vb.org Archive
Page 1 of 2 1 2
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vB4 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=251)
-   -   .htaccess deleting it self (https://vborg.vbsupport.ru/showthread.php?t=268337)

daydie 08-10-2011 08:46 PM
.htaccess deleting it self
 
whats going on with my forums :( my .htaccess is deleting it self.

Some1 hacked my FTP and changed my forum directory to /TriiX, I Noticed, change FTP password and fixed, now i put .htaccess, 20min later its gone from my FTP.

How is this possible? please help i think its deleting it self.

HMBeaty 08-10-2011 08:51 PM
Have you changed all of your passwords? Server? FTP? etc?

daydie 08-10-2011 08:53 PM
just changed Godaddy account pass, so that and FTP are now "safe" im not sure how they gained access in first place.

hopefully it wont delete now >.< (Also changed forum admin password)

Is it common for only .htaccess to delete it self?

HMBeaty 08-10-2011 08:54 PM
Quote:
Originally Posted by daydie (Post 2231983)
just changed Godaddy account pass, so that and FTP are now "safe" im not sure how they gained access in first place.

hopefully it wont delete now >.< (Also changed forum admin password)

Is it common for only .htaccess to delete it self?
No.

nhawk 08-10-2011 09:02 PM
It looks like you'll need to upload the original index.php file for vBulletin again. And make sure there is no other index file in the main site folder.

The one that's there could very well be deleting the file.

Lynne 08-11-2011 01:29 AM
Are you sure you don't have your ftp client set to not show invisible files? If you can't see invisible files, you won't be able to see your .htaccess file. Also, does godaddy allow you to have .htaccess files?

daydie 08-11-2011 06:07 AM
yeah, my site been working fine now. must of been some1 accessing my godaddy account on the web. thanks anyways guys aprichate it

--------------- Added [DATE]1313046735[/DATE] at [TIME]1313046735[/TIME] ---------------

Just saw my index file and it has this:

<html>

<head>

<!--

Well done for being able to read the source code.



MSN - root@unloyal.co.uk

Email - im@purv.org



~~ TriiX

-->

<style type="text/css">

body {

background-image: url(http://www.purv.org/deface.jpeg);

color: white;

}



h1 {

color: red;

}

</style>

<SCRIPT LANGUAGE="JavaScript">

var text=" [root@secureserver]~ cat message.txt<br> \

Good evening, David.<br> \

You're on a secure host? Uh-oh, I don't think so!<br> \

The index is the only page I have touched, nothing else.<br>Consider this a warning<br> \

If you can't secure a forum, then don't run one.<HR> \

Want help to secure it? Via being a techy or a host? Alternately, want to cry?<br> \

<b>MSN - root@unloyal.co.uk<br>Email - im@purv.org</b> \

I'll be waiting to hear from you.<br><br> \

Much love<br> \

TriiX \

<br><br><br> \

[root@secureserver]~ logout";

var delay=50;

var currentChar=1;

var destination="[none]";

function type()

{

//if (document.all)

{

var dest=document.getElementById(destination);

if (dest)// && dest.innerHTML)

{

dest.innerHTML=text.substr(0, currentChar)+"_";

currentChar++;

if (currentChar>text.length)

{

currentChar=1;

setTimeout("type()", 9000);

}

else

{

setTimeout("type()", delay);

}

}

}

}



function startTyping(textParam, delayParam, destinationParam)

{

text=textParam;

delay=delayParam;

currentChar=1;

destination=destinationParam;

type();

}

</SCRIPT>

<title>GreeTz</title>

</head>

<body>

<div align="center">

<iframe width="1" height="0" src="http://www.youtube.com/embed/zOopudSHS0c?autoplay=1" frameborder="0" allowfullscreen></iframe>

<h1><b>Hacked by TriiX</b></h1><br>

<DIV ID="txt">

<SCRIPT LANGUAGE="JavaScript">

javascript:startTyping(text, 50, "txt");

</SCRIPT>

</div>

</div>

</body>

</html>

--------------- Added [DATE]1313046839[/DATE] at [TIME]1313046839[/TIME] ---------------

How the hell has he done this?

Is Vbulletin secure? i have the latest and latest patch, Is it v bulletin or GoDaddy that is vulnerable?

Is their any way he can change index source without accessing FTP?
Also Is it possible he can access config somehow to see data to get password? im kind of worried now. If my forum grows and this happends im ++++ed. =/

nhawk 08-11-2011 10:51 AM
It's GoDaddy not vB.

I had something similar happen a couple of years back with another type of site. The site ran fine for nearly 8 years on a dedicated server, but due to the economy the owner decided to move the site to GoDaddy to save money. Within one month of the move the site was hacked in a similar manner. It was not hacked with FTP, or by obtaining any of the site passwords. It was hacked directly from root access to the server. The site was immediately moved back to a dedicated server under my control and the site has never been hacked since.

Despite what they say, in my opinion GoDaddy does not secure their servers very well. That's entirely my opinion and not intended to bash them.

But keep in mind whether on a dedicated server or a shared server, security is always the responsibility of the site owner not the provider.

daydie 08-11-2011 11:11 AM
never, how can i prevent this?

Your exactly rite, im speaking to the hacker but he wont tell me know. He said something about Shell i dunno.

I really need to stop this. He can do ANYTHING he wants.

--------------- Added [DATE]1313065567[/DATE] at [TIME]1313065567[/TIME] ---------------

i think its because its shared, he said any site in shared hosting on my account, can lead to ssh exploit or something and can access all files on that server and databases

balls. i dunno wot to do.

setishock 08-11-2011 11:38 AM
You need to find another host like PDQ. Quit playing with them.


All times are GMT. The time now is 03:31 AM.
Page 1 of 2 1 2
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01039 seconds
  • Memory Usage 1,740KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (10)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete