Helpful Coder

 Randomly checked the views in blogger for the post I published yesterday on cleaning up a hacked Wordpress site.  Hey, there's one view! I guess that's good... wait, it says that the view occurred on Sept 30, 2020... more than three weeks before I actually published the post. Someone has a bug!

A long-time client contacted me with a question about their SSL certificate, and said they thought the site "might be hacked." Well, boy was it hacked. Shell scripts everywhere, and core Wordpress files as well as plugins heavily modified. I think it's all cleaned up now, so I thought put up a quick post about the process while it's still fresh in my mind. How to know it's hacked? In this case, it was easy. The site looked fine in the browser, but when I logged in and looked at the files on the server there were quite a few shell scripts which are little php files (in this case) that give the attacked a 'back door' to continue to upload files/etc even if their WordPress access was closed off. Additionally, there were many core files (wp-config.php for example) that had huge chunks of encoded text inserted at the top of the file. Additionally, looking at the transfer logs revealed traffic to weird looking URLs that were definitely not legitimate pages/post...

This one caused some confusion today! I have an AWS lightsail server set up. It handles multiple different domains - essentially the same codebase, but does different things depending on the hostname (domain) being used to access it. I needed to add a new letsencrypt certificate to the system. This would be the second one I've added. After generating the certificate, I found that the new site (called it domain2) was trying to use the certificat of the first site (domain1) ... I thought I'd generated a certificate that supported both domains, but apparently not. After some poking around (lightsail has its own way of setting up the apache configuration files) I finally figured it out. To fix it, I needed to have two different virtual host (port 443) directives. They were essentially alike, except that that I had to add ServerName and ServerAlias settings appropriate for domain1 and domain2, and set the SSLCertificateFile and SSLCertificateKeyFile settings appropriately. Now I j...