Miscellaneous Hacks - Cyb - Advanced Forum Rules

Info:
Advanced Forum Rules system for vBulletin.

Main Features:
-Rules shown on separate page (no file uploads required)
-Several sets of rules can be created and applied to individual forums
-Choose between BB codes and HTML in rules
-Options to force users to accept Forum Rules before can view forums or threads, post replies, PMs, or e-mails...
-Option to replace registration rules with this product ones
-Option to reset user acceptance status when infraction is received

View screenshots.


Installation:
1. Import XML file (as product): AdminCP > Plugin System > Manage Products > [Add/Import Product]
2. OPTIONAL (for some customized styles)
Open template "navbar" and add "$cyb_frules_link" after "vbphrase[faq]</a></td>".
3. OPTIONAL (to add 'reset acceptance status' to different place than default one)
Open template "MEMBERINFO" and add "$cyb_frules_force" wherever you wish.


To set options:
Go to: AdminCP > vBulletin Options > Cyb - Advanced Forum Rules


Versions:
v1.0 - Oct 06. 2005.
-First version
v1.5 - Apr 22. 2006.
-Navbar link is added automatically now (one installation step less)
-Navbar "Forum Rules" link can be disabled in hack settings
-"Manage Rules" link is on settings page now (no need for .xml menu file anymore - one file less to upload when installing)
-"Unknown Location" fixed
-Added function to enable/disable whole hack (predefined error message is displayed instead)
-Templates now goes to "Cybernetec" group in Style Manager
To upgrade from 1.0 to 1.5:
-Import product XML through AdminCP > Plugin System > Manage Products > [Add/Import Product] (Be sure "overwrite" is checked). Upload cfrules.php and cfrulesadmin.php (replace old files). Delete file \includes\xml\cpnav_cfrulesadmin.xml.
v1.6 - Aug 04. 2006.
-Release of this hack for vB v3.6
v1.7 - Aug 05. 2006.
-Uncached template bug fixed
v2.0 - Aug 07. 2006.
-Completely changed way this hack works. No more queries, no more file uploads. Now Rules can be exported because it's part of vB settings. Now you can use BB Codes, which means you can use all standard text formatting functions, smilies, etc. To upgrade: Uninstall old version > Import XML as product > Delete "cfrules.php" from your forums root > Delete "cfrulesadmin.php" from "admincp" folder of your forums
v2.1 - Aug 07. 2006.
-Fixed "Edit Forum Rules" link (didn't worked for some users)
v2.2 - Aug 25. 2006.
-If your forum's index.php file was renamed, for any reason, now you can enter new filename in ACP hack options to have this hack working properly
-Added "Product Version Checking" - https://vborg.vbsupport.ru/showthread.php?t=124679
v2.3 - Aug 26. 2006.
-New: User must accept Rules to be able to post on Forums (option can be disabled/enabled)
-Look improved (see screenshots)
-Codes improved
-Hack name changed to "Cyb - Advanced Forum Rules"
v2.4 - Aug 27. 2006.
-Fixed small javascript bug
-Removed redirection to forum index after Rules acceptance
-Note 1/2 lines replaced by boxes in hack settings
-Removed navbar link HTML Markup options
-Separate phrase created for navbar link
v2.5 - Aug 31. 2006.
-Added ability to reset read status for all users. After this they will need to accept the Forum Rules again
-Added note at the top of Forum Rules when user need to accept it to be able to post on forums
-Added explanation on how to check which users had (not) accepted Rules
v2.6 - Aug 31. 2006.
-Fixed bug (index file location/name setting doesn't work)
-Fixed bug (if user who haven't accepted Rules try to post via quick reply in IE he gets undefined error)
-Fixed bug (resetting the accepts doesn't work if index file was renamed)
-Added: Guests now also need to accept Forum Rules to be able to post (cookie-based)
-Added: redirection message for user who try to post but haven't accepted Rules
v2.6.1 - Aug 31. 2006.
-Fixed bug (if user has no permissions to post he will get standard "no permission" message, not redirection to Forum Rules)
v2.7 - Sep 11. 2006.
-After acceptance users are redirected to the page they were previously viewing
-No more need to set filename for "index.php" if it was renamed. Now misc.php is used, which nobody has need to rename.
NOTE: Don't forget to update the links to the Rules you were posted on your site - change it to YOURFORUMS/misc.php?do=cfrules
-Added confirmation dialog for resetting acceptance status for all registered users
v2.8 - Sep 14. 2006.
-Added option to exclude usergroups from accepting Rules
-Navbar link title moved from phrases to settings for easier translation/make-up
v2.9 - Sep 24. 2006.
-Added option to reset acceptance status for individual member
v3.0 - Oct 30. 2006.
-Whole code is now valid XHTML 1.0 Transitional
v3.1 - Nov 13. 2006.
-Option to force user to accept rules again in member profile can be turned off
-Added variable for above function that you can place it to another place in MEMBERINFO template ($cyb_frules_force)
-Bug fixed (if some user knows exact link for resetting acceptance status he can do it)
-Several other improvements/fixes
v3.2 - Mar 06. 2007.
-New: User must accept Rules before can send PMs
-New: Options to choose what user can't do before accepting Rules
