Getting hacked today and now, please help

remove or rename your xmlrpc.php file

man and it continues

I noticed my pages weren’t loading, and I was generating HUGE error_logs. I deleted the error_log and two seconds later it was up to 62 mb. I finally got it downloaded and found errors related to a script running in page.php

This is what I found in my page.php:

<?php
$tpl = "/home/.numnod/mwsmedia/mattselznick.com/gfx/t-m-p.html";
$repl = "<REPL>";
$w1 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w2 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w3 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w4 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w5 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w6 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w7 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w8 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w9 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w10 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w11 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w12 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$w13 = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$keys = file("/home/.numnod/mwsmedia/mattselznick.com/gfx/key1.txt");
$wr1 = $w1[rand(0, count($w1)-1)];
$wr2 = $w2[rand(0, count($w2)-1)];
$wr3 = $w3[rand(0, count($w3)-1)];
$wr4 = $w4[rand(0, count($w4)-1)];
$wr5 = $w5[rand(0, count($w5)-1)];
$wr6 = $w6[rand(0, count($w6)-1)];
$wr7 = $w7[rand(0, count($w7)-1)];
$wr8 = $w8[rand(0, count($w8)-1)];
$wr9 = $w9[rand(0, count($w9)-1)];
$wr10 = $w10[rand(0, count($w10)-1)];
$wr11 = $w11[rand(0, count($w11)-1)];
$wr12 = $w12[rand(0, count($w12)-1)];
$wr13 = $w13[rand(0, count($w13)-1)];
$q = $_GET['go'];
$q = ereg_replace(".htm", "", $q);
$q = ereg_replace("-", " ", $q);
$fp = fopen($tpl, "r");
$fin = '';
while (!feof($fp))
     $fin .= fgets($fp, 1024);
fclose($fp);
$fin = ereg_replace($repl, $q, $fin);
$rd = rand(0,10000);
  $rd = $rd."";
 $rd2 = rand(0,10000);
  $rd2 = $rd2."";
 $rd3 = rand(0,10000);
  $rd3 = $rd3."";
 $rd4 = rand(0,10000);
  $rd4 = $rd4."";
 $rd5 = rand(0,10000);
  $rd5 = $rd5."";
$fin = ereg_replace("<SOME>", $rd , $fin);
$fin = ereg_replace("<SOME2>", $rd2 , $fin);
$fin = ereg_replace("<SOME3>", $rd3 , $fin);
$fin = ereg_replace("<SOME4>", $rd4 , $fin);
$fin = ereg_replace("<SOME5>", $rd5 , $fin);
$wr1l = ereg_replace(" ","-" , $wr1);
$fin = ereg_replace("<KEY1>", $wr1, $fin);
$fin = ereg_replace("<KEY1l>", $wr1l, $fin);
$wr2l = ereg_replace(" ","-" , $wr2);
$fin = ereg_replace("<KEY2>", $wr2, $fin);
$fin = ereg_replace("<KEY2l>", $wr2l, $fin);
$wr3l = ereg_replace(" ","-" , $wr3);
$fin = ereg_replace("<KEY3>", $wr3, $fin);
$fin = ereg_replace("<KEY3l>", $wr3l, $fin);
$wr4l = ereg_replace(" ","-" , $wr4);
$fin = ereg_replace("<KEY4>", $wr4, $fin);
$fin = ereg_replace("<KEY4l>", $wr4l, $fin);
$wr5l = ereg_replace(" ","-" , $wr5);
$fin = ereg_replace("<KEY5>", $wr5, $fin);
$fin = ereg_replace("<KEY5l>", $wr5l, $fin);
$wr6l = ereg_replace(" ","-" , $wr6);
$fin = ereg_replace("<KEY6>", $wr6, $fin);
$fin = ereg_replace("<KEY6l>", $wr6l, $fin);
$fin = ereg_replace("<KEY7>", $wr7, $fin);
$fin = ereg_replace("<KEY8>", $wr8, $fin);
$fin = ereg_replace("<KEY9>", $wr9, $fin);
$fin = ereg_replace("<KEY10>", $wr10, $fin);
$fin = ereg_replace("<KEY11>", $wr11, $fin);
$fin = ereg_replace("<KEY12>", $wr12, $fin);
$fin = ereg_replace("<KEY13>", $wr13, $fin);
$n = 10;
$links = "";
for ($i=0; $i<$n; $i++)
{
  $rankey = trim($keys[rand(0, count($keys)-1)]);
  $ranhref = ereg_replace(" ", "-", $rankey)."";
  $links = $links." <a href='./?go=$ranhref.htm'>$rankey</a><br>";
}
$fin = ereg_replace("<LINK>", $links, $fin);
echo $fin;
?>

Man I’m getting hacked hard here, any advice to batten down the hatches?

remove or rename your xmlrpc.php file

You have a collection of affiliate spam links at the bottom. And, again, 711 here and there…

cool, i deleted the xmlrpc.php and the footer spam links, so far so good but it’s still early

my host sent me the record showing i was attacked through wordspew chatbox. i was running a slightly older 3.01 version cuz the new one kept blocking users.

i would like to ensure the latest does not have the same attack vector as 3.01, though

what’s 711 here and there?

