vb.org Archive
Page 3 of 7 12 3 45 Last »
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 2.x Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=4)
-   -   Get an e-mail if someone is trying to access your Admin CP (With IP address) (https://vborg.vbsupport.ru/showthread.php?t=32707)

DFX 02-13-2002 07:46 AM
Great Hack, installed perfectly on my board running 2.2.0.

Birdie501 02-13-2002 12:18 PM
Hi,

i found that it only works if the username is already in the database! That make no sense for me! I want to be informed also if someone is trying to log in when he is not a registered member! is that possible?

Or does it work on your site?

Greetings

Lucky 02-13-2002 08:03 PM
Also wondering.

Soma 02-14-2002 03:04 AM
thanx a million

RoC-RTCWCentral 02-14-2002 07:56 AM
Works as stated on a 2.2.2 board.

Thanks alot FireFly!!!

RoC

DiSS Troya 02-14-2002 08:59 AM
Thanks for the awesome hack!

Birdie501 02-14-2002 09:03 AM
[QUOTE]Originally posted by Birdie501
Hi,

i found that it only works if the username is already in the database! That make no sense for me! I want to be informed also if someone is trying to log in when he is not a registered member! is that possible?

Or does it work on your site?

Greetings

Birdie501 02-28-2002 06:15 PM
Nobody has a solution for me?
Thats bad (sad)

:cry:

Jawelin 03-07-2002 11:09 AM
Hi, Chen.

I have been using this simple but essential hack since it was born... :stoned:
Yesterday, for the first time, I received a true alert of someone trying to access the AdminCP, I guess... Hwr, some /admin/ dir script, as it is within the session.php of the admin section...
The first true after a lot of simulated ones by me to tryout the efficience...

Well; this is a very strange thing, as I protected the web dir also by an .htaccess of Apache... with another userid/password, of course.

So I realized should be needed more informations about the potential intruder.
For example, the exact page/script he (oopss.... he/she :pleased: ) called, the referrer page and many more info.

Where (which object within the session.php script) could I retrieve those informations and more ?
I though something like phpinfo(INFO_ENVIRONMENT) or phpinfo(INFO_VARIABLES) (what better?), for example to be attached to the mail() function ...

What do you think about ? How could I save all these and set a mime type to attach the buffer ?

Thanks a lot, FF.

Bye

Shane_2k 03-09-2002 09:47 AM
How do u password protect your admin control panel please help

thanks

Jawelin 03-09-2002 09:57 AM
.htaccess on Apache web-server.
It does protect the urls (from a given directory with all children..)

Another question: HOW COULD I read the bboard cookies on cracker browser and send them along with the phpinfo (above) email ?
Thanks again.

Shane_2k 03-09-2002 10:02 AM
Thnx but i have no idea but i will have a go and also how do u do this

(in attachment)

Jawelin 03-09-2002 12:15 PM
[QUOTE]Originally posted by Shane_2k
Thnx but i have no idea but i will have a go and also how do u do this
(in attachment)

Erwin 03-13-2002 06:28 PM
Hi, would this work for 2.2.4?

Got home from work - installed the hack - no problems there, but I am not getting any emails sent to me.

Checked my VB options, the email address is correct, it works, just tested it...

Mmm... maybe it's my server... I'm with VO...

pdaGuy 03-15-2002 08:08 AM
Same here Erwin.
Installed the hack but I don't get any emails!
Anyone managed to fix it??

Mutt 03-16-2002 12:20 PM
not sure if this works yet. just playing around with it so if anyone can think of how to fix/improve it let me know.

