friends site hacked

New Member Joined: Dec 30, 2008 Posts: 14

Hey all.

A friend of mines site was just hacked tonight. He was using mybb and they wiped it and had just installed php-nuke platinum and they just took that down as well. He sent me this if it means anything to you security gurus.

Referer: none
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.12) Gecko/20101026 AskTbCS2/3.9.1.14019 Firefox/3.6.12 (.NET CLR 3.5.30729)
HTTP Host: [ Only registered users can see links on this board! Get registered or login! ]
Script Name: /forums/modules.php
Query String: name=Forums&file=search&mode=results
Get String: name=Forums&file=search&mode=results
Post String: search_keywords=<script>alert(bad_tag);</script>&search_terms=any&search_author=<script>alert(bad_tag);</script>&search_forum=-1&search_time=0&search_fields=all&search_cat=-1&sort_by=0&sort_dir=DESC&show_results=topics&return_chars=200
Forwarded For: none
Client IP: none
Remote Address: 74.63.112.138
Remote Port: 60572
Request Method: POST

Is this an old exploit that can still be used on platinum or is it something new as sentinel didn't stop it.

If it is platinum problem is ravennuke vulnerable to these exploits as well?

Thanks.

Regards,

Scott

Posted: Fri Nov 05, 2010 6:48 am

Do you know what version of phpbb was included with php-nuke platinum? When was php-nuke platinum last released? There were some known exploits to the forums search code, I going to guess your friend was using an old version of phpbb... but can't say for sure as I have no familiarity with php-nuke platinum.

Posted: Fri Nov 05, 2010 6:50 am

Hi, I don't think those codes were causing anything because I just tested and I got blockated with NSentinel. This could be another secutity issue in platinum.

Quote:

=<script>alert(bad_tag);</script>&search_terms=any&search_author=<script>alert(bad_tag);</script>&search_forum=-1&search_time=0&search_fields=all&search_cat=-1&sort_by=0&sort_dir=DESC&show_results=topics&return_chars=200

Posted: Fri Nov 05, 2010 7:43 am

Because they hacked mybb and now Nuke Platinum I suspect they might have a back door to the server. I would change all the password to cPanel, FTP etc.

You should be safe with RavenNuke. Wink

Posted: Fri Nov 05, 2010 1:17 pm

Thanks for the replies guys.

I'm unsure what version of platinum it was, it was a recent install (2 or 3 days) and only just downloaded then so I am guessing it was whatever the latest version is that is available.

I use RN myself and am confident in it.

I posted this just in case it was something new. I'm trying to convince him to use RN but at the end of the day it is his site. I just don't want to see him consistently lose his site to people with nothing better to do.