| Author | Message |
|---|---|
 Wowman2002 |
Date sent: 2015/10/14 05:44:01
As I was looking for Webbcraft in my searchbar, (up the top corner), I was greeted by a black page with white writing that wrote:"Iranian Hackers..." Insta: PeymanSiyahi "Down with Saduie" "Mail: peymansiyahi@gmail.com" http://webbcraft.co.uk/ Luckily it's only the Webbcraft.co.uk page & not the forums. please deal with this, and explain why it happened |
 luigiofthebakery Moderator |
Date sent: 2015/10/14 10:06:32
Fixed. There was an exploit in the webbcraft.co.uk/upload facility which allowed malicious files to be uploaded by directly using the PHP upload script that didn't check for file types. File type checking was done in javascript, so it only checked files uploaded through a browser. This allowed the hacker to upload another php script to change the homepage by uploading a new index.html file in the home directory. I have removed the malicious files that were uploaded, which should prevent the hacker from maliciously accessing the website again. I have combed through the website files and it seems nothing else was added or changed and no access was gained to the database.While I work on a patch for the upload script, the webbcraft file upload facility has been disabled. |
Wowman2002 |
Date sent: 2015/10/14 12:39:02
Thanks for your response Luigi, I found this very disturbing as if you google "Peyman Siyahi", he's an Iranian Hacker that supports ISIS, and potentially a member of the terreorist group, however it seems to me that the hacker just used that name to creep us out even more.Was the a any reason he targeted this forum? |
luigiofthebakery Moderator |
Date sent: 2015/10/14 13:45:25
While I can confirm that the hacker's IP address originated in Iran, I believe you're right in assuming that someone else was just using that name in order to creep us out.After deobfuscating the malicious file they uploaded, I uncovered that the file was a common script used in web server exploitation called Newbie3viLc063s (http://pastebin.com/jma8JRG1). It clearly seems that the hacker is unlikely to be someone as notable as Peyman Siyahi if they don't even write their own code. I don't know what the motive could have been, perhaps it was just by random chance. Then after looking through the logs more closely, it seemed as if this website wasn't targeted that much and the majority of actions were directed at another website hosted on the same server, vizen.org. |
Wowman2002 |
Date sent: 2015/10/14 15:12:46
I agree with you, anyways, if it was Peyman Siyahi he wouldn't have just done the front page, he would've done the whole website. I'm very curious about this Peyman Siyahi guy, so I'm going to investigate about this "work", just out of curiosity.Thanks for dealing with this so quickly & for your replies, (and investigation). Regards Wowman2002 |
 armzngunz |
Date sent: 2015/10/15 12:08:13
I do not think any major, known hackers would care about a minecraft server website. |
Wowman2002 |
Date sent: 2015/10/15 13:10:20
I do agree. |
