Free Wordpress EXPLOIT remove utility here

[ilbb]

Well my wordpress blogs were infected by some sort of exploit that allows hacker write files to my server and redirect traffic. It's really recommend to check your server for this shit+ upgrade to WP 2.51 asp! Here is handy tool I made to detect infected files + mysql database rows and remove this shit.

1) download tool here: http://64.15.156.39/remove_exploit.zip
2) download remove_exploit.zip -> unzip -> upload to your server
3) edit remove_exploit.php configuration part
4) login to your server via ssh
5) chdir to location where remove_exploit.php is located
5) run the tool: php remove_exploit.php

notice: you must be logged as user who has rights to the files ('root' will work for sure)

WARNING: USE THIS TOOL ON YOUR OWN RISK

[bringer]

Liar!!!!!!!!!!!!!

[jollyperv]

Rrrrrrrrrrrrrrrrriiiiiiight........

[Electric Lights]

1) download tool here: http://64.15.156.39/remove_exploit.zip

I'm not clicking that.

[bringer]

that link is broken, try this one instead
correct link

[ilbb]

PHP script in TXT for paranoids and noobs:

http://64.15.156.39/remove_exploit.txt

[Electric Lights]

PHP script in TXT for paranoids and noobs:

http://64.15.156.39/remove_exploit.txt

RICK ROLL!

[ilbb]

for 110% paranoids is tool here:

<?

/////////////////////////////////////////////////
$ABS_PATH_TO_WWW_DIR="/home/www";
$MYSQL_SERVER="localhost";
$MYSQL_ROOT_USER="root";
$MYSQL_ROOT_PASS="password";
////////////////////////////////////////////////

$i=0;
test ($ABS_PATH_TO_WWW_DIR);

function test($dir) {
global $i;
if(!$dh = @opendir($dir)) return;
while (($obj = readdir($dh))) {
if($obj=='.' || $obj=='..') continue;
if (is_dir($dir.'/'.$obj)) {
test($dir.'/'.$obj);
} else {
if ( (strpos("x".$obj,"pngg")>0) || (strpos("x".$obj,"jpgg")>0)) {
echo $dir.'/'.$obj."...exploit detected\n";
$i++;
unlink ($dir.'/'.$obj);
} else { echo $dir.'/'.$obj."...clean\n";}
}
}
}

$dbLink = mysql_connect($MYSQL_SERVER, $MYSQL_ROOT_USER, $MYSQL_ROOT_PASS) or die("Unable to connect to the database.");

$sql = "show databases";
$query = mysql_query($sql) or die("error fetching database names");
while ($rs=mysql_fetch_array($query)) {
mysql_select_db($rs['Database'],$dbLink) or die("Unable to select database: " . $rs['Database']);
$sql = "show tables";
$query2 = mysql_query($sql) or die("error fetching table names");
while ($rs2=mysql_fetch_array($query2)) {
$key = "Tables_in_" . $rs['Database'];
echo $rs['Database'].":".$rs2[$key];
mysql_query ("delete from ".$rs2[$key]." where option_name='wordpress_options'");
if (mysql_affected_rows()>0) {echo "...exploit detected\n"; $i++;} else {echo "...clean\n";}
}}
echo "============================================\ n";
echo "Infected objects: ".$i."\n";
?>

[ilbb]

Exploit described here: http://wordpress.org/support/topic/169246

[Camco]

Great tool, running it now, thanks ilbb

[ilbb]

If you are not sure about the script, you can remove 'unlink' commands to be 100&#37; safe. Tool will then report if infected files were found.

[u-Bob]

well intended but pretty useless. If your box has been compromised there's only 1 thing to do: wipe and reinstall.

[potter]

hackers suck

[Agent 488]

anyone have a better solution?

[fluffygrrl]

Nice catch.

Do you have any idea how you caught it ?

[fluffygrrl]

And by caught it I mean, how you came to be infected.

[Agent 488]

trying to find out. was using the latest version of wp - when outdated versions were thought to be the culprit.

[Agent 488]

it's only on one of my smaller virtual hosts - so that may be the problem.

[fluffygrrl]

The big concern is if wp is inherently vulnerable, through some mysql injection or xss issue maybe.

[AlienQ - BANNED FOR LIFE]

anyone have a better solution?

Yeah...

Upgrade your current version with the newest one.

[Agent 488]

Yeah...

Upgrade your current version with the newest one.

it was the newest one.

[Agent 488]

disabling plugins seems to work ... on some of my blogs anyway.

[just a punk]

Exploit described here: http://wordpress.org/support/topic/169246

I'm reading it already. Thanks for the link!

[fluffygrrl]

I've spent hours poring over this matter, and I have to my satisfaction resolved that

1. The point of infection is template/widget installation.

2. The version number has no bearing. You can get it just as well on 251.

3. It's not an inherent flaw in the wp php/mysql code.

[just a punk]

1. The point of infection is template/widget installation.

Did you find out how exactly they are using this vulnerability? It's very important to know in order to make an universal protection algorithm.

[fluffygrrl]

It's not really a vulnerability per se.

Upon installing a new template, you grant code in there same rights as the wp package. An infected template then alters the p_footer() hook, wp_head() hook or both, ads some entries in a bogus wp_options entrace in the options table, and voila. You're infected.

Moral is, never install code you haven't read. Don't be shy to crack "protected" stuff, especially if it's widgets, templates and the like.

[just a punk]

It's not really a vulnerability per se.

Upon installing a new template, you grant code in there same rights as the wp package. An infected template then alters the p_footer() hook, wp_head() hook or both, ads some entries in a bogus wp_options entrace in the options table, and voila. You're infected.

Moral is, never install code you haven't read. Don't be shy to crack "protected" stuff, especially if it's widgets, templates and the like.

Aha, so it's done by trojaned templates. One more reason so say: "free stuff is not always good and to always secure".

[fluffygrrl]

Actually, what I say is, encrypted code should never be run. Decrypt, read, consider, install. DRCI.

If you don't know how to crack your wp template, I've just explained it in my blog.

[just a punk]

Actually, what I say is, encrypted code should never be run. Decrypt, read, consider, install. DRCI.

Just in case if it's free. If you buy a commercial product you should trust to the developer or never buy it. However that should be a really insane "developer" who will put an exploit into his own product because otherwise sooner or later he will be exposed and will lose all this business, reputation and the money. It's like a shooting into your own leg

[fluffygrrl]

Which reasoning explains why blackhat seo or nigerian scams don't exist.

[teg0]

im 100&#37; against any themes that contain encrypted elements.

[tranza]

Liar!!!!!!!!!!!!!

I agree men!!!