Got hacked? here is how you cleanup.

[craigedmonds]

Here is a couple of thoughts from me...

 

1. Put a .htaccess file inside of admin folder preventing unauthorised ip's from accessing your admin section.

 

order deny,allow
allow from xxx.xxx.xxx.xxx
deny from all

 

If you dont have a fixed ip...get one.

 

2. Make sure your admin email can not be overwitten/updated.

 

The recent hacks also allowed the hacker to change the admin email, so all they did was to update the admin email and request new password. A good way to make sure that even if they do manage to update the admin email, is to put in a small sql statement inside the config file, which updates the admin email with your hardcoded email address, so even if they do manage to compromise the system a little and change the admin email, as soon as a page in whmcs is loaded, the admin email is overwritten again with your hard coded one.

 

3. Do not store root usernames and passwords for servers inside of WHMCS

 

If you are running dedicated servers, DO NOT under any circumstances store the root password/usernames for your servers. If you are using cpanel server, just create a reseller account in cpanel and store those reseller credentials inside WHMCS. Its very tempting for ease, to store your servers root details in cpanel, but the hacker can easily decrypt the password and access your server within seconds.

Edited December 28, 2011 by craigedmonds

[slinky]

I was upgraded to 4.5.2 - my server is "secured" with a firewall and they left most of their files on my site. All my attacks were from countries in the middle east - Saudi Arabia, Jordan, Iran. The index.html left in my downloads folder was:

 

<p class="style1">hadi rahmani & hossien</p>

 

Despite this I'm locked out of my admin account. Reset passwords sent to me do not function. I've had to send in a ticket to get this fixed.

[slinky]

The good news is that the hackers didn't nail me. Password reset and everything seems fine. I'm happy to provide the information to those that need it. I'd love to put out a bounty on these kids who are doing this...

[Ramy74]

Do I need to delete the folders?

"/home/username/whmcs/templates_c/"

"/home/username/whmcs/attachments/"

"/home/username/whmcs/downloads/"

 

Now i have all them in whmcsdata and this folder not in public and have permissions 777 by all.

 

Regards, Ramy

[Jbro]

If your config is pointing to new location and you have moved the folder then yes just go on delete them. Have a backup copy just in case

[Ramy74]

Thanks for all your help guys.

 

Regards, Ramy

[easyhosting]

you dont delete these, you just move to new location with the lines in the configuration.php pointing to the new location.

then make sure these are no longer in the whmcs

[bear]

Do I need to delete the folders?

"/home/username/whmcs/templates_c/"

"/home/username/whmcs/attachments/"

"/home/username/whmcs/downloads/"

 

Now i have all them in whmcsdata and this folder not in public and have permissions 777 by all.

Yes, remove those public versions. No need to keep them, and better not to have confusion later about which are which.

[Kenya Webhosting]

I also recieved the dodgy support tickets. I have checked various things and have banned the (Arabian) IP that I found responsible in the activity logs.

 

I have changed the cpanel pw and the whm password but cannot find

 

1. the link to Server setup under General Settings

2. The tick box to only allow client registration with an order

 

Please advise

[Kenya Webhosting]

I have been informed by suppot that the position of the server link is now under Products and Services and that changing my setup to disallow registrations without ordering would not help prevent unwanted support tickets.

[Vijay]

After you have done that, create a file called nothnaks.php and put it in your hooks directory with the following code:

.

.

issue gone.

 

For those who like to keep things simple and silent, here is extended version of FlexiHost code. This will close the attacker's account and force logout

*REMOVED*

Edited February 23, 2012 by WHMCS Andrew
Code Removed

[iPH - Sriram]

Hi webkami,

 

This post is very informative. I got hacked exactly the same way.

 

I was using 5.0.2 at that time.

 

I went through each step to cleanup and carried it out.. Now am using 5.0.3. It was download fresh from WHMCS.

It went on fine, however i have a problem now.

 

When i login to Admin panel and goto Clients and then click on DOMAINS to see all the domain names registered by that partiular client, i get a blank page.

 

/admin/clientsdomains.php?userid=XX

 

It was working earlier before i was hacked.

 

Any suggestions on resolving this issue.?

 

P.S : Only other thing i did while cleaning up was to change the path.

Earlier WHMCS was installed on : http://www.my-website.com/ccms

Now it is installed on : http://client.my-website.com

 

Any help would be appreciated.

 

Regards,

Sri

Edited January 11, 2012 by iPH - Sriram

[carltonsent]

I am a victim of a hack attempt as well that started with the hacker registering as a user then came the support ticket with php

 

I had the latest update 5.0.3 when this happened and have followed all the extra security info in setup so should I be worried? How can I decode the php like ATHEiST did?

 

Thanks,

Chad

[bear]

How can I decode the php

Here's one site: http://www.opinionatedgeek.com/dotnet/tools/base64decode/

[remcom]

If you received the ticket then you should be fine. The system wouldn't have displayed the ticket if you were still exploitable. (Not 100% confirmed, just going by what previous ticket hacks had in them when decoded.)

