We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Sites Be Gettin' Hacked!

    • 23849
    • 223 Posts
    thefutureforward Reply #1, 15 years, 8 months ago
    Hi All,

    Just recently, I had 2 sites get attacked. One was an Evo 1.0.4 install, the other an Evo 1.0.5 install.

    What happens is, the templates I’ve setup on the sites get the following code (or something similar) injected into them, usually right before the </body> tag:

    <div style="display:none;">
<a href="http://brnckvvtmllttrhaberimatbaa.blogspot.com" title="yabancı film izle">yabancı film izle</a>
<a href="http://www.birfilmizle.com" title="dizi">dizi</a>
<a href="http://www.cizgifilmizlex.com" title="izlesene">izlesene</a>
<a href="http://iddaekip.blogspot.com" title="iddaa">kaliteli diziler</a>
<a href="http://www.yerlifilmizle.com" title="film izle">film izle</a>
<a href="http://www.laledevridizisi.net" title="dizi izle">dizi izle</a>
<a href="http://www.dizievi.com" title="dizi izle">dizi izle</a>
<a href="http://www.kelebekfm.net" title="film izle">film izle</a>
<a href="http://www.yergokask.org" title="yer gök aşk">yer gök aşk</a>
<a href="http://www.sonbolumizle.org" title="dizi izle">dizi izle</a>
<a href="http://www.nettefilm.net" title="film izle">film izle</a>
</div>


    I’ve taken all the usual pre-cautionary measures (changed passwords, backed up sites and updated to 1.0.5 on the the 1.0.4 install), but I was just wondering if anyone had any ideas why this occurred. SQL injection perhaps?

    Any thoughts would be much appreciated. Thanks all!
      Nick Hoag
      Creative Partner
      The FutureForward

      http://thefutureforward.com
      • 12372
      • 44 Posts
      hostile17 Reply #2, 15 years, 8 months ago
      1.05 fixed a mySQL injection vulnerability, so I would say that’s probably it.
        • 23849
        • 223 Posts
        thefutureforward Reply #3, 15 years, 8 months ago
        Hey hostile,

        I just realized that the 1.0.4 site that got attacked actually had that code injected directly into the index.php file.

        Pretty weird!
          Nick Hoag
          Creative Partner
          The FutureForward

          http://thefutureforward.com
          • 15162
          • 59 Posts
          JX3 Reply #4, 15 years, 8 months ago
          Could it be Gumblar? My site, or my computer, had an infection. Basically the virus downloads files from your server through FTP, modifies them and re-uploads them. It usually goes for the index files. It only put one URL on my index pages and I think I didn’t have them wrapped with an anchor tag, but it may still be a virus of some kind. You should check the computers that connect to your site via FTP.
            • 12372
            • 44 Posts
            hostile17 Reply #5, 15 years, 8 months ago
            I had an issue like JX3, where index filse were being attacked, but that was via an exploit in the turd that is OpenX!

            This is the trouble... so many options.

            The way I tracked down my security hole was look at access logs at the time of modification, see if you can pinpoint the actual visit... then go back in the logs for the same IP address. See where they headed to first. (Assuming it came from the web, and not via FTP.)
              • 23849
              • 223 Posts
              thefutureforward Reply #6, 15 years, 8 months ago
              Awesome, thanks for the info guys. I’ll take a look into it and see what I find!
                Nick Hoag
                Creative Partner
                The FutureForward

                http://thefutureforward.com
                • 18373 ☆ A M B ☆
                • 3,141 Posts
                Mark Hamstra Reply #7, 15 years, 8 months ago
                A site I moved over to MODX had that (before MODX) in its index file, too. I guess the client never knew about it untill I found it in the source code, but if it’s being added to the index file (base64?) I doubt it’s a hole in MODX.

                Do let us know what you find out though - security is very important.
                  Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

                  Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.