WHMCS hacked over and over again.

JimmyGibbs · Post #1 (**permalink**) 01-06-2012, 12:47 PM

Hello, I use WHMCS for billing and over the yesterday a hacker login to the admin account and change the password, I was able to change the password through phpMyAdmin but that doesn't seem to do anything, the hacker login again and same thing happened 6-7 times, I updated to the latest version of WHMCS and installed the latest security patch. Do you have any idea how the hacker is able to login to the admin account?

handsonhosting · Post #2 (**permalink**) 01-06-2012, 12:50 PM

It's entirely possible that there's a compromise of the hosting account itself and not just the billing area. If they have setup the system to alert an email address when the admin information is changed, that could be playing a role too.

It's best to shut down the site (so users information can't be exploited) and then contact WHMCS directly to have them perform a security audit on your site.

JimmyGibbs · Post #3 (**permalink**) 01-06-2012, 12:53 PM

Quote:

Originally Posted by handsonhosting

It's best to shut down the site (so users information can't be exploited) and then contact WHMCS directly to have them perform a security audit on your site.

That's not a problem, the website is still under construction so there is not any clients. I will try to find a solution with WHMCS support but if anyone had the same problem post it here please.

Bullten · Post #4 (**permalink**) 01-06-2012, 01:09 PM

Whmcs is not vulnerable yet. There are thousands to tricks to hack something.

1) Kernel not updated --- rooting is possible
2) Improper or unsecured server ---- navigating to other user account on shared panel is possible
3) using whmcs third part plugins ----- Everything is possible...

If i was that hacker i would have planted a shell to maintain access to your host and do what ever i like to...

Perform a virus scan and malware to find out whats fishy on your host

easyhostmedia · Post #5 (**permalink**) 01-06-2012, 02:31 PM

Quote:

Originally Posted by JimmyGibbs

Hello, I use WHMCS for billing and over the yesterday a hacker login to the admin account and change the password, I was able to change the password through phpMyAdmin but that doesn't seem to do anything, the hacker login again and same thing happened 6-7 times, I updated to the latest version of WHMCS and installed the latest security patch. Do you have any idea how the hacker is able to login to the admin account?

i suggest you follow these steps

http://docs.whmcs.com/Further_Security_Steps

Quote:

Move the attachments, downloads & templates_c folders

The three folders "attachments", "downloads" and "templates_c" need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all). When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to your configuration.php file:

$templates_compiledir = "/home/username/templates_c/";
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";

In the above example, "username" is the cpanel username and so the 3 folders are located in the home directory, above public_html.

Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec - the highest permissions are 755 for both folders and files.
Change your WHMCS Admin Folder name

Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area via the admin folder. To protect against this, you can rename the admin folder name to any name you like. You cannot move the folder - only rename it. You can then tell WHMCS what the name of that folder is for the links in admin notification emails by adding the following line to your configuration.php file:

$customadminpath = "myfoldername";

Replace "myfoldername" above with the new name you just gave to your admin folder.

Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well.

Example: php -q /home/mylogin/public_html/secure/myfoldername/cron.php

JFSG · Post #6 (**permalink**) 01-06-2012, 10:26 PM

There are lots of possibilities. Some of the common ones are:

1) Vulnerable PC. Is your PC infected?
2) Weak password.
3) Server's security compromised.
4) WHMCS Addons compromised.

etc.

easyhostmedia · Post #7 (**permalink**) 01-07-2012, 08:28 AM

Quote:

Originally Posted by JFSG

There are lots of possibilities. Some of the common ones are:

1) Vulnerable PC. Is your PC infected?
2) Weak password.
3) Server's security compromised.
4) WHMCS Addons compromised.

etc.

true, but the OP stated the hacker got into his WHMCS admin area, so therefore the WHMCS security steps should be carried out

HWH Andrew · Post #8 (**permalink**) 01-07-2012, 09:15 AM

I would like to point out that an exploit had been moving around on HostBill (another billing software) which in the past had been used on WHMCS and still appears to be attacking small WHMCS installations. I do not know if WHMCS has had this patched or not, but the exploit had been used via support tickets by SMARTY due to the settings not set to secure. You may want to check that you haven't been hit by the exploit. The exploit allowed the attacker to execute and PHP code. In the one that had been attempted on my site (already patched before it happened) the exploit used eval with a base64 code. The base64 code decoded to a file write to a three letter file and put it into a list of known folders.

easyhostmedia · Post #9 (**permalink**) 01-07-2012, 09:32 AM

yes this explot is doing the whmcs rounds and WHMCS advice is to use the patch they have done along with http://docs.whmcs.com/Further_Security_Steps

PK-Host · Post #10 (**permalink**) 01-07-2012, 10:53 AM

Quote:

Originally Posted by LN arleslie

I would like to point out that an exploit had been moving around on HostBill (another billing software) which in the past had been used on WHMCS and still appears to be attacking small WHMCS installations. I do not know if WHMCS has had this patched or not, but the exploit had been used via support tickets by SMARTY due to the settings not set to secure. You may want to check that you haven't been hit by the exploit. The exploit allowed the attacker to execute and PHP code. In the one that had been attempted on my site (already patched before it happened) the exploit used eval with a base64 code. The base64 code decoded to a file write to a three letter file and put it into a list of known folders.

I have been getting a lot of these tickets with {php}eval(base64_decode( then it goes on and on. I've had these through emails so all i've done is set a filter via spamassasin to block any with that in its subject. They seem to have stopped so far.

easyhostmedia · Post #11 (**permalink**) 01-07-2012, 11:22 AM

The try and get in via support ticket, but if you apply the pach they cant access the installation, but the patch will not stop the emails/tickets

web3k · Post #12 (**permalink**) 01-09-2012, 02:49 PM

Quote:

Originally Posted by PK-Host

I have been getting a lot of these tickets with {php}eval(base64_decode( then it goes on and on. I've had these through emails so all i've done is set a filter via spamassasin to block any with that in its subject. They seem to have stopped so far.

This is a recent exploit attempt, you should make sure you'll tuned into WHMCS and apply any patches they come out with: http://blog.whmcs.com/?t=43462

easyhostmedia · Post #13 (**permalink**) 01-09-2012, 03:01 PM

Yes if you use WHMCS it pays you to join the WHMCS forum and be a regular watcher of the forum to find out out latest patches etc..
this is especially important if you dont get any services direct from WHMCS as you wont get the emails etc. they send to their clientbase regarding patches etc.

HostLeet · Post #14 (**permalink**) 01-09-2012, 05:04 PM

Quote:

Originally Posted by easyhostmedia

i suggest you follow these steps

http://docs.whmcs.com/Further_Security_Steps

Agreed. It is simply a MUST to follow ALL of the steps in that guide, specially this one:

Quote:

Restrict Access by IP

For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all
You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.

If you haven't done all of the steps in the security guide, then it is safe to say that WHMCS and their script is NOT at fault for you being hacked and the problem is server/user based.

InstantPH · Post #15 (**permalink**) 01-18-2012, 04:26 PM

Quote:

Originally Posted by HostLeet

If you haven't done all of the steps in the security guide, then it is safe to say that WHMCS and their script is NOT at fault for you being hacked and the problem is server/user based.

And even if all the steps in the security guide have been followed, I think you'll find that the security whole is not with WHMCS. If it was, you'd see an influx of posts complaining about WHMCS being hacked. Similar to how we saw a huge amount of posts about the php encode hack in support tickets.