Advertisement:

Author Topic: I was hacked  (Read 10668 times)

Offline kcmagicdata

  • Semi-Newbie
  • *
  • Posts: 21
I was hacked
« on: July 29, 2008, 07:18:10 PM »
I was hacked today by

"HACKED By 3RqU "

Not that they did anything other than "Tag" me  with a index.htm file .It also added a new Adminsitrator account to my forum.
I am using ver 1.1.1 and am currently having alot of trouble getting any of the updates to go through. Everything i try results in error this error that unable to this unable to that. Is there anything else i should check for?




*removed the hackers link
« Last Edit: August 01, 2008, 07:52:05 AM by Tony »

Offline Delidereli

  • Semi-Newbie
  • *
  • Posts: 25
  • Gender: Male
Re: I was hacked
« Reply #1 on: July 29, 2008, 07:20:03 PM »
smf 1.1.5 e geç gardaş. 1.1.4 te sql injection açığı var

Offline ccbtimewiz

  • SMF Hero
  • ******
  • Posts: 5,300
  • Gender: Male
  • OXEN
Re: I was hacked
« Reply #2 on: July 29, 2008, 08:00:29 PM »
I'm afraid some idiots found a hole in SMF 1.1.4 that allows them to use SQL injections to alter their permission levels.

The fix for this is to update to SMF 1.1.5. There are no other options.
« Last Edit: July 29, 2008, 09:33:03 PM by ccbtimewiz »

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #3 on: August 01, 2008, 05:17:53 AM »
Please help me. I have also been hacked by some EFSANE87 guy and I cant seem to fix this problem. He created an admin account wich I now deleted using my database webadmin, but still it keeps showing "Hacked by...". Is there any way to hack it back so I can keep all posts and stuff?

Thanks in advance,

Hyper

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #4 on: August 01, 2008, 05:19:26 AM »
Where does it say hacked by?

May we have a link please.

Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #5 on: August 01, 2008, 05:29:36 AM »
when I go to the forum it says that. So I thought lets try just manually typing in boards or the admin panel, but it keeps showing the message. I changed the directory to something else now, but I'll change it back for a sec. Tell me when you viewed it: http://www.wshadows.com/forum

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #6 on: August 01, 2008, 05:41:37 AM »
Check your default language files for suspicious stuff - index

You can login using imode : http://www.whiteshadowsclan.com/forum/index.php?action=login;imode

Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #7 on: August 01, 2008, 05:55:13 AM »
Check your default language files for suspicious stuff - index

wich files are those exactly? And are you trying to say that the database is still "good"? Cause all boards and stuff are there.
Btw thanks for that imode thing! Didnt know about that.
« Last Edit: August 01, 2008, 05:57:55 AM by hypercube »

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #8 on: August 01, 2008, 06:10:01 AM »
Have you many mods installed?

Your language files are here :

/forum/Themes/default/languages

check index.english.php


Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #9 on: August 01, 2008, 06:15:50 AM »
yeah I got about 5-6 mods installed.

I'll put the file here, didnt find anything strange in it.

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #10 on: August 01, 2008, 06:17:53 AM »
ok what about your Settings.php file? (please dont upload it - its got your db password in!)
Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #11 on: August 01, 2008, 06:22:44 AM »
nothing..
Should I try downloading a new smf 1.1.4 package and then upload it in place? Then we know if its the database or any files...

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #12 on: August 01, 2008, 06:24:11 AM »
rename the default theme directory to default_bak

And then just reupload the default theme from a fresh download here.

Its not your DB.
Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #13 on: August 01, 2008, 06:39:18 AM »
i cant find a smf 1.1.4 download, still looking.. :/

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #14 on: August 01, 2008, 06:40:45 AM »
use a 1.1.5 for the moment.

Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #15 on: August 01, 2008, 07:19:08 AM »
I accidently deleted the database (i backed it up though). So now im trying to restore that first with phpmyadmin. But its giving some errors atm.

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #16 on: August 01, 2008, 07:23:18 AM »
ok i solved some strange things.. look now.
there are no picture but posts are back :/

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #17 on: August 01, 2008, 07:26:47 AM »
Now switch your default theme back to colatesi_v3 in the admin cp

Is this it?

http://www.whiteshadowsclan.com/forum/index.php?theme=2
Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline Tony Reid

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 4,154
  • Gender: Male
    • @AbsoluteBreeze on Twitter
    • www.fertilityfriends.co.uk
Re: I was hacked
« Reply #18 on: August 01, 2008, 07:28:47 AM »
I see its all done.

You really need to upgrade to 1.1.5 - this can be done in your admin cp under packages.

Tony Reid


My Big Board
www.FertilityFriends.co.uk/forum - An SMF powered forum with over 5 million posts

Offline hypercube

  • Jr. Member
  • **
  • Posts: 104
Re: I was hacked
« Reply #19 on: August 01, 2008, 07:29:45 AM »
Now switch your default theme back to colatesi_v3 in the admin cp

Is this it?

http://www.whiteshadowsclan.com/forum/index.php?theme=2

ok how the hell did u know it was called like that and how did that theme land up there :S

Its working again now btw, I dunno what I did :P

Thanks so much, I dont know how to tell you how much u helped me. You're the best!


If I upgrade it cant be hacked again?