Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 13 Oct 2013, 04:49
hinomaru hinomaru is offline
 
Join Date: Apr 2009
My forum admin CP changed by hacker

Hello,

Im using vbulletin 3.8.4 PL2 and havent, I found that my admincp>>statistic&log> transaction log... have been changed like the pic below :



how to fix that?

Thanks
Reply With Quote
  #2  
Old 13 Oct 2013, 04:58
Digital Jedi's Avatar
Digital Jedi Digital Jedi is offline
 
Join Date: Oct 2006
Real name: Mark Daniel Martinez
Ask your host if they are running MySQL Tool. It looks like that and vBulletin are crossing wires somewhere.
__________________
Reply With Quote
  #3  
Old 14 Oct 2013, 05:13
hinomaru hinomaru is offline
 
Join Date: Apr 2009
Originally Posted by Digital Jedi View Post
Ask your host if they are running MySQL Tool. It looks like that and vBulletin are crossing wires somewhere.
They are not running any mysql tool like at that picture.
Reply With Quote
  #4  
Old 14 Oct 2013, 06:32
ForceHSS's Avatar
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
the text at the bottom of that picture ask your host is that theres
Reply With Quote
  #5  
Old 14 Oct 2013, 22:47
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Real name: Lynne
Do you still have your /install directory uploaded? Do you have any added Administrators? Any plugins you don't recognize?
__________________
Former vBulletin.org Staff Member

Try a search before posting for help. Many users won't, and don't, help if the question has been answered several times before.
W3Schools -
Online vBulletin Manual
If I post some CSS and don't say where it goes, put it in the additional.css template.
I will NOT help via PM (you will be directed to post in the forums for help.)
Reply With Quote
  #6  
Old 15 Oct 2013, 03:19
TheLastSuperman's Avatar
TheLastSuperman TheLastSuperman is offline
 
Join Date: Sep 2008
Real name: Michael Miller Jr
Originally Posted by Digital Jedi View Post
Ask your host if they are running MySQL Tool. It looks like that and vBulletin are crossing wires somewhere.
Look at very bottom of screenshot, dodos have to put copyright in hacking tools they too want credit basically it gives his name and to visit the powerterds site .

@hinomaru - looks like you've been hacked try these tutorials:

http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
http://www.vbulletin.com/forum/blogs...vbulletin-site
__________________
Daddy Does Dios and Figs!
https://www.linkedin.com/in/thelastsuperman

Search - Use the search feature to find similar issues/answers.
Information - Include screenshots, copy/pasted error codes, url etc.
Fixed - Please return to your thread/post and let us know how it was fixed!
Thanks - For participating! Click the "Like" on a post if someone helped you!
Reply With Quote
  #7  
Old 15 Oct 2013, 10:35
hinomaru hinomaru is offline
 
Join Date: Apr 2009
Originally Posted by Lynne View Post
Do you still have your /install directory uploaded? Do you have any added Administrators? Any plugins you don't recognize?
Install directory deleted a long time. And also administrator account only me and there is a suspected plugin but already deleted.

--------------- Added 15 Oct 2013 at 10:38 ---------------

Originally Posted by TheLastSuperman View Post
Look at very bottom of screenshot, dodos have to put copyright in hacking tools they too want credit basically it gives his name and to visit the powerterds site .

@hinomaru - looks like you've been hacked try these tutorials:

http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
http://www.vbulletin.com/forum/blogs...vbulletin-site
I already follow the instruction from the link u gave. But the one thing that I dont have is the backed up database. And so with the old database it still show the pic like the first post. I dont know how to find the injected file or database or something like that
Reply With Quote
  #8  
Old 15 Oct 2013, 12:16
TheLastSuperman's Avatar
TheLastSuperman TheLastSuperman is offline
 
Join Date: Sep 2008
Real name: Michael Miller Jr
Hmm don't be so hard on yourself, you can check all of this at least, if you're not comfortable removing it then fine but you can surely do some sifting and find what is wrong. It's easy enough to run those queries listed in my blog post because those type of sql statments using select in the code do just that i.e. they only select and show you said code you can't mess anything up by just "checking" so run the queries then post the results here for one of us to assist.

Not sure what files if any were uploaded or infected, you can check for spare admin accounts and delete asap, now check the control panel log and all entries by said hacker will have N/A beside them and their ip address is listed so ban that pronto (open a ticket with host, ask them to ban ip at server level). To check the files go to maintenance in admincp and run the suspect files tool, that will show you more info to go by as well and also feel free to post that as well.

The main point of you posting this info, results of queries etc is to receive assistance from our community... you can use the links provided and assistance by a few of us to come out on top here without the need to hire someone (yes at the moment it seems over your head, a little practice and a little patience and next thing you know you're unhacking your site not us!).
__________________
Daddy Does Dios and Figs!
https://www.linkedin.com/in/thelastsuperman

Search - Use the search feature to find similar issues/answers.
Information - Include screenshots, copy/pasted error codes, url etc.
Fixed - Please return to your thread/post and let us know how it was fixed!
Thanks - For participating! Click the "Like" on a post if someone helped you!
Reply With Quote
  #9  
Old 15 Oct 2013, 22:41
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Real name: Lynne
All default files on the site?
__________________
Former vBulletin.org Staff Member

Try a search before posting for help. Many users won't, and don't, help if the question has been answered several times before.
W3Schools -
Online vBulletin Manual
If I post some CSS and don't say where it goes, put it in the additional.css template.
I will NOT help via PM (you will be directed to post in the forums for help.)
Reply With Quote
  #10  
Old 16 Oct 2013, 01:14
create365 create365 is offline
 
Join Date: Aug 2013
Look in plugins for a suspicious code, mostly on init_startup.
It contains code like
You can also perform a query to search for this part of string in plugins db.

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

(remove __ from eval and gzinflate - this board can't save the post when this string occurs)
Most of shells I have spotted is installed like this. As opposite to leaving some exploit on server, but this is not the case.

Also if you're running VPS/dedicated - make sure chmod is set as it should be, and if webserver user has privileges to write/execute files (should not have, this way even if someone upload a shell, he can't execute an exploit).

Greetings.
Reply With Quote
  #11  
Old 16 Oct 2013, 02:07
hinomaru hinomaru is offline
 
Join Date: Apr 2009
After disable all plugin the problem is gone, and the suspect is from the one of the plugin.

And after search with this query :

SELECT title, phpcode, hookname, product FROM plugin WHERE phpcode LIKE '%base64%' OR phpcode LIKE '%exec%' OR phpcode LIKE '%system%' OR phpcode like '%pass_thru%' OR phpcode like '%iframe%';

The code above from : http://www.vbulletin.com/forum/forum...37#post3506437

I got the result like this :



--------------- Added 17 Oct 2013 at 01:27 ---------------

how to solve that?can I only delete the database record that shown above?
Reply With Quote
  #12  
Old 17 Oct 2013, 02:52
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Real name: Lynne
Why can't you disable your plugins and then get into the admincp and delete the plugins via the Plugin Manager?

To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

All three of those init_startup plugins need to go once you are able to get to the Plugin Manager.
__________________
Former vBulletin.org Staff Member

Try a search before posting for help. Many users won't, and don't, help if the question has been answered several times before.
W3Schools -
Online vBulletin Manual
If I post some CSS and don't say where it goes, put it in the additional.css template.
I will NOT help via PM (you will be directed to post in the forums for help.)
Reply With Quote
  #13  
Old 23 Oct 2013, 02:50
hinomaru hinomaru is offline
 
Join Date: Apr 2009
Finally all fixed..thanks for the support
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 22:34.

Layout Options | Width: Wide Color: