:o man i'll get a warning lol they've banned me twice the other day as it is rofl
like i give a shit rofl
You must think your superman. I think ppl forget that this is all free. It takes alot of time and effort to maintain a site of this size.
To the fellow admins here at mpc who do a fine good job:
There were popups used with wmf exploits two days before the site went down.
The files used were:
xpl.wmf " http://www.google.com/search?hl=en&lr=&q=xpl.wmf "
sploit.anr " http://www.google.com/search?hl=en&lr=&q=sploit.anr "
You guys should use the .htaccess file more if you dont already do to deny access to the admin panel.
Share with other cheat site admins the ips used to "hack" the site so we can ban those as well. I understand that mostlikely in this case there were proxies used but there are addons to deny access to a site if a person is using a proxy server or a tunnel.
There is a project on sourceforge that gathers daily or weekly proxy ips. It takes on click and replacing one file to deny access to those proxys here.
You can also check out: http://www.vbulletin.org/forum/showthread.php?t=96318
<?php
// Anti-Poroxy
/*
Title:
Proxy Detection
Version:
v2.0
Description:
This will detect any suspicious open socket
that the user is running and if found in an
array, it will not let the user proceed to
the website, and the ability to allow certain
hosts to pass the scan.
Author:
Jonathan Anders
geminii@citcom.net
http://www.unixcon.net/~datalogik/scripts/
Usage:
Just include this page in any webpage you want protected.
Notes:
If you like this code and use it, I would like to inform you of a much larger
project that I am working on named 'phpPPS - Protection Suite' which uses the
same concept but in a much larger, multiple-user oriented way.
*/
/* Modify these next few lines to whatever you like. */
$Ports = array( '80', '81', '1080', '8080', '3128', '8000', '8888'); // To hold the list of ports.
$AllowedHosts = array('localhost', 'otherhost.com'); // To hold the list of allowed hosts.
$DisallowedHosts = array('proxyserver.com', 'agnitum.com'); // To hold the list of disallowed hosts.
$Redirect = "http://www.mysite.com/forum/proxyerror.html"; // Redirect page
$SocketTimeout = 1; // Higher the number, the longer it takes.
/* End of modification. */
if ((!in_array ($REMOTE_ADDR, $AllowedHosts)) && (!in_array ($REMOTE_ADDR, $DisallowedHosts)))
{
$x = 1;
while ($Ports[$x])
{
$fSockPointer = fsockopen($REMOTE_ADDR, $Ports[$x], $errno, $errstr, $SocketTimeout);
if ($fSockPointer)
{
header ("Location: $Redirect");
fclose($fSockPointer);
}
$x++;
}
} else {
if (in_array ($REMOTE_ADDR, $AllowedHosts))
{
die();
} else {
header ("Location: $Redirect");
die();
