Nuke Sentinel 2.4.2pl9 hacked???

New Member Joined: Jun 15, 2006 Posts: 19

Something strange happened today...

I had already 6 banned IP's on NS's IP ban list, some of them automatically added, others manually added.

The strange thing is all of those disappeared from the list (and DB) and a new one appeared :

Blocked IP - 196.201.77.*
Date - 2006-09-08 @ 05:59:26
Expires - Permanent
Reason - Harvest

I guess somehow the hacker managed to delete the records from the DB...

I'm getting tired of these kids... and prepared to give up and close down my website which has +4,000,000 visitors (phpNuke report, so i guess it's the number of generated pages...)

Sells PC To Pay For Divorce Joined: Posts: 5661

where did you get that wishdom from ?
Nice catching title btw but you cannot hack sentinel..
and you better check your settings....im so very positive that the answer lies there...

Posted: Fri Sep 08, 2006 7:09 am

Normally Sentinel puts the blocked IP's in both the blocked IP table and in htaccess. Did you check both? Did you check them by doing display blocked IP's in Sentinel or by looking at the table directly or both? And did you look at .htaccess. The only way a hacker could remove them from both places would be if he/she/it had administrative access to your Sentinel or if he could run a script on your site or get into both phpmyadmin and web site adminstration or FTP to edit the .htaccess file. That obviously would be fairly serious, in fact they would rule you. So if you are really sure this happened you'd be best off to see who might have access to your site administratively and check your logs carefully to see what's going on and look for files that shouldn't be there. The usual litany of things to do when you've been hacked.

Posted: Fri Sep 08, 2006 7:41 am

well my idea was that he is using the option to flush blocked ip's..

Posted: Fri Sep 08, 2006 10:36 am

You might be right Hitwalker. I couldn't tell from the original post so I asked him to look into several different things. No matter what the cause, if the hacker has control over blocked IP's then he has administrative rights to the site.