[finally not so solved] site closed hacked ?

just remove the file that snippet.reflect.php is not used its the source file of the snippet that is installed
just remove the thing.

Dimmy

sur it was done.

But we add to scan all files too.
Probably 2 more backdoor installed last week that were not found.

I suggest to every one to have a look to your host logs (http request) you’ll probably see dozen of tries of using the reflect breach.

All our sites logs’s show many attempts.

Quote from: elz64 at Dec 01, 2008, 10:24 AM

I suggest to every one to have a look to your host logs (http request) you’ll probably see dozen of tries of using the reflect breach.

All our sites logs’s show many attempts.

Correct, they are trying it on any domain they believe is run by modx. But attempts do not equal a successful breach so this is meaningless other than for blocking known malicious IP’s.

yep, sure


But If I only could reply to those bas**$$d..
you know sometime could be good to kick some ass ...

Anyway that we can ban IPs automatically for intrusion attempts like how nuke would?

Also should we delete all php files for all other snippets that hold the snippet code that isn’t actually required in the snippet folders?

Banning IP’s would be a long job you will most likely find that there are multiple hackers trying to get into your site and exploit it.

My Advice
1. if you have had register_globals = on switch it off.
2. If you have been compromised check for any new files or modified files in the past week or two *.php
Most likely the hackers will drop in a back door .php or modify something existing to be able to get back in

3. If you have been compromised and would like to be extra safe download your site as a backup and reupload a fresh version of MODx and reconnect to your database.

4. Change your database password.

On Onesmarthost many sites have had hackers attempt to exploit reflect but because register_globals = on we are all safe.

We are also running daily checks on new .php files just in case for a short time.

Looking at the logs the hacks are coming from many IP’s and Countries, most likely junior hackers trying out a new exploit which doesnt work here

I also download my log files each week and import them into excel makes it much easier to view and from that you can easily spot any possible breakins.

Aaron

@OneSmartHost:

My Advice
1. if you have had register_globals = off switch it on

are you sure about that?
cheers, j

WHOOPs its late i had better Modify that.

My dedicated server has register_globals = off... Just wondered if the php files in the other snippets that aren’t required, like the reflect one should be deleted or are they safe?