Malicious Snippet Hack found in Modx 1.0.4

Hey there,
We discovered an alarming hack on our Modx site today. It appears to be the common shell script in base64 pharmacy upload thing except that the shell script was installed as a snippet and a snippet call to the script was left on two page templates. One of the templates was created within the last month and a half so the exploit is fairly recent. We just updated to 1.0.4 Evo.

We don’t see any evidence that the shell script was used. Has anyone else seen anything like this? This is troubling because it seems to imply an understanding of how Modx snippets work in order to function. Human hack?

Any information would be welcome.

Jonathan Pierce

How did such a snippet get installed? Somebody must have had access to either your manager or your database.

My thought as well. Can you review the system events/activities log to see what took place and when with the snippet?
MattC

Sorry to be slow responding. I traced the malicious snippet back as far as late April in the logs. There was a string of updates to the snippet but no creation date for it. We have no evidence the snippet was used to upload anything. The pace of updates has a sort of "human" quality (several minutes between changes) but uses the default admin identity. We’re keeping an eye on activity. I maintain the website for a college and it’s possible a student could have done this, though we’ve never had that happen before.

If I learn anything more. I’ll surely pass it on.

jp

It seems likely that someone got your Manager password somehow (or someone forgot to log out on a public computer). If the password is simple, it may have been a brute-force attack or the database could be compromised and the hacker broke the MD5 for the admin password. It could also be a key-logging trojan on the personal machine of an admin user. I think the last one is the most likely.

Change your admin passwords, and make them something interesting that won’t be easily "guessed". A good trick is to take the hash from the database and put it in Google. If it comes back with a results, then it’s not such a good password.

looks like db hack in that case there is no admin accound password needed to add snippet and change templates, all can be done in the database itself, so check if its maybe a shared database or maybe there is a user without a password (installing mysql in wamp or lamp will not require a password for root sometimes).

Dimmy

If there wasn’t a creation date for the Snippet, to me that implies that the Snippet was added from someplace OUTSIDE the manager, e.g. from the sql command line or from phpMyAdmin etc. The manager_log table does not rely on MySQL to automatically generate a timestamp -- it relies on the manager to feed it a valid integer representing a date and time (as opposed to a column definition that included ’timestamp DEFAULT CURRENT_TIMESTAMP’).

What kind of access does your host have to your database? Can anyone log into phpMyAdmin? Is there shell access?