TimThumb, a small PHP script to resize and crop images on the fly which is used by many WordPress themes (usually premium WordPress themes such as Elegant Themes) all over the net. This script has been compromised with a zero day vulnerability. This blog and my other blog which use TimThumb were also hacked and injected with some malicious code in the WordPress core.
The compromised script was TimThumb v2.7 and below. If you are using that script, YOU MUST UPDATE IT NOW!!! I spent 3 hours cleaning up my WordPress blog since the attacker injected their code in many locations.
TimThumb Zero Day Vulnerability Symptoms
How the attacker injects their code may vary for each one of you. But on this blog they injected their malicious code into my jquery.js, l10n.js and put a shell code in the wp-content folder so they can get in and out easily. Their code may be encrypted so it is harder to find. You can see the screenshots below:
This code is in l10n.js
This code is injected into the TimThumb cache folder
Those codes only show ads on my blog, which is annoying. But the attacker could do worse by injecting shell code so they can do anything to your website and database. And worst of all, they can control your server. So I remind you, please update your TimThumb script now!
TimThumb Zero Day Vulnerability Recovery
So now you know that you got hacked and injected with some malicious code. What to do now? Here are some steps to clean up your WordPress blog:
- First, BACKUP YOUR DATABASE! It is a must.
- Replace all files in wp-admin and wp-includes folders from the WordPress official website. If you have made some changes to WordPress core, please merge your code as best you can.
- Delete all files in cache and tmp folders.
- Delete all files in TimThumb cache folders.
- Get the latest TimThumb script and overwrite your TimThumb script.
- If you have shell access you can find all the malicious code by using this command: “grep -r base64_decode *” and find the last 10 days of modified scripts under the wp-content folder with this command: “find /path/to/wp-content -mtime 10” and check if the files are injected.
- Update your WordPress plugins; the attacker may have injected some code into your plugins as well.
- Find PHP code in the uploads folder; there shouldn’t be any PHP files under upload, tmp and cache folders. Delete any you find.
- Consult with your hosting security support and tell them to check and scan your website.
That covers most of it, but to be sure, download your access_log and see if there are any malicious requests to your blog. Get the attacker’s IP and ban it from .htaccess.
TimThumb Zero Day Vulnerability Sources
Mark Maunder (WordThumb author) announcement: He announced the zero day vulnerability in many WordPress themes, and also he and Ben Gillbanks (TimThumb author) worked together to rewrite all the TimThumb script and merge it with WordThumb.
TimThumb 2.0 by Ben Gillbanks.
WordPress FAQ: what to do when you get hacked.
PS: If you need my help to clean up your website from malicious code, please leave me a comment below or use the contact form. Thanks.