Cribb you ****

SM · Jan 2, 2012

Cribb to regret deleting my post where i told Rego to leave the forum

Old Mate · Jan 2, 2012

Rego said: ↑

You don't necessarily need to restore a backup to resolve this issue. The most common compromises from this issue are a template replacement issue where one of the common templates has its pre-parsed version replaced. They often also leave a backdoor through a plugin as well. The following steps will allow you to find these problems in the system:

1) Run Suspect File Diagnostics under Maintenance -> Diagnostics. Replace any files not containing the expected contents. Delete any files that are not part of vBulletin and that you can't identify as belonging to your addons.

2) Check the config.php for any suspicious code. It isn't checked by the suspect file diagnostic.

3) Search all templates for iframe tags. They should only appear in the following templates: bbcode_video, editor-ie.css, member.css, stylegenerator.css, vbcms.css, vbulletin.css, help_bbcodes, humanverify_recaptcha, search_common, and search_common_select_type. Even these should be manually reviewed.

4) Check all your plugins for rogue include, require, include_once, or require_once code. All files should come from your server and be known to you.

5) Check your plugins for any base64 code. I recommend using against using any plugins or products that include base64 code in them. However some "lite" or branded addons will include this as a means to prevent you from cheating the author. You'll have to make a personal call on these if you use them. This is often a sign of a hacked site.

6) Make sure that your plugins do not include calls to exec(), system(), or pass_through (filt0wned because I can't spell, btw)() or iframes. These are also often signs of a hacked site.

Query for step 4 and 5 -
SELECT title, phpcode, hookname, product FROM plugin WHERE phpcode LIKE '%base64%' OR phpcode LIKE '%exec%' OR phpcode LIKE '%system%' OR phpcode like '%pass_through (filt0wned because I can't spell, btw)%' OR phpcode like '%iframe%';

7) Run this query: SELECT styleid, title, template FROM template WHERE template LIKE '%base64%' OR template LIKE '%exec%' OR template LIKE '%system%' OR template like '%pass_through (filt0wned because I can't spell, btw)%' OR template like '%iframe%';

It checks the templates for compromising code.

8) Check .htaccess to make sure there are no redirects there. This isn't a vBulletin issue per se but can cause problems.

After finding issues and removing them, your software may not be completely operational. There are a couple things you need to do.

1) Delete any additional administrators you did not authorize. Usergroups -> Usergroup Manager. Look at users listed as Primary and Secondary users in the Administrator group.

2) You need to rebuild your styles. The easiest way to do this is to run upgrade.php.

3) Rebuild your plugin Datastore by opening Plugins / Products -> Plugin Manager and saving the display order.

4) Finally, Upgrade your system to the latest version. If you're exposed to this vulnerability, you are running out of date software. The only way to remain secure is to upgrade to the latest versions.

5) This is optional but I recommend placing .htaccess password controls on the install, includes, packages and vb directories as well as admincp and modcp.
Click to expand...

Lol!

Sultan Pepper · Jan 2, 2012

Cribbage said: ↑

Yeah you're all lucky you can post at the moment. I'll fix it all up after I've had a proper chat with AK47 about securing the forum from future hacks. I don't have a lot of time at the moment but the main issue is the fact that it'd be a waste of energy to fix the site completely only for them to wipe it again.
Click to expand...

AK47 will definitely be able to help you, he's a gun at that stuff.

Cribbage · Jan 2, 2012

Sultan Pepper said: ↑

AK47 will definitely be able to help you, he's a gun at that stuff.
Click to expand...

Haha, that he is. I added him on Skype and he tried to help me the other day but then I ended up on the phone for hours.

AVA · Jan 2, 2012

Cribbage said: ↑

Haha, that he is. I added him on Skype and he tried to help me the other day but then I ended up on the phone for hours.
Click to expand...

Whoosh?

Frizzed · Jan 3, 2012

Sultan Pepper said: ↑

AK47 will definitely be able to help you, he's a gun at that stuff.
Click to expand...

Mousey · Jan 3, 2012

I didn't even think of that

Droos · Jan 4, 2012

Fiery said: ↑

I have lost most smileys and the images on the homepage since yesterday. Is it just me?
Click to expand...

I see much has changed here in the month I was on Holiday, we lost some smileys!! :sarcasm:

Fiery · Jan 4, 2012

Droos said: ↑

I see much has changed here in the month I was on Holiday, we lost some smileys!! :sarcasm:
Click to expand...

Yeah...all of them. Fixed now

Droos · Jan 4, 2012

Fiery said: ↑

Fixed now
Click to expand...

Yeah, back to normal now!

Captain · Jan 4, 2012

:woakes:

Himannv · Jan 5, 2012

Droos said: ↑

I see much has changed here in the month I was on Holiday, we lost some smileys!! :sarcasm:
Click to expand...

What a good month that was for Cricsim.

Droos · Jan 5, 2012

Himannv said: ↑

What a good month that was for Cricsim.
Click to expand...

Don't be a cunt you cunt!

Himannv · Jan 7, 2012

Droos said: ↑

Don't be a cunt you cunt!
Click to expand...

Can't help it sometimes mate.

Log in or Sign up

Cribb you ****

SM MD Dorn

Old Mate M Perry

Sultan Pepper HG Emm

Cribbage RG Cribb

AVA T Delonge

Frizzed WC Welker

Mousey AJ Son

Droos JP Rhodes

Fiery GR Smith

Droos JP Rhodes

Captain SSD Dong

Himannv LV Himann

Droos JP Rhodes

Himannv LV Himann

Share This Page

Log in or Sign up

Cribb you ****

SM MD Dorn

Old Mate M Perry

Sultan Pepper HG Emm

Cribbage RG Cribb

AVA T Delonge

Frizzed WC Welker

Mousey AJ Son

Droos JP Rhodes

Fiery GR Smith

Droos JP Rhodes

Captain SSD Dong

Himannv LV Himann

Droos JP Rhodes

Himannv LV Himann

Share This Page

Useful Searches