# MODx supports Friendly URLs via this .htaccess file. You must serve web
# pages via Apache with mod_rewrite to use this functionality, and you must
# change the file name from ht.access to .htaccess.
#
# Make sure RewriteBase points to the directory where you installed MODx.
# E.g., "/modx" if your installation is in a "modx" subdirectory. If you have
# problems with your .htaccess working at all, try un-commenting the first
# line above the "RewriteEngine On" directive.
#
# You may choose to make your URLs non-case-sensitive by adding a NC directive
# to your rule: RewriteRule ^(.*)$ index.php?q=$1 [L,QSA,NC]
#Options +FollowSymlinks
RewriteEngine On
RewriteBase /
# Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www.neilcreek\.com [NC]
#RewriteRule (.*) http://www.neilcreek.com/$1 [R=301,L]
#
# or for the opposite domain.com -> www.domain.com use the following
# >>> DO NOT USE BOTH THE ABOVE AND BELOW <<<
#
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.example-domain-please-change\.com [NC]
#RewriteRule (.*) http://www.example-domain-please-change.com/$1 [R=301,L]
# Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent
# https://www.domain.com when your cert only allows https://secure.domain.com
#RewriteCond %{SERVER_PORT} !^443
#RewriteRule (.*) https://neilcreek.com/$1 [R=301,L]
# The Friendly URLs part
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
# Make sure .htc files are served with the proper MIME type, which is critical
# for XP SP2. Un-comment if your host allows htaccess MIME type overrides.
#AddType text/x-component .htc
# If your server is not already configured as such, the following directive
# should be uncommented in order to set PHP's register_globals option to OFF.
# This closes a major security hole that is abused by most XSS (cross-site
# scripting) attacks. For more information: http://php.net/register_globals
#
# To verify that this option has been set to OFF, open the Manager and choose
# Reports -> System Info and then click the phpinfo() link. Do a Find on Page
# for "register_globals". The Local Value should be OFF. If the Master Value
# is OFF then you do not need this directive here.
#
# IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS :
#
# Your server does not allow PHP directives to be set via .htaccess. In that
# case you must make this change in your php.ini file instead. If you are
# using a commercial web host, contact the administrators for assistance in
# doing this. Not all servers allow local php.ini files, and they should
# include all PHP configurations (not just this one), or you will effectively
# reset everything to PHP defaults. Consult www.php.net for more detailed
# information about setting PHP directives.
php_flag register_globals Off
# For servers that support output compression, you should pick up a bit of
# speed but un-commenting the following lines.
#php_flag zlib.output_compression On
#php_value zlib.output_compression_level 5
# The following directives stop screen flicker in IE on CSS rollovers. If
# needed, un-comment the following rules. When they're in place, you may have
# to do a force-refresh in order to see changes in your designs.
#ExpiresActive On
#ExpiresByType image/gif A2592000
#ExpiresByType image/jpeg A2592000
#ExpiresByType image/png A2592000
#BrowserMatch "MSIE" brokenvary=1
#BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1
#BrowserMatch "Opera" !brokenvary
#SetEnvIf brokenvary 1 force-no-vary
DirectoryIndex index.php index.html index.htm
#Options +FollowSymlinks
RewriteEngine On
RewriteBase /
# The Friendly URLs part
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
« MODx Parse Error » MODx encountered the following error while attempting to parse the requested resource: « PHP Parse Error » PHP error debug Error: gzinflate() [function.gzinflate]: buffer error Error type/ Nr.: Warning - 2 File: /nfs/c01/h03/mnt/33105/domains/neilcreek.com/html/blog/wp-config.php(1) : eval()'d code Line: 1 Parser timing MySQL: 0.0123 s (7 Requests) PHP: 0.1046 s Total: 0.1169 s
MODX Staff
MODX Staff
wp-config.php is the file I meant, sorry.
I think you may be right. I found blibks of machine code at the start of wp-config.php and wp-config-sample.php. I couldn’t fine wp-config.ing.php however, nor did a google search return the path. Where would I find this file?
Your welcome, but you are about to experience a very painful recovery, depending on the extent of the damage they did. Once c99madshell is successfully uploaded to a server, depending on the configuration of the server and the permissions, it is possible they a) deleted files via a pattern, like rm- R *log*, b) attempted to ssh in and gain root access to own the server, c) setup a porn site somewhere within your site, or d) any number of other nasty things (see http://www.derekfountain.org/security_c99madshell.php for more information on what this exploit is all about).
I removed the offending code, but my site is still invisible and my blog still gives intermittant errors. Should this have solved the problems?
Are there any other files I need to check? Do I need to do anything else to repair the damage done by the exploit? Is there any way to prevent it from happening again?
If my ongoing problem is not caused by this exploit (as it still persists) can you suggest another solution?
Thanks very much for making me aware of the issue!
