XF 2.1 Exploit?

spicer

spicer

Active member
For a week I have received the following:

Server-Fehlerprotokoll
Code: 
    ErrorException: [E_WARNING] Cannot modify header information - headers already sent by (output started at php://input:1) src/XF/Http/Response.php:386

    Generiert von: Unbekanntes Konto 16 November 2020 um 13:46

Stack-Trace

#0 [internal function]: XF::handlePhpError(2, '[E_WARNING] Can...', '/var/www/vhosts...', 386, Array)
#1 src/XF/Http/Response.php(386): header('X-Frame-Options...', false)
#2 src/XF/Http/Response.php(283): XF\Http\Response->sendHeaders()
#3 src/XF.php(441): XF\Http\Response->send(Object(XF\Http\Request))
#4 index.php(20): XF::runApp('XF\\Pub\\App')
#5 {main}

Status der Anfrage
Code: 
array(4) {
  ["url"] => string(49) "/threads/arcade-bartop-im-selbstbau.457/add-reply"
  ["referrer"] => string(77) "https://www.mydomain.ch/threads/arcade-bartop-im-selbstbau.457/#post-1349"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(9) {
    ["message_html"] => string(6800) "wwwert12qa21qccv xxx02xx-df4-2w-33we-1


Cheap Online Pharmacy  Liothyrone in UK/GB  online visa no rx ;
Online Pharmacy  Liothyrone  in AUSTRALIA no prior prescription  ;
[b]Price Of  Liothyrone in USA  with no rx [/b] ;

[url=http://totalworldstore.com/shop/go.php?sid=9] [u][b]>>> Want to buy cheapest quality Liothyrone? CLICK HERE! <<<[/b][/u] [/url]

Discount Price  Liothyrone in UK/GB  without rx  ;
How To Buy  Liothyrone in USA  fast shipping no prescription



ENTER HERE! SAVE MONEY WITH US! >>>> https://bit.ly/your1pharm



Ordering  Liothyrone c.o.d. no rx  | Liothyrone  pay cod no prescription

[quote]
[b]UNITED STATES,CANADA,UK

ALL COUNTRIES! ALL DESTINATIONS! [/b]

Liothyrone in EUROPE
Liothyrone in ITALY
Liothyrone in FRANCE
Liothyrone in SPAIN
[b]Liothyrone in GERMANY
Liothyrone in AUSTRALIA[/b]
Liothyrone in IRELAND
Liothyrone in NEW ZEALAND
Liothyrone in Singapore, Philippines, Malaysia
Liothyrone in SOUTH AFRICA
[/quote]




[i][b]Ordering  Liothyrone c.o.d. no rx  | Liothyrone  pay cod no prescription [/b][/i]











RELATED TAGS:

ordering online  Liothyrone in UK/GB
where to buy  Liothyrone with no perscription USA
need  Liothyrone prescriptions online

[b]Ordering  Liothyrone c.o.d. no rx  | Liothyrone  pay cod no prescription [/b]

