I was unable to access my email starting this morning, and after trying pretty much everything, I discovered a message from a hacker on both of my eFic install subdomains. They had replaced my config.php with their own; I'm not sure how they accessed it in the first place or what I can do, but I've been using phpMyAdmin to change any and all details that they may have altered to suit them and their identity; because I no longer have access to my hacked email account, I've been changing that as well.
But on one of my eFic installs, I changed the email address associated with my account to one I have access to... yet it wouldn't accept any known permutations of my password. I'm guessing that it's THAT particular install (the one with the most changes throughout) that was the hacked one, and so the password to that has been changed as well. I tried to reset the password using the tool that comes with eFiction, but I got this error:
Warning: fsockopen() [function.fsockopen]: php_network_getaddresses: getaddrinfo failed: Name or service not known in /home/**/public_html/epiphany/includes/smtp_include.php on line 106
Warning: fsockopen() [function.fsockopen]: unable to connect to smtp.seventh-star.net:25 in /home/**/public_html/epiphany/includes/smtp_include.php on line 106
Here: http://seventh-star.net/epiphany, though http://seventh-star.net/drfa was also hacked; I've since re-uploaded MY config.php for both sites, so my site is once again displaying for both. But for the former, I can't login.
I'm guessing it's not saying that the email I added is invalid, just that it can't connect (for some reason) to my server's SMTP, even though the information in phpMyAdmin is correct.
How can I fix this so I can get into my account again (since the password in the phpMyAdmin is encrypted/scrambled), and how can I prevent future breaches of this nature? Was it something like my config.php file didn't have the permissions set properly, or something more sinister?
Archive: Dragonfayth
eFiction: 3.5.5/6
Latest Patch(es): Yes
bridged?: No
modified?: Yes
PHP: 7.4.25
MySQL: 5.7.32-35-log
Create a file makeupaname.php and write into it:
<? print md5("mynewpassword"); ?>
Then browse to makeupaname.php and it will display the encrypted form of "mynewpassword". Use phpmyadmin to write that value into the database and you will be able to login. Then delete the php file.
Thanks for that; I was able to get into my other domain. But now I'd like to make sure the hacking can never happen again, and I'm not sure where the vulnerability really was.
Archive: Dragonfayth
eFiction: 3.5.5/6
Latest Patch(es): Yes
bridged?: No
modified?: Yes
PHP: 7.4.25
MySQL: 5.7.32-35-log
It could be this one: https://efiction.org/forums/index.php?topic=4712.0
Delete your bridges folder if you aren't using them, or at least rename it something random.
