Hacked by BeLa

Regular Joined: Jun 17, 2006 Posts: 81 Location: MD

Woke up this morning to a call from the owner of the site I have been helping get all set up. Looks like a Turkish source hacked the site.
[ Only registered users can see links on this board! Get registered or login! ]

I have been trying to identify the pages accessed by looking at the logs, but I have been unsuccessful so far. I am running Nuke 7.8 and phpbb 2.0.18

I also accessed the phpmyadmin panel, and this is what I found.

At this point I am trying to figure out how to fix this. Unfortunately, the last backup is at least a month old. It appears to be just an overlay over all of the pages on the site. Any suggestions where to start looking, as far as what files such a hack would be made to?

Site Admin Joined: Jun 04, 2004 Posts: 6432

You'll probably want to reinstall phpMyAdmin (or have your host do it).

Check the logs to see how it was authorized. If you're not using NukeSentinel and admin authentication on both admin.php and the modules/Forums/admin directory, you should.

Posted: Sun Aug 13, 2006 11:09 am

So is there most likely no way to fix this?

Posted: Sun Aug 13, 2006 11:28 am

OK, it looks like I figured out what they did. Now I need to start working on securing what I can. Not sure if it would be a good idea to post corrective action or not, as it could be worse the next time.

Posted: Sun Aug 13, 2006 11:35 am

kguske wrote:

You'll probably want to reinstall phpMyAdmin (or have your host do it).

Check the logs to see how it was authorized. If you're not using NukeSentinel and admin authentication on both admin.php and the modules/Forums/admin directory, you should.

WHere can I get NukeSentinel? The downloads section has what appear to be only patches and add-ons for NS.

Posted: Sun Aug 13, 2006 11:40 am

Also created an Admin account, with admin name bela

Posted: Sun Aug 13, 2006 1:52 pm

The full version NukeSentinel 2.5.0 7.0 - 7.9 you can download
from: [ Only registered users can see links on this board! Get registered or login! ]

The patch for version 2.5.1 is here in the download section.

You also need to change the admin name (your post) or why do you publish this for public ?

Update your forum and use .htaccess for the modules/forums/admin/ files.

Check here:

[ Only registered users can see links on this board! Get registered or login! ]