Website hacked..again

Regular Joined: May 08, 2004 Posts: 77

Yep, they did it again.
They couldnt access authors or the admin part.
But they did get in anyway and changed the "nuke_config" tabel. Via that table its showing a hacked tekst on the mainpage.

Any ideas how they get in? and how to prevent this?
Must say that im using an older phpnuke version with sentinel for that website, because i had plans quiting the website i never updated it (shame on me).

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Do you use Coppermine or any third party application that allows uploading of files? What version of NukeSentinel are you using?

Posted: Thu Oct 06, 2005 1:31 pm

I did use Gallery and Sentinel was an older version (didnt update, thought that i would sell the website..). Cant check now.
Do you think that Gallery could be the problem?

Posted: Sat Oct 08, 2005 6:10 am

Did fix/replace the table and website is ok now, but not online yet.
Need to update Sentinel and Gallery first...
Hope that will fix the problem, otherwise it will happen again i guess.. Sad

Posted: Sat Oct 08, 2005 7:56 am

Himmel wrote:

I did use Gallery and Sentinel was an older version (didnt update, thought that i would sell the website..). Cant check now.
Do you think that Gallery could be the problem?

If you check bugtraq for Gallery exploits that may answer your question. Dependent on what release of Gallery you use there may have been a similar exploit. OTHO, when a table gets changed it can also be a result of XSS through the weblinks module or some other module that isn't secured with Chatserv's latest patches. Or, depnding on the release of NukeSentinel there could have been an exploit that was discovered and blocked in a later release. You need to carefully go through your server access logs from the day when this happened and see if you can find the access that was used.

Posted: Mon Oct 10, 2005 9:04 am

Hi Raven, will update things asap. Cant reach any server logs, so after the updates we will see how things work out;)
Thx

Posted: Mon Oct 10, 2005 11:49 am

Raven wrote:

Do you use Coppermine or any third party application that allows uploading of files?

LMAO these days should that question just be:

Do you use any third party application that allows uploading of files?

After all a PoC keeps popping up much more these days that Coppermine is not the issue.