Serious Problem - FORUM HACKED

[Airwaves]

My 2.2.1 version forum was hacked, you can see it at http://www.airwavescomms.co.uk/forums

the members have been deleted except 7, for which i cannot view in any way.

I have lost all admin abilities

Would it be possible, if so, HOW, to use the getadmin script included with vb221 ?

Please help!!!

[Dotagious]

Oh man.... that's nasty.

[The Prohacker]

1. Upload the getadmin script to your admin dir.
2. Run it from the net and get yourself admin.
3. Htaccess the forum so the intruders can't come back.
4. If you used the same password else where, change them all.
5. Inform your other admin's to change their passwords.
6. Upload fresh PHP files.
7. Change all ftp, and shell passwords..
8. Inform your host of the intrusion....
9. Restore a forum backup...
10. Change your passwords after the restore.

I'm pretty sure someone got in because someone either used a password some where else, or had an easily guess password...


In the future, besure htaccess the admin dir, so even if an account's password gets compromised, the intruder doesn't have access to the admin cp.....

[Airwaves]

1. Upload the getadmin script to your admin dir.
2. Run it from the net and get yourself admin.

Done that, ran it, the admin account doesnt exist (user 1)

3. Htaccess the forum so the intruders can't come back.

Will this affect the general running of the forums?


4. If you used the same password else where, change them all.

MY password is unique for the forums, i think the second admin (user 2), his account was used

5. Inform your other admin's to change their passwords.

cant do that, all registered users, admins and moderators were deleted, first user is user 103 i think

6. Upload fresh PHP files.

will do

7. Change all ftp, and shell passwords..

have done, i dont have a shell account i dont think

8. Inform your host of the intrusion....

have done

9. Restore a forum backup...

dont have one recent enough to be of use, my hdd corrupt and lost it, i had to wait a week for a new drive, and this is my 2nd day back online and this happens!

10. Change your passwords after the restore.

will do.


The MySQL database, most of the tables have been emptied, the getadmin doesnt work, even by creating a new user, it says table 'access' already exists.

This error

Database error in vBulletin Installer :

Invalid SQL: CREATE TABLE access (
userid int(10) unsigned DEFAULT '0' NOT NULL,
forumid smallint(5) unsigned DEFAULT '0' NOT NULL,
accessmask smallint(5) unsigned DEFAULT '0' NOT NULL
)
mysql error: Table 'access' already exists

mysql error number: 1050

Date: Saturday 29th of December 2001 09:56:35 PM
Script: /forums/admin/install.php?step=4
Referer:

I think i should just start over from scratch as this is the second time its happend, but the first time it wasnt so bad, they just defaced it.

Is it possible to create an admin account by parsing a SQL statement? If so, I could probably create some sort of back-up from within the admin control panel will i not?

[The Prohacker]

Originally posted by Airwaves
I think i should just start over from scratch as this is the second time its happend, but the first time it wasnt so bad, they just defaced it.

Yeah, sounds like, if your db backup is old, might as well start anew, when doing that, be sure to .htaccess the admin and mod dirs like I said above to prevent further attacks, and choose long hard to get, passwords that would not be in the dictionary.....



Before reinstalling, check the admin logs via phpMyAdmin, and see if you can get the person's IP, if you can, do an arin lookup on it, and notify their host....

[Airwaves]

I already started the new one...

I have htaccess the admin dir, will do the mod dir aswell.

Here is the adminlog table, I do not understand the time format used, but the IP starting 195 is myself, the other isnt. It looks like USERID 2 was the account to be breached, this is my co-admin.

adminlogid userid dateline script action extrainfo ipaddress
1 1 1004116517 index.php 195.92.168.165 Edit Delete
2 1 1004116538 options.php options 195.92.168.165 Edit Delete
3 1 1004116574 options.php dooptions 195.92.168.165 Edit Delete
4 1 1004116592 user.php add 195.92.168.165 Edit Delete
5 1 1004116632 user.php insert 195.92.168.165 Edit Delete
6 1 1004116637 user.php find 195.92.168.165 Edit Delete
7 1 1004116640 user.php emailpassword 195.92.168.165 Edit Delete
8 1 1004116748 forum.php modify 195.92.168.165 Edit Delete
9 1 1004116762 forum.php edit forum id = 1 195.92.168.165 Edit Delete
10 1 1004116788 forum.php doupdate forum id = 1 195.92.168.165 Edit Delete
11 1 1004116842 index.php 195.92.168.165 Edit Delete
12 1 1004118668 index.php 217.35.250.18 Edit Delete
13 2 1004118707 index.php 217.35.250.18 Edit Delete
14 2 1004118725 forum.php modify 217.35.250.18 Edit Delete
15 2 1004118752 forum.php edit forum id = 1 217.35.250.18 Edit Delete
16 2 1004118810 user.php modify 217.35.250.18 Edit Delete
17 2 1004118825 user.php find 217.35.250.18 Edit Delete
18 2 1004118836 user.php edit user id = 2 217.35.250.18 Edit Delete
19 2 1004118902 user.php doips 217.35.250.18 Edit Delete
20 2 1004118977 user.php doupdate user id = 2 217.35.250.18 Edit Delete
Next page >

