http://www.coupe-club.org.uk
SMF 1.1.11
TinyPortal v0.9.8
Default
too many mods too list
Hi guys, been hacked this evening by the Turks, for the second time, last time I was running 1.1.4 so I updated hoping it would fix the problem, but no, they were back today.
I found the membership the hacker was using to somehow access the Admin panel and banned and blocked his domain name.
Anyone got any ideas what to do to keep them out?
Bigguy has been helping me sort it but we can't seem to locate the vulnerability.
It's been suggested that it may be TP that has the vulnerability?
They probably uploaded a file that had a script in it. This would allow the hacker to inject code into various files. IIRC, 1.1.4 had a vulnerability in it that allowed anyone to upload an avatar that had code embedded in it, then run that code as php. This code added some more code to the end of every file on the domain.
I would look for files that don't belong to either SMF or TP, and check all the php files for injected code. Or wipe the whole domain clean and upload files fresh from SMF and TP.
Hi sparky33,
Welcome to the TP Support site.
This is more of an SMF issue than a Tinyortal one. What is happening to you did not come from TinyPortal.
If what Willy says is true, and it could be, you should download your entire site to a temp folder on your local computer and then do a search for "base64_decode" of all the files. Any files that show up with the search are likely suspect but files that are part of your install could have been infected as well. Also, there are tools on SMF to discover files that shoudn't be in your install. BigGuy knows where those files are.
Good Luck.
ZarPrime
You on a shared host? If so, are you sure it's your site that is the site getting exploited? Or is it another site on the host who's getting everyone else hacked?
This could be as simple as your password.
Make sure your password for your Database, FTP , PhpMyAdmin and forum admin account are all different.
because your Database password is stored in Setting.php. If your passwords are all the same and someone gets a hold of the Settings.php, then you could be in trouble.