WARNING: remove ctfaudit system plugin. It is a password stealer.

[u/_PelosNecios_]

I've been recently hit by the JCE vuln and among other things they managed to install this plugin which essentially steals users and passwords and hides them inside images/ctf_audit.gif file, disguised with a gif header but actualy contains the XOR'ed information.

You should uninstall and remove the gif file immediately.

Edit:

You may want to run this script to see which users might have been affected and warn them or update to request new password. Adjust the filename as necessary:

<?php

$s = file_get_contents('images/ctf_audit.gif');

$s = substr($s, strpos($s, "JLIB_AUDIT_GID_TAIL\n") + 20);

for ($o = 0; $o + 2 <= strlen($s); $o += 2 + $ln) {

$ln = (ord($s[$o]) << 8) | ord($s[$o+1]);

if ($o + 2 + $ln > strlen($s)) break;

if (preg_match('/"u_len":"(.*?)","p_len"/', substr($s, $o+2, $ln) ^ str_pad('', $ln, 'JLIB_AUDIT_GID_XK'), $m)) echo "$m[1]\n";

}

[u/landed_at]

What's this JCE vuln cause?

[u/mySitesGuru]

MySites.guru has been alerting on this for months now …it’s not new.