HACKED - TWO OF MY SITES WERE TODAY

Client Joined: Dec 04, 2004 Posts: 757

Hello all, two of my sites were hacked today and left this message

Defaced By D.O.M
domteam.info

HEy Just Remember Jesus Love You!

I have everything up to date as far as I know and havnt been hacked in over a year now

any idea`s

Cheers
mrix

Sells PC To Pay For Divorce Joined: Posts: 5661

yeah well known..has a lot of victims...
no sentinel?

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

NukeSentinel(tm) installed and configured?

Any photo galleries which all have known exploits?

Forums up to date (v2.0.19) with all patches?

Nuke up to date with all patches?

Hangin' Around Joined: May 09, 2004 Posts: 32

Hi mine got done as well, I am upto date on my Forums & Sentinel Gallery i am using is coppermine the newest one. Is there anyway to sort this out ?

Thanks

Panda

Posted: Tue Apr 04, 2006 12:54 pm

Review your access logs to see how they got in. I would suspect Coppermine right off the bat.

Posted: Tue Apr 04, 2006 1:12 pm

Access logs are huge !! what should i be looking for ? !! nothing is standing out !!

Posted: Tue Apr 04, 2006 1:51 pm

Does this look line anything dodgy ?!!

EDIT !!

Worker Joined: May 18, 2005 Posts: 119 Location: SVCDPlaza

Thats a nice script but je better strip the link out .
And yes there is your bug in your site

Posted: Tue Apr 04, 2006 3:08 pm

I know there is a bug in my site !!

Posted: Tue Apr 04, 2006 3:24 pm

Both my sites have the latest sentinal and updates patches and the latest forum patches I did find that I was using the vwar clan install on one of my sites and that has just had issues I have updated that and hope that fixed it???? Raven is it possible you could look at my logs as I am lost with them Confused

Thanks
mrix
Michael Rixon
www.sea-fishing.org
the site that has vwar running is this one www.battlefield-2.biz

Posted: Tue Apr 04, 2006 3:29 pm

panda wrote:

I know there is a bug in my site !!

Vwar is the bug panda its not secure .

Posted: Tue Apr 04, 2006 3:36 pm

I have gone to the vwar site and have updated it with the new functions_install.php they suggest would you say this is secure?
thanks
mrix

Posted: Tue Apr 04, 2006 3:40 pm

Mrix, how did you sort your site out ?

Thanks

Andy

Posted: Tue Apr 04, 2006 3:45 pm

Check http://secunia.com for 2 days of huge announced exploits with vwar. If you use sQuery, search your logs for sQuery. That's how many sites are being cracked right now. The kiddies are doing searches on Google for things like squery+4.5 to locate vulnerable sites.

Posted: Tue Apr 04, 2006 3:47 pm

This site http://www.battlefield-2.biz/ is not secure mrix

Posted: Tue Apr 04, 2006 3:57 pm

I have loads of lines like this one

edit

from ip address 84.51.41.166 are these lot from Turkey ?

Also how do i correct it ?

Many Thanks

Andy

Posted: Tue Apr 04, 2006 4:00 pm

a solution i dont now panda but please edit the link and read http://secunia.com/

Posted: Tue Apr 04, 2006 4:14 pm

Ban Turkey completely from your site. See

http://www.ravenphpscripts.com/postx8733-0-0.html
http://www.ravenphpscripts.com/postxf8531-0-0.html

registered · Posted: Tue Apr 04, 2006 4:25 pm

panda wrote:

Access logs are huge !! what should i be looking for ? !! nothing is standing out !!

Probably a sql injection... Do a search for 'nuke_config' too. Wink

Posted: Tue Apr 04, 2006 4:26 pm

Cheers i'll being doing that one. Just need to try and correct my Site now !!

Posted: Tue Apr 04, 2006 4:28 pm

as i was trying to help panda and the used code couldnt be used in public i send you a pm,would help if you read it and replied.

Posted: Tue Apr 04, 2006 4:35 pm

Quote:

Mrix, how did you sort your site out ?

Thanks

Andy

I just uploaded a backup through cpanel and updated the vware

thanks
mrix

registered · Posted: Tue Apr 04, 2006 4:37 pm

Good to report whoever's hosting the hacker's website too
http://www.whois.sc/domteam.info

Posted: Tue Apr 04, 2006 4:38 pm

Bugger last backup i did was Jan 06 Crap !! I presume ya mean DB Backup !!

Walker you have PM

Cheers

Andy

Posted: Tue Apr 04, 2006 4:42 pm

I have just noticed at the bottom of my htaccess file these added????

deny from 86.16.61.105
deny from 202.149.36.158
deny from 80.74.199.146
deny from 87.82.20.199

anyone have any idea who they are???

cheers
mrix