Need Help with this Backdoor

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #1

Today, all three websites face this critical error. Later when I debug i have found the below PHP code in my plugins folder.

Spoiler: PHP File

Gofile

Gofile is a free and anonymous file-sharing platform. You can store and share data of all types (files, images, music, videos etc...). There is no limit, you download at the maximum speed of your connection and everything is free.

gofile.io

I only Use WP Smush and WP rocket Nulled Downloaded from Babiato Trusted Uploader. I don't know how it got into my websites.

Can anybody guide me to prevent future attacks? i am using wordfence for security.

 

Last edited: Aug 25, 2020

B

BlackAlbum

Active member

Oct 20, 2018

268

143

43

• Aug 25, 2020

• #2

use wordfence for security and these type of breaches

 

hacgiay

Well-known member

Trusted Uploader

Jan 4, 2019

651

359

70

EasternLaos

• Aug 25, 2020

• #3

go to file manager -> plugin folder -> rename those folder

 

• 

Reactions: Hexor

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #4

hacgiay said:

go to file manager -> plugin folder -> rename those folder

Click to expand...

i have done it. deleted the file.
but i dont know how it got into all my websites.
can anyone explain?

 

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #5

dhavalfuletra said:

use wordfence for security and these type of breaches

Click to expand...

yeah, found the backdoor with wordfence.

 

hacgiay

Well-known member

Trusted Uploader

Jan 4, 2019

651

359

70

EasternLaos

• Aug 25, 2020

• #6

found some sites with cplugin.php with google

Index of /wp-content/plugins

Index of /wp-content/plugins3

 

• 

Reactions: Hexor

hanson21

Member

Nov 14, 2019

95

19

8

• Aug 25, 2020

• #7

try to disable and enable plugins one by one to detect

 

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #8

hacgiay said:

found some sites with cplugin.php with google

Index of /wp-content/plugins

Index of /wp-content/plugins3

Click to expand...

Even among three of my sites, on one I did not use any nulled content. I don't know how to figure out how it got into all my sites.

 

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #9

hanson21 said:

try to disable and enable plugins one by one to detect

Click to expand...

problem is fixed bro, I need to know how it got it my websites

 

MrSam_1

Well-known member

Administrative

Trusted Seller

Dec 1, 2018

24,129

27,394

120

• Aug 25, 2020

• #10

What wordfence said? It have reported some modified files, from which plugin? You said you have 2 that use nulled plugins and one that use legit plugins. All 3 sites have the same plugins and theme?

 

• 

Reactions: Hexor

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #11

slvrsteele said:

What wordfence said? It have reported some modified files, from which plugin? You said you have 2 that use nulled plugins and one that use legit plugins. All 3 sites have the same plugins and theme?

Click to expand...

No two site on Newspaper theme, using basic plugins comes with newspaper, and a2 optimized plugin from a2hosting and Rank math, WP smush and Wp rocket.

Wordfence said, we have found a backdoor on your site, then I have downloaded the file and deleted it from the websites.
i can't figure out how it got all my websites where I am not even using nulled plugins on one site.

 

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #12

slvrsteele said:

What wordfence said? It have reported some modified files, from which plugin? You said you have 2 that use nulled plugins and one that use legit plugins. All 3 sites have the same plugins and theme?

Click to expand...

Here is the warning Wordfence Showed

 

MrSam_1

Well-known member

Administrative

Trusted Seller

Dec 1, 2018

24,129

27,394

120

• Aug 25, 2020

• #13

It is not mandatory that a nulled plugin is the cause. There are flaws given by poor coding on everything. Developers are not security experts, they just follow some security guidelines and coding practices and it's quite easy to miss something. If you want to know how it got there you should get your hands really dirty and occupy your time with checking the access log and error log for all sites and find the request that normally shouldn't be there. It's a humongous load of work but if you're patient and check thoroughly you might find the issue and the infiltration.

 

• 
• 

Reactions: smalok and Hexor

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #14

slvrsteele said:

It is not mandatory that a nulled plugin is the cause. There are flaws given by poor coding on everything. Developers are not security experts, they just follow some security guidelines and coding practices and it's quite easy to miss something. If you want to know how it got there you should get your hands really dirty and occupy your time with checking the access log and error log for all sites and find the request that normally shouldn't be there. It's a humongous load of work but if you're patient and check thoroughly you might find the issue and the infiltration.

Click to expand...

this is what I have been thinking when I saw my fresh site was infected too, thanks for your guidelines

 

funguy

Active member

Jul 31, 2020

257

126

43

India

ieltsessays.com

• Aug 25, 2020

• #15

It is server issue. Some servers are not secure enough. Hackers can inject malicious files easily on sites hosted on such servers.

 

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #16

funguy said:

It is server issue. Some servers are not secure enough. Hackers can inject malicious files easily on sites hosted on such servers.

Click to expand...

I am using A2hosting, they are reputed enough. i have sent them a message also, let;s see what they reply

 

funguy

Active member

Jul 31, 2020

257

126

43

India

ieltsessays.com

• Aug 25, 2020

• #17

hexor said:

I am using A2hosting, they are reputed enough. i have sent them a message also, let;s see what they reply

Click to expand...

I have been dealing in such issues for long. So, there is some sort of vulnerability for sure. No server is perfect.
I would like to give a small example, if NASA, FBI, Twitter etc. can be hacked, there is nothing which is hack-proof

 

• 

Reactions: Hexor

Hexor

:):

Trusted Seller

Trusted Uploader

Jun 23, 2020

2,005

1,546

120

Pale Blue Dot

• Aug 25, 2020

• #18

funguy said:

I have been dealing in such issues for long. So, there is some sort of vulnerability for sure. No server is perfect.
I would like to give a small example, if NASA, FBI, Twitter etc. can be hacked, there is nothing which is hack-proof

Click to expand...

yeah this is true

 

MR A

Well-known member

Trusted Seller

Trusted Uploader

Banned User

Apr 19, 2019

755

299

63

Root

• Aug 25, 2020

• #19

same happen with me too my fresh 1-month site infected and 10000 backlinks generated am not using both domain yet

 

• 

Reactions: Hexor

guguk

Well-known member

Jul 19, 2019

1,150

828

113

Ottoman Empire

• Aug 25, 2020

• #20

it could not caused by nulled-plugins.
Check also PC. if there have any malware it could be steal your hosting credentials.
Delete un-used FTP account.
Check browser add-ons.

 

• 

Reactions: smalok