[SOLVED] Hacked! Urgent help needed

Hey guys

This morning a not so happy client of mine called me with this http://ziestha.dk

What should I do now?

Here is a quick screenie of the server, everything ’looks’ normal to me..

Take a look at the index.php file, and the /manager/includes/config.inc.php file. It is a common practice that if a hacker can break in to a server to change those files.

It most likely has nothing to do with MODx, but rather a breach of security on the server itself allowing the hacker to access the files and rewrite them, probably with root access permissions.

Hey Susan

Was just about to PM you when I saw you answer, thanks alot
The config.inc.php file looks normal to me. At least the username, passwd, DB and prefix is still the same as before. The /index.php and /manager/index.php however have both been replaced with the hackers, as seen on http://ziestha.dk.
I went to phpMyAdmin and everything there ’looked’ ok to me as well.
I wonder if I have just been unlucky or if this is because of those stupid Muhammed drawings that some Danish news people decided to re-print once again. Back when they were first printed, thousands of Danish sites were hacked..
Anyways, can I just replace the /index.php and /manager/index.php with the originals and then everything is well? Or will it just get hacked again?

Try just replacing them, then change their permissions to read-only (not even owner can write). These script kiddie scripts usually don’t go to the trouble of changing permissions, even if they do get root access to the server. I would also have some rather unkind things to say to my hosting company about their server security.

Yea, speaking of the hosting provider I just called their ’alarm-service’. The owner of the company answered and just told me to make a support ticket (which I had of course already done) and then they would have a look at it later. In his opinion it was the cms that I was using that was not secure.. so bye bye http://i123.dk
My client has asked me to find any hosting provider where this kind of thing won’t happen, regardless of the price. So if anyone has some good suggestions I’m all ears..
About hacked site, Im gonna try and replace the two corrupted index.php files now, and then lets see what happens..

Thanks for the quick replies Susan

I rather imagine this was just a script-kiddie script that scans for index.* files and replaces them. If you check out the various folders (such as assets/snippets or assets/cache) that have index.html files in them to prevent directory listing in poorly-configured server environments, they are all hacked as well.

I downloaded the latest modx version, uploaded it and merged it with the other files on the server. Then I did an upgrade install. Now everything seems to be back to normal again.

Thanks for helping me out.

-larsb

Yes, but the server itself is still compromised, so it’s liable to happen again, especially since the hosting support doesn’t seem inclined to take responsibility for their server security.

Make sure to change your passwords (FTP, server control panel and MODx users).

Just to round this up..
I finally received an answer to my support ticket:

Hej larsb,

Vi genopretter dit site fra fredagens backup. hvis du stadig oplever fejl så skriv tilbage, husk at det er dit ansvar at der ikke ligger scripts på dit webhotel som kan misbruges og at du selv har en backup af dit site.

Which basically means:

We will restore your site from the backup made Friday. If you are still experiencing errors please reply. Remember that it is your responsibility not to have scripts on your web hotel that can be exploited and that you have your own backup of your site.

This reply came just now, about 5 hours after I solved the issue myself with the help of you guys

Anyways, I’m gonna find a new provider no matter what. Have been looking at site5, which ScottyDelicious has said some nice things about (http://modxcms.com/forums/index.php?topic=4702.5;wap2).

Thanks for all the help everyone. Backups have been made and passwords changed.

-larsb