I added the scriptpath, real username as found from cookie, real username as found from sessions, and a link to search for username using that ip

PHP Code:
            // email alert
            $ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
            $iphostname = @gethostbyaddr($ipaddress);
            if ($sessionid=$DB_site->query("SELECT userid FROM session WHERE host='$ipaddress'")) {
                $realusername=$DB_site->query_first("SELECT username FROM user WHERE userid='$sessionid[userid]'");
                $MessageAddon .= "Sessions identifys them as ".addslashes($realusername);
            }
            if ($HTTP_COOKIE_VARS['bbuserid']) {
                $realuserid = $HTTP_COOKIE_VARS['bbuserid'];
                $realusername=$DB_site->query_first("SELECT username FROM user WHERE userid='$realuserid'");
                $MessageAddon .= "Thier cookie identifys them as ".addslashes($realusername);
            }
            $message="Someone is trying to login using your admin account!\nThe Script was : ".addslashes($scriptpath)."\n\nUsername they tried to use: $loginusername\nPassword they tried to use: $loginpassword (".md5($loginpassword)." in encryption)\n\nThe IP address is: $ipaddress\nThe host is: $iphostname\n\nSearch for members using this ip\n $bburl\admin\user.php?action=doips&s=&ipaddress=$ipaddress\n\n$MessageAddon";
            mail($webmasteremail,"Warning: vBulletin Admin Login Tried",$message,"From: \"$bbtitle Admin CP\" <$webmasteremail>");
            // email alert 

pdaGuy 03-17-2002 10:39 AM
Thanks Mutt, it's working now! (on version 2.2.4 too) ;-)

trainer 03-21-2002 03:32 PM
Mutt i have tried your version and the original version but no luck with 2.2.4

does yours work with 2.2.4? i like the idea alot.

maybe i am doing something wrong cause i did have this hack installed before with version 2.2.1

thanks for the help

trainer 03-21-2002 03:58 PM
got it working for the most part but can't seem to get any memberinfo from the cookies

doesn't identify anyone. i logged into the forums under a test account then did a bogus login to the admin section and i only got this message in teh email alert

Sessions identifys them as Thier cookie identifys them as Array

Mutt 03-21-2002 08:00 PM
I can't get it to work. I can't even get it to email me :( Code looks like it should work but I just can't test it

trainer 03-21-2002 08:13 PM
i can get it to work but can't get the usernames from the cookie file to appear. that would be a really sweet feature so it would be easy to identify exactly who it is

pdaGuy 03-22-2002 12:47 AM
Hmm.. this is totally strange. How come it works for me ? :paranoid:
This is the email that I get if someone tries to login on the admin panel with a wrong password.

[QUOTE]Someone is trying to login using your admin account!
The Script was :

Username they tried to use: test
Password they tried to use: test (098f6bcd4621d373cade4e832627b4f6 in encryption)

The IP address is: XXX.X.XX.XX
The host is: XXX.XXXXX.com

Search for members using this ip .php?action=doips&s=&ipaddress=XXX.XXXXX.com

Sessions identifys them as Thier cookie identifys them as Array

Liz 03-22-2002 03:51 AM
I just have a quick question. Seeing how I don't have a "webmaster@yadda-yadda.com" email, can I put a different email in instead of the webmaster one?

<$webmasteremail>");

like...could I put:
<$myemailaddress>");

would that work? Or is it some special coding? Thanks!

JJR512 03-22-2002 03:55 AM
$webmasteremail represents whatever you put in your board's Admin CP on the vBulletin Options page in the Contact Details section on the line for Webmaster's email. Whatever you have there is where an email to $webmasteremail will go.

Liz 03-22-2002 04:24 AM
Thanks for your fast reply.
I put the hack in, and then took it out.
Now when I go to log into the CP it says

Warning: Cannot add header information - headers already sent by (output started at /home/xxxbo/public_html/admin/sessions.php:399) in /home/xxx-bo/public_html/admin/global.php on line 136

Warning: Cannot add header information - headers already sent by (output started at /home/xxx-bo/public_html/admin/sessions.php:399) in /home/xxx-bo/public_html/admin/global.php on line 162

Hang on a sec

and then it brings me back to the login page...
HELP!!

