You are not logged in. Please login or register.
PunBB Forums → PunBB 1.2 discussion → Hacked by Altan
The IP address is: 81.214.28.118
The host name is: dsl.static8121428118.ttnet.net.tr
A big chance for me ... I was surfing on my forum.
In few seconds, he was ADMIN, he has changed MAINTENANCE MODE ...
Waouh ... 1.2.6 > NOT PERFECT about security 
EDIT: http://punbb.org/forums/viewtopic.php?pid=50077#p50077 /Rickard
you have the access.log file from the webhost from him?
It puts this in "MAINTENANCE MODE"
<html>
<head>
<meta http-equiv="Content-Language" content="tr">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Hacked By ALTAN and STEEL</title>
</head><body text="#FF0000" bgcolor="#000000">
<p align="center"><b><font face="Arial Black" size="7">Hacked By ALTAN</font></b></p>
<p align="center">
<img border="0" src="http://n.domaindlx.com/depoaltan/ay01.jpg" width="400" height="262"></p>
<p align="center"><b><font face="Arial Black" size="7">TURKISH HACKER</font></b></p>
<p align="center"><b><font face="Arial Black" size="7">ALTAN AND STEEL</font></b></p>
<p align="center"><b><font face="Arial Black" size="7">altan@sanaldevrim.net</font></b></p></body>
</html>
The IP address is: 81.214.28.118
The host name is: dsl.static8121428118.ttnet.net.tr
I just had the same IP signup as a user, deleted him from my forum.
Good catch!!
PS. I disabled registrations for now
this is the same one that made the shit in the 1.2.5 release
Like HCGTV, I have disabled registration. (I'm under 1.2.6)
Rod, over the last few days I've seen quite a lot of new registrations on my forum.
So I went ahead and cleared those users out who have registered this month, just to be one the safe side. I figure if you register and never sign on and make a post, then why register.
Euh .... very "good" news for me ... HE has erased 2 Forums ... mmmmmmmmmmmm (no backup, of course)
Has a vunerability been posted on any of the security sites ?
If there is a vunerability in 1.2.6 you'd expect this site to be 'attacked'..
Maybe it's a fault in one of the mods...
I have few mods installed ... the only thing abou security is I wanted to use my header.inc from nucleus to punBB ... but it's not with this an user can register directly in ADMIN mode ... I don't know, the mods I have are
- bbcode
As you can see ... nothing.
When Rickard will read this post, I can able to send him (or Smartys ? The Anti Hacker ) my whole forum to see where it's wrong (maybe my fault, or another thing ?)
Rod, over the last few days I've seen quite a lot of new registrations on my forum.
So I went ahead and cleared those users out who have registered this month, just to be one the safe side. I figure if you register and never sign on and make a post, then why register.
The same thing happened to me earlier today on one of my test forums. The moron had also created around 13000 empty topics in the forum. He never managed to gain admin status though.. I did allow people to register without verification though.
The mail adresses entered are mostly just a random bunch of characters, like d8jvackgi@ii7ia.org
IP Adress: 206.51.233.215
He also create about 25380 fake user names.. All from the same IP.
Is it possible to ban an IP address instead of an already-registered username? I'd like to get proactive about this...
Is it possible to ban an IP address instead of an already-registered username? I'd like to get proactive about this...
Yes, just leave username blank.
I have few mods installed ... the only thing abou security is I wanted to use my header.inc from nucleus to punBB ... but it's not with this an user can register directly in ADMIN mode ... I don't know, the mods I have are
- bbcodeAs you can see ... nothing.
When Rickard will read this post, I can able to send him (or Smartys ? The Anti Hacker
Anti hacker? how kind 
Yeah, feel free to send me a copy (my email address). Also, like Frank said, if you have an access.log file, send it to me (feel free to save me some time and only include stuff for his IP)
ghotistix wrote:Is it possible to ban an IP address instead of an already-registered username? I'd like to get proactive about this...
Yes, just leave username blank.
Thanks. I should have looked a bit closer at the bans area... 
Until we figure out what's happening, I'd recommend anyone with apache to add the following to their .htaccess file:
<Files ~ "(config.php|register.php|.htaccess)$">
Order allow,deny
Deny from all
</Files>I just realised that I have seven defaced/hacked installs. They are all old test versions which I was too lazy to delete. It is nice to know that some idiot hacker has totally wasted his time hacking a bunch of obsolete test boards.
I just realised that I have seven defaced/hacked installs. They are all old test versions which I was too lazy to delete. It is nice to know that some idiot hacker has totally wasted his time hacking a bunch of obsolete test boards.
Well, my test board was 1.2.6, so it's not just the obsolete versions though..
CodeXP: Do you have access logs from it that I could take a look at?
Incidentally, a search for recent registrations here shows up the same pattern as described by CodeXP.
CodeXP: Do you have access logs from it that I could take a look at?
Sure, I just downloaded the log for yesterday (apparently that's when it happened, I just noticed it earlier today):
Here's what keeps repeating over and over again:
206.51.233.215 - - [22/Aug/2005:18:27:40 -0500] "POST /register.php?action=register HTTP/1.1" 200 850 "-" "Java/1.5.0_03"
206.51.233.215 - - [22/Aug/2005:18:27:40 -0500] "POST /login.php?action=in HTTP/1.1" 200 894 "-" "Java/1.5.0_03"
206.51.233.215 - - [22/Aug/2005:18:27:40 -0500] "POST /post.php?action=post&fid=7 HTTP/1.1" 200 860 "-" "Java/1.5.0_03"Just with different fid every now and then. Let me know if you need the complete file.
Thx,
I blocked my one forum for now, the other one is invitation only anyway (and I do not think this guy'll get one )
If this is really an issue in 1.2.6 still - that's bad news....
maybe you post the relevant parts of your access log here? (only the relevant parts of course...)
The more people can have a look the sooner maybe a solution can be found.
Hmm. I wish I knew the way in which he gained access. I know of one potential security problem with 1.2.6, but it would not allow anyone to gain administrator access in the way this has gone down. I would love to have some access logs to look at. For those of you affected, I would love to have a look at your 1.2.6 installs. Who knows, maybe you forgot to apply a fix or something.
Incidentally, a search for recent registrations here shows up the same pattern as described by CodeXP.
In these forums?
There must be some unforseen variables that are allowing acess to thes scriptkiddies. Maybe certain mods/plugins could leave a door open? Or possibly, server varaiables? I would think that fourms.punbb.org would be the main target to take down, seeing it is one of the largest punbb forums, and also most recognized (as each instance of punbb forums linkes to this board). Because they have not bothered with this site, there must be something that Rickard has done that the others have not. As code xp pointed out, its not limited to old versions.
PunBB Forums → PunBB 1.2 discussion → Hacked by Altan
Powered by PunBB, supported by Informer Technologies, Inc.