WordPress Blackhole Exploit

by 5 replies
6
One of my client's sites was infected by this exploit. In addition to searching in tomthumb and thumbs.php, look for an infected index.php in these folders:

/wp-content/themes
/wp-content/themes/(your theme name)
/wp-content/plugins
/wp-content

Remove everything that begins with "if (!isset($sRetry))" and ends with the final curly brace before the closing php statement. In all of the index files except for the one in themes, you should be left with:
Code:
<?php //silence is golden?>
in your theme header you should be left with only the usual theme stuff.
#programming #blackhole #exploit #wordpress
  • What is the benefit by doing like that???
    I am not sure about this. What is purpose of this??
    Does it work in all the versions of wp?
  • The purpose is to remove the wordpress blackhole exploit. If your site hasn't been infected, you can ignore this message.
  • Different hackers will use different variables so sRetry would be valid for some of the hacked sites.
  • Crackers are smart these days... Adding code in index.php and footer.php was cool in old days

    Now days i see most hackers adding their code in functions.php.. Specially the viruses that redirect the user when they come from search engine results.

    These types of hack are hard to find if you directly type the URL of the site in your browser.

    Go to google search, search for your site and go from there. If your site stands still than you are clean but if your site redirects to some other spammy page then you have a problem.

    Also, test this by going to info INCOGNITO Mode of Chrome or Private Browsing of FF or by simply loggin out of your site.

    If you are logged in then this virus won't redirect just to hide itself from the owner of the site.
  • What is really a blackhole exploit?
Join the discussion

Next Topics on Trending Feed

  • 6

    WordPress Blackhole Exploit

    One of my client's sites was infected by this exploit. In addition to searching in tomthumb and thumbs.php, look for an infected index.php in these folders: /wp-content/themes