5

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack.

Screenshot of the situation:

enter image description here

What kind of attack is this? What is the reason?

I can provide more information but I don't know where to start. So please ask me on comments.

APACHE LOG FILES:

http://mertyildiran.com/mertyildiran.com.error.log

http://mertyildiran.com/mertyildiran.com.log

http://dragon.computer/dragon.computer.error.log

http://dragon.computer/dragon.computer.log

enter image description here

  • 1
    Seems like someone dumped a bunch of sites on your web server that are now delivered through your infrastructure. The big question here for me is which one is your genuine site? For this page, Google shows a warning that leads to google.com/webmasters/hacked – Zonk Nov 5 '15 at 13:36
  • 1
    i don't have WP, but i see lot of log on my server of attacks based on WP security breach. This is my advice not a pro advice: check your apache log, try to create rules on log to have more visibility on wp-admin page & upload, check on internet how to securise WP (mainly upload page), update you WP to last version ... – Froggiz Nov 5 '15 at 13:36
  • @Zonk What do you mean with "genuine site"? All of them connected to domain names. I am aware that Google tagged me with "This site may be hacked." I will clean these files and issue will be solved. But I cannot encounter with the same attack for the second time. So I need to find the reason. Please help me :) – mertyildiran Nov 5 '15 at 13:41
  • 1
    Okay, so then you should really check your wordpress installation and wp-plugins. You have had someone dumping malicious content on your site - which apparently you're serving still... – Zonk Nov 5 '15 at 13:55
  • 1
    you should check this kind of request : /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php /wp-content/plugins/showbiz/temp/update_extract/revslider/get.php and wp-config, that s most of request i get in my logs || about your logs i think it is before 1 nov, in 1 nov log i see that the guy launching his script through your server – Froggiz Nov 5 '15 at 14:08
5

Nowadays, a lot of bots are scanning Internet to find security breaches to abuse of servers. As WordPress is one of the most used CMS, most of attacks attempts are done using WordPress flaws.

  1. If you site get hacked, you have to find how it happened in a first time

    Most of WordPress attacks are aiming wp-config.php through adminpages, upload, loginpages, plugins to collect informations about your configuration and how to exploit it.

    One of the biggest security is to protect your wp-config.php:

    <Files wp-config.php>
    order allow,deny
    deny from all
    </files>
    

    Some exemples of requests found in logs: (useful info linked to attacks are in logs)

    • wp-config viewer attack:

    /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

    • showbiz plugin breach attack:

    /wp-content/plugins/showbiz/temp/update_extract/revslider/get.php

    • bruteforce attack:

    /wp-login.php (auth fail flood)

    A lot of WordPress expert sites warn about some basic security flaws:

    For example: http://codex.wordpress.org/Hardening_WordPress

  2. Keep your WordPress up to date

    Updates are made to fix stuff, but in this stuff, there is thing about security, so try to get an eye on updates (subscribe to WP newsletter, or try to add system to autoupdate it)

  3. Once the breach is fixed, you can unlock your site from hacked site on http://google.com/webmasters/hacked (thanks @Zonk for the link)

Some more: Some Apache advice to prevent attacks:

  • log in a special files request on wp-config/wp-login/wp_admin files

    SetEnvIfNoCase Request_URI "wp-config\.php|\/wp-admin\/|wp-login\.php" securitylog CustomLog ${APACHE_LOG_DIR}/security.log vhost_combined env=securitylog

  • redirect useless trafic

    RewriteCond %{HTTP_USER_AGENT} ^-?$ RewriteRule .* - [F]

  • limit request methods to GET, HEAD and POST

    RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST)$ RewriteRule .* - [F]

  • find a human readable logviewer

  • Just a question. Does Google allow you to remove malformed pages from it's search engine? Many of these WordPress hacks seek to install SEO-wrecking garbage on the websites. Eventually, when someone googles your company name, they get porn/spam as the first result... – Mark Buffalo Nov 5 '15 at 16:27
  • maybe you can try this question on webmasters.stackexchange.com, in fact i wonder how google can index thoose pages if there no link to it in the web site, what is thoose fake.php page content ? if i was a hacker who wrote .php page on a system, i would try to take a silent control of the machine, instead a SEO reputation downgrade...so i can't answer and explain anything of thoose, i just see what happend and try to protect against – Froggiz Nov 5 '15 at 16:42
  • Some SEO wreckers seem to persist for months on Google. Even if the pages were deleted previously. I was hoping Google would offer a service to remove those pages from their listings. Your #3 link caused a lightbulb to go off. – Mark Buffalo Nov 5 '15 at 16:45
  • save lightbulbs and use led instead ! – Froggiz Nov 5 '15 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.