The payloads involved in this hack can be found below:
HTML source: https://gist.github.com/super3/6802799
According to several people who have browsed over the source, nothing malicious was involved in the payload. However, it unknown is whether or not any user data was compromised. Stay tuned for more information.
UPDATE FROM THEYMOS:
It’s unfortunately worse than I thought. There’s a good chance that the attacker(s) could have executed arbitrary PHP code and therefore could have accessed the database, but I’m not sure yet how difficult this would be. I’m sending out a mass mailing to all Forum users about this.
Here’s what I know: The attacker injected some code into $modSettings[‘news’] (the news at the top of pages). Updating news is normally logged, but this action was not logged, so the update was probably done in some roundabout way, not by compromising an admin account or otherwise “legitimately” making the change. Probably, part of SMF related to news-updating or modSettings is flawed. Possibly, the attacker was somehow able to modify the modSettings cache in /tmp or the database directly.
Also, the attacker was able to upload a PHP script and some other files to the avatars directory.
Figuring out the specifics is probably beyond my skills, so 50 BTC to the first person who tells me how this was done. (You have to convince me that your flaw was the one actually used.) The forum won’t go back up until I know how this was done, so it could be down for a while.
Theymos has been spotted in IRC saying that bitcointalk is soon to come back online. More Information.