My modx site got hacked (modx 1.0.5)

Take that link down -- you probably don't want people seeing that. If you got backdoored (as those payloads suggest), you may need to reinstall your entire OS... if your hosting provider isn't in the loop here, now might be the time.

As you suggested I have taken the link down and just left the file names.

I am on a shared hosting, I informed the provider already.

Yeah, that payload was nasty -- that's attempting to hack the OS, not just the site: it downloads a root exploit and compiles it. This could give your hosting company a run for their money.

The first payload gives the attacker a couple simple file browsers: http://www.screencast.com/t/tX63ZIV9yLI
and http://www.screencast.com/t/vplGajtyZ

From there they can upload other payloads or edit/delete your files. The nastier payload was a hack against the OS, including several possible exploits. See it in action: http://www.youtube.com/watch?v=jt81NvaOj5Y

Hope your webhost isn't running an vulnerable version of their OS. [ed. note: Everettg_99 last edited this post 13 years, 2 months ago.]

Do you think this is a bot or a human being doing the hack?
The malicious files were put arbitrary in folders, it seems to me at least.

I still wonder what the motivation is to break-in into a free first aid site which has an Alexa rank of less then 10 000 000 (!), and then intrude a free maths forum...


PS: I assume there are many modx installations that have already been intruded. After Evo v1.0.5 (Jan 2011) it took more than a year for the next update v1.0.6 (March 2012), and I guess a lot of developers do not follow the Security RSS that is given in the manager panel (kind of hidden under >Tools >Configuration): http://feeds.feedburner.com/modxsecurity [ed. note: kajus99 last edited this post 13 years, 2 months ago.]

Who knows. This looks like it was a person, honestly: from your logs, it looks like they used some automated tools to find the vulnerability, but after that, it was clicky-click-click to have fun at your expense. Who knows why... boredom? Amusement? This isn't the nastiest motive though... worse would be a genuine malicious hacker, dedicated to defacing you or your company. And this one was at least obvious -- not very subtle. Seems like maybe he/she just wanted another notch in their belt, another trophy to take home. Worse would be the lurkers... someone who gets in and just watches... and waits... without you knowing it. You gotta have some humility with these guys: if someone is dedicated enough, they can bone you.

Thanks a lot for your help!

The hacker left a file "enlightenment.tgz with a "funny" picture of being hacked. So I guess you were more than right when saying:

Live and learn

If they can get files onto your system, then the server can be part of a botnet. There's a lot of money to be made supplying major spammers and hackers with compromised servers as part of an entire network.