Latest Announcemnent
New thread
Status
Not open for further replies.
N

neo404

Active Member
271
2011
19
35
Hi!

i have a Wordpress Blog which seems to be hacked... if i go to domaim.com/category i always get this login site:

DKcjiT4.png


I already searched around for suspicious files and found nothing...

PLEASE can anybody help me!!

I can click the Wordpress Posts, but if i want to navigate to a Category i always get this crap login site..... Source Code from this site:

PHP: 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> 
<title>I-47 : By Arjun</title>
<script type="text/javascript">
checked = false;
function checkedAll () 
{
    if (checked == false){checked = true}else{checked = false}
	for (var i = 0; i < document.getElementById('myform').elements.length; i++) 
	{
	  document.getElementById('myform').elements[i].checked = checked;
	}
}
</script>
<style type="text/css">
<!--

body,td,th {
	color: #FF0000;
}
input.but {
    background-color:#006633;
    color: white;
    border : 1px solid #ccc;
}
a:link {
	color: #00FF00;
	text-decoration:none;
	font-weight:600;
}
a:hover {
	color:#00FF00;
	text-decoration:underline;
}
font.txt
{
	color: #00FF00;
	text-decoration:none;
	font-size:17px;
}
a:visited {
	color: #006600;
}
input.box
{
    background-color:#0C0C0C;
    color: white;
    border : 1px solid #ccc;
	-moz-border-radius:6px;
	width:400;
	border-radius:6px;
}
input.sbox
{
    background-color:#0C0C0C;
    color: white;
    border : 1px solid #ccc;
	-moz-border-radius:6px;
	width:180;
	border-radius:6px;
}
select.sbox
{
    background-color:#0C0C0C;
    color: white;
    border : 1px solid #ccc;
	-moz-border-radius:6px;
	width:180;
	border-radius:6px;
}
select.box
{
    background-color:#0C0C0C;
    color: white;
    border : 1px solid #ccc;
	-moz-border-radius:6px;
	width:400;
	border-radius:6px;
}

textarea.box
{
    border : 3px solid #111;
    background-color:#161616;
    color : white;
    margin-top: 10px;
	-moz-border-radius:7px;
	border-radius:7px;
}
body {
	background-color:#000000;
}
-->
</style>
<body>
	<center>
	<form method="POST">
	<div style="background-color:#006600; width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px; background-image:url(Windows_7_-_Alien_from_outer_space.jpg);">
		<table cellpadding="9" cellspacing="4">
			<tr>
				<td align="center" colspan="2"><blink><font size="7"><b>I-47 v1.3 </b></font></blink></td>
			</tr>
			<tr>
				<td align="right"><b>User Name : </b></td>
				<td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;"  value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
			</tr>
			<tr>
				<td align="right"><b>Password : </b></td>
				<td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;"  value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
			</tr>
			<tr>
				<td align="center" colspan="2"><input type="submit" class="but" value="     Enter     "></td>
			</tr>
			<tr>
				<td colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By Arjun==--</b></font></td>
			</tr>
		</table>
	</div>
	
	</form>
	</center>
<br>
</body>
</html>
 
4 comments
I think he found a bug on your wordpress blog and he put the code into every category. Try to delete his code if that wouldn't still work then you should delete the whole files in your hosting.
 
The hacker must be using an exploit of the plugins you are using,

Even if you replace the file with original he will be back again, Run ClamAV and see what all files are infected and md5 check of all files can help finding which files are affected and disable the plugin related to the file.

Secure your server (or ask your hosting to do so), There are certain measures which can prevent the script from running. Sometimes, hackers gain access to other account on server using symlink too. So ask your host to secure apache from symlink attacks.
 
Status
Not open for further replies.
Back
Top