ludachris
11-13-2006, 09:59 PM
Hey guys, I am in the process of cleaning up all the sites on one of our servers that was hacked due to a Remote File Include Vulnerability. Here are some links to what I'm talking about:
http://securitytracker.com/alerts/2006/Feb/1015624.html
http://www.soledadpenades.com/2006/05/28/idiots-with-nothing-to-do
Basically what happened was, they somehow found a way to write to every file on our server. They added a few lines of IFRAME code that was meant to redirect our visitors to other sites. Every single file on the server was affected, although not all files had the same code added. Some had multiple lines of the same code, others had just one line. It's a dedicated server, and all sites on the server are ours.
The problem is I can't narrow down which script we're running would account for the security hole. Can anyone tell me which of these scripts it could be:
vbulletin - developers say it's not
vbadvanced cmps - developers say it's not
vbadvanced Links - developers say it's not
phpadsnew2 - http://phpadsnew.com/two/
ContactForm - http://www.free-php.net/scripts.php?id=2
Photopost Classifieds - http://www.photopost.com/class/
Photopost vbGallery - http://www.photopost.com/forum/forumdisplay.php?f=113
(formerly vbaGallery, not photopost pro)
And if none of the above, could it be a hack that has been added on to vb? We have a few. What should we be looking for? Any help would be appreciated. I'd hate to clean this all up only for somone to run a script and screw it all up again.
Please guys, I need to find out how to stop this from happening again. I've already cleaned up all files once and it took several days. It happened again today and we have to start all over.
http://securitytracker.com/alerts/2006/Feb/1015624.html
http://www.soledadpenades.com/2006/05/28/idiots-with-nothing-to-do
Basically what happened was, they somehow found a way to write to every file on our server. They added a few lines of IFRAME code that was meant to redirect our visitors to other sites. Every single file on the server was affected, although not all files had the same code added. Some had multiple lines of the same code, others had just one line. It's a dedicated server, and all sites on the server are ours.
The problem is I can't narrow down which script we're running would account for the security hole. Can anyone tell me which of these scripts it could be:
vbulletin - developers say it's not
vbadvanced cmps - developers say it's not
vbadvanced Links - developers say it's not
phpadsnew2 - http://phpadsnew.com/two/
ContactForm - http://www.free-php.net/scripts.php?id=2
Photopost Classifieds - http://www.photopost.com/class/
Photopost vbGallery - http://www.photopost.com/forum/forumdisplay.php?f=113
(formerly vbaGallery, not photopost pro)
And if none of the above, could it be a hack that has been added on to vb? We have a few. What should we be looking for? Any help would be appreciated. I'd hate to clean this all up only for somone to run a script and screw it all up again.
Please guys, I need to find out how to stop this from happening again. I've already cleaned up all files once and it took several days. It happened again today and we have to start all over.