hacked index.php file with 444 permissions won’t stay changed

  • Resolved WebHostPro

    (@dwhswebhosting)


    4 years, 6 months ago

    Hi,

    We have a complicated hack with two WordPress sites.

    Both hacked WordPress sites version 5.4.1 have the main index.php files changed to permissions 444 and filled with hacked content.

    We have changed the tried changing permissions from the user account and root, we have tried removing the file from the user account and root, we have tried changing the content from the user account and root.

    No matter what we do the file always changes back to permissions 444 with the hacked content in it.

    The page I need help with: [log in to see the link]

Viewing 6 replies - 1 through 6 (of 6 total)
  • Moderator Samuel Wood (Otto)

    (@otto42)

    www.ads-software.com Admin

    Restore from a backup you made before the hack then close the hole that allowed them to get in to the site in the first place.

    If something is changing files, then you are still hacked and you haven’t removed the hack yet. Until you do that, there is no cure.

    Thread Starter WebHostPro

    (@dwhswebhosting)

    Thanks, there is no back up.

    The goal here is to find the whole now and the hack and fix it.

    Thread Starter WebHostPro

    (@dwhswebhosting)

    *hole

    How can they have the file be restored with the hacker code the second it’s removed, and the permissions changed?

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.ads-software.com Admin

    The only way it can happen in the manner you describe is if something is still running on that machine to prevent changes to the files.

    Thread Starter WebHostPro

    (@dwhswebhosting)

    Yeah, I figured that. Thanks. Any idea how to track down what it is?

    Thread Starter WebHostPro

    (@dwhswebhosting)

    O.K. great, after a lot of research and some big help, we found how the hack was working.

    The code added to the main index page of WordPress was telling PHP-FPM to rebuild the file from it’s cache if it was changed.

      1. To remove or edit the file, you first need to disable PHP-FPM.
      2. Change or remove the index.php file.
      3. Then you can restart PHP-FPM and start doing normal work on the site.

    Hope this helps someone.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘hacked index.php file with 444 permissions won’t stay changed’ is closed to new replies.