We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 36582
    • 463 Posts
    This was in the root of a website I was asked to clean up. I was surprised to see cgi-bin in there and even more surprised to see 3 gifs in there. I don't think it is a modx issue as - more to do with the server or FTP compromise.

    I found the files by doing SSH search for files changed in the last 10 / 20/ 30 / 60 days. Opened up the gifs in a text editor and it was plain to see they were infected.

    There were also .php files with chmod 200.
      Web site design in Nottingham UK by Chris Fickling http://www.chrisficklingdesign.co.uk
      • 26931
      • 2,314 Posts
      just found another altered JS file in another (outside of the MODX installation) folder (root)
        • 26931
        • 2,314 Posts
        as well as a GIF (i.gif) file which was referenced in another JS file

        /*
        Copyright (C) 2000 Free Software Foundation, Inc. See LICENSE.txt
        */function MM_swapImgRestore() { //v3.0
        	if(isIE6 && typeof(noSwap)!= "undefined" && noSwap === true) return;
        	var i,x,a=document.MM_sr; for(i=0;a&&i<a.length&&(x=a[i])&&x.oSrc;i++) {if(isIE6){x.style.filter=x.oSrc}else{x.src=x.oSrc};}                                                                 
        }                                                                         
        
        function MM_preloadImages() { //v3.0
          var d=document; if(d.images){ if(!d.MM_p) d.MM_p=new Array();
            var i,j=d.MM_p.length,a=MM_preloadImages.arguments; for(i=0; i<a.length; i++)
            if (a[i].indexOf("#")!=0){ d.MM_p[j]=new Image; d.MM_p[j++].src=a[i];}}      
        }                                                                                
        
        function MM_findObj(n, d) { //v4.0
          var p,i,x;  if(!d) d=document; if((p=n.indexOf("?"))>0&&parent.frames.length) {
            d=parent.frames[n.substring(p+1)].document; n=n.substring(0,p);}
          if(!(x=d[n])&&d.all) x=d.all[n]; for (i=0;!x&&i<d.forms.length;i++) x=d.forms[i][n];
          for(i=0;!x&&d.layers&&i<d.layers.length;i++) x=MM_findObj(n,d.layers[i].document);
          if(!x && document.getElementById) x=document.getElementById(n); return x;
        }
        
        function MM_swapImage() { //v3.0
          if(isIE6 && typeof(noSwap)!= "undefined" && noSwap === true) return;
          var i,j=0,x,a=MM_swapImage.arguments; document.MM_sr=new Array; for(i=0;i<(a.length-2);i+=3)
          if ((x=MM_findObj(a[i]))!=null){
                if(isIE6){document.MM_sr[j++]=x;if(!x.oSrc){x.oSrc=x.style.filter;}x.style.filter = "progid:DXImageTransform.Microsoft.AlphaImageLoader(src='"+a[i+2]+"')";
                }else{document.MM_sr[j++]=x; if(!x.oSrc) x.oSrc=x.src; x.src=a[i+2];}
           }
        }
        
        function MM_reloadPage(init) {  //reloads the window if Nav4 resized
          if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) {
            document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }}
          else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload();
        }
        MM_reloadPage(true);
        
        function MM_showHideLayers() { //v3.0
          var i,p,v,obj,args=MM_showHideLayers.arguments;
          for (i=0; i<(args.length-2); i+=3) if ((obj=MM_findObj(args[i]))!=null) { v=args[i+2];
            if (obj.style) { obj=obj.style; v=(v=='show')?'visible':(v='hide')?'hidden':v; }
            obj.visibility=v; }
        }
        
        var isIE = /msie|MSIE/.test(navigator.userAgent);
        var isIE7 = /msie|MSIE 7/.test(navigator.userAgent);
        var isIE8 = /msie|MSIE 8/.test(navigator.userAgent);
        var isIE9 = /msie|MSIE 9/.test(navigator.userAgent);
        var isIE6 = isIE && !isIE7 && !isIE8 && !isIE9;
        function setFilters() {
        	if(isIE6){var imgs=new Array;imgs=document.getElementsByTagName("img");
        		for(var i=0; i<imgs.length; i++){
        			if (imgs[i].name && imgs[i].name != "selectedImage" && imgs[i].src.toLowerCase().match('png$')=='png') {
        				imgs[i].style.filter = "progid:DXImageTransform.Microsoft.AlphaImageLoader(src='"+imgs[i].src+"')";
                        imgs[i].src = 'images/i.gif'
        			}
            	}
        	}
        }
        
        if(window.onload) {var temp=window.onload;window.onload=function(e) {setFilters();temp(e);};
        }else{window.onload=function(e) {setFilters();};}
        
        function setCounter(value){
        	document.getElementById('textcounter_value').firstChild.nodeValue = value;
        }
          • 26931
          • 2,314 Posts
          btw. is it possible that I infected my computer by downloading & checking those files?
            • 26931
            • 2,314 Posts
            thanks btw
              • 36582
              • 463 Posts
              I honestly wouldn't know if they pose a local risk.
                Web site design in Nottingham UK by Chris Fickling http://www.chrisficklingdesign.co.uk
                • 26931
                • 2,314 Posts
                btw. does anyone know if this could be related to the current Shellshock / Bash vulnerabilit?
                http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/
                  • 9995
                  • 1,613 Posts
                  I don't know.
                  But thanks for pointing that out, I mailed this link to my host. They closed the leak last week thow.
                  http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/

                    Evolution user, I like the back-end speed and simplicity smiley
                  • Hi Sharkbait,

                    Sorry for your troubles! In my recent experience with this, besides the malicious php files, they had also compromised records in the DB in the form of a bogus plugin or snippet that had been added. Look for a plugin or snippet in the db that you don't see in the manager. Or, if you do a search for base64 you might find some records that need to be deleted...

                    They had also made themselves an admin user account, so look for one called "Support" or similar.
                      Lucy Iannotti
                      Following Sea design & development
                      http://www.following-sea.com
                      New Bedford, MA
                      • 26931
                      • 2,314 Posts
                      Hi Lucy,

                      thanks

                      did a db search already but found no hints.
                      will look for hidden plugins

                      pretty nifty hack, hey wink

                      cheers, j