-New: Option to replace Registration Rules with this hack's one
-New: Better counter (with miliseconds, improved browser compatibility)
-Fixed some "invisible" bugs in code and improved compatibility with the latest vB releases
v3.3 - Apr 21. 2007.
-New: Option to force user to accept Rules before can view forums
-Fixed bug where three queries are executed on places where not needed
-Fixed bug where blank rows are shown twice on registration rules page
-New in registration rules options (disable completely)
-Better redirection after Rules acceptance
-Some other optimizations in codes...
v3.4 - Apr 22. 2007.
-Fixed bug where PMs can not be sent even Rules are accepted
-Fixed bug where Quick Reply does not work even Rules are accepted
-Improved counter and added ability to completely disable it (tested and worked on IE, Firefox, and Opera)
-Improved compatibility with right-to-left styles (note: in Rules use [right] tags anyway)
-Fixed navbar link
v3.5 - Jul 22. 2007.
-Fixed bug (MySQL injection vulnerability - attacker can trick admin to reset rules acceptance status for all members)
-Group membership checking works now for supplementary usergroups too
-Several code improvements
v3.5.1 - Jul 22. 2007.
-Fixed bug (XSS Vulnerability)
v3.5.2 - Jul 23. 2007.
-Another security exploit fixed
v3.5.3 - Jul 25. 2007.
-Fixed bug where user is not properly redirected after accepting rules
v3.5.4 - Jul 25. 2007.
-Bug fixed where username info is not shown when going to reset acceptance status
v3.6 - Oct 14. 2007.
-Fixed bug where some mods are not able to reset acceptance status
-Improved javascript code to fix problems with the counter some users reported
-Minor bug fixes
v3.7 - Apr 30. 2008.
-CSRF protection added
-Compatible with vBulletin 3.7 Gold (may not work with Beta/RC releases)
-Fixed bug where "reset all" button in hack options does not work in IE
-Minor bugs fixed
v3.8 - Jun 19. 2008.
-Fixed bug where user is able to submit form without checking "agree"
-Option to disable BB Codes in Forum Rules
-Option to change "Forum Rules" link color or set to style's default
-Better placement of "Force User To Accept Forum Rules" link in user profiles
v3.9 - Apr 19. 2009.
-New: Ability to create several rules sets, and apply them to individual forums
-New: Exclude individual forums from restrictions
-New: Rules management page where rules sets can be easily added/deleted/edited/applied to forums
-'General Forum Rules' item can be changed but not deleted. Please use it always as general rules.
-Bug fix: Option to disable registration rules does not work on vB 3.8.x
-Bug fix: Counter on 'Accept rules' button does not work on some configs
-Forum Rules link in showthread now leads to this product's 'General Forum Rules'
-If user has not accepted rules, then 'Force to accept rules' link in their profile is not shown
-New: Option to reset user acceptance status when infraction is received
-Some minor bugs fixed
v3.9.1 - Apr 20. 2009.
-Fixed bug: Forum Permissions sometimes needs to be rebuild manually after upgrade
-Fixed bug: Redirection after accepting rules does not work properly in some cases
v3.9.2 - Apr 21. 2009.
-New: Drop-down menu with the rule set list on Rules page
-New: General Rules always shown at the top of table, requested Rules below it
-New: 'Forum Rules' link at the bottom of forumdisplay will lead user to that forum's rule set
-Fixed bug: Navbar link is not disabled when you disable product in options
-Fixed bug: Quick Reply hidden for users who have not accepted Rules even if forum is excluded from restrictions
-Forums better sorted on the list, now linked and some more details are shown
v3.9.3 - Apr 25. 2009.
-New: User can not view Rule sets applied to no-permissions-to-view forums
-Above works also with 'Cyb - Advanced Permissions Based on Post Count' add-on
-New: Choose if General Rules will be Always shown, Collapsed if there is another rule set requested, or Disabled when there are other rules shown
-'Forum Rules' links in showthread, newthread, and newreply are also now redirected to the Cyb Forum Rules
-New: "Rules NOT accepted" shown in user profiles when they have this status
v4.0 - Apr 28. 2009.
-New: User must accept Rules to be able to view thread content
-New: User must accept Rules to be able to send e-mails ('contact us' or 'e-mail user')
-New: Different Rule sets are accepted individually
-New: Reset acceptance status for individual Rule sets
-New: Rules acceptance date/time info shown in member profile
-Fixed bug: Quotes can not be used in Rule Set name
-Some minor bugs fixed
v4.0.1 - Apr 28. 2009.
-Fixed bug: Reply w/quote switches to basic reply after redirection
-Fixed bug: Forums exclusion does not work properly in v4.0
-New: When PM restrictions are enabled Quick Reply is hidden in ShowPM until General Rules are accepted
v4.0.2 - May 08. 2009.
-Fixed bug: In some cases wrong items are listed in 'Accepted Rules' drop-down
-Fixed bug: 'Reset user acceptance status when infraction received' does not work properly
v4.0.3 - May 04. 2011.
-Security bug fixed
v4.0.4 - May 06. 2011.
-Fixed: vbseo users not able to switch rules
v4.0.5 - May 18. 2011.
-Fixed: Security bug
-Improved rule acceptance check


