Login or Register  • Home • Downloads • Your Account • Forums •

Forum FAQ  •  Search  •  Memberlist  •  Usergroups  •  Profile  •  Log in to check your private messages  •  Log in Nuke Video 2.4 has a new patch View next topic View previous topic   Web RavenPHPScripts (This Site)      Ravens PHP Scripts And Web Hosting Forum Index » Hack Attempt Script Author Message killerskippy New Member Joined: Jun 12, 2007 Posts: 2 Posted: Tue Jun 26, 2007 6:07 pm My site and one of our servers got taken over via a code issue allowing php files to be uploaded via thumbnail upload with a submitted video. This was fixed the same day by the admin at Nuke Video once i reported and gave logs, but i figured i would post here so if anyone is using the script they know to grab the patch. They uploaded a couple of files one main one that gave them access to the Server and all root / users passwords for the server along with database access etc. 36_rachid.php .r57shell.php The server is now back in our control and has been formated and reloaded complete and all new security added to the phpnuke website. What i dont understand is why Sentinal didnt block them i had set all IP address from Russian and morrocian to be blocked and the ip address found in the httpd_access_log file in the server are from within the ranges i blocked. I added this to my httaccess file also RedirectMatch r57shell.php Only registered users can see links on this board! Get registered or login to the forums! RedirectMatch rachid.php Only registered users can see links on this board! Get registered or login to the forums! Can anyone tell me how to block a whole country? Im really over being hacked and the attempts so i wish to just block all IP's from RU I recieve many emails ever day saying blocked someone from an ip in RU and they all seem to include this: Date & Time: 2007-06-26 20:26:26 EST GMT +1000 Blocked IP: 216.117.141.102 User ID: Visitor (1) Reason: Abuse-Filter -------------------- User Agent: libwww-perl/5.65 Query String: Only registered users can see links on this board! Get registered or login to the forums! Get String: Only registered users can see links on this board! Get registered or login to the forums! Post String: Only registered users can see links on this board! Get registered or login to the forums! Forwarded For: none Client IP: none Remote Address: 216.117.141.102 Remote Port: 55123 Request Method: GET Or Date & Time: 2007-06-27 04:54:44 EST GMT +1000 Blocked IP: 85.98.179.220 User ID: Anonymous (1) Reason: Abuse-Filter -------------------- User Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0) Query String: Only registered users can see links on this board! Get registered or login to the forums! Get String: Only registered users can see links on this board! Get registered or login to the forums! Post String: Only registered users can see links on this board! Get registered or login to the forums! Forwarded For: none Client IP: none Remote Address: 85.98.179.220 Remote Port: 4873 Request Method: GET Cheers KillerSkippy evaders99 Moderator Joined: Apr 30, 2004 Posts: 2852 Posted: Tue Jun 26, 2007 8:43 pm Did Sentinel write any of the Russian IP ranges to the banned list in .htaccess ? You can block all the libwww-perl attacks using .htaccess - its referenced in a previous thread before. I've seen usage of Mozilla/4.0 before, but I am unaware whether this is truly an automated bot or just a bad hacker. killerskippy New Member Joined: Jun 12, 2007 Posts: 2 Posted: Tue Jun 26, 2007 8:53 pm evaders99 wrote: Did Sentinel write any of the Russian IP ranges to the banned list in .htaccess ? You can block all the libwww-perl attacks using .htaccess - its referenced in a previous thread before. I've seen usage of Mozilla/4.0 before, but I am unaware whether this is truly an automated bot or just a bad hacker. Yes the IP address's are added auto to the htaccess file but the range is already set to block in the block range section of sentinal, so they shouldnt be getting to the site in the first place unless im not understanding how it works. I am searching for the libwww-perl attacks now i hope that helps Display posts from previous:   All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 Year  Oldest FirstNewest First        Ravens PHP Scripts And Web Hosting Forum Index » Hack Attempt Script  Jump to:  Select a forum Read Me First!!!