Portal wurde gehackt

Fragen zur Bedienung von phpBB 3.0.x, Probleme bei der Benutzung und alle weiteren Fragen inkl. Update auf die neuste phpBB 3.0.14 Version
Forumsregeln
phpBB 3.0 hat das Ende seiner Lebenszeit überschritten
phpBB 3.0 wird nicht mehr aktiv unterstützt. Insbesondere werden - auch bei Sicherheitslücken - keine Patches mehr bereitgestellt. Der Einsatz von phpBB 3.0 erfolgt daher auf eigene Gefahr. Wir empfehlen einen Umstieg auf die neuste phpBB-Version, welches aktiv weiterentwickelt wird und für welches regelmäßig Updates zur Verfügung gestellt werden.
bodensee
Mitglied
Beiträge: 25
Registriert: 30.12.2009 21:48

Re: Portal wurde gehackt

Beitrag von bodensee »

RubberDuck hat geschrieben:Kann es sein das "nur" die index.php verändert wurden und der Rest noch vorhanden ist? Die index.php vom phpBB würde was anderes ausgeben wenn diese nicht verändert wurde.
Also wenn ich in der index.php nach "Hacked" suche, wird nichts gefunden. Auf was für Veränderungen sollte man denn da achten?
Da ich keine Entwickler bin, poste ich hier mal den Inhalt der index.php:

Code: Alles auswählen

<?php
/**
*
* @package phpBB3
* @version $Id: index.php 9614 2009-06-18 11:04:54Z nickvergessen $
* @copyright (c) 2005 phpBB Group
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
*
*/

/**
*/

/**
* @ignore
*/
define('IN_PHPBB', true);
$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.' . $phpEx);
include($phpbb_root_path . 'includes/functions_display.' . $phpEx);

// Start session management
$user->session_begin();
$auth->acl($user->data);
$user->setup('viewforum');

display_forums('', $config['load_moderators']);

// Set some stats, get posts count from forums data if we... hum... retrieve all forums data
$total_posts	= $config['num_posts'];
$total_topics	= $config['num_topics'];
$total_users	= $config['num_users'];

$l_total_user_s = ($total_users == 0) ? 'TOTAL_USERS_ZERO' : 'TOTAL_USERS_OTHER';
$l_total_post_s = ($total_posts == 0) ? 'TOTAL_POSTS_ZERO' : 'TOTAL_POSTS_OTHER';
$l_total_topic_s = ($total_topics == 0) ? 'TOTAL_TOPICS_ZERO' : 'TOTAL_TOPICS_OTHER';

// Grab group details for legend display
if ($auth->acl_gets('a_group', 'a_groupadd', 'a_groupdel'))
{
	$sql = 'SELECT group_id, group_name, group_colour, group_type
		FROM ' . GROUPS_TABLE . '
		WHERE group_legend = 1
		ORDER BY group_name ASC';
}
else
{
	$sql = 'SELECT g.group_id, g.group_name, g.group_colour, g.group_type
		FROM ' . GROUPS_TABLE . ' g
		LEFT JOIN ' . USER_GROUP_TABLE . ' ug
			ON (
				g.group_id = ug.group_id
				AND ug.user_id = ' . $user->data['user_id'] . '
				AND ug.user_pending = 0
			)
		WHERE g.group_legend = 1
			AND (g.group_type <> ' . GROUP_HIDDEN . ' OR ug.user_id = ' . $user->data['user_id'] . ')
		ORDER BY g.group_name ASC';
}
$result = $db->sql_query($sql);

$legend = array();
while ($row = $db->sql_fetchrow($result))
{
	$colour_text = ($row['group_colour']) ? ' style="color:#' . $row['group_colour'] . '"' : '';
	$group_name = ($row['group_type'] == GROUP_SPECIAL) ? $user->lang['G_' . $row['group_name']] : $row['group_name'];

	if ($row['group_name'] == 'BOTS' || ($user->data['user_id'] != ANONYMOUS && !$auth->acl_get('u_viewprofile')))
	{
		$legend[] = '<span' . $colour_text . '>' . $group_name . '</span>';
	}
	else
	{
		$legend[] = '<a' . $colour_text . ' href="' . append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=group&g=' . $row['group_id']) . '">' . $group_name . '</a>';
	}
}
$db->sql_freeresult($result);

$legend = implode(', ', $legend);

