Version: , by XGC Viper XI
Developer Last Online: Jan 2020
Version: Unknown
Rating:
Released: 11-16-2014
Last Update: Never
Installs: 0
No support by the author.
Recently ibProArcade 2.7.2+ was hacked where the hacker was able to insert the root file into the arcade/tar folder. This was confirmed with the webmaster once this was identified based on the file that was inserted. The only file that should be in that folder is the index.html.
As it has been a while since ibProArcade was updated, has there been any updates or fixes that addresses this issue?
Show Your Support
This modification may not be copied, reproduced or published elsewhere without author's permission.
As far as I can see, the only place where the tar module is being used which uses the arcade/tar/ folder, is in the adminCP.
Either someone accessed your ACP through an other vulnerability or the hacker just uploaded a malicious file to that folder because it has public read/write access on it. (0777 chmodded)
No, the arcade/tar folder is in the root based on the installation files and the folder has 755 permission to include the arcade folder. This was pin pointed by the webmaster who had been troubleshooting this issue before I made him aware of it where a file was inserted that began the root of the problem. The only part of our site that uses that folder structure is the ibProArcade.
After the site was hit with the root file, it pathed to change all the main files of vBulletin and almost all index.html page to insert code in to the files.
I was working on someones site last night, who had DB Tech's arcade installed... I only mention that mod because of what I'm about to tell you to check.
- Check the game folders, anywhere it stores the game itself, either the specific folder OR any /temp folders.
Why? Sometimes the games you install/import can have malware and malicious files.
How do I know? This is one of the few games I've ran into where the files would not transfer to my pc when running a backup so I knew something was up.
Is the game Bobsled GC installed?
I found this in a sub-folder:
Now normally a game.swf would be ok but as I noticed my pc did not even allow that one to come through - couple that with the fact there's variants and one that stood out more than others was shell and comm files. Needless to say these had to be removed using the root user as nothing we did from normal accounts allowed us to delete the files basically permission denied every time.
So like I said above, I only mention DB Tech arcade because of what I recently ran into last night with those iffy game files. The owner of the site logged in as root, delete those files and uninstalled the game from the arcade. What I'm trying to convey is that, the arcade COULD have an unknown exploit OR one of your games does - Be Careful where you download games from.
After the site was hit with the root file, it pathed to change all the main files of vBulletin and almost all index.html page to insert code in to the files.
I imagine this was base64_decode? If you found out anything else regarding this since time of the above post please let us know.
ibProArcade 2.7.2Hacked Details »»
About Developer
No support by the author.
11-16-2014, 07:06 PM
