WHMCS hacked over and over again.

[JimmyGibbs]

Hello, I use WHMCS for billing and over the yesterday a hacker login to the admin account and change the password, I was able to change the password through phpMyAdmin but that doesn't seem to do anything, the hacker login again and same thing happened 6-7 times, I updated to the latest version of WHMCS and installed the latest security patch. Do you have any idea how the hacker is able to login to the admin account?

 

[handsonhosting]

It's entirely possible that there's a compromise of the hosting account itself and not just the billing area. If they have setup the system to alert an email address when the admin information is changed, that could be playing a role too.

It's best to shut down the site (so users information can't be exploited) and then contact WHMCS directly to have them perform a security audit on your site.

 

[JimmyGibbs]

It's best to shut down the site (so users information can't be exploited) and then contact WHMCS directly to have them perform a security audit on your site.

That's not a problem, the website is still under construction so there is not any clients. I will try to find a solution with WHMCS support but if anyone had the same problem post it here please.

 

[Bullten]

Whmcs is not vulnerable yet. There are thousands to tricks to hack something.

1) Kernel not updated --- rooting is possible
2) Improper or unsecured server ---- navigating to other user account on shared panel is possible
3) using whmcs third part plugins ----- Everything is possible...

If i was that hacker i would have planted a shell to maintain access to your host and do what ever i like to...

Perform a virus scan and malware to find out whats fishy on your host

 

[easyhostmedia]

Hello, I use WHMCS for billing and over the yesterday a hacker login to the admin account and change the password, I was able to change the password through phpMyAdmin but that doesn't seem to do anything, the hacker login again and same thing happened 6-7 times, I updated to the latest version of WHMCS and installed the latest security patch. Do you have any idea how the hacker is able to login to the admin account?

i suggest you follow these steps

http://docs.whmcs.com/Further_Security_Steps

Move the attachments, downloads & templates_c folders

The three folders "attachments", "downloads" and "templates_c" need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all). When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to your configuration.php file:

$templates_compiledir = "/home/username/templates_c/";
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";

In the above example, "username" is the cpanel username and so the 3 folders are located in the home directory, above public_html.

Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec - the highest permissions are 755 for both folders and files.
Change your WHMCS Admin Folder name

Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area via the admin folder. To protect against this, you can rename the admin folder name to any name you like. You cannot move the folder - only rename it. You can then tell WHMCS what the name of that folder is for the links in admin notification emails by adding the following line to your configuration.php file:

$customadminpath = "myfoldername";

Replace "myfoldername" above with the new name you just gave to your admin folder.

Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well.

Example: php -q /home/mylogin/public_html/secure/myfoldername/cron.php

 

[JFSG]

There are lots of possibilities. Some of the common ones are:

1) Vulnerable PC. Is your PC infected?
2) Weak password.
3) Server's security compromised.
4) WHMCS Addons compromised.

etc.

 

[easyhostmedia]

There are lots of possibilities. Some of the common ones are:

1) Vulnerable PC. Is your PC infected?
2) Weak password.
3) Server's security compromised.
4) WHMCS Addons compromised.

etc.

true, but the OP stated the hacker got into his WHMCS admin area, so therefore the WHMCS security steps should be carried out

 

[HWH Andrew]

I would like to point out that an exploit had been moving around on HostBill (another billing software) which in the past had been used on WHMCS and still appears to be attacking small WHMCS installations. I do not know if WHMCS has had this patched or not, but the exploit had been used via support tickets by SMARTY due to the settings not set to secure. You may want to check that you haven't been hit by the exploit. The exploit allowed the attacker to execute and PHP code. In the one that had been attempted on my site (already patched before it happened) the exploit used eval with a base64 code. The base64 code decoded to a file write to a three letter file and put it into a list of known folders.

 

[easyhostmedia]

yes this explot is doing the whmcs rounds and WHMCS advice is to use the patch they have done along with http://docs.whmcs.com/Further_Security_Steps

 

[PeterKelly]

I would like to point out that an exploit had been moving around on HostBill (another billing software) which in the past had been used on WHMCS and still appears to be attacking small WHMCS installations. I do not know if WHMCS has had this patched or not, but the exploit had been used via support tickets by SMARTY due to the settings not set to secure. You may want to check that you haven't been hit by the exploit. The exploit allowed the attacker to execute and PHP code. In the one that had been attempted on my site (already patched before it happened) the exploit used eval with a base64 code. The base64 code decoded to a file write to a three letter file and put it into a list of known folders.

