Solved Community Alert - Backdoored Script

[Hydra]

Hello Guys,
I would like to warn all users which downloaded and ran one of this scripts:
https://r4p3.net/threads/script-packetlossguard-ddosguard-v1.1430
https://r4p3.net/threads/script-timerankmod.1503/
The user backdoored the script and uploaded your "config.php" to his ftp server.
Proof:

Check the file "\libraries\TeamSpeak3\Node\Abstract.php" for this lines. It opens a ftp connection to his server and upload your server query login informations which placed in the "config.php". He "only" got access to your server query nothing else. If you see connection from a portugal ip address (46.50.34.*) he already logged into your server query.

Steps you should do now:
1.) Change your Server Query Password.
2.) Limit the access to Server Query (if not done already!).

I already wrote an abuse report to his homeconnection and server hoster (myvirtualserver.de).

Greetings Hydra

 

[ehthe]

timerankmod might also be affected

 

[Hydra]

timerankmod might also be affected

If someone can send me the files I can check it.

 

[Mr-Malone]

It's totally true what @Hydra says.
I found these lines in his script @ratodesanita https://r4p3.net/threads/script-timerankmod.1503/.
I was a victim of this backdoor and ask all users to review every FrameWork PHP script library containing TS3.

This is the script "edited" by ratodesanita http://i.imgur.com/1O4JpbZ.png

 

[Laszl0w]

Nice found.

 

[denka]

had to be from portugal @ratodesanita lol and he should be banned for doing this

 

[0x0539]

Hello Guys,
I would like to warn all users which downloaded and ran one of this scripts:
https://r4p3.net/threads/script-packetlossguard-ddosguard-v1.1430
https://r4p3.net/threads/script-timerankmod.1503/
The user backdoored the script and uploaded your "config.php" to his ftp server.
Proof:

Check the file "\libraries\TeamSpeak3\Node\Abstract.php" for this lines. It opens a ftp connection to his server and upload your server query login informations which placed in the "config.php". He "only" got access to your server query nothing else. If you see connection from a portugal ip address (46.50.34.*) he already logged into your server query.

Steps you should do now:
1.) Change your Server Query Password.
2.) Limit the access to Server Query (if not done already!).

I already wrote an abuse report to his homeconnection and server hoster (myvirtualserver.de).

Greetings Hydra

Might this explain why my whole server was fucked and had to restart all over today?

Short note what happened: Server bots (music bots etc, crashed on 5:37AM, the server crashed a couple hours after)
When restarted, I lost completely everything, no channels, permissions, nothing. --- My logs were also over 3.00GB when I tried backing the server up before.

 

[Hydra]

Might this explain why my whole server was fucked and had to restart all over today?

Check the logins and search a portugal ip. This guy dont know how to use vpn so he used his homeconnection.

 

[0x0539]

Might this explain why my whole server was fucked and had to restart all over today?

I guess it doesn't matter, had to update to 3.0.12.3 anyway but was too lazy to do so.

 

[rofl cake]

Cough*

Cough*

 

[0x0539]

Cough*

What a shame..
<00:01:02> Failed to connect to server

 

[0x0539]

Cough*

Cough*

So many cough's gurl, are you okay?

 

[X-Ecutioner]

Thank very much and ban the guy

 

[MadKill]

Teamspeak of that noob guy 188.93.234.253:50000 and his website http://www.tugaspeak.net/ if some guys want fck him have her skype: thebxio her facebook https://www.facebook.com/danieltmcastro and ban that guy from forum.

 

[francisco arsénio]

Link For Download this plz

 

[0x0539]

Link For Download this plz

 

[MadKill]

Link For Download this plz

Another scamer ban him friend of original scamer......

 

[0vert1m3]

LOL what a lil fucker. I thought we were normal / good people here and not such a backdoor snitch ;C

 

[Niepowtarzalny]

100% true So... i mean if we delete abstract.php it's 100% working script maybe send some rockets to 185.101.93.211 ;>

Edit:
Anyway... he change password to ftp acc so its safe now

 

[Joxiii]

Please spamm his fb and skype or stress his site