Hack added admin

Nuke Soldier Joined: Apr 05, 2006 Posts: 15

I had an alert from nuke sentinel, someone ran the admin.php to add a superuser.

www.justfungaming.com//admin.php?add_aid=hacker&add_name=hacker&add_pwd=123456&add_email=birxx@yahoo.com&admin=(code edited to prevent more abuse)

And it worked and added a superuser. Anyone know how to prevent this?

Site Admin Joined: Jun 18, 2004 Posts: 217

what version of phpnuke are you running, seems you are not using current patches and sentinal either not done right or using an old version.

thanks

steve

Nuke Soldier Joined: Apr 05, 2006 Posts: 15

I am running 7.8 with the latest patches and as far as I know sentinel is set up properly. I got this from sentinel:

Date & Time: 2006-04-29 12:36:27 EDT GMT -0400
Blocked IP: 85.96.125.137
User ID: Anonymous (1)
Reason: Abuse-Author

Site Admin Joined: Jun 18, 2004 Posts: 217

well thats normal someone attempted a hack and they were banned and its in your sentinal log and probley emailed to you as well.

you have nothing to worry about this is normal

thanks

steve

Nuke Soldier Joined: Apr 05, 2006 Posts: 15

It still created the user, and IP block doesn't mean much if someone is using a proxy. I set sentinel to http auth, maybe that will help.

Posted: Sun May 21, 2006 10:30 pm

admin.php open
require_once("mainfile.php");
later add

Code:

$checkurl = $_SERVER['REQUEST_URI'];
if((stripos_clone($_SERVER["QUERY_STRING"],'AddAuthor')) || (stripos_clone($_SERVER["QUERY_STRING"],'VXBkYXRlQXV0aG9y')) || (stripos_clone($_SERVER["QUERY_STRING"],'QWRkQXV0aG9y')) || (stripos_clone($_SERVER["QUERY_STRING"],'UpdateAuthor')) || (preg_match("/\?admin/", "$checkurl")) || (preg_match("/\&admin/", "$checkurl"))) {
die("Illegal Operation");
}

Captain Joined: Apr 30, 2004 Posts: 561

Something simple you could do is to change the name of the admin.php file....

Nuke Cadet Joined: May 28, 2006 Posts: 1

This is not simple. I try change name, change admin name in config and repleace name in admin file security code.
In admin menu any option is "Acces denied".
Any idea??