My forum admin CP changed by hacker

[hinomaru]

Hello,

Im using vbulletin 3.8.4 PL2 and havent, I found that my admincp>>statistic&log> transaction log... have been changed like the pic below :

https://vborg.vbsupport.ru/external/2013/10/49.png

how to fix that?

Thanks

[Digital Jedi]

Ask your host if they are running MySQL Tool. It looks like that and vBulletin are crossing wires somewhere.

[hinomaru]

Ask your host if they are running MySQL Tool. It looks like that and vBulletin are crossing wires somewhere.

They are not running any mysql tool like at that picture.

[ForceHSS]

the text at the bottom of that picture ask your host is that theres

[Lynne]

Do you still have your /install directory uploaded? Do you have any added Administrators? Any plugins you don't recognize?

[TheLastSuperman]

Ask your host if they are running MySQL Tool. It looks like that and vBulletin are crossing wires somewhere.

Look at very bottom of screenshot, dodos have to put copyright in hacking tools they too want credit basically it gives his name and to visit the powerterds site :p.

@hinomaru - looks like you've been hacked try these tutorials:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked
http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site
http://www.vbulletin.com/forum/blogs/michael-miller/3934768-recovering-a-hacked-vbulletin-site

[hinomaru]

Do you still have your /install directory uploaded? Do you have any added Administrators? Any plugins you don't recognize?

Install directory deleted a long time. And also administrator account only me and there is a suspected plugin but already deleted.

--------------- Added 1381833486 at 1381833486 ---------------

Look at very bottom of screenshot, dodos have to put copyright in hacking tools they too want credit basically it gives his name and to visit the powerterds site :p.

@hinomaru - looks like you've been hacked try these tutorials:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked
http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site
http://www.vbulletin.com/forum/blogs/michael-miller/3934768-recovering-a-hacked-vbulletin-site

I already follow the instruction from the link u gave. But the one thing that I dont have is the backed up database. And so with the old database it still show the pic like the first post. I dont know how to find the injected file or database or something like that

[TheLastSuperman]

Hmm don't be so hard on yourself, you can check all of this at least, if you're not comfortable removing it then fine but you can surely do some sifting and find what is wrong. It's easy enough to run those queries listed in my blog post because those type of sql statments using select in the code do just that i.e. they only select and show you said code you can't mess anything up by just "checking" so run the queries then post the results here for one of us to assist.

Not sure what files if any were uploaded or infected, you can check for spare admin accounts and delete asap, now check the control panel log and all entries by said hacker will have N/A beside them and their ip address is listed so ban that pronto (open a ticket with host, ask them to ban ip at server level). To check the files go to maintenance in admincp and run the suspect files tool, that will show you more info to go by as well and also feel free to post that as well.

The main point of you posting this info, results of queries etc is to receive assistance from our community... you can use the links provided and assistance by a few of us to come out on top here without the need to hire someone (yes at the moment it seems over your head, a little practice and a little patience and next thing you know you're unhacking your site not us!).

[Lynne]

All default files on the site?

[create365]

Look in plugins for a suspicious code, mostly on init_startup.
It contains code like
You can also perform a query to search for this part of string in plugins db.

ev__al(gzin__fla__te(base64_decode('
(remove __ from eval and gzinflate - this board can't save the post when this string occurs)
Most of shells I have spotted is installed like this. As opposite to leaving some exploit on server, but this is not the case.

Also if you're running VPS/dedicated - make sure chmod is set as it should be, and if webserver user has privileges to write/execute files (should not have, this way even if someone upload a shell, he can't execute an exploit).

Greetings.

[hinomaru]

After disable all plugin the problem is gone, and the suspect is from the one of the plugin.

And after search with this query :

SELECT title, phpcode, hookname, product FROM plugin WHERE phpcode LIKE '%base64%' OR phpcode LIKE '%exec%' OR phpcode LIKE '%system%' OR phpcode like '%pass_thru%' OR phpcode like '%iframe%';

The code above from : http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/406768-a-fix-if-your-site-is-already-exploited?p=3506437#post3506437

I got the result like this :

https://vborg.vbsupport.ru/external/2013/10/17.jpg

--------------- Added 1381973259 at 1381973259 ---------------

how to solve that?can I only delete the database record that shown above?

[Lynne]

Why can't you disable your plugins and then get into the admincp and delete the plugins via the Plugin Manager?

To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

All three of those init_startup plugins need to go once you are able to get to the Plugin Manager.

[hinomaru]

Finally all fixed..thanks for the support