Anvilpoint CyberOps - Hacker for Hire ◆ Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Tech Coding Web Development › [PHP] My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside

New Reply 
PHP 

My Wordpress Site Got Malware/Spam code in Every PHP File. Content Inside
n31ght0
n31ght0 Offline
[bin@HF:]
*
Registered
Posts:
2,109
Threads:
409
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
0
May 31, 2018 06:22 PM
Please help guys my wordpress site got hacked and the attacker inject malware code in every PHP file. it seem the purpose for google ads booster.

the decode base64 is here https://malwaredecoder.com/result/5578cf...f2e525f75c

the original file is here https://pastebin.com/raw/RFvCDsYm

i don't know how they do that. Any idea how to find the security hole? i was deleted all the malware in every file before but in a couple of day it back again. i need to know the security hole first before restoring my file. If anyone have experience before with the same issues like me please share guys.
Geatzo
Geatzo Offline
Cancer Of God
*
Registered
Posts:
485
Threads:
115
Credibility:
000
Popularity:
25
βytes:
β 0
Game XP:
0
May 31, 2018 06:56 PM
Maybe google php shells?
The original file is encoded so i would never ever use a encoded file.
newQuery
newQuery Offline
strict-type only
*******
Vibe
Posts:
1,344
Threads:
99
Credibility:
400
Popularity:
1,412
βytes:
β 1,397.95
Game XP:
730
Jun 1, 2018 05:24 AM
Hello, first of all, you should check if all your plugins/modules are up to date and maintained.
It seems like a user was able to upload some sort of shell, probably using a form upload somewhere on your site.
[Image: vibesignature.gif]


“Whatever Your Mind Can Conceive and Believe, It Can Achieve.” – Napoleon Hill
Squito
Squito Offline
root@hfhosting:~#
***
HF Ub3r
Posts:
2,553
Threads:
10
Credibility:
100
Popularity:
217
βytes:
β 0
Game XP:
0
Jun 1, 2018 05:43 AM
Also make a phpinfo file and check if open_basedir set up properly. If not, then demand your money back and get the hell out of there.
You see, Doctor, God didn't kill that little girl. Fate didn't butcher her and destiny didn't feed her to those dogs.
If God saw what any of us did that night he didn't seem to mind. From then on I knew... God doesn't make the world this way.
We do.
n31ght0
n31ght0 Offline
[bin@HF:]
*
Registered
Posts:
2,109
Threads:
409
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
0
Jun 4, 2018 07:15 PM
(Jun 1, 2018 05:24 AM)newQuery Wrote:  Hello, first of all, you should check if all your plugins/modules are up to date and maintained.
It seems like a user was able to upload some sort of shell, probably using a form upload somewhere on your site.

(Jun 1, 2018 05:43 AM)Squito Wrote:  Also make a phpinfo file and check if open_basedir set up properly. If not, then demand your money back and get the hell out of there.

Hi, is it possible to track from where the file is modified? i mean i want to know who/which inserting base64 code to every PHP file on my site
Zher0
Zher0 Offline
Semper Prorsum
*
Registered
Posts:
4,343
Threads:
119
Credibility:
1200
Popularity:
1,874
βytes:
β 82,874.2
Game XP:
2,865
Jun 4, 2018 07:19 PM (This post was last modified: Jun 4, 2018 07:20 PM by Zher0.)
Also make sure you wordpress theme is patched/safe. If you're are using any nulled plugins/themes always check them.
Want Niche Edit backlinks to rank in Google? Click Here
ZeroSecurity: Latest Security News
https://x.com/zer0security
darksh33p
darksh33p Offline
[n00b@HF:]
*
HF l33t
Posts:
48
Threads:
5
Credibility:
000
Popularity:
15
βytes:
β 0
Game XP:
0
Jun 4, 2018 08:20 PM
this very common. i would get a security company to clean ur site and then make sure you change FTP an ssh password. most of time it is FTP that gets brute especially on cpanel style services can also always do clean migration to new wp site but move your db, not php files. only thing is you need to check db to make sure no malicious stuff there either
[Image: 3GxrPNr.png]
zxyl
zxyl Offline
[n00b@HF:]
*
Registered
Posts:
7
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 13, 2018 01:03 PM
WP Protect Admin

Download & Install it...
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Proxy3200Apr 29, 2024 12:34 AM 8 246 Apr 29, 2024 12:34 AM
Last Post: Finacustech
[PHP] by HackersFeb 11, 2022 12:01 AM 8 546 Feb 11, 2022 12:01 AM
Last Post: Hackers
[PHP] by BulgarianFeb 21, 2020 12:33 AM 5 372 Feb 21, 2020 12:33 AM
Last Post: Backbone