File Download

Posted: Tue Dec 27, 2005 6:39 pm

Something has corrupted my site, and is trying to force an image download a file expl1_tank.wmf from trust4free.ws every time my index.php is accessed. I overwrote my index.php and it appears OK for now. How can it have happened, and how can I stop it from happening again? I'm running Raven's 7.6 distro with Sentinel BTW.

Sells PC To Pay For Divorce Joined: Posts: 5661

Well i doubt that..
Every idiot can try to abuse a site or try to hack it.
But it would help if you could provide more info...

Posted: Tue Dec 27, 2005 8:21 pm

Doubt what, and What kind of info should I provide?

Posted: Tue Dec 27, 2005 8:34 pm

well how do you know this?
How do you know they are using your index.php ?

registered · Posted: Tue Dec 27, 2005 9:26 pm

Dacubz, the base RavenNuke76 distribution should not have allowed this to happen. Now, if you have installed other modules or hacks which allow file uploads, such as Copermine, or a forum file upload mod, or some form of chat module, that could have been the way they broke in... Again, that is if you are certain your index.php was overwritten. Also, are you sure that you configured NukeSentinel per the provided instructions?

Posted: Wed Dec 28, 2005 8:03 pm

I don't have anything unusual installed, but one of my users did some research and came up with this. I haven't done anything besides overwrite my index.php so far.

http://www.mackenty.org/index.php/learn/comments/site_problem_found/#comments

Domain Name: TRUST4FREE.WS
Registrant: personal

Administrative Contact:
yo.wuzzup@gmail.com
18666254678

Registrar:
Rustelekom (www.NameServers.ru)
1 866 6254678
info@nameservers.ru

Domain created on 2005-10-15 10:10:39
Domain last updated on 2005-10-15 10:10:39

Name servers:

ns0.xname.org
ns1.xname.org

Posted: Wed Dec 28, 2005 8:29 pm

Reported to the host also, but I was wondering if this could have been caught.

registered · Posted: Thu Dec 29, 2005 3:27 am

Well you'd need to look at your access logs to see how he got it. There's gotta be a vulnerable part somewhere.. usually its an uploading script