Need Help about hacking

[tanzeelniazi]

Hello all i have a problem today i got so many email about database errors
i think someone try to hack but fail not complete sure
i got this emails

Database error in vBulletin 4.2.0:

Invalid SQL:

                SELECT post.postid, post.threadid, post.visible, post.title, post.userid,
                        thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid
                FROM post AS post
                LEFT JOIN thread AS thread USING (threadid)
                WHERE postid IN (1) AND 81 44 AND (7397=7397);

MySQL Error   : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '44 AND (7397=7397)' at line 5
Error Number  : 1064
Request Date  : Monday, July 18th 2016 @ 07:03:58 PM
Error Date    : Monday, July 18th 2016 @ 07:03:58 PM
Script        : http://www.XXXXXX.com/forumrunner/request.php
Referrer      :
IP Address    : 18*.6*.1**.**9
Username      : Unregistered
Classname     : **_******_MySQLi
MySQL Version :

Database error in vBulletin 4.2.0:

Invalid SQL:

                SELECT post.postid, post.threadid, post.visible, post.title, post.userid,
                        thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid
                FROM post AS post
                LEFT JOIN thread AS thread USING (threadid)
                WHERE postid IN (1) AND (SELECT CHAR(122)||CHAR(107)||CHAR(75)||CHAR(66) FROM INFORMATION_SCHEMA.SYSTEM_USERS)=CHAR(122)||CHAR(107)||CHAR(75)||CHAR(66) AND (7852=7852);

MySQL Error   : Unknown table 'SYSTEM_USERS' in information_schema
Error Number  : 1109
Request Date  : Monday, July 18th 2016 @ 07:04:18 PM
Error Date    : Monday, July 18th 2016 @ 07:04:19 PM
Script        : http://www.XXXXX.com/forumrunner/request.php
Referrer      :
IP Address    : 18*.6*.1**.**9
Username      : Unregistered
Classname     : **_******_MySQLi
MySQL Version :

Database error in vBulletin 4.2.0:

Invalid SQL:

                SELECT post.postid, post.threadid, post.visible, post.title, post.userid,
                        thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid
                FROM post AS post
                LEFT JOIN thread AS thread USING (threadid)
                WHERE postid IN (1) AND (SELECT CHAR(122)||CHAR(107)||CHAR(75)||CHAR(66) FROM INFORMATION_SCHEMA.SYSTEM_USERS)=CHAR(122)||CHAR(107)||CHAR(75)||CHAR(66) AND (7852=7852);

MySQL Error   : Unknown table 'SYSTEM_USERS' in information_schema
Error Number  : 1109
Request Date  : Monday, July 18th 2016 @ 07:04:18 PM
Error Date    : Monday, July 18th 2016 @ 07:04:19 PM
Script        : http://www.XXXXXX.com/forumrunner/request.php
Referrer      :
IP Address    : 18*.6*.1**.**9
Username      : Unregistered
Classname     : **_******_MySQLi
MySQL Version :

and some other types of database errors
Some one try to hack me ?
Someone got my database ?
any help

[Kane@airrifle]

You had better update and patch ASAP: http://www.vbulletin.com/forum/forum...or-vbulletin-4

[z3r0]

Check for a new plugin added named "vbulletin" in the hook location "init_startup" containing a load of base64 encoded stuff, if it's there you have been hacked and you should disable/remove it and have a check for any files uploaded to your forum (left menu -> maintenance -> diagnostics -> suspect file versions)

[tanzeelniazi]

how i check in "vbulletin" in the hook location "init_startup" containing a load of base64 encoded stuff ???

[z3r0]

From the admincp go to plugin manager in the left column then check for a product titled "vbulletin" that has the hook location "init_startup", click edit and if in contains the word base64 and a load of random text then you need to disable it.

[RichieBoy67]

If you need help let me know.. Definitely follow the above advice asap. Also disable forumrunner until you upodate.

[Dave]

Delete the forumrunner directory or rename it to something random asap in case you haven't patched it yet.

[Paul M]

Originally Posted by RichieBoy67

If you need help let me know.. Definitely follow the above advice asap. Also disable forumrunner until you upodate.

Disabling Forumrunner will have no effect on the issue, you must either patch it, or remove it.

[TheLastSuperman]

Originally Posted by z3r0

Check for a new plugin added named "vbulletin" in the hook location "init_startup" containing a load of base64 encoded stuff, if it's there you have been hacked and you should disable/remove it and have a check for any files uploaded to your forum (left menu -> maintenance -> diagnostics -> suspect file versions)

Actually, it's best to check the datastore table, (Edit: well truth be told check regular plugins via admincp, the plugin table as well PLUS the datastore table, check them all!) then look in the pluginlist (there are two, pluginlist and pluginlistadmin so be sure to check both, typically malicious cade is only in pluginlist though) because code added to the bottom of this will not show in one single/particular "plugin" via the admincp because this contains all the plugins in one list not a single view per say . You can also scroll the entire contents of pluginlist to see a complete list of plugins installed on your site, be careful if editing out malicious code and once done go to your admincp then into plugin manager and save the active status (to reset datastore/plugins) otherwise changes may not show immediately and/or could cause display issues.

What some have been doing is injecting their base64 code at the very bottom (scroll to find, they add tons of white space so you won't notice right off the bat unless you scroll down, i.e. if a scrollbar exist when viewing via phpmyadmin, scroll scroll scroll ) and more so we see this with myfilestore than any other type of exploit (also if you're dealing with that in particular, myfilestore redirect then also check the file datastore_cache.php which is located in /includes/datastore/ for any mal code).

[RichieBoy67]

There is a good chance that debase64 code was already added to all of the files as well at this point.

--------------- Added [DATE]1468970657[/DATE] at [TIME]1468970657[/TIME] ---------------

Originally Posted by Paul M

Disabling Forumrunner will have no effect on the issue, you must either patch it, or remove it.

Yes, correct. Thank you Paul for the correction. :up: That is why you get the big bucks!