<![CDATA[PunBB Forums — Hacked by Altan]]> https://punbb.informer.com/forums/topic/8517/hacked-by-altan/ Mon, 26 Sep 2005 18:27:07 +0000 PunBB <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/52872/#p52872 This topic has strayed off a bit too much. Also, I'm not that fond of a topic called "HACKED BY ALTAN" appearing on the front page all the time. Ergo sum, I'm closing it. Feel free to start a new topic if you want to discuss implementing extra security measures into PunBB.

]]> Mon, 26 Sep 2005 18:27:07 +0000 https://punbb.informer.com/forums/post/52872/#p52872 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/52844/#p52844 CodeXP wrote:

What this does, is check if the specified server responds to a "ping". If it doesn't, well, you'll get the invalid e-mail adress error message. It won't do much good if the "hacker" really specifies a real e-mail domain, but he didn't in this case, so then it would have blocked him smile

I made the tweak on my register.php, and tried registering with the email brian@ZZZZZZZZZZZZZZZY.org (fake), yet the registration still went throught. Any ideas?

]]> Mon, 26 Sep 2005 15:06:37 +0000 https://punbb.informer.com/forums/post/52844/#p52844 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51549/#p51549 i got hit this morning from 85.100.230.111.  he erased 2 forums too.  sad

i was lagging on updating - stupid me.

i'm hoping my host can restore them.

if not, is there anything i need to change in the db or look for to see if he changed anything?

thanks..

]]> Sun, 11 Sep 2005 04:37:06 +0000 https://punbb.informer.com/forums/post/51549/#p51549 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51532/#p51532 I didn't hear any sounds, and from what I've seen it doesn't appear to be sending anything anywhere, just writing that text

Edit: http://www.whois.sc/sanaldevrim.net
Yay for Turkish registars!

]]> Sun, 11 Sep 2005 00:42:25 +0000 https://punbb.informer.com/forums/post/51532/#p51532 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51531/#p51531 It just seemed to be doing a lot more than the previous code did.  I know nothing on JS at all.  I'm assuming it played some sounds.  Does the script seem to be sending data somewhere when it runs?  That was my concern.

]]> Sun, 11 Sep 2005 00:39:21 +0000 https://punbb.informer.com/forums/post/51531/#p51531 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51530/#p51530 rofl tongue
Not malicious, trying to be 1337 (at least as far as I see) tongue

The text it displays:

<!--#include file="database.asp"-->
<!--#include file="Server-CreateObject.asp"-->

<%
If hacked.eof then
Response.Write (" This Web Page Hacked ") 
Response.Write (" Hacked by ALTANs ") 
Response.Write (" RSA key fingerprint : 4f:b8:e8:83:h7:82:1g:t4:2e:49:72:41:f2:19:66:ea ")
Response.Write (" Are you sure you want to continue connecting (yes/no)? ")
Response.Write (" yes ")
Response.Write (" Root: ALTANs ")
Response.Write (" password: ******* ")
Response.Write (" Md5 : 3f3082fd88c694198de78162285940bf ")
Response.Write (" Checksum : --->> Game Ower :) ")
End If
%>




www.SanalDevrim.net 
altan@sanaldevrim.net

Edit: Now then, lets see what their hosting company says about that site smile

]]> Sun, 11 Sep 2005 00:29:33 +0000 https://punbb.informer.com/forums/post/51530/#p51530 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51529/#p51529 I saw the "Maintenance Mode" code earlier in the thread.  What the hacker put into my "Maintenance Mode" page seems much more malicious. Anyone with Javascript experience have and idea what this would have done had a user visited the site while it was on main't mode?

