• Please take a moment to look over the Suggestions & Feedback rules before making a post: READ RULES HERE

Hacked by badsectqr - Anyone else experienced this?

Status
Not open for further replies.
C

cunningstunts

Registered Member
Joined
May 7, 2009
Messages
69
Reaction score
13
I wasn't sure where to post this - so posting here.

All 11 sites were hacked by "badsectqr" - the link left on site is imhatimi(dot)org


Just curious how they did this - did they hack each individual wp and joomla site backend?

Or has my PC been comprimised?

Thanks if anyone can advise.
 
Advertise on BHW
They could've got in numerous ways.
Your pc, script in a template, they could
be inside your whole C block.
Have you bought this to the attention of your hosts?
There may be other sites on that server hacked as well.
Now you need to secure yourself and fix any damage.
 
As beef had said already, it could have been a number of ways. I am guessing the most common way: Using a keylogger or istealer or something. What kind of virus softwares are you using?
 
Yes - been onto my hosts - namecheap and they have an internal back up ready to go.

So this is interseting - my anti-virus has been completely removed. PC was left on over New Years Eve.

I've been away for last few days.

Latest software I instaled was AMR.

Not sure what to do - reinstal antivirus software or reinstal OS.
 
Looks like your box is compromised.
If you have nothing on there to loose
by all means reinstalling is simpler than
searching for a virus Avs don't detect.
What AV are you using anyway?
Was the last execution from a legitimate source?
 
I personally would blow away the drive and just re-load the OS, actually as cheap as HD's are i would brick the drive and buy a new one and start all over.. Not having a good AV and being on all these sites, is not a good idea.
 
I was using Norton.

Was the last execution from a legitimate source?
Click to expand...

You mean the last exe software instal?

It was AMR - Article Marketing Robot

Yeah - will buy new HD and start again. Cheers for the FB.

And Happy New Year!
 
I got hit once by confirming directory submission emails. The directory site was infected with some java program that started a download in my browser. I immediately shut down Firefox but it was too late. The software was installed and scanned my hard drive for stored password in WS-FTP and Dreamweaver. It then infected my hosting accounts so it could infect who ever visited them.

What a pain. Never save your passwords to your hosting account in ftp programs.
 
The problem , server is not secure
easily reachable your file config , Let give an example command the pull config

ln -s /home/username/public_html/configpath ex.txt

Change the path your config file and encrypt
good luck
 
baDsectQr said:
The problem , server is not secure
easily reachable your file config , Let give an example command the pull config

ln -s /home/username/public_html/configpath ex.txt

Change the path your config file and encrypt
good luck
Click to expand...

This works as long as you have access inside the server. In order for that you need to get access somehow.

The most common way is via faulty Joomla/WP plugins. There are literally thousands (probably tens of thousands) of WP/Joomla sites waiting for me to upload my shell and do what ever I like to your site.

When you have the choice, don't use open source software.
-aReJay
 
aReJay said:
This works as long as you have access inside the server. In order for that you need to get access somehow.

The most common way is via faulty Joomla/WP plugins. There are literally thousands (probably tens of thousands) of WP/Joomla sites waiting for me to upload my shell and do what ever I like to your site.

When you have the choice, don't use open source software.
-aReJay
Click to expand...

joomla - wordpress makes no difference :) first index file pulled , require_once or are there ways to include command
 
I haven't, it could be your mistake probably.

And change your AV, norton sucks :)
 
baDsectQr said:
joomla - wordpress makes no difference :) first index file pulled , require_once or are there ways to include command
Click to expand...

That's a little too obvious and would be the first place that people look for redirects/defacements.

You need to look deeper into your application, and usually the code will be obfuscated with base64_encode which makes it impossible to do an fgrep search for the code alteration.

-aReJay
 
Advertise on BHW
Status
Not open for further replies.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top