Just had a hacker on my test server ..

[Gimp]

(On Mangos 3.0.9 rev. 7909)

Normally I wouldn't report this but I found it unusual, it wasn't just some noob using WEH.

My test server is setup very blizzlike, and I noticed a player at lvl 80 in my Minimanager. There's no way he could have gotten to that level so obviously he hacked with gm commands, so I banned him and deleted his account. The unusual part was that Minimanager didn't show a GM/BT sign next to his account name, in fact his account was set to "player", not moderator or game master. I checked back the gm logs and he was using gm commands to give himself items and delete and spawn npcs.

[Lascax]

Someone who has access to your DB changed his account lvl and turned it back to player at the end, probably.

[Alexstrasza]

make sure SQL server is not acessible from outside (without password)

and better firewall it completely.

If you are using some kind of web forms - it may be insecure too and allow SQL injections

its much less possibility that hacking been done via the server itself.

[Shin Darth]

If you are using MySQL, set that nobody can access to the database by localmachines

[Gimp]

How does SQL injection work? Would replacing my existing website/mysql passwords with 15-20 character long passwords help?

[arrai]

How does SQL injection work? Would replacing my existing website/mysql passwords with 15-20 character long passwords help?

No, the problem lies somewhere else: http://en.wikipedia.org/wiki/SQL_injection

[Aokromes]

Disable any mysql web interfaces. Also if you can't disable them, make sure you use some strong login and password instead mangos/mangos

[JordanMckeag]

Disable View Source On Your Register Page

[sso1]

I didnt had that problem yet but how can I disable view source? :confused:

[Gimp]

I believe he's getting in one of 2 ways, he just got back in under a slightly different ip address tonight:

1. SQL injection through the registration page, I'm using Reggacc. I'm not sure how secure it is. Would I be better off using minimanager for registrations?

2. I'm using a vote rewards system developed by a member over at the Trinity forums. In order for it to work I have to have remote access enabled on the database, and it's currently set to ip 0.0.0.0, so any ip can access it.

[Patman128]

2. I'm using a vote rewards system developed by a member over at the Trinity forums. In order for it to work I have to have remote access enabled on the database, and it's currently set to ip 0.0.0.0, so any ip can access it.

The hacker probably used SQL injection on that system.

[Gimp]

Well I think I found out how he was getting in (I hope so). I talked to him in game and he said he guessed (probably brute forced) the phpmyadmin password. It was a 7 or 8 character pass with numbers and letters. He had full access to the db but luckily he didn't do any major damage.

I replaced the pass with a MUCH longer and more complex password.

[freghar]

uh ... 8-char bruteforce on an MD5 hash (local, no network) could take almost half a year on my old 2.6GHz Celeron, so I really doubt he used that, my cracking tool (I believe it was jon the ripper) was able to do few milions of iterations per second (IIRC) while your man would unlikely get 10000+ / second.

[Gimp]

uh ... 8-char bruteforce on an MD5 hash (local, no network) could take almost half a year on my old 2.6GHz Celeron, so I really doubt he used that, my cracking tool (I believe it was jon the ripper) was able to do few milions of iterations per second (IIRC) while your man would unlikely get 10000+ / second.

Even after the password change he's in again!

OMFG I can't stop him from getting in

[freghar]

Of course you can. Using a firewall for example. Or ACLs, ..., ...

[Lascax]

Why don't you limit the access to your DB only from your static IP?

[Gimp]

Well we completely removed phpmyadmin yesterday, and ever since things have been quiet.

*crosses fingers*

[freghar]

http://milw0rm.com/exploits/8921 - 2009-06-09

http://milw0rm.com/exploits/8992 - 2009-06-22

[raczman]

http://milw0rm.com/exploits/8921 - 2009-06-09

http://milw0rm.com/exploits/8992 - 2009-06-22

tested this on default phpMA installs across variety of debiain-based distros, and they do not work.

By the way, i am 100% positive the "hacker" got in using mangos/mangos user/pw combination on pma or with mysql CLI client. Most of the people forget to restrict access to users from outside.

[Gimp]

tested this on default phpMA installs across variety of debiain-based distros, and they do not work.

By the way, i am 100% positive the "hacker" got in using mangos/mangos user/pw combination on pma or with mysql CLI client. Most of the people forget to restrict access to users from outside.

Our mysql is set to only allow connections from localhost. Our user/pass combo was username + 8 character pass. Even after we replaced the password with a VERY long and complex pass, they got in just the same. Ever since we got rid of phpmyadmin, the attacks have stopped.

I have a feeling they were using some kind of phpMA exploit to bypass it completely.

They also tried breaking into our SSH according to the logs but weren't successful.

[Patman128]

So how does this PMA exploit work? Do you have to have the MySQL username and password in the PMA config or will it work even without a password?

[Aligatro]

Our mysql is set to only allow connections from localhost. Our user/pass combo was username + 8 character pass. Even after we replaced the password with a VERY long and complex pass, they got in just the same. Ever since we got rid of phpmyadmin, the attacks have stopped.

I have a feeling they were using some kind of phpMA exploit to bypass it completely.

They also tried breaking into our SSH according to the logs but weren't successful.

Is he on the same lan network(in some countries there are huge lan netoworks offered by ISPs) as your server ? Because there are tools out there that let you easily sniff traffic on lan and retrieve passwords from unencrypted connections.

[Gimp]

Is he on the same lan network(in some countries there are huge lan netoworks offered by ISPs) as your server ? Because there are tools out there that let you easily sniff traffic on lan and retrieve passwords from unencrypted connections.

I don't think so, the hackers (two of them) were from Germany.

Anyways I recommend everyone not to use phpmyadmin.

[Aligatro]

I don't think so, the hackers (two of them) were from Germany.

Anyways I recommend everyone not to use phpmyadmin.

So, this means that you are hosting your server open to the internet. =/ Just use .htaccess file to restrict only to localhost or internal ips for the whole folder where phpmyadmin is located. Or use password protection, also using .htaccess.

[Dagguh]

You can use PDO in your PHP to secure yourself from SQL Injections.

If you are using MySQL, set that nobody can access to the database by localmachines

He probably meant disabling access from remote machines.