| Author |
Message |
studeggle
Hangin' Around
Joined: Mar 19, 2004
Posts: 36
|
 Posted:
Tue Mar 30, 2004 8:52 am |
 
|
Can anyone out there help me find and fix my problem. Almost every single week my index page is getting rewritten on my site and I have to reload it. I'm afraid I don't know alot about securing things or telling how they did it. I am useing Raven's ver of php nuke 7.0 on a linux server that is updated daily with any security patches for linux and the web server software. And I keep chaning my login information. But it just keeps happening. The defacment page is different each time so I don't know if it is lots of people and I have some giant security flaw I am over looking, or the same one useing different sigs to make it look like different people. I would realy appreciate any help with this issue. I run a website for fun but it is starting to not be fun anymore with haveing to redo it almost every week.  |
|
|
   
 |
|
sixonetonoffun
Spouse Contemplates Divorce
Joined: Jan 02, 2003
Posts: 2499
|
| Posted:
Tue Mar 30, 2004 9:08 am |
|
Have you patched MeG? Actually you might consider dropping it for Gallery or Coppermine at this point I don't know where a patched version is... |
|
|
|
|
|
Raven
Site Admin/Owner
Joined: Aug 27, 2002
Posts: 16987
Location: Kansas
|
| Posted:
Tue Mar 30, 2004 9:14 am |
|
And have you applied the latest Security Fix packs from Chatserv that are advertized on my front page? And the couple of patches that have recently been discussed here? My 7.0 was only current as of the date it was released. |
|
|
|
|
|
studeggle
Hangin' Around
Joined: Mar 19, 2004
Posts: 36
|
| Posted:
Tue Mar 30, 2004 9:16 am |
|
Are you refereing to My eGallery? If so no I did not know there was a problem with it, I will keep tring to get coppermine to work, and deactivate My eGallery (will deactivating it be sufficent, or do I need to remove all of its files?) |
|
|
|
|
|
studeggle
Hangin' Around
Joined: Mar 19, 2004
Posts: 36
|
| Posted:
Tue Mar 30, 2004 9:17 am |
|
thankyou, Yes I have applied the security fixes discussed on you front page Raven. |
|
|
|
|
|
sixonetonoffun
Spouse Contemplates Divorce
Joined: Jan 02, 2003
Posts: 2499
|
| Posted:
Tue Mar 30, 2004 9:48 am |
|
Then its probably MyeGallery you might find info at nukecops on a fix or updated version. |
|
|
|
|
|
Raven
Site Admin/Owner
Joined: Aug 27, 2002
Posts: 16987
Location: Kansas
|
| Posted:
Tue Mar 30, 2004 11:27 am |
|
|
|
|
|
studeggle
Hangin' Around
Joined: Mar 19, 2004
Posts: 36
|
| Posted:
Tue Mar 30, 2004 6:58 pm |
|
Thank you very much  thanks to you two I found the problem and the culprit now I can block his/her IP and fix my problem. Incase you want to know here is a copy from my log.
Host: 62.251.187.10 Url: /index.html Http Code : 200
Date: Mar 30 14:19:54 Http Version: HTTP/1.1" Size in Bytes: 270020
Referer: Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 9 |
|
|
|
|
|
studeggle
Hangin' Around
Joined: Mar 19, 2004
Posts: 36
|
| Posted:
Tue Mar 30, 2004 7:07 pm |
|
I also just found this guy that used the exploit after my site was defaced but before I was able to fix it. He didn't change anything, but the code ( ) to looks like he was able to pull everything about my server off. Should I change login information for all domains running on this server? |
|
|
|
|
|
|
|
|
|
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
