wordpress exploit, site hacked [newportalse.com]

My site just got this same attack.

Not good.

I got it also, scanned my site through securi.net, what did you use?

found some info on attacks, but nothing on this exact one if you’re interested:

https://www.google.co.uk/support/forum/p/Webmasters/thread?tid=111c656d782114dd&hl=en

https://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/

and https://sucuri.net/ is where I found the scan.

I have a friend that finds lots of exploits to fix, one of the lead guys out there, I will keep you posted if I find a fix.

You should check these out also.

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
https://codex.www.ads-software.com/Hardening_WordPress

Seems like, based on sucuri.net, the attack was on /wp-includes/js/l10n.js and /wp-includes/js/jquery/jquery.js

It had inserted the malicious code at the end of those files.

I went in and deleted the bad code – but the question remains, how did this happen?

It appears that they got to every one of these files on my server (I have multiple WordPress installs) so it was not just a single site attack, but perhaps a server attack.

I am using hostmonster.com.

yikes. I have at least 10 wordpress sites, what a pain. I saw it might be via tim thumbs php injection. but not certain.

My site (groaction.com) also got hacked by them a couple of days ago. I have timthumbs too, if that helps to get at the root of the problem.

Thanks for posting the links of where the bad code is. Much appreciated.

Whois info for newportalse.com:

Provorov Aleksey ([email protected])
SOKOLINOY GORYi 5-Ya UL., 23
Moskva
Moskovskaya obl,105275
RU
Tel. +7.9104556998

I have timthumbs as well, looks like that’s where the exploit came from.

https://ma.tt/2011/08/the-timthumb-saga/

for more info on the timthumb exploit. It has been patched, but the theme or at least timthumb need updated

Yes, this one is happening through the timthumb.php vulnerability. We posted some details here too:

https://blog.sucuri.net/2011/08/attacks-against-timthumb-php-in-the-wild-list-of-themes-and-plugins-being-scanned.html
https://blog.sucuri.net/2011/08/wordpress-sites-hacked-with-superpuperdomain2-com.html

thanks,

I have a similar problem. Same domain and attack – there’s two infected javascript files on my site. Here’s the scan:

`
eb site: dotgamerclan.com
status: Site infected with malware
web trust: Not Blacklisted

Malware found on javascript file:
https://www.dotgamerclan.com/announcementsblog/wp-includes/js/l10n.js?ver=20101110

[Code moderated as per the Forum Rules. Please use the pastebin]

I don’t know how to “clean” the files. I think I fixed the timthumb hole, though, using the fix on https://blog.vaultpress.com/2011/08/02/vulnerability-found-in-timthumb/. I am also using Host monster. Can anyone help me clean these files?

You can post on jobs.wordpress.net if you want to hire someoen to clean your site.

[update]

seemed to have clean the install and no more problems. here are the steps I took:

1. download wordpress and extract l10n.js listed above, and replace it, there is malicious code in it.

2. clean your functions.php file in your themes, some versions of this might affect more than one install or theme, mine happened to just be in active theme. they inject about 100 lines then add some code.

the code:
https://pastebin.com/Qe1Ag47A

thats what you want to delete. also redo your salt tags.

3. make new username/password for wordpress and database.

https://sitecheck.sucuri.net/scanner/ posts that there is no more problems. this was scary as I have about a million hits a month, yikes, hope I didn’t do damage to other peoples computers :/

note: this might not be an exhaustive method, there more be more hidden code. my wordpress was updated to most current version and all plugins were updated, so I’m not sure how it happened.

so far no more problems. hope this helps.

You should also check your .htaccess and wp-config.php

They’ve both been affected in these attacks :/