Will pay for help solving issue ASAP

[kiladila]

ok i will thanks!

kiladila Reviewed by kiladila on 31st May 2010. Will pay for help solving issue ASAP Have very big problem with rapidleech server: www.leechking.com Somebody with IP 95.211.100.XXX stealing my RapidShare accounts and drainin all traffic from it. I can't do anything even password change not helping. What i have done: first of all reintalled OS to Linux Ubuntu, than changed my root, mysql, admin zone pass. Added extra security to admin zone (additional server side login), changed all RapidShare premium passwords. And nothing, in the next day same fucked IP is showing in Rating: 5

[kd1987]

Simple 2 possibilities:

1. Your system is compromised, system from where you access your server!
2. Your server is compromised, backdoored or just shelled.

Solution for 1: Take back up (of individual file and folder), format re-install your OS and then access your server. Don't break your head in solving it.

Solution for 2: nmap -PN on your server and check for any binded shells! Disable functions like fsockopen, system (leeching should work with them disabled) in php.ini. Look out for files like "shbd" or anything that sounds weird in your 777 folders, including /tmp/ .

Simple?

[kiladila]

Thanks kd1987 for advices i will look in to it, but i think this is sql injection some where in script...

[kd1987]

If it is sqli that u suspect then, add this line in your .htaccess

php_flag magic_quotes_gpc on

relying on this feature is discouraged however, if the claimed "hacker" is one of those scripties who knows only about sqli, x=x auth bypass, lfi, rfi, etc.. then, it will keep him at his bay

[kiladila]

We didn't managed how stealing was done, but after changing rapidleech script from rapidleech plus from zecel.com to original upgraded, problem are gone. So it's seams that rapidleech+ from zecel.com have serious backdoors ir something like this.

[kd1987]

Cheers!

[kiladila]

albertoberto you right. Problem is solved yesterday and reason:
insert_location() function (download
system) which reveals premium cookies and base_64 encoded auth-strings to end
user(s). with simple http debuger.