TinyPortal

Development => Support => Topic started by: baller1308 on December 29, 2007, 08:21:57 PM

Title: Site hacked
Post by: baller1308 on December 29, 2007, 08:21:57 PM
it seems that my site got hacked recently.  I'm not sure if they did it through TP or SMF, but the site is somewhat functional, well, the homepage is at least.  All the links redirect to another site and was wondering  if anyone knows what they did and how to fix it.  My site is www.frown-guild.org
Title: Re: Site hacked
Post by: wilsy on December 29, 2007, 08:36:05 PM
Hi,

Check out admin> Server Settings > Forum URL

Check that the correct forum url is in place.

Regards,

Wilsy.
Title: Re: Site hacked
Post by: Nokonium on December 29, 2007, 09:39:05 PM
It could be SMF related

QuotePowered by SMF 1.1.3

You have not applied the latest update.

It is also possible that there is a hole in the server security.
Title: Re: Site hacked
Post by: Zetan on December 29, 2007, 10:07:26 PM
Do you have the Shop mod installed?
Title: Re: Site hacked
Post by: wilsy on December 29, 2007, 10:14:26 PM
Hi ZTN,

I had a look but couldnt see shop installed. Not all the links are 'hacked', the smf/bloc copyrights are still intact. This leads me to think that its the forum url settings.

Hope you're well :)

Regards,

Wilsy.
Title: Re: Site hacked
Post by: Zetan on December 29, 2007, 10:17:16 PM
I only mention it because there was a recent exploit with the Shop mod. There is a fix for it now at SMF.

I'm good thanks  :)  lol, sick as a dog to be honest. I blame the alcohol over christmas.  :uglystupid2:

:)
Title: Re: Site hacked
Post by: wilsy on December 29, 2007, 10:19:27 PM
QuoteI'm good thanks    lol, sick as a dog to be honest. I blame the alcohol over christmas.

Lol, me too. And I said I would have a quiet time this year ;)
Title: Re: Site hacked
Post by: Zetan on December 29, 2007, 10:21:10 PM
mmm.. "I'm never drinking again"  :-\ Yeah right. Feel like my stomach has been ripped out.

Anyhoo.. back on topic.
Title: Re: Site hacked
Post by: baller1308 on December 30, 2007, 12:39:55 AM
Quote from: wilsy on December 29, 2007, 08:36:05 PM
Hi,

Check out admin> Server Settings > Forum URL

Check that the correct forum url is in place.

Regards,

Wilsy.
I can't seem to login to admin because of the url change.  Is it possible to change it back in phpmyadmin, and if so where?
Title: Re: Site hacked
Post by: Lesmond on December 30, 2007, 01:12:08 AM
Try http://forums.frown-guild.org/index.php?action=admin
Title: Re: Site hacked
Post by: Skhilled on December 30, 2007, 01:59:05 AM
You could also try repair_settings.php to see if that'll reset the links for you.
Title: Re: Site hacked
Post by: G6Cad on December 30, 2007, 09:45:10 AM
Same turkish redirect as always.

1. This is not a hack through eather SMF or TP, it's a plain server host hack. You will need to contact your host and tell them they need to block the dorrs the hacker found.

2. The redirect is simple, the hacker added new index.html to every dir on the server, you need to manually remove all of them to get your forum to work as it did before. Most servers have an order from what file they open first. index.html is the first file in line, the next is index.php and so in, so when you remove the index.html your site will be back as normal.

3. If you are running an older version of SMF and tp software, it wont hurt to upgrade to the new ones, they have several fixes and security changes made. However this would probably nt helped you this time as the hack came through the server software aand not your SMF.