Someone hacked my admin

Nuke Cadet Joined: Feb 11, 2005 Posts: 3

Hi,

Someone hacked my admin and now i cannot log into my own god admin with the user name and password i used before. Please help me sort this out - i cannot lose my website. I really dont know how to resolve this and i have no control over my website.

Thanks - please help asap.

Posted: Fri Feb 11, 2005 9:24 pm

Ok, ER cure.
step 1: open your phpmyadmin
step 2: clear nuke_authors field
step 3: locate your http://www.your-nuke-domain/admin.php
step 4: you will see the first admin ID creation message on the screen. Create it as quickly as possible.
step 5: Done.

Post ER cure.
step 1: install the most recent patches for your phpnuke version (immediately do it).
step 2: move admin.php file to another location (or different name if you are using phpnuke 7.6).
step 3: install a protection system: one of .... sentinel, admin secure, protector etc.
step 4: trace the hacker's IP address. Then ban it with C class range.

Post-Post ER cure.
Extract web-server (i.e., apache) log and post it to nukecops.com. then the nukecops.com supportive friends (I believe they are so kind and friendly, they are really your friends) will give you additional comments on it.

I hope your site will be back with no loss.

Nuke Soldier Joined: Feb 08, 2005 Posts: 15

What if.....

You emty your authors table then when you goto admin.php you create an admin.

It takes you to admin login, you type in the the name and pass you just created and then it takes you back to the create admin screen.

Im having a problem similar to this except its not letting me create any new admins.

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

I have the same problem at http://www.aalborgbasket.dk/index.php

What can i do?

I have deleted the nuke_authors field but when i try to make a new admin account i get the same problem as _MP

How do i get rid of the hacker message?

I really really hope you guys can help me out here!!

Posted: Sun Feb 20, 2005 11:37 am

stritomania wrote:

I have the same problem at http://www.aalborgbasket.dk/index.php

What can i do?

I have deleted the nuke_authors field but when i try to make a new admin account i get the same problem as _MP

How do i get rid of the hacker message?

I really really hope you guys can help me out here!!

Hi, Stritomania.
Answers to the following questions:

1) Did you authors field empth?
2) if so, did you create a new authors ID?
3) if so, did you delete message block in admin CP ?

That's it.
Go ahead to put security patches & protection scripts as soon as possible.

IF you are still conflicts, then PM me.
Actually, that hacking is the most rudimental hacking. If you got hacked by such stupid turkishes, then you did not do anything to procted your sites. This time add secure patches & protectors. Those hacker are so stupid baby hecking....

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

Thanks Xyberian!

I guess i misundestod your first post and deleted the authors field instead of clearing it... !?!

How can i make it again in mysql database?

Sorry, i am very new to this system, thanks again Smile

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

and also, how can i get my front (index) page back to normal again?

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

Xyberian wrote:

This time add secure patches & protectors. Those hacker are so stupid baby hecking....

What kind of software should i install?
I have installed Protector but was hacked again just 30 minutes ago!?! ;o(

Site Admin Joined: Aug 17, 2003 Posts: 12482

Hacked again? Did you read the sticky? http://www.nukecops.com/postt32206.html

Did you update all your software? That includes the Patched files, the BBToNuke packages to 2.0.13, etc

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

Evaders99 wrote:

Hacked again? Did you read the sticky? http://www.nukecops.com/postt32206.html

Did you update all your software? That includes the Patched files, the BBToNuke packages to 2.0.13, etc

When i try to update my patched files and BBToNuke packages (downloaded from http://cvs.sourceforge.net/viewcvs.py/nukepatched/74patched/)

i can't use the admin controlpanel.... only two buttons are avalible (calender and log off) all the other buttons are gone... what can i do?

Site Admin Joined: Aug 17, 2003 Posts: 12482

Clear your authors table and create a new God account

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

Evaders99 wrote:

Clear your authors table and create a new God account

serious?.... do you think that could be the problem?

Site Admin Joined: Aug 17, 2003 Posts: 12482

You are talking about hacked.. if a site were hacked, that'd be the first thing compromised. With the God account, you'll have access to everything in your admin panel.

Nuke Soldier Joined: Dec 02, 2004 Posts: 17

Evaders99 wrote:

You are talking about hacked.. if a site were hacked, that'd be the first thing compromised. With the God account, you'll have access to everything in your admin panel.

yes but when i tjek the authers field in the MySql database there is only the 3 admins i made... and before i installed the patched files and update i had acces to alle the icons in the admin page. I have just reinstalled my backup of the old not pached files and now i have access to alle the icons in the admin menu again....!?!

Captain Joined: Apr 30, 2004 Posts: 561

stritomania...... Evaders99 led you astray......

Your problem has nothing to do with being hacked. Your problem is with the patched files. If you did not replace the patched file properly, or if you hand coded it, you may have made a mistake in the admin/ case, link, and/or module files.

What will happen is if an admin link for the Administration Menu is not right, Nuke will not display the rest of the admin icons.

This is why when you removed the patched files, all the admin icons and links came back in the Administration Menu.

I had the same problem......

Not all things can be blamed on being hacked...... Your first clue should have been when you changed files..... sorry that Evaders99 did not consider that.

PLEASE, load the patched files..... but be aware that if you have a problem, and the admin links are not showing..... first look at the admin link AFTER the one that is showing. That link most likely is not right.