Comments on: How to find a backdoor in a hacked WordPress

By: thearchitekt

thearchitekt — Sun, 28 Apr 2013 15:01:35 +0000

I found a bunch of spammy links on the homepage of my site, looked further and found this in my functions. I’m fairly certain the hacker came in through the server. It’s a shared server and I was able to thumb my way up through the folders until I was inside the server and back down into the other sites hosted there using ftp. I had no idea it was that easy.

By: Alex

Alex — Sun, 07 Apr 2013 22:58:26 +0000

Even though this exploit is a few years old, I’m still seeing it happening on many websites.

By: Wordpress Security for Designers

Wordpress Security for Designers — Tue, 19 Mar 2013 14:00:54 +0000

[...] Find the hacker backdoor that leaves you vulnerable: See Otto on removing hacker backdoors [...]

By: Derry Birkett

Derry Birkett — Tue, 19 Mar 2013 13:48:03 +0000

Often these backdoors are inserted with a server “owner” eg. apache:apache rather than an FTP user, and if you spot the hack straight away you can also filter by date and check for new files of that day: This will often locate a poorly hidden backdoor. i.e. you find a file in /uploads/ (for example) with todays date and the owner is apache:apache.

By: WordPress sites

WordPress sites — Mon, 03 Dec 2012 16:23:03 +0000

[...] This has nothing to do with DNS resolution – and the above error is a somewhat generic one, however with the "eval" in there I'd bet that you've been hacked. Take a look here: http://ottopress.com/2009/hacked-wordpress-backdoors/ [...]

By: sam

sam — Sun, 09 Sep 2012 01:26:59 +0000

i have the same garbage. can i delete this entry safely?

SELECT *
FROM `information_schema`.`PROCESSLIST`
WHERE (
`ID` LIKE ‘%clomid%’
OR `USER` LIKE ‘%clomid%’
OR `HOST` LIKE ‘%clomid%’
OR `DB` LIKE ‘%clomid%’
OR `COMMAND` LIKE ‘%clomid%’
OR `TIME` LIKE ‘%clomid%’
OR `STATE` LIKE ‘%clomid%’
OR `INFO` LIKE ‘%clomid%’
)
LIMIT 0 , 30

By: Otto

Otto — Fri, 31 Aug 2012 04:22:57 +0000

As much as I dislike the NextGen Gallery plugin, that’s not actually in there. You may have gotten hacked in some other manner and that file was simply added to the plugin directory. Because I’m not seeing anything particularly special in the plugin code itself:
http://plugins.svn.wordpress.org/nextgen-gallery/trunk/

By: dc

dc — Fri, 31 Aug 2012 04:05:03 +0000

With the help of this post, I have exposed the NextGEN Gallery plugin as having a backdoor into my WP install. Checkout the plugin’s “admin.php” file; you’ll notice it pulls a bunch of data from a remote url and dumps it into a wp option in the database. It then creates users and blog posts in mass using combinations of the data received. A huge PITA since this was registering 400+ users daily. Thanks for the suggestions!

By: nessy

nessy — Mon, 20 Aug 2012 02:49:27 +0000

Hello guys! I need your help. Please. I have a back door.

-I have share hosting in godaddy.
-Before only my root site was getting effecting and i was deleting the code, or restoring, but now
-all my sites got infected. In almost all php files end with this:

Please help me! I don’t know what to do. I asked sucuri.net but they said they charge for all folders each. I have one kind of injection. I can’t pay for all. Any help is appreciated.

One of the htaccess. I delete the injected code, and then I realized they got injected to other sites, too..

Pleaseeeee… I’m dealing with these for the last 2-3 months, and don’t know what to do..

Godaddy of course doesn’t help at all..

Thank you…

Any suggestion??

By: What Action To Take If Your Wordpress Site Gets Hacked | Tims Marketing Blog

Wed, 15 Aug 2012 02:49:19 +0000

[...] This site will help you with ‘backdoor’ hacks but it will probably be too technical for many WP users. http://ottopress.com/2009/hacked-wordpress-backdoors/ [...]