// Generate birthday list if required ...
$birthday_list = '';
if ($config['load_birthdays'] && $config['allow_birthdays'])
{
	$now = getdate(time() + $user->timezone + $user->dst - date('Z'));
	$sql = 'SELECT u.user_id, u.username, u.user_colour, u.user_birthday
		FROM ' . USERS_TABLE . ' u
		LEFT JOIN ' . BANLIST_TABLE . " b ON (u.user_id = b.ban_userid)
		WHERE (b.ban_id IS NULL
			OR b.ban_exclude = 1)
			AND u.user_birthday LIKE '" . $db->sql_escape(sprintf('%2d-%2d-', $now['mday'], $now['mon'])) . "%'
			AND u.user_type IN (" . USER_NORMAL . ', ' . USER_FOUNDER . ')';
	$result = $db->sql_query($sql);

	while ($row = $db->sql_fetchrow($result))
	{
		$birthday_list .= (($birthday_list != '') ? ', ' : '') . get_username_string('full', $row['user_id'], $row['username'], $row['user_colour']);

		if ($age = (int) substr($row['user_birthday'], -4))
		{
			$birthday_list .= ' (' . ($now['year'] - $age) . ')';
		}
	}
	$db->sql_freeresult($result);
}

// Assign index specific vars
$template->assign_vars(array(
	'TOTAL_POSTS'	=> sprintf($user->lang[$l_total_post_s], $total_posts),
	'TOTAL_TOPICS'	=> sprintf($user->lang[$l_total_topic_s], $total_topics),
	'TOTAL_USERS'	=> sprintf($user->lang[$l_total_user_s], $total_users),
	'NEWEST_USER'	=> sprintf($user->lang['NEWEST_USER'], get_username_string('full', $config['newest_user_id'], $config['newest_username'], $config['newest_user_colour'])),

	'LEGEND'		=> $legend,
	'BIRTHDAY_LIST'	=> $birthday_list,

	'FORUM_IMG'				=> $user->img('forum_read', 'NO_NEW_POSTS'),
	'FORUM_NEW_IMG'			=> $user->img('forum_unread', 'NEW_POSTS'),
	'FORUM_LOCKED_IMG'		=> $user->img('forum_read_locked', 'NO_NEW_POSTS_LOCKED'),
	'FORUM_NEW_LOCKED_IMG'	=> $user->img('forum_unread_locked', 'NO_NEW_POSTS_LOCKED'),

	'S_LOGIN_ACTION'			=> append_sid("{$phpbb_root_path}ucp.$phpEx", 'mode=login'),
	'S_DISPLAY_BIRTHDAY_LIST'	=> ($config['load_birthdays']) ? true : false,

	'U_MARK_FORUMS'		=> ($user->data['is_registered'] || $config['load_anon_lastread']) ? append_sid("{$phpbb_root_path}index.$phpEx", 'hash=' . generate_link_hash('global') . '&mark=forums') : '',
	'U_MCP'				=> ($auth->acl_get('m_') || $auth->acl_getf_global('m_')) ? append_sid("{$phpbb_root_path}mcp.$phpEx", 'i=main&mode=front', true, $user->session_id) : '')
);

// BEGIN mChat Mod
if(!defined('MCHAT_INCLUDE') && $config['mchat_on_index'] && $config['mchat_enable'] && $auth->acl_get('u_mchat_view'))
{
	define('MCHAT_INCLUDE', true);
	$mchat_include_index = true;
	include($phpbb_root_path.'mchat.'.$phpEx);
}
// END mChat Mod
// Output page
page_header($user->lang['INDEX']);

$template->set_filenames(array(
	'body' => 'index_body.html')
);

page_footer();

?>
Wobei ich ausschliessen möchte, dass da etwas nicht passt, da ich ja das gehackte Forum bzw. das Verzeichnis umbenannt habe und ein älteres Verzeichnis, das rein nur das Forum beinhaltet verwende und ich ja wie beschrieben nicht auf den Adminbereich zugreifen kann.
bodensee
Mitglied
Beiträge: 25
Registriert: 30.12.2009 21:48

Re: Portal wurde gehackt

Beitrag von bodensee »

DeepSurfer hat geschrieben:Linux oder WIN Server ?
Hast Du bei einem Linux Server einen Konsolen Zugang (Putty) ?
Zwar handelt es sich um einen Linux Server, leider habe ich weder ssh noch telnet Zugriff darauf.

