my wordpress website is redirecting to the following shell.

I've taken the website offline and restored from backup - although I'd like to understand more about this shell.

I've setup a 'test' server with the hacked shell.

if I go to "hackedwebsite.example.com" (running WordPress) - I'm redirected to this shell.

If I go to "hackedwebsite.example.com/wp-admin" - I'm redirected to this shell but in the wp-admin directory.

Where does the redirect take place, and where is this shell installed (such as .PHP files).

shell screenshot

it's quite the 'crafty' shell hack

  • If the url doesn't change, you are not redirected anywhere. What's in your .htaccess? Otherwise, it could be almost anywhere in the WP installation. You could run a diff comparison between the clean and the infected site. – Esa Jokinen Mar 26 at 6:13
  • I'm familiar with the command 'diff' comparisons - but I don't know how to read the output of the file. I don't have .htaccess my website is nginx – IanArman Mar 26 at 6:38
  • Ok. I wouldn't tag a question apache-2.2 if it's Nginx, though. – Esa Jokinen Mar 26 at 6:42
  • I thought I'd keep 'hackers' guessing... lol! I guess I have to reveal some secrets. lol – IanArman Mar 26 at 7:03
  • I could attached the 'shell.php' installation script. I can decode the base64 – IanArman Mar 26 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.