legal buy  Liothyrone without perscription or membership
Liothyrone without a rx overnight delivery
where to purchase  Liothyrone cheap cod no rx
Liothyrone saturday USA
want  Liothyrone online overnight delivery USA
Liothyrone without dr prescription
where to get  Liothyrone saturday delivery USA
Liothyrone overnight no prescription
cheap price for  generic  Liothyrone same day delivery
Liothyrone from u.s. pharmacy
purchase online  Liothyrone without doctor prescription
Liothyrone overnight cheap
safe order for generic  Liothyrone online in
Liothyrone express delivery USA
cheapest place to order  Liothyrone prescriptions online
Liothyrone ups cod
do you know how i can buy  Liothyrone no script next day delivery
Liothyrone overnight cod no prescription
wholesale  Liothyrone without credit card or check
Liothyrone quick delivery no prescription USA in Nebraska ;buy  Liothyrone overnight without prescription USA ;discount  Liothyrone in UK/GB ;where can i buy  Liothyrone in USA
wholesale  Liothyrone without doctor prescription ;legit place to buying  Liothyrone saturday delivery
cheapest  Liothyrone from canadian pharmacy no prescription
discount price  Liothyronein Hialeah
Liothyrone and no prescription
lowest prices for  Liothyronein Fort Wayne
orders  Liothyrone with no perscription
licensed pharmacy  Liothyrone online overnight delivery
pharmacy  Liothyrone in AUSTRALIA ;discount  Liothyrone cash on delivery USA ;discount price  Liothyronein Sydney ;discount price  Liothyrone no prescription next day delivery USA
order safety  Liothyrone next day delivery ;safe order for generic  Liothyrone express delivery USA ;Liothyrone overnight delivery
where to buy  Liothyrone in CANADA ;where can i buy generic  Liothyronein Bakersfield ;find generic  Liothyrone in USA ;where to buy legitimate  Liothyrone cash on delivery USA ;do you know how i can buy  Liothyrone in AUSTRALIA
cheap and easy  Liothyrone in AUSTRALIA
discount  Liothyrone in UK/GB //discount price for  Liothyrone in UK/GB ;;buy generic  Liothyrone in UK/GB ;safe order  Liothyrone in USA ;purchase  Liothyrone in USA
purchase at best price  Liothyrone in UK/GB ;best price for  Liothyrone in USA ;where can i buy  generic  Liothyrone in USA ;legitimate pharmacy  Liothyrone in UK/GB ;cheapest generic  Liothyrone in CANADA ;
low prices for generic  Liothyrone in UK/GB
how to buy  Liothyrone in CANADA
purchase online  Liothyrone in USA


http://www.ridingboard.com/board/viewtopic.php?f=11&t=7125 http://www.doripesco.ro/forum/viewtopic.php?f=15&t=83&p=263892#p263892 http://conexiuni.autismromania.ro/forums/topic/buy-online-cheapest-imidil-in-australia-shipped-by-cash-on-delivery-imidil-next-day-delivery-no-rx/ http://www.doripesco.ro/forum/viewtopic.php?f=15&t=83&p=265120#p265120 http://www.ambervibe.com/forum/viewtopic.php?f=37&t=368742 http://www.doripesco.ro/forum/viewtopic.php?f=15&t=115&p=263897#p263897 http://littlebikers-nl.messageboard.nl/forum/posting.php?mode=reply&f=2&t=143929&sid=db1b5aa289efc306edf51dbb132e40d5 http://www.hydromep.com/forum/welcome-mat/148111-cheap-price-of-algofren-in-australia-no-prescription-no-fees-algofren-non-prescription-needed http://littlebikers-nl.messageboard.nl/forum/posting.php?mode=reply&f=2&t=143929 https://myway.pt/shawn-mendes-cria-fundacao-para-ajudar-jovens/62336?unapproved=1183899&moderation-hash=e925c74446a2b43b2b297b69219efa09#comment-1183899 http://fpemg.com.br/forum/viewtopic.php?f=15&t=145154 http://www.nsu-club.com/forum/viewtopic.php?f=6&t=1552908 http://www.vmalumni.com/forums/topic/where-can-i-buy-tetorinen-saturday-delivery-tetorinen-overnight-without-prescription/ https://pixarplanet.com/forums/viewtopic.php?f=10&t=230638 http://xn--90ahc1ac7aeq.xn--p1ai/communication/forum/forum2/14203-rabestrom-prezzo http://www.zeiss-services.com/index.php/forum/welcome-mat/402536-where-to-buy-inderal-la-from-india-inderal-la-overnight-no-prescription?start=168#1117301 http://www.vmalumni.com/forums/topic/buying-cordafen-in-internetnext-day-delivery-cordafen-no-rx-required/ http://highhopeshuntclub.com/viewtopic.php?f=1&t=1108841 http://www.zeiss-services.com/index.php/forum/welcome-mat/451397-purchase-cheap-online-monoket-kansas-overnight-no-prescription http://forum.secondnaturesuccess.com/showthread.php?tid=338830 http://www.ridingboard.com/board/viewtopic.php?f=11&t=7066 http://www.dev.hydes.in/analytix1/kunena-2013-02-09/analytix-users-category/3481568-what-is-the-generic-of-cyclostad-in-uk-gb-c-o-d-no-prescription-cyclostad-no-prescription-next-day-delivery#3482658 http://www.thaisylphyclub.com/index.php?topic=20188.msg974009#msg974009 http://www.zeiss-services.com/index.php/forum/welcome-mat/402740-pharmacies-that-sell-garcinia-cambogia-in-uk-gb-garcinia-cambogia-online-visa-no-rx?start=246#1117597 http://www.sinopcity.com/forum/showthread.php?tid=13621 http://www.zeiss-services.com/index.php/forum/welcome-mat/402538-cheapest-price-to-order-inderal-la-in-uk-gb-inderal-la-non-prescription-needed#788687 http://www.vmalumni.com/forums/topic/buy-online-cheapest-ranimed-in-canada-online-no-prescription-ranimed-no-prescription-overnight/ http://forum.freekalmykia.org/index.php?/topic/1279-order-at-low-price-red-viagra-in-philippines-online-pharmacy-overnight-shipping/&page=3#comment-14133 "
    ["message"] => string(6800) "wwwert12qa21qccv xxx02xx-df4-2w-33we-1


