I manage a client hosting account on [color]host platform. It is a VPS account, running CENTOS 6.10 kvm [server] v84.0.16 OS. There are PHP/MySQL sites, along with WordPress sites. All WordPress sites/plugins/themes are latest versions.

There is a persistent hack going on. The indicators are modified wp-config.php and index.php (WP) files with inserted code (obfuscated); [random].php files, hidden ICO files scattered about all folders (WP and non-WP). The obfuscated code does an 'include' of the hidden ICO file. The hidden ICO file contains obfuscated code that tries to insert code in the footer of a WP site, but fails because the options references by the code does not exist in the WP site(s).

The modified files often have the execute permission added (like the index.php) file. I remove that permission while cleaning up, but the file is changed. Most files normally have a permission of 644; folders have 755.

The modified files reoccur after full inspection and cleanup of all files, including looking at the databases used by the sites (I have found some inserted WP 'posts' in the wp-posts database; they were removed.). The modified files do not have a current date; the date is always somewhere in the past. So looking for recently modified files doesn't work. Cleanup includes editing files and removing obfuscated code, changing file permissions, and removing unauthorized files (like hidden ICO files, and the [random].php files).

There are no extra WP admin-level users (or any other level). I have changed credentials on the hosting platform, all databases, all FTP users, and SQL database; strong (and different) passwords throughout.

I have used htaccess commands to deny access to wp-config.php file (and others), but the files are still modified without authorization.

I don't see any obvious processes running on the server (I have terminal access through WHM), although my Linux expertise is just above minimal. I also don't see any unusual user names with this command: getent passwd | egrep -v '/s?bin/(nologin|shutdown|sync|halt)' | cut -d: -f1

I think that determining who (or what) is modifying files might give me a clue to how the unauthorized changes to files are being done. So am looking for guidance on how to monitor a particular file (say, the wp-config.php file in one of the WP sites) for changes, with information on who/what changed it.

What would you recommend for further investigation of this issue? Thanks.


All files: owner = 500, group = 503

  • The crucial information besides file mode is the owner and group of the files. The web server just needs to read those files, they should be owned by someone else. – Piotr P. Karwasz Dec 6 '19 at 22:12
  • @PiotrP.Karwasz ; thanks. Added info (owner = 500, group = 503), all files. – Rick Hellewell Dec 6 '19 at 22:55
  • This is probably the user running PHP. Change the owner of the file to a user you trust (i.e. yourself :-): chown <username> -R /path/to/wordpress (it does it recursively). – Piotr P. Karwasz Dec 6 '19 at 23:02
  • Wouldn't changing the user to something else cause issues with PHP running the WP site? (And I admit that I am fuzzy on that concept, even with my 35 years of PC experience.) – Rick Hellewell Dec 7 '19 at 0:22
  • The webserver would still be able to read those files as group or other. The owner of the file can additionally modify permissions. – Piotr P. Karwasz Dec 7 '19 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.