Очень странный взлом ModX

Question

На днях получил взлом нескольких сайтов на ModX симптомов практически никаких кроме самих изменений (изменили только подвал).
Может кто сталкивался?

доступ к админке ограничен по IP
пароли не менее 16 символов
логины админов нестандартные.

Изменения не в файлах, а в БД. что весьма странно и указывает на уязвимость в MODX.

если нужна дополнительная информация для помощи, дополню пост.

UPD

Собственно вот лог за весь день c IP который имел доступ к админке.

        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:18:29 +0300] "GET / HTTP/1.1" 200 10348 "https://siteworking.ru/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:18:32 +0300] "GET /fonts/fontawesome-webfont.woff2?v=4.6.0 HTTP/1.1" 200 66624 "https://$HOST.ru/assets/components/minifyx/cache/styles_ea0805b3dc.min.css" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:43 +0300] "GET /manager HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:44 +0300] "GET /manager/ HTTP/1.1" 200 2006 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:44 +0300] "GET /manager/templates/default/images/modx-logo-color.svg HTTP/1.1" 200 1367 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:45 +0300] "GET /manager/templates/default/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1" 200 77160 "https://$HOST.ru/manager/templates/default/css/index-min.css" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:55 +0300] "POST /manager/ HTTP/1.1" 302 5 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:56 +0300] "GET /manager/ HTTP/1.1" 200 5397 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:58 +0300] "GET /connectors/lang.js.php?ctx=mgr&topic=topmenu,file,resource,trash,welcome,configcheck,gallery:default&action= HTTP/1.1" 200 21999 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:58 +0300] "GET /connectors/modx.config.js.php?action=&wctx=mgr HTTP/1.1" 200 5910 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "GET /manager/templates/default/images/modx-icon-color.svg HTTP/1.1" 200 783 "https://$HOST.ru/manager/templates/default/css/index.css?v=18690c54" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php HTTP/1.1" 200 284 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php?action=element/getnodes&id=root HTTP/1.1" 200 375 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php HTTP/1.1" 200 423 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php HTTP/1.1" 200 158 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php HTTP/1.1" 200 645 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php?action=system/dashboard/widget/feed&feed=news HTTP/1.1" 200 5832 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php?action=element/getnodes&id=n_type_chunk&type=chunk HTTP/1.1" 200 670 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:20:59 +0300] "POST /connectors/index.php?action=element/getnodes&id=n_type_template&type=template HTTP/1.1" 200 452 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:00 +0300] "POST /connectors/index.php HTTP/1.1" 200 88 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:00 +0300] "POST /connectors/index.php?action=system/dashboard/widget/feed&feed=security HTTP/1.1" 200 2393 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:10 +0300] "GET /manager/?a=element/chunk/update&id=4 HTTP/1.1" 200 9663 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:10 +0300] "POST /connectors/index.php HTTP/1.1" 200 88 "https://$HOST.ru/manager/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:10 +0300] "GET /connectors/modx.config.js.php?action=element/chunk/update&wctx=mgr HTTP/1.1" 200 5910 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:10 +0300] "GET /connectors/lang.js.php?ctx=mgr&topic=topmenu,file,resource,trash,chunk,category,propertyset,element,gallery:default&action=element/chunk/update HTTP/1.1" 200 21950 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php HTTP/1.1" 200 284 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php HTTP/1.1" 200 423 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php?action=element/getnodes&id=root HTTP/1.1" 200 375 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php HTTP/1.1" 200 271 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php HTTP/1.1" 200 233 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php?action=element/getnodes&id=n_type_chunk&type=chunk HTTP/1.1" 200 675 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:11 +0300] "POST /connectors/index.php?action=element/getnodes&id=n_type_template&type=template HTTP/1.1" 200 452 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:21:12 +0300] "POST /connectors/index.php HTTP/1.1" 200 88 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:12 +0300] "POST /connectors/index.php HTTP/1.1" 200 865 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:13 +0300] "POST /connectors/index.php?action=element/getnodes&id=n_type_chunk&type=chunk HTTP/1.1" 200 675 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:13 +0300] "POST /connectors/index.php HTTP/1.1" 200 88 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:13 +0300] "POST /connectors/index.php HTTP/1.1" 200 153 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:13 +0300] "POST /connectors/index.php HTTP/1.1" 200 88 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:14 +0300] "POST /connectors/index.php HTTP/1.1" 200 88 "https://$HOST.ru/manager/?a=element/chunk/update&id=4" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:18:22:35 +0300] "GET / HTTP/1.1" 200 10333 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
        /var/log/nginx/$HOST.ru-access.log.7.gz:185.217.68.134 - - [22/Mar/2020:19:14:31 +0300] "GET / HTTP/1.1" 200 10333 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"

UPD

Обновлены таблицы с юзерами в БД перед тем как вошли.

nginx version: nginx/1.14.0 (Ubuntu)
Modx 2.7.3
php-fpm 5.6
mysql 5.7

Конечно не все пакеты были обновлены. судя по логам подозрительного ничего не было, но уязвимость точно через веб, потому что по SSH доступа к пользователю от которого работает сайт нет. в логах странных POST и GET обнаружено не было

БЛОГ НА HUSL

Очень странный взлом ModX

Ответы (0 шт):