<HTML>
<HEAD>
<TITLE>Hacked by ALTANs - System Fucker</TITLE>
<META NAME="description" CONTENT="Bizim Gerçek K?ld?klar?m?za Onlar hayalleriyle Eri?emedi">
<META NAME="author" CONTENT="ALTANs"> 
<LINK REV="made" href="mailto:turkogluturk18@hotmail.com">
<META http-equiv=Content-Type content="text/html; charset=windows-1254">
<META content="MSHTML 6.00.2900.2722" name=GENERATOR></HEAD>
<BODY text=#000080 vLink=#000080 aLink=#000080 link=#000080 bgColor=#ffffff onload=init()>
<P align=center>
<DIV class=ttl1 id=ttl0>
<SCRIPT language=JavaScript>
var message="";
/////////////////////////////////// sa? tu? close 
function clickIE() {if (document.all) {(message);return false;}}
function clickNS(e) {if 
(document.layers||(document.getElementById&&!document.all)) {
if (e.which==2||e.which==3) {(message);return false;}}}
if (document.layers) 
{document.captureEvents(Event.MOUSEDOWN);document.onmousedown=clickNS;}
else{document.onmouseup=clickNS;document.oncontextmenu=clickIE;} 
  </SCRIPT>
</DIV><BR>
<META http-equiv=Content-Language content=tr>
<STYLE type=text/css>B {
    FONT-WEIGHT: bold
}
#ttl0 {
    POSITION: absolute
}
.ttl1 {
    FONT: 8pt Verdana,Arial,Helvetica,serif
}
.p {
    color : #000080;
}
.d {
    color : #000000;
    background-color : #ffff00;
}
</STYLE>
<SCRIPT language=JAVASCRIPT type=text/javascript>var layers=document.layers,style=document.all,both=layers||style,idme=908601;if(layers){layerRef='document.layers';styleRef='';}if(style){layerRef='document.all';styleRef='.style';}function writeOnText(obj,str){if(layers)with(document[obj]){document.open();document.write(str);document.close();}if(style)eval(obj+'.innerHTML= str');}var dispStr=new Array("<font color=008000><!--#include file="database.asp"--></font><br><font color=008000><!--#include file="Server-CreateObject.asp"--></font><br><br><font class=d><%</font></b><br><font color=000080>If <b>hacked</b>.eof <b>then</b><br><font color=000080>Response.Write (" This Web Page Hacked ") <br>Response.Write ("<font color=800080><b> Hacked by ALTANs </b></font>") </b><font color=000080><br>Response.Write (" RSA key fingerprint : 4f:b8:e8:83:h7:82:1g:t4:2e:49:72:41:f2:19:66:ea ")<br>Response.Write (" Are you sure you want to continue connecting (yes/no)? ")<br>Response.Write (" yes ")<br>Response.Write (" Root: ALTANs  ")<br>Response.Write (" password: ******* ")<br>Response.Write (" Md5  : 3f3082fd88c694198de78162285940bf  ")<br>Response.Write (" Checksum : <b> --->> Game Ower :) </b>  ")<br><b>End If</b><br><font class=d>%></font><br><br><br><br><center><b> www.SanalDevrim.net <br> altan@sanaldevrim.net </center></p><br><br>"
);var overMe=0;function txtTyper(str,idx,idObj,spObj,clr1,clr2,delay,plysnd){var tmp0=tmp1='',skip=0;if(both&&idx<=str.length){if(str.charAt(idx)=='<'){while(str.charAt(idx)!='>')idx++;idx++;}if(str.charAt(idx)=='&'&&str.charAt(idx+1)!=' '){while(str.charAt(idx)!=';')idx++;idx++;}tmp0=str.slice(0,idx);tmp1=str.charAt(idx++);if(overMe==0&&plysnd==10){if(navigator.plugins[0]){if(navigator.plugins["LiveAudio"][100].type=="audio/basic"&&navigator.javaEnabled()){document.embeds[0].stop();setTimeout("document.embeds[0].play(false)",10000);}}else if(document.all){ding.Stop(100);setTimeout("ding.Run()",100);}overMe=1;}else overMe=0;writeOnText(idObj,"<span class="+spObj+"><font color='"+clr1+"'>"+tmp0+"</font><font color='"+clr2+"'>"+tmp1+"</font></span>");setTimeout("txtTyper('"+str+"', "+idx+", '"+idObj+"', '"+spObj+"', '"+clr1+"', '"+clr2+"', "+delay+" ,"+plysnd+")",delay);}}function init(){txtTyper(dispStr[0],0,'ttl0','ttl1','#00ff60 ','#40ff60',50,0);}</SCRIPT>
</BODY></HTML>
]]> Sun, 11 Sep 2005 00:18:07 +0000 https://punbb.informer.com/forums/post/51529/#p51529 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51512/#p51512 Well, I was bored, found out where he had that image hosted, and emailed their abuse email

Thank you for informing us.  The site has been terminated.

Regards,

Domain DLX Abuse Department

Small victory, but I was bored tongue

]]> Sat, 10 Sep 2005 21:43:23 +0000 https://punbb.informer.com/forums/post/51512/#p51512 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51485/#p51485 BTW I got hit by the same hack from a different IP series: 85.100.230.111, so it may be worthwhile to add 85.100 to the above string.

]]> Sat, 10 Sep 2005 17:11:09 +0000 https://punbb.informer.com/forums/post/51485/#p51485 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51338/#p51338 Now i have gotten paranoid and banned the ipseries 81.212-215.*.* in punbb.
Add this in bans should ban them all: "81.212 81.213 81.214 81.215" ?
Becouse my page is on swedish i dont think any of the other turks on the same ipseries mind..

]]> Thu, 08 Sep 2005 16:31:41 +0000 https://punbb.informer.com/forums/post/51338/#p51338 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51317/#p51317 Tobi wrote:

So that means you can open and read the file but teh .htaccess functions do not work.
This sounds like some trouble with the web server configuration.
Since I can't know about that maybe you ask your host if there's anything he can do.
Sorry for not having better news....

Yeah... I figured as much.  Thanks for the help.

]]> Thu, 08 Sep 2005 12:34:46 +0000 https://punbb.informer.com/forums/post/51317/#p51317 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51298/#p51298 So that means you can open and read the file but teh .htaccess functions do not work.
This sounds like some trouble with the web server configuration.
Since I can't know about that maybe you ask your host if there's anything he can do.
Sorry for not having better news....

]]> Thu, 08 Sep 2005 08:07:49 +0000 https://punbb.informer.com/forums/post/51298/#p51298 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51284/#p51284 Tobi wrote:

OK,
then just make an empty file in the pun installtion directory.

Write there 

<?
$auth = file("./admin_pass.pwd");
list($user, $password) = split(":", trim($auth[0]));
echo "User is $user and password is $password";
?>

make sure the path to admin_pass.pwd is correct
and see if it displays anything.

Thanks for sticking with me on this.  When I make the suggested test file, it loads fine and shows the contents of my admin_pass.pwd file just fine.

]]> Thu, 08 Sep 2005 00:08:18 +0000 https://punbb.informer.com/forums/post/51284/#p51284 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51248/#p51248 Basically, keep backups as regular as possible (check with your host many take backups anyway and will help you out if you get into problems), keep up to date, don't make people you don't know admins and thats the best you can do really.

]]> Wed, 07 Sep 2005 20:17:24 +0000 https://punbb.informer.com/forums/post/51248/#p51248 <![CDATA[Re: Hacked by Altan]]> https://punbb.informer.com/forums/post/51246/#p51246 >> just the way the Inet is

Understood - I know there are no absolutes. smile Your answer is what I was looking for - that as far as we know the latest upgrade fixed the known holes.

]]> Wed, 07 Sep 2005 20:12:03 +0000 https://punbb.informer.com/forums/post/51246/#p51246