1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[NOTE] Gravity Forms Plugin for WP = Trojan

Discussion in 'Black Hat SEO' started by CoyoteAssassin, Nov 28, 2011.

  1. CoyoteAssassin

    CoyoteAssassin Elite Member

    Joined:
    Jan 3, 2010
    Messages:
    1,862
    Likes Received:
    3,933
    Occupation:
    Full Time IMer
    Location:
    USA
    FYI - If anyone downloaded the GravityForms 1.5.2.1 that was also posted on BHW around July of 2011, remove it ASAP.

    Someone used a flaw within the code to hack one of my websites. They only placed a redirect on the page but and it was a simple fix but it was shortly after we started promoting the site.

    Below are some of the files that were accessed.

    Code:
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/js/jquery-ui/mywebsite/64/index2.html
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/js/jquery-ui/mywebsite/r.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/plc/c1.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/stats.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/gravityforms.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/x35/c1.php
    /home1/mywebsite/public_html/wp-pages.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/kui/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/eri/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/plc/c1.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/plc/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/plc/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/plc/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/plc/dt.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/ast/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/bir/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/iuy/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/len/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/z3n/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/x35/c1.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/x35/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/x35/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/x35/start.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/x35/dt.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/tji/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/g3m/lloz.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/zdte.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/l0.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/files/tc_targeting_data/c.txt
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/files/scriptsnippet.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/files/analytics-min110428.js
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/index.php
    /home1/mywebsite/public_html/wp-content/plugins/gravityforms/cuv/lloz.php
    I hope that helps someone.