I will try and trace the IP somehow and inform the ISP somehow.

Whats an 'ARIN' lookup?

I have started the forums agian, but have this information saved.

[The Prohacker]

Arin, is the people who alot IPs. The IP above, 217.35.250.18, appears to be from europe:

inetnum: 217.35.212.0 - 217.35.255.255
netname: BT-Webport
descr: BT-Webport Sheffield
country: GB
admin-c: BS1474-RIPE
tech-c: BS1474-RIPE
status: ASSIGNED PA
remarks: Please send abuse notification to [email protected]
mnt-by: BTNET-MNT
changed: [email protected] 20010629
source: RIPE

route: 217.32.0.0/12
descr: BT Public Internet Service
origin: AS2856
remarks: Please send abuse notification to [email protected]
remarks: PLEASE DIRECT ALL QUERIES TO [email protected]
mnt-by: BTNET-MNT
changed: [email protected] 20000921
source: RIPE

role: BTnet Support
address: 154 St Albans Rd
address: Sandridge
address: St Albans
address: Hertfordshire
address: AL4 9NH
address: GB
phone: +44 1189 512313
e-mail: [email protected]
trouble: [email protected]
admin-c: FLS15-RIPE
tech-c: BS1474-RIPE
nic-hdl: BS1474-RIPE
remarks: Please send abuse notification to [email protected]
remarks: For all queries contact [email protected]
mnt-by: BTNET-MNT
changed: [email protected] 20010613
changed: [email protected] 20011112
source: RIPE

Since their ISP is BT Net, don't expect them to do anything.... But sometimes worth a try, get your host to get you http logs, and get the logs from the adminlog table, and send them to [email protected] and see if you get a response...

[Kaizen]

BT !

I've had that IP before !

I dont believe it !

BTW, the chances of you getting a reply from BT are minimal !

[The Prohacker]

Originally posted by Kaizen
BTW, the chances of you getting a reply from BT are minimal !

I'm thinking more towards nill........

[Kaizen]

Originally posted by The Prohacker



I'm thinking more towards nill........

How do u know how bad they are (is it all my moaning )

[The Prohacker]

Originally posted by Kaizen


How do u know how bad they are (is it all my moaning )

Nah, not you... Have had friends with connection problems, problems with problem users who were using BT, etc....

[Black Tiger]

Hmmz... spoke to a friend of mine with a lot of php knowledge.
He hacked out a lot of stuff. Accourding to him, when activating img tags there are security breaches.
In the PM option there is also a way of getting admin access when knowing enough about php.

I asked him if he could tell me how, but he did not have it documented yet. Pity due to his work (he must travel a lot the coming years) he probably won't have time to do it, but he told me that if he had time he would document it.

If I get it I can give it to the developers, so it can be fixed.
But vbb is not 100% secure, that's for sure, but then again, which boardsoft is?

[tubedogg]

The img tag exploit was fixed several versions ago and there are no known security bugs with the PM system (this has been checked by a couple outside security experts).

[Black Tiger]

Well. I'll have to wait until my friend has some time, he still found some things.
One should have some real php knowledge to exploit them he said, but they were present.
Indeed the img tag was fixed.
Hopefully I'll get him so far he will document it for me, If he does, I surely will send you a copy.

[JTMON]

Originally posted by tubedogg
The img tag exploit was fixed several versions ago and there are no known security bugs with the PM system (this has been checked by a couple outside security experts).

Good to hear about the IMG tag exploit being fixed but saying outside people check it isn't quite enough I don't believe. If you were to look at some other security threads here you will see that the outside security people missed some basic issues. If I could remember exactly what it was I would type it here but I can't. I do remember that I posted in that thread regarding the use of security experts and them missing something.