my wordpress website is redirecting to the following shell.
I've taken the website offline and restored from backup - although I'd like to understand more about this shell.
I've setup a 'test' server with the hacked shell.
if I go to "hackedwebsite.example.com" (running WordPress) - I'm redirected to this shell.
If I go to "hackedwebsite.example.com/wp-admin" - I'm redirected to this shell but in the wp-admin directory.
Where does the redirect take place, and where is this shell installed (such as .PHP files).
it's quite the 'crafty' shell hack