Well that was way easier to find than expected:
Code:
[Fri, 25 Aug 2017 05:53:45 -0400] 599ff3a97ab6a M /home/vekou/public_html/_vti_txt/index.php Infected file found: Known exploit = [ Fingerprint Match] [PHP Injection Attack [P1261]]
That's not the only hit I'm seeing in the logs either; all the Wordpress files I can find in the logs have compromised PHP code present that allows arbitrary code execution. Given that, it's a very safe bet your Wordpress install is heavily compromised, but there's an un-captured exploit in one of the files that isn't known to our scanners so it's not auto-nuking the file.
Possible sources I found:
- wpblog/index.php (compromised)
- wp_blog/index.php (same)
- any one of the files in wp-includes/SimplePie/cache0936f6beea6df5b13115c3c1dca9fac and cachebc9ac149f91ffb1270cf063451754c44 (which are both non-standard folders, and contain code that has been ran through an obfuscation system to prevent reading them)
- wp-mailchamp.php (which is a copy of the default "Hello Dolly" plugin, but not inside the plugins folder and was likely a hacker doing experiments)
- files/index.php (compromised, modify date from 11/23/16 which means it's been there for almost a year).
This having been said, there's probably more. Your best bet is going to be (to quote Aliens) "to take off and nuke the site from orbit." Take a current backup so you have one, and then clear out your public_html, and reinstall everything from fresh, vendor supplied files. If you do need to restore a file from the backups, check it first and look for anything unusual - a good one is a random comment such as "/*344a9*/" where the numbers/letters can be any combination, which is a dead-giveaway of a particular Wordpress compromise. Others might involve weird code such as eval(base64_decode("unreadable garbage here")). I'll be blunt, it's going to suck a bit having to reinstall it, but that's going to be the best bet to ensure there aren't any remaining compromised files; if any comp'd ones remain, they can be used to launch a re-compromise of the account and cause your install to continue acting weird.
