- This topic has 4 replies, 2 voices, and was last updated 3 years, 3 months ago by
.
-
Posts
-
My website was hacked. Appears the bad man was able to upload jpeg file with php code that allowed them to upload more php.
Today I found my CPU at 50%. It was at this level for over 24hrs (so before I found out that PPOM Pro was deactivated). I found it was a process called XMRig. Researched and saw that this was potentially linked to cyrptomining. https://www.wordfence.com/blog/2017/12/massive-cryptomining-campaign-wordpress/
Ran ImunifyAV through Plesk panel and found a file /wp-content/uploads/ppom_files/default.php. They were able to upload this via “POST /wp-admin/admin-ajax.php”.
I also found a folder in the domain root that was named xmrig-6.12.1 and it included a few files apparently to run the XMRig process.
Here is the start of the attack.
103.148.77.171 – – [24/May/2021:09:14:13 -0700] “POST /wp-admin/admin-ajax.php HTTP/2.0” 200 652 “website.com/product/productname/” “Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0”They uploaded this file that contained php:
103.148.77.171 – – [24/May/2021:09:14:13 -0700] “GET /wp-content/uploads/ppom_files/o_1f6fifd5v8op1ug85evcap1mhs9.jpg?nocache=1621872853 HTTP/2.0” 200 6196 “website.com/product/productname/” “Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0”Hi
Sorry, but as per policy here: https://najeebmedia.com/privacy-and-refund-policies/ your support is expired, please contact sales@najeebmedia.com to renew support.
- You must be logged in to reply to this topic.