Also habe ich das gehackte Verzeichnis per FTP auf meinen Rechner übertragen.
und versucht mit
- mal mit

Code: Alles auswählen

find /complete-server-path/to forum/ * | grep 'hacked'
wenn es eine HTML bzw. PHP Anweisung ist, dann wird Dir diese hiermit angezeigt welche Datei dafür verantwortlich ist.
etwas zu finden, doch leider keinen Erfolg.
Wobei mir jetzt nicht ganz klar ist, mit find lassen sich doch nur Dateien selbst suchen und nicht deren Inhalte durchsuchen?

Dafür war ich mit
egrep -rni -e "hacked" ./forum_hacked
erfolgreicher:

Code: Alles auswählen

./forum_hacked/images/geomap/map.html:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_ranks.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_prefs_view.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.recent.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_memberlist_leaders.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_confirm_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_bbcodes.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_permissions.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.login_box.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_pm_layout.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.jumpbox.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.birthday_list.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.search.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_prefs_post.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.mini_calendar.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_warnings.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_ban.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_viewonline_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.change_style.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_history.html.php:1:Hacked ByLenis
./forum_hacked/cache/data_disallowed_usernames.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_main_subscribed.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_queue.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_memberlist_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.custom_center.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_custom_profile_fields.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.general_block.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.whois_online.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.main_menu.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_profile_reg_details.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_attachments.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.statistics.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_attachments.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.announcements_compact.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_confirm_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.donation_small.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_attachment.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_buttons.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_forums.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_main.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_zebra_foes.html.php:1:Hacked ByLenis
./forum_hacked/cache/data_role_cache.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_overall_footer.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_message_footer.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_topic_review.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.leaders_ext.html.php:1:Hacked ByLenis
./forum_hacked/cache/data_modules_mcp.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_warn_front.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_zebra_friends.html.php:1:Hacked ByLenis
./forum_hacked/cache/sql_715a222fdfe625c64a476a3d0701ff0d.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.latest_members.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_main_drafts.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_prefs_personal.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_viewtopic_print.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.portal_right.html.php:1:Hacked ByLenis
./forum_hacked/cache/sql_09e8507fa4de27ff8b346bfeae85c9b8.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_footer.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_geomap_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.clock.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.online_friends.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_styles.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_simple_footer.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_custom_profile_fields.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ajax_geoinfo.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_reports.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.news_compact.html.php:1:Hacked ByLenis
./forum_hacked/cache/data_modules_ucp.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_groups_manage.html.php:1:Hacked ByLenis
./forum_hacked/cache/sql_f0bf07fa26cf046860a9b00132ec37bd.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_register.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_update.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_permission_mask.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.latest_bots.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.leaders.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_logs.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_profile.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mchat_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_message_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_captcha_default.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_notes_user.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_overall_header.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_main_bookmarks.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_viewfolder.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_resend.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_permission_roles.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_front.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_portal.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_viewmessage.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_message_header.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.attachments.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_quickreply_editor.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_avatar.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.additional_blocks_right.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_jabber.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_warn_post.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_memberlist_view.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.custom_small.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.forumlist_search.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_editor.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.link_us.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_feedback.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.donation.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.top_poster.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_viewtopic_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_jumpbox.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_index_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_forumlist_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_overall_footer.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_preview.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.user_menu.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_drafts.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.announcements.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.links.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_logs.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.portal_center.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_prefs.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_faq_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_icons.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_viewonline_whois.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_smilie_creator.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.welcome.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_warn_user.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_attach_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_options.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_de-email_user_welcome_inactive.txt.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_layout.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_notes_front.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_pm_popup.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_main_front.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_profile_avatar.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_header.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal._block_config.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_search_results.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_header.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_topic.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_.portal.portal_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_board.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.additional_blocks_center.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_poll_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_avatar_options.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_message_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_groups_membership.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_memberlist_search.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_signature.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_permission_roles_mask.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_de-email_topic_notify.txt.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_overall_header.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_login_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_footer.html.php:1:Hacked ByLenis
./forum_hacked/cache/sql_3eaaf5f2ab4911a8949d84c653b4b454.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.news.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_move.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_agreement.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.random_member.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_posting_review.html.php:1:Hacked ByLenis
./forum_hacked/cache/data_modules_acp.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_de-email_privmsg_notify.txt.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_mcp_warn_list.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_groups.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_simple_header.html.php:1:Hacked ByLenis
./forum_hacked/cache/sql_021151d1a377d62dbfaa89a4d1acc716.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_profile_signature.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.poll.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.portal_left.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_profile_profile_info.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_viewforum_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.additional_blocks_left.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_portal.block.wordgraph.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_search_body.html.php:1:Hacked ByLenis
./forum_hacked/cache/tpl_prosilver_ucp_remind.html.php:1:Hacked ByLenis
./forum_hacked/cache/ctpl_admin_acp_users_overview.html.php:1:Hacked ByLenis
Aber es handelt sich dabei ja "nur" um Cache dateien.
RubberDuck
Mitglied
Beiträge: 460
Registriert: 09.07.2003 16:52
Wohnort: ROW
Kontaktdaten:

