[Forum] Hacked but how?

[THe Slug]

Yesterday my site was hacked, luckily for us our hosting company spotted the file and blocked it, but how did they gain access to my site?
We had just changed password to another complex one. the admin account is not called admin. my ftp account is different to all the login account and so is the one for the hosting company.

So how did they drop a id.php file on my root, create a new admin account and a new forum folder inside my files?

Does 4.2.1 still have loop holes?
Is my hosting company to blame?

Or have I simply done something wrong with the security of my site?

Would really like some answers as more and more vbulletin sites are being hacked daily..

Thanks.

[Amaury]

Remove your install directory. There's currently a known exploit.

[Zachery]

Please read the following two blog posts:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked

http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site

[THe Slug]

My install directory had been removed.

Today at 04:03 I was hit again but this time with a re direct page, I have managed to get my home page back but when clicking on the forum I again get sent to this redirect page have a look if you like...www.stratosec.com/Forum

Can someone tell me what the the site meant to do when you go to the above link so I can find where this re-direct is hiding as I have not the knowledge to find it at the moment.

Thank you.

[THe Slug]

I have just found 2 plugins.....1.called Indonesian Hacker the other called 2. vbulletin both are in the hook init_startup
Clearly No1 should not be there but should the 2nd one?

[cowudders14]

I was also recently hacked using version 4.2.0, I've upgraded and checked my site throughout.

Some handy hints from what I found:
I had three new admin users created. How, I don't know, but they were there, with full access to everything. Check your control panel logs: ACP -> Statistics and logs -> Control panel log and see if you have any usernames you don't recognise. There should only be legit admins in here. root is not a legit admin.


I also found that my permissions had been changed and some templates had been modified.
This is a useful post: http://www.vbulletin.com/forum/blogs...ve-been-hacked

HTH

[Wayne Luke]

As stated above, delete your install directory.

[markp_2000]

They have install plugins that run a eval(gzinflate(base64_decode('bbblah'))); hack. It appears they use two plugins to execute the hack and both will common names. The two plugins were name 'vBulletin' and the other was 'use memcached instead of db for datastore items'. When I ran a decode on the eval scipt it basically created an myphpadmin shell that allowed full access to the backend database.