Site hacked questions

Hi,

I have a site running on 2.2.2pl which recently had the Core Services hack - I have since removed the core services plugin and had a look for dodgy PHP files / users etc... I also changed all MODx admin passwords and FTP etc - thought had sorted the issue... but now have noticed that on 2 certain pages in the site - that in a table of data where I have some images - the img src elements have been hacked to include a load of spam / crap code... e.g.



This is a shortened example - its actually loads and loads of random characters...

So.. question is... how is this happening? I can change the code back to the correct img src and all is fine for a few weeks - and then bang, it happens again...

Any ideas where to search for the dodgy code performing this injection?

Any ideas on a fix?

I am going to be upgrading to a much more recent MODx build, but wanted to remove the malware before that upgrade.

Cheers,

dubbs.

Are you sure that is bad code? It is perfectly acceptable to use code like that to load images. http://stackoverflow.com/questions/1207190/embedding-base64-images

Quote from: sottwell at Nov 24, 2015, 10:15 AM

Are you sure that is bad code? It is perfectly acceptable to use code like that to load images. http://stackoverflow.com/questions/1207190/embedding-base64-images

Its randomly injected code... whether or not its bad is another question... My concern is... how did it get there in the first place...? I have once removed it already - and now it is back... so being injected somehow...

Then there is probably something in the template or the resources themselves. Perhaps some Javascript. Without seeing the page and being able to track where all of its elements come from it's hard to be any more specific.

Quote from: sottwell at Nov 24, 2015, 10:54 AM

Then there is probably something in the template or the resources themselves. Perhaps some Javascript. Without seeing the page and being able to track where all of its elements come from it's hard to be any more specific.

Ok - so unlikely a malicious PHP file in the file system on the server then? currently reviewing the files on the server vs the original 2.2.2pl build files...

It could be, but considering that this appears to only affect certain pages makes it more likely that it's something specifically involved in generating those pages.

Quote from: sottwell at Nov 24, 2015, 11:01 AM

It could be, but considering that this appears to only affect certain pages makes it more likely that it's something specifically involved in generating those pages.

OK thanks. Will keep searching...

Susan - I found no extra files on the server other than within:

core/packages/modContext/
core/packages/xPDOFileVehicle/

Where there were a few extra files and folders... Are these legit?

Also found that the hacked code injection is also within the site CSS files... so not specific to the 2 pages I had previously identified...

Any thoughts anyone?

Is it the sql injection issue? > https://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection

Just found another hack... When browsing files in the Resource brwoser/viewer when picking an image - all the thumbnails are missing and instead replaced with a "NO GD" image... Using Firebug the url for the image source it is pulling is:



So, after the width and height vars - a load of random junk????

So looks like PHPThumb has been compromised also???