Stop a spammer with .htaccess?

Captain Joined: Sep 13, 2003 Posts: 314

A spammer seems to succeed to download a type of e-mail client named Envio_xD.php to my modules directory and through my site then send out spam. I get a lot of error e-mails to my sites e-mail account that proves that.
I have tried to stop this to happen by add to the .htaccess :

<Files "modules/Envio_xD.php">
Order allow,deny
Allow from myipaddress
</Files>

But it does not seem to work. Grateful för suggestions!

Site Admin Joined: Aug 17, 2003 Posts: 12397

How did he get in?
I don't know off-the-top how the FILES declaration works

I would use mod_rewrite to do the same thing, something like

Code:

RewriteRule ^modules/Evio_xD.php http://127.0.0.1 [R, L]

Captain Joined: Sep 13, 2003 Posts: 314

The hacker used SpChat to upload the file to my site. I looked in the logs and discovered that. I also found his ip-address, so I have blocked it now in NukeSentinel.

I tried your suggestion with Rewrite, but it gave Internal server error for the entire site, so I could not use it.

Captain Joined: Sep 13, 2003 Posts: 314

I have now solved the problem to access that file. I created a new .htacess file in the directory modules/ . In that .htacess file I have:

<Files "Envio_xD.php">
Order allow,deny
Allow from myipaddress
</Files>

and it works very well and noone else can access that file, if downloaded again to my site.

Site Admin Joined: Aug 17, 2003 Posts: 12397

I'm guessing Sentinel doesn't protect against this exploit. Is SPChat integrated within the phpNuke/Sentinel environment or not?

Captain Joined: Sep 13, 2003 Posts: 314

No, Sentinel does not protect from upload of files through SpChat and Sentinel did not protect from the identical behavour by coppermine. However, certain hacking attempts through Spchat have Sentinel protected from, so it seems at least partially integrated into NukeSentinel.

Site Admin Joined: Aug 17, 2003 Posts: 12397

Cool good to know. I avoid the uploading functions myself Wink

Sergeant Joined: Jul 11, 2004 Posts: 104 Location: Athens

I would nix SPChat in favor of flashcat http://www.tufat.com/script2.htm

Granted it's $5 but we have never had a problem with it.

Captain Joined: Sep 13, 2003 Posts: 314

I wonder, if not this in the .htaccess file would be better? It should also stop hackers from uploading index.php or config.php to the site.

<Limit PUT>
order deny,allow
deny from all
</Limit>

Has anyone tried this?

Site Admin Joined: Aug 17, 2003 Posts: 12397

I'm guessing that should work, as long as its file uploading through a PUT method rather than a POST method