Holy aggressive batman

I'd chip in, if that helps.

That's interesting I figured it was just a php vuln that was exploited.

Best of luck

If you're just trying to add:
psexec \\srvName icacls.exe D:\temp\* /grant user-name:(D,GR,X)

Obviously it will need a little tweaking w/ the switches but this should do you for a starter.

That's good news, have you got any info on whether or not the db was backed up?

I need to feed my addiction when I'm not at a pc.

Yep - these can all do it. If you don't have powershell, figure out what the ACL should look like, write out the icacls.exe command & variables, then save it in a batch file and script it out to the other boxes.

What OS(es) are involved? All W2K3?

I (hesitantly) went to the site and it does look like they just defaced it instead of actually hacking the thing, likely somebody just found a leak in the vBulletin software and exploited it that way. I'd say if you can restore the database w/ the updated software that's probably the most you can do for now.

FYI - this thing sadly happens a lot and is more annoying than damaging. I once had a phpBB site of mine undergo a similar treatment and I found that the time I spent being pissed about it was significantly less than the time it took me and my hosting provider (Verio) to fix it.

Vbulletin looks like it is all db driven. I'm thinking if you get the latest version of the software, install it, then have them restore the database you might be out of the woods. This is pending their attack isn't on the db tier.

Was the database backed up?

Isn't this a much, much cheaper alternative?

http://www.amazon.com/Practical-Packet-Analysis-Wireshark-Real-World/dp/1593272669/ref=wl_it_dp_o_npd?ie=UTF8&coliid=I2C55HVZC0QAX3&colid=13CPC8DZ1Z4LY

With WireShark being free and all I'd think downloading the tool and reading up on this material would be pretty good for those on a budget. I have heard the Laura Chappel courses are amazing, but again, for the price.

True as well, but slightly more risky whereas by attending the course you'd have not only the benefit of the instructor but the actual course material/notes.

You need to contact your manager and the management team and have them speak to an attorney. I would imagine that will be a quick way to get a response from them. What they are doing now is more than unethical, it is illegal.

I thought about that too. I know it's not kosher to divulge a lot of info but has your company spent a decent amount on commercial products? I suppose there is a bit of rationale if they have a standardized suite but it is more unexpected than anything that linux just for certain tools wouldn't be part of the environment.

More than enough right there. This should cover you plenty.