Hacked websites? - Any way to salvage them?

Hi all,

I have a bad feeling that two of our websites have been hacked. I suspect they are both on the same server and somebody got into them somehow. Needless to say, it this turns out to be a hack we are going to follow MODx's Hardening procedures for our next websites. Our other websites don't look like they've been compromised though. It's possible they're on different servers, or just different versions of MODx..?

Anyway, I was wondering if there is any way to salvage them? We can't access the manager because it says it doesn't recognize the user. But thankfully I can access cPanel and the content is still there (at first glance). What's confusing is that the users exist in the '_users' table, so it's not like they've been deleted. I'm going to investigate further on Monday, but it's not going to bode well for my weekend!

I was just wondering if this sounds familiar to anybody?

- Front End is broken. GetResources lists aren't spitting anything out.
- CSS styles aren't showing on one website
- Users can't log into manager using the manager login window
- Once cache is cleared manually (core/cache) then you get shown the big, red MODx 500 Error
- cPanel still accessible

Hello,

Could you tell us more about your hosting environment (Shared hosting or your own server?), and what version(s) of MODX you are running? Depending on the factors in play recovering a hacked MODX site isn't difficult.

Hi AMDbuilder

We've done some more investigating and still haven't figured out the problem.

We've restored one of the websites to a former backup (files and SQL) but the issue still persists?? I'm thinking it may not be a hack...but some server configuration update that the server provider won't own up to? But what seriously concerns me most is that we can't access the manager at all.

The following information is from one of the websites:

• MODX 2.1.3
• Shared hosting - All three websites on that server are down. Two other websites on a completely other server still completely fine
• Unfortunately, I can't access my cPanel from our studio all of a sudden (not my day today) so I can't give you any other details

What the heck does this sound like to you? I realize this is not enough information...

Sar

Hello,

It would be helpful to have additional information, but what you have provided thus far points towards a server configuration issue. I know most providers aren't be fans of owning up to their own issues, which usually center around highly restrictive configurations.

You might try one of the sites on a different server. I have a feeling they might work fine, it's just some new policy on the one server breaking things.

You're probably right. The more I think about it, the more I think it's a server issue. But then the moment you speak to the server provider, they're like 'Nope' and I'm back at square one.

Our client (bless his little heart, he's been patient through all of this) pointed out that our Piwik installation throws up this error:



So I've passed this on to our provider. Let's see if that steers them in the right direction. Otherwise, I'll ask them to pop our website on another server, coz it's not fun at all having a website down for as long as we have.

I would be a little concerned if your provider failed to install the mysql driver, that's fairly basic in my book (and the first thing I test post reconfiguration).

If you need a MODX friendly server while they get things figured out, I'd be happy to hook you up.

Okay...maybe this will help someone else....

Our server provider saw that we were missing vital directives. More specifically, the following:


So they put a php.ini file in our root folder with the above information, and the sites have popped back up. They're saying that somebody must have deleted the php.ini files across all websites. But THREE different websites? That does not make any sense to me. Our design team didn't touch them, our client certainly didn't touch them, and the server provider is saying that they didn't touch them.

[b]But now...[b]

Our client's keep getting logged out of the manager. Everytime they go to save something, it crashes. I think they're losing their patience :S So I added some session directives in the php.ini file but that didn't seem to do anything.

Overall, I have a feeling something changed on the server, but the server provider is oblivious to it or they won't own up to it.


Quote from: AMDbuilder at May 13, 2013, 04:24 AM

If you need a MODX friendly server while they get things figured out, I'd be happy to hook you up.

AMDbuilder, what can we do to ensure this doesn't happen? Do you recommend moving to a MODx friendly environment? What's the difference? We have some websites lined up to build and I would hate for this to happen again.

Sar

I didn't mention...I don't even SEE a php.ini file in previous back ups of the websites, but they worked fine! It was never there to begin with.

I would strongly recommend changing hosting providers based on the above information. It sounds like there are some major configuration issues with the server.

Typically the only time you would need to add those lines is if you are changing the server php.ini, and in that case you would typically copy the entire server php.ini file.

The php.ini file would have been in your backups prior to this instance so something has definitely changed with the configuration.

Quote from: AMDbuilder at May 14, 2013, 10:30 PM

I would strongly recommend changing hosting providers based on the above information. It sounds like there are some major configuration issues with the server.

Typically the only time you would need to add those lines is if you are changing the server php.ini, and in that case you would typically copy the entire server php.ini file.

The php.ini file would have been in your backups prior to this instance so something has definitely changed with the configuration.

Is there absolutely any other way those extensions could have been removed? I want to know for sure since I have to go back to the server provider and tell them for CERTAIN that the server's php.ini file is the reason for this problem since we've never had a php.ini file in our site's root to begin with.

The server provider is adamant they haven't made any changes. So what else could it be?