ini.php

When a website gets hacked, one thing we know for sure is that attackers love to leave malware that allows them access back into the site in future. This type of malware is called a backdoor. This type of malware was named this because it allows for remote control of a compromised website in a … Read more

Web Application Firewall

A Web Application Firewall protects Web servers from malicious traffic and blocks attempts to compromise the system. While proxies generally protect clients, WAFs protect servers. A WAF is deployed to protect a specific web application or set of web applications. A WAF can be considered a reverse proxy. WAFs may come in the form of … Read more

php fwrite base64 decode

An attacker trying hide malware, before it’s uploaded, fwrite to server and executed. This attacks type uses Cross-Site Request Forgery & Remote Content Execution vulnerability together (CSRF & RCE vulnerability) It’s also base64 encoded content, so it’s more difficult find with scanners. Example – fwrite & base64_encoded malware base64_decode malware When malware uploaded to server … Read more

common.php (Object Injection Vulnerability in Backup & Restore Dropbox)

WordPress plugin Backup & Restore Dropbox have PHP Object Injection Vulnerability. It’s allow remote download malware to the server. This vulnerability founded by pluginvulnerabilities.com and published it. We found that vulnerability try malware download common.php malware to server via FTP Protocol. Real Post Payload First file_get_contents download common.php malware and file_put_contents write it to server. … Read more

gzpdecode.php

WordPress Vulnerability in Cherry Plugin – Arbitrary File Upload The Vulnerability allow an attacker to upload all types of files without administrator login. /wp-content/plugins/cherry-plugin/admin/import-export/upload.php This is fixed latest version of Cherry Plugin, but all customers won’t update their website and files. Interesting comes heres, botnetwork search this old vulnerability and if found they upload malware … Read more

yiw_contact sendemail file upload vulnerability

Looking better POST payload, header looks normal request: In the below HTTP Post, there were 2 parameters that started with yiw. This indicates that the attacker is likely trying to explpoit the Beauty & Clean Theme File Upload WordPress Vulnerability which is literally as simple as posting your backdoor file to the contact field via … Read more

work1.php

This is old Arbitrary File Upload Vulnerability in Cherry Plugin (Worpdress). Malware tries patch .htaccess files and add own redirect that file. When a user access website with correct browser, then redirect activates and redirect user to another page. Last malware unlink (removes) itself. Full sourcecode

wp.php

If we look inside this PHP script (only a small part of the code): Execute wp.php If we run this, we found PHP Command shell WSO 2.5 (backdoor) this file: Detect this malware Malware Expert – Signatures found this malware from php code, if you want use our signatures for free.

Install ModSecurity Plesk

The following options are possible (GUI/CLI): via Plesk GUI go to Home > Tools & Settings > Updates and Upgrades: Add/Remove Components: and under the web hosting settings select ModSecurity: Installed: via CLI execute plesk installer CLI Installer Select Go forward (F) Select Go forward (F) and under Select the components you want to install … Read more