Security Password for Admincp Hacks

Security Password for Admincp Hacks
by AnhTuanCool

Quick Stats:
Version 1.0.2
Tested full functionally on vBulletin 3.0.3
Time to install: no more than 2 min
File to edit: 4
Template to edit: None
Query to run: None

What this hack does:
Add an additional Password for ACP which is only known by insiders if intentional or unintentional someone could get your current account and do the bad things to your board, this password is assign to all current administrator and only can be changed by the superadministrator*.

Updated:
Upgrade from v1.0.0
Fixed bug that not allow normal member to login

Install:
I had includes the installation file so that you don't have to move much which is always discourage people with long instruction. Included the installation file, download and upload the two files onto your forumroot/admincp/ directory, run the file acppassword_install.php from your admincp and follow it closely.

Disclaimer:
Of course do not forget to back-up your file before uploading it.
Do NOT stop the installation while it isn't finished yet, this can cause you more trouble.

*Be a superadministrator
If you are the webmaster of your site, then you probably can use FTP or another way - edit the source code, you will need to edit the $superadministrators variable in the includes/config.php file to be a superadministrator or you can add some of trusted people, in order to reset this password.

To allow the administrators to access this page, edit the variable to include the user IDs of those administrators should have access, separating each user ID with a comma, like this:

$superadministrators = '1,25,57';

To allow only a single administrator to access this page, simply add that user's ID with no commas, like this:

$superadministrators = '1';

Note: This hack assigns the security password for all current administrators, so if you set someone to administrator, you will have to reset the password in order to allow him to ACP.

Screenshots:
Attachment

NOTE: INSTALL as your OWN risk. This hack has a serious side-effect on the login function. I'll try to fix it as soon as I can.

[yukayumi]

Really don't remember if I had made any changes to this file before.It's supposed to be there like in your screenshot but mine is different.Please take a look and tell me what to do.Should I hit the back button and uninstall this script? I'm afraid I won't be able to login my admincp if get stuck in the middle of the installation here.

[PitchouneN64ngc]

What is your version of vBulletin you using? For vB 3.0.3, all is good

[AnhTuanCool]

To yukayumi -

Replace your lines from 156 to 158 with:

PHP Code:

    if ($bbuserinfo = $DB_site->query_first("SELECT userid, usergroupid, membergroupids, username, password, cpanelpassword, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . addslashes(htmlspecialchars_uni($username)) . "'"))
    {
        if (
            $bbuserinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $bbuserinfo['salt']), '') AND
            $bbuserinfo['password'] != md5($md5password . $bbuserinfo['salt']) AND
            $bbuserinfo['password'] != iif($md5password_utf, md5($md5password_utf . $bbuserinfo['salt']), '') OR
            $bbuserinfo['cpanelpassword'] != md5(md5($password2))
        ) 


Good luck

[yukayumi]

Mine is vbb 3.0.1,maybe that's why there's alot of error out there.Could not find the code between those <!-- login fields --> in my adminfunctions.php file.I guess it's not compatible with 3.0.1 though.What should I do?

[AnhTuanCool]

In adminfunctions.php, SELECT BETWEEN the two <!-- login fields --> and <!-- /login fields --> line, and do the replacement, good luck

[yukayumi]

Could you please take a look at my functions_login.php file? It's 3.0.1 and I could not find the code mentioned in your hack.Thanks.

[AnhTuanCool]

Cross out that modification for functions_login.php and do the first two support that I gave (if you didn't) cause there is no verify_authenticate function .

[yukayumi]

Work like charm,AnhTuanCool.Thanks alot.This hack is great!

[Floris]

Personally I think this is useless because there is also .htaccess which is better.
The biggest threats are xss where they don't even need to know the passwords. This would be a handy additional security layer for windows servers where .htaccess isn't working. And every additional security layer is better then not having it. So thank you for your hack and sharing it.

[Carter876]

I'm on Linux server and I prefer to use .Htaccess but this hack is good for Windows server

Regards