How I fixed my hacked wordpress blog

What to do if your Wordpress Blog is hacked

1. To find out if the website has been compromised use the below mentioned site to see if the site has any malware or trojans. This is a free scanner. It will list all the malicious js found on your website which was what happened in my case.
1. http://sitecheck.sucuri.net/scanner/
2. You can use this site to beautify infected javascripts found on your website.
1. http://jsbeautifier.org/
3. User grep to find all the files which have the suspicious code. The ">" writes the output to the file mentioned in the command
1. grep -r -l '<String to find>' *.* . > output.txt
2. Also try the command: grep -r -l '<String to find>' *
3. search for the string “eval”, “base64_decode”
4. Change the eval() function to the alert() function. This will print the javascript instead of executing it. Now open the page in your browser and the malicious code will be printed instead of being executed.
5. Check the database with the following sql script:
1. SELECT * FROM wp_posts WHERE post_content LIKE '%<iframe%'
   UNION
   SELECT * FROM wp_posts WHERE post_content LIKE '%<noscript%'
   UNION
   SELECT * FROM wp_posts WHERE post_content LIKE '%display:%'
6. Write a shell script to remove the malicious script. Use the below script for inline editing
1. grep -lr -e '<String to find>' * | xargs sed -i '/<String to find>/d'o

We were using an older version of wordpress which had vulnerabilities against XSS attacks. To prevent further hacking we moved to the latest version of Wordpress.

Helpful weblogs:

• http://sitecheck.sucuri.net/scanner/
• http://jsbeautifier.org/
• http://blog.sucuri.net/2010/02/removing-malware-from-a-wordpress-blog-case-study.html
• http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
• http://ottopress.com/2009/hacked-wordpress-backdoors/
• http://codex.wordpress.org/FAQ_My_site_was_hacked
• http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/

Multiple Tomcat Instances Ubuntu

Aim: To have multiple instances on Tomcat which can be started by the command:

sudo service tomcat-<name> start

The easiest method that I found was to install the first instance of Tomcat using:

sudo apt-get install tomcat<version number>

switch to folder /var/lib. A tomcat directory should be formed here e.g. tomcat6 if you installed Tomcat-6. Make a copy of this folder

sudo cp tomcat6 tomcat6-test

open the server.xml file in your new tomcat folder (in our case tomcat6-test).

Change the ports for all connectors in use so that they do not clash with other tomcat instances on your machine. Change the ports in bold:

• <Server port="8005" shutdown="SHUTDOWN">
• <Connector port="8080" protocol="HTTP/1.1"  connectionTimeout="20000"                URIEncoding="UTF-8" redirectPort="8443" />
• <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> (if you are using AJP)
• Note: do not change the redirectPort values.

go to /etc/init.d folder and make a copy of the tomcat file.

sudo cp tomcat6 - tomcat6-test

open this file for edit and change CATALINA_BASE to point to /var/lib/<new tomcat instance>.

You should now be able to use "sudo service tomcat-<name> start" to start the new tomcat instance.