Modx 1.03 site hacked, please help!

Hi guys

Our modx 1.03 site has been hacked, clearly we should have upgraded to the latest version and now we are paying the price.....

The hack is only showing when you view the site as googlebot, our page also shows up in google with a spammy ’windows OEM software’ title and meta conent, completely unrelated to our site.

The problem is our hosting company can’t tell us what files have been affected or when this happened.

What course of action should we take? Ideally we would route out the malicious code and then upgrade?

Does anybody have any knowledge of this specific vulnerability?

Hoping someone in the modx community can help!

You might want to check this thread to see if the hack is similar
http://modxcms.com/forums/index.php/topic,52543.0.html

In short, I’d be inclined to look first at these files for anything weird (like the base64 code ref’d above) and remove it:
index.php,
manager/includes/protect.inc.php,
manager/includes/config.inc.php,
manager/includes/document.parser.class.inc.php,
as well as the .htaccess files.

That still won’t tell you if any new files have been introduced, though.
Matt

The proper way to ensure there is no malicious code would be to restore the whole site from a recent backup, including the database. Do you have a backup of the site? Can the hosting company provide you with a recent one?

Assuming that does not work out for you could copy the sites files locally, download a clean modx 1.03 install and run a files and directory comparison between the hacked site files and the clean install. Look for changed core files (as the previous poster suggested) and anything else that seems out of place, php files in the images directory for example.
You should also download a textual snapshot of the database and try and see if there is no suspicious code in there.

Thanks guys

looking inside the .htaccess and comparing it with an older version shows the following extra code:




I am no expert but presuming this also means our sitemap.php has been altered and links to the spam links.

Hoping that removing these 2 files and updating to modx 1.05 should fix this and stop this from happening again.

I don’t think so; that looks like valid directives to provide the sitemap links for Google and friends.

Just an update for anybody interested....

Our hosting company came back to us and it seems that they got in through phpthumb, they then created a file called wso2.php which is a shell script giving them access to all files, from there they created entries in .htaccess and the created the file sitemap.php......

I have followed the advice about securing php thumb on this thread: http://modxcms.com/forums/index.php/topic,54874.msg316279.html#msg316279

Ah. Well, I suppose I can’t be right all the time Glad you got it figured out, and your explanation of what happened can be helpful to anyone else who finds themselves in the same situation.