HACKED! Any ideas on how to recover? Password recovery?

jmthorpe.com was hacked. How does one fix this?

I can’t login to the manager, but I do still have control over the database. Is that where the login info is stored? Thanks!

Yes. It’s the manager_users table. Make sure you apply the md5 function to the new password you set.

Can we have more information on the hack? Modx version, server type, what happened?

If I recall correctly, that was compromised around Nov 24th ... I’m fairly certain it’s 0921 with register_globals On.

If you have a backup of your database ( made thru the modx manager) you can recover your password fairly easy.

Look for the statements concerning the table ’manager_users’ and cut and paste these into a new text file.

Log into phpMyAdmin provided by your webhost and import this text file into your database.

One of my modx sites was hacked too and a few days later in turned out they had hidden a fake web-banking ( halifax.co.uk something) site in my webspace. I wasn’t aware of this until I received an email from a netizen, so beware!

Quote from: sottwell at Dec 07, 2006, 01:42 AM

Yes. It’s the manager_users table. Make sure you apply the md5 function to the new password you set.

Can we have more information on the hack? Modx version, server type, what happened?

So I went into the manager_users table and changed the password for my login, but i still get an "incorrect username or password" message. What can be done?

Another option is to upgrade to 0.9.5 and use the (new) forgot password function on the manager login. You’ll make sure to follow the unblocking manager user tutorial too to make sure you can login: http://modxcms.com/forums/index.php/topic,275.0.html

The side benefit of this is that you can replace your manager folder with a known-clean one, and any assets folders too. Just leaves things (most likely) like your images and site folders to thoroughly review for nefarious extra files/folders.

Quote from: rthrash at Dec 07, 2006, 08:40 AM

Another option is to upgrade to 0.9.5 and use the (new) forgot password function on the manager login. You’ll make sure to follow the unblocking manager user tutorial too to make sure you can login: http://modxcms.com/forums/index.php/topic,275.0.html

The side benefit of this is that you can replace your manager folder with a known-clean one, and any assets folders too. Just leaves things (most likely) like your images and site folders to thoroughly review for nefarious extra files/folders.

That’s definitely the way to go. That way you’ll kill two birds with one stone. If I were you, I’d also download everything on the site to make a local backup, delete everything on the server, and then only upload the things that you know for sure are yours before doing the upgrade (there are probably things hidden in your assets folder now that do things you don’t want done).

Oh, and you should still set register_globals to OFF (search the forums and php.net for more info)...

Quote from: ZAP at Dec 07, 2006, 09:55 AM

Quote from: rthrash at Dec 07, 2006, 08:40 AM

Another option is to upgrade to 0.9.5 and use the (new) forgot password function on the manager login. You’ll make sure to follow the unblocking manager user tutorial too to make sure you can login: http://modxcms.com/forums/index.php/topic,275.0.html

The side benefit of this is that you can replace your manager folder with a known-clean one, and any assets folders too. Just leaves things (most likely) like your images and site folders to thoroughly review for nefarious extra files/folders.

That’s definitely the way to go. That way you’ll kill two birds with one stone. If I were you, I’d also download everything on the site to make a local backup, delete everything on the server, and then only upload the things that you know for sure are yours before doing the upgrade (there are probably things hidden in your assets folder now that do things you don’t want done).

Oh, and you should still set register_globals to OFF (search the forums and php.net for more info)...

I’m definitely going this route. Thanks for opening my eyes to this great solution.

Also, how does one create a new admin account without having access to the manager, perhaps using phpmyadmin and such? I think all of the current accounts on this manager are not going to allow me to login.

So, the upgrade went smoothly and the site is now back up and live. The only problem at this point is that none of the logins work. They’re all incorrect usernames and passwords now. I edited the modx_manager_users table with new passwords encrypted MD5 and still can’t login. What am I missing? Any ideas? Thanks!