================================================================================ PASTE SITE DUMP — acmecorp.com Associated Leaks SYNTHETIC DATA FOR CTF CHALLENGE — All data is entirely fictional. No real credentials or persons are represented. ================================================================================ --- PASTE #1 --- Source: PasteBin-Example (simulated) Paste ID: xK7mR2pQ Title: "acme db creds - DO NOT SHARE" Posted: 2025-06-14T03:22:00Z Author: anonymous Status: Removed (cached copy) Content: # Staging DB access — for new devs # DO NOT commit this to git HOST=staging-db.internal.acmecorp.com PORT=5432 DATABASE=acme_staging USER=app_readonly PASSWORD=REDACTED_HASH_abc123 # Production read replica (ask David C. for write access) HOST=prod-replica.internal.acmecorp.com PORT=5432 DATABASE=acme_production USER=analytics_ro PASSWORD=REDACTED_HASH_def456 --- --- PASTE #2 --- Source: GhostBin-Example (simulated) Paste ID: nT4vB8wL Title: "acmecorp email list" Posted: 2025-08-22T17:45:00Z Author: anonymous Status: Active Content: # Harvested from various public sources # Acme Corporation employee emails g.harmon@acmecorp.com Gregory Harmon CEO r.okonkwo@acmecorp.com Rachel Okonkwo VP Engineering d.chen@acmecorp.com David Chen Sr DevOps Engineer s.liu@acmecorp.com Samantha Liu Security Engineer j.kowalski@acmecorp.com James Kowalski Full Stack Dev m.santos@acmecorp.com Maria Santos Sr Data Engineer t.nakamura@acmecorp.com Taro Nakamura Product Manager l.foster@acmecorp.com Lisa Foster HR Director b.rodriguez@acmecorp.com Ben Rodriguez Sales VP k.patel@acmecorp.com Kavya Patel QA Lead a.thompson@acmecorp.com Alex Thompson Frontend Dev n.williams@acmecorp.com Nina Williams Backend Dev p.garcia@acmecorp.com Pablo Garcia SRE e.kim@acmecorp.com Eugene Kim Data Analyst c.dubois@acmecorp.com Claire Dubois Marketing Mgr --- --- PASTE #3 --- Source: PasteBin-Example (simulated) Paste ID: qW3eR9yU Title: "credential dump - various sites - 2025" Posted: 2025-09-10T08:30:00Z Author: anonymous Status: Removed (cached copy) Content: # Partial credential dump — mixed sources # Format: email:hash_or_password d.chen@acmecorp.com:REDACTED_HASH_7f8a9b2c3d4e5f j.kowalski@acmecorp.com:REDACTED_HASH_1a2b3c4d5e6f7 t.nakamura@acmecorp.com:REDACTED_HASH_9g8h7i6j5k4l3 r.okonkwo@acmecorp.com:REDACTED_HASH_2m3n4o5p6q7r8 p.garcia@acmecorp.com:REDACTED_HASH_4s5t6u7v8w9x0 # Note: these appear to be bcrypt hashes from a third-party # service breach (not directly from acmecorp.com systems) --- --- PASTE #4 --- Source: PasteBin-Example (simulated) Paste ID: hJ6kL1mN Title: "acme internal urls" Posted: 2025-07-03T12:15:00Z Author: guest_user_8827 Status: Active Content: URLs found in a public GitHub commit that was quickly deleted: https://jenkins.acmecorp.com/job/deploy-production/ https://grafana.acmecorp.com/d/aws-eks-cluster/ https://sentry.acmecorp.com/organizations/acme/issues/ https://argocd.acmecorp.com/applications https://k8s-dashboard.acmecorp.com/#!/overview https://vault.acmecorp.com/ui/vault/secrets https://internal-api.acmecorp.com/v2/health https://admin.acmecorp.com/login Also found in the same commit: SENTRY_DSN=https://abc123fake@sentry.acmecorp.com/42 GRAFANA_API_KEY=REDACTED_KEY_glsa_faketoken_00000000 SLACK_WEBHOOK=https://hooks.slack-example.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX --- --- PASTE #5 --- Source: GitHub Gist (simulated) Gist ID: a1b2c3d4e5f6g7h8i9j0 Title: "vpn-setup-notes.txt" Posted: 2025-05-20T09:00:00Z Author: dchen-ops (matches David Chen's GitHub username) Status: Public (likely unintentional) Content: # VPN Setup Notes for New Employees # Last updated: May 2025 1. Request VPN access from IT (ticket to l.foster@acmecorp.com) 2. Download OpenVPN client 3. Config server: vpn.acmecorp.com:1194/udp 4. Auth: LDAP credentials (same as your email login) 5. MFA: Duo Security push notification Internal DNS after VPN connection: - bastion.internal.acmecorp.com (SSH jump host) - staging-db.internal.acmecorp.com (staging PostgreSQL) - prod-replica.internal.acmecorp.com (read-only prod DB) - kibana.internal.acmecorp.com (log analysis) - nexus.internal.acmecorp.com (artifact repository) - sonarqube.internal.acmecorp.com (code quality) Default subnet: 10.0.0.0/16 DNS server: 10.0.1.10 ================================================================================ SUMMARY OF FINDINGS: - 15 employee email addresses confirmed (Paste #2) - Email naming convention: first_initial.lastname@acmecorp.com - 5 credential hashes found from third-party breach (Paste #3) - Internal infrastructure URLs leaked via GitHub commit (Paste #4) - VPN configuration and internal DNS hostnames exposed (Paste #5) - Staging database credentials exposed (Paste #1) — likely rotated - API keys/tokens for Sentry, Grafana, Slack found (Paste #4) ================================================================================ END OF PASTE DUMP ================================================================================