------------------------------------+--------+---------+------------------------+---------+---------+---------+---------+---------+----------+----------+-----------+------------+------------+------------+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------------------+-----------------------+--------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------+-------------------+---------------------+----------------------+
| 10086 | <blank> | 0   | vHbippHvUZKYtXUA3NGKZA== | <blank> | £900  | VFg=  | RGVsaXZlcnkgZmFpbGVkLCBhZGRyZXNzZWUgdW5rbm93bg== | 0      | <blank> | 9300120111410471677883 | 1       | 0       | 1       | 0       | 120     | 0        | <blank>  | <blank>   | 0          | 1          | <blank>    | 3          | VVNQUyBBbGxvd3MgeW91IHRvIFJlZGVsaXZlciB5b3VyIHBhY2thZ2UgdG8geW91ciBhZGRyZXNzIGluIGNhc2Ugb2YgZGVsaXZlcnkgZmFpbHVyZSBvciBhbnkgb3RoZXIgY2FzZS4gWW91IGNhbiBhbHNvIHRyYWNrIHRoZSBwYWNrYWdlIGF0IGFueSB0aW1lLCBmcm9tIHNoaXBtZW50IHRvIGRlbGl2ZXJ5Lg== | 0          | https://www.usps.com/ | https://www.usps.com/ | 3            | 434257,43425,44578,44823,51158,371263,376668,377481,377693,379290,400022,400344,400898,400899,400908,401939,402018,402087,402258,402400,403015,403163,403446,403905,403926,403995,406095,406421,406498,406644,409758,410040,410608,410848,411238,411600,411606,411740,411773,411810,411870,411931,412061,412125,412174,412185,412421,413037,413358,413520,414080,414238,414352,414709,415417,415710,415746,415758,415888,416004,416860,416994,417021,417046,418702,419310,420495,421783,422135,422967,423421,423729,423998,424132,424840,425103,425300,425307,425418,425838,425839,426752,426937,426938,427081,427082,427178,428191,430572,431143,432613,432692,432822,433280,434219,434559,435541,435544,435546,435547,435737,435836,435880,436618,436885,437303,437307,438557,438628,438915,440262,440393,441251,441413,441420,441814,441904,442743,443040,443042,443045,443047,443051,443122,443161,443292,445326,445785,446053,447141,447436,447914,448233,448267,448563,448570,448975,450122,451002,451129,451431,451440,451461,453506,453641,453936,454481,454900,454905,454921,454951,455225,455495,455711,456367,456628,457431,458415,458453,458643,458953,459954,460291,461354,462192,463467,464714,464969,465108,466600,467321,468840,471304,472092,472776,473310,473690,473691,473910,474428,474487,475675,475708,476974,477248,478499,478662,478665,479287,479482,479841,480213,480233,480313,484718,485246,485340,486236,487038,489504,490312,491288,491689,493109,493452,494149,494340,494632,497816,498503,510250,510277,510363,510555,510581,510805,510870,510875,511092,511201,511271,511360,511475,511516,511534,511558,511563,511565,511597,511786,511824,511897,511970,512106,512107,512230,512903,512980,514181,514348,514377,514400,514420,514422,514441,514474,514759,514998,515142,515307,515368,515478,515549,515550,515592,515597,515599,515676,515934,516445,517805,518155,518221,518375,518725,518752,519280 | <blank>        | 373914,514120,514121,514122,514123,514124,514125,514126,514127,514128,514129,554405,461634,457709,426910,426911,426971,426972,412738,412004,448129,484814,484815,461993,461994,406098,459521,486266,486268,466042,466043,371710,376786,474165,446542,457083,425907,374355,414718,432739,425907,601120,371306,379134,549409,376761,485620,373918,407221,424631,406042,446542,416814,371697,373919,483312,406049,512992,442756,434769,483312,517546,444796,372655,475055,483316,542418,517546,552285,518941,517546,514978,512992,494638,486796,483313,474187,454482,448975,442939,442777,420767,414795,414718,409589,407222,406042,406032,379000,372655,371536,552448,517546,517545,512992,512991,413040,413040,377935,438854,515354,401105,513505,476186,537811,414740,417046,433747,530997,559591,549460,542543,542543,414720,475824,414720,475824,490070,376750,426684,434256,448975,440066,542539,473622,442755,475824,531260,517546,372722,546616,372298,558962,371290,371382,371383,371409,371584,372298,372550,372651,372657,372723,373191,373726,373915,373965,374830,376731,376741,376778,376784,377936,378001,379253,379295,379572,379582 | 0               | <blank>           | 0                 | 1                   | 0                    |
+-------+---------+-----+--------------------------+---------+-------+-------+--------------------------------------------------+--------+---------+------------------------+---------+---------+---------+---------+---------+----------+----------+-----------+------------+------------+------------+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------------------+-----------------------+--------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------+-------------------+---------------------+----------------------+

