Sites hacked..did I find the right file

[manpreet]

Some of my sites got hacked (cpanel level). I've cleaned out a lot and notice this might be the injection file.

If anyone has experience with this or time, could you confirm this is it
https://gofile.io/d/OaF5CK

 

[MaxGuard]

Yes, it does look like a injection file. Best thing for you right now would be to ask your hosting provider to clean the server for you as the cracker can leave backdoors to get back into the server. After that install the last backup of the site you have before the cracker got in.

 

[samiejg]

Yep, one of the lines near the top says "We are in..." and then has a bunch of other server type syntax and is trying to open another script at the bottom with fopen.

But yeah just be careful there's no backdoor like rockstars was saying. Although I think this file is basically a backdoor itself Sometimes they will try to hide them in sneaky spots or even a bunch of them all over the place.

 

[FatBee]

Its a shell, you got injected and defaced. And no, you are not cPanel level hacked. Your database is fucked.

 

[manpreet]

Thanks for the reply guys. I found a bunch of other things like bradleyking plugin and some manipulation of aws security codes. I've got rid of everything and am thinking starting fresh just in case. I don't understand how they got in 4-5 different sites though. They've managed to installs plugins, add posts, add php pages etc that's why I thought maybe someone got into my cpanel.

Yes, it does look like a injection file. Best thing for you right now would be to ask your hosting provider to clean the server for you as the cracker can leave backdoors to get back into the server. After that install the last backup of the site you have before the cracker got in.

When you say 'clean' do you mean install the last valid backup of the database etc? My issue is I made so many changes in between

Yep, one of the lines near the top says "We are in..." and then has a bunch of other server type syntax and is trying to open another script at the bottom with fopen.

But yeah just be careful there's no backdoor like rockstars was saying. Although I think this file is basically a backdoor itself Sometimes they will try to hide them in sneaky spots or even a bunch of them all over the place.

Yeh they did...theres a range of files installed across 4-5 days, I've tried to examine all these and keep my valid files and get rid of theirs

Its a shell, you got injected and defaced. And no, you are not cPanel level hacked. Your database is fucked.

I saw a file saying "You got defaced by xxxxx" lol why the hell would someone write that, I wouldn't have noticed anything unless I saw this. Would you have an idea how this person got into the database without access to the passwords etc.

The wierd thing is I asked namecheap to do a migration of my site to theirs and they are litterally the only people/company I have shared my database details with in the last 10 years. I don't know whether it's a coincidence but I sent the request for migration and details via their 'protected' form near the end of May and the first few hacked files were on the 27th May (to 4th June)

 

[FatBee]

Guess they are fucked

 

[Mr Positive]

Install wordfence on all sites that should protect you for future

 

[soa0611]

Install wordfence on all sites that should protect you for future

i got my 3 different sites (official themes, not nulled) hacked, on all was free Wordfence, useless shit.
probably Premium version works ok

 

[Mr Positive]

i got my 3 different sites (official themes, not nulled) hacked, on all was free Wordfence, useless shit.
probably Premium version works ok

weird I have it on Client sites and I have made sure to use it full features, another option for you and op is to use @kindablack security service maybe not all sites are same and your sites need more detailed introspection

 

[manpreet]

weird I have it on Client sites and I have made sure to use it full features, another option for you and op is to use @kindablack security service maybe not all sites are same and your sites need more detailed introspection

The sites have different themes (not nulled) and plugins. Some sites have different usernames/passwords so thats why I keep thinking someone got access to my database/cpanel