JJR512 03-22-2002 04:41 AM
The problem is with your sessions.php file. The error message says that, plus that's the only file edited by this hack. If you put this hack in, then took it out, and didn't do ANYthing else at all, then most likely you didn't take out the hack code properly. I don't know what else could be. Do you have a backup copy of sessions.php to try?

Mutt 03-23-2002 01:53 PM
use this one

PHP Code:
            // email alert
            $ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
            $iphostname = @gethostbyaddr($ipaddress);
            if ($HTTP_COOKIE_VARS['bbuserid']) {
                $realuserid = $HTTP_COOKIE_VARS['bbuserid'];
                $realusername=$DB_site->query_first("SELECT username FROM user WHERE userid='$realuserid'");
                $MessageAddon .= "\nThier cookie identifys them as ".addslashes($realusername[username]."\n");
            }
            if ($sessionids=$DB_site->query("SELECT userid FROM session WHERE host='$ipaddress' AND userid>0 GROUP BY userid")) {
                while ($sessionid = $DB_site->fetch_array($sessionids)) {
                    $realusername=$DB_site->query_first("SELECT username FROM user WHERE userid='$sessionid[userid]'");
                    $MessageAddon .= "\nSessions identifys them as ".addslashes($realusername[username]);
                }
            }
            $message="Someone is trying to login using your admin account!\nThe Script was : $PHP_SELF\n\nUsername they tried to use: $loginusername\nPassword they tried to use: $loginpassword (".md5($loginpassword)." in encryption)\n\nThe IP address is: $ipaddress\nThe host is: $iphostname\n\nSearch for members using this ip\n $bburl/admin/user.php?action=doips&s=&ipaddress=$ipaddress\n$MessageAddon";
            mail($webmasteremail,"Warning: vBulletin Admin Login Attempted",$message,"From: \"$bbtitle Admin CP\" <$webmasteremail>");
            // email alert 

Updates

correctly idenifies user via sessions and cookie
it also idetifies which script they were trying to access.

this currently only produces an email when an admin username is used with the incorrect password. I'm going to dig a little and try and get it to work for all incorrect admin logins

Mutt 03-23-2002 02:53 PM
firefly, I've added alittle to your hack

Here's the chunk of code that needs to be added to 2 files

PHP Code:
            // email alert
            $ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
            $iphostname = @gethostbyaddr($ipaddress);
            if ($HTTP_COOKIE_VARS['bbuserid']) {
                $realuserid = $HTTP_COOKIE_VARS['bbuserid'];
                $realusername=$DB_site->query_first("SELECT username FROM user WHERE userid='$realuserid'");
                $MessageAddon .= "\nThier cookie identifys them as ".addslashes($realusername[username]."\n");
            }
            if ($sessionids=$DB_site->query("SELECT userid FROM session WHERE host='$ipaddress' AND userid>0 GROUP BY userid")) {
                while ($sessionid = $DB_site->fetch_array($sessionids)) {
                    $realusername=$DB_site->query_first("SELECT username FROM user WHERE userid='$sessionid[userid]'");
                    $MessageAddon .= "\nSessions identifys them as ".addslashes($realusername[username]);
                }
            }
            $message="Someone is trying to login to the $bbtitle control panel!\nThe Script was : $PHP_SELF\n\nUsername they tried to use: $loginusername\nPassword they tried to use: $loginpassword (".md5($loginpassword)." in encryption)\n\nThe IP address is: $ipaddress\nThe host is: $iphostname\n\nSearch for members using this ip\n $bburl/admin/user.php?action=doips&s=&ipaddress=$ipaddress\n$MessageAddon";
            mail($webmasteremail,"Warning: vBulletin Admin Login Attempted",$message,"From: \"$bbtitle Admin CP\" <$webmasteremail>");
            // email alert 

the first addition is in sessions.php as instructed by firefly

it goes right after

PHP Code:
 if (md5($loginpassword)!=$bbuserinfo[password]) { 


then second additon is in adim/global.php

and it goes right after

PHP Code:
$getperms=$DB_site->query_first("SELECT cancontrolpanel FROM user,usergroup WHERE user.usergroupid=usergroup.usergroupid AND user.userid='$bbuserinfo[userid]'");
if ($getperms[cancontrolpanel]!=1) { 
now you'll get an email like this

