XF 1.5 Hacked forum

[Sunka]

my forum is hacked 15 minute ago.
Still have access to ACP. I disabled all addons.
what to do right now?

 

[Sunka]

Sorry but no. I shared that only with Xenforo Staff.

 

[Ozzy47]

Sorry but no. I shared that only with Xenforo Staff.

Wise decision.

 

[ManagerJosh]

Sorry but no. I shared that only with Xenforo Staff.

That's fine. Based on the PHP Shell itself, I could probably figure out what they were trying to do - including what their objectives.

Wise decision.

Debatable. Computer Forensics and Incident Handling/Response is my primary day job and I enjoy it quite a bit. Always looking for more incident to do an analysis and understand an adversary even more.

 

[ManagerJosh]

BTW, just for the record - malware scans do nothing. It's still signature based, and a PHP shell would not be picked up by malware scans if the signatures are not in the malware scanner.