Unable to locate the FreePBX BMO Class 'Userman'

[rnrstar (Todd Schacherl)]

I’ve got a PBXact UC 40 that appears to have been hacked. When I try to bring up the GUI I get a Whoops, “Unable to locate the FreePBX BMO Class ‘Userman’” I’ve tried to do as suggested, fwconsole ma install userman, which give me:

Updating tables userman_users, userman_users_settings, userman_groups, userman_groups_settings, userman_directories...Done
Generating CSS...Done
Module userman successfully installed
Updating Hooks...Done

Then when I do fwconsole ma enable userman I get:

The following error(s) occured:
 - Module userman is already enabled

I found some files like support.php, asterisk.php, helpdesk.php in various folders and deleted them. I ended up replacing the admin folder from a working UC 40 and still I can’t get the GUI to come up. The phones work and I’m able to take and make calls. I just can’t get the GUI to work.

I’ve also tried a fwconsole validate --clean and that gives me:
fwconsole validate --clean
Downloading…
============================
============================
This script will check your system to the best of it’s ability
It should not be relied upon for complete validation
Every hack is different. This just tries to discover and clean them up as best as possible
Continue with this action?y
Scanning All files…
Scanning All files…
[============================] 17 secs
Found /var/www/html/admin/modules/cxpanel/main.log that shouldn’t be there?
Purged File
Purging PHP Session storage
Moving potentially compromised file /etc/asterisk/manager_custom.conf to /tmp/freepbx_quarantine/manager_custom.conf
Moving potentially compromised file /etc/asterisk/sip_custom.conf to /tmp/freepbx_quarantine/sip_custom.conf
Moving potentially compromised file /etc/asterisk/extensions_custom.conf to /tmp/freepbx_quarantine/extensions_custom.conf
Connecting to the PBX…Connected
Finished

Every time I run the above command, I get the same output.

Is there a way I can download and re-install the framework?

[mbrooks (Matt Brooks)]

Well, since you’re running PBXact, you should be able to open a support case with Sangoma. They might be able to repair it for you. Other than that, it looks like your system is badly damaged and probably needs a reinstall.

[psandesh (Sandesh Prakash)]

Hi @rnrstar
As per your comments above you have replaced the admin folder from another box. Even though the modules are same we use zending and due to which the system is broken.
Try running below commands.

fwconsole ma refreshsignatures
fwconsole sa update
fwconsole chown

and check the issue is fixed or not.

[rnrstar (Todd Schacherl)]

Thanks Sandesh. I tried the refreshsignatures already and it runs but it still doesn’t fix the GUI. The sa update ran as well and the chown command runs as well but still the GUI is broken. I’ve set up another server to replace and I’m just waiting for the time to replace. I think I’ll just rebuild the server when I replace it.