China Hack - Postet den (3374 Views)
Senior Member
Astralis
Innlegg: 1218
1218
I don't know how they've got it. They messed with member ID #2 and made it admin and went to town.
In the member table, they added:

Code:

Member'sName<script src=removed></script>

How can I go through the database and remove this? They updated MANY fields and columns with this.<
   
 Sidestørrelse 
Postet den
Forum Admin
HuwR
Innlegg: 20611
20611
you will almost certainly need to do this manually, sounds like you also need to ensure you have ALL current patches applied.<
Postet den
Senior Member
Astralis
Innlegg: 1218
1218
I have all the patches unless a new one just came out.
Anyhow, could there be a regex to delete everything after the first "<".<
Postet den
Forum Admin
HuwR
Innlegg: 20611
20611
not if they have updated many fields and columns, it would be just as quick to do it manually.
There are NO known hacks/issues that will allow someone who is not an admin create one, therefore you must still have an issue that is not patched, or a MOD that requires patching, you need to scour your log files to find out how they managed to change a member to admin<
Postet den
Senior Member
Astralis
Innlegg: 1218
1218
Unfortunately I can't access SQL Server logs. Will the info be in IIS Logs?
What should I look for?<
Postet den
Forum Moderator
AnonJr
Innlegg: 5768
5768
It would be in the IIS logs. As to what to look for, that's a tougher question...<
Postet den
Senior Member
Astralis
Innlegg: 1218
1218
Couldn't there be a simple way to get a script to run through each column, identify where "<scrip" is, cut it, save everything before it and then update the field?
I just don't know what type of regexp would identify that. Otherwise, I could easily write an asp script to do that.<
Postet den
Senior Member
Astralis
Innlegg: 1218
1218
This appears to be a Database hack and it seems like they're doing it to many tables, not just the forum table. They seem to know the structure of Snitz, though.<
Postet den
Forum Moderator
AnonJr
Innlegg: 5768
5768
Or it could be related to this: [link] For the type of attack Podge mentioned you don't need to know the database structure.
Have you added any MODs? While I won't 100% rule it out, I don't think that a fully patched 3.4.06 forum is vulnerable to that sort of attack.<
Postet den
Senior Member
Astralis
Innlegg: 1218
1218
That's exactly what happened. How to stop this??<
Postet den
Snitz Forums Admin
ruirib
Innlegg: 26364
26364
If that was the case, seems like they got in using non Snitz code? Do you have non snitz code?<
Du må legge inn en melding