FUDforum: Bug Reports » Possible exploit- hackers access my ACP

Home » FUDforum Development » Bug Reports » Possible exploit- hackers access my ACP

Show: Today's Messages :: Polls :: Message Navigator

Possible exploit- hackers access my ACP [message #158455]

Thu, 26 February 2009 10:52

TheBarnes

Messages: 19
Registered: February 2009

Karma: 0

Junior Member

Hi, I have had a problem where hackers are running a script to access my Admin files, can I e-mail someone my error log please?

Regards
James

Report message to a moderator

Re: Possible exploit- hackers access my ACP [message #158456 is a reply to message #158455]

Thu, 26 February 2009 11:29

naudefj

Messages: 3772
Registered: December 2004

Karma: 28

Senior Member
Administrator
Core Developer

Hi James,

How do you know they accessed your site via the Admin Control Panel?

My site was also hacked a couple of times, however, it never turned out to be FUDforum's fault.

PS: You are welcome to mail the logs to me.

Best regards.

Frank

Report message to a moderator

Re: Possible exploit- hackers access my ACP [message #158458 is a reply to message #158455]

Thu, 26 February 2009 12:03

TheBarnes

Messages: 19
Registered: February 2009

Karma: 0

Junior Member

Have e-mailed you Frank, many thanks.

Just from viewing the error logs it appears they are running scripts to browse directly to the admin contol panel files. I may however be completely incorrect.... I'm on v2.7.7 by the way.

Report message to a moderator

Re: Possible exploit- hackers access my ACP [message #158460 is a reply to message #158458]

Thu, 26 February 2009 12:34

naudefj

Messages: 3772
Registered: December 2004

Karma: 28

Senior Member
Administrator
Core Developer

I'm busy working through your log. For starters:

1) lock your forum's files.

2) block the offending IP addresses from your site (add "Deny form <ip>" in you .htaccess file).

3) Ensure the forum's default ".htaccess" files are all in-place:

data/cache/.htaccess
data/errors/.htaccess
data/files/.htaccess
data/include/.htaccess
data/messages/.htaccess
data/scripts/.htaccess
data/sql/.htaccess
data/src/.htaccess
data/thm/.htaccess
data/tmp/.htaccess

Report message to a moderator

Re: Possible exploit- hackers access my ACP [message #158462 is a reply to message #158455]

Thu, 26 February 2009 13:07

TheBarnes

Messages: 19
Registered: February 2009

Karma: 0

Junior Member

Thanks Frank-

1) I thought they already were locked, hence my concern. I've checked the files on the server and they're now set to 644. (not sure what the data files should be set to though....)

2 + 3) I have no htaccess files!! They must not have been restored last time I had a backup....
Can I get these from somewhere?

[Updated on: Thu, 26 February 2009 13:11]

Report message to a moderator

Re: Possible exploit- hackers access my ACP [message #158463 is a reply to message #158462]

Thu, 26 February 2009 13:44

naudefj

Messages: 3772
Registered: December 2004

Karma: 28

Senior Member
Administrator
Core Developer

1) If your forum is locked your files will be chmod'ed to 0600.

2) Create one in your root htdoc directory (/).

3) You can manually recreate them. They contain a single line:

Deny from all

Report message to a moderator

Re: Possible exploit- hackers access my ACP [message #158465 is a reply to message #158455]

Thu, 26 February 2009 14:26

TheBarnes

Messages: 19
Registered: February 2009

Karma: 0

Junior Member

As usual you've been superb Frank.

I manually had to CHMOD all the files to 600 (they were set as 644 otherwise). I can't set the images and themes files to 600, because otherwise the images don't show up, is that correct?
Should the actual adm directory as well as the files within be set to 600, or does that not matter?

I also assume that when I want to perform admin tasks I'll have to go onto the server and CHMOD all the files back again?

Report message to a moderator