Blank Page after logging into the AdminCP

[jkotlowski]

Last night, my site was knocked offline for an unknown reason. Suspecting it was a hosting issue, I went to my host and asked them to check into it. Their support came back and said my PHP version needed to be updated, so they updated to PHP 5.6 (I believe). And everything seemed fine at that point, but I didn't bother checking to see if I could log into the AdminCP at the time.

A few hours later, my website was compromised , presumably as a result of the backdoor exploit being discussed. The result was that my site went offline entirely for several hours while I was sleeping. I contacted my host again and they did a hackscan to determine what files were malicious. However, the ones they came up with didn't include all the extra files I found on the server. So their solution was to roll the server's back by a couple days to before the intrusion, which I did. This brought the site back online, however I can no longer access the AdminCP. When I log in, I get a blank page. I tinkered around in my htaccess files as well as poked around the config files and didn't see anything amiss. So now I'm here. Anyone have any idea what the problem could be?

https://www.t5forums.com/
https://www.t5forums.com/admincp/
https://www.t5forums.com/admincp/index.php (tried this too, as was suggested in similar topics here. Still doesn't work.)

[Wayne Luke]

You cannot run vBulletin 5.5.X on PHP 5.6. You must use a minimum version of PHP 7.1. Versions older than vBulletin 5.5.X are no longer supported.

I suggest you reupload all files to your server. Without access to your server through a support ticket (which requires a support contract), I can't tell you why you're getting a blank page at this moment.

[jkotlowski]

You cannot run vBulletin 5.5.X on PHP 5.6. You must use a minimum version of PHP 7.1. Versions older than vBulletin 5.5.X are no longer supported.

I suggest you reupload all files to your server.

I actually did reupload all my files about an hour ago. I was a version behind and decided to upgrade to 5.5.4 in case the exploit used to hack my site was only on the older versions. I thought it sounded odd that my PHP version was outdated. I distinctly remember asking to be updated to PHP 7.1 several months ago. That may be what broke my AdminCP. I'll contact my hosting support about updating my PHP version and see if that helps.

[jkotlowski]

You cannot run vBulletin 5.5.X on PHP 5.6. You must use a minimum version of PHP 7.1. Versions older than vBulletin 5.5.X are no longer supported.

I suggest you reupload all files to your server. Without access to your server through a support ticket (which requires a support contract), I can't tell you why you're getting a blank page at this moment.

I was able to change my PHP version through cpanel to 7.2.

Still cannot access my AdminCP.

[Wayne Luke]

Is the /admincp directory empty? The only files should be in the /core/admincp directory.

[jkotlowski]

Is the /admincp directory empty? The only files should be in the /core/admincp directory.

Suspicious file was in the adminCP location. Really strange since I rolled the server back to the 22nd. It should have been deleted, I would think.

I deleted that file and now it's working. I guess I'm going to have to go into each and every folder to look for suspicious files. Hopefully you guys can get a patch out soon to fix the exploit. It would be a pain for me to do all this again. lol.

Thanks as always for your help, Wayne. Much love friend.

[Wayne Luke]

Rollbacks really don't work that way. They only replace files that they have in their list of files to replace.

[panzerscope]

Just so it is known, with the recent zero day security issue, my site was compromised and the contents of the AdminCP folder was deleted as I was also getting the blank page issue.

[alfreema]

FWIW:

We were on 5.5.4. The symptom was that you could not get any page to return anything -- just blank screens. There were directories in our vb5 folder that had timestamps from 4:57am last night, so we didn't trust ANYTHING in our vb5 directory.

So ....

- We backed up our database.
- Then went through the steps of reinstalling from scratch, until we got to this step:

https://[yourdomain]/core/install/install.php

and instead ran this:

https://[your domain]/core/install/upgrade.php

- Then we commented out the code block per this post: https://forum.vbulletin.com/forum/vb...17#post4422617
- Upon doing so we are back up and running and the only outstanding issue at this point is a few mods that we installed will probably need to be reinstalled -- other than that things are running again.
- Oh we had to replace the favicon.ico

The side benefit to doing this is, we know we have a very clean install now, that isn't a bunch of historical patches. I think it was faster than getting a vendor to restore a backup -- but this will obviously only work if your database wasn't affected.

[Wayne Luke]

Just so it is known, with the recent zero day security issue, my site was compromised and the contents of the AdminCP folder was deleted as I was also getting the blank page issue.

/admincp is supposed to be empty. It is not supposed to have any files in it. It doesn't even need to exist but customers want it to be there for some reason.

/core/admincp has all the AdminCP files.

[UKCobra]

Given all the stories of how people have been affected differently, I imagine there are different groups of people trying this exploit. Some looking for financial payback, some are just looking for creating havoc. Our DB does not appear to be impacted, nor did I get any blank pages.
What we had were redirects to survey pages and prize winning websites, most likely designed to harvest some sort of personal data.
Initially they were spotted because one or two images were missing and CSS was a little screwy.

[jkotlowski]

FWIW:

We were on 5.5.4. The symptom was that you could not get any page to return anything -- just blank screens. There were directories in our vb5 folder that had timestamps from 4:57am last night, so we didn't trust ANYTHING in our vb5 directory.

So ....

- We backed up our database.
- Then went through the steps of reinstalling from scratch, until we got to this step:

https://[yourdomain]/core/install/install.php

and instead ran this:

https://[your domain]/core/install/upgrade.php

- Then we commented out the code block per this post: https://forum.vbulletin.com/forum/vb...17#post4422617
- Upon doing so we are back up and running and the only outstanding issue at this point is a few mods that we installed will probably need to be reinstalled -- other than that things are running again.
- Oh we had to replace the favicon.ico

The side benefit to doing this is, we know we have a very clean install now, that isn't a bunch of historical patches. I think it was faster than getting a vendor to restore a backup -- but this will obviously only work if your database wasn't affected.

I didn't do a clean install, but I really need to. There are so, so many files on my server from 2-3 years ago that probably don't need to be there. But I've been a bit afraid to do a clean install because I'm not entirely sure what things I need to keep as to not lose avatars, settings, images, custom smilies, and all the other stuff I've added. lol

[alfreema]

It honestly wasn't that bad. I do need to reload our smilies (thanks for mentioning those, I forgot about them). But our logo and images were all in a single folder that I brought over. The custom themes are all in the database so I didn't have to do anything there. Actually all the avatars are still loading -- are those in the database?! The only things I think I had to redo are the favicon.ico file, copy the one folder of images, and I will need to redo the smilies.