have I been hacked?

Making the index.php and config.inc.php files read-only can help against hacking by bot scripts that get into the server. Of course if a hacker gets root access to the server then you have even bigger problems.

Thanks Bobray, thats very insightful. You mention it does not look modx-targeted, but it attacked and altered the manager login file in assets/templates/manager/login.html, which I would have thought was pretty deeply buried and also very specific to modx?

I'm no expert on permissions, but to alter a file with a 644 or even 755 permission surely the attacker must have gained access to the server (via ftp?) as only the owner can alter files with these permissions correct? This can this be done through a form injection correct? - I remember there was mention of old ajaxSearch scripts being susceptible to hackers? Are there any other ways a hacker can alter a file with owner-only write permissions?

Quote from: wdnz at Apr 03, 2012, 09:14 PM

Thanks Bobray, thats very insightful. You mention it does not look modx-targeted, but it attacked and altered the manager login file in assets/templates/manager/login.html, which I would have thought was pretty deeply buried and also very specific to modx?

Possibly, but almost every site has an index.* and login.* file and it's not that difficult to do a recursive search for them. I see it in my "page-not-found" log all the time.


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

just to clarify, per the hosting company the site was hacked due to weak ftp password. the breach wasn't related to modx.
thanks everyone for the replies.