I have been getting a lot of these tickets with {php}eval(base64_decode( then it goes on and on. I've had these through emails so all i've done is set a filter via spamassasin to block any with that in its subject. They seem to have stopped so far.

 

[easyhostmedia]

The try and get in via support ticket, but if you apply the pach they cant access the installation, but the patch will not stop the emails/tickets

 

[web3k]

I have been getting a lot of these tickets with {php}eval(base64_decode( then it goes on and on. I've had these through emails so all i've done is set a filter via spamassasin to block any with that in its subject. They seem to have stopped so far.

This is a recent exploit attempt, you should make sure you'll tuned into WHMCS and apply any patches they come out with: http://blog.whmcs.com/?t=43462

 

[easyhostmedia]

Yes if you use WHMCS it pays you to join the WHMCS forum and be a regular watcher of the forum to find out out latest patches etc..
this is especially important if you dont get any services direct from WHMCS as you wont get the emails etc. they send to their clientbase regarding patches etc.

 

[HostLeet]

i suggest you follow these steps

http://docs.whmcs.com/Further_Security_Steps

Agreed. It is simply a MUST to follow ALL of the steps in that guide, specially this one:

Restrict Access by IP

For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all
You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.

If you haven't done all of the steps in the security guide, then it is safe to say that WHMCS and their script is NOT at fault for you being hacked and the problem is server/user based. :crash:

 

[InstantPH]

If you haven't done all of the steps in the security guide, then it is safe to say that WHMCS and their script is NOT at fault for you being hacked and the problem is server/user based. :crash:

And even if all the steps in the security guide have been followed, I think you'll find that the security whole is not with WHMCS. If it was, you'd see an influx of posts complaining about WHMCS being hacked. Similar to how we saw a huge amount of posts about the php encode hack in support tickets.

 

[easyhostmedia]

And even if all the steps in the security guide have been followed, I think you'll find that the security whole is not with WHMCS. If it was, you'd see an influx of posts complaining about WHMCS being hacked. Similar to how we saw a huge amount of posts about the php encode hack in support tickets.

even using the security patch this does not stop the attempts and the support ticket messages

in cpanel you can use account level filtering to setup rules with a fail message or with a block message
a common example that is going around (in my case) is

 base64_decode

so just setup the settings like this

body contains
base64_decode

Fail With Message
php code to a ticket system is not a nice thing to do

then users who send that above code in a email to your ticket system (or any other email to your account ) will get the above reply

you can add extra rules to so the above rule only apply to abuse department or other emails

here is a example email that get sended back with the above rule

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

XXX@XXX
php code to a ticket system is not a nice thing to do

 

[WebCare360]

Well, this is the most scary thing that any hosting provider will ever have to face. Well, I also got such messages a few days back that was encoded with base64 and when I decoded the code that was a scary attacking code :-s.

Well, I contacted the WHMCS support team and they told me that as I have the latest script installed that have already patched for such attacks.

So, I advise you to contact with WHMCS team to get some guideline

Further, to make secure you WHMCS you should take proper security steps.

Good Luck.

 

[easyhostmedia]

Well, this is the most scary thing that any hosting provider will ever have to face. Well, I also got such messages a few days back that was encoded with base64 and when I decoded the code that was a scary attacking code :-s.

Well, I contacted the WHMCS support team and they told me that as I have the latest script installed that have already patched for such attacks.

So, I advise you to contact with WHMCS team to get some guideline

Further, to make secure you WHMCS you should take proper security steps.

Good Luck.

as long as you have the latest WHMCS security patch as given in the WHMCS forum then you are safe from the attachs, this will not however stop them trying and submitting tickets, so follow my above steps to block the messages from ther attackers and then follow the further security steps by WHMCS http://docs.whmcs.com/Further_Security_Steps

 

[Bullten]

Well guys that base64 exploit was recently found in whmcs and is already fixed there is no need to protect it by changing anthing

 

[easyhostmedia]

Well guys that base64 exploit was recently found in whmcs and is already fixed there is no need to protect it by changing anthing

yes the patch will stop the attacks from getting into your whmcs installation.

but ask any WHMCS staff then they will al advise you to follow these http://docs.whmcs.com/Further_Security_Steps as an extra security measure as yes the base64 has been sorted but i can guarantee their will other exploits being created to try the same thing. this is how things are as fixing this exploit will not stop IDIOTS trying other ways.

the account level filtering process will bounce back and block all emails/tickets these IDIOTS try and send, saving hosts the time in manually removing these