Stormgaard Posted July 8, 2006 Share Posted July 8, 2006 I run a WoW/Gaming guild website and woke up to find we'd been hacked by [b]"Turkish Hacker K@lem"[/b] (whoever the f*ck that is). Anyways, I did a quick Google search on "K@lem" and found that he's hit other fantasy/gaming sites before - there are a lot of cached pages out there with examples of his work.Anyone know how to fix the damage he causes?Here's our site: http://www.se7ensamurai.com Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/ Share on other sites More sharing options...
Prismatic Posted July 8, 2006 Share Posted July 8, 2006 Looks like a redirect exploit rather then a hack... Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54778 Share on other sites More sharing options...
Daniel0 Posted July 8, 2006 Share Posted July 8, 2006 I don't know how your site is supposed to look. But I think it's just the title that has been changed, and a news item has been posted on the front page.[b]Edit:[/b] I found this in the source code:[code]<meta http-equiv="refresh" content="10;URL=http://serseri_2784.sitemynet.com/hacked/">[/code] three times after each other. Remove it in the skin and it will be fixed. Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54780 Share on other sites More sharing options...
Prismatic Posted July 8, 2006 Share Posted July 8, 2006 No it's a redirect exploit.. Look in your php-nuke, near the footer of the whole site, you will see 3 lines.[code]<meta http-equiv="refresh" content="10;URL=http://serseri_2784.sitemynet.com/hacked/"> </head><br><meta http-equiv="refresh" content="10;URL=http://serseri_2784.sitemynet.com/hacked/"> </head><br><meta http-equiv="refresh" content="10;URL=http://serseri_2784.sitemynet.com/hacked/"> </head><br>[/code]That right there is what redirects you. I'm guessing he got access to an admin account and posted a custom footer with that info.Hes basically a script kiddy, because any real "hacker" would just totally delete the php-nuke install and upload his own index.html/php ;D Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54781 Share on other sites More sharing options...
Stormgaard Posted July 8, 2006 Author Share Posted July 8, 2006 I was thinking I could just delete the news item, but he's somehow made it that I can't access the admin module. I type in my username and password and once I hit enter it just refreshes all over again, asking for my username and password again. Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54783 Share on other sites More sharing options...
Stormgaard Posted July 8, 2006 Author Share Posted July 8, 2006 He must have had access to the Admin account (though I'm not sure how) - I think he changed my Admin username and Password. Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54785 Share on other sites More sharing options...
Daniel0 Posted July 8, 2006 Share Posted July 8, 2006 Change it again in the database. You just need to know how it's encrypted (most likely MD5 or SHA1). Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54786 Share on other sites More sharing options...
Stormgaard Posted July 8, 2006 Author Share Posted July 8, 2006 This may sound like a dumb question - but how do I do that? Via FTP? Via my Hosting Controller? Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54788 Share on other sites More sharing options...
tomfmason Posted July 8, 2006 Share Posted July 8, 2006 I would contact my host if I were you. They might possibly be able to tell when the last time your site was accessed via ftp then cross reference that with any web static software that you may have like webalizer or urchin. If so you can get there IP address and report them to there ISP. Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54790 Share on other sites More sharing options...
Daniel0 Posted July 8, 2006 Share Posted July 8, 2006 [quote author=Stormgaard link=topic=99872.msg393553#msg393553 date=1152369061]This may sound like a dumb question - but how do I do that? Via FTP? Via my Hosting Controller?[/quote]phpMyAdmin if that is installed. Quote Link to comment https://forums.phpfreaks.com/topic/14026-hacked-by-klem/#findComment-54793 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.