If you like this hack please click INSTALL.

[LauraM]

Valter, thank you for working so fast and putting out an updated version with the security patch. Your very quick attention to this is appreciated.

[Suiram]

i was just hacked. i have no doubt it was this mod. why? because it was the only mod i was using. plain vanilla vbulletin v3.8.6 pl1 and this mod - nothing else. i was not hacked with v4.0.2, i was not hacked when i updated to v4.0.3 but a few days after the initial hack reports by others and then i was on v4.0.4. and yes, i did tick the overwrite box. i almost deserve this for not uninstalling it right there and then, when people were reporting their sites hacked. like another guy said in the other forums, thank God it was a "friendly" hack. never again. i'll stick to vanilla forums from now - lesson learned.

i'm here to find out why i still have a link to http://forums.(mydomain).com/misc.php?do=cfrules which goes to the icons faq question. how do i get rid of this "portal to hacking" completely? i want any and all traces removed.

[Daverball]

Check out this thread: https://vborg.vbsupport.ru/showthread.php?t=263202

It's well possible that you have been hacked before you updated, Hackers tend to install a backdoor, so they can get back inside, even if the exploit they used to get in has been fixed already. It's not always super obvious that you have been hacked, it can happen very subtly, without you ever noticing.

I'm not quite sure what your question is though, do you mean, that you still have a link labeled "Rules" in your navbar? If so, I'm sure you can get rid of it by examining whether there are any active template modifications on the navbar template, if not, you may be able to remove the link by making a template modification of your own.

