Jump to content

[Solved] Johnny Hacked


Recommended Posts

Guest Geoff

@whoever has shell access on johnny

 

chown -R those files to his username.

 

 

Huh? Is that directed towards me?

 

No. It's for djbob.

 

 

Is it really that hard to reset my account? I can't upload anything

 

We can delete your account. Please wait for someone to try the command above first.

Link to comment
Share on other sites

  • Replies 140
  • Created
  • Last Reply

Top Posters In This Topic

Guest Geoff

I was thinking the hackers chowned some of the files in his account to root.

 

You might be able to fix this by chowning all of the files in /home/aprime on johnny to the user aprime.

Link to comment
Share on other sites

@djbob I've just successfully added a new domain to my account and my previous domain was deleted by Geoff. But unfortunately I've seen this message again "A3q was here ... A3q [ at ] att [ . ] net" !!

I changed my index file on April 3rd. I checked my other files (in public html) very carefully. Everything was fine. I was able to use my site. Now when I've seen that msg again, then I've checked again. No, there is no problem with any of my files. And I am pretty damn sure that this issue is not completely fixed in you server :( Generally after adding a domain into jonny, either there shows a queue msg or the main site of the user. But this time its different :( Hope you'll check Jonny again.

 

*Your cgi-sys/defaultwebpage.cgi says, "A3q was here ... A3q [ at ] att [ . ] net" :( :(

 

I am sorry cause I told that my previous domain was deleted. Don't worry. That wasn't deleted :) I mistook it. Anyway, my other info was correct.

 

@djbob I've just successfully added a new domain to my account and my previous domain was deleted by Geoff. But unfortunately I've seen this message again "A3q was here ... A3q [ at ] att [ . ] net" !!

I changed my index file on April 3rd. I checked my other files (in public html) very carefully. Everything was fine. I was able to use my site. Now when I've seen that msg again, then I've checked again. No, there is no problem with any of my files. And I am pretty damn sure that this issue is not completely fixed in you server :( Generally after adding a domain into jonny, either there shows a queue msg or the main site of the user. But this time its different :( Hope you'll check Jonny again.

 

*Your cgi-sys/defaultwebpage.cgi says, "A3q was here ... A3q [ at ] att [ . ] net" :( :(

 

I am sorry cause I told that my previous domain was deleted. Don't worry. That wasn't deleted :) I mistook it. Anyway, my other info was correct.

 

Sorry for one thing, my previous domain (account's main domain) was not deleted :) I mistook it. The other info was correct.

Link to comment
Share on other sites

Perhaps I can help by noting few points on my username: siddhant (siddhant3s.heliohost.org)

 

 

I hope this will help you resolve the problem.

I am on Johnny.

Link to comment
Share on other sites

@djbob Suppose

#you have a domain mydomain.com

#now park a domain mydomain1.com

#visit mydomain1.com

#first you'll automatically go here http://mydomain1.com/cgi-sys/defaultwebpage.cgi

#then you'll see this: A3q was here ... A3q [ at ] att [ . ] net

#again, create a subdomain like subdomain.mydomain.com

#visit subdomain.mydomain.com

#you'll automatically go here http://subdomain.mydomain.com/cgi-sys/defaultwebpage.cgi

#then you'll see this: A3q was here ... A3q [ at ] att [ . ] net

 

Hope you've understood now.

 

[if you do not see the message, then clear cookie & cache. I hope this will help you.]

Link to comment
Share on other sites

@djbob Suppose

#you have a domain mydomain.com

#now park a domain mydomain1.com

#visit mydomain1.com

#first you'll automatically go here http://mydomain1.com/cgi-sys/defaultwebpage.cgi

#then you'll see this: A3q was here ... A3q [ at ] att [ . ] net

#again, create a subdomain like subdomain.mydomain.com

#visit subdomain.mydomain.com

#you'll automatically go here http://subdomain.mydomain.com/cgi-sys/defaultwebpage.cgi

#then you'll see this: A3q was here ... A3q [ at ] att [ . ] net

 

Hope you've understood now.

 

[if you do not see the message, then clear cookie & cache. I hope this will help you.]

 

That is exactly my problem too.

Link to comment
Share on other sites

Thanks, it works now :)

 

Out of curiosity

How do you guys know if the person on the Helionet forum is the same person on Heliohost?

They can easily have the same name and claim to be somebody else, since the users have to sign up for each site separately

Link to comment
Share on other sites

@Aprime - Umm... I'm not sure if a user would request support for another user that they don't know.

 

And if a user requests for their website to be deleted, we would check their index.html to see if it reads 'All files have been deleted! Please delete my site!'.

Link to comment
Share on other sites

Guest Geoff

@djbob The problem is the queued page on johnny was replaced with the hacker page.

 

@everyone else Clear your cache.

 

How do you guys know if the person on the Helionet forum is the same person on Heliohost?

 

We are working on fixing this problem. Unfortunately, we are waiting on this theme to be ported to IPB 3.

Link to comment
Share on other sites

@everyone else Clear your cache.

My cURL interaction

[siddhant3s@x10n ~]$ curl http://yatantrika.co.cc
<html><head>
<meta http-equiv="Cache-Control" content="no-store, no-cache, must-revalidate, max-age=0" />
<meta http-equiv="Pragma" content="no-store, no-cache, must-revalidate, max-age=0" />
<meta http-equiv="Expires" content="Tue, 01 Jan 1980 1:00:00 gmt" />
<meta http-equiv="Refresh" content="0;URL=/cgi-sys/defaultwebpage.cgi">
</head><body></body></html>
[siddhant3s@x10n ~]$ curl http://yatantrika.co.cc/cgi-sys/defaultwebpage.cgi
A3q was here  ...  A3q [ at ] att [ . ] net[siddhant3s@x10n ~]$

No point of cache.

 

 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.

×
×
  • Create New...