Hacked 2 days in a row!

New Member Joined: Aug 30, 2006 Posts: 8

My index.php file has been hacked 2 days in a row now Confused

. Thank god, I had made a backup of all major files. How can I stop this from happening again?

Involved Joined: Jul 15, 2004 Posts: 252 Location: OKC, OK

I would say install Raven Nuke 2.02.02 and newest version of Nuke Sentinel.

What are you running? Nuke? What version? Wo you have sentinel installed? What version?

Need more info....and if you got the hack in your web logs that would help also.

Posted: Thu Aug 31, 2006 3:16 pm

I use the newest Raven 7.6 nuke. I got it off this site about 2 months ago.

Posted: Thu Aug 31, 2006 3:27 pm

Well you may need to update Sentinel, but without some logs to go by it is next to impossable to say how they got in and what you can do to make sure it does not hapen again.

Nothing is 100% hack proof, Raven's is about as good as it gets for Nuke security, there are other forks/mods that are good I will not play favorite and say one is the best but you arn't going to get much better then you have with Raven Nuke and newest Sentinel installed.

Try and dig through your logs, almost all hack attemps will leave some traces behind that can be put together to come up with some way to avoide them.

Posted: Thu Aug 31, 2006 5:03 pm

You think it could be my settings for sentinel? What are the correct settings for sentinel to fully secure your website?

registered · Theme Guru Joined: Nov 01, 2003 Posts: 1006

what is your version of sentinel? the one included in rn is not the latest as many releases have come out recently. Also, what addons are you using? What is your sites url? Are you using anything that allows upload on your site? Are you using a gallery? Are you using any clan based addons like VWAR or anything? Are your forums up to date? Have you ever upgraded them? Look on the main forums admin page for your current version it will be listed in red. Click on Sentinel and read the version number at the top of the next page. We really cannot help without more information. Good Luck!

Posted: Fri Sep 01, 2006 10:16 am

There is a chance (a big chance) that upgrading sentinel will not stop the attacks. The reason I say this is because you have files that were changed. It depends on what hack they are using. Currently the most common one is the phpbb attack. Upgrading sentinel WILL block this.

Though if you have vWar, coppermine, spchat, or any other known hackable modules then sentinel WILL NOT stop these attacks.

Also a VERY common attack right now is the php 777 attack. If this is the attack then there is really nothing sentinel will do to help you. You need to adjust your folder security settings or move hosts.

The final attack could be they have hacked your FTP or web server. With these attacks the only way to prevent them is to change passwords or hosts. Though more than likely this is not the hack used because they would probably be deleting your site.

Posted: Fri Sep 01, 2006 10:26 am

I do not have any of the modules stated. I use a few others though. Like the donations module, 4n chat, guessing game, nuke television, nukec classifieds module, all the rest are either from this site or nukescripts. Also I do not have the forums active. Would that make a difference from someone entering that way?

Posted: Fri Sep 01, 2006 10:30 am

it might help if you could answer some of the specific questions that I asked you. it makes it easier for us to help you.

Posted: Fri Sep 01, 2006 7:34 pm

I use NukeSentinel(tm) 2.4.2pl5. I do not allow anything to be uploaded. The forums are not in use and disabled. I am running running phpBB 2.0.20. Should it still be updated? No gallery of any type. I have a calender module ( KalenderMx 1.4.c ), MS_Analysis v2.2 Pro, I have the helpdesk from disipal.net, PHP-Nuke Syndicated News Version 1.0.0, Guessing Gamemod, Donation mod and the Weather mod from nukescripts. I did have other modules but they were not being used and I removed them. My website is http://yonkerstribune.com

Posted: Sat Sep 02, 2006 11:20 am

That is not the latest NukeSentinel. It has been upgraded several times since then. It is now up to 2.5.02 if I remember correctly. When you install programs such as these, you need to check back from time to time to see if they have been updated, since holes are discovered frequently, so you are able to protect your site the best you can.... Very Happy

Posted: Sat Sep 02, 2006 11:56 am

If I remember correctly 2.4.2pl5 did have the phpbb catch in it. So if that is true then my next guess would be the php 777 attack. Do you have folders that were CHMOD to 777?

Posted: Sat Sep 02, 2006 12:34 pm

You need to activate HTTP Auth.

There is also a new version for the calendar out KalenderMx 1.4.d I would update this because several older versions of calendars have a security problem. The author said XSS attacks in older versions but how knows...

Btw: Name of the hacker ?

Posted: Sat Sep 02, 2006 12:58 pm

Thank you for the info. When you upgrade, do you have to go threw the next version. Or can you go striaght to newest?

One hack was dr.jr7 ( France Ip ). The second was Dengeniz from Jordan.

Someone built the website for me. My knowledge of php is mid range. So I image I will spend alot of time here.

Posted: Sat Sep 02, 2006 1:13 pm

Also as far as my knowledge KalenderMx 1.4.d is the latest version. Do you think I should remove it? Also if yes, do you know a secure program like it?

Posted: Sat Sep 02, 2006 3:37 pm

If it was this group: [ Only registered users can see links on this board! Get registered or login! ]

you need to check all files to find out if there are new unknown files or folder.

As I know from other guys they use different IPs also from Asia.
You really need to find out how they hacked the website.Check your logfiles, nukesentinel and possible ask your webhoster.
For the calendar I only meant its a good idea to upgrade this also because there is e.g. some new anti-spam protection included. I don´t use and don´t need any calendar.
To upgrade NukeSentinel go to nukescripts.net and download NS 2.5.00 and download also the neweste 2.5.02.

Sells PC To Pay For Divorce Joined: Posts: 5661

well you dont simply alter a root file,they have to get the access and permissions from somewhere..

Posted: Sat Sep 02, 2006 5:22 pm

I'd much rather ban alot of countries ip ranges. My site gets alot of hits from all over the world. Although the hits are great. I'd much rather block ip's from middle east, Germany, China, Japan, France and countries like that. How can that be done?

Ps: Thanks for all the help.

Posted: Sat Sep 02, 2006 5:40 pm

ok here is what the doctor describes.... Twisted Evil

put this in your htaccess..

that didnt worked...

Posted: Sat Sep 02, 2006 5:42 pm

pm me your email address..
ill send htaccess ban list..