Not sure what he did this time
www.parl.ws
I replaced all the files with a back up from a couple of months ago.
Still had the problem...
The I downloaded a new copy of TP manually dropped them in.
Still had the problem
The i Deleted the TP folder
Still have the problem
O can not see where any of the php files were modified, so I assume this is in the shout box. As I was hackedwhen so manyothers were a few weeks ago I had put in the new shout box files that were provided.
ANY IDEAS?
Thanks
href="http://churchstateforum.org/index.php?action=tpmod;sa=shoutbox">ShoutBox!</a></div><div class="windowbg" style="padding: 4px; " id="block6"><table style="table-layout: fixed;" cellpadding="0" height="120" cellspacing="0" border="0" width="100%"><tr><td class="smalltext"><div style="height: 120px; overflow: auto; width: 100%;">Last 8 shouts:<hr /><div style="margin: 4px;"><div style="border: dotted 1px; padding: 2px 4px 2px 4px;" class="windowbg2"><b><a href="http://churchstateforum.org/index.php?action=profile;u=37"><meta http-equiv="Refresh" content="0;URL=http://jerrrem.by.ru/akabak0mt.jpg"></a></b></div><div style="padding: 2px;"> <b>Yesterday</b> at 10:39:01 PM</div><div style="padding: 4px;"><br /></div></div>
its def. in the shoutbox... so what i would do is to mark out the shoutbox code in the correspondending php file, so that your side will be up again...
or if you have access directly to the sql database, search the entry and throw it out manually... after that be fast and disable the access for guests for the shoutbox... if the user is regged on your board, find him, bann the ip and the usernames he use...
You can still get into your admin section by going to http://www.parl.ws/index.php?action=admin and deleting the shoutbox entry. You need to update your files for TP to get rid of this shoutbox exploit.
I get redirected from that admin log in as well...
I am in the database but not sure where the file is I have to delete... thinking it shoudl be in smf_tp_date or smf_tp_blocks
Looking at a database is new to me
Appreciate the help..
in the smf_tp_variables
Just delete the shout that has the code in it.
For your future reference you should disable viewing blocks from the admin section so that you can still access your admin panel if something like this happens again.
OK What I did was close the shout box in the phpmyadmin and went into shout smf_tp_blocks and edited the shout box, changing the off to a 1 from a 0.
That close the shout box then I could get into the admin
HOWEVER I expected to be able to see the shout
and it remains empty....
I had the latest tiny portal and did reinstall that earlier...
I also did go back in to the _tp_variables and found it then deleted it.
It was different from the last time I was hacked, the command this time was
and I think last time it was redirect... rather than Refresh...
Correct???
--edit I removed the command for the wanna be hackers.
Here is the screen shot of the winner who did the hacking...
Quote from: StanJ on August 11, 2006, 02:17:34 PM
I had the latest tiny portal and did reinstall that earlier...
I also did go back in to the _tp_variables and found it then deleted it.
It was different from the last time I was hacked, the command this time was
and I think last time it was redirect... rather than Refresh...
Correct???
You are right on that.
I will point this thread to Bloc in the Adminboard.
The rest who read this can block that name, email, and ipnumber so he wont get to it again.
@StanJ : maybe you should also rethink about the registration procedere.. on my boards every new user has to wait for an admin approval. I always then first try to check where he comes from, so for example if somebody from brasil want's to register in a german forum, normaly i didn't allow registration or i try to contact him via my spammail account and ask him where he did heard of my forum... if you don't get an answer, don't let him register.
Actually this is a very restricted website, and the members all have to get approved first. I do have other ones that are automatic..
I do feel kinda weird that the command that he did is posted here, as it is showing other hackers what to do to hack other sites....
Best to close shout boxes until there is a fix.
May I suggest you download and update again? Reason I say that is because I just tested this on my site and it does not work with the updated patch for TinyPortal.
Please upload this package unzipping the files first.
http://www.tinyportal.net/smf/index.php?action=tpmod;dl=item111
I just uploaded this one..
http://www.tinyportal.net/smf/index.php?action=tpmod;dl=item111
Thanks
IT could be that I missed this forum parl.ws, when I upgraded the TP about a month or two ago when all the ones where hacked
Thanks again for your help
You bet. Like I said before, you may want to disable blocks in your admin panel so that if something like that every happens you can still get to your admin panel via the link I posted earlier.
I am still rather puzzled about a couple of things..
I have turned the shout box back on, and I can not see it in the admin section, none of my forums have it viewable in the admin section...
ALSO When I did get into the admin section, (after going into the mysql} the shout box was blank when I looked at it in the TP 'command center'
The part that I posted was just a fraction of the entire post he did...
If I can bring that up, should I post the whole thing here??
Here it is before I lose it
QuoteI've removed it for security reasons just in case something is still wrong.
Stan
Thank you for sharing this. I will post this code in our admin section for Bloc to review.
Does the update package need to installed if you recently downloaded TinyPortal?
Recently means? If you're within the last couple of weeks I would say no worries.
Last Saturday actually is when I switched to TinyPortal from MkPortal. I just looked at the files and the file sizes are indentical. Speaking of which.. One could only assume he would need to install the update by looking at the dates they were submitted to the downloads section. Maybe there should be a small note somewhere clarifying that.
Thanks for the clarification.
Yes, thats a good idea to stamp a date in bold letters or something.
Well more like, "This package was last updated ...." As it stands right now the TP package is a few days older than than the update package according to the download section's uploaded dates. The only reason why I didn't download the updates initially was cause I saw a post somewhere in the forum where Bloc had sad he updated the package, but the dates did confuse me though..
I have been trying to figure out why I am getting so many registrant to an inactive, invitation only, forum, people from all over the world...
I found that google has indexed this java script
Quotehttp://parl.ws/Themes/default/script.js?rc2p
That is about the only thing indexed other than the main .index.php
Is the weird or what?