Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a phpBB 3.0.5 installed on a linux server: (oovium.com/forums/). I noticed two days ago someone using an autogenerated email address from China created a new account without having read a single message. The email address they used was listed on http://stopforumspam.com. I deleted the account.

Yesterday, the same (or similar) email address created another account, but this time they posted a message complaining about having trouble with registration and posted their registration link.

I stupidly clicked the link and it took me back to my forum. I then deleted the account and its message.

The message is deleted so I don't know exactly what the URL that I clicked was.

So my questions: 1. Is there a way to hack a phpBB 3.0.5 by having an admin user click a link? 2. Is there a way to determine if the message board has been hacked? 3. Is there any way to retrieve that deleted message so I can determine precisely what the URL was?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

the apache access logs will show you the link you clicked, if you can remember roughly when you clicked it and what IP you were using, you can minimize your search.

also, you should be checking your logs for unusual activity, now, to see if you have indeed been exploited in some way.

apache's logs are usually stored in /var/log/httpd/ or /var/log/apache depending on your server's configuration, the log directory should be listed in your web server's configuration file.

share|improve this answer
1  
Thanks a lot. I was able to find the log entry and as far as I can tell there is nothing suspicious after I clicked on that message. Now, I just wonder if the URL sent me offsite and somehow forwarded me back. Not sure, how that would be helpful anyway. I did find a ton of hack attempts in that log file however. It's a little frightning actually. Most seemed unsuccessful, but it seems the default install of phpMyAdmin leaves an admin screen unprotected and a number of people were hitting that. Guess I'll post another question on that one. –  aepryus Aug 3 '10 at 22:05
add comment

1) In principle, yes. By clicking on links, the admin is performing actions. Specially crafted links can be created to perform undesirable actions.

2) Review the logs. Check file integrity. Determining if you've been hacked is not a trivial problem.

3) Accessed urls can be retrieved through the server logs. Deleted messages might be available in the SQL database that backs phpBB.

Best of luck

share|improve this answer
    
Thanks a lot, I was able to track down the log file. I also poked through the MySQL database for phpBB, but they don't seem to archive deleted messages at all. –  aepryus Aug 3 '10 at 22:08
add comment

One thing to test... I would register yourself a fake user and get the registration email with the link. Take it and paste it into the address bar and change a few characters to make it fake. If it just redirects you back like the link he posted did, more than likely he just linked the original link he received upon the first registration and phpBB just routes you to a predefined page if the validation link is not valid.

share|improve this answer
    
Yeah, I'm not too concerned if it were a legitimate registration URL. I'm more worried about the URL actually being something else and my failure to avoid the social engineering leading me to click it. –  aepryus Aug 3 '10 at 22:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.