Hello…wanted to share the code that a hacker placed on a client’s wordpress site. I went ahead and ran it through a couple iterations of base64 decoding to get the actual code.
Encoded Launch Code embedded in your PHP pages (variables are different on each page, so search for the “<?php (and 20+ spaces)”
https://ideone.com/73pfAL
Decoded Hack
https://ideone.com/MEg3wO
They place the code typically in the header.php, index.php, functions.php and wp-config.php, but I would check your entire directory. It’s not obvious the code is there if you don’t have word wrap on. They inject it at the top, starting with “<?php (100s more spaces)” until it’s way off screen to the right. You’ll know it when you see it. It’s a nifty little bugger that uses arrays and the chr() function to build an “eval()” statement. That then runs the main hack.
The basic functionality is that it runs only on iphones and ipads. They redirect you to a mock up of the iTunes store to download a porn app called “BaDoink”. It captures your IP address and places it in a file they created in a temp directory or the root of your WP installment. It’s named “.. “. You typically just overlook it.
Anyway, hope this helps in case you find yourself or a client’s site hacked.?
