Hacked 6.5 after security patches added....

Guest

Hi!

I am posting in this forum instead of the logged in security issues forum because the New User Reg here wouldn't let me register (guys might want to check it out)

OK, I'm using Nuke 6.5, applied the 6.5 patch last night and today at http://coolpetsites.com my site was hacked by something that caused it to redirect to a different website that was a forum with anti-Bush banners at the top. I re-applied the patch, and it was still there. I have temporarily solved the problem by moving news out of the homepage and WebLinks is the home page. So obviously it is still something attached to the news, but I can't see what.

Any ideas? No articles had obvious changes.

Debbie
dc@loxly.com

Major Joined: Jan 13, 2003 Posts: 892

Not to be a nag here but can you give us the specific patches applied and from where.

You might want to checkout using temporarily at least the banners.php and mainfile.php patches (In same download) at http://www.phpsecure.info/
The mainfile.php will disrupt some functions but until we can figure out whats been done this all that can be offered tonight.

Please check your refers and logs if you can find poo.php haha.php
post it back here. It might look like this in the refers:
http://12.90.16.46/poo.php?target=http%3A%2F%2Fnukedwebtree.com%2Findex.php&sid=77&title=Hax

Or any other odd entries like this.

Posted: Mon Mar 31, 2003 11:14 pm

I used the 65patch from Nuke Cops. It includes patches to mainfile, and three modules, including News. I also checked the files manually against the changes posted at phpnuke.org in the hacked thread.

I'll go look at the referrers now.

Posted: Mon Mar 31, 2003 11:22 pm

The only poo in my referers are searches on poodles and poop Smile

To see the redirect, click on the news page in the Modules block. I have gone through the page source, and I might be blind, but I don't see anything there that should be causing the redirect. Pretty much the whole page loads, am I correct in assuming the redirect is near the bottom of the page?

Debbie

Major Joined: Jan 13, 2003 Posts: 892

Code:

This what you have to look for nice twist they used instead of a java script very clever little prank.

Posted: Tue Apr 01, 2003 8:16 pm

Thanks! I have been at work all day and just got to this now. Thank you I totally forgot about meta refresh. The question remains how they added the story with the patches added.

Debbie

Major Joined: Jan 13, 2003 Posts: 892

If your 100% sure it was done post patch. We'll find out when the next round of sites get hit if not before. Confused

Posted: Wed Apr 02, 2003 11:47 pm

I am absolutely 100% sure the patch was applied to the files on that server.

I'm on my way to unzip the Final, final 6.5, add mods and load it up. We'll see what happens.

Debbie