}
}
?>
############################################
# Hack Name: Proxy Detector v1.0
# Author: Takara (Steph Sauvé, wizzyx@rogers.com)
# Date: 07.05.02
############################################
# Version of vB: 2.2.5
# Description: This is little hack detects via the Environmental Variable
# HTTP_X_FORWARDED_FOR if the user is using a proxy. Most proxys give out this
# variable. If it is it will display it out for you, and allow you to view the
# real IP of the person, and proxy IP/hostmask when you click the link.
#
# Files Edited: newthread.php, newreply.php
# Templates Modified: threads_displayip
# Templates Added: None
# SQL Columns Added: proxyip
#
# Notes: I borrowed this install file layout from someone (I don't
# remember), thanks though! Aswell remember to backup your files
# and your DB before making any changes!
############################################
### Run the Following SQL Query
ALTER TABLE post ADD proxyip VARCHAR(255) not null AFTER ipaddress;
### Open newreply.php
### Find
if ($logip==1 or $logip==2) {
$ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
} else {
$ipaddress="";
}
### After That Add
if (getenv("HTTP_FORWARDED")!="") {
$proxyip=getenv("HTTP_FORWARDED");$proxyip="<P>Proxy Detected. Real IP: $proxyip<br><small>Because a proxy has been detected, the above IPs are those of the proxy</small></P>";
} elseif (getenv("HTTP_X_FORWARDED_FOR")!="") {
$proxyip=getenv("HTTP_X_FORWARDED_FOR");$proxyip="<P>Proxy Detected. Real IP: $proxyip<br><small>Because a proxy has been detected, the above IPs are those of the proxy</small></P>";
} elseif (getenv("HTTP_CLIENT_IP")!="") {
$proxyip=getenv("HTTP_CLIENT_IP");$proxyip="<P>Proxy Detected. Real IP: $proxyip<br><small>Because a proxy has been detected, the above IPs are those of the proxy</small></P>";
} else {
$proxyip="";
}
### Find
$DB_site->query("INSERT INTO post (postid,threadid,title,username,userid,dateline,at tachmentid,pagetext, allowsmilie,showsignature,ipaddress,iconid,visible ) VALUES (NULL,'$threadid','".addslashes(htmlspecialchars($subject))."','" . addslashes($postusername)."' ,'$bbuserinfo[userid]','".time()."','$attachmentid','".addslashes($message). "','$allowsmilie','$signature','$ipaddress','$iconi d','1')");
### Replace By
$DB_site->query("INSERT INTO post (postid,threadid,title,username,userid,dateline,at tachmentid,pagetext, allowsmilie,showsignature,ipaddress,proxyip,iconid ,visible) VALUES (NULL,'$threadid','".addslashes(htmlspecialchars($subject))."','" .addslashes($postusername)."','$bbuserinfo[userid]','". time()."','$attachmentid','".addslashes($message)."','$allowsmilie', '$signature','$ipaddress','$proxyip','$iconid','1' )");
### Close newreply.php
### Open newthread.php
### Find
if ($logip==1 or $logip==2) {
$ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
} else {
$ipaddress="";
}
### After That Add
if (getenv("HTTP_FORWARDED")!="") {
$proxyip=getenv("HTTP_FORWARDED");$proxyip="<P>Proxy Detected. Real IP: $proxyip<br><small>Because a proxy has been detected, the above IPs are those of the proxy</small></P>";
} elseif (getenv("HTTP_X_FORWARDED_FOR")!="") {
$proxyip=getenv("HTTP_X_FORWARDED_FOR");$proxyip="<P>Proxy Detected. Real IP: $proxyip<br><small>Because a proxy has been detected, the above IPs are those of the proxy</small></P>";
} elseif (getenv("HTTP_CLIENT_IP")!="") {
$proxyip=getenv("HTTP_CLIENT_IP");$proxyip="<P>Proxy Detected. Real IP: $proxyip<br><small>Because a proxy has been detected, the above IPs are those of the proxy</small></P>";
} else {
$proxyip="";
}
### Find
$DB_site->query("INSERT INTO post (postid,threadid,title,username,userid,dateline,at tachmentid,pagetext, allowsmilie,showsignature,ipaddress,iconid,visible ) VALUES (NULL,'$threadid','".addslashes(htmlspecialchars($subject))."', '".addslashes($postusername)."','$bbuserinfo[userid]','".time()."','$attachmentid', '".addslashes($message)."','$allowsmilie','$signature','$ipaddress','$iconi d','1')");
### Replace By
$DB_site->query("INSERT INTO post (postid,threadid,title,username,userid,dateline,at tachmentid,pagetext, allowsmilie,showsignature,ipaddress,proxyip,iconid ,visible) VALUES (NULL,'$threadid','".addslashes(htmlspecialchars($subject))."','". addslashes($postusername)."','$bbuserinfo[userid]','".time()."', '$attachmentid','".addslashes($message)."','$allowsmilie','$signature', '$ipaddress','$proxyip','$iconid','1')");
### Close newthread.php
### Login to your control panel
## Go to Templates -> Thread Management Templates -> threads_displayip
### Replace ALL with:
The IP Address is: $postinfo[ipaddress]. The host name is: $postinfo[hostaddress].$proxyipPlease click <a href="showthread.php?s=$session[sessionhash]&threadid=$threadid">here</a> to return to the thread.
