UPDATE: Site hacked again, teaches me for not removing the backdoors.  Details on how to find those below

Well what a delight that I checked on one of my old unused sites to find malware warnings and it redirecting me to http://placecollocation.ru/ .  This of course made me look a little closer as it’s folly to assume a breach is contained to one little area and sure enough I found wordpress and drupal sites alike redirecting.  So being the good server admin I cleaned it out only to wake up the next morning with one of my users telling me that the server was hacked and then pointing me to this very page saying ‘here’s how to fix it ’, obviously he doesn’t know this is my blog but I had to lasugh

So after a few hours of scripting I’ve cleaned it all out again but I wanted to post up a little help for those going through the same thing.

First off a big thanks goes out to Hack Sparrow for this post: http://www.hacksparrow.com/wordpress-hacked-getting-forwarded-to-distributioncorporate-ru-solution.html  as that pointed me in the right direction immediately.  Although if I could be a little critical of our hacking/flying/chirping friend I would say you shuold have looked more closely at those backdoors.. Obviously they could go by many names so you need to be able to find them if their location or name changes.

So first step: Make a list of all infected .htaccess file

• Go find one that know is infected, it will contain a whole lot of ^M or linebreaks in it and then show you some nice little code that redirects your users to some russian site.  The 3 I’ve heard of are placecollocation.ru , flyghtairline.ru or distributioncorporate.ru.  Copy that url
• Go to your home root directory, or /usr/www  or whatever your webroot dir is and run: find . -name .htaccess -exec grep -H {RUSSIANDOMAIN GOES HERE} > infected.txt
• Clean out all the undeeded data in that file so it’s just a list of files:
• In linux: sed -i ‘s/:.*//g’ infected.txt
• In BSD: sed -i ” -e ‘s/:.*//g’ infected.txt
• Clean out duplicate listings: uniq infected.txt > infected.new && mv infected.new infected.txt

Second Step: Clean the infected files

• Lucky for us this guy announces himself by putting a shitload of linebreaks which awk can easily recognize.. What we want to do is tell awk to look for two of these line after line and delete everything below their occurence, output that to a new htaccess and then copy that over the infected one.  *It wouldn’t hurt to back up your .htaccess files*
• Run: awk ‘p $0 == “\r\r”{exit} $0 != “\r”{print $0}{p=$0}’ .htaccess > htaccess && mv htaccess .htaccess for each of the .htaccess files in your infected or alternatively just write a script that reads that file line by line, going through and performing the above command

Step 3: Finding the Backdoors

• As a good sneaky fucking russian this guy leaves backdoors so that he can re-infect you hours after cleaning this out in the form of the following files: _wp_cache.php sm3.php or wp.php.  If you look at these files you'll see they start with something like this:

• <?php # Web Shell by oRb
$auth_pass = "";
$color = "#df5";
$default_action = 'FilesMan';
$default_use_ajax = true;
$default_charset = 'Windows-1251'
• So the prudent thing to do would be to scan all .php files(or all files in general if yuo were really wanting to be careful) and search for smoething unique about this file, ie: Windows-1251 or Web Shell by oRb like so:  find . -name “*.php” -exec grep -H ‘Web Shell by oRb’ ;\ -exec rm {} \;

Final Step: Upgrade all outdated timthumb files

• This whole mess was caused by an exploit in timthumbs, which goes by thumbs.php or timthumbs.php.  It’s very important to realize though that there could likely be other, non timthumbs files on yuor server called thumbs.php as it’s a pretty ambigious filename.  So you need to find all of your timthumb files and replace them with updated ones
• So let’s grab the updated timthumb: wget http://timthumb.googlecode.com/svn/trunk/timthumb.php
• find . -name “*thumb*.php”  -exec grep -H timthumb {} \; -exec cp timthumb.php {}

And that’s that!  You should be all good to go..
PS – One last thing I did was to chown root all of my .htaccess files and leave them chmodded to 444.  Make sure this doesn’t screw anything up on your end but hopefully it should prevent them from being overwritten in the future

Tags: htaccess, redirect, ru, timthumb, wordpress