blocks|key|466003|text|如果他们能够编辑php.ini，我相信他们可以在每个PHP页面中添加一个页脚(很明显，这在您自己的代码中是看不到的)。创建一个test.php文件，看看它是否还在发生。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|entityMap^0|8|7|1R|8^^$0|@$1|2|3|4|5|6|7|G|8|@$9|H|A|I|B|C]|$9|J|A|K|B|C]]|D|@]|E|$]]]|F|$]]

If they were able to edit <code>php.ini</code>, I believe they could add a footer to every PHP page (which obviously, you wouldn't see in your own code). Make a <code>test.php</code> file and see if it still happens.

blocks|key|466050|text|我去了那个有问题的网站，它试图安装一个特洛伊木马，比如：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|466051|http://www.martinsecurity.net/2008/09/04/analyzing-a-malicious-pdf-trojpdfjs-a/|offset|length|466052|用JavaScript加载恶意PDF文件。查看代码时，它看起来也非常相似。除非你已经锁定了你的电脑，否则应该避免。至于解决方案，我认为联系您的托管公司，正如Anapologetos所说，将是基本的第一步。|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|27|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|G|5|6|7|S|8|@]|9|@]|A|$]]]|H|$I|$5|J|K|L|A|$M|C]]]]

I went to the site in question, it tried to install a trojan like:

<a href="http://www.martinsecurity.net/2008/09/04/analyzing-a-malicious-pdf-trojpdfjs-a/" rel="nofollow noreferrer">http://www.martinsecurity.net/2008/09/04/analyzing-a-malicious-pdf-trojpdfjs-a/</a>

Loading a malicious PDF file with JavaScript. Viewing the code, it also looks very similar. Probably should be avoided unless you've locked down your computer. As for solutions, I think contacting your hosting company, as Anapologetos said, would be the essential first step.

blocks|key|4205280|text|回答这些问题会帮助你找到解决办法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4205281|你和服务器之间有代理吗？|unordered-list-item|4205282|你有没有排除浏览器插件添加了什么东西？|4205283|你排除了工作站上的恶意软件吗？|4205284|您是否尝试过使用telnet/netcat来检索页面而不是使用浏览器？|4205285|这是你维护的服务器吗？你提到其他网站，他们也有这个问题吗？|4205286|iframe的内容是什么？|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Q|8|@]|9|@]|A|$]]|$1|E|3|F|5|D|7|R|8|@]|9|@]|A|$]]|$1|G|3|H|5|D|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$]]]|O|$]]

Answering these questions should help you find the solution.

<ul>
<li>Is there a proxy between you and the server?</li>
<li>Have you ruled out browser plugins adding something?</li>
<li>Have you ruled out malware on your workstation?</li>
<li>Have you tried retrieving the page with telnet/netcat instead of using a browser?</li>
<li>Is this a server you maintain? You mention other sites, do they also have this problem?</li>
<li>What is the contents of the iframe?</li>
</ul>

blocks|key|465959|text|关闭JavaScript标记后，页面源代码中的HTML代码是什么？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|465960|此外，我还将获得一个扩展，它将WordPress版本隐藏在页面源代码中，因为它将它显示为一个元标记(<meta+name="generator"+content="WordPress+2.7.1"+/>)，例如，我可以看到您正在运行"WordPress+2.7.1“(这是当前版本:claps:)，但是一旦发现了它的外露，人们就可以搜索它了。|offset|length|style|CODE|465961|还可以检查WordPress安装使用的其他文件。我知道它可以从其他文件中灌输并要求(因为它们是基于PHP的)页面源代码(因为它们是基于PHP的)，而且我知道扩展/主题也可以这样做，确保这些都是最新的。|465962|此外，检查哪些扩展和主题已安装/启用，并摆脱任何您不知道的。|entityMap^0|0|1E|1F|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@$D|O|E|P|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|Q|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|R|8|@]|9|@]|A|$]]]|L|$]]

What is that JavaScript code in your page source after the closing HTML tag?

Also I would get the extenstion that hides your WordPress version from the page source since it shows it as a meta tag (<code>&lt;meta name="generator" content="WordPress 2.7.1" /&gt;</code>), for example, I can see you're running "WordPress 2.7.1" (which is the current version :claps:) but once a expoilt for that is found people will be able to search for it.

Also check the other files that your WordPress installation uses. I know that it can inculde and require (won't show up in page source since they are PHP based) from other files and I know that extenstions/themes can also do so make sure those are up to date.

Also check to see what extensions and themes are installed/enabled and get rid of any you don't know.

blocks|key|466161|text|WordPress页面不是像大多数CMSes那样是从数据库生成的吗？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|466162|如果是这样的话，下面是开源CMSes、PHP和共享web托管的肮脏小秘密:在许多共享托管服务器上，每个人的PHP脚本都以相同的权限运行(即使用Apache守护进程的UID和GID+)。|466163|这意味着，如果PHP可以读取您的脚本，它可以读取服务器上每个其他客户的脚本。反之亦然。|466164|但是，许多开源CMSes在它们的PHP脚本中存储高权限的数据库凭据。Drupal这样做；Joomla这样做；我还没有看过WordPress源代码，但是如果它不这么做，我会很惊讶。|466165|简而言之:与您共享服务器的其他每个用户都极有可能获得对WordPress数据库的完全特权访问。|466166|我有点不想用粗体来写，但我觉得我已经用这个问题砸了几个月的头，在这段时间里，我遇到了两家，可能是三家很有名气的托管公司，他们使用这种设置，只是不能被它所带来的巨大安全问题所困扰。|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|O|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|P|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|Q|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|R|8|@]|9|@]|A|$]]]|L|$]]

Aren't WordPress pages, like those of most CMSes, generated from a database?

If so, here's the dirty little secret of open-source CMSes, PHP, and shared web hosting: on many shared hosting servers, everyone's PHP scripts run with the same privileges (i.e. with the UID and GID of the Apache daemon).

This means that, if PHP can read your scripts, it can read the scripts of every other customer on the server. And vice versa.

But, many open-source CMSes store high-privilege database credentials in their PHP scripts. Drupal does this; Joomla does this; I haven't looked at the WordPress source but I'd be surprised if it didn't do this.

In short: It's extremely likely that fully-privileged access to your WordPress database is within trivial reach of every other user who shares the server with you.

I sort of hate to write that in bold but I feel like I've been banging my head against a wall with this issue for a few months now, during which time I've run into two, possibly three apparently-reputable hosting companies that use this setup, and just can't be bothered by the enormous security problem it presents.

<blockquote>
 Possible Duplicate: 
 <a href="https://serverfault.com/questions/218005/my-servers-been-hacked-emergency">My server&#39;s been hacked EMERGENCY</a> 
</blockquote>



I just discovered that my site has, I believe, been hacked. Along with a couple of other sites on my host. If you go to the bottom of the site you'll see an iframe. I don't know what that is, it shouldn't be there.

I deleted all the code from my site and it's still there.

I checked htaccess thinking maybe someone added auto_append. Nothing.

Any clue as to how else something can be added to the bottom of my site?

I'm currently downloading some log files to look through.

My site hacked?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

可能重复:  我的服务器被黑客入侵我刚发现我的网站，我相信，被黑了。还有我的主机上的其他几个站点。如果你去底部的网站，你会看到一个iframe。我不知道那是什么，它不应该在那里。我从我的网站上删除了所有的代码，它仍然在那里。我查看了htaccess，认为可能有人添加了auto_append。没什么。有什么其他的线索可以添加到我的网站底部吗？我目前正在下载一些日志文件来查看。

问我的网站被黑了？
EN

回答 5

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我的网站被黑了？EN

回答 5

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我的网站被黑了？
EN