slinky Posted December 7, 2011 Share Posted December 7, 2011 FYI Someone at this IP address - 46.248.197.234 - tried to hack my WHMCS install with this. Sent several messages. Hopefully not successful. I've banned them. 0 Quote Link to comment Share on other sites More sharing options...
scurrell Posted December 7, 2011 Share Posted December 7, 2011 Pointless blocking the IP, as it will happen again from a completely different location. So far we've had attempts from Korea, Saudi and China. 0 Quote Link to comment Share on other sites More sharing options...
WHMCS CEO Matt Posted December 7, 2011 WHMCS CEO Share Posted December 7, 2011 Please don't post the actual code. You're just putting more users at risk. The patch we released last week was designed to protect this so providing you have applied that there is no need for any concern: http://forum.whmcs.com/showthread.php?t=43462 Matt 0 Quote Link to comment Share on other sites More sharing options...
crshep Posted December 13, 2011 Share Posted December 13, 2011 I was just hacked by 46.185.139.65 and sent the code to WHMCS. They change my Paypal email to theirs. The code was put in a sales ticket and then they were in. Don't know how since I do not no code but they got in. Anyway just waiting to hear back from WHMCS. They did it twice so far........... Charles 0 Quote Link to comment Share on other sites More sharing options...
catding Posted December 14, 2011 Share Posted December 14, 2011 I received lots of code from Sandi and US and Malaysia these days in the support. nothing been changed, but it is too horrible.. 0 Quote Link to comment Share on other sites More sharing options...
jservices Posted December 14, 2011 Share Posted December 14, 2011 Hello, I followed the link Matt but it does not explain the nature of the hack. From decoding the message it looked like an SQL injection via the support system email. Is that right? 0 Quote Link to comment Share on other sites More sharing options...
WHMCS CEO Matt Posted December 14, 2011 WHMCS CEO Share Posted December 14, 2011 No I can confirm it has nothing to do with SQL Matt 0 Quote Link to comment Share on other sites More sharing options...
01jack Posted December 16, 2011 Share Posted December 16, 2011 We've had several attempts with the support tickets hack since 8 December, fortunately we were patched and so far they have not been able to get in. It looks like they are actually trying to reset the admin password and gain access to whmcs that way. 0 Quote Link to comment Share on other sites More sharing options...
milamber Posted December 16, 2011 Share Posted December 16, 2011 We've had several attempts with the support tickets hack since 8 December, fortunately we were patched and so far they have not been able to get in. It looks like they are actually trying to reset the admin password and gain access to whmcs that way. Yes. I decoded the code too. It just happened now again. They put support ticket with php base64 coded text. It contains few lines of code basically to connect to mysql using data from configuration.php and reset admin password. The attack was from : 84.235.73.218 (Saudi Arabia) 0 Quote Link to comment Share on other sites More sharing options...
altomarketing Posted December 16, 2011 Share Posted December 16, 2011 Yes. I decoded the code too How did you do that ? 0 Quote Link to comment Share on other sites More sharing options...
m8internet Posted December 16, 2011 Share Posted December 16, 2011 How did you do that ? Use a base 64 decoder 0 Quote Link to comment Share on other sites More sharing options...
slinky Posted December 29, 2011 Author Share Posted December 29, 2011 (edited) They left a lot of code behind. I upgraded my site and, despite doing so, can't login or reset the admin password. Using phpmyadmin I don't see the account they tried to upload. What I provided is not the code they used - it's just a small snippet. It appears they try to exploit the downloads and templates_c directories and trigger it with a support ticket. The larger problem is that I cannot login with any admin, even after removing the code. Resetting the passwords don't work either. Note - not that it means anything, but every hacking attempt came from countries in the middle east - Jordan, Saudi Arabia, Iran. Edited December 29, 2011 by slinky 0 Quote Link to comment Share on other sites More sharing options...
slinky Posted December 29, 2011 Author Share Posted December 29, 2011 Here is the name left behind in one of the index files: <p class="style1">hadi rahmani & hossien</p> 0 Quote Link to comment Share on other sites More sharing options...
