Site hacked or what?

[TheMatrix]

Hi all

I'm facing a very strange problem here.

For one of my sites, I see several (80+) indexed URLs in Google in this format:

www.site.com/index.php?list=21&page=37

Here's the first page screenshot of the G search:

It's a WP site BTW!

I have no such pages on my site whatsoever.

Each of these pages, redirects me to this site:

http://www.paperhelp.org/?pid=98

The strangest thing is that the redirect only works when I'm logged in to my WP admin panel. Or else, it goes to my homepage.

Also, lately, some of my posts are being redirected to the homepage.

How is that happening? Can anyone help?

TheMatrix

 

[scraper1]

Your blog might be backdoored. You are either owned through a vulnerability in WP or a plugin, or through a backdoored theme or plugin.

 

[svr231]

strange for me...
May be i should get more alert from this

 

[TheMatrix]

Your blog might be backdoored. You are either owned through a vulnerability in WP or a plugin, or through a backdoored theme or plugin.

I searched through every file in my installation, and the DB, but couldn't find the site's name in there.

How do I remove the backdoor?

 

[shadowedsniper]

Check your theme files. It's probably a free theme from some website other than wordpress' right? And it's probably encoded with base64 so you won't be able to find it through a plain text search.

 

[TheMatrix]

Check your theme files. It's probably a free theme from some website other than wordpress' right? And it's probably encoded with base64 so you won't be able to find it through a plain text search.

No, it's a custom coded theme. I myself wrote every single piece of code!

 

[fanthomas]

Must be the plugins. Do you think you've had this problem for a long time without realizing it? If yes then it will be hard to figure out which plugin is causing it. I would remove all of them and start over. This is why I don't use wordpress and create static sites.

 

[TheMatrix]

Must be the plugins. Do you think you've had this problem for a long time without realizing it? If yes then it will be hard to figure out which plugin is causing it. I would remove all of them and start over. This is why I don't use wordpress and create static sites.

The site's been up for almost 2 years now, and I just saw this. Maybe these pages have been created 7-10 days ago.

 

[sbw27]

Yeah...hacked. Try installing exploit scanner or virus scanner...both free wp plugins that will help you find the exploit.

 

[GreyWolf]

Yeah that's very odd. It sucks when things like that happen.

One thing I did notice when I made a typo and left the : out of the search string "site ******.com inurl:index.php" it actually gave a whole different set of results showing pages where you're site is backlinked with the format "******.com/index.php?list=21&page=37". There's a lot of backlinks to your domain with various different list and page numbers. It might be worthwhile for you to check that out as well, maybe you can find something leading you to who's posting them or something.

I then did the search string correctly "site:******.com inurl:index.php" and got the same results page you pasted. When I click any of the links it just goes to your homepage just as you said. I don't really see what value it would be to a hacker if the only time it redirects is for the site admin, but I'm sure they have some reason for it. Maybe it's to somehow identify you so they can exploit you even more like with a keylogger or something.

I didn't find the paperhelp.org link anywhere in the source of your home page so it's probably somewhere in the php files. If you have a bulk text search program you might try searching for it in all the files on your server. Of course it could be in an obfuscated code section or the redirect from your site could be going somewhere else first and then redirecting to the paperhelp.org site.

I did a search for the paperhelp site and backdoor but didn't find anything, you might keep doing similar searches though. Maybe search you're theme and plugin names on google adding backdoor, virus, hacked, etc. It seems like for something like this others would be having the same problem.

I'd definitely be concerned if it was my site. I'd keep searching for answers until I found something. Worst case you might need to delete and reinstall wordpress and your themes. I'd do everything I could to figure it out before doing that though.

Be sure to come back to this thread and post whatever you figure out or after you try whatever final solution you come up with. Good luck.

Another place you should check is in your htaccess to see if there's anything suspicious there. It seems like that would be more likely if it was happening all the time though. Since it's only happening when your logged into admin I'd think it's probably somewhere else. Still worth checking though.

 

[TheMatrix]

Yeah...hacked. Try installing exploit scanner or virus scanner...both free wp plugins that will help you find the exploit.

Ran the scan. Nothing found!

 

[jkrillah]

You are using latest WP? Cos one of my hosters had just sent every customer an email about always updating to the latest cos "its not funny when your wordpress blog gets hacked".

On a sidenote a site of mine just got hacked too, luckely a new site, it ran ArticleDashboard script.. They "defaced" it...

 

[TheMatrix]

Yeah that's very odd. It sucks when things like that happen.

One thing I did notice when I made a typo and left the : out of the search string
site ******.com inurl:index.php it actually gave a whole different set of results showing pages where you're site is backlinked with the format http://www.******.com/index.php?list=21&page=37. There is a lot of backlinks to your domain with various different list and page numbers.

I did the site:******.com inurl:index.php and got the same results page you pasted. When I click any of the links it just goes to your homepage. I don't really see what value it would be to a hacker if the only time it redirects is for the site admin. Unless it's to somehow identify you so they can exploit you even more like with a keylogger or something.

I didn't find the paperhelp.org link anywhere in the source of your home page so it's probably somewhere in the php files. If you have a bulk text search program you might try searching for it in all the files on your server. Of course it could be in an obfuscated code section or the redirect from your site could be going somewhere else first and then redirecting to the paperhelp.org site.

