Codezwiz >> Forums >> General PHP Nuke Help >> Hacked and defaced

Ive been hacked and defaced here's my site [ Register or login to view links on this board.] Some *&^%$# called Kieger has messed my site up,this is the 2nd time,but the most serious,this *&^%$# is able to make its self am admin and to modify loads of files.

Edited for waste of space!

Losing faith in CZ? It isnt our responsibility to keep your site safe. We provide you with the tools to do it. Maybe you should secure your site so this doesnt happen. Everyday there is a new way to expose your site and there isnt anything that "CZ" can do about it. Thats up to you!

Fortress Just released
[ Register or login to view links on this board. ]

Protector Just released
[ Register or login to view links on this board. ]

im a little stunned by your reply,i downloaded and use your version of the nuke portal,i dont expect 24hr support.bathtub you have given me more support than i ever expected,but then i expected the whole CZ-enhanced thing to be safe,im not slating CZ,i love it,

but............

All fixes related to security have been kept up to date in the code. Once you take the code and use it on your site you need to ensure that it is kept up to date. I post fixes as I can make them up. I am also going to post a big article on how to keep your site safe. I'm sorry you got hacked but there just isnt anything that me or the CZEnhanced 7.0 was going to do to stop it. These are all new sql injection cases. Some script kiddies finding new ways of messing with us. Stay tuned I will have a few ways to help coming up tonite. For now get in thier and claim "your" site back.

Here read through these they will help you secure your site.
[ Register or login to view links on this board. ]

Fitted both fortress and protector(how do i know its working correctly?) Im now going to work through the other steps you outline.

Thanx Telli,and im sorry if i offended you in any way,it wasn't my intention.

Where do i find/where do i put??

$query = eregi_replace('UNI0N','UNI0N', $query);

And in your double login.On the 5th line on the modded version of admin.php

should

include("includes/adminconfig.inc.php");

not read

include("includes/adminlogin.inc.php");

Its been a loooong day for me here

Ive applied all but the O to 0 fix.

And still this **%!@! gets in

ive deleted superuser aaaaa twice since i fitted all the bells and whistles.

I know ive been posting to this thread all day,sorry about that,but im in the UK so guess im awake while you guys sleep

If you have protector installed, you can track the page views. Please find the page they are exploting. Please do not copy & paste anything, dont show any of the exploit or anything to that nature, just tell me the file they are using the exploit on. Be it login.php, admin/index.php, modules/downloads/index.php etc.

And make sure you changed your passwords doesnt do any good to block him if he still has your passwords.