Administrator Milw0rm hacked
Gönderilme zamanı: 31 Oca 2007, 22:10
bilindigi üzere Milw0rm, özellikle en güncel güvenlik aciklarini vermesi ile ünlü bir site fakat bugün bu sitenin admin haklarini ele geciren cyberterrorist isimli hacker , bir uyari notu birakarak siteye zarar vermeden log out oldu ve diger yeralti sitelerine bu islem sirasindaki kayitlari ( loglari ) dagitti asagida:
He connects:
172.185.9.57 - - [29/Jan/2007:19:29:00 -0600] "GET / HTTP/1.1" 200 8408 "http://www.milw0rm.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPat
h.2)"
First attempt at login (he must of not typed my password right):
172.185.9.57 - - [29/Jan/2007:19:29:22 -0600]
"POST /login.php?do=login HTTP/1.1" 200 3976 "http://forum.milw0rm.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Wi
ndows NT 5.1; InfoPath.2)"
He has an issue looking for the admin section:
172.185.9.57 - - [29/Jan/2007:19:29:54 -0600]
"GET /admincp HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:30:18 -0600]
"GET /cp HTTP/1.1" 404 267 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:30:25 -0600]
"GET /admin HTTP/1.1" 404 270 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:30:46 -0600]
"GET /admincp HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
Logins correctly:
172.185.9.57 - - [29/Jan/2007:19:33:54 -0600]
"POST /login.php?do=login HTTP/1.1" 200 3975 "http://forum.milw0rm.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Wi
ndows NT 5.1; InfoPath.2)"
Keeps looking for admin section. (future note: the Admin link at the bottom of the screen works):
172.185.9.57 - - [29/Jan/2007:19:35:05 -0600]
"GET //admincp/phrase.php HTTP/1.1" 404 284 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)
"
172.185.9.57 - - [29/Jan/2007:19:35:16 -0600]
"GET /admincp/phrase.php HTTP/1.1" 404 283 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:35:21 -0600]
"GET /admincp HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
Then deletes a few posts, posts the post above,
changes password:
72.185.9.57 - - [29/Jan/2007:19:54:49 -0600]
"GET /profile.php?do=editpassword HTTP/1.1" 200 7052 "http://forum.milw0rm.com/profile.php?do=editprofile" "Moz
illa/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:55:10 -0600]
"POST /profile.php?do=updatepassword HTTP/1.1" 200 6613 "http://forum.milw0rm.com/profile.php?do=editpassword"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
then logs out.
kaynaklar:
http://underground.ag/showthread.php?t=37129
http://karibik.lebanese.nl/?p=659
He connects:
172.185.9.57 - - [29/Jan/2007:19:29:00 -0600] "GET / HTTP/1.1" 200 8408 "http://www.milw0rm.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPat
h.2)"
First attempt at login (he must of not typed my password right):
172.185.9.57 - - [29/Jan/2007:19:29:22 -0600]
"POST /login.php?do=login HTTP/1.1" 200 3976 "http://forum.milw0rm.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Wi
ndows NT 5.1; InfoPath.2)"
He has an issue looking for the admin section:
172.185.9.57 - - [29/Jan/2007:19:29:54 -0600]
"GET /admincp HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:30:18 -0600]
"GET /cp HTTP/1.1" 404 267 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:30:25 -0600]
"GET /admin HTTP/1.1" 404 270 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:30:46 -0600]
"GET /admincp HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
Logins correctly:
172.185.9.57 - - [29/Jan/2007:19:33:54 -0600]
"POST /login.php?do=login HTTP/1.1" 200 3975 "http://forum.milw0rm.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Wi
ndows NT 5.1; InfoPath.2)"
Keeps looking for admin section. (future note: the Admin link at the bottom of the screen works):
172.185.9.57 - - [29/Jan/2007:19:35:05 -0600]
"GET //admincp/phrase.php HTTP/1.1" 404 284 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)
"
172.185.9.57 - - [29/Jan/2007:19:35:16 -0600]
"GET /admincp/phrase.php HTTP/1.1" 404 283 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:35:21 -0600]
"GET /admincp HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
Then deletes a few posts, posts the post above,
changes password:
72.185.9.57 - - [29/Jan/2007:19:54:49 -0600]
"GET /profile.php?do=editpassword HTTP/1.1" 200 7052 "http://forum.milw0rm.com/profile.php?do=editprofile" "Moz
illa/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
172.185.9.57 - - [29/Jan/2007:19:55:10 -0600]
"POST /profile.php?do=updatepassword HTTP/1.1" 200 6613 "http://forum.milw0rm.com/profile.php?do=editpassword"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"
then logs out.
kaynaklar:
http://underground.ag/showthread.php?t=37129
http://karibik.lebanese.nl/?p=659