 

You can decode the ticket with any BASE64 decoder.

[carltonsent]

I am a victim of a hack attempt as well that started with the hacker registering as a user then came the support ticket with php

 

I had the latest update 5.0.3 when this happened and have followed all the extra security info in setup so should I be worried? How can I decode the php like ATHEiST did?

 

Thanks,

Chad

 

Well, I just found out my system has been sending emails:-(

 

I closed the account but not the ticket and this is what the php came out when decoded:

$c3o = base64_decode

[snipped]

$red = fopen("templates_c/red.php","w");

fwrite($red,$c3o);

 

and this is the email the system is sending:

Your email to our support system could not be accepted because it was not recognized as coming from an email address belonging to one of our customers. If you need assistance, please email from the address you registered with us that you use to login to our client area.

 

I assume my system is sending that email because I closed the account?

 

There are no other admin users in database and i'm now looking for all kinds of stuff that stands out

 

I'm already running 5.0.3 so should I re-install it? will that work?

 

Again, I have followed all the security steps, rename of admin, move template_c and stuff

 

Thanks for all your help

Chad

[carltonsent]

For those who like to keep things simple and silent, here is extended version of FlexiHost code. This will close the attacker's account and force logout

*REMOVED*

 

Do I just name this anything like nothanks.php?

 

Chad!;-)

Edited February 23, 2012 by WHMCS Andrew
Code Removed

[inyerface]

Very excellent!! Our entire network of servers was hacked and we couldn't figure out how that was done until we found shell files installed on WHMCS. It came right down to the root passwords being changed by hackers on our machines.

 

First thing is to remove the shell or hacked files. Then we installed the security patch:

http://forum.whmcs.com/showthread.php?p=206522

 

Then we looked at locking down WHMCS a bit more by restricting login to only certain IPs that way if the hacker got the information they need couldn't login anyway. We simply followed the steps in this document:

http://docs.whmcs.com/Further_Security_Steps

 

Then we locked down our servers and restricted shell access and root login to only our IPs.

 

Thanks for the post this helped us a lot. We used to operated under a reactive model (when something goes wrong fix it) and as a result of recent hacks have put a team in place to proactively monitor suspicious activity and it's interesting the things we're coming across. BUT, we have not been hacked again since.

[webKami]

Sorry had to fix your message befor it makes sense.

 

I would think it's better if someoone opened a ticket if something happened rather than telling the world how they got in. This way WHMCS can tell THEIR customer how to fix it.

 

I have explained it before, I am not describing how they got in. There is a lot to it, besides staying quiet about a vulnerability hurts more. As I shared what I did some nice people shared more tips and it all helps making a securer system.

 

 

Edit: just realised you might just be quoting the original message and with some smiley (invisible), my message stands for the original commenter.

Edited February 6, 2012 by webKami
mis-quoted

[paulvincent]

Actually I haven't really been hacked - or any of my accounts - but I can really say that it is much of a hassle.

 

Does anyone have any friends they can recommend to trace this hackers? And it would be better if they don't just accept money, but maybe gadgets as well, cause some of us have some extra gadge's but not money.

 

 

 

________________________

Philippines SEO Outsourcing

[CavalloComm]

I was just hit this morning with this - didn't do anything though. Also decoded it - totally different file than red.php - but never made it onto my server.

 

IP was: 96.44.148.246

 

Just in case ya'all wanna block it..

[rke211]

I was just hit this morning with this - didn't do anything though. Also decoded it - totally different file than red.php - but never made it onto my server.

 

IP was: 96.44.148.246

 

Just in case ya'all wanna block it..

 

doesnt matter what they call it lol

 

i had the problem a while ago of them getting on my admin folder so since then ive also added a directory password using cpanel seems to have done the trick

 

the bug is fixed as there was two attempts today to access my site one was a rather large sql querry to write out all the crucial details such as cpanel details, card details clients passwords etc.

 

another again just to upload a file but i tested them myself and it did nothing

[alinford]

I have looked at the thread, but could not find a definitive answer on this.

If we we create a new ticket with that php code, and it does not do anything, then we are safe from this exploit?

[xboss]

Here is a couple of thoughts from me...

The recent hacks also allowed the hacker to change the admin email, so all they did was to update the admin email and request new password. A good way to make sure that even if they do manage to update the admin email, is to put in a small sql statement inside the config file, which updates the admin email with your hardcoded email address, so even if they do manage to compromise the system a little and change the admin email, as soon as a page in whmcs is loaded, the admin email is overwritten again with your hard coded one.

 

I like the sql inside of config. Care to share the statement? I dont write sql or php very well

[sparky]

I like the sql inside of config. Care to share the statement? I dont write sql or php very well

That wont do you much good as they already have had access to your configuration file to get the DB details and encryption hash.

Whats to say they just remove that code or alter it to make it a little easier for them!