Cheap Online Pharmacy  Liothyrone in UK/GB  online visa no rx ;
Online Pharmacy  Liothyrone  in AUSTRALIA no prior prescription  ;
[b]Price Of  Liothyrone in USA  with no rx [/b] ;

[url=http://totalworldstore.com/shop/go.php?sid=9] [u][b]>>> Want to buy cheapest quality Liothyrone? CLICK HERE! <<<[/b][/u] [/url]

Discount Price  Liothyrone in UK/GB  without rx  ;
How To Buy  Liothyrone in USA  fast shipping no prescription



ENTER HERE! SAVE MONEY WITH US! >>>> https://bit.ly/your1pharm



Ordering  Liothyrone c.o.d. no rx  | Liothyrone  pay cod no prescription

[quote]
[b]UNITED STATES,CANADA,UK

ALL COUNTRIES! ALL DESTINATIONS! [/b]

Liothyrone in EUROPE
Liothyrone in ITALY
Liothyrone in FRANCE
Liothyrone in SPAIN
[b]Liothyrone in GERMANY
Liothyrone in AUSTRALIA[/b]
Liothyrone in IRELAND
Liothyrone in NEW ZEALAND
Liothyrone in Singapore, Philippines, Malaysia
Liothyrone in SOUTH AFRICA
[/quote]




[i][b]Ordering  Liothyrone c.o.d. no rx  | Liothyrone  pay cod no prescription [/b][/i]











RELATED TAGS:

ordering online  Liothyrone in UK/GB
where to buy  Liothyrone with no perscription USA
need  Liothyrone prescriptions online

[b]Ordering  Liothyrone c.o.d. no rx  | Liothyrone  pay cod no prescription [/b]

