How and why the forums were "hacked"

**bgoodman** · 09-20-2002, 12:54 AM

Well, the how part is fairly simple, there are several vulnerabilities in vbulletin and php that allow you to executes malicious commands (such as upping your user status to admin).

What happened was that the 'hacker' (a.k.a. script kiddie) deleted all of the admin users (Aaron, MooN, and Zip-Lock) and the Moderators (Skippman) leaving the forums in the wrong hands.

Fortunately, he deleted the 'forum index' (the part of the MySQL DB that contains forum name and description) instead of deleting some 70,000 posts.

Also all of the private messages sent on or before Sept 6 were lost due to the hacker. In the aftermath, I had to drop all of the custom avatars to allow new ones to work. (if you lost your avatar and don't have a backup LMK and i'll look in the old DB file and see if I can find it.)

Now I can't elaborate on the how I fixed it part because I used several flaws in the server configuration to gain access to the MySQL database.

I'm sure I missed several details in this message.

Discuss if you want.... just don't flame each other.