I thought I'd share what I did to recover from my recent hack, besides the obvious 2 - install all the security fixes, and recover any backups you have.
First thing I've done is remove all admins, including myself. When I need to administrate, I bump my level back up to 3, and turn it off as soon as I'm done. If anyone hacks me in the future, they won't have level 3 access.
Second, I wrote a quick and dirty script using some of the code from the Random Password MOD. This script set everyone's password to a random string. I then required my members to all use the "Forgot my Password" link. Harsh, but necessary in my opinion.
Here's that script:
<%
set my_Conn = Server.CreateObject("ADODB.Connection")
strConnString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath("mydb.mdb") '## MS Access 2000 using virtual path
my_Conn.Open strConnString
memberListSQL = "Select MEMBER_ID from forum_members"
Set memberList = Server.CreateObject("ADODB.Recordset")
memberList.open memberListSQL, my_Conn
Do while NOT memberList.EOF
thisMemberID = memberList.fields("member_ID")
'// Create an array of characters to choose from for the passwords.
'// If you would like to add uppercase letters or high ASCII characters,
'// simply add them to the array, just remember to modify intNumChars
'// variable to match number of characters in the array.
intNumChars = 35
pwArray = Array("a","b","c","d","e","f","g","h","i","j","k","l", _
"m","n","o","p","q","r","s","t","u","v","w","x", _
"y","z","1","2","3","4","5","6","7","8","9")
'// This picks 12 random numbers and pulls corresponding letters from the
'// array. If you want a larger, or smaller, password simply adjust the
'// number of characters you grab.
Randomize
pwd1 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd2 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd3 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd4 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd5 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd6 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd7 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd8 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd9 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd10 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd11 = (Int(((intNumChars - 1) * Rnd) + 1))
pwd12 = (Int(((intNumChars - 1) * Rnd) + 1))
'// Make the password!
strPassword = pwArray(pwd1) & pwArray(pwd2) & pwArray(pwd3) & _
pwArray(pwd4) & pwArray(pwd5) & pwArray(pwd6) & _
pwArray(pwd7) & pwArray(pwd8) & pwArray(pwd9) & _
pwArray(pwd10) & pwArray(pwd11) & pwArray(pwd12)
updateSql = "UPDATE FORUM_MEMBERS SET M_PASSWORD = '" & strPassword & "' WHERE MEMBER_ID = " & thisMemberID
my_Conn.execute(updateSql)
memberList.moveNext
Loop
memberList.Close
Set memberList = Nothing
Response.Write("Finished")
%>
You will need to grab the connection string from your config.asp. Save that code to an ASP page, and only visit the page once.
-Dan
Topic Locked
Posted - 11 May 2002 : 19:43:55
