1

I'm running WordPress on IIS7 on one of my servers. For some reason, a hacker is able to change the read/write permissions on all of the files, and then inject a script tag into the top line of the index.php file.

Where should I start looking in order to figure out how they're overwriting the files?

2
  • You have hard evidence that this is exactly what happened? How do you know they changed permissions and injected code and not gained access some other way?
    – Ben Ashton
    Mar 17, 2012 at 4:19
  • I don't know how they gained access. I do know for a fact that permissions on the site files are changed and I know for a fact that a script has been injected into the index.php file. From there, my AV kicks in and quarantines the file and the site comes up 403. Mar 17, 2012 at 4:24

1 Answer 1

2

First up, upgrade to the latest version of wordpress. Then disable all plugins. That'll keep the buggers at bay while you do a bit more forensics on the machine.

Look through your access logs looking for requests around the time of the mtimes of the files in question that are either POSTs, or GETs with funny-looking query parameters. Note the URLs that are being requested, and whether they're associated with a plugin or the core code, which will help narrow down the attack vector. You can then re-enable plugins that aren't related to the problem (after again updating them to the latest version to minimise risk).

From there, it all depends on what you found previously and how much skill you have. You could play honeypot and try to get more info on what the attackers are up to, but I'm guessing you've probably got an uphill battle on that one from your apparent experience level. General advice is just to keep up to date on patches, watch the wordpress announcements for security updates, and pray you don't get hit by a zero-day.

2
  • Thanks, I'll check it out. I'm also wondering if they somehow hacked my friends FTP password, I'm seeing strange FTP activity. Mar 17, 2012 at 4:33
  • Yes, it's common for people's workstations to be infected with malware that scans for saved FTP passwords (or keylogs the credentials) and ships them to the intruder for exploitation.
    – womble
    Mar 17, 2012 at 4:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .