Digital Management | Company Consultant Services Agency

HACKED

HACKED: Removing the .bt hack from your wordpress site

So I took over website duties for a suite of WordPress websites, and quickly discovered the “.bt pharma” hack was present on most of the sites. After some back-and-forth with malware plugins, I realized it was much more pernicious than I initially assumed. I did some internet searching and found a few blogs that discussed removing it, but none were complete, and most appeared to be fronts to get me to purchase a service to do it for me. Being stubborn and frugal, I decided to come up with a plan, and when executed the sites became hack-free and life is good again.

The first step was to add the Sucuri security plugin for WordPress, this provides an easy interface to “harden” your WordPress install. Specifically, it blocks the execution of PHP files in the Uploads directory, and the WP-CONTENT and WP-INCLUDES directories. You can also disable the plugin/themes editor and remove the README (“avoid information leakage”).

After WordPress is hardened, install the WordFence security plugin for WordPress, this will be used as a malware scan, so we can find the infection. Enable the firewall, WordFence will take several hours to “learn” the environment. Enable the scanning and run a scan, see what the results are.

It seems the .bt hack will add some code to functions.php files in various WordPress theme directories (in WP-INCLUDES/themes). It also deposits “.bt” files in WP-ADMIN/css/, cgi-bin/, and domain root directories. In addition it adds template-config.php files to various WordPress theme directories, and class-wp-http-netfilter.php files in WP-INCLUDES directories.

Next, we’ll have to write a quick script to remove all the added files. Use the WordFence scan results to find the files to remove. And it is a good idea to just search your webserver harddrive for the 3 filenames to remove.

Start the script with “rm -f “, and then add each file to remove, separated by a space. For example, I was working with 10 WordPress domains, an abbreviated version of my script would look like this:

rm -f dearoregon.com/cgi-bin/.bt dearoregon.com/wp-content/themes/genesis/template-config.php dearoregon.com/wp-includes/class-wp-http-netfilter.php

rm -f floorcentral.com/cgi-bin/.bt floorcentral.com/wp-content/themes/genesis/template-config.php floorcentral.com/wp-includes/class-wp-http-netfilter.php

rm -f JobSearchTeens.com/.bt

I broke it up for readability purposes, plus I had too many files to remove to put them all on one line.

Now that the removal script is complete, it is time to remove the hacked code from the functions.php files, WordFence will give you the files that are hacked. From there, you can view a “diff” of the file to see what was added.

For each functions.php you will be changing, download the infected file first and save it as a backup in case something goes wrong (it saved me a couple times). To do this, create separate subdirectories for each domain and the path to the functions.php files (and any other infected files).

For my setup, I had a “backup” folder, then under that I had all my infected domains, under each domain I have a wp-content/themes/ directory, and under them are the infected themes, and then the infected files.

Now, copy the “backup” directory as a new directory named “restore”. Using WordFence to “diff” the infected functions.php file, you will see the hacked code at the top of the file. In your “restore” directory structure (make sure you are in the right directory), remove the hacked code, save the file, and then upload it using your FTP client, just for a quick sanity check. If your site is still online, you should be fine. Do this sanity check for every functions.php file you disinfect, very important.

You will discover that WordFence can find some false positives, dig into each one, some will just have versioning numbers that weren’t updated by the developers, some will have been altered by a companion plugin, these should be relatively obvious. The .bt hack seems to focus on the functions.php file, however I did find it had also altered a couple header.php files as well.

So now you should have a “restore” directory that mimics the directory structure of your webserver, and you have removal script, and a backup in case something goes wrong (which it shouldn’t since you’ve already executed the sanity check above).

The next part will take a little dexterity, you will want to be connected to your server via SSH so you have a command line interface, copy the removal script and paste it in your command line. While that is removing files, use your FTP client to upload the sanitized files. Keep pasting the removal script over and over again until the FTP client has completed uploading. You may want to do that a couple times in a row.

Now you can search your directories for .bt and template-config and class-wp-http-netfilter.php, hopefully they will all be gone. If not, add the newly found files to your removal script, and run through the removal/restore process a couple more times.

I’ve been malware-free since doing these things, I hope your results are the same.