PHP-Nuke admin.php security hole fix

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

To fix the admin.php security exploit, you need to edit admin.php. Your beginning code in admin.php will look something like this

Code:

<?php





/************************************************************************/


/* PHP-NUKE: Advanced Content Management System                         */


/* ============================================                         */


/*                                                                      */


/* Copyright (c) 2002 by Francisco Burzi                                */


/* http://phpnuke.org                                                   */


/*                                                                      */


/* This program is free software. You can redistribute it and/or modify */


/* it under the terms of the GNU General Public License as published by */


/* the Free Software Foundation; either version 2 of the License.       */


/************************************************************************/





require_once("mainfile.php");


get_lang(admin);

Modify it to look like this

Code:

<?php





/************************************************************************/


/* PHP-NUKE: Advanced Content Management System                         */


/* ============================================                         */


/*                                                                      */


/* Copyright (c) 2002 by Francisco Burzi                                */


/* http://phpnuke.org                                                   */


/*                                                                      */


/* This program is free software. You can redistribute it and/or modify */


/* it under the terms of the GNU General Public License as published by */


/* the Free Software Foundation; either version 2 of the License.       */


/************************************************************************/


$nastyGram = "<center>::<br />Thanks for providing me with your connection information!<br />You have been caught attempting to break into my site and appropriate action will be taken.<br />::</center>";


$myPHPVersion = str_replace('.','',phpversion());


if ($myPHPVersion>=410) $checkMyUrl = $_SERVER['REQUEST_URI'];


else $checkMyUrl = getenv("REQUEST_URI");


if (preg_match("/\?admin/", "$checkMyUrl")) {


   require_once("mainfile.php");


    include("header.php");


    OpenTable();


   echo $nastyGram;


   CloseTable();


   include "footer.php";


   die();


}





require_once("mainfile.php");


get_lang(admin);

The $nastyGram variable can be modified to be whatever you want it to. You could display a message and then relocate them to the FBI page for something novel Laughing

.

Client Joined: Jul 18, 2003 Posts: 977

this is nice!! Can we check to see if it is working somehow?

Posted: Tue Oct 14, 2003 2:25 pm

The exploit was being accessed through code like this. I will only give enough to allow you to test - don't want to publish more than that here.
[ Only registered users can see links on this board! Get registered or login! ]

That should be enough to test it.

Posted: Tue Oct 14, 2003 2:30 pm

oh okay thanks... thanks for being on the lookout Mr. Raven!!

Worker Joined: Sep 09, 2003 Posts: 165

hehehehehe works great thanks Raven

New Member Joined: Aug 01, 2003 Posts: 5

Great work!

Is there a way to perhaps pm or e-mail the admin(s) when this message is displayed, so they can manually or automatically take corrective action?

Posted: Wed Oct 15, 2003 1:11 pm

What admins?

Worker Joined: Oct 06, 2003 Posts: 108

Kewl. Works Great!

Posted: Thu Oct 16, 2003 12:58 am

Oops, I said admin(s) what I meant to say is that a site administrator(s) that has just had this exploit or one like it, run on her/his patched site, by someone other than himself/herself, could probably benefit from knowing about the incident sooner rather than later.

For instance, it might be useful for that site administrator to be notified via e-mail or instant message, with the connection information and details of visitors that have been presented with the $nastyGram on their site(s). In this way they could manually take action, if that was what they wanted to do.

Another idea that comes to mind is the following:

If the ip address of the visitor that has been presented with the $nastyGram is not equal that of the true site administrator, then the ip address of that visitor might be automatically banned?

I do not have the skills required to implement the above ideas at this time, I am Just thinking out loud.

Posted: Thu Oct 16, 2003 8:00 am

The Protector 1.13b mod can help with that.

You can find it at http://protector.warcenter.se/

It protects admin IPs and you can also assign members to the protection.

It autobans and gives you the option to add more, tracks ips, who/where online, how long, reverse lookup, etc..

Posted: Thu Oct 16, 2003 3:40 pm

Thanks for the tip frogger, this looks great! Is there a mod availible for 1.13b?

