[Anarchist]

This is a guide on how to regain control of your MyBB forum in case it has been compromised by a hacker.


Regaining Control

1. Assess the damage. Find out exactly what the hacker did to your forum, whether it's deleting of posts, banning admin accounts, or whatever. Also, make sure to check your templates once you regain Admin CP access to check for malware!

2. See if you can log in to your admin account. For the rest of this tutorial, we're going to assume you cannot, whether it be because your account has been banned or deleted.

3. Log into your forum via PHPMyAdmin. This is why it's important to have this installed, every forum should.

4. Now this is where it will depend on what the hacker has done.

• 1) If your admin account has been banned, this is very easy to fix. In PHPMyAdmin, click on the "mybb_banned" table, and simple delete the row with your UID (user id, should be 1). This will delete your ban, and you should be able to log in as normal again.
  
• 2) If the password to your admin account has been changed, this is easy to fix. In PHPMyAdmin, select SQL, and input the following code.
  
  Code:

  UPDATE mybb_users SET password = MD5('my new password'), salt = '' WHERE uid = 'x';
  (replace 'my new password' with whatever you want your new password to be, and 'x' with your UID, (1 if you're the owner). You should be able to log in as normal with your new account credentials.)
  
• 3) If your admin account has been deleted, this is more difficult to fix. Register on your forum, and then run the following code in PHPMyAdmin.

5. Now that your account has been restored, log in to your Admin Control Panel.

6. Immediately, delete the hacker's account and IP ban them. You can always tell which account they were using by reading the Administrator Log.

7. If you are missing any posts or users, keep reading, otherwise skip to the prevention section.

1. If you no longer have any database backups on your server, look for one stored locally.
   
2. Restore to the most recent one.
   
3. Inform your users of any losses.
   
4. Keep a close eye out for a new attack in the days to come.
   

Prevention

1. Move your admin directory. This is a simple guide, but it makes it almost impossible for any hacker to easily find your Admin CP.

2. Change your password. I don't think this needs explaining.

3. Always keep a secret admin account. A hacker can find out if you have a secret admin simply by checking who has admin permissions, but if they overlook this, it can be an easy fix to regain your forum.

4. Keep several recent database backups store off of the server. (obviously)

5. DO NOT appoint admins or moderators that you do not absolutely trust. (obviously)

6. Always keep an eye on your forum. Don't go more than 24 hours before you or another trust individual check server, admin, and moderator logs. They're there for a reason.


Credits to the original creator of this tutorial:

• pandaa - ForumHour member

[Redbull]

You just blew my mind away Uzi, thanks for letting me know.

[Exiled]

Fantastic tutorial. I would recommend this to anyone who uses MyBB.

[Banadmin]

Excellent tutorial, Uzi! Thanks boi.

[Grily]

Thank you for this! I didn't know everything you posted yet, so this will be useful for sure