wp-config file installed

  • Resolved danaruth

    (@danaruth)


    7 years, 10 months ago

    Hello! I found a second wp-config file installed on my domain and did not receive any notification of this event that replaced the DB parameters. It was only this evening, when trying to login, that I realized the site was down. A malicious wp-config file was the last thing I would be expecting, especially with Wordfence installed and configured. I also found the offending “user” and have no idea how they logged in. I am the only user and the login info is not generic. It didn’t re-direct site visitors elsewhere; instead the page displayed WP logo with country drop-downs. My hosting provider mentioned something about a database connection error and that’s when we found a second wp-config file. I have screenshots if it would be helpful. When trying to bring the site back up I experienced a conflict and had to deactivate my theme and all plugins, including Wordfence. I would like to know how this activity happened and what I could do to protect in the future. This conflict is still present and it appears that I have some major work ahead of me. Not happy 🙁 Thank you for your help!

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter danaruth

    (@danaruth)

    7 years, 9 months ago

    hello? anyone? i have restored my site, but would like a post-mortem to better understand how this happened or address a vulnerability. thank you 🙂

    Ambyomoron

    (@josiah-s-carberry)

    7 years, 9 months ago

    The second wp-config file presumably has a date/time stamp for when it was created. Check your web server access log for suspicious activity around that time. If you find nothing there, perhaps four (s)ftp credentials have been compromised.

    Simply restoring the site to its state before the attack will not prevent the same attack from occurring again. Presumably, you have taken other measures.

    wfasa

    (@wfasa)

    7 years, 9 months ago

    Hello @danaruth,

    I second @josiah-s-carberrys suggestion. You’d need to do a forensic analysis on the site to figure out where the additional wp-config.php came from. Since you have restored the site you may have wiped out the evidence at that point.

    Hopefully this won’t happen again but if it does, @josiah-s-carberrys suggested procedure above is a good start.

    Best of luck for now!

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘wp-config file installed’ is closed to new replies.