XF 1.2 HELP! site hacked locked out of admin cp, unable to create a new admin or restore one

[XxUnkn0wnxX]

as the title says i am locked out of admin cp i cannot ad new admins in the admin panel so how do i bypass the admin panel? using phpmyadmin to create and add a super super admin without the use of admin cp?

 

[XxUnkn0wnxX]

Do you have other forums/scripts installed in your server? Even for testing purposes or left over from before etc?

well i do have a testing board in another folder but has not been effected it is up to date, i have reset all passwords on it but it doesn't have much and all add ones up to date, there are no week links to it so if damage where done to it would not effect main forums + i get an email each time some one logs in or fails an attempt into admin cp on main forums and test board

i don't have any custom scripts only the ones originally set up by hosting provider and that the server needs in order to run

 

[Slavik]

i have went through my logs no one got access via ssh only my ip is in the list and i can confirm i was on via ssh during the times i shows in the logs. though there have been many attempts but all failed

Well you'll have to wait for your host to investigate in that case. However I would suggest you focus on looking for the problem elsewhere, because it won't be with XenForo itself.

The facts still remain, a) there is no currently publicly known exploit for XenForo available. b) If there were a private exploit known, there are considerably more valueble targets than your site available to target c) every case we have investigated has been due to other applications on the sever being at fault, never Xenforo.

 

[XxUnkn0wnxX]

all i know that the exploit is related to "/library/Sabre" specifically to Sabre

 

[Adam Howard]

and my hosting is hostgator

Problem likely found.

WebHostingTalk.com has been talking about the security and other issues on hostgator since they got bought out by EIG

What I can tell you is a list of providers to avoid (technically, it's just 1 provider, but many names)
http://en.wikipedia.org/wiki/Endurance_International_Group

And here is a 3 part article as to why
http://www.digitalfaq.com/editorials/websites-blogs/hostgator-alternatives-eig-pt1.htm

Then you may wish to checkout http://www.WebHostingTalk.com for a good provide

 

[MattW]

all i know that the exploit is related to "/library/Sabre" specifically to Sabre

And how have you determined that?

 

[Slavik]

I'm locking this thread.

Until such time as the author wants to get in touch with us via ticket with evidence of an exploit i'm not going to allow these unfounded and frankly absurd accusations to keep flying.