@p-mt, sorry for late response, was busy last week …
sudo grep -r turnitupnow * > badfiles.txt
is good, but…
Do you know that:
1. PHP can be easily embedded in gif, jpg, png, mp3, wav… ?
2. A lot of plugins after unpacking has executable rights on gif, jpg, png, txt files, which can be executed as CGI in this case?
Always cure them with help of
find ./ -type d -exec chmod -vv 755 {} \;
find ./ -type f -exec chmod -vv 644 {} \;
3. Bunch of installations has 777 permissions on all wp-content folder instead of restricting it to “upload” only? (The best choice would be to remove ANY writable by HTTP server folders outside DOCUMENT_ROOT as it possible to do with other CMS, but changing it in the WordPress it’s a challenge)
4. Almost any HTTP server allows write permissions to /tmp which is most loveable place for any backdoors?
5. Most servers have bash, gawk… base utilities which can be called by anyone and can be easily used as backdoor channel,(so no need to keep anything on servers cuz it always available ?? ) any trace of activity will be logged on hosting?
Well there is a lot of scary things that out of your control if you dont run your own server. Hackers rarely infect systems in old fashion way. They usually keeps spare ways to reactivate itself after their visible stuff was detected and deleted. Spare ways could be anywhere, in database triggers, inside images or mp3 files(that actually always exposed by WordPress to the world)…etc
To be sure that you care at least your parts of software, check ALL your files that exposed by HTTP server with this simple commands(change directory to the ROOT of HTTP accessible aka DOCUMENT_ROOT):
# Check if some files trying to obfuscate itself
find . | xargs grep -i base64 > ../000-obfuscation.txt
# Check for links to external sites
# Especially pay attention if it is in php files
find . | xargs grep '\<:alpha:*://[^/]*'> ../001-external_links_in_urls.txt
# Review potentially malicious content
find . | xargs grep -Ei 'iframe|src|javascript:|eval|include' > ../002-active_content.txt
# Delete anything in temporary folder that was created by your
# account. (Dont worry that you may delete others files,
# /tmp has a stiky bit set on most servers, so you can not delete
# files that was created by others)
rm -fr /tmp/* ;
Dump MySQL database so it will be possible to parse it as a single text file and search for the same keywords inside it.
Well, there no universal advises because of different environments on servers and situation heavily depended on what type of plugins/themes do you use(BTW, don’t keep deactivated plugins/themes since it still callable from outside and if one find a hole he/she will able to use it)
Best regards,
Alex
