Malicious Code: *///istart preg_replace on nav-menu.php line 465

I recently received an email from my web host, notifying me that a few files on a couple different websites had malicious code in them.

This was actually the second time I received an email about files on these websites. I had already gone through them a few days previously, hunting through various directories in FTP and manually deleting or cleaning all the files I found that had recent dates.

Bah!

So I did it again … logged in via FTP, deleted the files they mentioned, went through a few directories with files sorted by date, and deleted a bunch more malicious files that my host hadn't detected.

Yet I suspected there was at least one more file lurking around somewhere.

So! I asked my programmer friend to put together a script that could display a list of all files on a website and sort them by date.

Lo and behold! A few interesting things happened.

First, here's a file that had malicious code injected.

Notice anything weird about it?

Me neither!

The file has the same date, time and permissions as all the others around it. This is how I missed it the first time — simply sorting a list of files in this directory by “Last modified” did NOT in fact show the file's actual date!

But, my friend's script showed a different story.

In this list, nav-menu.php is the newest file on the entire website.

OK! So we've got a bot that installs malicious code into a file, saves it — and then does something to the file's date attribute to reduce the chance of detection through FTP.

What does it inject, exactly?

You can copy/paste the above into this decoder to make this readable.

This code is always the same, always appears on line 465, and is always in the file /wp-includes/nav-menu.php.

If you suspect your website may have been hacked, simply download this script, upload it into the root directory of your website, and view it in a browser. (Be sure to delete the script immediately after viewing the report.)

If nav-menu.php has a different date in this list than it does in your FTP program, it may have been hacked!

Other Malicious Files Found

The script turned out to be handy in helping me delete a bunch of other malicious files that also weren't detected by my host.

This highlighted file, for example, appears to be the oldest in the directory — which MUST mean it's the safest, right? There's no way I'd have a malicious file that's been sitting there for 2 years, right?

Once again, the script showed a different date (it was the newest on the whole website):

Other baddies my host didn't find, that had suspicious modified dates:

While today was more or less a write-off, going through all the websites I host with the same fine-toothed comb, tonight I'll rest a little bit better knowing the world is a safer place. 😉

Download

So, what are you waiting for? Find those evil lurking files on your website now! Download the script here. I've got 3 other file-viewing scripts available for download here as well.

Disclaimer

For obvious reasons, I recommend deleting these scripts from your server as soon as you use them.

I certainly can’t be held responsible for anyone who creates a list of all files and directories on their entire website … and leaves it open to the public. 😉

Enjoy!