My websites Hacked By AnonymousFox

[Moh Farawati]

Hi there,

today I got all my WordPress sites hacked by AnonymousFox, all admin username change it to AnonymousFox, there is a Database in Cpanel but not working! I don't know how!

Admin ID: 1
-user_login: AnonymousFox


I use nulled template Impreza and all my plugins from Babiato

Is there anything I can do to restore my sites!

 

[NullMaster]

Hi there,

today I got all my WordPress sites hacked by AnonymousFox, all admin username change it to AnonymousFox, there is a Database in Cpanel but not working! I don't know how!

Admin ID: 1
-user_login: AnonymousFox


I use nulled template Impreza and all my plugins from Babiato

Is there anything I can do to restore my sites!

Did you use plugins from other sources.

 

[Moh Farawati]

Did you use plugins from other sources.

Never, Ever
Babiato is my only source

 

[NullMaster]

Never, Ever
Babiato is my only source

what do you use form builder on your site. contact form 7 ?

 

[NullMaster]

please read

SOLVED - cpanel login after AnonmousFox hack

After an attack by AnonymousFox, with a lot of effort, I have regained control of the server. If I try to login to cpanel directly from WHMCS I get in no worries. However if I try to login from the login page it fails with A network error occurred during your login request. Please try again...

forums.cpanel.net

 

[Moh Farawati]

what do you use form builder on your site. contact form 7 ?

Screenshot

Captured with Lightshot

prnt.sc

 

[Moh Farawati]

please read

SOLVED - cpanel login after AnonmousFox hack

After an attack by AnonymousFox, with a lot of effort, I have regained control of the server. If I try to login to cpanel directly from WHMCS I get in no worries. However if I try to login from the login page it fails with A network error occurred during your login request. Please try again...

forums.cpanel.net

my sites on Plesk not Cpanel, sorry

and I have more than 3 websites in WordPress too for clients, all working well, just my personal sites with nulled stuff get hacked.

 

[Energy]

Theres a chance that your theme or plugins were not up-to-date with the latest version. When a theme/plugin is exploited, the creator usually patches it relatively soon. Since your website uses nulled components, you can't auto-update them and need to wait until someone on this site uploads the latest version.

It's starting to become common, which is why people need to check if they're running the most recent versions and also why you need to make daily or at least weekly backups.

 

[Moh Farawati]

Theres a chance that your theme or plugins were not up-to-date with the latest version. When a theme/plugin is exploited, the creator usually patches it relatively soon. Since your website uses nulled components, you can't auto-update them and need to wait until someone on this site uploads the latest version.

It's starting to become common, which is why people need to check if they're running the most recent versions and also why you need to make daily or at least weekly backups.

You right, I have full backup weekly, and now I did a new WordPress version, and I buy my theme never add anything nulled :/

Do you have any advice to protect the site in the future regarding this thing?

 

[guguk]

Hi there,

today I got all my WordPress sites hacked by AnonymousFox, all admin username change it to AnonymousFox, there is a Database in Cpanel but not working! I don't know how!

Admin ID: 1
-user_login: AnonymousFox


I use nulled template Impreza and all my plugins from Babiato

Is there anything I can do to restore my sites!

It's obviously this situation should be investigate.

Could you please tell us more info?
Plesk version - Hosting name
Plugins list

And their versions
etc.

Sorry about lost btw hope you will not face again.

"I guess" there have a backdoor a plugin which u use .

 

[adhi1234]

It was not fault with nulled theme or plugin from here. But a general exploit in file manager system.

With the news that WordPress sites have been probed and attacked this week, according to Defiant, the company behind the Wordfence firewall, this has naturally exposed many bloggers and e-commerce companies’ vulnerabilities. But what has happened?

• A massive increase in attacks occurred after hackers found a way to exploit a zero-day vulnerability in File Manager (a popular WordPress plugin installed on over 700,000 sites). Naturally, this has thrown many website providers into a panic.
• The zero-day vulnerability was an unauthenticated file upload. This allowed an attacker to upload malicious files on a site running older versions of the File Manager plugin (versions 6.8 and below).
• The hacker gained access to an unprotected file from its elFinder package.

The only fix is to keep wordpress, themes and plugins upto date. Use a good hosting priver with proper security measures and firewall which inhibits remote script executions. Good hosting provider may cost more but they keep security in check most of the times.

