A WordPress site I run recently got hit by malware.
Luckily I had backups, so I was able to recover, but I wanted to write up what I learned as a reference for future prevention.
File Damage
The image above is what the files looked like in my FTP client.
You can see that a suffix of __8997da9 was appended to the filenames.
Once I removed that suffix and restored the .php extension, I was able to open the files and view them as they originally were.
about.php
A file called about.php had been created, and it turned out to be doing the following:
- Reading its own file contents via
file_get_contents(__FILE__) - Splitting on something like
explode("?>", …)to pull out a long payload hidden after the closing PHP tag - Decoding it with
base64_decode/str_rot13, then executing it via something likepreg_replace('/…/e', …)or@eval()
— that's the pattern of code I found.
revisions.php
A file called wp-includes/revisions.php had also been created, and checking the access logs showed an abnormal volume of requests to it.
Access Logs
Total abnormal request count
- Total requests: 429,939
- Daily average: roughly 150,000
Most of the traffic was Googlebot
According to the report broken down by organization, "66.249" (Googlebot's IP range) accounted for 98.9% of all requests.
| IP Organization | Requests | Share |
|---|---|---|
| 66.249 (Googlebot) | 420,981 | 98.9% |
| 20.xxx | 3,779 | 0.19% |
| 52.xxx | 835 | 0.32% |
| Other | Small numbers | – |
Googlebot itself wasn't at fault here — it seems that Google mistook the "malicious URLs generated by the infection" for legitimate pages and crawled them.
Requests concentrated on the malicious files
