[wp-trac] [WordPress Trac] #46574: getmyfreetraffic hack

[WordPress Trac]

#46574: getmyfreetraffic hack
--------------------------+-----------------------------
 Reporter:  tchala        |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  General       |    Version:
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 My friend runs a load of WP sites

 Most of them got hacked yesterday so he's madly installing backups of
 everything

 Fortunately he showed me a hacked site BEFORE he fixed it

 I was lucky enough to WGET the index page bother before and after he fixed
 the site

 From my initial tests it's doing a 403 and if that hails replacing every
 link with a link to getmyfreetraffic.com

 I tried the hacked version a few times and note that the 403 goes to
 different sites every time - my first try was a dead link to a .tk URL for
 some reason (possibly payload with a false 404)

 Mark (my friend) is obviously worried about his business so didn't have
 time to archive the hacked site - I quite understand, if this happened to
 you it'd be a case of fix + forget.

 I will ask Mark for root so I can see if I can find an infected site.

 This is all in the moment so I can't be sure what happens next

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/46574>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform