Hacked

Involved Joined: Sep 22, 2003 Posts: 252

My site just got hacked. Lost all my left blocks which has the admin menu, but was able to get that replaced. I no longer have adminstrative access to my site. Any help appreciated.

Posted: Sat Aug 07, 2004 8:56 am

If you can't login from admin.php
Go to phpmyadmin navigate to the authors table
Find any bogus accounts and drop them if they exist.
Click on the edit button for your admin account in the pwd field put this instead:
5f4dcc3b5aa765d61d8327deb882cf99
this is the word password now go back to admin.php login with your admin name and use password as the pasword then go to edit admins and change your password to a new one be sure not to use the old one as it is compromised already.

Or try emptying the authors table from phpmyadmin then go to the admin.php and it will run in setup mode to create the new super user.

Install the latest Sentinel asap it only takes a few minutes.

Posted: Sat Aug 07, 2004 8:59 am

Ok, got it. I'm back in and I think I have fixed any damage. Now, I guess I need security. Sentinel readme says that I will lose any modifications that I have made in my base files. What do you recommend to prevent this from happening again?

Posted: Sat Aug 07, 2004 9:09 am

Now, i can't log in as a user. My name "administrator" has been deleted. I do have admin access again. How do I recover the name "administrator"? It won't let me re-register it.

Posted: Sat Aug 07, 2004 9:39 am

Check and see if your username was changed too if it is just use the edit user function to change it back or phpmyadmin again.

Posted: Sat Aug 07, 2004 9:42 am

I really screwed up six. I deleted my user name and tried to re-register it and it wont let me. I did a dbase backup right before i did this. I guess i need to do the dbase restore (sql) but have never done it before. Do I just "run" the sql file?

Posted: Mon Aug 09, 2004 10:15 am

Did you run a full backup in CPanel or just a DB backup in /Admin on your site?

In CPanel under backup it should give you an option to restore the Mysql database.

It may be easier to go to PHPMyAdmin, select nuke_users at the top select browse. It should list all of the user names for your site. Delete any users listed and go back to yoursite.com/admin.php and it should ask you to set up a new admin account.

I had to do this when my site was hacked; before I knew about Sentinel Wink

Or
You can copy and paste the section nuke_users in your saved .sql file and upload that from your nuke_users table in phpmyadmin.

Hope this helps, I am still kind of new to this too. Smile

Posted: Mon Aug 09, 2004 10:16 am

Thanks for the info. Not sure what I'm gonna do yet. I restored a week old back-up.

Posted: Mon Aug 09, 2004 10:45 am

I had lost some stories from a hack and then found an old backup, so I opened the oldsaved.sql file and the newsaved.sql file in cutehtml and copied just the nuke_stories together from both into a new .sql file.
In phpmyadmin / nuke_stories I dropped the old file and uploaded the newstoriesonly.sql file using the upload and that restored all the stories (minus a few because of my lacking recent backups).

This might help explain how to update a mix of saved files.

Steve