perezbox

HI @duncantmc

This means you have something on the server blocking the scans, why it’s generating 403’s (forbidden).

Are you running wordfence? maybe some .htaccess rules? or some other tool that might be proactively blocking IPs?

Thanks

Hi @jaschaio

Bravo on going to your logs for answers!! Love it!!

Is this a VPS?

Too bad you deleted the /uploads folder, all you had to do was disable PHP execution in the directory. They were executing a mailer script, pretty common these days.

As for what happened, seems they were able to brute force as you described, but it is odd being your user / pass combination.

It’s no surprise they installed their own tools, that’s very common. They will install and configure the things they are most comfortable with to accomplish their goals. Speculating beyond this will be very tough though with direct access to see exactly what happened.

Nice catch though.

Tony

Hi @islandwoman

This is very common. The bots are still hitting the known location, it’l persist for a while until someone sees the issue and takes your domain out of rotation.

Tony

Hi @islandwoman

Spoke with one of our analysts, and he decoded it for you and everyone else. This is a file upload backdoor, you can see it in it’s raw format here: https://pastebin.sucuri.net/zo0u27ibhy5tc1k

The attacker is able to use this to upload a file, likely another backdoor to gain full access to the environment.

I’d say you’re environment is definitely compromised.

Tony

Hi @islandwoman

It’s hard to answer this question:

“Can anyone tell if this is a malicious code? And how this file keeps reapping?”

1 – We’d need to see the file, and it’s content.

2 – The real question is how the file getting there? There are instances in which hosts add files to the root, so it could be theres. Have you asked them if they’re familiar with the file? If they’re not, then it’s pretty safe to assume the environment compromised.

3 – Sounds like you addressed all the access control issues, although hard to verify based on what you said and not knowing what your environment consists of. The next question would be, how are you addressing all the software vulnerability issues? Neither the WordFence or Sucuri plugins will address that.

Here is a good article on the subject: https://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-ecosystem.html

4 – Most scans will only show you something if the integrity of a file is changed, or if the site is displaying something externally. Backdoors and other scripts can be a bit tricky, just depends on how you have tools configured.

Answers to some of the questions would help move things in the right direction.. 🙂

Tony

Hi @peterlee

This statement is grossly inaccurate: “WordPress script is one of the easiest platform to be hacked in.”

Whomever told you this is misinformed and lacks knowledge in WordPress and Security. The platform itself is one of the more mature platforms on the market. In my experience hacks website owners experience are rarely attributed to the platform itself. They’re often associated with things website owners do, like installing plugins / themes and not appropriately managing the environment.

It’s hard to decipher where to even begin with your post as you don’t ask a specific question. It seems your host is taking care of the problem, is that right? I would take time to read through the guides @james provided as a good place to start.

I’d also take some time to read this article, that talks to the real vulnerability within the WordPress environment.

Hey @ryseale

I got your email, will send you a note in a bit.

Tony