XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk
  1. Board index / 
  2. XOOPS Community Support forums / 
  3. Q and A 
  4.  / myxoops.org hacked!
Register
21
cucoket
Re: myxoops.org hacked!

  • 2005/9/7 8:14

  • cucoket

  • Just popping in

  • Posts: 23

  • Since: 2004/7/7 5


Sorry for the late response!

I copied here the log:

le="color: #000000"><?php 2005-09-01 09:11:46 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /xoops.css - 200 0 1158 420 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:46 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /favicon.ico - 200 0 1678 392 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba - 2005-09-01 09:11:46 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/style.css - 200 0 492 439 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:47 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /index.php - 200 0 19575 409 1484 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 - - 2005-09-01 09:11:47 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /include/xoops.js - 200 0 118 412 235 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:48 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/page_flip_l.gif - 200 0 642 453 16 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:48 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/title.gif - 200 0 739 447 453 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:49 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /images/road.gif - 200 0 1361 427 453 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:49 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /images/house.gif - 200 0 899 428 1031 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:49 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/page_flip_r.gif - 200 0 639 453 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:49 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/cellpic_bkg.jpg - 200 0 922 453 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:49 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/count/index.php id=count&s=1 200 0 722 432 203 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:50 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/cellpic_nav.gif - 200 0 1214 453 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:50 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/cellpic3.gif - 200 0 652 450 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:50 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /themes/blue_lagoon/images/cellpic1.gif - 200 0 503 450 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:11:50 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/count/count.swf cgi=cgi=http://www.ria1.org/modules/count/index.php&total=1816&yes=6&today=7&you=1&load=end& 200 0 1531 634 219 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 countyet=1;+countcount=2;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:12:05 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb - 301 0 405 566 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1123591941;+newbb_topics_viewed=4%7C18726533;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:12:06 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/index.php - 200 0 11771 567 454 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1123591941;+newbb_topics_viewed=4%7C18726533;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/ 2005-09-01 09:12:06 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/folder_new_big.gif - 200 0 273 557 15 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583925;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:06 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /images/subject/icon1.gif - 200 0 425 450 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:06 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/pixel.gif - 200 0 326 548 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583925;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:06 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/folder_big.gif - 200 0 284 553 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583925;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:06 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/folder_locked_big.gif - 200 0 212 560 15 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583925;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:14 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/viewforum.php forum=1 400 1229 8351 633 704 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583925;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:14 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/viewforum.php forum=1 200 109 11309 633 1015 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583925;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/ 2005-09-01 09:12:14 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/post.gif - 200 0 665 568 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:14 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/folder.gif - 200 0 1178 570 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:14 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/red_folder.gif - 200 0 1183 574 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:14 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /images/icons/no_posticon.gif - 200 0 497 475 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:15 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/hot_folder.gif - 200 0 897 574 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:15 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/hot_red_folder.gif - 200 0 920 578 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:15 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/lock.gif - 200 0 1132 568 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:15 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/folder_sticky.gif - 200 0 1783 577 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:21 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/viewtopic.php topic_id=2&forum=1 200 0 13087 665 484 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583933;+newbb_topics_viewed=4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewforum.php?forum=1 2005-09-01 09:12:21 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /uploads/rank3e632f95e81ca.gif - 200 0 632 487 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1 2005-09-01 09:12:22 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /images/icons/reply.gif - 200 0 1052 480 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1 2005-09-01 09:12:22 219.195.90.2 - W3SVC449 WIN10 64.8.123.45 80 GET /uploads/blank.gif - 200 0 325 475 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1 2005-09-01 09:13:43 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 POST /user.php - 200 0 1139 731 157 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1 2005-09-01 09:14:01 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/viewtopic.php topic_id=2&forum=1& 200 109 12426 616 2922 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125583941;+newbb_topics_viewed=2%7C18759733%2C4%7C18726533;+NewBBLastVisitTemp=1123591941;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba - 2005-09-01 09:14:14 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/move_topic.gif - 200 0 715 571 15 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125584038;+newbb_topics_viewed=2%7C18759734%2C4%7C18726533;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1& 2005-09-01 09:14:14 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /images/icons/delete.gif - 200 0 1052 483 16 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1& 2005-09-01 09:14:18 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /images/icons/edit.gif - 200 0 1044 481 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1& 2005-09-01 09:14:19 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /admin.php - 200 0 2405 549 125 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/newbb/viewtopic.php?topic_id=2&forum=1& 2005-09-01 09:14:26 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/style.css - 200 0 1986 445 16 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:32 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /include/layersmenu.js - 200 0 260 427 16 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:43 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/hbar_right.gif - 200 0 645 458 16 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:43 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/xoops2.gif - 200 0 979 454 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:43 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/hbar_left.gif - 200 0 639 457 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:47 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/system_slogo.png - 200 0 494 460 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:48 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/logo.gif - 200 0 1687 452 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:50 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/mylinks/images/mylinks_slogo.png - 200 0 469 462 16 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:51 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/xoopspoll/images/xoopspoll_slogo.png - 200 0 433 466 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:54 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/myalbum/images/myalbum_slogo.gif - 200 0 625 462 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:55 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/protector/images/protector_slogo.gif - 200 0 686 466 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:57 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/newbb/images/xoopsbb_slogo.png - 200 0 732 536 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 NewBBLastVisit=1125584038;+newbb_topics_viewed=2%7C18759734%2C4%7C18726533;+PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:57 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/menu.gif - 200 0 406 452 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:57 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/mydownloads/images/mydl_slogo.png - 200 0 332 463 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:59 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/news/images/news_slogo.png - 200 0 813 456 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:14:59 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/addresses/images/addresses_slogo.png - 200 0 567 466 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:01 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/xoopspartners/images/logo.png - 200 0 498 459 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:01 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/xoopsheadline/images/headline_slogo.png - 200 0 1 469 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:04 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/sections/images/sections_slogo.png - 200 0 213 464 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:04 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/agendax/agendax_slogo.png - 200 0 814 455 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:05 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /images/pointer.gif - 200 0 564 440 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:06 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/hbar_middle.gif - 200 0 508 459 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:10 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/admin.php fct=groups 200 0 4076 537 312 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:13 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/bg_menu.gif - 200 0 393 455 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:14 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/bg_content.gif - 200 0 550 458 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/admin.php 2005-09-01 09:15:23 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/bg_content.gif - 200 0 550 484 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/system/admin.php?fct=groups 2005-09-01 09:15:24 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/images/menu.gif - 200 0 406 478 0 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/system/admin.php?fct=groups 2005-09-01 09:15:39 217.133.0.152 - W3SVC449 WIN10 64.8.123.45 80 GET /modules/system/admin.php fct=groups&op=modify&g_id=1 200 0 4735 580 468 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+ja-JP;+rv:1.7.10)+Gecko/20050717+Firefox/1.0.6 PHPSESSID=9587487bc5681893fbf5fd50cf5b68ba http://www.ria1.org/modules/system/admin.php?fct=groups


