Answered MODx 2.2.6 Manager Not Working Correctly. Missing Items & Blank Pages. OMG!

right: so I can manually type in the new password then?

as for base 64 in modresponse.php, I downloaded and searched for base64 and found nothing. Also scouring the doc visually for a random strings of characters and don't see anything.

Quote from: BobRay at Jul 22, 2014, 01:07 AM

Quote from: mmcgee at Jul 22, 2014, 12:52 AM

One silly question: If I change the Database password — how do I get it changed in modx? Is that in the system settings?

It's in the core/config/config.inc.php file.

Quote from: mmcgee at Jul 22, 2014, 12:55 AM

In my assets directory there is:
.cache.idx.php
cache.php
xPDO.idx.php

Are all 3 of these bad?

I don't have any .php files in the assets folder of my 2.2.13 install. I don't have a 2.3 install to look at, but I think they're suspect.

Take a look at the contents for any lines that contain @eval or base64_decode.

The base64_decode lines will contain something like this:

$v = base64_decode('alkjlkjelkjsaslkjaslkjljasd ... ');

About your non-MODX sites: they're probably safe, but I would at least change the usernames and passwords and look around for any suspicious .php files or suspicious users.

It was tricky changing my modx admin password. Screen kept going blank.

I'm updating all of my hosting ftp, database info now.

What about those two cache idx files? I changed their names? Perhaps those were other attempts to hack?

It was tricky changing my modx admin password. Screen kept going blank. I did a search for "base64" and found nothing. Also not seeing any gibberish code like that.

I'm updating all of my hosting ftp, database info now.

What about those two cache idx files? I changed their names? Perhaps those were other attempts to hack?

The other two cache files I found in the assets directory did contain base64 code, so I deleted them.

It's possible. If you want to PM me their contents, I can tell you if they look suspicious. Hackers usually try to leave several back doors in a site they hack so they can get in again if the user deletes some of their work.

AFAIK, MODX doesn't put anything at all in the assets folder. Stuff there is all accessible directly via URL.

You might want to look around in the site root and the assets folder for any other suspicious PHP files.

Also, check the index.php file in the site root for any base64_decode or @eval lines.

I really appreciate your assistance tonight. I'm waiting for the FTP password change to update on the server. I've updated the database password in the config.inc.php.

What about ftp user and password. Is that in system settings?

index.php is all clear. no bas64. no @eval.

No, the FTP credentials would be strictly in cPanel.