A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access it on my LAN. Today I logged into the server and noticed several databases were deleted from phpmyadmin and the logs show many IPs connected to phpmyadmin.

The server itself contained no critical or personal info. Whoever penetrated my server created a database with a table telling me to send .05 BTC to an account if I want my data back, but the databases they deleted/exported are honestly not that important to me.

What I'm worried about is if they were able to access the rest of my LAN. What should I do to check? I disabled the DMZ setting and checked, port 80 is no longer open from outside my network.

  • 1
    Nothing is known about your network and the exact router setup. Is this "DMZ" in your router really a separate network which cannot access the main network or is it just an "exposed host" in the same network as the other systems? Some router vendors unfortunately call this "DMZ" too. Feb 9 '20 at 21:45
  • I don't know specifically. It's an ISP provided router, specifically a Sagemcom F@st 5260. In the Access Control section of the router there's a tab labeled 'DMZ'. I enabled the setting and put in my VM's LAN IP.
    – Jay
    Feb 9 '20 at 21:49
  • Based on this description it is an exposed host and has likely an IP address in the same network as the others. Given that you've hosted this inside a VM: can you reach other systems inside your network from inside the VM or do firewall settings prevent this? Feb 9 '20 at 21:56
  • Other than a networked drive hosted by another VM, nothing was accessible by that VM that I'm aware of. The network drive only has movies and TV shows on it, no personally data. Virtually all ports in the compromised server's firewall was disabled.
    – Jay
    Feb 9 '20 at 22:00
  • 2
    In this case it is unlikely that the attacker could have anything of relevance. Feb 9 '20 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.