Have I been hacked? [not a hack attempt]

[Rawksie]

A while back, I renamed admin to make it harder to hack my site.

My site has been set to 'down for maintenance' for some time, because it's not ready.

I tried just now to enter my admin area and it said I don't have permission.

What has happened? It seems my IP has been blocked out, likely with a .htaccess
I'm going to go check it out via other routes now, but any information or ideas would be uber, thanks.

EDIT:
Hokay.

The .htaccess in my admin directory says this;

<filesmatch "\.(php3?|tpl|inc|txt|cfg)$">
deny from all
</filesmatch>

Is this correct?

[Rawksie]

I forgot to mention, I have been able to access my renamed admin up until just now. I have had no problems until today... Though I haven't attempted to use admin for a while as I have had nothing to add, so I have no clear-set timeframe for this.

I'm gonna go poke my server error logs, see what I can dig up...

[Rawksie]

Bloody editing time limit.

LOTS of interesting errors.

[Thu Jun 15 00:47:01 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/&nbsp;&zenid=c024dd0080f6a9b285946b978b74074a
[Thu Jun 15 00:46:58 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/404.shtml
[Thu Jun 15 00:46:58 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/&nbsp;&zenid=553789b8c79d775e69a5c0b84683bb0c
[Thu Jun 15 00:46:57 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/404.shtml
[Thu Jun 15 00:46:57 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/index.php&zenid=c024dd0080f6a9b285946b978b74074a
[Thu Jun 15 00:46:54 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/404.shtml
[Thu Jun 15 00:46:54 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/index.php&zenid=553789b8c79d775e69a5c0b84683bb0c
[Wed Jun 14 23:52:50 2006] [error] [client 66.249.72.210] File does not exist: /--------/public_html/catszylou/404.shtml
[Wed Jun 14 23:52:50 2006] [error] [client 66.249.72.210] File does not exist: /--------/public_html/catszylou/robots.txt
[Wed Jun 14 23:14:13 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 23:14:13 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/img/hr.png
[Wed Jun 14 23:10:46 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 23:10:46 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/favicon.ico
[Wed Jun 14 23:10:36 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 23:10:36 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/favicon.ico
[Wed Jun 14 23:10:36 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 23:10:36 2006] [error] [client 84.9.240.209] File does not exist: /--------/public_html/img/hr.png
[Wed Jun 14 22:45:11 2006] [error] [client 66.249.72.210] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 22:45:11 2006] [error] [client 66.249.72.210] File does not exist: /--------/public_html/robots.txt
[Wed Jun 14 21:43:37 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 21:43:37 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/&nbsp;&zenid=2b4886cc884e9aafd60db7863ccd4c38
[Wed Jun 14 21:43:36 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 21:43:36 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/&nbsp;&zenid=4a228fe1eb2735739e11f00ddcd16265
[Wed Jun 14 21:43:36 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 21:43:36 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/index.php&zenid=2b4886cc884e9aafd60db7863ccd4c38
[Wed Jun 14 21:43:35 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/404.shtml
[Wed Jun 14 21:43:35 2006] [error] [client 81.208.36.95] File does not exist: /--------/public_html/index.php&zenid=4a228fe1eb2735739e11f00ddcd16265265

I've blanked some of my directory information, but I'm leaving the IP there. Name and shame I say.

I don't know what's going on there, but I'm bloody well going to find out.

[Ajeh]

Do you have a file:

404.shtml

Do all the links work?

[Rawksie]

Nah, I haven't set up 404 yet.

It's the index.php&zendid=### that worry me.

EDIT TO ADD: That IP that had them is in my sessions database twice, with the zenids mentioned in the error.

What does this mean?

EDIT TO ADD 2: Oho. Korean eh? Common phpNuke hacker area... DNSstuff are useful... Not that that helps, but gives me a little 'I know who you are, I can even phone you right now you dirty little hax0r.' boost.

..Perhaps this is a revenge for the sites I recently repaired and secured against further hacking for other people...

[Ajeh]

Make the 404.shtml ... does this stop the second error in each of the pairs that are showing as a pattern here?

[Rawksie]

[Thu Jun 15 00:46:54 2006] [error] [client 58.180.191.32] File does not exist: /--------/public_html/index.php&zenid=553789b8c79d775e69a5c0b84683bb0c

^ Thats the bit I'm worried about.
I know perfectly well why I'm getting 404 and favicon errors. I just haven't gotten around to that bit yet.

I want to know why I cannae access my friggin admin... And I don't see why anyone would be doing that ^ kind of thing.

[Rawksie]

Had an idea - haven't backed up in a while, not since I last accessed.

So pottered into my backups and sure enough, the .htaccess on the server was completely different to the one I had.

So I uploaded my own and I can log in.


...Now I will have to figure out how my .htaccess was changed. :?

[DrByte]

/public_html/index.php&zenid=0000000000

The only reason that's "invalid" is because it should be a ? instead of a &

It should have nothing to do with accessing your admin area .... cuz unless your admin is in the root of your public_html folder, it's unrelated.

As to why you're seeing attempts at & instead of ? .... I would start looking around your site to see what links may have caused that. You could look at your server's activity log and compare it with your error log ... just to see what succesful clicks were made just before the one in question... that would at least show you what page the "bad" link is located on.


Do you have any reason to believe this is a "hack attempt related to a vulnerability in Zen Cart"? If so, please explain.

[Rawksie]

I was worried it might be a hack due to the fact I couldn't access my admin at all.
It turned out that my .htaccess was completely different from the one in my backups... But I fixed that.

I have no links that could cause a & to be there instead of a ?
In fact, there are pretty much no links at all that can be used as my site is and has been down for maintenance for a few weeks. (I'm not ready to open up yet, see.)

But, 'tis all sorted now. I just gotta find out what or who changed my .htaccess in my admin directory.