just note hacker named [mod note; hacker name removed] got server , defaced several sites. can tell, he/she left 3 files in site directory...
1. index.html -- "defacement" page file replaced every single file filename starts index, default, main, home, logo. in case of art files, seemed have kept same name, replaced actual file html.
2. mass.pl -- perlscript "priv8" script actual replacing , overwriting file in number 1, above.
3. c57.php -- php script effects still investigating. looks gives intruder control on server. tries run mysql queries, re-write php.ini, etc. script crashed server 2 days, until techs bring online. had file replacements backups next 2-days.
cause: usual... outdated versions of joomla , mambo. fix, converted joomla 1.0.12. updated components , modules. if else came across similar intrusion in pass week or , has info add c57.php script, please post here.
also, if know hacker is, let me know he/she lives. want work him/her/them on bat several hours...
1. index.html -- "defacement" page file replaced every single file filename starts index, default, main, home, logo. in case of art files, seemed have kept same name, replaced actual file html.
2. mass.pl -- perlscript "priv8" script actual replacing , overwriting file in number 1, above.
3. c57.php -- php script effects still investigating. looks gives intruder control on server. tries run mysql queries, re-write php.ini, etc. script crashed server 2 days, until techs bring online. had file replacements backups next 2-days.
cause: usual... outdated versions of joomla , mambo. fix, converted joomla 1.0.12. updated components , modules. if else came across similar intrusion in pass week or , has info add c57.php script, please post here.
also, if know hacker is, let me know he/she lives. want work him/her/them on bat several hours...
moderator note; name of hacker has been removed, no need give them credit
Comments
Post a Comment