Site hacked with parameter

G03

G03

Regular Member
Joined
Mar 19, 2017
Messages
453
Reaction score
135
Hey BH’s

So my site has been hacked with some sort of vulnerability in WordPress.

The hacker added a ?S=hfjfkensbsksndn sort of parameter to the end of my domain and looks like this

domain.com/?S=hfjfkensbsksndn

This brings up a fake 404 page with a link to the side. When clicking on the link it’s a direct backdoor to my site via the

wp-admin/post-new.php

How will you go about removing this?
Thanks
 
Advertise on BHW
G03 said:
No. 6.0.3
Click to expand...
First, update it to the latest version. We'll see what to do next after you finish this step.
 
  • Like
Reactions: G03
remove any nulled plugins, update the core and the plugins to the latest updates and of course install a wp security plugin to remove the virus
 
you need to remove the backdoor from the PHP source.
check file modification times of all php files. on linux you can do it with the "stat" command.
for example: stat index.php
then you see when the file was last modified. you can write a small bash script to do that in bulk.
or use the "grep" command to find specific patterns of the backdoor you see i.e. grep -R "hfjfkensbsksndn" *
also make sure to update all your plugins, themes, and wp (or reinstall latest version).
if there is nothing injected in the DB then it should fix it. of course also change all passwords.
 
The real culprit here isn’t the post-new.php file, but the backdoor (generally these are undetectable because all they are, are upload scripts.) that they used to upload the shell. Look into any upload script you have intentionally or unintentionally installed in your site. Just getting rid of the shell wont help much.
 
You are kinda fu&ked. This happened to me last year because I downloaded a cracked elementor pro. Lots and lots of japanese pages on my domain over night. All I could do was to delete the whole wp install and reinstall it.
 
harran said:
You are kinda fu&ked. This happened to me last year because I downloaded a cracked elementor pro. Lots and lots of japanese pages on my domain over night. All I could do was to delete the whole wp install and reinstall it.
Click to expand...
Yeah lol. That would be the wisest thing to do at this point.
 
BlurryBit said:
The real culprit here isn’t the post-new.php file, but the backdoor (generally these are undetectable because all they are, are upload scripts.) that they used to upload the shell. Look into any upload script you have intentionally or unintentionally installed in your site. Just getting rid of the shell wont help much.
Click to expand...

BlurryBit said:
Yeah lol. That would be the wisest thing to do at this point.
Click to expand...

So which one is it ?
 
BlurryBit said:
The real culprit here isn’t the post-new.php file, but the backdoor (generally these are undetectable because all they are, are upload scripts.) that they used to upload the shell. Look into any upload script you have intentionally or unintentionally installed in your site. Just getting rid of the shell wont help much.
Click to expand...

Exactly. I check the post-new.php and its legit. I'll Dm you
 
G03 said:
So which one is it ?
Click to expand...
I guess reinstalling wp and just copying the posts would be a better option. This time don’t use any nulled theme or plugins.
 
you can use GOTML plugin, its saved me many time. After scan with GOTML, use WordFence and Defender Pro, I hope your issue will solve.
 
  • Like
Reactions: G03
Fardin2012 said:
you can use GOTML plugin, its saved me many time. After scan with GOTML, use WordFence and Defender Pro, I hope your issue will solve.
Click to expand...
Trust me, no anti virus can detect $_FILES or move_uploaded_file as a virus (if it does, the whole php world will break). That’s how they code the backdoor. Here’s a post I made a long time back explaining this..

https://www.blackhatworld.com/seo/p...-for-detecting-malicious-web-scripts.1055564/
Scroll through a few posts in the thread if you want to try detecting the backdoor… but chances are, you will miss it.
 
BlurryBit said:
Trust me, no anti virus can detect $_FILES or move_uploaded_file as a virus (if it does, the whole php world will break). That’s how they code the backdoor. Here’s a post I made a long time back explaining this..

https://www.blackhatworld.com/seo/p...-for-detecting-malicious-web-scripts.1055564/
Scroll through a few posts in the thread if you want to try detecting the backdoor… but chances are, you will miss it.
Click to expand...
That's why I said about WordFence and Defender Pro, GOTML will remove common issues then WordFence and Defender Pro will check all files and if any files are not same as original then its will show and you can compare it with original files.

They will not tell you anything about virus or backdoor they just show you the file was modified and not same as original. Also they will give you list if there any other files remain in server that not related to WordPress core or related with plugin.

For example, If you have a php file uploaded by hacker in any directory then Defender pro will show that file location and listed as "Unknown file in WordPress core" now its depend on you what you will do with that file. Its not just scan and find.
 
Fardin2012 said:
That's why I said about WordFence and Defender Pro, GOTML will remove common issue then WordFence and Defender Pro will check all files, if any files are not same as original then its will show and you can compare it with original files.

They will not tell you anything about virus or backdoor they just show you the file was modified and not same as original. Also they will give you list if there any other files remain in server that not related to WordPress core or related with plugin.

For example, If you have a php file uploaded by hacker in any directory then Defender pro will show that file location and listed as "Unknown file in WordPress core" now its depend on you what you will do with that file. Its not just scan and find.
Click to expand...
Ok, fair point. It should help a bit if the backdoor is in the core area.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top