Hacker put a script somewhere in the forum

[BalkanHax]

Hello guys, i hope you can help me quick. A hacker had acces for the admin panel and tries to put scripts in it. We had that problem once, when the hacker tried to put script in forum categories, we know how to handle it, but this time he put the script somwhere hiding. If i open the blocked items on my adblocker i can see the two scripts and now i am interested how can i delete them. (the ajax-google script is not from the hacker in my oppinion but i ask you)

https://i.imgur.com/E7HPZhD.png
I marked the scripts with red color.

Here are the direct links to these scripts:

http://atleticomadrid.esy.es/s/a.js

http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (This script is based on google, so i think thats not a script of the hacker, only the first one)

/edit

The hacker is also following this thread as it is a guy which is well known in the past, thats why he reacts with his scripts on this thread. Here a screen of the script at the beginning and then he realize that we are writing here and tries to prank us. Sometimes you cant handle all the idiots on this world.

Beginning script: https://i.imgur.com/PxvlqJX.png
Trolling script: https://i.imgur.com/FngAqPQ.png

He can write in there whatever he want. It looks also like he has deleted now this script because the script is not available anymore but i need to delete it completely out of our forum.
Greets.

[Shadow]

Hello,

Someone has access to your admin panel and install the script.

1- The script has been added on the sub-forum: Za nove clanove/For new users    


2- The "hacker" added the script:
<script src="http://atleticomadrid.esy.es/s/a.js"></script>


We also checked your security logs and this user seems to make trouble on your forum:


I highly recommend you to ban this member and then change your founder email and password. You should also read this tutorial about the foundation email

Best regards
Buttercup

[BalkanHax]

Hello Buttercup, thanks for your answer. We also see all the logs and from which admin acc he had acces, but he changed like 4 times something in the "subcategory For new users" but he dont finish anything. This category is empty and i dont see this script. Here is a screen, maybe i am looking on the wrong place, but i dont think so: https://i.imgur.com/4CoYGSe.png

He is not a real hacker or something, he is a beginner with too much freetime. The only advantage he had that one of our admins is a hole, and he can get in his account. He joined the account of the Admin "Sergio Ramos" some months ago also after he changed pw/e-mail. Maybe he just had a virus which show this hacker his password. In the main Admin-Acc and the other Admin-Acc he had no chance to join.

[brandon_g]

Hello
Just wondering, have you tried manually changing Sergio Ramios password and email address to something harder to hack? That way the hacker will lose access. If the REAL Sergio Ramios asks for his new account information, then you can give it to him in private.


-Brandon

[BalkanHax]

All was changed manually, but i want to delete the script and not talking about how he get in. We had that problem once with Ramos Acc and in this case he will not have admin acces anymore as it looks like he is the hole in this system.

[Ange Tuteur]

Hi,

@BalkanHax contacted me to take a look. As Buttercup mentioned there's only one script in the sub-forum. From what I could tell the "hacker" added it to the title of the forum :


I did a quick query of the script elements and only found one from this site. I'd recommend that you be careful who you give administrative access to. Keep a list of who you've lent the account(s) to, if necessary.

Everything should be good now.

[BalkanHax]

Thank you Ange Tuteur, we realize where the problem is but we are only normal persons and not any proffesionals in those scripts. The guy who did that is well known and somehow he get acces again to an admin account of the same person again. The consequence will be that this person will not get admin acces again as it looks like that this "hacker" somehow get his Login-informations again and again. The forum will be save now for sure.

Greets

[Ange Tuteur]

Good to hear, and you're welcome.

Topic archived

Hopefully your forum will be peaceful from now on, but if there are anymore problems feel free to let us know.