Posted: Thu Oct 16, 2003 9:40 pm

mattomus wrote:

Thanks for the tip frogger, this looks great! Is there a mod availible for 1.13b?

I just woke up, so the ole grey cells aren't fully functional at the moment, so . . .

Not sure what you mean. Sounds like you found the site and the mod.

If you're not in a hurry to get Protector, you should wait until 1.14b is available sometime this week.

Posted: Fri Oct 17, 2003 10:28 am

I will wait for 1.14b

thank you

Posted: Tue Oct 21, 2003 7:50 am

What is the difference between these two fixes to the admin.php? Is all that stuff in the other code really necessary to fix the problem being addressed?

Your fix

Code:

$nastyGram = "<center>::<br />Thanks for providing me with your connection information!<br />You have been caught attempting to break into my site and appropriate action will be taken.<br />::</center>"; 


$myPHPVersion = str_replace('.','',phpversion()); 


if ($myPHPVersion>=410) $checkMyUrl = $_SERVER['REQUEST_URI']; 


else $checkMyUrl = getenv("REQUEST_URI"); 


if (preg_match("/\?admin/", "$checkMyUrl")) { 


   require_once("mainfile.php"); 


    include("header.php"); 


    OpenTable(); 


   echo $nastyGram; 


   CloseTable(); 


   include "footer.php"; 


   die(); 


} 





require_once("mainfile.php");


get_lang(admin);

Fix posted at the other site.....

Code:

$checkmyurl = getenv("REQUEST_URI"); 





if (preg_match("/\?admin/", "$checkmyurl")) { 


echo "die"; 


exit; 


}


require_once("mainfile.php");


get_lang(admin);





function create_first($name, $url, $email, $pwd, $user_new) {


    global $prefix, $db, $user_prefix;


    $first = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_authors"));


    if ($first == 0) {


    $pwd = md5($pwd);


    $the_adm = "God";


    $sql = "INSERT INTO ".$prefix."_authors VALUES ('$name', '$the_adm', '$url', '$email', '$pwd', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '1', '')";


    $db->sql_query($sql);


    if ($user_new == 1) {


        $user_regdate = date("M d, Y");


        $user_avatar = "blank.gif";


        $commentlimit = 4096;


        if ($url == "http://") { $url = ""; }


            $sql = "INSERT INTO ".$user_prefix."_users (user_id, username, user_email, user_website, user_avatar, user_regdate, user_password, theme, commentmax, user_level, user_lang, user_dateformat) VALUES (NULL,'$name','$email','$url','$user_avatar','$user_regdate','$pwd','$Default_Theme','$commentlimit', '2', 'english','D M d, Y g:i a')";


        $db->sql_query($sql);


    }


    login();


    }


}

Posted: Tue Oct 21, 2003 7:52 am

Code:

$myPHPVersion = str_replace('.','',phpversion()); 


if ($myPHPVersion>=410) $checkMyUrl = $_SERVER['REQUEST_URI']; 


else $checkMyUrl = getenv("REQUEST_URI");

You need this code at a minimum. The other is at your discretion.

Posted: Tue Oct 21, 2003 9:36 am

As I thought....pretty much overkill, then.

I'm using your code. Smile

Was just wondering about the other.

Client Joined: Jan 29, 2004 Posts: 624

Frogger wrote:

The Protector 1.13b mod can help with that.

You can find it at http://protector.warcenter.se/

It protects admin IPs and you can also assign members to the protection.

It autobans and gives you the option to add more, tracks ips, who/where online, how long, reverse lookup, etc..

Oh, I can attest to the efficacy of the Protector! I have it on my site and just from idle, mindless curiosity I ran Raven's snippet above and behold I banned myself.
{ edited by admin at user's request }
Go ahead, click that link. I dare you! Now I have to figure out how to unban myself, any ideas?

Posted: Fri Jan 30, 2004 4:06 pm

Uninstall it. It's a known bug.

Posted: Fri Jan 30, 2004 5:14 pm

Raven wrote:

Uninstall it. It's a known bug.

