Get Paid to Participate - up to $1 per post!     Twitter     Facebook     Google+
Hosting Discussion
 

forgot password?



Reply


Old
  Post #1 (permalink)   01-06-2012, 01:47 PM
HD Newbie
 
Join Date: Nov 2011
Posts: 2

Status: JimmyGibbs is offline
Hello, I use WHMCS for billing and over the yesterday a hacker login to the admin account and change the password, I was able to change the password through phpMyAdmin but that doesn't seem to do anything, the hacker login again and same thing happened 6-7 times, I updated to the latest version of WHMCS and installed the latest security patch. Do you have any idea how the hacker is able to login to the admin account?
 
 


Old
  Post #2 (permalink)   01-06-2012, 01:50 PM
HD Wizard
 
Join Date: Mar 2005
Location: Atlanta, GA
Posts: 2,264

Status: handsonhosting is offline
It's entirely possible that there's a compromise of the hosting account itself and not just the billing area. If they have setup the system to alert an email address when the admin information is changed, that could be playing a role too.

It's best to shut down the site (so users information can't be exploited) and then contact WHMCS directly to have them perform a security audit on your site.
__________________
Emerson Nogueira
http://www.HandsOnWebHosting.com
cPanel Web Hosting, Domain Registration, Managed VPS Servers
 
 


Old
  Post #3 (permalink)   01-06-2012, 01:53 PM
HD Newbie
 
Join Date: Nov 2011
Posts: 2

Status: JimmyGibbs is offline
Quote:
Originally Posted by handsonhosting View Post
It's best to shut down the site (so users information can't be exploited) and then contact WHMCS directly to have them perform a security audit on your site.
That's not a problem, the website is still under construction so there is not any clients. I will try to find a solution with WHMCS support but if anyone had the same problem post it here please.
 
 
 


Old
  Post #4 (permalink)   01-06-2012, 02:09 PM
HD Addict
 
Join Date: Oct 2011
Posts: 177

Status: Bullten is offline
Whmcs is not vulnerable yet. There are thousands to tricks to hack something.

1) Kernel not updated --- rooting is possible
2) Improper or unsecured server ---- navigating to other user account on shared panel is possible
3) using whmcs third part plugins ----- Everything is possible...

If i was that hacker i would have planted a shell to maintain access to your host and do what ever i like to...

Perform a virus scan and malware to find out whats fishy on your host
 
 


Old
  Post #5 (permalink)   01-06-2012, 03:31 PM
HD Wizard
 
easyhostmedia's Avatar
 
Join Date: Mar 2011
Location: Northumberland, UK
Posts: 5,004
Send a message via MSN to easyhostmedia

Status: easyhostmedia is offline
Quote:
Originally Posted by JimmyGibbs View Post
Hello, I use WHMCS for billing and over the yesterday a hacker login to the admin account and change the password, I was able to change the password through phpMyAdmin but that doesn't seem to do anything, the hacker login again and same thing happened 6-7 times, I updated to the latest version of WHMCS and installed the latest security patch. Do you have any idea how the hacker is able to login to the admin account?
i suggest you follow these steps

http://docs.whmcs.com/Further_Security_Steps

Quote:
Move the attachments, downloads & templates_c folders

The three folders "attachments", "downloads" and "templates_c" need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all). When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to your configuration.php file:

$templates_compiledir = "/home/username/templates_c/";
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";

In the above example, "username" is the cpanel username and so the 3 folders are located in the home directory, above public_html.

Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec - the highest permissions are 755 for both folders and files.
Change your WHMCS Admin Folder name

Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area via the admin folder. To protect against this, you can rename the admin folder name to any name you like. You cannot move the folder - only rename it. You can then tell WHMCS what the name of that folder is for the links in admin notification emails by adding the following line to your configuration.php file:

$customadminpath = "myfoldername";

Replace "myfoldername" above with the new name you just gave to your admin folder.

Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well.

