Fixing the Japanese keyword hack

Re:Fixing the Japanese keyword hack by tk2 on Tuesday July 23, 2019 @01:54AM (#20504722)

One of my websites was affected by this. I'm currently doing some work to de-obfuscate the php code.

https://github.com/shiragami/japanese-backdoor/blob/master/o...

Basically what it did: Create a htaccess file to redirect request. Respond differently if client is web-crawlers i.e. seo cloaking. Download a php backdoor. Rewrite sitemap.xml and robots.txt

I'm still not sure what exploit that it uses to gain access.

[ Parent | on HN ]

Re:Fixing the Japanese keyword hack by codedokode on Tuesday July 23, 2019 @05:14AM (#20505431)

Probably a vulnerable PHP application (for example, outdated Wordpress plugin) or stolen admin's password.

[ Parent | on HN ]