my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's files. I don't know what is it. Is is dangerous? Please let me know with as much as details you can help me. Thank in advance!


The hacker used a publicly available shell MulCiShell v0.2. It can be configured to perform a number of functions including brute forcing passwords, downloading your entire site and replicating itself. You could take a closer look at mshell.php to see what it does.


From your log files:

He tried to access /etc/passwd which contain a list of system users. He was probably trying to switch to a user with additional privileges. He tried from line 66-278 of the log and failed, probably because the web server was not running as root.

In line 300, he tries to access your .htaccess file. Probably trying to modify it to allow execution of CGI scripts so he can access /etc/passwd

Line 406, he tries to crack your site's password. $arr is a variable declared in line 473 of mshell.php. I suppose he left the auth_url post parameter blank.

Line 518, tries to access .htaccess once again.

Line 1272, last ditch attempt by trying to exploit some buffer overflow in apache.

I don't think he managed to compromise the machine, he used a publicly available tool and didn't seem to know what he was doing. I doubt he covered his tracks as well. His IP originates from a vietnam ISP and furthermore the referer for some requests is http://www.google.com.vn. Although he could have compromised a machine in vietnam and used it as a platform to attack your site.

  • Thank you for deep informative explanations! Really appreciating! So the hacker is just a script kiddie. I will find out more about this shell. Thank again @limbenjamin! – Jane Brye Nov 22 '14 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.