I had a user on our shared host who let their Wordpress install fall victim of an exploit that allowed for arbitrary file creation as the apache user. The files generated are obviously generated with a random generator, but fall under some sort of pattern. I was also thinking about just matching the group, but a find of that nature hits too many files that are legitimate. How can I match all of these example malicious files?
8twcoasx.php
hjoeksdp.php
nzpsmujc.php
oiczdqkp.php
wpebruwi.php
wuclgsvz.php
tie9txh5.php
vza6pn12.php
nwfthzli.php
1wovcnq6.php
1fwevaol.php
zscy86d8.php
ikz45skj.php
n70x0aul.php
nwk34bs0.php
ugdnncmz.php
wdcq2zzi.php
8f4w3dmt1z.php
uqv4e2cm2a.php
55zf4u1dp7.php
szfc8v129e.php
oihfoe09fposf.php (occured more often)
Jwlsjd_baaqifg.php (occured more often)
I'll obviously be working with the user to update their Wordpress install and plugins, but I would appreciate a regex I can toss into find and quickly verify whether the issue persists afterward, etc.
Patterns I can see:
- Always 8, 10, or 13 characters.
- Always *.php
sudo
, for example, has not been changed to store or send your password somewhere?