Iggy

Member Since 06 Dec 2002
Offline Last Active Apr 22 2011, 00:33

Find content

Community Stats

Group Community Member
Active Posts 1,240 (0.37 per day)
Most Active In General Support (488 posts)
Profile Views 20,713
Age Age Unknown
Birthday Birthday Unknown
Real Name
BOFH
Gender
Male
Location
Seattle, WA
Interests
Coffee and sleep deprivation

Contact Information

0 Neutral

Friends

Latest Visitors

kurt1
15 Sep 2011, 18:00
KeyGuy
30 Mar 2011, 04:19
bkellum
23 Mar 2011, 01:21
rafiq_qc
06 Mar 2011, 19:16
burt
20 Jan 2011, 18:58

Posts I've Made

In Topic: img directory was hacked

16 April 2011, 21:23

geoffreywalton, on 16 April 2011, 15:49, said:

Chris

Follow this link for more info on how to disinfect the site and how to harden it against future attacks.

http://forums.oscommerce.com/user/184805-geoffreywalton/page__tab__aboutme

HTH

G

Deleting the files won't cover it. Restoring the files won't cover it.

Since they're going to be back until you plug whatever hole they got through you might want to use your site as a honeypot and post whatever results you find.

Fix your site up first then place an htaccess file in the images dir with something like

RewriteEngine on
RewriteRule \.(html|htm|php|cgi|pl)$ /images/pixel_trans.gif [R,L]

You can make that any image name so you can get an idea how many times it gets hit in the logs.

That will make their exploit unusable

and watch your logs for exactly how they got in.

My money's on the admin/login.php hack

Looks something like this in the logs
94.142.129.147 - - [04/Sep/2009:22:36:03 -0500] "POST /admin/file_manager.php/login.php?action=save HTTP/1.1" 200 46617
174.129.177.51 - - [23/Oct/2009:17:33:22 -0500] "GET /admin/orders.php/login.php HTTP/1.1" 200 37728
74.220.219.147 - - [10/Nov/2009:10:33:14 -0600] "POST /admin/mail.php/login.php?action=send_email_to_user HTTP/1.1" 302 -
64.186.244.174 - - [14/Nov/2009:01:46:44 -0600] "GET /admin/file_manager.php/login.php HTTP/1.1" 200 44327
66.96.128.60 - - [09/Dec/2009:23:08:56 -0600] "POST /admin/file_manager.php/login.php?a=1&action=save HTTP/1.1" 200 16552
207.115.80.2 - - [19/Dec/2009:16:53:41 +0100] "POST /admin/mail.php/login.php?action=send_email_to_user HTTP/1.1" 302 -

In Topic: I get some warnings at my webpage

04 April 2011, 21:29

Harald Ponce de Leon, on 04 April 2011, 12:32, said:

Hi Stig..

Can you add the following to your osCommerce/OM/Config/settings.ini file in the [Setup] section:

http_cookie_domain = ""
http_cookie_path = ""

This should fix the problem.

Thanks,

Just to confirm that. Only had to add it to the Setup section to make it work
Running locally - Mac OS X 10.6 - XAMPP 1.73