Potential security breach

[Ishtar]

Hi,
We've just had a user register themselves as a administrator. Can you please confirm if this is normal functionality or if there has been a security breach?

[Jamsoft]

Under no circumstances should a user be registering as an administrator. This is not normal.

Check this: http://www.vbulletin.com/forum/forum...-1-vbulletin-5

If you have not done this, you need to remove your INSTALL folder right away. See the above link for details. Oh, and delete that admin account and any others that you have not created.

[Mark.B]

Please delete your install directory immediately.
Delete any unknown admin accounts
Check the Admin CP logs to see what activity there was.
Check your plugins for anything you didn't put there yourself.
Add .htaccess password security to your AdminCP

[kdevitt]

Just had this happen on my forums - deleted profile and install folder. IP of the attack was 122.173.192.42

[kdevitt]

They installed the skimlinks plugin by the way.

[Ishtar]

i would like to log a job to get your assistance with this please. What info do you need from me?

[Zachery]

Please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked

http://www.vbulletin.com/forum/blogs...vbulletin-site

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

[yamahapaul]

Please delete your install directory immediately.

Just to clarify, do I have to delete the whole of the folder and contents as circled on the attached pic?

[DemOnstar]

Delete the entire install folder. it is at your forum root as illustrated in the following post.

[yamahapaul]

[munkfish]

We've just been compromised after having had the install/upgrade.php script attacked, appears to be related to this (which is presumably what the link in the 2nd post above refers to):

http://www.cyberaon.com/2013/09/vbul...rade-0day.html

After creating a dodgy admin account via the upgrade script, they added a single plugin 'wub' which essentially consisted of a single 'system($foo)' call hooked to the ajax_completed(?) hook to allow them to execute arbitrary commandline code via a browser. After that a number of exploit scripts/systems were uploaded, most notably Bases.php which appears to be a general do-it-all exploit script, plus various other bits and bobs (including the enlightenment kernel exploit tool). After that you can see them rooting around looking for interesting targets within the filesystem and viewing various files.

Touch wood it's been caught early enough and we're in the process of restoring from backup etc. How the install directory wasn't deleted I don't know.

Also slightly peed off that the subscription I have for the Announcements board on this forum doesn't appear to have sent anything out since February so I didn't get the heads up on this issue.

As mentioned above, if anyone reads this and hasn't deleted the install folder inside the forum root, make sure you do so straight away (mind you if you're reading this then it's probably already too late unfortunately, can only suggest you restore your board files from a backup or at least compare them to a known good backup).

[Bob Maestri]

This has just happened in our forums as well. I have deleted the Install folder. Will deleting this folder have any adverse affects on the operation of the forum? Also, has anyone had a repeat of this issue after deleting the install folder?

This kind of stuff freaks me out as the forums are important to my company. Thanks for any reassurance anyone can provide

[munkfish]

This has just happened in our forums as well. I have deleted the Install folder. Will deleting this folder have any adverse affects on the operation of the forum? Also, has anyone had a repeat of this issue after deleting the install folder?

This kind of stuff freaks me out as the forums are important to my company. Thanks for any reassurance anyone can provide

Deleting the folder won't have any adverse effect, it should have been removed after the last installation/upgrade was completed anyway (but it has to be done manually so unless you're careful you can forget/miss doing it).

Re your other question, the issue is that the initial compromise of the upgrade.php script / install directory is only the 'way in'. After that additional 'shell' tools are usually uploaded and from there they can go to work attempting to escalate their privileges or installing extra malware or using your site as a dumping ground to 'hold' the malicious scripts/tools for uploading to other compromised servers. The key is having some kind of backup of your system that you can compare the current system to and remove any additional files that were added illegally.

Check the link to a blog post by Zachary on the vb blog about recovering from an attack (somewhere in the first few posts on this thread). Essentially you want to change all your forum admin usernames / passwords, the database username/password, plus restore all your forum files from a backup copy (move or delete the old board directory and restore a known good copy of the board directory in it's place).

One way to do some detective work is to check the username of the admin account that was created and get the creation time of the account. After that, check your webserver logfiles for any plugin.php accesses around that time - from that you can get their IP address (the IP address isn't in the admin panel entry for the user by default because technically the user hasn't accessed the forum 'normally' in any way that would create an ip address entry in the database). Then from there grep the logfiles for the IP address to see what URLs they're requesting and attempt to 'tidy up' after them - in our case it was a PHP shell script Bases.php (some encoded shell script - I-47) that they'd uploaded (amongst other things) and we could see them poking around looking for other potential targets.

[Bob Maestri]

Deleting the folder won't have any adverse effect, it should have been removed after the last installation/upgrade was completed anyway (but it has to be done manually so unless you're careful you can forget/miss doing it).

Re your other question, the issue is that the initial compromise of the upgrade.php script / install directory is only the 'way in'. After that additional 'shell' tools are usually uploaded and from there they can go to work attempting to escalate their privileges or installing extra malware or using your site as a dumping ground to 'hold' the malicious scripts/tools for uploading to other compromised servers. The key is having some kind of backup of your system that you can compare the current system to and remove any additional files that were added illegally.

Check the link to a blog post by Zachary on the vb blog about recovering from an attack (somewhere in the first few posts on this thread). Essentially you want to change all your forum admin usernames / passwords, the database username/password, plus restore all your forum files from a backup copy (move or delete the old board directory and restore a known good copy of the board directory in it's place).

One way to do some detective work is to check the username of the admin account that was created and get the creation time of the account. After that, check your webserver logfiles for any plugin.php accesses around that time - from that you can get their IP address (the IP address isn't in the admin panel entry for the user by default because technically the user hasn't accessed the forum 'normally' in any way that would create an ip address entry in the database). Then from there grep the logfiles for the IP address to see what URLs they're requesting and attempt to 'tidy up' after them - in our case it was a PHP shell script Bases.php (some encoded shell script - I-47) that they'd uploaded (amongst other things) and we could see them poking around looking for other potential targets.

Thanks for the reply. I have:

- deleted the install folder
- deleted the hacked user
- deleted or renamed modified files (we saw a new one called "meow.php")
- changed all passwords
- created a backup

I hope this is sufficient until vB patches the exploit. I did not see any suspicious plugins and it doesn't look like anything else was tampered with, so seems I'm fairly lucky compared to what has happened to some others.

[Ishtar]

Are VBulletin creating a security patch for version 4? When is it expected to be available?