MODX Evo(s) hacked, sending out SPAM and upgrading it to latest MODX Evo version does not resolve the issue

I've got a new client on a shared hosting account with a standard LAMP setup. The previous dev put a large amount of MODX Evo sites with this hosting company on their shared hosting package and they've all been getting compromised lately. They're running MODX Evo 1.0.8 (or a version close to that number).

The hosting company has pointed out the sites are sending out SPAM. I logged onto the server and noticed that the server has to have permissions of "777" on the directories where you need to upload files in the CMS (i.e. assets/images, assets/files, etc.). As such, we upgraded a few of the sites and removed the suspicious .php files I found in those folders but wasn't sure how they got in to those directories in the first place. After the upgrade to MODX Evo 1.0.15 (the newest at this writing), the hosting company still is telling us that the sites are sending out SPAM even though I don't see the suspicious .php files that once were in these directories.

Is this a known issue in the MODX community regarding Evo? And if so, is there any known fixes to repair the db (assuming the db is compromised)? Or are more aggressive approaches needed to resolve the issue? I haven't had to deal with these types of problems in the past b/c I've typically stayed ahead of the problem by keeping my MODX sites upgraded to the newest versions when patches came out. My initial guess is a problem at the hosting level, but wasn't sure before we recommend the client abandon the hosting if there were an easier solution to patch up this issue beyond just an upgrade.

Check the Manager Users for odd users. Check your plugins for anything unexpected. Change all the passwords for everything, including CPanel logins and email accounts. Check the index.php file and the config.inc.php file to make sure it doesn't have anything it shouldn't (compare to those of a known good site).

Hey Susan,

Thanks for the insight. I'm going to go through that process right now and will check with the hosting company tomorrow to see if they're continuing to see SPAM.

Thanks!

Hey Kris,

The reality is that the sites probably still contain backdoors that are being reactivated. I encountered a site of an old client of mine last fall that was badly compromised and it took a significant amount of effort and scanning the access logs to see if 'people' (read bad bots/actors) were trying to use POST to hit php files. This enabled me to find and remove the additional files. In addition, though this is probably not an effective method for blocking which was to use .htaccess to reroute the IPs of the bad actors.

Incidentally, the .htaccess had been compromised and was rewriting urls and redirecting people to different views. The challenge in this case was that the site has a tandem install of WordPress and there were files hidden in its directories as well.

Jay

The only way I've successfully removed all threats is to remove all modx files, upload the latest version, extra addons ( if staying with revo ) and the original config files and then run install in upgrade mode, you then need to upload all your images, css files etc making sure they haven't been compromised first

So far I've been able to get away with scanning the files for date, all of the hack files weren't overwritten by the upgrade, so they pretty much stood out as being different.

This is all great advice. What we're starting to do on sites recently is install .git to allow us to see what files have changed so we can pinpoint anything out of the ordinary.

Unfortunately we upgraded another Evo site on their server, scanned for files that were out of place and still had problems with the site sending SPAM. A lot of issues seem to be related to the server. It's a shoddy hosting platform and the support is non-existent so we're probably going to recommend new hosting followed by MODX Evo upgrades to ensure we're closing these security gaps.

Some Links for cleaning:
https://forums.modx.com/thread/94643/how-to-clean-up-your-hacked-webspace (could be used for Evo too)
http://de.modx.com/forum/thread/7060/ablage-von-fremden-php-skripten-auf-ftp#dis-post-38078 (Unix shell script)

Don't restrict your search on the MODX folders. On a client site a php shell was installed in awstats folder.

As a further place to look, phpMyadmin is a frequent target and if installed below web root and not kept up to date it could, too be an issue.

Quote from: smashingred at Feb 11, 2015, 01:14 PM

As a further place to look, phpMyadmin is a frequent target and if installed below web root and not kept up to date it could, too be an issue.

Yeh, I don't believe it's in a very accessible place, but good point.