OTS hacking
- Thread starter Samik
- Start date
1: Did you recheck that your phpmyadmin is only accessable from localhost? (Did you test to enter your friends house and try to enter phpmyadmin?)
2: Do you use Gesior ACC? Any Beta release of it?
3: Do you got remote access to the server?
4: If you got remote access to the server/computer your hosting on, what kind of remote access tool do you use?
2: Do you use Gesior ACC? Any Beta release of it?
3: Do you got remote access to the server?
4: If you got remote access to the server/computer your hosting on, what kind of remote access tool do you use?
"these lines of code have been removed and it was 'unprotected' again."
What lines? Did you use the build-in .htaccess type xampp got?
Check if you have dropped the PMA user on your phpmyadmin.
Try to rename phpmyadmin to something else
Enter your tFS server, config.lua, change passwordtype from "plain" to "shal" or "md5".
For maximum security, you can remove all form for access to the phpmyadmin by removing it while not using it.
But I think you used wrong method securing phpmyadmin with.
Also, for maximum security, use TFSCMS and not Gesior. If you want a flawless CMS. But you will miss many functions.
Then they have placed a shell on your pc. Reinstall your server, gesior AAC and the problem will be solved.
Enter xampp or xampplite
enter apache/conf/extra/httpd-xampp.conf
And you will find this:
PHP:
</Directory>
Alias /phpmyadmin "C:/xampplite/phpMyAdmin/"
<Directory "C:/xampplite/phpMyAdmin">
AllowOverride AuthConfig
Order allow,deny
Allow from all
</Directory>
# Access restriction via Remote
<IfModule auth_remote_module>
<Directory "C:/xampplite/htdocs/fonts">
AllowOverride All
AuthType Basic
AuthName "AUTH REMOTE TEST"
AuthRemoteServer 127.0.0.1
AuthRemotePort 80
AuthRemoteURL /forbidden/
Require valid-user
#User: user / Password: pass
</Directory>
</IfModule>Note the remote tool here as well. Not quite sure, but to me it looks like a huge vulnerability. You should make sure to not use the default username and password for xampp's remote tool.
The fact that you didnt know about httpd-xampp.conf file is proof that you secured phpmyadmin in a wrong method. Meaning you used an insecure wannabe "secure" mode for it.
It does not work to only reinstall xampp, if they placed the shell in the gesior aac system you will still be hackable. So either you can look for the shell file or you must replace _EVERYTHING_
Reinstall the OS or find the shell.
you only need to reinstall your web server, or at least remove everything from your webserver...... As Feloth stated above xd
Last edited:
In earlier versions of xampp, pma did not have password. Which gave people access to phpmyadmin and they could add shells somewhere in your system. And that way take full control over your server without you even knowing.
