Hacked by d3ngsz & Dengesiz Team

Client Joined: Oct 07, 2003 Posts: 735 Location: Ohio

Script kiddies are out again. They got my site eto-league.com.
[ Only registered users can see links on this board! Get registered or login! ]

Changes the message and the site name in preferences.

I am running NukeSentinal 2.4.2pl8

I am not running latest 3.2

This is getting insane.

Sells PC To Pay For Divorce Joined: Posts: 5661

any tracks of what they did?

Posted: Tue Jun 13, 2006 3:11 pm

Where would be the best place to look for tracks?

Posted: Tue Jun 13, 2006 3:13 pm

depends if they were actualy on your site..
you could start in cpanel....stats last visitors..
any uploading facilities on that site?

Posted: Tue Jun 13, 2006 3:16 pm

I want to ban all these turkish bums who get off on hacking.

85.97.133.164
85.104.237.212
85.103.58.85

How do I add a range?

d*** I need to RTFM..... Smile

Posted: Tue Jun 13, 2006 3:37 pm

If they spoofed their IP which is likely, your banning blindly.
Check your sever logs, Sentinels tracked IP's, Tracked Users etc.

Posted: Tue Jun 13, 2006 9:52 pm

If its one of the recent modules/Forums/admin/* type hack, it may have still bypassed NS... not sure if all the injections have been covered? (Are we ever sure? Sad

) Unfortunately, you may only spot via the server logs...

Had you, by chance, implemented either HTTPAuth or CGIAuth protection on this directory per Raven't post here:
[ Only registered users can see links on this board! Get registered or login! ]

You can PM me the answer if you would rather. The attacks are continueing, so the more info we can pass along to Bob and team the better. Thanks.

Posted: Thu Jun 29, 2006 5:07 pm

They hacked another site and the admin found different files e.g. for an IRC botnet(http://www.egghelp.org/whatis.htm) in modules/4nAlbum and /temp. It seems they search for this module and the forums too. The "Turk Fascist" Hacker group can be found here:

Team Leader: d3ngsz
Msn: [ Only registered users can see links on this board! Get registered or login! ]
Site URL: [ Only registered users can see links on this board! Get registered or login! ]
[ Only registered users can see links on this board! Get registered or login! ]

Btw: I would not visit that site.

Posted: Fri Jun 30, 2006 2:30 am

They (hackers) even answer on victim post in german CMS forums. Mad

I have been hacked by them. I was using 7.7 PL 3.2 no Sentinel.

Now I use Ravens Dist, Sentinel 2.4.2pl9.
Since then they have visited my site from different locations, i.e. Turkey, Portugal, ... .

Up to now everything seems OK.

Thanks to effort of you guys Exclamation

Posted: Fri Jun 30, 2006 2:55 am

I know that he replied. They can cause a very large damage. If you don´t have turkish users ban Turkey with cidr via htaccess completely.
[ Only registered users can see links on this board! Get registered or login! ]