He changed his IP at 09:13:43 and logged in only once and gained the admin right!

I cannot find anything else.

Who has rxperience pls take a look!

Thanks
22
jaquita
Re: myxoops.org hacked!

  • 2005/9/7 14:29

  • jaquita

  • Just popping in

  • Posts: 22

  • Since: 2005/9/4 1


At a first glance at the logs it appears the intruder was using newBB just before, during, and immediately after gaining access. Also, the PHPSESSIONID is exactly the same throughout that log sequence although it comes from two different IP's. I didn't know that was possible.

It also looks like "/modules/newbb/viewtopic.php topic_id=2&forum=1" was important during the core sequence up to gaining admin access. After that, it's not used anymore.

Those are just observations of the log. Exactly what it means within the XOOPS framework I don't know.

Good luck.

jaquita
23
Antoine
Re: myxoops.org hacked!

  • 2005/9/7 14:47

  • Antoine

  • Friend of XOOPS

  • Posts: 112

  • Since: 2004/11/14


It probably isn't possible to look up the user-types by session-id anymore (e.g. did the user visiting the boards have admin rights), but as far as I can see the IP change might signify an XSS attack. All the more reason to at least never allow admins to change IP during a session.
24
LazyBadger
Re: myxoops.org hacked!

My dirty thinking
I see only one POST (with GETs you can't get privileges escalation), thus - I suuppose, some XSS-exploit was embedded into user's profile (obviously - into signature or avatar) and forum topic with this user's posting (done before) was used for acticating exploit
Quis custodiet ipsos custodes?

Webmaster of
XOOPS2.RU
XOOPS Modules Proving Ground
XOOPS Themes Exhibition
25
jaquita
Re: myxoops.org hacked!

  • 2005/9/7 15:06

  • jaquita

  • Just popping in

  • Posts: 22

  • Since: 2005/9/4 1


I noticed that single POST as well and was wondering about it. I'm not very familiar with the XOOPS code (yet) but is it possible to post php code, or any executable code for that matter, into a forum message that could then be executed when the message is loaded through a direct call?

Just wondering.

jaquita
26
Antoine
Re: myxoops.org hacked!

  • 2005/9/7 15:12

  • Antoine

  • Friend of XOOPS

  • Posts: 112

  • Since: 2004/11/14


Theoretically: Yes. Would have to check the sanitation of all variables involved to be sure. Don't think anything as obvious as the main message body can be used to XSS though.
27
comflash2
Re: myxoops.org hacked!

  • 2005/9/7 15:16

  • comflash2

  • Just popping in

  • Posts: 51

  • Since: 2005/1/1 1


Sorry to say.. No wonder your were hacked. Your newbb vunerable to the cross site scripting (and SQL injection ??) that can allow user to steal cookie-based authentication credentials. its very easy to exploit.. no need REAL HACKERS to do that. its in newbb/viewtopic.php, for "topic-id" and "forum" URI parameters .
Act Like Lightning FLASH
28
frankblack
Re: myxoops.org hacked!

  • 2005/9/7 15:36

  • frankblack

  • Just can't stay away

  • Posts: 830

  • Since: 2005/6/13


So I have to switch the forum (from newbb 2.02) to a safer version. BUT does cbb1.14 has the same vulnerabilities?
29
skara
Re: myxoops.org hacked!

  • 2005/9/7 16:46

  • skara

  • Friend of XOOPS

  • Posts: 84

  • Since: 2004/9/24


?? did you had Protector module installed ??
the art of war is to know the weakness of your enemy
30
phppp
Re: myxoops.org hacked!

  • 2005/9/7 17:32

  • phppp

  • XOOPS Contributor

  • Posts: 2857

  • Since: 2004/1/25


Quote:

frankblack wrote:
So I have to switch the forum (from newbb 2.02) to a safer version. BUT does cbb1.14 has the same vulnerabilities?


Neither Newbb 2.* nor CBB 1.*/2.* has the vulnerability.
The topic_id related security bug was been fixed in XOOPS 2.073 (or 2.09?)
« 1 2 (3) 4 »

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Donat-O-Meter

Stats
Goal: $15.00
Due Date: Jul 31
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $15.00
Make donations with PayPal!

Latest GitHub Commits