A few of my sites running subrion got hacked..

mattf · 11-13-2008

Title should be pretty self explanatory. I am running the free version.

Here is what I am getting.

First site

sses was here<br />
<b>Warning</b>: Cannot modify header information - headers already sent by (output started at /home/myhost/public_html/mywebsite.com/index.php:1) in <b>/home/myhost/public_html/mywebsite.com/includes/header.php</b> on line <b>4</b><br />
<br />
<b>Warning</b>: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cookie - headers already sent by (output started at /home/myhost/public_html/mywebsite.com/index.php:1) in <b>/home/myhost/public_html/mywebsite.com/includes/header.php</b> on line <b>5</b><br />

<br />
<b>Warning</b>: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cache limiter - headers already sent (output started at /home/myhost/public_html/mywebsite.com/index.php:1) in <b>/home/myhost/public_html/mywebsite.com/includes/header.php</b> on line <b>5</b><br />
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

The site looks like normal, only with the text in red displayed on the site above the header graphic.

2nd site was much worse. All i got was a blank page stating 'sses was here'

same for the source code. I could still gain admin access however.

3rd and 4th sites.

I get this at the relevant part in the source code



<div id="msg"></div>
<div class="error">Requested URL not found (404)</div>

</div>
</div>
</div>
<div class="white_box_bottom_right">
<div class="white_box_bottom_left">
<div class="white_box_bottom"> </div>
</div>
</div>

</td>


I also get a big pink box stating the basic 404 page not found info where the previews of the articles used to be. However, I can still see the info from the browse/index.htm url.

in all of these, the install has been deleted on installation.

What I am looking for is two things.

1.) Was this a permissions problem? If so, what specific permissions would you think would be the problem.

is there a specific file he is attacking.

2.) Is this a subrion or a server issue for me? I have about 50 sites up and running on this server, and he didn't pick all 4 of them in a row. 3 in a row, and then 1 random one.

any help would be appreciated.

mattf · 11-13-2008

just thought i'd add, after checking my stuff, 7 more sites are down.

i don't think I like the person who did this

**Vasily B.** · 11-13-2008

Hi
Please send FTP credentials from one site to tech support - tech at subrion dot com. I will check the way of hacking immediately

11-13-2008	#1 (permalink)
mattf Junior Member Join Date: Feb 2008 Posts: 7	A few of my sites running subrion got hacked.. Title should be pretty self explanatory. I am running the free version. Here is what I am getting. First site sses was here<br /> <b>Warning</b>: Cannot modify header information - headers already sent by (output started at /home/myhost/public_html/mywebsite.com/index.php:1) in <b>/home/myhost/public_html/mywebsite.com/includes/header.php</b> on line <b>4</b><br /> <br /> <b>Warning</b>: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cookie - headers already sent by (output started at /home/myhost/public_html/mywebsite.com/index.php:1) in <b>/home/myhost/public_html/mywebsite.com/includes/header.php</b> on line <b>5</b><br /> <br /> <b>Warning</b>: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cache limiter - headers already sent (output started at /home/myhost/public_html/mywebsite.com/index.php:1) in <b>/home/myhost/public_html/mywebsite.com/includes/header.php</b> on line <b>5</b><br /> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> The site looks like normal, only with the text in red displayed on the site above the header graphic. 2nd site was much worse. All i got was a blank page stating 'sses was here' same for the source code. I could still gain admin access however. 3rd and 4th sites. I get this at the relevant part in the source code <!-- breadcrumb end --> <div id="msg"></div> <div class="error">Requested URL not found (404)</div> </div> </div> </div> <div class="white_box_bottom_right"> <div class="white_box_bottom_left"> <div class="white_box_bottom"> </div> </div> </div> </td> <!-- center column end --> I also get a big pink box stating the basic 404 page not found info where the previews of the articles used to be. However, I can still see the info from the browse/index.htm url. in all of these, the install has been deleted on installation. What I am looking for is two things. 1.) Was this a permissions problem? If so, what specific permissions would you think would be the problem. is there a specific file he is attacking. 2.) Is this a subrion or a server issue for me? I have about 50 sites up and running on this server, and he didn't pick all 4 of them in a row. 3 in a row, and then 1 random one. any help would be appreciated.

11-13-2008	#2 (permalink)
mattf Junior Member Join Date: Feb 2008 Posts: 7	Re: A few of my sites running subrion got hacked.. just thought i'd add, after checking my stuff, 7 more sites are down. i don't think I like the person who did this Last edited by mattf; 11-13-2008 at 07:55 AM.

11-13-2008	#3 (permalink)
Vasily B. Administrator Join Date: Feb 2008 Location: Kyrgyzstan, Bishkek Posts: 509	Re: A few of my sites running subrion got hacked.. Hi Please send FTP credentials from one site to tech support - tech at subrion dot com. I will check the way of hacking immediately __________________ Auto classifieds script, Best Articles Script, Web Directory Software, Realty Classifieds Script, eLitius Affiliate Tracking Script - Open Source Affiliate Script, Free Directory Script - Best Free Directory Script Follow Surbion CMS news and updates on Subrion Twitter

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode