Site hacked and Folder permissions 777

I've just had a site hacked where a file 'safe.php' was uploaded to the web root and contains some scripts including the line 'Dragoc Private Safe Mode Command Execution Bypass Exploit'.

So far the only damage I can see it has done is to rename my .htaccess files to .1htaccess thereby disabling them.

I'm not sure how the hacker got in but from the sefver logs I can see they ran a POST script and I'm assuming they used the folders with 777 permissions.

My question is do I need 777. For example the core/cache folder is 777. If I change it to 755 the system still works and I can see the caches being created. However the manager Home screen warns

"One or more configuration details didn't check out OK: Configuration warning: cache directory not writable"

Should the folder be 777 or is the manager giving an invalid warning.

After I've got this working I'm going to move the core folder above root!

Thanks

You need to provide at least what version of MODX you are using in order for us to help you.

Revolution modx-2.2.0-pl2

Actually I've just found out it is was a plesk vulnerability http://kb.parallels.com/en/113321

But I'm interested in the 755 answer anyway.

Thanks