My S9Y site HACKED!!! what I should do now? [fixed]

bonabest · Post by **bonabest** » Fri May 23, 2008 3:12 am

Hi guys,

I just found that my s9y site been hacked by some one from Turkey...

my web address www.bonabest.net

can anyone help me out? like what's the best way to restore my blog without losing any data?

PLZ!

by the way, my s9y version is 1.2.1

bonabest · Post by **bonabest** » Fri May 23, 2008 3:33 am

fixed!!!

this guy edited the serendipity_config_local.inc to the following content.

what a wan*er, so simple and too naive...

<html>
<head>

</style>
<div id="Layer1" style="position:absolute; left:0; top:0; width:1000; height:1000;
z-index:1; background-color: #000000; layer-background-color: #ccccc; border: 1px none #000000">
<strong>
</span></strong></p>
<DIV align=center>
<p><B><BR>
<STYLE>BODY {
SCROLLBAR-ARROW-COLOR: red; SCROLLBAR-BASE-COLOR: black
}
</style>
<title>HACKED BY VEZiR.04</title><p><font color="#000000">
<div id="Layer1" style="position:absolute; left:0; top:0; width:1000; height:1000;
z-index:1; background-color: #000000; layer-background-color: #ccccc; border: 1px none #000000">
<p align="center"><font face ="Showcard Gothic" style="font-size: 125pt"><font color="white">HackeD
<p align="center"><font face ="Showcard Gothic" style="font-size: 25pt"><font color="white">Your System Owned By
<p align="center"><font face ="Showcard Gothic" style="font-size: 35pt"><font color="white">Vezir.04~McPislick~One_Dream
<p align="center"><font face ="Showcard Gothic" style="font-size: 15pt"><font color="white">vezir.04@gmail.com
<p align="center"><font face ="Showcard Gothic" style="font-size: 15pt"><font color="white">www.turkishrevenge.org

<noscript>
</b></p>
</font></td>
</tr>
<tr align="center">
</tr>
</table>
</body>
</html>

Post by **Don Chambers** » Fri May 23, 2008 3:46 am

Not sure how the hacker did that, but definitely start by upgrading to the latest s9y release. Glad you were able to detect and correct the problem so quickly. Disregard my PM.

Post by **garvinhicking** » Fri May 23, 2008 10:50 am

Hi!

Do you run other applications on your webserver? Even though a file of s9y was affected, it might have stemmed from another application. Especially instances of Coppermine Gallery have been subject to hack attacks recently!

Regards,
Garvin