05-10-2015, 11:54 AM
I found a backdoor script on backupbuddy 601 from wplocker, it ads the following code that you will only find when you use importbuddy, you can find the malware code at the end of the file importbuddy/pluginbuddy/_pluginbuddy.php. starting at line 1720.
If anyone used this version of importbuddy to restore/migrate a site check your db for strange users.
Never trust virustotal when using php scripts, it is impossible to keep track of so many php malware, your best bet is to unzip the script, load sublime text edit and do a file search for red flag words. some of the ones i use:
eval
exec
enqueue_script
system
base64
_decode
jquery
nilog
jqeury
and several others...
If anyone used this version of importbuddy to restore/migrate a site check your db for strange users.
Never trust virustotal when using php scripts, it is impossible to keep track of so many php malware, your best bet is to unzip the script, load sublime text edit and do a file search for red flag words. some of the ones i use:
eval
exec
enqueue_script
system
base64
_decode
jquery
nilog
jqeury
and several others...