I have a dedicated server running WordPress and have recently noticed that its been hacked and PHPShell a remote web server controller has been uploaded. This has let the hacker view and edit files including my database!
I have since deleted the PHPShell folder. Changed all possible passwords (database, user accounts, FTP, turn off SSH etc) and he's recently gained access again!
However I think he was originally able to upload this through Akismet plugin after checking my logs:
xx.xxx.208.130 - - [05/Feb/2014:02:18:29 -0600] "GET /phpshell-2.4/ HTTP/1.0" 403 1431 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36"
xx.xxx.208.130 - - [05/Feb/2014:02:17:47 -0600] "POST /wp/wp-content/plugins/akismet/.!31.php HTTP/1.0" 200 17503 "https://example.com/wp/wp-content/plugins/akismet/.!31.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36" .!31.php
Going off the details above it seems he was able to upload this PHPShell through Akismet plugin. I contacted their devs and I was informed
/akismet/.!31.php was not part of their original package and that the hacker could have created this as a decoy. Before I deleted the Akismet plugin and went to
https://example.com/wp/wp-content/plugins/akismet/.!31.php you were able to upload and execute files to the server, through my firewall!
I HAVE to get this hacker off my server. I have run timthumb scanners and it found nothing. Where else do I start?