How did they hack my Wordpress sites

Question

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised".

I got alerts from Google Webmaster about a script in one of the WP sites. When I checked the sites, I found some links in the footer, mentioning "myteenmovies.net" and one another site. Whois information showed, they were Russian sites.

I also found some other PHP files with weird names, wxwz.php,xypz.php etc... The PHP code was encrypted with some eval(gununcompress(base64_decode())) like that. There was ananother file which had a comment "#Web Shell by orb".

I understand that the hacker has got complete access to my server (with Webshell script). All the sites are quite old (about a year), Wordpress 2.5. Permissions are 755. Can anyone guess or advise, how did the hacker upload the files? FTP/SSH/Cpanel passwords are quite strong. Any other ways?

Answer 1

That's your problem right there. Most of these attacks are carried out by automated scripts that look for known vulnerabilities in older wordpress systems. Since anyone can look at bug reports and changelogs, it's not too difficult to engineer a script to exploit a weakness.

Your best defense is to always have your wordpress version AND your themes/plugins up to date.

I used to have this problem with a few of my defunct blogs, but keeping them constantly updated fixed it.

Do a grep on your existing blogs and look for any iframes or eval method calls in your WP directory. Also check the DB. Once it's all clean, update your WP version and themes/plugins and keep it updated.

Next login to Google webmaster and, if you haven't already, prove ownership and ask for a review of your site. The warning should go away after awhile.

Answer 2

Welcome to reality. Your sites got hacked because you completely failed to take any precautions. Running such old and vulnerable versions of WordPress is simply asking for this to happen. Given the invitation you've created don't be surprised when people come to the party.

I suggest you either put some effert into your web sites or stop playing at being a webmaster and get someone who knows what they're doing to manage your systems and ensure all reasonable safety measures are implemented, including upgrading as necessary. There's more to a web site than just throwing a prepackaged version of software on it, typing some content and sitting back.

Answer 3

Unless you have the logs from the day it happened, there's probably no way you're going to know how it happened. There's tons of exploits against historical versions of wordpress like 2.5. Here's a few CVEs that might be how they got in:

• CVE-2008-2068
• CVE-2008-2392
• CVE-2009-2762
• CVE-2009-3890

Do you keep your plugins up to date? There's exploits against them too, that could be the avenue of attack too.

You could spend days looking at CVEs and exploit code but the reason they got in there (assuming it was through wordpress) was through some bug in the code. This bug was probably found several years ago, widely published, and already fixed. There's probably nothing special about your wordpress install, it was probably exploited through some automated tool looking for old versions of wordpress.

Do you keep your plugins up to date? There's exploits against them too, that could be the avenue of attack too.

If you just want to see how someone might exploit some old version of wordpress, just search http://exploit-db.com .

FTP/SSH/Cpanel passwords are quite strong

Do you reuse passwords? Is your FTP password the same for that forum you maybe registered for 3 years ago that stored their passwords in clear text and got hacked? That's another avenue of attack.

Answer 4

See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex

Answer 5

Alex, unless you're a full-time security person, doing forensics on stuff like this is a waste of your time. Running WP 2.5, which is 3 years old, is just asking to be pwned.

A few simple rules:

• Be very conservative in what types of files you allow users to upload to your site. Best choice is "none".
• Keep current, tested, off-site backups of everything.
• Use/require good passwords for all accounts.
• Keep your software up-to-date,
• And, if you're the sysadmin, don't expose any services you don't have to (I normally limit it to ports 80/443 for web, and 22 for SSH).

Answer 6

I had the “WebShell by oRB” too, it may have come through phpThumb or through phpmyadmin (the plugin was taken from wordpress plugins and the developers said, one should delete ist. Since Ocober 18 they have rebuild it). The hackers inserted the file tar.php in themes/twentyten (there was a backdoor-script in it). I also found a malware in a text-document which was masekd as a video-document.