randomly failed to attach files. (solved)

naive · Post by **naive** » Thu Sep 13, 2012 7:53 am

When I press "Add the file" to attach in reply, sometimes the page of "Forex trading - tips, and trading tutorials appeared.

It seemed to occur randomly since sometimes I just attached a file without anything wrong.

Many of my members encountered this.

Am I hacked? What should I do to explore?

Oyabun1 · Post by **Oyabun1** » Thu Sep 13, 2012 8:39 am

Please fill out the Support Request Template Generator and post it back here to enable us to assist you better.

naive · Post by **naive** » Thu Sep 13, 2012 1:24 pm

Support Request Template
What version of phpBB are you using? phpBB 3.0.11
What is your board's URL? https://forum.doctorvoice.org
Who do you host your board with? http://www.liquidweb.com
How did you install your board? I used the download package from phpBB.com
What is the most recent action performed on your board? Update from a previous version of phpBB3
Is registration required to reproduce this issue? Yes
Do you have any MODs installed? Yes
What version of phpBB3 did you update from? phpBB 3.0.10
What MODs do you have installed? ACP Announcement Centre
What styles do you currently have installed? prosilver, subsilver2, K_kitty, Black_pearl
What language(s) is your board currently using? Chinese Traditional
Which database type/version are you using?mysqli 5.0.95
What is your level of experience? Using phpbb for more than 7 years
What username can be used to view this issue? pitcher
What password can be used to view this issue? 123456
When did your problem begin? Maybe for the past two weeks
Please describe your problem. In a post, I wanted to attach a file, after pressing add the file button, a page appeared, but not every time. Sometimes I can successfully attach the file. It seemed to appear randomly.

Generated by SRT Generator

naive · Post by **naive** » Thu Sep 13, 2012 1:25 pm

I checked the codes of that page.

Code: Select all

<HTML><HEAD><TITLE></TITLE></HEAD><frameset rows="*" framespacing="0" frameborder="NO"><frame src="http://www.jam-hsiao.com/forex_trading.html" scrolling="AUTO" name="One" noresize><noframes></noframes></frameset></html>

<!-- 
                                                                                                                                                                                                                                                                                                                                                                                                          
-->

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Thu Sep 13, 2012 2:29 pm

someone ( your host? ) is injecting that iframe into your code. check with the host.

robert

naive · Post by **naive** » Thu Sep 13, 2012 2:42 pm

Thanks. Robert.
Which file to check that code? posting.php or some others?
I have roughly checked posting.php for that code but did not find one.

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Thu Sep 13, 2012 3:07 pm

naive wrote:Thanks. Robert.
Which file to check that code? posting.php or some others?
I have roughly checked posting.php for that code but did not find one.

It is most likely in the index.php file and maybe others.

did you ask your host about it yet?

robert

naive · Post by **naive** » Thu Sep 13, 2012 3:20 pm

Now waiting reply from the host.

naive · Post by **naive** » Thu Sep 13, 2012 11:08 pm

Code: Select all

grep -Rin 'forex_trading.html' /home/forum
/home/forum/www/400.shtml:1:<HTML><HEAD><TITLE></TITLE></HEAD><frameset rows="*" framespacing="0" frameborder="NO"><frame src="http://www.jam-hsiao.com/forex_trading.html" scrolling="AUTO" name="One" noresize><noframes></noframes></frameset></html>

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Fri Sep 14, 2012 1:36 am

naive wrote:

Code: Select all

grep -Rin 'forex_trading.html' /home/forum
/home/forum/www/400.shtml:1:<HTML><HEAD><TITLE></TITLE></HEAD><frameset rows="*" framespacing="0" frameborder="NO"><frame src="http://www.jam-hsiao.com/forex_trading.html" scrolling="AUTO" name="One" noresize><noframes></noframes></frameset></html>

what does this mean and why did you post it with no explanation?

robert

naive · Post by **naive** » Fri Sep 14, 2012 2:16 am

I searched the server and found that the error pages, including 400.shtml, 401,shtml, 500.shtml were infected with that codes of iframe.

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Fri Sep 14, 2012 3:00 am

that means that your server has been compromised and you need to let your host know about it. they did not get in through phpbb but probably by some other software on the server.

luck,
robert

naive · Post by **naive** » Fri Sep 14, 2012 4:10 am

haha,
the host did a maldetect and reported that no files were infected.
They suggested inspecting the scripts.

I will do that first myself, by comparing the files between the official site here and my site.

I checked those infected files. Does that mean they could have being there since 2008?

Code: Select all

 -rw-r--r-- 1 forum forum 628 Dec 6 2008 400.shtml
-rw-r--r-- 1 forum forum 628 Dec 6 2008 401.shtml
-rw-r--r-- 1 forum forum 613 Nov 23 2008 403.shtml
-rw-r--r-- 1 forum forum 628 Dec 6 2008 500.shtml

One thing I am not understanding is that we did not have problems to add attachments until recently.
Where could I explore now?

canonknipser · Post by **canonknipser** » Fri Sep 14, 2012 4:38 am

Those 400.shtml files looks like html-error-Documents (just from naming conventions) send by the server when a error occured.
So, if during attaching a file a server-error number 500 occurs, 500.shtml is sent instead of the default error document of the web server.

Look in your .htaccess file, there must be a statement "ErrorDocument" refering the files ...

naive · Post by **naive** » Fri Sep 14, 2012 4:49 am

Thank you for explanation.

That is what I want to know why my members very often encountered failure to attach the files and then were directed to the error pages, just recently, maybe for the past two or three weeks.