legal buy  Liothyrone without perscription or membership
Liothyrone without a rx overnight delivery
where to purchase  Liothyrone cheap cod no rx
Liothyrone saturday USA
want  Liothyrone online overnight delivery USA
Liothyrone without dr prescription
where to get  Liothyrone saturday delivery USA
Liothyrone overnight no prescription
cheap price for  generic  Liothyrone same day delivery
Liothyrone from u.s. pharmacy
purchase online  Liothyrone without doctor prescription
Liothyrone overnight cheap
safe order for generic  Liothyrone online in
Liothyrone express delivery USA
cheapest place to order  Liothyrone prescriptions online
Liothyrone ups cod
do you know how i can buy  Liothyrone no script next day delivery
Liothyrone overnight cod no prescription
wholesale  Liothyrone without credit card or check
Liothyrone quick delivery no prescription USA in Nebraska ;buy  Liothyrone overnight without prescription USA ;discount  Liothyrone in UK/GB ;where can i buy  Liothyrone in USA
wholesale  Liothyrone without doctor prescription ;legit place to buying  Liothyrone saturday delivery
cheapest  Liothyrone from canadian pharmacy no prescription
discount price  Liothyronein Hialeah
Liothyrone and no prescription
lowest prices for  Liothyronein Fort Wayne
orders  Liothyrone with no perscription
licensed pharmacy  Liothyrone online overnight delivery
pharmacy  Liothyrone in AUSTRALIA ;discount  Liothyrone cash on delivery USA ;discount price  Liothyronein Sydney ;discount price  Liothyrone no prescription next day delivery USA
order safety  Liothyrone next day delivery ;safe order for generic  Liothyrone express delivery USA ;Liothyrone overnight delivery
where to buy  Liothyrone in CANADA ;where can i buy generic  Liothyronein Bakersfield ;find generic  Liothyrone in USA ;where to buy legitimate  Liothyrone cash on delivery USA ;do you know how i can buy  Liothyrone in AUSTRALIA
cheap and easy  Liothyrone in AUSTRALIA
discount  Liothyrone in UK/GB //discount price for  Liothyrone in UK/GB ;;buy generic  Liothyrone in UK/GB ;safe order  Liothyrone in USA ;purchase  Liothyrone in USA
purchase at best price  Liothyrone in UK/GB ;best price for  Liothyrone in USA ;where can i buy  generic  Liothyrone in USA ;legitimate pharmacy  Liothyrone in UK/GB ;cheapest generic  Liothyrone in CANADA ;
low prices for generic  Liothyrone in UK/GB
how to buy  Liothyrone in CANADA
purchase online  Liothyrone in USA


http://www.ridingboard.com/board/viewtopic.php?f=11&t=7125 http://www.doripesco.ro/forum/viewtopic.php?f=15&t=83&p=263892#p263892 http://conexiuni.autismromania.ro/forums/topic/buy-online-cheapest-imidil-in-australia-shipped-by-cash-on-delivery-imidil-next-day-delivery-no-rx/ http://www.doripesco.ro/forum/viewtopic.php?f=15&t=83&p=265120#p265120 http://www.ambervibe.com/forum/viewtopic.php?f=37&t=368742 http://www.doripesco.ro/forum/viewtopic.php?f=15&t=115&p=263897#p263897 http://littlebikers-nl.messageboard.nl/forum/posting.php?mode=reply&f=2&t=143929&sid=db1b5aa289efc306edf51dbb132e40d5 http://www.hydromep.com/forum/welcome-mat/148111-cheap-price-of-algofren-in-australia-no-prescription-no-fees-algofren-non-prescription-needed http://littlebikers-nl.messageboard.nl/forum/posting.php?mode=reply&f=2&t=143929 https://myway.pt/shawn-mendes-cria-fundacao-para-ajudar-jovens/62336?unapproved=1183899&moderation-hash=e925c74446a2b43b2b297b69219efa09#comment-1183899 http://fpemg.com.br/forum/viewtopic.php?f=15&t=145154 http://www.nsu-club.com/forum/viewtopic.php?f=6&t=1552908 http://www.vmalumni.com/forums/topic/where-can-i-buy-tetorinen-saturday-delivery-tetorinen-overnight-without-prescription/ https://pixarplanet.com/forums/viewtopic.php?f=10&t=230638 http://xn--90ahc1ac7aeq.xn--p1ai/communication/forum/forum2/14203-rabestrom-prezzo http://www.zeiss-services.com/index.php/forum/welcome-mat/402536-where-to-buy-inderal-la-from-india-inderal-la-overnight-no-prescription?start=168#1117301 http://www.vmalumni.com/forums/topic/buying-cordafen-in-internetnext-day-delivery-cordafen-no-rx-required/ http://highhopeshuntclub.com/viewtopic.php?f=1&t=1108841 http://www.zeiss-services.com/index.php/forum/welcome-mat/451397-purchase-cheap-online-monoket-kansas-overnight-no-prescription http://forum.secondnaturesuccess.com/showthread.php?tid=338830 http://www.ridingboard.com/board/viewtopic.php?f=11&t=7066 http://www.dev.hydes.in/analytix1/kunena-2013-02-09/analytix-users-category/3481568-what-is-the-generic-of-cyclostad-in-uk-gb-c-o-d-no-prescription-cyclostad-no-prescription-next-day-delivery#3482658 http://www.thaisylphyclub.com/index.php?topic=20188.msg974009#msg974009 http://www.zeiss-services.com/index.php/forum/welcome-mat/402740-pharmacies-that-sell-garcinia-cambogia-in-uk-gb-garcinia-cambogia-online-visa-no-rx?start=246#1117597 http://www.sinopcity.com/forum/showthread.php?tid=13621 http://www.zeiss-services.com/index.php/forum/welcome-mat/402538-cheapest-price-to-order-inderal-la-in-uk-gb-inderal-la-non-prescription-needed#788687 http://www.vmalumni.com/forums/topic/buy-online-cheapest-ranimed-in-canada-online-no-prescription-ranimed-no-prescription-overnight/ http://forum.freekalmykia.org/index.php?/topic/1279-order-at-low-price-red-viagra-in-philippines-online-pharmacy-overnight-shipping/&page=3#comment-14133 "
    ["_xfUsername"] => string(7) "tolikkk"
    ["no_captcha"] => string(1) "1"
    ["submit"] => string(0) ""
    ["last_date"] => string(10) "1604787961"
    ["last_known_date"] => string(10) "1604787961"
    ["klPage"] => string(0) ""
    ["_xfToken"] => string(8) "********"
  }
}

