UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY

IN THE MATTER OF THE SEARCH OF

5201 RIVERSIDE STATION BLVD., SEACAUCUS, NEW JERSEY, 07094,

WHICH IS MORE PARTICULARLY DESCIRBED IN ATTACHMENT A

Case No. 12-4085 (MAH)

SEARCH WARRANT

To:

Special Agent Gabriel Andrews and any Authorized Officer of the United States

Affidavit having been made before me by Special Agent Gabriel Andrews who has reason to believe that on the premises known as

SEE ATTACHMENT A

in the District of New Jersey there is now concealed a certain person or property, namely
SEE ATTACHMENT B

I am satisfied that the affidavit and any recorded testimony establish probable cause to believe that the person or property so described is now concealed on the person or premises abovedescribed and establish grounds for the issuance of this warrant which is
SEE ATTACHMENT C

The facts to support the issuance of a Search Warrant are as follows:

SEE ATTACHMENT D

YOU ARE HEREBY COMMANDED to search on or before #t&6"

/Z_ >o/

(not to exceed 14 days) the person or place named above for the person or property specified, serving this warrant and making the search in the daytime, 6:00 a.m. to 10:00 p.m., and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the
person or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to the Honorable Michael A. Hammer, U.S. Magistrate Judge as required by law.
October 3. 2012. at
Date and Time issued

3:f^

Essex County. New Jersey

County and State

vJUi**~

Honorable Michael A. Hammer

United States Magistrate Judge

Name and Title of Judicial Officer

Signature of Judicial Officer

ATTACHMENT C

Evidence of violations of federal law, including Title 18, United States Code, Sections

371 (conspiracy), 1030(a)(5) (transmitting malicious code), and 1030(a)(6) (trafficking in

passwords).

no

internetfeds (
Ah

CD

<X Search Messages

Mark Clear Search

Style

Emoticons

Encoding

Welcome. We are the Internet feds. Everything that Is shared here Is private and must remain In this channel unless stated otherwise.
I looks around
i2:SSom
i2 JSoni

OperationPayback

Wow, things got quiet fast.

12 S7pm
i2.S73m

oh i jst seen the others in tfoperationpavback talking about the LHC and CERN someone showed me thels the other day I couldn't stop laughing
http://hcc.web.cern.ch/hcc/control/vacuum.php?sector=/../,./,./control/vocuum.oho^OO
LFI on CERN xD
LOLs.

12:S7pm ~
2:S6sni
j2:SBpm :2.;Ssm

Their website has no pictures :/

i pokes Kayla
:3? Ohai

i03pti

iOJo-n I
i 03p-ii
1 OJpn

.0

I dunno I'm bored and nobody's talking in here.

Wait, that LFI doesn't make sense :S It goes 3 directories up... Oh, nevermind

! 04pn i O'.p-n iOSpil 1 G6p.ii lOGpii

CO

The script is at D:\WWWRoot\HCC\control\vacuum.php

So what does that do
Ohshi-

/ Kayla?

1 07pm 2 IfJpii 3 lOpii MOpii 1 lOp-n llOpn

i lOpn
; i .oil

you can basically use it to read any file from the server
How?

hears loud explosion from Switzerland

if there's mysql/mssql config file you can get passwords from them and dump their database
it's Just finding them

It's a Local File Inclusion vuln, AES

<*-