Re: Security Warning / need help understanding New Version of site hack on Evo 1.014

zaigham — Jul 16, 2014, 12:39 PM

I am no security expert but I had to cleanup similar hack from one of my sites, and my host was unable to find the point of entry in logs. Then I had to find and guess, and I suspect that EvoGallery's Uploadify had the vulnerability which let the hacker gain access.

The code you have provided, is being eval() on gzipped and base64encoded strings of base64encoded arrays etc. Layers and layers of obfuscation is going on here.

Hope this gives some hints.

Security Warning / need help understanding New Version of site hack on Evo 1.014

noahlearner — Jul 15, 2014, 09:56 PM

First time I've seen this version of a hack on modx site. Hacker gained entry to site. Not sure how, but I have since made sure to upgrade to 1.014. There were all kinds of random php files scattered about site. Hacker also altered in index.php file after line 62 to include

require_once(dirname(__FILE__).'/'.MGR_DIR.'/includes/config.php');

I then found that file.
I have repaired index.php, removed random php files, changed passwords for ftp, cpanel, and modx. What else is reccomended action?
Can any security folk chime in on what is going on in the file below?

The code of which follows:

Security Warning / need help understanding New Version of site hack on Evo 1.014 - My Forums

Re: Security Warning / need help understanding New Version of site hack on Evo 1.014

Security Warning / need help understanding New Version of site hack on Evo 1.014