vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Modification Requests/Questions (Unpaid) (https://vborg.vbsupport.ru/forumdisplay.php?f=112)
-   -   Hacked again... (https://vborg.vbsupport.ru/showthread.php?t=42464)

Link14716 08-18-2002 11:30 PM
Hacked again...
 
So now that I was hacked again and files are being destroyed, I need help fixing the problems.

Errors in all global.php's are there, pointing to the same EXACT line...

eval($optionstemp[template]);

HELP!

EDIT EDIT EDIT!

I meant to put this in Support......

g-force2k2 08-18-2002 11:34 PM
Link just run a full clean install again... just redownload files from your vb user cp... sorry to hear about the hacking...

g-force2k2

Link14716 08-18-2002 11:42 PM
Clean install....... goddamnit. This would be my 4th damned clean install in about a month. I am sick of this bull++++. Feel like I should just shut the damned thing down.

Erwin 08-18-2002 11:54 PM
How is your site being hacked?

g-force2k2 08-18-2002 11:56 PM
why don't you just restrict the admin cp so that no user can become and administrator and that no user can access the control panel except you?

g-force2k2

Steve Machol 08-18-2002 11:57 PM
Quote:
Originally posted by Erwin
How is your site being hacked?
That *is* the critical question. If you are being hacked through your server then nothing you do with vB withh help stop this.

g-force2k2 08-19-2002 12:05 AM
ic smachol lets hope not...

else it might just mean its time for a new host...

g-force2k2

Link14716 08-19-2002 12:45 AM
I wouldn't really know how I am being hacked. But you know what? Even though my admin CP is crippled and non-accessible, I used the nifty admin-logs through phpMyAdmin and got the stupid IP address.

But I am wondering if there is anyway to fix the problems that the hacker caused......

Link14716 08-19-2002 12:51 AM
Unfortunetly, I had left debug on while doing some hacks and of course the hacker took out all of the settings (almost). The setting table is left with 41 rows. While I can fix that, I want to know how to fix the file errors. BTW, I also have the admin log table stored right on my harddrive showing the hacker deleting setting groups and banning me (which I unbanned myself, but I can't do anything with a crippled admin CP) with the dateline and his IP Address.

g-force2k2 08-19-2002 03:03 AM
if the hacker was trying to cripple through the admin cp then he must've just hacked the forums then... if thats they case the just define yourself as the only person able to access admin cp... ;) and restrict the setting.php file... just some ideas of course...

g-force2k2

Steve Machol 08-19-2002 03:07 AM
Quote:
Originally posted by Link14716
Unfortunetly, I had left debug on while doing some hacks and of course the hacker took out all of the settings (almost).
That's a security risk as you probably have figured out by now.

Boofo 08-19-2002 03:11 AM
How do you restrict the setting.php file?

Quote:
Originally posted by g-force2k2
if the hacker was trying to cripple through the admin cp then he must've just hacked the forums then... if thats they case the just define yourself as the only person able to access admin cp... ;) and restrict the setting.php file... just some ideas of course...

g-force2k2

NTLDR 08-19-2002 09:21 AM
Quote:
Originally posted by Boofo
How do you restrict the setting.php file?
Its allready protected by:

PHP Code:
cpheader(); 
So only admins can use it, you could of course restrict it to a specified userid:

PHP Code:
if ($bbuserinfo[userid]!=1) {
exit;
} 
After cpheader(); so that the script exits if you don't have the userid 1.

The safest option though is to put the entire admin directory behind a .htaccess block and uses a different username / password combo then you do for your forums.

Link14716 08-19-2002 10:31 AM
Quote:
Originally posted by smachol
That's a security risk as you probably have figured out by now.
I have always know that it was a security risk, I used it mostly to add templates into the global set.

Link14716 08-19-2002 10:42 AM
I can get back my settings, but don't get these errors......

Parse error: parse error, expecting `T_VARIABLE' or `'$'' in /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code on line 1

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Every other page has that on it, with the global.php, and I am wondering if when I get my settings back from the grave if it'll fix......

Dark_Wizard 08-19-2002 10:43 AM
Make sure there is no white space at the end of functions.php after the ?>

Link14716 08-19-2002 11:42 AM
If only it were that easy...

The global.php line:
Code:
eval($optionstemp[template]);
functions.php line 1628:
Code:
    setcookie($name, $value, $expire, $cookiepath, $cookiedomain, $secure);

Dark_Wizard 08-19-2002 11:53 AM
Change this:
Code:
eval($optionstemp[template]);
to this:
Code:
eval($optionstemp['template']);

Link14716 08-19-2002 12:41 PM
Once again..... if only it were that easy.... I tried it and still get the exact same error in all 3 global.php and function.php's

Link14716 08-19-2002 12:52 PM
BTW, I got the settings up, but it still has same error, nthing has changed. I am going to go ahead and ban the corrupt admin so I don't have to deal with his ass whining and +++++ing...

Dark_Wizard 08-19-2002 01:36 PM
Send me your global and functions files...

