Hacked! What's Next?
So, you've been hacked like just about everyone that has a nuke site. Your next question is, what do i do? Well here is how to get your site back online..
Steps :
The first thing is to make sure you get rid of any admins that the hacker has created or if they used yours then get rid of it and start fresh. How do you do that? Go to phpmyadmin and check your nuke_authors table (replace nuke if you have a different prefix for your table). Click browse and remove all admin accounts. Now go to http://www.yournukesite.com/admin.php and create a new admin account. You now have back control of your site. If you don't have phpmyadmin or don't know how to use it then copy the following code and paste inside a php file, save it to your nuke directory and run it in your browser (http://www.yournukesite.com/removeadmin.php). It will delete the tables for you. (Taken from nukecops.com)
<?php
require_once("mainfile.php");
if (!isset($prefix)) die('config.php not loaded properly.');
if (!isset($db)) die('database layer not loaded properly.');
$sql = "DELETE FROM " . $prefix . "_authors";
$result = $db->sql_query($sql);
if ($result) {
echo "All administrator accounts has been removed.<br/>";
echo "Now run admin.php to create new admin account.";
} else {
echo "Unable to access to database.";
}
?>
My index.php has been tampered or showing a hacker message
- Login as admin, and go to PHP-Nuke administration menu.
- Click on "Messages" icon.
- Check foe every site messages by clicking on "edit" link.
- Remove any unnecessary message text, or delete the message.
- Done.
A frame shown at the bottom of my site's page
- Login as admin, and go to PHP-Nuke administration menu.
- Click on "Preferences" icon.
- Remove any unnecessary foot text.
- Done.
One or some of your script files has changed
- Replace modified file with original one on your local machine.
- Patch or upgrade your modules that containing upload feature.
Securing PHP-Nuke
- Apply patches for your current PHP-Nuke version. ( nukesecurity resources)
- Install one or more PHP-Nuke security add-ons: (alphabetical orders)
- Check for Hacker Assassins PHP-Nuke combo package that shipped with latest ChatServ's patches and some security add-ons.
- Keep watching on Waraxe Forum for PHP-Nuke expoits.
- Visit some security sites such as Security Tracker , Security Focus , and Secunia for latest advisories regarding to PHP-Nuke exploits and vulnerabilities.
- Keep monitoring for new and upcoming PHP-Nuke exploits and vulnerabilities.
That's all. Visit our forums for more help. |