Can't log into Manager - Seems to be in a "loop"??

☆ A M B ☆
120 Posts

inTandem Reply #1, 14 years, 6 months ago

Everything worked fine with an existing Evo site. My client just contacted me and she cannot log back into the manager. Neither can I. This is her emal letting me know what happened:

"This started earlier today when I was logged on to the website. The page was open in the new website main gallery. I did not edit or change anything. After I hit logout the page started 'wobbling' as if it was sending a message to the server but not actually doing anything. I left it to close by itself. This evening when I went to log back in I'm getting the same wobble from the link. I'm not even getting as far as the login page now. "

I am currently building a new site for the client within the same MODX install. The last thing I did yesterday is work with MaxiGallery and create some new pages that are displaying a MaxiGallery that is being managed by an old page. It all worked fine when I was working with it yesterday. I only made changes to the smoothgallery css file within the MaxiGallery snippet files. However, I did not log out of the manager. Unfortunately, I after receiving my client's email, I also logged out to see if I could replicate the problem and am now also stuck.

Does anybody have any idea what could be causing this? Take a look at http://www.sligolive.ie/manager to see the "symptoms".

Thanks for your help!

☆ A M B ☆
3,141 Posts

Mark Hamstra Reply #2, 14 years, 6 months ago

Your site has been comprimised.

Open http://www.slig olive.ie/manager/media/script/mootools/mootools.js and get rid of this stuff at the bottom: http://markh.nl/s/cl/k2C.png

Can't hurt to go through your server to find any files which are world writable (777) and limiting access to those.

If you're not on 106 you definitely want to make sure you are, though from the exploits I've seen it's more common that hacks like these are executed by world writable files throughout the file system.

Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.

☆ A M B ☆
120 Posts

inTandem Reply #3, 14 years, 6 months ago

Thanks for your super-quick reply! Am actually in the process up doing a backup so that I can upgrade to 1.0.6!

☆ A M B ☆
3,141 Posts

Mark Hamstra Reply #4, 14 years, 6 months ago

Make sure you don't backup the exploited code. wink

I'd backup everything as is. Start searching for exploits like that (also check .htaccess files and php files for similar code) and remove them.

Backup again and kill the older backup with fire.

Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.

☆ A M B ☆
120 Posts

inTandem Reply #5, 14 years, 6 months ago

Have done a search for files that contain "document.write" and it's come up with a number of page cache files, ie. docid_123.pageCache.php. At the beginning of these files, it has the following code:

<?php die('Unauthorized access.'); ?>a:42:{s:2:"id";s:3:"519";s:4:"type";s:8:"document";s:11:"contentType";s:9:"text/html";s:9:"pagetitle";s:16:"Festival Posters";s:9:"longtitle";s:16:"Festival Posters";s:11:"description";s:16:"Festival Posters";s:5:"alias";s:17:"festival-posters1";s:15:"link_attributes";s:0:"";s:9:"published";s:1:"1";s:8:"pub_date";s:1:"0";s:10:"unpub_date";s:1:"0";s:6:"parent";s:3:"506";s:8:"isfolder";s:1:"0";s:9:"introtext";s:55:"A gallery of Sligo Live Posters since it began in 2005 ";s:7:"content";s:39:"<h1>Sligo Live Posters since 2005.</h1>";s:8:"richtext";s:1:"1";s:8:"template";s:2:"26";s:9:"menuindex";s:1:"4";s:10:"searchable";s:1:"1";s:9:"cacheable";s:1:"1";s:9:"createdby";s:1:"2";s:9:"createdon";s:10:"1332774903";s:8:"editedby";s:1:"2";s:8:"editedon";s:10:"1332787257";s:7:"deleted";s:1:"0";s:9:"deletedon";s:1:"0";s:9:"deletedby";s:1:"0";s:11:"publishedon";s:10:"1332775029";s:11:"publishedby";s:1:"2";s:9:"menutitle";s:16:"Festival Posters";s:7:"donthit";s:1:"0";s:11:"haskeywords";s:1:"0";s:11:"hasmetatags";s:1:"0";s:10:"privateweb";s:1:"0";s:10:"privatemgr";s:1:"0";s:13:"content_dispo";s:1:"0";s:8:"hidemenu";s:1:"0";s:16:"meta-description";a:5:{i:0;s:16:"meta-description";i:1;s:312:"Ireland's folk, roots and indie festival returns for a seventh year. Fans will be delighted to hear that Elvis Costello, KT Tunstall & Hayseed Dixie are among the headliners. Sligo town hosts traditional sessions with the best of the globe Irish Traditional Musicians and free concerts in cafe's across the town.";i:2;s:0:"";i:3;s:0:"";i:4;s:4:"text";}s:19:"NEW-content-sidebar";a:5:{i:0;s:19:"NEW-content-sidebar";i:1;s:13:"@DOCUMENT 452";i:2;s:0:"";i:3;s:0:"";i:4;s:4:"text";}s:21:"NEW-manage-gallery-id";a:5:{i:0;s:21:"NEW-manage-gallery-id";i:1;s:3:"444";i:2;s:0:"";i:3;s:0:"";i:4;s:4:"text";}s:17:"__MODxSJScripts__";a:1:{i:1;s:271:"<link rel="stylesheet" media="all" type="text/css" href="assets/snippets/wayfinder/examples/cssplay/dropdown.css" />
	<!--[if lte IE 6]>
	<link rel="stylesheet" media="all" type="text/css" href="assets/snippets/wayfinder/examples/cssplay/dropdown_ie.css" />
	<![endif]-->";}s:17:"__MODxDocGroups__";s:0:"";}<!--__MODxCacheSpliter__--><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

After the <head> tag above, it continues with the normal code of the page.

Does this indicate a problem, seeing that it mentions unauthorised access???

Amendment: Just checked and it seems like all the pageCache files start with this kind of code ... the fact that the ones above were picked up is just random as they include some valid script code with document.write in it in their templates. [ed. note: intandem last edited this post 14 years, 6 months ago.]

☆ A M B ☆
3,141 Posts

Mark Hamstra Reply #6, 14 years, 6 months ago

Not well-versed enough in Evo to say if that's how the cache file should look or not, sorry!

Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.

☆ A M B ☆
2,213 Posts

AMDbuilder Reply #7, 14 years, 6 months ago

The quickest method to restore an Evolution site is to install a new copy. Then switch out the database for yours, and upload the custom snippets, plugins, and modules (along with the site template and content).

It takes about a hour or two to be back up and running using that method depending on how much custom stuff you have running.

Patrick | Server Wrangler
About Me: Website | Tweets | MODX Hosting