[CMS] I've been hacked

[oddmud]

UPDATE BELOW


I'm in damage control right now, I've changed my server password. Changing my admin user passwords.

in my /content/ folder is 1718 html files all sexual related names.

I'm not sure if it's a vBulletin thing, a vBSEO thing, or a server thing.

HELP!? What do I do?!

[Zachery]

There is no way that by default vBulletin can write files to folders like that.

First steps is to upload new files from a stock zip, also update/disable third party addons.
Double check your file/folder permissions. Make sure for the time being there are no files/folders set to 777.
Is your vBulletin install in the content folder?
Did you put the cms in the content folder?
What is in the content folder if not vBulletin?

[oddmud]

The /content/ directory was 755 .

i went in to the vBSEO setup and it put the proper files back in place so the site is up now.

/content/ was setup by vBSEO i believe. it's my cms.

http://www.goaliecrease.net turns into www.goaliecrease.net/content/

very strange, i haven't been hacked like this before.

[Zachery]

There shouldn't have been a content folder at all, if vbseo was doing anything it was a mod_rewrite. There shouldn't be a content folder by default.

What is your public_html folder set to permissions wise?

[oddmud]

I see now the content folder is gone.. argh, someone's screwing with me...

755 is the main public folder.

[zxLeo]

ah . well if you use vbulletin 4.1.0 Beta you could get this

well vbulletin 4.1.0 maybe have some bugs into files .

but im not sure if it's ...

PS :

Sorry for my bad english u.u !

[Zachery]

There are no known exploits for any current versions of vBulletin, please don't imply that there are unless you have some level of proof.

[oddmud]

I'm running 4.0.8 PL2. I'm not implying anything, I believe you were talking to zxleo though.

[TheLastSuperman]

More than likely server related.

What you want to do here is find out HOW they were able to gain access, unless you fix (putty over that hole in the wall) it will happen again.

*Always backup EVERYTHING, filesystem and database etc to your hard drive, no matter the current state of things you might need a file not in the stock .zip of vB to replace it etc. - Best to run Virus scans and or Malware Bytes Anti-Malware on these files before you open any of them, run scans immediately after downloading the files to your PC via FTP like Filezilla etc*

1. Backup all attachments (avatars/album images/everything) if they are stored in the filesystem not the database. *See my note above, best bet is to backup EVERYTHING*
2. Delete ALL the stock files (Leave the attachment folders for now, we backed up just to be safe).
3. Upload new fresh 4.x files, ensure the config is correct and uploaded before any other file.
4. Follow Zachery's info above about checking CHMOD permissions and disabling add-ons, while disabled check for their thread here on vb.org and see if any have been "Quarantined" if so disable or remove completely otherwise see below.
5. If you did not delete all the stock files OR there are quite a few files left over not normally seen be sure to check them out and remove if required.

*Remember that most hackers are in fact "Script Kiddies" and nothing more meaning they must follow online Guides or info in order to actually "hack" something, very rare to see those with knowledge in the crowd as the talented ones are very "quiet" and don't wear bright red dresses to a ceremony for nuns per say.

Basically most hackers will name a file something that blatantly gives it up... recently I had to fix a forum where a hacker had uploaded a file named grethel_brothel.php <-- Who the HELLO does that? Dead give-a-way for someone like me, I still searched further and found 3 more malicious files but the point is, there should be nothing to worry about unless they directly accessed your database. Edit: <-- Ohh and nothing to worry about if you patch the hole they found, I should have clarified that so be sure to nip that in the bud!

[TheLastSuperman]

I see now the content folder is gone.. argh, someone's screwing with me...

755 is the main public folder.

Change ALL your passwords including cPanel and FTP, delete any old FTP accounts now and change the main FTP accounts PW.

[oddmud]

Thanks, i don't know what i'm really looking for but i'll try.

[TheLastSuperman]

Thanks, i don't know what i'm really looking for but i'll try.

Well keep this in mind...

The .zip file you download from the members area i.e. 4.0.8 PL2 has ALL the stock files in it. So the only thing that should be added are, new attachments such as avatars and album images IF they are stored in the filesystem otherwise they are in the database so no worries. And the only other thing should be modification folders and their files.

So like I said, backup everything first to your PC, start a scan on those files then go back to your FTP client and delete ALL folders and files related to vbulletin. Now upload the fresh 4.0.x files from the .zip and update the config.php and make sure it's in place then all nasty files went poof. If something major is off or missing pull it from your backup (when the virus scan is done etc) and restore.

Don't let it intimidate you... vBulletin is not that much of a bully . In the least, if you make full backups you can't go wrong even if you don't make it right catch my drift?

[oddmud]

I use a plug in that makes daily backups. Auto Database Backup 4.0.3.

Is that good enough? I'm still going to back up to the hard drive and scan like you said.

Thanks for all your help by the way.

[TheLastSuperman]

I use a plug in that makes daily backups. Auto Database Backup 4.0.3.

Is that good enough? I'm still going to back up to the hard drive and scan like you said.

Thanks for all your help by the way.

Sure is, I know quite a few that use it and you should be able to restore it. Remember though, how did he/she get in? That's the key... if you restore a DB backup and changed passwords after the point in time it was made be sure to go back and change them again IF you restore as the passwords from the time you were hacked are.. yeap you get it now .

No problem, I've had to do this on a few sites recently and was on here hunting some info down, checking on some threads and the title caught my eye .

[oddmud]

UPDATE

So I noticed my google numbers dropped drastically. I decided to do a little research as to what had been causing it. I found that when I was hacked there was some sort of residual linking in the site.

When I looked at my source code using Firefox for the /forums/ directory everything looked hunky dory. When I used the "Fetch as Googlebot" from the webmaster tools. I found at the end of my code was thousands of porn links.

Now I'm sure this caused google to punish me, and that's why I'm not getting the traffic anymore. I'm in the process of backing up and upgrading and overwriting everything and upgrading. Hopefully this will solve the problem.