[مشكلة] : اختراق الموقع وحذف كافة البيانات من الووردبريس

السلام عليكم مشكله غريبه

منذ اكثر من 4 سنوات لم اواجه مثل هذه المشكله

انا لدي مدونه ووردبريس وفيه خيار لرفع الصور عند كتابة التدوينه من قبل الزوار

المهم هذا رافع الشيل + حاذف كل شيء كل شيء في الموقع ورافع اندكس ولكن القاعده موجوده


راسلت الدعم الفني وكان جوابهم

Don Schneider
Staff 07/07/2014 03:32
Hi,

Based on what I see in the logs it appears that the content was deleted using a file /home/mtgr/public_html/wp-content/uploads/2014/07/b.php

In checking your domain's raw access logs I see many POSTs to http://mtgr.org/wp-content/uploads/2014/07/b.php from the IP address 5.236.69.151 between 20:52 and 22:38 GMT. There would normally be no reason for a php file to be stored under /wp-content/uploads. Based on the facts I believe that this was a phpshell. Using a php shell script a hacker would be able to add, edit or delete files at will. At 22:38:10 there was a final POST to the b.php script, after which all requests for all files started returning 404 (file not found). In addition to anything else you do you may want to block that particular IP on your firewall.

5.236.69.151 - - [06/Jul/2014:20:52:05 +0000] "GET /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 197240 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:53:16 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 17 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:53:16 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 19 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:53:16 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 60449 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:53:56 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 11600 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:54:28 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 6469 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"



5.236.69.151 - - [06/Jul/2014:20:54:38 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 1858 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:54:44 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 45 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:53:16 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 88395 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:56:02 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 143328 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:56:39 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 17 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:20:56:40 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 59380 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:21:31:21 +0000] "GET /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 197231 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:21:52:19 +0000] "GET /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 197231 "-" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:21:53:45 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 17 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:21:53:45 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 59887 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:35:40 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 11600 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:36:24 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 1830 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:36:45 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 11600 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:36:56 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 2405 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:37:03 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 32 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:37:04 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 13566 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:37:08 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 6469 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:37:20 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 11605 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:38:10 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 200 2 "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"
5.236.69.151 - - [06/Jul/2014:22:38:11 +0000] "POST /wp-content/uploads/2014/07/b.php HTTP/1.1" 404 - "http://mtgr.org/wp-content/uploads/2014/07/b.php" "Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0"





اريد حل لهذه المشكله

وايضاً المشكله الثانيه عند تفعيل السيف مود يكتب لي لا يمكن الاتصال بقاعدة البيانات للوردبريس

شكراً لكم







أكثر...