h1. Unhacking a WordPress site

This is an INCOMPLETE guide, but a good starting point!  It doesn't cover removing malicious code inserted into the database, for instance.

WordPress gets hacked - a lot.  And the correct solution is to restore your database and filesystem from backup.  However, sometimes we deal with sites that weren't responsibly managed, and that's not an option.  Here's a guide on what to do.

First - if it IS an option, delete your WordPress filesystem and restore from known good files.  There's just too many ways to obfuscate a hack, so these approaches are necessarily incomplete.

* Search for suspicious PHP commands:
<pre>
grep -r gzuncompress *
grep -r base64_decode *
grep -r eval( *
grep -r str_rev *
</pre>

Not every instance of these commands is malicious!  However, a hacked site will often use these, so look at what comes after them.  If it's a long base64 block, that's bad news.  

Note that there are MANY ways to obscure the commands above.  Here are some example strings you can also search for
<pre>
"base" . "64_decode"
eval/*
</pre>

That last one's tricky.  It found this command: @eval/*boguscomment*/('malicious_command')@.



* Check for this:
<pre>
<?php eval(get_option("\x72\x65\x6e\x64\x65\x72")); ?>
</pre>

That evaluates to:
<pre>
<?php eval(get_option("render")); ?>
</pre>

This indicates that there's malicious code in your database, and this minimal change allows the code to render.

Here's the commands I used to remove that from my entire codebase:
<pre>
find -name \*php -exec sed -i 's/<?php eval(get_option("\\x72\\x65\\x6e\\x64\\x65\\x72")); ?>//g' {} \;
find -name \*.html -exec sed -i 's/<?php eval(get_option("\\x72\\x65\\x6e\\x64\\x65\\x72")); ?>//g' {} \;
</pre>

* Look for function names you discovered with the last command and grep for those.  I found commands like "ruburat" and "ukonabuh" which I then searched for.
* Use @git reset --hard HEAD@, if you're using git.
* Don't assume git will remove everything!  I found php files in places not checked by git.  E.g. in the .git folder, to wp-config.php and civicrm.settings.php, wp-content/uploads.  Here are some commands to help you find php files where they don't belong (run from webroot):
<pre>
find .git -name \*php
find wp-content/uploads -name \*php
</pre>