I went to bed last night hoping the activity was over, but it’s not. This morning there where three more post drafts saved, each taunting me for being hacked by worldhackerz.net, each under different existing usernames. I saved a local copy of the xmlprc.php last night and completely deleted it, and I disabled the wordspew plugin. I’m running spybot and ad-aware on my system now.

Any other advice? I’m also still wondering “what’s 711 here and there?”

https://www.textpattern.com

That’s where I’m headed. I’m thoroughly disgusted. I’ve been a WP forum member for nearly four years. This latest round of crap is the last straw. I develop WP sites for a living and I can no longer countenance this crap. There have been no definitive solutions to my problem. I can’t peddle this program to any of my paying clients, it’s insanity.

Backup your database, migrate to TextPattern, import your WP posts and have a nice life.

It’s what I plan to do.

Sorry I can’t be more help.

Dammit! I just checked my site about 30 minutes ago, no spam links. I check a moment ago again, and the spam links are back in my footer. I check footer.php and that same eval() link is there.

HELP!?!? What is the hole here?

if you re-enabled wordspew, that might be part of your problem

There is a version that is exploitable, so if youre opting to use that version for the sake of functionality, well, you can expect to reap what you sow.

I did not re-enable wordspew, I of course want to wait to make sure I’m not being attacked anymore. I of course also learned my lesson and when I do reenble wordspew will go with the latest version and will deal with the functionality issues at that time.

i went to delete the wordspew folder from my plugins directly, and it is gone already. why would the hacker delete it? i looked in my other plugin folders and did not see it moved anywhere. it does not appear in my admin panel plugins activation page, either.

spybot found not a single issue on my system. i reinstalled my pc a few weeks ago so it is fairly fresh.

i had one other admin account, but i demoted that account to a writer and changed it’s password.

i’ll try changing my passwords again, but i’ve got a feeling this is not over.

What is the hole here?

What is the hole here?

Considering that this is the second time youve asked that, and no-one has succinctly answered that question, you might consider your question answered with a “no-one knows”.

You might want to consider some options related to logging the data thats actual sent to your blog. You CAN log all $_POST variables, you dont need to log $_GET requests as they show up in your Apache logs already, but you can, you CAN even log everything that is sent to xmlrpc.php, via the superglobal $_SERVER, but you shouldn’t need to do that since youve disabled it.

In other words, at this point, I can only recommend taking a look at whats going on behind the scene, so to speak.

perhaps someone else has other ideas.
—

edit
On second look, regarding xmlrpc.php, just to correct my previous statement, theres a logging option built in.

Okay, as I said I completely removed the xmlrpc.php file, how do I do this logging? I am reading that other thread and you said to email you for the instructions to do that? do i need to put xmlrpc.php back in there under a renamed filename or ?

Thanks for the help!

I would NOT put back xmlrpc.php — that IS NOT a solution to your problem.

I explain how to log ALL $_POST variables sent to a wordpress blog and why it might be useful on my own blog >

https://www.village-idiot.org/archives/2008/02/02/wordpress-honeypot-project/

Please read the following closely:

You will want to edit that code, so that passwords of your writers are NOT written a to the logging file. Its done by putting in the IPs at the top.. My example only provides for 2 IPs, so if you have more than 2 you will need to change that line slightly.

The file that is written to needs to be writable by the web server, that means, typically, that it needs to be chmod 666.

Also, this will LOG ALL PASSWORDS used during logging in to the site. (thats why you want to make sure that you edit the $posty_ip so that YOUR info is NOT sent and that NO other administrator info is…

You will also want to rename the file that is logged to, don’t use the default name in my example, as anyone can bring it up in a browser and read it, as long as they know what is named. (Unless you put in a non-web accessable directory, which is doable, as well.)

—

This is not something that I recommend for the average user. IF, after reading that post, you are completely confused, dont try to forge ahead — contact me privately at whoo AT whoo.org and if you really want to do this, I will help you through setting it up via email or chat.

I would also ONLY do this if you are still actively being exploited.

Cool, I had not replaced the xmlrpcs.php yet so we’re good. I think I can do what you’re describing, but as you suggested I’ll wait to see if I get hacked once more before trying.

I’ll update later today if anything happens or not. The help is invaluable and much appreciated!