And if your question is why http://forums.(mydomain).com/misc.php?do=cfrules is still leading somewhere, that's because misc.php is a file which implements many many features, like your FAQ. The Smiley thing seems to just be the default and since cfrules doesn't exist anymore it displays the default.

[Suiram]

Originally Posted by Daverball

It's well possible that you have been hacked before you updated, Hackers tend to install a backdoor, so they can get back inside, even if the exploit they used to get in has been fixed already. It's not always super obvious that you have been hacked, it can happen very subtly, without you ever noticing.

i don't think so. the file was uploaded on the 9th. i updated to to the "fixed" version 4.0.3 on the 5th. i don't know. i'm still unsure what exactly went down.

[The Realist]

I also was using this mod and updated to the latest files attached here and was hacked and locked out, I gained access, removed the fake admin, re-did the titles etc and since that my whole forums files (the lot) has been deleted by someone.

This was 3 years plus worth of work gone down the pan because the developer of this hack didnt check his work.

Now Im stuffed and hoping my host can restore the site or its gone for good.

Thanks.

[The Realist]

Per my above post. My host has carried out a check of the logs and says the following:

I scoured your logs to find no indication of an account breach. However, I did pin-point when this occurred by the error logs and have reason to believe your scripts was exploited to allow your files to be deleted.

Here is the log entries (our helpdesk may strip these - see the raw email):


[Tue May 10 03:32:41 2011] [error] [client 94.143.240.103] malformed header from script. Bad header=Fxxxxxxx%2Fpublic_html%2Femail: vbseo.php, referer: http://www. xxxxxxx. co. uk/includes/vba.php?x=ls&d=%2Fhome2%2Fxxxxxxx%2Fpublic_html&so rt=0a
[Tue May 10 03:33:30 2011] [error] [client 94.143.240.103] malformed header from script. Bad header=Fxxxxxxx%2Fpublic_html%2Femail: vbseo.php, referer: http://www. xxxxxxx. co. uk/includes/vba.php?x=ls&d=%2Fhome2%2Fxxxxxxx%2Fpublic_html&so rt=0a
[Tue May 10 03:36:46 2011] [error] [client 94.143.240.103] File does not exist: /home2/xxxxxxx/public_html, referer: http://www. xxxxxxx. co. uk/includes/vba.php?

As you can see, there is a script that was either uploaded through an exploit or it is a script you are using that was exploited. The "hacker" was attempting to view your files and 3 minutes later the file was gone. These logs show the unsuccessful attempts and also show they were reworking the exploit to be successful. So whatever includes/vba.php was/is, it contains a nasty exploit or was a shell that was uploaded through an exploit of your scripts. You may want to ensure vbseo is updated.

While these do not give solid evidence of the exploit as these was logged in the error log, it's almost for certain due to the calls and time frames. Your raw access logs have already rotated, and would have gave us the solid evidence needed as it would have shown the successful attempt, but it's not needed after concluding the above. I'm 99% sure they was trying to list your files to test the exploit. Once they was able to list them, they carried out the intentions by removing all files.

As you already noticed, your database is intact. All you need to do is reupload your files and plug in the DB information. Just be sure to update all scripts and audit your files.

Make sure you have backups because this hack can delete your whole forum.

Regards

[babynino]

My forum was hacked again after a recent attack on my site a few days ago. We did a full restore, patched this mod to the current one which says that it was patched and yet a few minutes ago, my forum was hacked.

Add me to the list saying that this updated patch is not yet secure.

[error10]

I'm watching this closely.

It would be very helpful if someone can find in their server logs the original attack, or any accesses related to the attack. (The error log info above wasn't quite helpful enough for me to work with.)

[Disasterpiece]

I found a security hole in the script code which allowed me to execute php script code. (v4.0.4)

@Author/s/whoever is in charge: Plz contact me ASAP per PM

[Cristi_XP]

if we only disable the product will be safe ? or have to uninstall it till a good update ?