SPONSORED LINKS:

Reverend greed Help



REA D NE W PO STS


-Sponsors-



-Other Forums-

  Facebook Group
  Madhouse Radio new
  BinRev new
  Defcon Forums new
  KDK Pranks
  Ownage Pranks new
  Jerky Boys
  Underground News new
  Jackulator 9000 new


-phonelosers.org-

  Main Site
  Prank Calls
  Shoutcast Stream
  Podcasts
  PLA Wiki
  PLA YouTube
  PLA Twitter
  PLA Tumblr


REA D NE W PO STS



Support PLA by doing your Amazon searching here:

Also, visit PLAs Amazon Store

Author Topic: Reverend greed Help  (Read 4787 times)

Offline silentfreak

  • Junior Phone Loser
  • **
  • Posts: 28
  • 1337 13V3L: +1/-7
Reverend greed Help
« on: August 30, 2006, 09:33:26 PM »
My board is being hacked for 3 days now.  A hacker (and I am sure it is a person, because as the admin I am alerted by the hacker) deletes a member of my board per day, in alphabetical order.

The admins passwords are hard to find (letters + numbers + special caracters).  Since the members list is not publicly availible (you must be a member in order to see it), the hacker is probably or has been a member of my community.

The questions --

- Does SMF have some kind of security hole concerning this problem?

- Is there a way to include the member deletion in the moderation log, particularly if it is not an admin who perform the deletion?

- Is there a way to get the password errors with admins account in the moderation log?

If you need my FTP/admin account and password, just say it and I will communicate with you via PM.
« Last Edit: August 30, 2006, 09:41:23 PM by silentfreak »

Offline Reverend Greed

  • PLA Guru
  • *****
  • Posts: 224
  • 1337 13V3L: +42/-7
Re: Reverend greed Help
« Reply #1 on: August 30, 2006, 09:46:58 PM »
Why me?
Reboot America

Offline Devilz212

  • Senior Phone Loser
  • **
  • Posts: 69
  • 1337 13V3L: +13/-8
Re: Reverend greed Help
« Reply #2 on: August 30, 2006, 09:50:53 PM »
The hacker is obviously one of the best hackers ever. It's only going to get worse and worse, duh, and there is nothing you can do about it! That's why you should hate hackers. Hackers ruin our country. Hackers. Hackers. Blah, blah, blah.

Shut up, will you? I'm sick of people using the word "hacker" is such false ways. You're making your self sound like a complete idiot. Learn how to read your own logs. Look through the HTTP requests your web server recieved to get a better understanding of what exactly happened. As long as your running the current release of SMF, no, there aren't going to be any huge security holes (discluding zero-days).

Yeah, sure. I'll take an FTP account. I could use one for my warez. </sarcasim>.

Offline Reverend Greed

  • PLA Guru
  • *****
  • Posts: 224
  • 1337 13V3L: +42/-7
Re: Reverend greed Help
« Reply #3 on: August 30, 2006, 10:05:00 PM »
Devilz212 is exactly correct.  Thank you, Devilz212.  There's a huge difference between a hacker and a prankster.  CNN tells society that my dick can hack, but that doesn't mean it's true.

What does your error logs say for SMF?  Also, are you utilizing a host?  If so, obtain logs from them.  Please post this at time of your issue.  Also, bugtraq reports no issues as you describe.  Unless you can you give me exact details that will allow me to duplicate the hack, then your post is completely silly.  Let me know.
Reboot America

Offline Devilz212

  • Senior Phone Loser
  • **
  • Posts: 69
  • 1337 13V3L: +13/-8
Re: Reverend greed Help
« Reply #4 on: August 30, 2006, 10:09:34 PM »
Reverend Greed, I think what you mean to ask is if he is having someone else host the site for him ;). Also, you just agreed with me and then went ahead and called it a "hack".

Offline Reverend Greed

  • PLA Guru
  • *****
  • Posts: 224
  • 1337 13V3L: +42/-7
Re: Reverend greed Help
« Reply #5 on: August 30, 2006, 10:16:28 PM »
No.  I am not sure if it is a hack.  I was making a sarcastic remark regarding CNN and the media as a whole in how hacking is defined. 

