wordpress-wp-vcd-malware-attack-solution - GitLite

KO | EN

gitlite — search

#awesome #svg #javascript #react-native #computer-vision #list #php #cpp #gemini #html

wordpress-wp-vcd-malware-attack-solution

(★ 29)

Another attack on wordpress 4.8

파일 탐색기

ZIP 다운로드

.htaccess
class.wp.php
functions.php
jquery-Hyena-2.1.js
jquery.fancybox.js
jquery.validate.js
jquery.validate.min.js
jquery.waypoints.min.js
LICENSE
post.php
README.md
wp-tmp.php
wp-vcd.php

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

명령어 용어집

이 문서에서 사용된 명령어를 모아봤습니다. 낯선 명령어가 있다면 펼쳐서 확인해보세요.

🔍

`php`

설명 보기 ▼

PHP 명령줄 인터페이스.
더 많은 정보: <https://www.php.net/manual/en/features.commandline.options.php>.

php {{path/to/file}}

PHP 스크립트를 구문 분석하고 실행:

php {{[-l|--syntax-check]}} {{path/to/file}}

PHP 스크립트의 문법 검사(즉, 린트):

php {{[-a|--interactive]}}

PHP를 대화형으로 실행:

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Another attack on wordpress 4.8

Visit : <a href="https://medium.com/@rakshitshah/wordpress-wp-vcd-malware-attack-e7394801895d">Medium </a>,
<br>
Check out the guidelines and Remove above mentioned files to make your wordpress safe.

Let me know, If you find anything suspicious in your wordpress.<br>
If you think, your wordpress is now secure, Please click on Clap button on Medium.

# Update 1 :

# How it spreads?

The first thing to understand how to defeat an enemy is to understand it. The cause of WP-VCD attack is a nulled theme or a nulled plugin. Inside the plugin installation file many times is present this directive:

```
<?php if (file_exists(dirname(__FILE__) . '/class.plugin-modules.php')) 
  include_once(dirname(__FILE__) . '/class.plugin-modules.php'); ?>
<?php

/*
Plugin Name: Example
Plugin URI: http://example.com/
Author: John Doe 
....
*/
```

That directive load a script that will spread the malware. Opening that file is possible to found the malware code:

```
<?php
 
//install_code1
error_reporting(0);
ini_set('display_errors', 0);
DEFINE('MAX_LEVEL', 2); 
DEFINE('MAX_ITERATION', 50); 
DEFINE('P', $_SERVER['DOCUMENT_ROOT']);

$GLOBALS['WP_CD_CODE'] = 'PDHstAgXchan5E3JlcG9ydG...
```
So the first step to do in order to defeat the malware is to delete the involved plugin (or at least remove malware code from the plugin).

Edit: On 05/13/2020
As per the R&D, <a href="https://github.com/ThejeswarReddy" target="_blank" > ThejeswarReddy </a> found that,
<p>if you download null theme/plugin and inspect all files with your here mention code there is only folder that causing this issue that is '.settings' folder (usually in the root folder). it contains every file to create this malware, you can safely delete this folder and still the plugin/theme works!!</p>

# Contributor(s) : (Special Thanks To...)
<a href="https://github.com/rakshitshah94" target="_blank" > Rakshit Shah </a> <br>
<a href="https://github.com/gabriserra" target="_blank" > Gabriele Serra </a> <br>
<a href="https://github.com/codincafe" target="_blank" > CodinCafe </a> <br>
<a href="https://github.com/ThejeswarReddy" target="_blank" > ThejeswarReddy </a> <br>

EDIT #1 : (01/08/2018)
<h2>Contribution</h2>
If you want to contribute anything about WP-VCD attack, Create a pull request and let's try to make wordpress more secure.

<hr>
<h3>If you like our work, Share your some love, That will be appreciated!<h3>
<a href="https://www.buymeacoffee.com/9mood" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/default-blue.png" alt="Buy Me A Coffee" style="height: 51px !important;width: 217px !important;" ></a>