Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running WordPress on IIS7 on one of my servers. For some reason, a hacker is able to change the read/write permissions on all of the files, and then inject a script tag into the top line of the index.php file.

Where should I start looking in order to figure out how they're overwriting the files?

share|improve this question
    
You have hard evidence that this is exactly what happened? How do you know they changed permissions and injected code and not gained access some other way? –  Ben Ashton Mar 17 '12 at 4:19
    
I don't know how they gained access. I do know for a fact that permissions on the site files are changed and I know for a fact that a script has been injected into the index.php file. From there, my AV kicks in and quarantines the file and the site comes up 403. –  Chase Florell Mar 17 '12 at 4:24

1 Answer 1

up vote 2 down vote accepted

First up, upgrade to the latest version of wordpress. Then disable all plugins. That'll keep the buggers at bay while you do a bit more forensics on the machine.

Look through your access logs looking for requests around the time of the mtimes of the files in question that are either POSTs, or GETs with funny-looking query parameters. Note the URLs that are being requested, and whether they're associated with a plugin or the core code, which will help narrow down the attack vector. You can then re-enable plugins that aren't related to the problem (after again updating them to the latest version to minimise risk).

From there, it all depends on what you found previously and how much skill you have. You could play honeypot and try to get more info on what the attackers are up to, but I'm guessing you've probably got an uphill battle on that one from your apparent experience level. General advice is just to keep up to date on patches, watch the wordpress announcements for security updates, and pray you don't get hit by a zero-day.

share|improve this answer
    
Thanks, I'll check it out. I'm also wondering if they somehow hacked my friends FTP password, I'm seeing strange FTP activity. –  Chase Florell Mar 17 '12 at 4:33
    
Yes, it's common for people's workstations to be infected with malware that scans for saved FTP passwords (or keylogs the credentials) and ships them to the intruder for exploitation. –  womble Mar 17 '12 at 4:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.