Backdoor in Backupbuddy 601

[xantor]

I found a backdoor script on backupbuddy 601 from wplocker, it ads the following code that you will only find when you use importbuddy, you can find the malware code at the end of the file importbuddy/pluginbuddy/_pluginbuddy.php. starting at line 1720.

If anyone used this version of importbuddy to restore/migrate a site check your db for strange users.

Never trust virustotal when using php scripts, it is impossible to keep track of so many php malware, your best bet is to unzip the script, load sublime text edit and do a file search for red flag words. some of the ones i use:

eval
exec
enqueue_script
system
base64
_decode
jquery
nilog
jqeury

and several others...

[xantor]

If anyone need a clean importbuddy.php you can get it from the link bellow

get clean file here

[we1000]

thanks fro the info

[noobnoob]

Link broke... :(

[xantor]

Sorry, new link for clean file importbuddy.php to see the password to import a bakcup open the php file it is in a comment by the base 64 coded password.

[Bukan Siapa2]

Thanks Xantor for your info, but why you have "0" repp after you join mar 2014? *just asking :)

[noobnoob]

@Xantor, I gave 1 rep for your effort.

[DaniloIN]

+5 thank you for helping all

[wprocker]

Sheeeeeeeeeeeeeet!!

+5 thank you all for helping, I was about to install on my site?!!!!

Have a good one

[newwave]

Nice effort! Reps+