----------------Board Rules and Regulations Web Hosting Services----------------RWH GeneralRWH Pre Sale QuestionsRWH Client Center Application OnlyRWH OtherFAQ - PHP5 w/phpSuExec Conversion From PHP4PHP5 Conversion Issues From PHP4 RavenNuke(tm) Programming Standards/Approaches/Philosophy----------------Converting/Creating BlocksConverting/Creating ModulesConverting/Creating ThemesConverting/Creating OtherConverting/Creating General Discussion RavenNuke(tm) v2.3x----------------v2.3 RN Announcementsv2.3 RN Quick Fixesv2.3 RN Issuesv2.3 RN Documentationv2.3 RN Feedback/Suggestions Recommended Reading----------------Reading - AnnouncementsReading - Digital BooksReading - Hard/Soft cover BooksReading - Digital MagazinesReading - Printed Magazines RavenNuke(tm) Addons----------------FCKeditor/WYSIWYG IssuesnukeFeed/FeedCreatorForum Attachment ModnukeSEOShortLinks/TegoNukeNukePie/SimplePie RavenNuke(tm) v2.2x----------------RN v2.20.00 - AnnouncementsRN v2.20.00 - All IssuesRN v2.20.00 - Feedback RavenNuke(tm) v2.10.01----------------RN v2.10.01 - All IssuesRN v2.10.01 - Feedback RavenNuke(tm) v2.10.00----------------RN AnnouncementsRN FAQRN Bug FixesRN Not BugsRN Documentation Issues/SuggestionsRN Enhancement Requests and SuggestionsRN NSN Groups IssuesRN Themes IssuesRN NukeSentinel(tm) issuesRN Installer/Setup IssuesRN Bug Reports - Other IssuesRN Conversion Issues From v2.02RN Conversion Issues From Standard phpNukeRN The Good, The Bad, The Ugly Site Specific Stuff----------------READ ME FIRSTAnnouncementsRaven's v7.0 Customized DistroHack Attempt ScriptRaven's Customized Distribution PacksBUGS/FIXES - Raven's v7.3 Customized DistroCache Lite Admin ModuleNuke Tool Box (TM)Captcha SecurityRaven's RavenNuke(tm) v1.x DistroRaven's RavenNuke(tm) v2.00.00 - v2.02.00 DistroWYSIWYG - Raven's RavenNuke(tm) v2.x DistroUpgrade Pack For RavenNuke(tm) v1.05.00 to v2.02.00Raven's Collapsing Forums BlockGT - Raven's RavenNuke(tm) v2.x DistroRaven's RavenNuke(tm) v2.02.02 DistroPost Fixes - Raven's RavenNuke(tm) v2.02.02 DistroRaven's RavenNuke(tm) v2.10.00Public Testing of RavenNuke(tm) v2.10.00HtAccesser Security----------------Security - PHP NukeSecurity - OtherNukeSentinel(tm) v2.6.xNukeSentinel(tm) v2.5.xNukeSentinel(tm) v2.4.xNukeSentinel(tm)NukeSentinel(tm) Bug ReportsNukeSentinel(tm) Enhancement RequestsNukeSentinel(tm) AnnouncementsEasy IP Ban Reference [eC-IPBR]PHP-Nuke Patched Series By Chatserv Information About Forums----------------Old Forum EntriesPHPBBBB2NukePunBB PHP-Portal Project (Not General phpnuke!)----------------AnnouncementsGeneral - PHP Portal ProjectDevelopersDesign Discussions Scripts - General----------------Post Release FixesBug FixesGeneral/Other StuffHow To'sInstallation HelpPost Installation HelpGT - Next Gen and StandardSeeking applications ...ThemesBlocksModulesMaking Nuke Efficientphpnuke 8.1phpnuke 8.0phpnuke 7.9phpnuke 7.8phpnuke 7.7phpnuke 7.6phpnuke 7.6 Bugs/Fixesphpnuke 7.5phpnuke 7.4phpnuke 7.3phpnuke 7.2phpnuke 7.1phpnuke 7.0phpnuke 6.9phpnuke 6.8Bug Fixes for phpnuke 6.5phpnuke 6.5Gallery/Gallery2CNB Your AccountM2FBrowser Specific IssuesUpgrading NukeNuke Treasury Other CMS/Portal Applications----------------Post NukeNuke PlatinumNuke Evolution PHPBB----------------Stand Alonew/Nuke 6.5w/Nuke 6.9BBtoNuke ModsBBtoNuke General Programming - Server Help----------------PHPMySQLFor HireApacheHTMLCSSJavaScriptServer Help Guestbook Application (KISGB)----------------KISGB General Support Stock Quote Application (KISSQ)----------------KISSQ General Support NSN Scripts----------------NSN NewsNSN GroupsNSN OtherNSN Gr Downloads - a.k.a NukeDepository 6.5 Hacks----------------Old Articles Hack Nuke News Module Hack To Allow Ordering of Articles----------------News Module Hack - AnnouncementsNews Module Hack - BugsNews Module Hack - Enhancement RequestsNews Module Hack - Discussion Other Stuff----------------Other - DiscussionOther - Sites To VisitOther - Chit ChatOther - PoliticsOther - Movie ReviewsOther - The Wastelands of NukeworldOther - Book ReviewsOther - Humor Religion----------------Religion - GeneralPrayer/Praise Requests Potpourri----------------Rants & Raves Guest Editorials----------------My Turn - James R. Sanders  View next topic View previous topic You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum Forums ©

All logos and trademarks in this site are property of their respective owner.
The comments are property of their posters, all the rest © 2002-2008 by Raven
Proud to be listed at Lobo Links Web Directory

You can syndicate our news using the file



Website engines core code is © copyright by PHP-Nuke but has been heavily patched and modified by myself and others.
PHP-Nuke is a free software released under the GNU/GPL.


:: fisubice phpbb2 style by Daz :: PHP-Nuke theme by www.nukemods.com ::
:: fisubice Theme Recoded To 100% W3C CSS & HTML 4.01 Transitional Compliance by Raven and 64bitguy ::
:: :: ::

zerosum