### Done in the control panel
### Ok, done editing everything, now upload all the files that were edited (newthread.php, newreply.php). And you're done.
For phpbb forums i know this works it may help you guys out:
Here is the schtuff..
- In the includes directory create a new file call proxyblocker_scan.php
- Cut and paste the following into it.
Code:
< ?php
//
// Is this a new proxy using known proxy ports ?
// could have used port 80 but many dialups use it on their servers...
$ports = array( 3128, 1080, 8080 );
$target = $_SERVER['REMOTE_ADDR'];
while( $port = array_pop( $ports ))
{
$isproxy = 0;
// open a socket to the connecting host on well known proxy sockets
$socket = @fsockopen( \"tcp://$target\", $port, $errno, $errstr, 3 );
if( $errno == 0 )
{
$request = "GET http://www.google.com/ HTTP/1.0\r\n\";
$request .= "Proxy-Connection: Keep-Alive\r\n\";
$request .= "Pragma: no-cache\r\n\";
$request .= "Host: www.google.com\r\n\";
$request .= "User-Agent: MSIE 6.0\r\n\";
$request .= "\r\n\";
fputs($socket, $request);
$response = fputs($socket, 128);
if(strlen(stristr($response, \"200\")) > 0){
$isproxy = 1;
}
if( $isproxy )
{
fclose($socket);
die();
} else {
fclose($socket);
}
}
}
?>
- Save and close the file.
- In the includes directory create and open a file called proxyblocker_dnsbl.php
- Cut and paste the following into the file:
Code:
< ?php
$reverse_ip = get_reversed_ip( $_SERVER['REMOTE_ADDR'] );
// array of rbl servers
$rbl_dns_servers = array(
'.http.dnsbl.sorbs.net',
'.socks.dnsbl.sorbs.net',
'.misc.dnsbl.sorbs.net',
'.proxies.blackholes.easynet.nl',
'.list.dsbl.org'
);
// loop through list of rbl servers
while( $reverse_dns = array_pop( $rbl_dns_servers ))
{
// check for ip on a rbl server
if( check_rbl( $reverse_ip, $reverse_dns ))
{
// discovered a proxy on one of the servers
die();
}
}
?>
- Save and Close the File
- Create and Open file in includes directory called ‘functions_proxyblock.php’
- Cut and paste the following into file:
Code:
< ?php
// checks to see if a ip is on a dns server
function check_rbl( $reverse_ip, $reverse_dns )
{
$is_bad_ip = FALSE;
$rlookup = $reverse_ip . $reverse_dns;
if( $rlookup == gethostbyname($rlookup))
{
// returned the same info so not on list
} else {
// returned information so is on list
$is_bad_ip = TRUE;
}
return $is_bad_ip;
}
// takes an ip address passed to it and returns a revered ip
function get_reversed_ip( $ip )
{
$ip_exploded = explode('.', $ip );
$reverse_ip = "$ip_exploded[3].$ip_exploded[2].$ip_exploded[1].$ip_exploded[0]\";
return $reverse_ip;
}
?>
- Open common.php
- FIND include($phpbb_root_path . ‘includes/db.’.$phpEx);
- AFTER WRITE include($phpbb_root_path . ‘includes/functions_proxyblock.’.$phpEx);
- SAVE & CLOSE common.php
- OPEN login.php
- FIND include($phpbb_root_path . ‘common.’.$phpEx);
- AFTER ADD
Code:
include($phpbb_root_path . ‘proxyblocker_scan.’.$phpEx);
include($phpbb_root_path . ‘proxyblocker_dnsbl.’.$phpEx);
You guys did a great job bringing the site back online. Keep up the good work.