Question 30860 in Wordpress Question posted in
The official Wordpress documentation can be found here.

WP site keeps getting hacked for a cryptojacker – How to find the leak? – WordPress

I’ve got a site that has been hacked for the fourth time now this month. With scripts hosted on autofaucet.org. (sloppy code even, found their names. Some Russian dudes. But that’s off topic) I’ve taken some measurements to prevent a new hack, but alas…

  • I’ve installed a clean WP installation on the server, with clean files and a clean DB.
  • reinstalled the plugins clean
  • I have All In One WP Security & Firewall plugin for file scanning, firewall, hide inlog page, etc.
  • Changed all the wordpress passwords.

I’ve notices the encoded code is being placed in files called assets.php.

I’m curious how a hacker would inject/place the code on the server. How to prevent it better and what questions to ask the webhost company. I’ve asked them before and they just say it’s my fault, update the wp installation and move on. What should they check if the code is injected from their side?

Tags:

2

Answers


  1. 0

    Your log files (of the web server) e.g. /var/log/nginx/access.log with the nginx web server will tell you who it was. Look for the change date/time of the assets.php file. Then check server access logs for IP addresses from that exact time. Then search logs for that IP address. You will find the first accesses by that IP address. That was likely the hack.

    Usually WordPress plugins are to blame as long as you keep the WP site updated. So, you could disable plugins not needed urgently, and disable the others one by one, or all for testing.

    As a workaround, you can make the index.php (or other) file under attack read-only. In the past I have worked around particular attacks by chown root.root filetobeattacked.php which usually works (but may hinder updates, so it’s a temporary solution). If you are not root on the server (shared hosting) perhaps chmod 444 filetobeattacked.php could work.

    Login or Signup to reply.
  2. 0

    I had same issue before. It might be the wordpress core files.

    1. Delete all files except wp-content, then download and replace it with the new wordpress files.
    2. Search for ‘autofaucet.org’ inside wp-content, and remove if necessary.
    3. Open wp-contents/themes/ then check functions.php – check if any additional code is there on top. Check the last updated files and time inside the theme and plugins.
    4. Export database files and searcg for ‘autofaucet.org’ and remove if any item found.
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search