Wordpress site repeatedly getting hacked

Ok, that was quick. Invoice-CKNQZ-341-908719 was created again. This time, deleted all contents of index.php and just left the open and closing tags <?php and ?>
 
Advertise on BHW
seoguy81 said:
Ok, that was quick. Invoice-CKNQZ-341-908719 was created again. This time, deleted all contents of index.php and just left the open and closing tags <?php and ?>
Click to expand...

Doesn't matter, you can't deceive md5 checks.
 
KHer0 said:
To tell you the truth, I didn't bother decoding it :D

Been on PC for too long and don't have the power to read codes.
Click to expand...

I haven't decoded it either, I mean what's the point when the pipeline looks obvious:

1. There's code somewhere onto his server injected into either WordPress itself, a plugin, an article on his site, a theme file, even CPanel itself can be infected.
2. This code generates the script pasted onto Pastebin
3. The script on Pastebin generates a malicious doc file, the link to which is probably being sent by email to victims in order to spread a virus.

Essentially, the hacker is using OP's server to host malicious doc files with viruses on them to people (where he's sharing the links to these doc files doesn't matter)

You can read more on recent Word doc exploits on Ars: https://arstechnica.com/security/2017/04/booby-trapped-word-documents-in-the-wild-exploit-critical-microsoft-0day/

If OP is being pushed into a $199 security check by his hosting company, my strongest recommendation is GTFO ASAP, they might be doing this themselves :)
 
Things I would suggest
  1. Remove SSH access unless you need it.
  2. Remove unused FTP accounts and change the passwords on the ones you use.
  3. Make sure your web host has 2 factor authentication on the login.
  4. Run your site with no plugins for a while and see if the issue comes back.
  5. Update any other WordPress installs you might have on the server. Lots of people host many sites and just kind of leave them there without updating them.
  6. Lock down your WordPress login pages by IP with .htaccess.
  7. And honestly, changing hosts seems like a solid suggestion. Hawk Host has 2 factor authentication on their cPanel login.
 
Checked CRON.. there is just one public_html/mails/admin/cron/cron.php
no .sh file detected
Went to uploads folder and deleted some folders/files that were left there (Didn't know gravity forms still keeps the files despite uninstalling/deleting it).
Checked all upload files
Will see. If this doesn't work then i'll consider moving out

I get the gist of it now. Some bad file/script is generating these folders with the index.php
Earlier I had a problem as unauthenticated mails were sent from my domain. So there is some similarity here, especially if that file has got something to do with emails.
Will also change the info@ and make it as a redirect to a custom email address.

Thanks a lot you guys... Lot more solid people here than at SG.
 
seoguy81 said:
Earlier I had a problem as unauthenticated mails were sent from my domain.
Click to expand...

If at one point you were used for email spamming, I cannot stress it enough how much you need a fresh VPS on another provider.

Hit me up if you need help with doing a security-hardened minimal VPS setup, I'll be writing some guides about this anyways soon on BHW since I see tons of people having issues.
 
15 mins since my last post and no rogue folder was created. Will wait for 24 hours and see if it stays the same. Discovered some very old plugins that I uninstalled but the folders & the files still remained there. Perhaps that was the issue and created the backdoor.

Fingers crossed
 
No chance, been through what your going through like 10 years ago.

Here's how you protect yourself. Make a new site and content, straight away take a backup and tar the files and database. Store locally. From time to time rip off the db for any new content you made, add that to your folder dated obviously.
Zip ensures no files added that you're unaware of.

Once hacked, accept it, wipe server clean reinstall old site new passwords everywhere. Rinse and repeat.

Heres an idea of my password security, I haven't been hacked in 3 years : V)Hvjck8_,DTH.d~

Now this site, get your content and bin the files, make new wp install, follow steps above. Cheaper than having it cleaned and way more effective.

Asking to have that php junk you sent above translated would require a php dev that charges proper $$$$ and even then, it's not like documented readable code, which is already not easy to read in some cases :)
 
seoguy81 said:
Lot more solid people here than at SG.
Click to expand...
Man, just curious, is there any host, that will take the time and effort to debug your website, clean it of malware and then take care of your security? And have the price of SG? I'm also on SG, but if there's something better I would move, why not.

I know there's a WP specialized hosting provider (forgot who) that claims to be optimized for WP and more secure but they hardly allow any plugins installed on their host. And they had huge prices if I remember right.
 
CrazyMint said:
Man, just curious, is there any host, that will take the time and effort to debug your website, clean it of malware and then take care of your security? And have the price of SG? I'm also on SG, but if there's something better I would move, why not.

I know there's a WP specialized hosting provider (forgot who) that claims to be optimized for WP and more secure but they hardly allow any plugins installed on their host. And they had huge prices if I remember right.
Click to expand...

None of the managed WordPress (or any app) hosting providers out there can or will ever be secure.

Why?

A few smart security practices and 2 bash scripts can make intrustion to your VPS not worth the effort unless there's a million dollar prize on your server.

If everyone knew how to do this and grew habits into doing it all the time (which is not more difficult than posting on wordpress lol), then companies like sucuri wouldn't be able to make 8-figure profits :)
 
Well, I do believe that nothing is unbreakable. But still doesn't stop people to claim they are secure and charge a lot more than others.
 
CrazyMint said:
Well, I do believe that nothing is unbreakable. But still doesn't stop people to claim they are secure and charge a lot more than others.
Click to expand...

What I'm trying to say is most WP/App managed hosts are very easily hackable, quite intentionally, so they can upsell security audits and malware cleaning procedures.
 
Sad but true Darmor, I didn't want to go into that, hence why I gave clear instruction how to protect yourselves. You'll soon know if a host is worthless to you following my procedure.
 
OP, can I ask why you are logging in and uploading using FTP?? You should be using a secure protocol like SFTP.
 
brother... sometimes it is not you... it is the servers itself....

what i recommends is you move to another webhost servers or providers and re-create sites all over agains.... use different passwords

also try use ip log to see ip that often coming to server.... ban that ips
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top