China Hack - نوشته شده در (3375 Views)
Senior Member
Astralis
مطلب: 1218
1218
I don't know how they've got it. They messed with member ID #2 and made it admin and went to town.
In the member table, they added:

Code:

Member'sName<script src=removed></script>

How can I go through the database and remove this? They updated MANY fields and columns with this.<
 پیش‌فرض مرتب‌سازی برای تاریخ DESC به معنی جدیدترین است  
 تعداد در صفحه 
نوشته شده در
Forum Admin
HuwR
مطلب: 20611
20611
you will almost certainly need to do this manually, sounds like you also need to ensure you have ALL current patches applied.<
نوشته شده در
Senior Member
Astralis
مطلب: 1218
1218
I have all the patches unless a new one just came out.
Anyhow, could there be a regex to delete everything after the first "<".<
نوشته شده در
Forum Admin
HuwR
مطلب: 20611
20611
not if they have updated many fields and columns, it would be just as quick to do it manually.
There are NO known hacks/issues that will allow someone who is not an admin create one, therefore you must still have an issue that is not patched, or a MOD that requires patching, you need to scour your log files to find out how they managed to change a member to admin<
نوشته شده در
Senior Member
Astralis
مطلب: 1218
1218
Unfortunately I can't access SQL Server logs. Will the info be in IIS Logs?
What should I look for?<
نوشته شده در
Forum Moderator
AnonJr
مطلب: 5768
5768
It would be in the IIS logs. As to what to look for, that's a tougher question...<
نوشته شده در
Senior Member
Astralis
مطلب: 1218
1218
Couldn't there be a simple way to get a script to run through each column, identify where "<scrip" is, cut it, save everything before it and then update the field?
I just don't know what type of regexp would identify that. Otherwise, I could easily write an asp script to do that.<
نوشته شده در
Senior Member
Astralis
مطلب: 1218
1218
This appears to be a Database hack and it seems like they're doing it to many tables, not just the forum table. They seem to know the structure of Snitz, though.<
نوشته شده در
Forum Moderator
AnonJr
مطلب: 5768
5768
Or it could be related to this: [link] For the type of attack Podge mentioned you don't need to know the database structure.
Have you added any MODs? While I won't 100% rule it out, I don't think that a fully patched 3.4.06 forum is vulnerable to that sort of attack.<
نوشته شده در
Senior Member
Astralis
مطلب: 1218
1218
That's exactly what happened. How to stop this??<
نوشته شده در
Snitz Forums Admin
ruirib
مطلب: 26364
26364
If that was the case, seems like they got in using non Snitz code? Do you have non snitz code?<
شما باید یک متن وارد کنید