MODx 1.0.4. website hacked - vulnerability in chunk replacement??

hi folks,

one of my pages just got hacked by a malware bastard delivering mal-/scarware notices to mostly innocent scholars and their parents... >:(

I don’t know the attack vector, but it seemed, that it is not done by javascript, cause an iframe was shown in normal source code view (not rendered view, like firebug or so).



the domains are subject to frequent changes, some are located in russia, some are from tiny little islands in the middle of nowhere.

all the files related to modx where form early august ’10 when I updated to 1.0.4.
there are no external services other than google analytics (I hope that THEY don’t do and can’t do nasty tricks besides collecting user data).

the fact why I’m asking for chunk replacement is, that I use a couple of different templates with one common div tag that was the first in the body with a chunk:



there is no need to use this div for an attack, e.g. for using the ID or something else, any other div will do.
the chunk (in the DB) contains a couple of links:



does anybody has an idea where to look further? our local State Office of Criminal Investigation is very interested in to get to know how this hack was done. and me of course, too, ’cause I have a couple of sites running on evo 1.0.4.

thanks in advanced,
rolf

Where is the hacked code? Have you found the source? Have you reviewed the logs to see what kind of activity was going on around the time of the attack? There are several security notices relating to Evolution; please make sure you’ve read them, especially regarding the older AjaxSearch files that are left behind when you upgrade.

I read all the evo-hack-stuff but I didn’t use any plugin mentioned there, respectivly nothing really gives a hint.

and I did not figure out the hacked code, all I’ve got is the source-code snippet (the page is down actually cause google has banned it) and several dozens of modx files form early august.

I think I found the reason, but I can’t figure out how and by whom the file was "untouched":

in /manager/includes/protect.inc.php
I found a very long base64-encode line with a evil eval at the beginning:



that leds to some code that is doing alternativly curl or http get to china http://gcounter.cn/info.php
maybe that’s still the top of the iceberg (it has to be implemented to that file...) I think this topic can be closed.

oh, by the way: the original size of ptotect.inc.php is 1593 bytes, my chinese fortune cookie weights 6074 bytes.

That means somebody had your FTP password (maybe your Windows machine has a keylogger or some other nasty?) or the entire server is compromised.

doah, I’m on a mac!
okay, I know there are keyloggers, too...

if someone has caught the password, the file timestamp would be changed, but, and that might be the reason ssh was activated with the ftp credentials
if the whole server is compromised, one of germanys biggest provider and hoster for normal webspace and services has a very huge problem, I think.
but I give them a hint, maybe they’ve some logfile entries out of my reach.

last but not least, I’ve to check if there is a hint in the code why the exploit comes into that special div...
otherwise there might be some other vulnerabilities...

Check last modify time of this file and then go to web server’s log and find what urls were accessed at this time.
If you have access to ftp logs, check it to.

it’s not my server, its just a hosted service for the schools webseite. I asked the provider to deliver me the logs, hope that give’s a hint.

the file itself has the same timestamp than the others around after uploading them.

I am pretty sure my site also got hacked in some way, when i enter my username and password from the manger login screen, I get an Ajax window that opens up with all spam like web addresses in some choppy HTML code.

Does anyone know what I could do to fix this?

Quite a number of large hosting providers have been hacked recently, with thousands of sites defaced or in some cases completely deleted.

http://tech.slashdot.org/story/11/10/01/1724219/web-hosts-one-stop-shops-for-mass-hacking