 

[guguk]

A massive increase in attacks occurred after hackers found a way to exploit a zero-day vulnerability in File Manager (a popular WordPress plugin installed on over 700,000 sites). Naturally, this has thrown many website providers into a panic.

As you said above guilty is File Manager plugin with File Management system of WP but was @Moh Farawati using that plugin?

 

[adhi1234]

As you said above guilty is File Manager plugin with File Management system of WP but was @Moh Farawati using that plugin?

I don't now. But then there can be similar vulnerability with other theme or plugin.

 

[Moh Farawati]

It's obviously this situation should be investigate.

Could you please tell us more info?
Plesk version - Hosting name
Plugins list

And their versions
etc.

Sorry about lost btw hope you will not face again.

"I guess" there have a backdoor a plugin which u use .

Thank you for reply
I have the latest update on everything
Also, I have more than good hosting

And also this is a list https://prnt.sc/y2pfba

and my database for another domain on same my sever, get clone to another domain
ex: name.com database cloned to name.net database
like comments and users, and admin email all changed

I don't know how to explain it, but now I delete everything.. فhis should not happen in the future.

 

[Moh Farawati]

It was not fault with nulled theme or plugin from here. But a general exploit in file manager system.

With the news that WordPress sites have been probed and attacked this week, according to Defiant, the company behind the Wordfence firewall, this has naturally exposed many bloggers and e-commerce companies’ vulnerabilities. But what has happened?

• A massive increase in attacks occurred after hackers found a way to exploit a zero-day vulnerability in File Manager (a popular WordPress plugin installed on over 700,000 sites). Naturally, this has thrown many website providers into a panic.
• The zero-day vulnerability was an unauthenticated file upload. This allowed an attacker to upload malicious files on a site running older versions of the File Manager plugin (versions 6.8 and below).
• The hacker gained access to an unprotected file from its elFinder package.

The only fix is to keep wordpress, themes and plugins upto date. Use a good hosting priver with proper security measures and firewall which inhibits remote script executions. Good hosting provider may cost more but they keep security in check most of the times.

i use Filebird plugin this come with Impreza theme.

all my plugin from Babiato.

 

[Moh Farawati]

The only fix is to keep wordpress, themes and plugins upto date. Use a good hosting priver with proper security measures and firewall which inhibits remote script executions. Good hosting provider may cost more but they keep security in check most of the times.

Thanks for your advice.

 

[guguk]

Thank you for reply
I have the latest update on everything
Also, I have more than good hosting

And also this is a list https://prnt.sc/y2pfba

and my database for another domain on same my sever, get clone to another domain
ex: name.com database cloned to name.net database
like comments and users, and admin email all changed

I don't know how to explain it, but now I delete everything.. فhis should not happen in the future.

Thanks for info, actually it's really long plugins list.
It's off-topic but you dont use some plugins (classic editor, smtp plugin etc.) just search alternate "without plugin" versions.

Most plugins/addons not familiar to me or did not use before so i could not say anything about that.

 

[Energy]

The only further advice I would give is to just make sure to update any and all plugins/themes as soon as possible before an exploit of a version is found, and make sure to do frequent backups.

 

[Itsyaboy]

I've used WordPress for a couple years now and owning a few websites running WP and actually starting out with nulled items I'll put in my 2 cents. For 1 nulled themes/plugins is a great way to test features and thoroughly before actually spending 60-200 dollars on a theme/plugin that you would really like to use ( If from a trusted source). 9 times out of 10 most of the demos available don't show enough and going through the hassle of a refund after the fact is a hassle.

That being said if you're not smart and precautious enough you are opening yourself up for a world of stress. In my opinion nulled plugins should just be used for testing! After that if you have enough or save enough buy the full product if you like what you're using it's very worth it. Like others have said in previous replies people are ALWAYS looking for a chance to exploit outdated plugins & themes ALWAYS. I check my logs and word fence firewall weekly and the amount of attempts on my websites is actually insanity! If you're going to use nulled plugins on a site that's live and gets visitors at least make sure.

1. It's a plugin/theme that gets updated regularly by the developer.
2. You're able to receive and manually update those plugins/themes
3. Read up on WordPress security and get your WP and hosting as secure tight as you can

If the plugins/theme are old and haven't been updated in a while don't bother using it if you're unable to get future updates don't bother. That's just my opinion though.

 

[KangMus]

remember to change default salt, try generate new salt https://api.wordpress.org/secret-key/1.1/salt/