0

I have been tasked with investigating a website that has been reported as abusive, I had no prior experience with this website and have no idea why or how things are set up as they are, in my investigations I have found multiple wp-admin folders with numbers on the end of them and a wp-config file that contains a lot of code that I don't believe should be there.

A lot of eval() functions that decode base64 code that when decoded contains globally defined variables like:

 if (!defined('ALREADY_RUN_1bc29b36f342a82aaf6658785356718'))
    {
    define('ALREADY_RUN_1bc29b36f342a82aaf6658785356718', 1);

     $ccexjwtgo = 413; function zscvdwpfe($bmbauwl, $uhkkg){$kirmhhq = ''; for($i=0; $i < strlen($bmbauwl); $i++){$kirmhhq .= isset($uhkkg[$bmbauwl[$i]]) 

I have updated the wordpress install to 4.7, updated all plugins and removed ones I believe to be a problem or unnecessary. Am I safe to assume that this site is indeed compromised? Or is this just some weird stuff imported from a plugin or what?

closed as off-topic by RRikesh, Dave Romsey, cjbj, bueltge, Pat J Dec 21 '16 at 23:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – RRikesh, Dave Romsey, cjbj, bueltge, Pat J
If this question can be reworded to fit the rules in the help center, please edit the question.

1

WordPress core does not contain obfuscated code (with unfortunate exception of revisions easter egg).

While wp-config.php can (and often does) contain arbitrary code, it is not normal for extensions to add anything there and there isn't an API way for it. In a nutshell it is meant to be edited by hand for specific configuration purposes.

I would assume any obfuscated code in that context to be harmful and site compromised.

Not the answer you're looking for? Browse other questions tagged or ask your own question.