I did a search for the paperhelp site and backdoor but didn't find anything, you might keep doing similar searches though. Maybe search you're theme and plugin names on google adding backdoor, virus, hacked, etc. It seems like for something like this other's would be having the same problem.

I'd definitely be concerned if it was my site. I'd keep searching for answers until I found something. Worst case you might need to delete and reinstall wordpress and your themes. I'd do everything I could to figure it out before doing that though.

Be sure to come back to this thread and post whatever you figure out or after you try whatever final solution you come up with. Good luck.

Another place you should check is in your htaccess to see if there's anything suspicious there. It seems like that would be more likely if it was happening all the time though. Since it's only happening when your logged into admin I'd think it's probably somewhere else. Still worth checking though.

That's quite a nice discovery. I went through these backlinks to the unwanted pages, and look at one of these:

http://www.bmwlemon.com/showthread.php?13-hxyecijtjxi-bPaxgearnec-yeyfegqeyla&

And another:

http://www.avsuomi.nl/gb/index.php?eintrag=120&PHPSESSID=8b12ca8278b9642885cfbf2473f85fa7

All of the backlinks are from guestbooks, xRumer-style forum pages etc.

Seems like it's not only me. They are fcking other people as well using the same exploit.

I'm downloading my theme, and will go through each line of code, to check any suspicious snippet. Also, I've elevated the matter to my hosting provider.

Also, a few days ago, I was into another problem.

Some plugins were casuing WP-ADMIN to be blank (White) unless deleted manually.

The plugins I checked were these:
wp-minify
wp-http-compression
secure wordpress
W3 Total Cache
WordPress Gzip Compression

when anyone (or all) of these is activated, the screen goes blank white, and the whole admin area is nothing but a white screen.

Unless I manually delete the plugin's folder in wp-content/plugins/ using FTP/cPanel, the problem persists.

Now, I checked, and the problem is resolved.

 

[blackmamber]

Those links have been removed, just checked on G. Maybe someone trying to clone your site

 

[TheMatrix]

Those links have been removed, just checked on G. Maybe someone trying to clone your site

Unfortunately, they are still there!

 

[jkrillah]

Such stuff has been going on forever. Viagra spammers epxloited holes in stat tools for example , to place their backlinks.

The problem can be anywhere. Your host isnt updating your virtual server regulary with latest security fixes.. It can be sql, php, webserver, wordpress installation, fantastico... IF its a plugin yes it would be helpful to find out which one it is... you could search all your plugins in google + exploit, or check your logs as to what exactly was done before this started

 

[TheMatrix]

UPDATE:

It WAS a plugin!

STATPRESS!

How I found out?

I ran a search in my DB using phpmyAdmin and found out the cause.

I have not deleted the plugin, and the DB tables and rows it created!

The problem is NOT fixed though!

Redirect still is there...

 

[TheMatrix]

New Update:

Out of anger, I tried to DoS the site to which links redirect, and only after 20k pings using SB, I think I might have seen the face of success!

I just tried to use that redirect and got this error:

Doing the http://whois.domaintools.com/dorgusus.in, I get the following information:

Domain ID5160099-AFIN
Domain NameORGUSUS.IN
Created On:11-Jul-2011 20:35:21 UTC
Last Updated On:11-Jul-2011 20:35:22 UTC
Expiration Date:11-Jul-2012 20:35:21 UTC
Sponsoring Registrarirecti Web Services Pvt. Ltd. (R118-AFIN)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:TS_16220954
Registrant Name:Nikolay Fedotov
Registrant Organization:N/A
Registrant Street1:ul. Kulikovo Pole, 142-54
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:
Registrant Postal Code:125649
Registrant Country:RU
Registrant Phone:+7.4952654879
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: [email protected]
Admin ID:TS_16220954
Admin Name:Nikolay Fedotov
Admin Organization:N/A
Admin Street1:ul. Kulikovo Pole, 142-54
Admin Street2:
Admin Street3:
Admin City:Moskva
Admin State/Province:
Admin Postal Code:125649
Admin Country:RU
Admin Phone:+7.4952654879
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:[email protected]
Tech ID:TS_16220954
Tech Name:Nikolay Fedotov
Tech Organization:N/A
Tech Street1:ul. Kulikovo Pole, 142-54
Tech Street2:
Tech Street3:
Tech City:Moskva
Tech State/Province:
Tech Postal Code:125649
Tech Country:RU
Tech Phone:+7.4952654879
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:[email protected]
Name Server:NS1.REGWAY.COM
Name Server:NS2.REGWAY.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:

Again, GreyWolf was right. The person(s) is/are using a secondary site to setup the redirect.

The script is at

http://dorgusus.in/go/got.php?sid=1

If anyone can extract any good info..??

EDIT: I used httpFox to analyze the redirect and here's what I got when I clicked on the G search result.

So, I can conclude that the person is using a 302 redirect!

 

[TheMatrix]

A few more confusing things I am seeing:

 

[TheMatrix]

Another update:

1. I just deleted all of my wp-admin and wp-includes folders, and re-uploaded fresh downloaded files from wordpress.org. Still the problem is there!
2. I dectivated all my plugins, but still the problem persists. So it seems to be just my theme, but as far as I have checked, there's no suspicious code in it.

Man. What is it....