Example: php -q /home/mylogin/public_html/secure/myfoldername/cron.php
__________________
Terry Robertson - CEO The Easyhost Media Group
Niceday Hosting - Affordable Hosting
PowerSSL - - We Secure your World
The Scamlist Forum - Fighting against scammers
 
 
 


Old
  Post #6 (permalink)   01-06-2012, 11:26 PM
HD Master
 
Join Date: Nov 2011
Location: Singapore
Posts: 291

Status: JFSG is offline
There are lots of possibilities. Some of the common ones are:

1) Vulnerable PC. Is your PC infected?
2) Weak password.
3) Server's security compromised.
4) WHMCS Addons compromised.

etc.
__________________
LIMENEX WEB HOSTING
Affordable High Performance Web Hosting
Web Hosting | Reseller Hosting | Managed VPS & Dedicated Servers | SSL Certificates
 
 
 


Old
  Post #7 (permalink)   01-07-2012, 09:28 AM
HD Wizard
 
easyhostmedia's Avatar
 
Join Date: Mar 2011
Location: Northumberland, UK
Posts: 5,004
Send a message via MSN to easyhostmedia

Status: easyhostmedia is offline
Quote:
Originally Posted by JFSG View Post
There are lots of possibilities. Some of the common ones are:

1) Vulnerable PC. Is your PC infected?
2) Weak password.
3) Server's security compromised.
4) WHMCS Addons compromised.

etc.
true, but the OP stated the hacker got into his WHMCS admin area, so therefore the WHMCS security steps should be carried out
__________________
Terry Robertson - CEO The Easyhost Media Group
Niceday Hosting - Affordable Hosting
PowerSSL - - We Secure your World
The Scamlist Forum - Fighting against scammers
 
 
 


Old
  Post #8 (permalink)   01-07-2012, 10:15 AM
HD Newbie
 
Join Date: Oct 2010
Location: Maxville, FL
Posts: 21
Send a message via AIM to HWH Andrew Send a message via MSN to HWH Andrew Send a message via Yahoo to HWH Andrew Send a message via Skype™ to HWH Andrew

Status: HWH Andrew is offline
I would like to point out that an exploit had been moving around on HostBill (another billing software) which in the past had been used on WHMCS and still appears to be attacking small WHMCS installations. I do not know if WHMCS has had this patched or not, but the exploit had been used via support tickets by SMARTY due to the settings not set to secure. You may want to check that you haven't been hit by the exploit. The exploit allowed the attacker to execute and PHP code. In the one that had been attempted on my site (already patched before it happened) the exploit used eval with a base64 code. The base64 code decoded to a file write to a three letter file and put it into a list of known folders.
 
 


Old
  Post #9 (permalink)   01-07-2012, 10:32 AM
HD Wizard
 
easyhostmedia's Avatar
 
Join Date: Mar 2011
Location: Northumberland, UK
Posts: 5,004
Send a message via MSN to easyhostmedia

Status: easyhostmedia is offline
yes this explot is doing the whmcs rounds and WHMCS advice is to use the patch they have done along with http://docs.whmcs.com/Further_Security_Steps
__________________
Terry Robertson - CEO The Easyhost Media Group
Niceday Hosting - Affordable Hosting
PowerSSL - - We Secure your World
The Scamlist Forum - Fighting against scammers
 
 
 


Old
  Post #10 (permalink)   01-07-2012, 11:53 AM
HD Amateur
 
Join Date: Sep 2011
Location: England
Posts: 52
Send a message via MSN to PeterKelly Send a message via Yahoo to PeterKelly

Status: PeterKelly is offline
Quote:
Originally Posted by LN arleslie View Post
I would like to point out that an exploit had been moving around on HostBill (another billing software) which in the past had been used on WHMCS and still appears to be attacking small WHMCS installations. I do not know if WHMCS has had this patched or not, but the exploit had been used via support tickets by SMARTY due to the settings not set to secure. You may want to check that you haven't been hit by the exploit. The exploit allowed the attacker to execute and PHP code. In the one that had been attempted on my site (already patched before it happened) the exploit used eval with a base64 code. The base64 code decoded to a file write to a three letter file and put it into a list of known folders.
I have been getting a lot of these tickets with {php}eval(base64_decode( then it goes on and on. I've had these through emails so all i've done is set a filter via spamassasin to block any with that in its subject. They seem to have stopped so far.
__________________
Peter Kelly - Want to get in touch? Contact me via the info on my profile.
PK-Host - Shared, Resellers & ShoutCAST Servers.
cPBackup - Ensure your WHM accounts are backed up safely and automatically.
 
