Warning: preg_match(): Compilation failed: invalid range in character class at offset 4 in /home2/tbinforo/public_html/cicerone/wp-content/plugins/lightbox-plus/classes/shd.class.php on line 1384
Warning: preg_match_all(): Compilation failed: invalid range in character class at offset 4 in /home2/tbinforo/public_html/cicerone/wp-content/plugins/lightbox-plus/classes/shd.class.php on line 700
Warning: foreach() argument must be of type array|object, null given in /home2/tbinforo/public_html/cicerone/wp-content/plugins/lightbox-plus/classes/shd.class.php on line 707
Warning: preg_match_all(): Compilation failed: invalid range in character class at offset 4 in /home2/tbinforo/public_html/cicerone/wp-content/plugins/lightbox-plus/classes/shd.class.php on line 700
Warning: foreach() argument must be of type array|object, null given in /home2/tbinforo/public_html/cicerone/wp-content/plugins/lightbox-plus/classes/shd.class.php on line 707
Titlul este pompos ca in ziare si reviste. Pana la urma WordPress-ul a fost spart prin intermediul unei teme (theme, layout, sablon etc, cum ii zice fiecare). Aveam pe server mai multe teme gratuite oferite de mai multe site-uri (printre care si woothemes.com) si foloseam doar cateva dintre ele. Si prin una din ele, s-a putut intra si incarca pe server fisier cu cod PHP.
Orice programator mai rasarit – care mai face cracking, hacking – stie ca in momentul in care poti pune un fisier PHP pe un server, poti face multe pornind de acolo. Depinde ce doresti sa faci.
METODE
Am incercat sa astup groapa sapata de hacker si am folosit mai multe metode:
- restaurarea fisierelor din back-up oferit de hosting
- cautare de fisiere index.php si vizualizarea codului de la finalul fisierului
- stergerea fisierelor ciudate de pe server (ex: Thumbs.db)
- reinstalare de WordPress si alte site-uri
- cautare de texte prin baza de date
.htacces
Blogurile dadeau un mesaj ciudat in burtiera:
PHP Warning: Unknown: failed to open stream: No such file or directory in Unknown on line 0
PHP Fatal error: Unknown: Failed opening required '/home/abcdefg/public_html/abcdefgh/Thumbs.db' (include_path='.:/usr/lib/php:/usr/local/lib/php') in Unknown on line 0
Am reinstalat, am cautat si… nimic. Pana la urma hackerul se bagase in “.htaccess” si a adaugat linia de mai jos
php_value auto_append_file /home/abcdefg/public_html/abcdefg/Thumbs.db
deci degeaba cautam in codul php, caci era folosita metoda “auto_append_file”.
Succes la cei care au gropi de astupat!