Mystery files in MODX root

I have a site with four or five very large mystery files in the MODX root directory.

The names are 6 or 7 apparently random letters except that the first letter is always Z. The files are all about 500 megabytes and haven't been modified for at least a year. The content of the files appears to be binary and the Mime type is text/x-generic.

Any ides what these guys are? Server core dumps?

Last I came across something like this I ran a tcpdump and figured out that someone ran an exploit on some customers joomla installation that resulted in our server running an IRCd. If the files haven't been touched in over a year, those files might be "leftovers".

It's pretty common for IRC groups to test out systems with just a few files at first. Have you tried running "file <filename>" on it? If it's an mkv or an avi, this idea might not be too far fetched

Andreas

Thanks for the idea. According to both finfo_file() and mime_content_type() they're zip files with no extension.

[update] The mystery deepens. I downloaded one and took a look with 7-Zip. It's a MODX transport file for and older version of one of my own extras. Weirder yet, the contents shown in 7-Zip are only 68k (about right), but the zip file is 500 megabytes.

[ed. note: BobRay last edited this post 11 years, 6 months ago.]

Greeting Bob,

Quote from: BobRay at Mar 04, 2015, 10:05 PM

they're zip files with no extension.

This sounded familiar to me.

Using my own cPanel-managed hosting space, I just used the GUI file manager to create a zip. While it was running, I looked (via FTP) in the destination where the zip was to be dropped, and found a file named, "zi4oeFIE" (no extension). Once the zip was done being created, that file (or at least that file name) was gone and the zip was there.

If you're in a similar configuration, I'd offer a guess that the files you're seeing might be temporary files created during the zipping process that never were deleted. With their size so large, perhaps what happened is that something was amiss with the zip process, file system, etc. at the time a zip was being made, leading to temporary (corrupted?) file detritus being left behind.

One possible explanation.

That sounds about right, except that I would have uploaded them to core/packages. It may be an issue with MODX's attempt to unzip them when the package is installed, though I wouldn't expect MODX to put temporary files in the site root.

I don't think MODX has anything to do with that, MODX just calls a PHP function, which in turn uses whatever server functions are available.

Still, I'd assume that it would put the temporary files in the temp. directory or the directory the file is being uploaded to. Especially since core/packages is above the MODX root directory.