And, the duplication remark was towards the symantics.
« Last Edit: August 30, 2006, 10:41:08 PM by Reverend Greed »
Reboot America

Offline silentfreak

  • Junior Phone Loser
  • **
  • Posts: 28
  • 1337 13V3L: +1/-7
Re: Reverend greed Help
« Reply #6 on: August 30, 2006, 10:25:43 PM »
I understand Devil.  I am not making myself out to be an idiot.  Your an idiot for thinking that when I'm merely asking for help.  Sorry for not possessing your knowledge on the matter but what I originally posted it happening.  I am asking for help not critism, asshole.

Offline Reverend Greed

  • PLA Guru
  • *****
  • Posts: 224
  • 1337 13V3L: +42/-7
Re: Reverend greed Help
« Reply #7 on: August 30, 2006, 10:35:13 PM »
What SMF version are you using?
Reboot America

Offline silentfreak

  • Junior Phone Loser
  • **
  • Posts: 28
  • 1337 13V3L: +1/-7
Re: Reverend greed Help
« Reply #8 on: August 30, 2006, 10:37:24 PM »
I'm using 1.0

Offline Reverend Greed

  • PLA Guru
  • *****
  • Posts: 224
  • 1337 13V3L: +42/-7
Re: Reverend greed Help
« Reply #9 on: August 30, 2006, 10:42:41 PM »
Do you have a problem with modifying your forum code for my benefit?
Reboot America

Offline Devilz212

  • Senior Phone Loser
  • **
  • Posts: 69
  • 1337 13V3L: +13/-8
Re: Reverend greed Help
« Reply #10 on: August 30, 2006, 10:43:38 PM »
silentfreak, the way you worded your question won't gain you much respect around here.

I'm still waiting for murd0c to make a comment.

Offline silentfreak

  • Junior Phone Loser
  • **
  • Posts: 28
  • 1337 13V3L: +1/-7
Re: Reverend greed Help
« Reply #11 on: August 30, 2006, 11:00:33 PM »
silentfreak, the way you worded your question won't gain you much respect around here.

I'm still waiting for murd0c to make a comment.

Respect wasn't my goal unless you are affiliated with a gang or something.

You're waiting for someone else to comment?  I think that says a lot about your endeavors.


Reverend Greed, I don't mind.  What's up?

Offline Reverend Greed

  • PLA Guru
  • *****
  • Posts: 224
  • 1337 13V3L: +42/-7
Re: Reverend greed Help
« Reply #12 on: August 30, 2006, 11:10:47 PM »
Okay.  As a troubleshooting measure I want you to modify this code. Open ManageMembers.php and find this:

Code: [Select]
function deleteMembers($users)
{
global $db_prefix, $sourcedir, $modSettings;

Afterwards add this:

Code: [Select]
global $user_info;

if (!is_array($users))
log_error($users . ' has his account deleted. It was deleted by ' . $user_info['name'] . ' (ip: ' . $user_info['ip'] . ')');
else
log_error(implode(',' $users) . ' have had their accounts deleted. It was deleted by ' . $user_info['name'] . ' (ip: ' . $user_info['ip'] . ')');

After making the changes above all deleting events will be in the error log - with the members name and IP address of who did it. This will be a great help. Please let me know of any future developments and post it in this thread so I can analyze.
« Last Edit: August 30, 2006, 11:13:39 PM by Reverend Greed »
Reboot America

Offline rbcp

  • Head Custodian
  • Administrator
  • Ninja Phone Loser
  • *****
  • Posts: 5244
  • 1337 13V3L: +454/-81
  • I'm not stupid! I'm not stupid! Hematology!
    • Homepage
Re: Reverend greed Help
« Reply #13 on: August 31, 2006, 06:43:05 AM »
What if the hacker (yes, hacker) is bypassing SMF altogether and just modifying the MySQL file directly?  Maybe he doesn't have your SMF password.  He has your hosting password or MySQL database password.  Or he's just hax0red your host and has access to all the host's sites.

By the way, where's your board?

CountyKid

  • Guest
Re: Reverend greed Help
« Reply #14 on: August 31, 2006, 08:33:41 AM »
This is surely the most exciting thing that will happened on here this month.


  I am glued to my computer, waiting for the next batch of 1337 0-dai inf0z.

 

SPONSORED LINKS: