+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside (/showthread.php?tid=5843216)
My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - n31ght0 - May 31, 2018
Please help guys my wordpress site got hacked and the attacker inject malware code in every PHP file. it seem the purpose for google ads booster.
the decode base64 is here https://malwaredecoder.com/result/5578cf43059b45ff525742f2e525f75c
the original file is here https://pastebin.com/raw/RFvCDsYm
i don't know how they do that. Any idea how to find the security hole? i was deleted all the malware in every file before but in a couple of day it back again. i need to know the security hole first before restoring my file. If anyone have experience before with the same issues like me please share guys.
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - Geatzo - May 31, 2018
Maybe google php shells?
The original file is encoded so i would never ever use a encoded file.
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - newQuery - Jun 1, 2018
Hello, first of all, you should check if all your plugins/modules are up to date and maintained.
It seems like a user was able to upload some sort of shell, probably using a form upload somewhere on your site.
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - Squito - Jun 1, 2018
Also make a phpinfo file and check if open_basedir set up properly. If not, then demand your money back and get the hell out of there.
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - n31ght0 - Jun 4, 2018
(Jun 1, 2018 05:24 AM)TheZdo Wrote: Hello, first of all, you should check if all your plugins/modules are up to date and maintained.
It seems like a user was able to upload some sort of shell, probably using a form upload somewhere on your site.
(Jun 1, 2018 05:43 AM)Squito Wrote: Also make a phpinfo file and check if open_basedir set up properly. If not, then demand your money back and get the hell out of there.
Hi, is it possible to track from where the file is modified? i mean i want to know who/which inserting base64 code to every PHP file on my site
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - Zher0 - Jun 4, 2018
Also make sure you wordpress theme is patched/safe. If you're are using any nulled plugins/themes always check them.
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - darksh33p - Jun 4, 2018
this very common. i would get a security company to clean ur site and then make sure you change FTP an ssh password. most of time it is FTP that gets brute especially on cpanel style services can also always do clean migration to new wp site but move your db, not php files. only thing is you need to check db to make sure no malicious stuff there either
RE: My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside - zxyl - Jun 13, 2018
WP Protect Admin
Download & Install it...