Support

Admin Tools

#25693 Sites got hacked

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Thursday, 25 August 2016 17:20 CDT

Doomster
 I'm not getting the updates through my site. Is beside the point. I'm using a Helix III template and this is what I do, my templates from on my site. (FrameWork) so I am a little concerned. Do not see it in the code. I got 6 emails saying I had exceptions but it did not block them. The only change I made on one of my sites (which is I got exceptions), is that I put up a coming soon page and it was a done deal right away. I have to say... being a little familiar with code that it may have left it a little open but was curious as to your suggestions. I lost both sites on the same server but had backups, thanks to you. One is the primary and the other is an addon domain. He got them both with my DB.
I should be a little more specific.. I am on a shard server and as I said site is a Domain and a Sub Domain. Same server. Some how he gave me a DB error. If you need it I can give it but each time I tried to access would be a diff error.

tampe125
Akeeba Staff
Hello Harold,

can you please be more specific? Do you need help to unhack your site, or you want some kind of code review of the templates you wrote?
We can only help you in the first case, here you can find a very detailed guide to unhack your site.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Doomster
Guess what I need to know is about blocking this or something. Almost as soon as I switched to the comingsoon page I had all these exeptions right away and no more access to my DB from either of my sites. Or should I include this in the template section for access. It is a comingsoon.php so I don't really understand the TMPL for the template.
180.76.15.12
180.76.15.143
180.76.15.135
180.76.15.161
180.76.15.34
180.76.15.10

-------------------------------------------------------------------------------
Blocking reason: tmpl
-------------------------------------------------------------------------------
Date/time : 2016-07-22 01:25:48 GMT
URL : http://www.dropalineentertainment.com/community/groups/viewdiscussion/?tmpl=comingsoon
User : Guest
IP : 180.76.15.10
Country : (unknown country)
Continent : (unknown continent)
UA : Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)

dlb
Davide is on vacation this week.

Yes, adding comingsoon to the "List of allowed tmpl= keywords" should fix the problem. This is a comma separated list.


Dale L. Brackin
Support Specialist


us.gifEnglish: native


Please keep in mind my timezone and cultural differences when reading my replies. Thank you!


????
My time zone is EST (UTC -5) (click here to see my current time in Philadelphia, PA)

nicholas
Akeeba Staff
Manager
If you got an email from Admin Tools the request was blocked. This means that YOU ARE NOT HACKED. Sorry for the bold and capital letters, I wanted to make sure the message comes across. That's the important thing to remember.

The reason of the blocking was the existence of tmpl in the URL. Please read https://www.akeebabackup.com/documentation/admin-tools/web-application-firewall.html#waf-configure under "Block tmpl=foo system template switch" to understand the Admin Tools protection feature in play. I am pasting this here for you:

One of the lesser known Joomla! features are its system templates. Whenever an error occurs or you put your site offline, Joomla! loads the respective system template. Passing the name of the template in the URL by appending, say, ?tmpl=offline allows you to test those templates without having to actually produce an error or put your site off-line. Do note that tmpl=system and tmpl=component must be permitted (see next option), as they are required by some extensions to work.


As Dale implied, it seems that your site requires a special "comingsoon" template parameter to show a "Coming Soon" page while it's under construction. So go to your site's administrator backend, Components, Admin Tools, Web Application Firewall, Configure WAF, find the List of allowed tmpl= keywords and change it to read exactly
component,system,raw,comingsoon

Click on Save & Close and everything is fine. Trust us.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Doomster
Even though you guys are busy, Thank You for the fast response and help.
As long as I don't think the Component is failing me (obviously not! Never has! Very happy with it!), I'm happy. What I don't really understand is that I kept going to a DB error on my sites straight afterwords. My stupid self (Dumb A**) didn't get copies of anything to compare and just did a fast restore as I have my Products site on the server. Just in your opinion, do you think it had anything to do with it? And you can close this thread if you like.

nicholas
Akeeba Staff
Manager
No, it shouldn't have anything to do with it. I would be 100% certain if I could see the error message to understand what kind of DB error you are having.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!