Secure your vBulletin board

[TECK]

ok, today i helped ptbyjason to take control again over his hacked board.
https://vborg.vbsupport.ru/showthrea...threadid=35339

while playing, i discovered a way to add myself as admin to any VB board, if i'm able to call the path from the server. FireFly, i want to email you the php file i made. email me so i can send you the file and you can look at it.

the solution is to change the permissions for the admin folder in a way that if any file is called from outside of the server, to display a show_nopermission error message.

UPDATE:
in /admin/config.php add this code, at the top:

PHP Code:

if(!strstr("$_SERVER[PATH_TRANSLATED]", "$_SERVER[DOCUMENT_ROOT]")) {
  die();
} 


that should prevent to run a script from outside your server. thanks PPN.

[TECK]

try this:

make a info.php file with the code listed below and place it in your root:

PHP Code:

<?php

phpinfo();

?>

i wonder if it is extremly easy to find out what is someone's path and manipulate his(her) board. what i can do, is make a directory for dynamic content (let's call it "dynamic"), and put in an .htaccess file that has the line:

PHP Code:

ForceType application/x-httpd-php 


in it. this will force all accesses from that directory to be processed as a PHP script. then I can just write a PHP script called, say, script (note, not script.php, just script), so if i call the path:

PHP Code:

http://domain.com/dynamic/script/this/is/all/fake/path/ 


after i call that path, i can check the variable $REQUEST_URI in PHP and strip off everything after /dynamic/script/, and that is the information i want...

you know what? all this info i found it on google.com.

[Scott MacVicar]

nakkid, email it to me and I'll look at it straight away. I don't think you can do this without FTP access though, and if mysql is setup correctly you shouldn't be able to access it via another server.

[Lesane]

I also think that this is not possible without uploading a file into that ftp account.....

[TECK]

hmm how do you explain the problem ptbyjason had? the hacker didnt have access as admin to his board.. he did it from another server!! we need to change the permissions.. is a fact. read the post where i helped jason...

[TECK]

ok, i emailed you the script PPN... do you know a way to don't let any file be called from outside of /admin dir? let me know. i'm not good with permissions.

[Scott MacVicar]

If he had access on the server, if it was a shared server? Then yes this happens, there is nothing that can be done about this if the permissions are not set correctly by the host then other users can read other users files.

[TECK]

i know i read somewhere about this type of permission, not to let call a script from outside the domain. that's where i need to focus on.. this is where the problem resides..

[Scott MacVicar]

Simpliest way to do something like this is use

PHP Code:

if(!strstr("$_SERVER[PATH_TRANSLATED]", "$_SERVER[DOCUMENT_ROOT]")) {
die();
} 


If the document root path is not found in the script filename path then exit the script. This means the script would have to had been executed above the users document root, so if you have /home/username/public_html then the script would have had to be executed in any of these folders. You can add this to the top of config.php but I don't see a point personally.

[TECK]

ok. can you make a quick hack? so we all can add it to the /admin folder? thanks.