m8internet Posted December 29, 2011 Share Posted December 29, 2011 can't login or reset the admin password Using phpmyadmin I don't see the account they tried to upload The larger problem is that I cannot login with any admin, even after removing the code. The script, when operated, deletes the superuser account That is also why you can no longer login You should be able to reset your own account back to superuser If not, then you need to create a new account (which you can later renumber back to number 1 if this is what it was originally) with superuser access Once you've done all this change the passwords Then replace all the files dated after the exploit date (from the support ticket) Then change the passwords again Sounds to me like you were running default names for folders, etc Try using other names for these folders 0 Quote Link to comment Share on other sites More sharing options...
slinky Posted December 30, 2011 Author Share Posted December 30, 2011 Thanks for all the info - actually the problem for me ended up being a cookie issue. After clearing the browser everything worked fine. The problem started after the attacks began. These jerks are uploading files into the templates_c directory and downloads. Not sure what can be done about this but it appears the attempts aren't working since the installation is still secure. But I'm getting now a few of these a day and it's getting ridiculous. I really hope a bounty can be put out some day on people like this and make it worthwhile to hunt them down... a nice dream. 0 Quote Link to comment Share on other sites More sharing options...
Jbro Posted December 30, 2011 Share Posted December 30, 2011 We reported an IP from Jordan to Intelligence service and cyber crime in Jordan 0 Quote Link to comment Share on other sites More sharing options...
slinky Posted January 14, 2012 Author Share Posted January 14, 2012 We reported an IP from Jordan to Intelligence service and cyber crime in Jordan I just found it funny that some of these guys actually left their identity in these files. They all want to get some credit for being hackers, I guess... and that leaves you... "appreciated." 0 Quote Link to comment Share on other sites More sharing options...
MordyT Posted January 15, 2012 Share Posted January 15, 2012 Hi, Just got a support ticket - see screenshot here: [LINK REMOVED] Is this the same thing as what you are discussing here? Do I need to be concerned? I am all up to date with the latest patches and versions... 0 Quote Link to comment Share on other sites More sharing options...
indonic Posted January 15, 2012 Share Posted January 15, 2012 Hi,Just got a support ticket - see screenshot here: [LINK REMOVED] Is this the same thing as what you are discussing here? Do I need to be concerned? I am all up to date with the latest patches and versions... yes, it's same with me...recently I got the ticket support with evalbase: Ticket ID: 442171 Subject: {php}eval(base64_decode <<snipped>> Whether is the issue/ hole with the submit ticket on WHMCS? 0 Quote Link to comment Share on other sites More sharing options...
mylove4life Posted January 15, 2012 Share Posted January 15, 2012 You do if you have done the update to WHMCS Hi,Just got a support ticket - see screenshot here: [LINK REMOVED] Is this the same thing as what you are discussing here? Do I need to be concerned? I am all up to date with the latest patches and versions... 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted January 15, 2012 Share Posted January 15, 2012 these are not just from Jordan, ive had them from Spain, Bulgaria, Jordan, UK etc. 1) block the IP in WHMCS 2) using a whois locate the DC of the IP and if you want report this to them i reported 3 to DimeNOC as this is where the IPs showed as from and got positive replies back that they would take action on the IP owners 0 Quote Link to comment Share on other sites More sharing options...
Sliffer21 Posted January 15, 2012 Share Posted January 15, 2012 For everyone that hasn't been paying attention to other post please read this. DO NOT POST THE CODE, IN TEXT OR A SCREENSHOT!!!! That just allows more people to have the code and more idiots to try and hack. 0 Quote Link to comment Share on other sites More sharing options...
MordyT Posted January 16, 2012 Share Posted January 16, 2012 (edited) So as long as you have that patch, you are fine i take it. I should be ok. @person above me - it is hard to know if it is the same thing if no one has the ability to see it. By doing a screenshot it makes it harder for anyone to copy, plus I would be deleting the screenshot from the server once I know one way or the other. Edited January 16, 2012 by MordyT 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.