Re: Portal wurde gehackt

Beitrag von RubberDuck »

Bis auf
./forum_hacked/images/geomap/map.html:1:Hacked ByLenis
sind das alles Dateien im Cache. Die sollte man Löschen können.

Was das mit dem Geomap aufsich hat, kann ich Dir aber leider nicht sagen.

Was hat denn die Auswertung der Serverlogs ergeben?
VARAN-eV.de - V.A.R.A.N. e.V. - Verein für Artenschutz der Reptilien- und Amphibienhalter Norddeutschlands
Terra-Nord.de - Der Terraristik Stammtisch im Norden
ReptilienManager.de - Die Online Reptilien Verwaltung
bodensee
Mitglied
Beiträge: 25
Registriert: 30.12.2009 21:48

Re: Portal wurde gehackt

Beitrag von bodensee »

RubberDuck hat geschrieben:Bis auf
./forum_hacked/images/geomap/map.html:1:Hacked ByLenis
sind das alles Dateien im Cache. Die sollte man Löschen können.

Was das mit dem Geomap aufsich hat, kann ich Dir aber leider nicht sagen.

Was hat denn die Auswertung der Serverlogs ergeben?
Ich denke ich werde geomap mal deaktivieren, die Cache Files löschen und sehen ob ich mehr finde.

Leider waren die Serverlogs bisher nicht so recht zugänglich.
Benutzeravatar
bantu
Server-Team
Beiträge: 7311
Registriert: 25.04.2006 16:12
Wohnort: Karlsruhe

Re: Portal wurde gehackt

Beitrag von bantu »

Wurde die Datei "./forum_hacked/images/geomap/map.html" von dir hochgeladen oder vom Webserver angelegt. Wer ist der Besitzer der Datei?
Powered by Coffee
MK-M
Mitglied
Beiträge: 29
Registriert: 31.12.2008 16:57
Kontaktdaten:

Re: Portal wurde gehackt

Beitrag von MK-M »

Hallo,

in der map.html stehen die Daten der User, die sich mit PLZ anzeigen lassen, drin. Die Datei wird vom Programm/Addon erzeugt und auf den Server gespeichert.

z.B. hier von mir ( Auszug vom Datenformat ) zum vergleichen:

Code: Alles auswählen

<area shape="circle" coords="305,260, 4" href="./geomap.php?mode=search&land=1&plz=38550&distance=0&sid={U_SESSION_ID}" alt="petra (Isenbüttel)" title="petra (Isenbüttel)" onmouseover="show_geo_popup('38550','1')" onmouseout="close_geo_popup()" />
<area shape="circle" coords="313,233, 5" href="./geomap.php?mode=search&land=1&plz=29378&distance=0&sid={U_SESSION_ID}" alt="MK-M [Administrator] (in der Südheide)" title="MK-M [Administrator] (in der Südheide)" onmouseover="show_geo_popup('29378','1')" onmouseout="close_geo_popup()" />
Hoffe es hilft hier weiter?

LG

MK-M
Benutzeravatar
bantu
Server-Team
Beiträge: 7311
Registriert: 25.04.2006 16:12
Wohnort: Karlsruhe

Re: Portal wurde gehackt

Beitrag von bantu »

Ich vermute, da lediglich Dateien geändert wurden, die vom Webserverbenutzer erstellt wurden, dass die Dateien über den Account eines anderen Benutzers des selben Webhostings verändert wurden. Eventuell hatte der dann eine Sicherheitslücke in seiner Software. Wenn das so ist, handelt es sich auf jedenfall nicht um ein sehr gelungenes Webserversetup deines Providers.
Powered by Coffee
Antworten

Zurück zu „[3.0.x] Administration, Benutzung und Betrieb“