OK. Live and learn... I hate full moons!

Posted: Mon Apr 14, 2008 11:30 pm

this exploit is now fixed in the latest nuke patched series so upgrade to that to fix the problem Smile

Posted: Tue Apr 15, 2008 1:25 am

Gazj,

Thanks for this information but you are replying to a post that is over 4 years old Smack

. This has long since been put to rest Wink

Posted: Tue Apr 15, 2008 1:38 am

i know buddy but just saying as some people that isnt nuke minded wont know the differnce and ask a question anyways Razz

Posted: Tue Apr 15, 2008 8:58 pm

That beats my record for oldest post replied to lol

Posted: Wed Apr 16, 2008 6:57 am

gazj wrote:

i know buddy but just saying as some people that isnt nuke minded wont know the differnce and ask a question anyways Razz

Well then you have a lot of work cut out for you with all the threads here. Laughing

Posted: Sat Jul 18, 2009 1:44 am

Raven wrote:

To fix the admin.php security exploit, you need to edit admin.php. Your beginning code in admin.php will look something like this

Code:

<?php





/************************************************************************/


/* PHP-NUKE: Advanced Content Management System                         */


/* ============================================                         */


/*                                                                      */


/* Copyright (c) 2002 by Francisco Burzi                                */


/* http://phpnuke.org                                                   */


/*                                                                      */


/* This program is free software. You can redistribute it and/or modify */


/* it under the terms of the GNU General Public License as published by */


/* the Free Software Foundation; either version 2 of the License.       */


/************************************************************************/





require_once("mainfile.php");


get_lang(admin);

Modify it to look like this

Code:

<?php





/************************************************************************/


/* PHP-NUKE: Advanced Content Management System                         */


/* ============================================                         */


/*                                                                      */


/* Copyright (c) 2002 by Francisco Burzi                                */


/* http://phpnuke.org                                                   */


/*                                                                      */


/* This program is free software. You can redistribute it and/or modify */


/* it under the terms of the GNU General Public License as published by */


/* the Free Software Foundation; either version 2 of the License.       */


/************************************************************************/


$nastyGram = "<center>::<br />Thanks for providing me with your connection information!<br />You have been caught attempting to break into my site and appropriate action will be taken.<br />::</center>";


$myPHPVersion = str_replace('.','',phpversion());


if ($myPHPVersion>=410) $checkMyUrl = $_SERVER['REQUEST_URI'];


else $checkMyUrl = getenv("REQUEST_URI");


if (preg_match("/\?admin/", "$checkMyUrl")) {


   require_once("mainfile.php");


    include("header.php");


    OpenTable();


   echo $nastyGram;


   CloseTable();


   include "footer.php";


   die();


}





require_once("mainfile.php");


get_lang(admin);

The $nastyGram variable can be modified to be whatever you want it to. You could display a message and then relocate them to the FBI page for something novel Laughing

.

Code:

translated to dutch:








<?php





/************************************************************************/


/* PHP-NUKE: Advanced Content Management System                         */


/* ============================================                         */


/*                                                                      */


/* Copyright (c) 2002 by Francisco Burzi                                */


/* http://phpnuke.org                                                   */


/*                                                                      */


/* This program is free software. You can redistribute it and/or modify */


/* it under the terms of the GNU General Public License as published by */


/* the Free Software Foundation; either version 2 of the License.       */


/************************************************************************/


$nastyGram = "<center>::<br />Dank voor het leggen van deze verbinding!<br />You Alleen je hebt nu een probleem, je ben aangemeld als hacking athempt.<br />::</center>";


$myPHPVersion = str_replace('.','',phpversion());


if ($myPHPVersion>=410) $checkMyUrl = $_SERVER['REQUEST_URI'];


else $checkMyUrl = getenv("REQUEST_URI");


if (preg_match("/\?admin/", "$checkMyUrl")) {


   require_once("mainfile.php");


    include("header.php");


    OpenTable();


   echo $nastyGram;


   CloseTable();


   include "footer.php";


   die();


}





require_once("mainfile.php");


get_lang(admin);