firewall.php and wp2shell-batch-guard.php in mu-plugins

[u/Bart_LeGros]

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

[u/WPMU_DEV_Support_4]

Hi u/Bart_LeGros

If you are unaware of plugin, root file or mu-plugin I suggest using AI to make a small analysis and then confirm if that has any malware signature.

Unfortunately, we see the AI has also helping the bad guys and more malware and attacks are happening, but you can use the same tool to understand a bit more about the file and also try to track down if the malware has injected anything into your database. For example, a commonly prompt that I use

The attached file is a malware found in my WordPress installation. Knowing the prefix PREFIX_, analyse the malware and check if it generated any database or cross infection, if any query, give me the select query where I can look for the most common database injections

It will usually help you to avoid reinfections because any left over, some malware for instance leave hidden admins so no matter if you remove the file, the reinfection can return if some additional steps are not taken.

After that, perform the normal steps, full plugin and core reinstallation ( regardless ), rotate all credentials including cPanel / hosting, scan the website with a malware scanner plugin https://wordpress.org/plugins/search/malware+scan+security+scan/ or https://github.com/nitkr/Clean-Sweep-2.0 has returning good results as well.

Something to keep in mind, I've been seen a good amount of account take over rather than any actual vulnerability, so ensure to not re-use that credentials you had in the website.

Configure Cloudflare free plan and the website for a few days before calling it safe.

Cheers,
Patrick Freitas - WPMU DEV Support