Hackers Suck!

[vbresults]

vBulletin is very unique on how it stores its templates and plugins, It?s different than WordPress and Joomla, all the content is saved in the database. That makes it a bit more complicated for webmasters because they can?t just use common command line tools (like grep) to search through all their files. They need to use phpMyAdmin or another database tool to try to find and fix those issues.

And that?s where this malware hides itself. It uses the Plugin system and hooks into ?global_start?, so it is called on every page request.

Read more... (http://blog.sucuri.net/2013/07/vbulletin-infections-from-adabeupdate.html)


What is this plugin?

This plugin allows you to export all plugin code in the database to a single file with one click. You can then scan the plugin text file for malware. This plugin will later expand into a full security audit suite.

https://vborg.vbsupport.ru/attachment.php?attachmentid=145717&stc=1&d=1373565590

Hackers can insert malicious code directly into the datastore, ignoring the actual plugin table and evading detection via scanning with the plugin manager. This plugin exports the live, running datastore rendering that tactic useless.

Installation
Import the product Xml.
The installation is complete; congratulations! Mark As Installed, Nominate For MOTM and Vote https://vborg.vbsupport.ru/external/2013/07/1.gif

[ForceHSS]

I click it then save the plugin-list to my desktop then what do I do

[vbresults]

I click it then save the plugin-list to my desktop then what do I do

Using a text editor, open it and search for "base64_encode", "eval", and "str_rot13". These are used to obfuscate the actual code to prevent you from finding it by simply typing in "iframe" or whatever the malicious code is.

[Zachery]

Wouldn't a better option just to flush the current datastore.plugin list and rebuild it from the current plugins?

Or to scan the plugin table for obfuscated code?

[DM BoNeZ]

this looks helpful i'm going to take a look at this :)

[crazyfalcon]

Using a text editor, open it and search for "base64_encode", "eval", and "str_rot13". These are used to obfuscate the actual code to prevent you from finding it by simply typing in "iframe" or whatever the malicious code is.


If you fine eval then what ?

I found eval in 21 occurrences