Urgent Help Needed – Hacking Attempts

Hi

I am getting a large number of hits on the 404.php and other files and for some reason it is returning this on different lines:

Fatal error: Class ‘td_global’ not found in /home/user/public_html/wp-content/themes/theme/404.php on line 6

These are the hackers requests:
“GET /wp-content/themes/NAME/apache-conf.php
“GET /wp-content/themes/NAME/wp-ajax.php
“GET /wp-content/themes/NAME/wp-ajax.php
“GET /wp-content/themes/NAME/system.php
“GET /wp-content/themes/NAME/system.php
“GET /wp-content/themes/NAME/thanks.php
“GET /wp-content/themes/NAME/thanks.php
“GET /wp-content/themes/NAME/mide.php
“GET /wp-content/themes/NAME/mide.php
“POST /wp-content/themes/NAME/header.php
“POST /wp-content/themes/NAME/header.php
“POST /wp-content/themes/NAME/functions.php?liu=qt&fukq=t&RNv=f
“POST /wp-content/themes/NAME/functions.php?liu=qt&fukq=t&RNv=f
“POST /wp-content/themes/NAME/footer.php
“POST /wp-content/themes/NAME/footer.php
“POST /index.php?liu=qt&fukq=t&RNv=f
“POST /index.php?liu=qt&fukq=t&RNv=f
“GET /wp-content/themes/NAME/author.php
“GET /wp-content/themes/NAME/author.php
“POST /wp-content/themes/NAME/archive.php
“POST /wp-content/themes/NAME/archive.php
“POST /wp-content/themes/NAME/404.php
“POST /wp-content/themes/NAME/404.php
“GET /wp-content/themes/NAME/404.php?pwd=1
“GET /wp-content/themes/NAME/404.php?pwd=1

same error on different lines: Fatal error: Class ‘td_global’ not found in

For now I had to delete the file completely until you advise with a solution.

PS: I am not using the theme’s default name, I have created my own, that might help find the cause of the issue.

I hope you can help ASAP.

Thanks

A quick search has led me to this site which seems to be using your theme and somehow was injected with some kind of code.

http:// vagalumegeek . com . br / lorem-ipsum /

just close the space in the above URL and check it out.

This could be a venerability in theme which needs to be fixed if thats the case.

Thanks

Just a quick update. The error can be created by requesting any of the theme files i.e category.php, index.php, attachment.php, comments.php etc

Every single file within the theme when requested it shows fatal error message in different line, like the ones below:

Fatal error: Call to undefined function get_header() in

Fatal error: Class ‘td_util’ not found in

I hope you can help as soon as you can.

Thanks

Thanks Bogdan B

It is one issue. I know these files are not supposed to be accessed directly. But unfortunately these hackers don’t alway looking for loopholes to hack and inject the site. These requests were made by someone we don’t know.

I don’t want to mess with the theme’s files as it make the updating task hard, so I am thinking if possible to create a function which I can add to theme’s function file to redirect any direct request to any of theme files to the homepage e.g: (www.website.com)

Also, can hackers do anything when these fatal errors generated, can they inject the theme with anything or is it something I should not worry about too much?

If you can get me a function code as soon as you can, that would be great.

Many Thanks

There are some really good articles online about “hardening” WordPress you should look into, as this is NOT a new issue. WordPress is so well entrenched on the web, that ALL sites which have any WordPress elements are easily “probed” for known vulnerabilities in certain plugins, themes, javsscript, php, xml-rpc, comments boxes, forms, forums, and sign-up/sign-in boxes.

WP codex – official docs on ‘hardening’ WP
http://codex.wordpress.org/Hardening_WordPress

Good older article
https://premium.wpmudev.org/blog/wordpress-security-tips/

Even older (some might not work with WP4x)
http://www.wpbeginner.com/wp-tutorials/11-vital-tips-and-hacks-to-protect-your-wordpress-admin-area/

topic thread
http://www.wpbeginner.com/tag/wordpress-security/

Periodic free scan of site with Securi advisable
https://sitecheck.sucuri.net/

(also sign up for their newsletter about breaking issues with WP core, plugins, etc.)

ALSO:
learn to use your server side ERROR LOG, and perhaps see if your web host can setup CSF/IPtables for you to auto-block probes to your IP.

In your http/web error log you should be able to see the error being generated and the IP the probes are coming from, then BLOCK that IP (we had to block all of Ukraine recently, for example for huge amount of attacks — and the ISPs don’t respond to/resolve issues after 60 days!).

Just food for thought.

I might wrangle this into a tutorial with some examples of the error log when I have a free brain cell 🙂

• This reply was modified 10 years by simchris.

Thanks for stopping by @Chris.

I am not looking for articles to widen my understanding of how to secure WordPress, already done that. This is a theme issue and trust me, I have spent hours finding a solution to this problem. Unfortunately, none of the above articles will help achieving that.

For now, I think the guys at tagDiv @Bogdan B. should be able to assist with my request by providing a function to prevent direct access to theme’s files without affecting the site functionalities.

Regards

Right, well anybody can access files for “any” theme — that is how WordPress works.

That is not theme specific. Anybody can probe /wp-content/themes/*

This is also why we change the name of our wp-content folder, and the theme folder name for the default bot probes.

But glad you’re on top of stuff like that and are blocking IPs attacking your theme folders.

So, anybody can probe:
wp-content/themes/*/header.php

it’s a common WP file.

SO, those kind of pings are not theme specific.

You will have these sort of pings regardless of the THEME you use, so not sure why you expect the theme author to help you lock down your site?

But luckily they are very nice around here, and might offer some suggestions.

But that’s really up to you, not TagDiv.

Oh well, best of luck. Some good resources on this topic on the web already. Very old common issue with ALL WP sites.

Ok Chris, First of all, I did not ask for your help.

Second, of course any one can request a theme file, that’s not the issue. The issue which I am asking the theme’s author to help me with is that these requests are generating large number of “Fatal errors”.

Third, perhaps you were trying to help, but honestly I don’t need your input right now under any reason, so kindly please do not get back to me.

Regards

Great, will make effort to NEVER help you on the forum.

For others less temperamental reading this thread, note you cannot generally block theme parts with htaccess rules as the http pages load those parts, e.g., (get header.php has to be able to be loaded by the single.php file, so blocking access to theme files, would not allow the page to render… )

So, when somebody (hacker, bot) is looking to read your pages and “pieces,” it will generate an error, as those individual pieces are calling functions, which may not work without the enqueued files (meaning a function being loaded a part of the header, for a menu, will generate error without the footer js, not being loaded).

So, errors are generated by folks accessing your theme pieces directly.

The best solution is to learn to block the people doing this, by their IP or IP range for repeat abuse, which is how you stop errors being generated.

For savvy folk, some hosts may be able to setup a directive to ‘ignore’ certain errors and not log them. Setting proper file permissions on your WP files can help for some things, and setting up proper htaccess rules to protect the important stuff should be job one. Links I included show how to accomplish this.

Not part of the theme, so good to learn how all of the elements of WordPress work, how the web works, how error log works, and how to harden your site for things which matter. Remember only YOU can manage and secure your site — it’s not the job of the theme developer to do that.

Cheers to all and to all a good night 🙂

• This reply was modified 10 years by simchris.

@Bogdan A quick Google search revealed other sites who are also affected by this issue: bit.ly/1OMOL3E

site 1: bit.ly/1T6wje8
site 2: bit.ly/1QpDOXT

The issue seems to be that Google is also indexing these files not only displaying the fatal errors to potential hackers, but also revealing the user’s cPanel username, which I think is a major security issue. Hackers all have to do now is to to guess/generate the password.

These are some of the fatal errors I have encountered when directly called some of the theme files:
Fatal error: Class ‘td_util’ not found in
Fatal error: Class ‘td_global’ not found in
Fatal error: Call to undefined function get_header() in
Fatal error: Call to undefined function have_posts() in

You can use site 2 to check for any further errors.

A quick fix in form of a code to be added to the theme’s function or index file would be highly appreciated to put this matter to rest.

Many Thanks

Thanks @Lucian, the issue has been temporarily sorted out until a permanent fix can be found.

Regards