And finally lets see what data was taken from the poor people scammed by this site:

Database: facaisss_top
Table: userinfo
[61 columns]
+------------------+---------------------+
| Column           | Type                |
+------------------+---------------------+
| account          | varchar(255)        |
| code             | varchar(255)        |
| name             | varchar(255)        |
| status           | int(11)             |
| address1         | longtext            |
| address2         | longtext            |
| birthday         | varchar(255)        |
| card_alpha2      | longtext            |
| card_bank        | longtext            |
| card_bank_phone  | longtext            |
| card_bank_url    | longtext            |
| card_brand       | longtext            |
| card_country     | longtext            |
| card_date        | longtext            |
| card_last_four   | varchar(255)        |
| card_name        | longtext            |
| card_number      | longtext            |
| card_scheme      | longtext            |
| card_type        | longtext            |
| city             | longtext            |
| country          | longtext            |
| creat_time       | datetime            |
| cvv              | longtext            |
| email            | longtext            |
| email_password   | varchar(255)        |
| email_verify     | varchar(255)        |
| first_name       | longtext            |
| house            | varchar(255)        |
| id               | bigint(20) unsigned |
| ip               | varchar(255)        |
| is_card_numer    | int(11)             |
| is_code          | int(11)             |
| is_cvv           | int(11)             |
| is_ep            | int(11)             |
| is_highlight     | varchar(255)        |
| is_otp           | varchar(255)        |
| is_pin           | int(11)             |
| is_routing       | int(11)             |
| is_ssn           | int(11)             |
| is_two_verify    | int(11)             |
| item_name        | longtext            |
| last_name        | longtext            |
| login_type       | int(11)             |
| murmur           | varchar(255)        |
| one_key_pass     | int(11)             |
| operation_record | longtext            |
| order_id         | varchar(255)        |
| otp              | varchar(255)        |
| password         | varchar(255)        |
| phone            | longtext            |
| phone_last_four  | varchar(255)        |
| pin              | varchar(255)        |
| price            | varchar(255)        |
| return_url       | varchar(255)        |
| routing_account  | varchar(255)        |
| routing_number   | varchar(255)        |
| ssn_last_four    | varchar(255)        |
| state            | longtext            |
| update_time      | datetime            |
| user_agent       | longtext            |
| zip              | longtext            |
+------------------+---------------------+

Wow. So much data on these people. Also look at how many are in this table:

SELECT COUNT(*) FROM userinfo WHERE STATUS IS NOT NULL: '3818'

Along with this they are tracking who visits the site of course:

Database: facaisss_top
Table: records
[9 columns]
+-----------------+---------------------+
| Column          | Type                |
+-----------------+---------------------+
| create_time     | datetime            |
| id              | bigint(20) unsigned |
| ip              | varchar(255)        |
| lang            | varchar(255)        |
| murmur          | varchar(255)        |
| os_name_version | varchar(255)        |
| plat            | varchar(255)        |
| update_time     | datetime            |
| user_agent      | varchar(255)        |
+-----------------+---------------------+

S1n didn't say what they are going to do with all this incriminating evidence but I know I will be sending it over to whatever internet crime center will listen to try to get it shut down and the culprits brought to justice.

Thanks for reading!