Löschen

With every new message, other links appear here which have nothing to do with my forum!
A colleague has the same in his XF2.1 forum.
 
Sort by date Sort by votes
You should shut down your server and start it in the rescue system.

Then try to understand how your server was compromised and remove the cause.

You probably have folders and / or files with 777 permissions, that needs to be changed to 755.
(For example, if you want to upload PHP extensions (= WRITE) and then start them (= EXECUTE), you need: chmod 777)

You should reset your server to a backup status that was definitely before the incident and then correct your folder and file permissions immediately.
 
Upvote 0 Downvote
Until the exact causes are known, I've written a provisional script, which is executed as root via cronjob
Code: 
@reboot /root/malwarekill.sh
You can of course let this run every 60s.

/root/malwarekill.sh rights 700

Code: 
#!/bin/sh

kill $(pidof kdevtmpfsi)
kill $(pidof kinsing)
rm /tmp/kdevtmpfsi
rm /tmp/kinsing
rm /var/tmp/kdevtmpfsi
rm /var/tmp/kinsing
echo "everything is good here" > /tmp/kdevtmpfsi
echo "everything is good here" > /tmp/kinsing
echo "everything is good here" > /var/tmp/kdevtmpfsi
echo "everything is good here" > /var/tmp/kinsing
chmod 644 /tmp/kdevtmpfsi
chmod 644 /tmp/kinsing
chmod 644 /var/tmp/kdevtmpfsi
chmod 644 /var/tmp/kinsing

In /var/spool/cron/crontabs I create a file named ftp owner root:root 644

For me, the malware no longer runs if the script runs once at boot.
Otherwise the malware sometimes came back 10 hours later.


PS:
Today I have reinstall the server.
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

B
  • Question Question
XF 2.2 Auto subscription failing - Information: Invalid custom field. Unrelated payment, no action to take.
Replies
3
Views
1K
Mike
Mike
Amin Sabet
Add-on Which Forms addon is right for me?
Replies
4
Views
876
Amin Sabet
Amin Sabet
flowerpot132
  • Question Question
A few questions before we make the move
Replies
9
Views
2K
TPerry
TPerry
Top Bottom