Support » Fixing WordPress » New hack with file “temp-crawl.php”

  • Notification of possibly new hack/malware:

    Today our site “rebooted” to showing the install page.

    In the wordpress root directory a new file appeared, “temp-crawl.php” with code:

    [ Please don’t post hacking code. Thanks.]

    This appears to take the contents of supplied URL parameter ‘q’, write them to a new file “tempcrawl”, execute that file, then delete the file.

    I deleted temp-crawl.php but don’t know where the vulnerability was.

    Currently there are zero google search results for “temp-crawl.php” so this might be something new(?)

    • This topic was modified 1 month, 1 week ago by  t-p.
Viewing 14 replies - 1 through 14 (of 14 total)
  • Moderator t-p

    (@t-p)

    Carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Off hand, couple of names that come to mind are Sucuri and Wordfence.

    We have a around 10 customers that experience the same thing. All of them noticed within the last few hours.

    This one is ugly.

    Try to investigate website access log to locate IP used to access temp-crawl.php.

    Investigation of all previous HTTP requests from this IP may point on initially exploited file or vulnerability allowed drop of this code.

    @quttera Can you list what 3rd party plugins you are using?

    I just dealt with this… The wp-config file was renamed bad.wp-config, I renamed and accessed it. The database settings were changed and the DB name and password now ended in “FCK”, and the . There were a couple of files (wp-crawl.php and wp-crawl.php.1 and installer.log.txt and wp-snapshots) that appeared this morning at 8:52 am. Cleaned out the site, reset the users, changed the salt keys, etc…

    @te_taipo here is the list of plugins we are using on our setups.

    These are not live websites and mostly used for exploits verification and tests/regression of our security plugin (quttera-web-malware-scanner).
    Not sure how this list will be useful… But here you go:

    ajax-search-lite
    akismet
    all-in-one-seo-pack
    bbpress
    buddypress
    contact-form-7
    duplicator
    google-analytics-dashboard-for-wp
    google-analytics-for-wordpress
    jetpack
    ml-slider
    quttera-web-malware-scanner
    regenerate-thumbnails
    simple-social-buttons
    theme-check
    updraftplus
    w3-total-cache
    woocommerce
    wp-crontrol
    wp-slimstat
    wp-super-cache
    yeloni-free-exit-popup

    It appears that duplicator is the issue. Are all of these plugins the latest versions, in particular duplicator

    Thanks @dennishermannsen for suggesting the vulnerability is in the Duplicator plugin.

    I got our site back online by just going through the WP setup wizard steps and using the credentials for the same (existing) database. Setup then said “..already installed..” and the site was public again. That’s only a temporary fix and I’ll do a full reinstall of WP without Duplicator plugin to clean it out.

    If you’re not actively using Duplicator, I’d recommend removing it and also removing all files created by it. If you need it in a later stage, you can always reinstall the plugin.

    Having a poke around some of the installer code, I tend to agree, its not safe being left on a website.

    calvin_42

    (@calvin_42)

    FYI, same problem happened on my website.

    The php file uploaded in wp-content/uploads was using the script https://pastebin.com/raw/jmxnY3Rk that includes a JS script in all posts via a MySQL query.

    Moderator t-p

    (@t-p)

    @dirac3000,

    Please do not jump into other topics. If the troubleshooting already posted made no difference for you, then, as per the Forum Welcome, please post your own topic.

    Your post has been archived.

    dirac3000

    (@dirac3000)

    I had a similar problem with a friend website. I ended up writing a python script to clean most of the files polluted by the malware. I posted the script on github, in case someone needs it.

Viewing 14 replies - 1 through 14 (of 14 total)
  • You must be logged in to reply to this topic.