Boofo 08-19-2002 06:50 PM
And how would I do this on a Linux server? I know absolutely nothing about .htaccess. :)

Quote:
Originally posted by NTLDR


The safest option though is to put the entire admin directory behind a .htaccess block and uses a different username / password combo then you do for your forums.

NTLDR 08-19-2002 06:57 PM
Firstly, create a file inside you admin directory called .htaccess with the following content:

Code:
AuthUserFile path-to-admin-dir/.htpasswd
AuthName "vBulletin Administrator Control Panel"
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>
Change path-to-admin-dir to the path to the admin directory on the server, and then create a file called .htpasswd and visit: http://www.xs4all.nl/~remcovz/htpasswd.html to generate what you should put in this file.

You will then be prompted with a popup security box that you have to enter the username and password before any files in the admin directory can be viewed.

Boofo 08-19-2002 07:16 PM
Would the path to the admin dir just be "admin" then?

Quote:
Originally posted by NTLDR
Firstly, create a file inside you admin directory called .htaccess with the following content:

Code:
AuthUserFile path-to-admin-dir/.htpasswd
AuthName "vBulletin Administrator Control Panel"
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>
Change path-to-admin-dir to the path to the admin directory on the server, and then create a file called .htpasswd and visit: http://www.xs4all.nl/~remcovz/htpasswd.html to generate what you should put in this file.

You will then be prompted with a popup security box that you have to enter the username and password before any files in the admin directory can be viewed.

NTLDR 08-19-2002 07:53 PM
No, it needs to be the full path on the server, if you don't know that path, visit member2.php in your forums directory, this will give you a fatal error and the path to member2.php.

If you replace member2.php with admin thats the path to the admin directory ;)

Boofo 08-19-2002 08:14 PM
I tried that and all I got was a blank page with the word "done" in the status bar. :)

Would it be the same path as for my FTP?

Quote:
Originally posted by NTLDR
No, it needs to be the full path on the server, if you don't know that path, visit member2.php in your forums directory, this will give you a fatal error and the path to member2.php.

If you replace member2.php with admin thats the path to the admin directory ;)

Erwin 08-19-2002 10:10 PM
Ahhh... never leave your debug on ever...

NTLDR 08-19-2002 10:28 PM
Quote:
Originally posted by Boofo
I tried that and all I got was a blank page with the word "done" in the status bar. :)

Would it be the same path as for my FTP?
They must have changed it since 2.2.4 :(

This should work, visit admin/index.php?action=phpinfo and search for DOCUMENT_ROOT that gives the path to the root of your domain, ie www.yoursite.com, then just add the path to the forums admin after it, eg /forums/admin

Boofo 08-19-2002 10:32 PM
LOL This just isn't my day. :)

It tells me NO Value on that. :)

Will this work?

Code:
http://www.bearfacts2.com/forum/admin?

Link14716 08-19-2002 10:43 PM
how about this.
at the end of the first line of one of the index.php's, add some random characters. Upload it and run it. It will give you the path to the file

Boofo 08-19-2002 11:02 PM
Bingo! At first, I did as you suggested and added random characters to the end of the <?php line but the page still loaded fine. I then replaced the <?php line with random characters and and it gave me the error and the path I needed. Thanks for the help. I should have known that. DOHHH!!!

Now, how do I go about setting up .htaccess for the main forums dir without having to password it (do stop anyone from downloading any php files and stuff like that)?

algolee 10-02-2004 06:24 AM
I think using .htaccess to protect /admin is working.
My website was hacked recently
Even I change my administrator's password can not stop the hacker login in.
I has checked my server ( include Apache's Log & DNS ) , no error can be find.
And finial I find hacker was login into /admin using my account & password.
After changed my password at lease 5 times , i decided to using .htaccess file at /admin directory.

ps. 1. I find some website discuss crack vbb at China website .... like below

http://www.enet.com.cn/esafe/inforce...720326189.html

2. Suddenly I find one thing , even the hacker can not login into /admin , but he still can login into system to delete mass post .... and do anything he want to do ...... :angry::angry::angry::angry:

Zachery 10-02-2004 11:33 AM
Quote:
Originally Posted by algolee
I think using .htaccess to protect /admin is working.
My website was hacked recently
Even I change my administrator's password can not stop the hacker login in.
I has checked my server ( include Apache's Log & DNS ) , no error can be find.
And finial I find hacker was login into /admin using my account & password.
After changed my password at lease 5 times , i decided to using .htaccess file at /admin directory.

ps. 1. I find some website discuss crack vbb at China website .... like below

http://www.enet.com.cn/esafe/inforce...720326189.html

2. Suddenly I find one thing , even the hacker can not login into /admin , but he still can login into system to delete mass post .... and do anything he want to do ...... :angry::angry::angry::angry:
This is a very very very old thread, i (think) i repllied to your thread at vBulletin.com. >.>


All times are GMT. The time now is 09:29 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.02243 seconds
  • Memory Usage 1,812KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (7)bbcode_code_printable
  • (2)bbcode_php_printable
  • (10)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (33)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete