I was Hacked

[ihammo]

Does anyone know yet exactly where/how this exploit starts? Is it the missing code in functions_portal.php?

I want to make sure that before I bring stuff back up it really is fixed.

As it is my provider has shut my site down as they had uploaded several trojans and were using my server as a point o launch other attacks.

backdoors to look for are:

Ronin
dc
bindtty

tomorrow is going to be a long day

[ihammo]

further to that - i noticed other function_xxxxx files in the includes folder also dont have the code below at the top. can anyone say if they shoudl have or not??

if (!defined('IN_PHPBB'))
{
die('Hacking attempt');
}

[MercAngel]

just found out a site i am and admin on was also hacked

but the other site i own was not and ther are links back to mine on the one that was hacked so maybe is is a host thing

[Unregistered]

all the sites which used premoded files were hacked? or did u guys updated manually by using FIND / REPLACE codes?

[Driver 7]

Bloody hell. I was hacked also.

[Drop-Forged]

all the sites which used premoded files were hacked? or did u guys updated manually by using FIND / REPLACE codes?

I used premoded files on my site, and yes was hackedà¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ¦. <img>

[ZacFields]

ihammo,

yes that string of code is supposed to be there for security purposes.

Zac

[Rabi]

I was hacked also....

[Solomon]

Make that 3x hacked in less than 48 hours. See this thread if you already havent. http://integramod.com/forum/viewtopic.php?t=1944

[Driver 7]

It's an automated hacking script as far as I can tell.

It looks to me like the place of entry was through somewhere inside the chatspot folder.

[Teelk]

Chatspot 1.0.0 is installed with IM, while version 2.0.0a7 is the latest version. I'll make the update available as soon as I have it all put together.

[Driver 7]

Thanks Teelk.

What is chatspot and what exactly does it do? Is it something we use or can it be removed?

[MercAngel]

are we sure they are getting in throught the forum software it self and not the host or some toher way

i had my other site open now for 48 hours i CHMOD all the file and folders to 777 so it chould be hacked easy.

i also have a packet sniffer running and so far nothing.

[MercAngel]

i have been checking the internet on this file called c99.php

i have found sites that have been hacked by this thing back to 2004

it looks like they have hacked just about every forum software there is as well as some not forums sites

[Solomon]

How come this site hasn't been hacked yet? What are they doing right, that we are all doing wrong?