New exploit? [READ]

Hello,

My server just got attacked, TB_User was deleted and the char names etc was removed - how this happened i'm not sure, i've blocked the following ports: 15880, 32000, 15882, 15885, 15883, 8080, 1433, 3306, 1990 , using SQL Server 2008 R2 - connecting from another place isn't possible. Using Win 2008, latest updates (windows) firewall is on, advanced firewall is on as well.. so is there a new exploit or something?

To mention, Certification is off, not running..

Website...

yeah prob your register script

NeSRO Games - SilkRoad Online! - yea could be the reg script, hmm what should i do?

Quote:

---

Originally Posted by serend

yeah prob your register script

---

Dunno.. well im not sure ha :S

try turning allow remote connections off in sql & change your register script

Maybe SQL Injection on Website you use. I never trust any scripts that are not coded by me :D

i would say register too, but it may be every input field you use for sql strings.
you might want to check the globals you send with it for inappropriate characters ..

something like this:

PHP Security Class

PHP Code:

---

<?php
    class Security {
        function secure($data) {
            if ( !isset($data) or empty($data) ) return '';
            if ( is_numeric($data) ) return $data;
            $non_displayables = array('/%0[0-8bcef]/', '/%1[0-9a-f]/', '/[\x00-\x08]/', '/\x0b/', '/\x0c/', '/[\x0e-\x1f]/');
            foreach ( $non_displayables as $regex )
                $data = preg_replace( $regex, '', $data );
            $data = str_replace("'", "''", $data );
            return $data;
        }
        function checkChars($data) {
            $check = preg_match("/^[a-zA-Z0-9]+$/", $data);
            if ($check == 0) {
                return false;
            } else {
                return true;
            }
        }
        function checkEmail($data) {
            $check = preg_match("/^[a-zA-Z]\w+(\.\w+)*\@\w+(\.[0-9a-zA-Z]+)*\.[a-zA-Z]{2,4}$/", $data);
            if ($check == 0) {
                return false;
            } else {
                return true;
            }
        }
        function checkMinLength($data, $length) {
            if (strlen($data) < $length) {
                return false;
            } else {
                return true;
            }
        }
        function checkMaxLength($data, $length) {
            if (strlen($data) > $length) {
                return false;
            } else {
                return true;
            }
        }
    }
?>

---

Use it like this:

PHP Code:

---

$usr = $sec->secure($_POST['username']);
$pwdentered = $sec->secure($_POST['password']);
$pwd = md5($sec->secure($_POST['password']));
$email = $sec->secure($_POST['email']);
$ip = $_SERVER['REMOTE_ADDR']; 


---

Please Note: The Security Class above was not written by me, credits to some other guy whose name i forgot (if you happen to be reading this pm me ill add your name)

greetz

Is your billing scripts web accessible?
Did you block all connections to globalmanager?
Both of those are vulnerable to sql injections

I dont think its an exploit anymore, I'm not sure, how do I post the logs from Ollydbg?

188.165.198.91 - / is it your server ?

I'm Have Sure

Joymax Atack We Servers