Hacking my myBB

[webaph]

1 - delete user, NOT DATABASE
2 - recreate user with different password
3 - open up inc/config.php from your server and find:

$config['password'] = "passwordhere";

replace passwordhere with your new user password.

if you also changed the usar name, find:

$config['username'] = "usernamehere";

and replace usernamehere with your new username.

[Lee69]

It's sorted, thanks for your time.

[loftx]

Posted a similar thread in bugs after my forum got hacked. I have the logs if any of the developers want them.

[Dennis Tsang]

If you have logs of some people accessing URLs that could have led to SQL injection or similar exploits, please feel free to let us know...

[faithhealer]

We got hacked. I was locked out of admin, and now I even seemed to be locked out by my domain. I've been getting this error:
--------------------------------------------------
mySQL error: 1045
Access denied for user '...'@... (using password: YES)
Query:
--------------------------------------------------
but I don't know if this has anything to do with it.

I have read some threads on this board about it, and dare say I'm not confident about being able to carry out some of the suggestions. Or even that I understand them, as I'm not too literate in computer programming. But I will have a go.

I've downloaded PR2 which I will upgrade as soon as I am know how safe it now is to back to using the board.

But
1)how confident can I be that we will be protected from this intrusion?
2) And how about this 'injection' thing, and about knowing what 'infection' is left on the db?
3) Is there a 'for dummies' way to effect these protections?


BACKGROUND/FURTHER INFO:

First hint of hacking were these messages on 14th and 15th August. which, not knowing any better I sent to my ISP, who were no help:

-------------------------------------------------
(14 aug)
A user has tried to access the Administration Control Panel for .... They were unable to succeed in doing so.
Below are the login details:

Username: \' or 1=1 /*
Password: (MD5: d41d8cd98f00b204e9800998ecf8427e)

IP Address: 81.214.122.174
Hostname: 81.214.122.174

(and 15th Aug )
....
Username: \' or 1=1 /*
Password: (MD5: d41d8cd98f00b204e9800998ecf8427e)

IP Address: 81.192.143.174
Hostname: adsl-174-143-192-81.adsl2.iam.net.ma
--------------------------------------------------

More recently (two days ago) found myself locked out! And all other admin accounts were deleted. First I could go on and see the board, but then I was like I was banned and now I get the SQL error 1045 as quoted above.


Through the sql db I have found this user//email: (which is now deleted)
Avt_Phenix // [email protected]

and through DNSStuff got this info: (though I don't know how useful it is)

domain: XAKER.RU
type: CORPORATE
nserver: ns1.nextmail.ru.
nserver: ns2.nextmail.ru.
state: REGISTERED, DELEGATED
person: Egor B Polusmak
phone: +7 095 5063196
fax-no: +7 095 5063196
e-mail: ******@mail.ru
registrar: RUCENTER-REG-RIPN
created: 2000.06.30
paid-till: 2006.07.03
source: TC-RIPN

There's loads of changes in admnlogs that I don't understand but if they might be useful I would send them to someone.

Grateful for useful responses

[Dennis Tsang]

Check your inc/config.php and see if the hacker changed those values.

[Shochu]

Those are really simple SQL injection attacks and I really hope myBB is now immune to something that trivial after the last patch *crosses fingers*

You might want to try renaming your admin directory to something other than /admin.

Here's the thread on how to do it

http://community.mybboard.net/showthread.php?tid=3928

Make it as long and confusing as possible.