[QUOTE]Someone is trying to login to your control panel!
The Script was : /forum/admin/index.php

Username they tried to use: xxxxxxxx
Password they tried to use: xxxxxx (d344c7e7f54ac73cf730fd91faf6391b in encryption)

The IP address is: xx.xx.xx.xx
The host is: xxxxxxxxxxxxxxx

Search for members using this ip
http://yoursite.com/forum/admin/user...ss=xx.xx.xx.xx

Thier cookie identifys them as xxxxxxx

Sessions identifys them as xxxxxxxxxx

Liz 03-23-2002 03:38 PM
[QUOTE]Originally posted by JJR512
The problem is with your sessions.php file. The error message says that, plus that's the only file edited by this hack. If you put this hack in, then took it out, and didn't do ANYthing else at all, then most likely you didn't take out the hack code properly. I don't know what else could be. Do you have a backup copy of sessions.php to try?

BlueWolf 03-23-2002 05:22 PM
Can you make this with your vbhack installer?

makes life easier!

Erwin 03-24-2002 03:39 AM
[QUOTE]Originally posted by Mutt
firefly, I've added alittle to your hack
.......

Hey people, let me know if you have any problems with this

Mutt 03-24-2002 02:51 PM
you are getting 2 emails?

I'll throw some more testing at it and see if I can duplicate the problem

Erwin 03-24-2002 06:25 PM
[QUOTE]Originally posted by Mutt
you are getting 2 emails?

I'll throw some more testing at it and see if I can duplicate the problem

Heckwork 03-25-2002 11:45 AM
Great hack !

I have added some code to see through proxy in combination with this .htaccess: Options Indexes FollowSymLinks Includes

$ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("R EMOTE_ADDR"),$HTTP_HOST);
$iphostname = @gethostbyaddr($ipaddress);
$ipaddress2=iif(getenv("HTTP_X_FORWARDED_FOR")!="" ,getenv("HTTP_X_FORWARDED_FOR" ),$HTTP_HOST);
$iphostname2 = @gethostbyaddr($ipaddress2);
$message="Someone is trying to login using your admin account!\n\nUsername he tried to use: $loginusername\nPassword he tried to use: $loginpassword (".md5($loginpassword)." in encryption)\n\nThe (Proxy) IP address is: $ipaddress\nThe host is: $iphostname\nIP address is: $ipaddress2\nThe host is: $iphostname2";
mail($webmasteremail,"Warning: vBulletin Admin Login Tried",$message,"From: \"$bbtitle Admin CP\" <$webmasteremail>");
eval("standarderror(\"".gettemplate("error_wrongpa ssword")."\");");

HTH

Peter

Jawelin 03-25-2002 12:37 PM
[QUOTE]Originally posted by Heckwork
Great hack !

I have added some code to see through proxy in combination with this .htaccess: Options Indexes FollowSymLinks Includes


Peter

Floris 03-25-2002 04:31 PM
[high]* Floris waits for firefly to update the original code with all the tweaks here and makes it an xxx.hack.php for vbhacker :)[/high]

Admin 03-26-2002 05:25 AM
/me might do that

webhost 04-12-2002 11:20 PM
Does this only work if someone uses a username that is in the database? Or does this work with any name a person might put in?

wooolF[RM] 04-13-2002 12:43 AM
]just added that "addon" by Mutt and Heckwork.
works good! :D

freeshares1 04-24-2002 12:53 PM
Thanks firefly,

Installed and works great.

phil


All times are GMT. The time now is 03:47 AM.
Page 3 of 7 12 3 45 Last »
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01450 seconds
  • Memory Usage 1,872KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (5)bbcode_php_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (4)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete