Hacked, please help...

Nuke Soldier Joined: Jul 02, 2003 Posts: 13

Hi guys...
I have a phpNuke 6.5 (with sec fix 3) and i've been hacked...
It seems that all the script kiddies have done is change all the news in my home page with this text:

H A C K E D!! BY - [ LunixO ]- --------------------- !Hi! --------------------- Testing your security system....0k --------------------- Hey admin!! Your security has broken by me. (SORRY!!) but you must parch your system. Admin you need any class of security on the computers... ---------------------------------------- Bi0s FucKed!! K hax0r k erz. Fillo d´ PutA!! Bi0s sorry because your mother suck me dick destrangis in the night. Bi0´s use ./xploit... lamah kaka. --------------------------- Greetz: Maure, MoOn, supn0rmal, arrow_maki, etc...- Wink

---------------------------------------- I Love This Game -[No.LImIts]- ------------------------------ The Hack is p0waH -[Free Your Mind]- --------------------------------------

After searching here in nukecops i've found a post the recomends this in /modules/News/index.php:
if ($score != 1 AND $score != 2 AND $score != 3 AND $score != 4 AND $score != 5) {
Header("Location: index.php");
die();
}

Is that enought to stop this little lamer ???
BTW: I had the lattest analyze.php and everything was (and is) ok...
BTW2: they used this URL:
http://www.rzw.com.ar/xploit_nuke.php?target=h....

Nuke Soldier Joined: Jul 02, 2003 Posts: 13

I've found a fix here:
http://www.frog-man.org/tutos/PHP-Nuke-News.txt

But i can no longer have html on my news Sad

Any help?

Posted: Wed Jul 02, 2003 12:10 pm

i think that the problem is the score...

in fact their script send this date to your site (modules.php)

Code:

getArray ( ) postArray ( [name] => News [op] => rate_article [sid] => 5 [score] => 1, title=char(112,114,111,118,97), hometext=char(99,111,114,116,111), bodytext=char(108,117,110,103,111) [submit] => Cambiar la Noticia )

here is the form that contact your site:

Code:

byez

If sameone now how to fix it... say something Wink

Support Mod Joined: Mar 19, 2003 Posts: 308

Please download the security-fix 3 for phpnuke 6.5 in the downloads-area and do what they say! You will need to change the modules/news/index.php file as well as the mainfile.php !

ciao,

Bart

Nuke Soldier Joined: Jul 02, 2003 Posts: 13

I've fixed it, it's on the URL i posted on the second post, but now my mainfile.php removes all < > | and ) characters, so i cannot post anything with HTML becouse this chars are replaced by HTML codes.
Any other fix before i make a script that search and replaces all that codes???

Support Mod Joined: Mar 19, 2003 Posts: 308

Djee KaTXi !!

check http://nukecops.com/postp25982.html#25982

with a solution!

Major Joined: Jan 13, 2003 Posts: 892

Use the fixes suggested frogmans patch was just that (a bandaid) not a fix for the specific vulnerability.

Nuke Soldier Joined: Jul 02, 2003 Posts: 13

Thanks, it's fixed on Sec fix 4, not 3, but it works.
Thanks a lot guys, you were a great help.

BTW: Every one update NOW. Hacking your home is way easy if you are not fixed.

Nuke Soldier Joined: Jul 02, 2003 Posts: 13

Another tip for guys that want to upgrade to secfix 4:
Everything works great but search.php and viewtopic.php , which are broken, just follow fixchanges.txt for this two files.

More info here:
http://www.nukecops.com/postlite4995-search.html+php+viewtopics+php