 
 


Old
  Post #11 (permalink)   01-07-2012, 12:22 PM
HD Wizard
 
easyhostmedia's Avatar
 
Join Date: Mar 2011
Location: Northumberland, UK
Posts: 5,004
Send a message via MSN to easyhostmedia

Status: easyhostmedia is offline
The try and get in via support ticket, but if you apply the pach they cant access the installation, but the patch will not stop the emails/tickets
__________________
Terry Robertson - CEO The Easyhost Media Group
Niceday Hosting - Affordable Hosting
PowerSSL - - We Secure your World
The Scamlist Forum - Fighting against scammers
 
 
 


Old
  Post #12 (permalink)   01-09-2012, 03:49 PM
HD Addict
 
Join Date: Oct 2011
Posts: 164

Status: web3k is offline
Quote:
Originally Posted by PK-Host View Post
I have been getting a lot of these tickets with {php}eval(base64_decode( then it goes on and on. I've had these through emails so all i've done is set a filter via spamassasin to block any with that in its subject. They seem to have stopped so far.
This is a recent exploit attempt, you should make sure you'll tuned into WHMCS and apply any patches they come out with: http://blog.whmcs.com/?t=43462
__________________
Web3k - Australian Web Hosting and Domain Names
 
 
 


Old
  Post #13 (permalink)   01-09-2012, 04:01 PM
HD Wizard
 
easyhostmedia's Avatar
 
Join Date: Mar 2011
Location: Northumberland, UK
Posts: 5,004
Send a message via MSN to easyhostmedia

Status: easyhostmedia is offline
Yes if you use WHMCS it pays you to join the WHMCS forum and be a regular watcher of the forum to find out out latest patches etc..
this is especially important if you dont get any services direct from WHMCS as you wont get the emails etc. they send to their clientbase regarding patches etc.
__________________
Terry Robertson - CEO The Easyhost Media Group
Niceday Hosting - Affordable Hosting
PowerSSL - - We Secure your World
The Scamlist Forum - Fighting against scammers
 
 
 


Old
  Post #14 (permalink)   01-09-2012, 06:04 PM
HD Guru
 
HostLeet's Avatar
 
Join Date: May 2009
Location: Florida, USA
Posts: 874

Status: HostLeet is online now
Quote:
Originally Posted by easyhostmedia View Post
i suggest you follow these steps

http://docs.whmcs.com/Further_Security_Steps
Agreed. It is simply a MUST to follow ALL of the steps in that guide, specially this one:

Quote:
Restrict Access by IP

For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all
You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.
If you haven't done all of the steps in the security guide, then it is safe to say that WHMCS and their script is NOT at fault for you being hacked and the problem is server/user based.
__________________
HOSTLEET.COM, LLC - Elite Website Hosting Since 2008!
Fast Reliable Affordable Secure Friendly & Courteous
RISK-FREE Money Back Guarantee PCI-Compliant Checkout
 
 
 


Old
  Post #15 (permalink)   01-18-2012, 05:26 PM
HD Newbie
 
Join Date: Oct 2009
Posts: 7

Status: InstantPH is offline
Quote:
Originally Posted by HostLeet View Post
If you haven't done all of the steps in the security guide, then it is safe to say that WHMCS and their script is NOT at fault for you being hacked and the problem is server/user based.
And even if all the steps in the security guide have been followed, I think you'll find that the security whole is not with WHMCS. If it was, you'd see an influx of posts complaining about WHMCS being hacked. Similar to how we saw a huge amount of posts about the php encode hack in support tickets.
__________________
Instant Pro Hosting - Professional Web Hosting Solutions
RAID Protected Storage, Tier-1 Premium Bandwidth, Daily Off-Site Server Backup's.
Fantastico De Luxe, Softaculous and RVSiteBuilder, 30 Day Money Back Guarantee.
Click here to find a web hosting solution that's right for you.
 
 
 
Reply
Previous Thread Next Thread


Thread Tools

New Post New Post   Old Post Old Post
Posting Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Sponsored By: