admin_prune attack?

Posted: Sun Jun 24, 2007 2:40 pm

We have just recently begun getting IP's blocked (6-8/day). The query is usually one attempting to access admin_prune.php with this added at the end.

Quote:

phpbb_root_path=http://www.apnic.net/index.html??

The root path is different in several of these. Others include:

flopa.addr. com/evilx
geocities. com with alot of other stuff on the end
bandwith.netfast. org/id.txt?

Are these actually attempts to prune our forums like they appear?

Also, several trying to post to the forums, either anonymously or with fake usernames - attempting to post links to porn sites, or other products.
We apparently have gotten on someones list, because this site has been up for 2 years and we have just begun to get this stuff.

Posted: Sun Jun 24, 2007 7:46 pm

This is an old exploit used to do whatever damage it can. This particular exploit is capable of doing anything that their script has been designed to make it do, insert New posts, delete entire forum, put something on the face, whatever they can make it do.

Good news is that if your Sentinel and nuke is patched to the latest security patch, then your site is quite safe from this exploit.

Posted: Sun Jun 24, 2007 8:53 pm

Likely you've just been indexed by Google.. that's all they use to find your site and sent these attacks. You can stop many of them by blocking libwww-perl using .htaccess

Posted: Mon Jun 25, 2007 6:59 am

Evaders99, how do I do that exactly?

Posted: Mon Jun 25, 2007 10:38 am

Try searching the forums, as it's been discussed before. Wink