WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So in my quest to solve this mystery, I actually found some script that might be similar to one used to deface our sites: http://pastebin.com/raw.php?i=hcvPE8YV

Now my question is where do they usually run this? Do they run it inside the hacked server or their own PCs?

share|improve this question

closed as off topic by Michael, Wyck, Rarst Aug 4 '12 at 16:09

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

They run it on your server, just like any other script runs (including WordPress).

In the log you provided, it looks like the hacker knew your password. Perhaps you are using the same password on other sites, and he somehow gained access to one of them?

Always set different and complex passwords; combine a large character range; include special characters and so on...

share|improve this answer
I really like to believe he knows the password but these are not my personal sites, these are shared hosting clients' sites. All passwords are different. The logs show they hit wp-login right away like it's being run from a script. It is also worth noting that the root account was never used since I am always notified if there was a root login. The hacker appears to change the password first in the DB before he logs to WP directly through automated scripts not manually. How they edit the database password without root access is a mystery to me. Access logs don't show any trace of their IP. – IMB Aug 3 '12 at 19:08
The only trace of their IP is only in the logs I provided, nothing more. – IMB Aug 3 '12 at 19:12
Hacker appears to be a member of indonesiandefacer.org as I saw it as one of the referrers in the logs. – IMB Aug 3 '12 at 19:13
then you provided partial logs; I don't see anything there that might suggest he changed your password trough another script – onetrickpony Aug 3 '12 at 19:47
Yeah that's the thing, there are no more relevant data aside from that. – IMB Aug 3 '12 at 19:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.