MODx Evolution 1.0.4 - 4 different sites hacked today

Hi,

Same scenario.

File:


altered with this:


Once cache is cleared from the manager iframe is gone (and doesn’t show up anymore on the main page).
I don’t see any direct attempts to access siteCache.idx.php file from the web (access logs doesn’t show anything).

HOWEVER: In one case - iframe still exists in manager templates files (login.html, manager.lockout.html).

All websites are on the same VPS server. Websites are not related (not sharing same vhost).

regards
DM

How did you upgrade the sites? Did you just upload the files overwriting the existing ones, or did you do a clean install?

Also could you tell us more about how the server is configured (apache version, php version, mysql version, phpsuexec?, cpanel?)

Apache v3.2.0 rev4652
PHP Version 5.2.9
MySQL 5.0.91-community
phpsuexec - no
cpanel - yes

Upgrades were made by overwriting.

I found this:
https://bugzilla.redhat.com/show_bug.cgi?id=634457

My server os is CentOS. Asked my hosting company about this, no answer so far...
Possible that MODx is innocent here

If I recall correctly you need shell to make use of that exploit.

I would actually be more worried about the lack of phpsuexec than the exploit. You may want to ask about getting that setup. Files need to be chmod 644 and folder 755 after that’s configured.

As for the attack I suspect it came from an old snippet/plugin folder as they sometimes get renamed. You may want to check snippets, plugins, and modules to ensure there are no extra/legacy items. That or just delete the stock items from those folder (leaving ones you added) and just replace them entirely.

Overwriting isn’t going to take your site down, but can leave behind files.

Are these definite hacks or a spoof?

I’ve got the same thing in Evo 1.0.3 and try as I might I can’t find any code that that Google Diags says is on my homepage.

There’s quite a few postings out there about spoof Google sites and warnings.

Have you made any progress?

I’ve spent hours on this so far and franky I’m tearing my hair out!

Best

I’m guessing this post might be of some relevance: http://modxcms.com/forums/index.php/topic,47759.0.html

This is why it’s strongly recommended you upgrade your sites. Also who is your host?

This could be a different exploit. If you are using phpThumb on any of your sites, there’s a nasty hack that would let an attacker pretty much do anything they want on your box. I found it on a client’s site, and I came up with a patch after crawling through the source code:

http://modxcms.com/forums/index.php/topic,54874.msg316279.html

phpThumb is often used with PHx and a number of other plugins and snippets -- it’s used on WordPress and Drupal sites as well, so this exploit has the potential to do some real damage.

Looks like i’ve got the same issue. The site is on a old modx 0.9.6 so was wondering if i update is there a chance there’s any probs with the DB? As was planning on doing a fresh install but re installing the DB.

This is the google message i’ve got:
Of the 1 pages that we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time that Google visited this site was on 2010-11-08, and the last time that suspicious content was found on this site was on 2010-11-07.

Malicious software includes 1 virus, 1 trojan(s), 1 exploit(s). Successful infection resulted in an average of 2 new process(es) on the target machine.

Malicious software is hosted on 1 domain(s), including mainsite.co.cc/.

This site was hosted on 1 network(s) including AS31727 (NODE4).

Thanks

Ben

Hello Ben,

You should always make a backup before upgrading, but going from 0.9.6 > 1.0.4 is rather safe and highly recommend to prevent exploits.

If you want to do a fresh install just save the folders relevant to your site.
config file - manager/includes/config.inc.php
images - assets/images
files - assets/files
templates - assets/templates/____

If you have any extra snippets, plugins, or modules naturally save their related folders. The upgrade shouldn’t be very difficult, if you need any help feel free to ask.

Quote from: AMDbuilder at Nov 09, 2010, 08:56 PM

Hello Ben,

You should always make a backup before upgrading, but going from 0.9.6 > 1.0.4 is rather safe and highly recommend to prevent exploits.

If you want to do a fresh install just save the folders relevant to your site.
config file - manager/includes/config.inc.php
images - assets/images
files - assets/files
templates - assets/templates/____

If you have any extra snippets, plugins, or modules naturally save their related folders. The upgrade shouldn’t be very difficult, if you need any help feel free to ask.

Thanks AMDBuilder, actually everything ran pretty smoothly.

My biggest problem was not know what files have been effected with the malicious scripts, so having to actually work out what I need to install fresh as couldn’t risk putting up any of the files from the old site.

But slowly getting there, thanks again.

Ben