Site hacked? How??

HenryHavoc

HenryHavoc

Senior Member
Joined
Mar 24, 2008
Messages
1,166
Reaction score
2,215
Woke up this morning to my wordpress site compromised. Index file was changed and there was an added sitemap with 8000 links. Immediately changed the index file back to normal and deleted the sitemap. Now I'm getting a 503 error when I try to pull up the site. Can't access wp-admin panel.

Whats crazy is how I found out. This morning I got an email from google saying that there was a new user added to my google search console account. They were able to get into my GSC and also add the html verification file to my server.

Just trying to figure this out. My hosting, FTP, domain email, and wordpress info is all different. Does that mean that I was specifically targeted? I'm so pissed this happened. If anyone has ideas please let me know - as of right now I am completely powerless.
 
Advertise on BHW
A possible avenue would be-- php exploit (weak template/plugin you didn't know about) --> php root --> found your google login from somewhere on the site -> guessed password if it was weak / found it same place.

Or maybe you reuse emails/passwords and some service you forgot about was compromised. Or maybe your maid got a new boyfriend and he's a total haxxor.
 
I guess they cracked your MySql database through Sql injection
 
Asif WILSON Khan said:
Do you use any nulled themes or plugins?
Click to expand...

No sir, but I was told my yoast is outdated and may have something to do with it. I need to get into the wp-admin and update all the plugins but as of right now I get a 503 error when I try to navigate anywhere in the site
 
I'm curious to know where do you host the wordpress at? shared hosting or vps?
 
If it was hacked, then they get access only to your hosting account. Since they also have access to your google account, it looks like it's not an automated hacking via script but targeted attack. Scan your PC with malwarebytes and see if any keylogger is working in the background stealing your keystrokes.
 
Wow lately there's been a lot of hacked sites going around in BWH.

Time for password changes everyone.
 
HenryHavoc said:
No sir, but I was told my yoast is outdated and may have something to do with it. I need to get into the wp-admin and update all the plugins but as of right now I get a 503 error when I try to navigate anywhere in the site
Click to expand...

Can you access cPanel?
 
HenryHavoc said:
Yes I can
Click to expand...

Try checking that the wordpress files are all there. You can try installing wordpress over your old copy. Back everything up first then try installing wordpress, it might be easier to back up and restore via FTP
 
First thing is to take a back up , delete everything and reinstall fresh new , scan for malware in your system.
 
follow this guide: http://www.inmotionhosting.com/support/website/wordpress/reinstall-wordpress-after-a-hack

1 down vote
Back up the Old Directors and file .

  1. your copies of everything except the wp-config.php file and the /wp-content/ directory with fresh copies from the Public_html.
- Reinstalling WordPress after a Hack / damage / mis-configured.

  1. First you'll want to download the latest version of WordPress to your local computer.

  2. Extract the files in the .zip archive you downloaded to a local folder.

    3.Using FTP, upload all of the folders and files contained within the wordpress directory to your public_html directory. Or if your domain was an addon domain and its document root was in a sub-directory make sure you're uploading it there. You can do this by hitting Ctrl-A in your FTP client when you're in the left-hand pane to select all the files, then simply drag them onto the server.

  3. Once the files are done uploading, navigate to the quarantine directory on the server side, right-click on wp-config.php and choose View/Edit. Your FTP application should prompt you for what application you'd like to open the file with, you can just use a text editor such as Notepad. Then finally copy down the database information from the define**('DB_...)** sections.

    5.At this point if you try to simply access the site you'll get a WordPress error about no wp-config.php file.

    6.Back in your FTP client, navigate to your public_html directory and you should see a file called wp-config-sample.php, right-click on this file and choose View/Edit, open the file in Notepad then fill in your database name, database user, and database user password. Then hit Ctrl-S to save the file, in a few seconds your FTP client should prompt you if you'd like to save this back to the server, click Yes. You can also place a check beside Finish editing and delete local file if your FTP client gives you that option.

  4. Now in your FTP client right-click on wp-config-sample.php choose Rename, and then name the file just wp-config.php.

    8.Now in this case if we try to go to our site again it's an all blank page, the reason for this is because our site used a custom theme, and those theme files are still quarantined. So next in your FTP client navigate to the /quarantine/wp-content/themes directory, and drag over the pinboard directory (or whichever theme you used) to your local computer.

    9.Now navigate on the server side to the /public_html/wp-content/themes directory, and then drag the pin-board directory from the local computer to the server.

    10.You should now be able to hopefully pull up your website again free of any malicious hacks.
Click to expand...

https://wordpress.stackexchange.com/questions/215182/reinstall-wordpress-without-losing-data
https://encrypted.google.com/search?q=reinstall+wordpress+without+losing+data
 
Well revenue went from 700$ last week to 12$ this week while I've been figuring this out. Google was quick to drop me from #1 to #3. I finally got access back to the site. There were tons of compromised files that had callbacks to russian sites that were essentially turning my site into a link farm. I am now in the process of migrating to a more secure server and installing some additional security as well. Sucks that my ranking dropped so quickly. I got some PBN posts dripping in over the next two weeks and I went ahead and gutted the site and got my page load speed up so I'm hoping that helps with the ranking. The good thing is that I have my site up and running.

I was told that there was an exploit in the version of wordpress I was using (I hadn't updated in over a year) so I updated that along with all my plugins. Hoping that between all of these additional changes I will be safe.

It's terrifying that I was able to lose access to my main breadwinner just like that. IM is scary shit. Thanks all for the help
 
Be careful what plug ins you use, some aren't as safe as you think they are.
 
HenryHavoc said:
Sucks that my ranking dropped so quickly.
Click to expand...

Google is very harsh to hacked sites. If you counted as an authority site you stand a good chance to recover most of your juice (though not really all) within the next weeks, especially if it's your first time and you weren't down for very long. But even so, being hacked is the worst SEO move you can make, so try and don't make it.

For a small / t2 site it's probably better to just kick it off your PBN/feeder system for a year or two, just let the domain sit empty. As you well observed yourself, hacked ~= spam farmed, and you wouldn't mix that into your t1 feeders would you.
 
HenryHavoc said:
I was told that there was an exploit in the version of wordpress I was using (I hadn't updated in over a year) so I updated that along with all my plugins. Hoping that between all of these additional changes I will be safe.
Click to expand...
Did you check your PC ? Because, Coz as you said they took control over your google console account as well !
 
HenryHavoc said:
.

I was told that there was an exploit in the version of wordpress I was using (I hadn't updated in over a year) so I updated that along with all my plugins.
Click to expand...

Noob mistake right there, glad you got it sorted.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top