My site defaced - now what?

[Lawrence]

I recently had my site defaced. I'm hoping for help trying to sort out how they did it and how I can block the hole. My setup is as follows:

Abyss X2 2.0.6
Inivision Power Board 1.3 Final
Pivot Blog 1.30 alpha 3: 'Rippersnapper'
Perl is installed for my access stats, and coranto, both of which are password protected by abyss.
PHP is 4.3.1

To my knowledge there are no vulns in these packages, but there's obviously something broken somewhere.

If anyone has a suggestion on how I might track down the exploit I'd love to hear it.

EDIT: I've been told by one of the defacer's crew (They were kind enough to leave their IRC lair in the deface page) that they used a hack in invision's pollrenderer.php

Now to solve that hole...

[p3]

Check your server logs and see where they were and what they did. My guess is they injected some code that allows them to edit pages.

[Lawrence]

If they used a PHP exploit to do the job there wouldn't be any upload records on the serverlog, would there?

Found the hack. It's a Pivot exploit.

[MonkeyNation]

DDoSing is your friend.
_________________

[Arctic]

You got hacked because you used some weird, completly weirdly named PHP script...?

Just do something else for your forum like bMachine, or BoostMachine. It works MUCH better than whatever you are using.

[cmxflash]

[Removed]

[aprelium]

[cmxflash]

[Removed]