Latest Announcemnent
New thread

Will pay for help solving issue ASAP

Status
Not open for further replies.
Some more info:

/var/log/dpkg.log:2010-05-26 20:05:35 install libssh2-1 <none> 0.18-1
r.daskevicius: /var/log/dpkg.log:2010-05-26 20:05:35 status half-installed libssh2-1 0.18-1
r.daskevicius: /var/log/dpkg.log:2010-05-26 20:05:35 status unpacked libssh2-1 0.18-1
/var/log/dpkg.log:2010-05-26 20:05:35 status unpacked libssh2-1 0.18-1
/var/log/dpkg.log:2010-05-26 20:05:39 configure libssh2-1 0.18-1 0.18-1

r.daskevicius: this is normal?
 
Off topic: Do you also own megaleech.eu?

On TOpic: Looks like your script might have some kind of backdoor and a hacker got access to your SQL.. Contact the script maker?
 
Ok, my suggestions is you enable it (see that it's usefull :D) and then get back with us as soon as you see some results.
 
Simple 2 possibilities:

1. Your system is compromised, system from where you access your server!
2. Your server is compromised, backdoored or just shelled.

Solution for 1: Take back up (of individual file and folder), format re-install your OS and then access your server. Don't break your head in solving it.

Solution for 2: nmap -PN on your server and check for any binded shells! Disable functions like fsockopen, system (leeching should work with them disabled) in php.ini. Look out for files like "shbd" or anything that sounds weird in your 777 folders, including /tmp/ .

Simple?
 
If it is sqli that u suspect then, add this line in your .htaccess
php_flag magic_quotes_gpc on
Click to expand...
relying on this feature is discouraged however, if the claimed "hacker" is one of those scripties who knows only about sqli, x=x auth bypass, lfi, rfi, etc.. then, it will keep him at his bay :)
 
We didn't managed how stealing was done, but after changing rapidleech script from rapidleech plus from zecel.com to original upgraded, problem are gone. So it's seams that rapidleech+ from zecel.com have serious backdoors ir something like this.
 
It's prolly the script's fault, some vulnerability.

Which script are you using, btw?

Either way, premium links generators are always exposed to those kind of things. Most of the times, a simple http debugger and some base64 decoder is more than enough to leech the acc's data.
 
albertoberto you right. Problem is solved yesterday and reason:
insert_location() function (download
system) which reveals premium cookies and base_64 encoded auth-strings to end
user(s). with simple http debuger.
 
Status
Not open for further replies.
Back
Top