MyBB Community Forums › Community Archive › Archived Forums › Archived Development and Support › MyBB 1.6 › 1.6 General Support v
My forum is getting hacked.

Jump to the post that solved this thread.
Thread Rating:
  • 2 Vote(s) - 3 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Threaded Mode
Solved: 13 Years, 3 Weeks ago My forum is getting hacked.
-=WFS-= Offline
Posts: 4
Threads: 1
Joined: Dec 2011
Reputation: 0
#1
Solved: 13 Years, 3 Weeks ago 2011-12-25, 04:51 AM (This post was last modified: 2011-12-25, 05:00 AM by -=WFS-=.)
Hello,

My forum is getting hacked. Someone is able to access my server files and injecting a file xalled index.shtml so that my home page is getting defaced. I am removing that file from server but still those hackers are able to access my server. I am even changing my server, admin cp password every time but still they are able to inject that file. I have upgraded from 1.6.4 to 1.6.6 but still it gets hacked.

my forum url is www.worldforstudents.in

Here is the screenshot [Image: 3433642735.jpg]

please let me know what I have to do to prevent this.
Find
Richard Offline
Posts: 536
Threads: 20
Joined: Aug 2010
Reputation: 7
#2
Solved: 13 Years, 3 Weeks ago 2011-12-25, 04:59 AM (This post was last modified: 2011-12-25, 05:00 AM by Richard.)
List of plugins you're running?
Have you scanned your computer for malicious programs?
Skip the B.S, Host MyBB caters to MyBB.
Website Find
-=WFS-= Offline
Posts: 4
Threads: 1
Joined: Dec 2011
Reputation: 0
#3
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:07 AM (This post was last modified: 2011-12-25, 05:14 AM by -=WFS-=.)
(2011-12-25, 04:59 AM)Richard Wrote: List of plugins you're running?
Have you scanned your computer for malicious programs?

Currently no plugins running.
Here is a screenshot of plugins which I used to run before my forum got hacked. But now i disabled them all
[Image: 7040869703.png]
Yes I did scanned.. No malicious programs found.
Find
ranjani Offline
Posts: 5,871
Threads: 10
Joined: May 2009
Reputation: 625
#4
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:24 AM
appears to be not infected at present . however run file verification tool from tools & maintenance
section of admin panel to check for any changed files . also check server logs for any malicious
activity . contact your web host and ask to check for any malicious scripts ..
Find
Yaldaram Offline
Posts: 13,283
Threads: 159
Joined: Oct 2010
Reputation: 1,291
#5
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:28 AM
Your site has been recovered. Make sure your passwords for AdminCP and Cpanel are strong enough to break.
[Image: 16mJ9bI]
MyBBsmsAPP | MyStatus | ProProfile
Website Find
-=WFS-= Offline
Posts: 4
Threads: 1
Joined: Dec 2011
Reputation: 0
#6
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:30 AM (This post was last modified: 2011-12-25, 05:36 AM by -=WFS-=.)
(2011-12-25, 05:24 AM)ranjani Wrote: appears to be not infected at present . however run file verification tool from tools & maintenance
section of admin panel to check for any changed files . also check server logs for any malicious
activity . contact your web host and ask to check for any malicious scripts ..

I did verify and removed the files he uploaded to my server, changed all the passwords. But still its getting hacked.
(2011-12-25, 05:28 AM)Yaldaram Wrote: Your site has been recovered. Make sure your passwords for AdminCP and Cpanel are strong enough to break.

yes, it got recovered because I removed the files which he injected but after some time it will get hacked again. This is happening to me from last 7 days. I remove the injected files and again after some time he will inject the same again...
Find
Nathan Malcolm Away

Former Staff
Posts: 13,646
Threads: 220
Joined: May 2010
Reputation: 550
#7
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:48 AM
It might have nothing to do with your hosting account. If the hacker has rooted the server, or has a shell uploaded on another account then it's up to the host to sort out. They're the best people to contact in this situation. The server logs will provide detailed information about why your forum keeps being defaced.
No longer involved in the MyBB project.
Find
Yaldaram Offline
Posts: 13,283
Threads: 159
Joined: Oct 2010
Reputation: 1,291
#8
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:49 AM
Make sure your passwords are strong as I suggested earlier. If he is injecting again and again then he is probably breaking the passwords.
[Image: 16mJ9bI]
MyBBsmsAPP | MyStatus | ProProfile
Website Find
-=WFS-= Offline
Posts: 4
Threads: 1
Joined: Dec 2011
Reputation: 0
#9
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:53 AM
(2011-12-25, 05:49 AM)Yaldaram Wrote: Make sure your passwords are strong as I suggested earlier. If he is injecting again and again then he is probably breaking the passwords.

Yes I do use strong passwords and change them every time after recovering my site..
Find
crazy4cs Offline

Big Board Owner
Posts: 4,385
Threads: 162
Joined: Jul 2010
Reputation: 138
#10
Solved: 13 Years, 3 Weeks ago 2011-12-25, 05:54 AM
This user has been denied support. This user has been denied support.
Hmm, you are shelled, lol. Kids these days finds your shared server, finds one week potentially vulnerable site, exploits them, uploads shell, and roots server. Some of them buy specially a hosting account on your host's server and does this.

Similar was happening to me on both shared servers, both got rooted, I finally thought it enough and moved to VPS.

If there is even one shell left in your account, they'd hack again and again, if you do not have much plugins or extra files, delete every file and re-upload them manually, otherwise it'd be very hard to search for a shell.

And also ask your host about this.
Z5T - Dynamic URL Shortener
My Plugins & Themes
Find
Jump to the post that solved this thread.


Forum Jump:


Users browsing this thread: 1 Guest(s)