WordPress trojan scripts
Repository to host simple list of scripts to trojanize WordPress themes.
In some cases Apache allows you to directy access PHP files in themes, in these cases you can just directy access the script through the /wp-content/themes/theme-directory/script.php URL.
To disable the execution of php files accessed directly, put a .htaccess file with the following instructions on the wp-content directory:
<Files ~ ".ph(?:p[345]?|t|tml)$">
deny from all
</Files>
The above code will stop your Apache server for accessing PHP, PHP3, PHP4, PHP5, PHT and PHTML files directly.
- For nginx servers you can use the htaccess to nginx converter.
- For IIS servers, see Microsoft guide's on converting .htaccess files into web.conf
How to use this scripts
- Download a theme from wordpress.org
- Extract the zip file and put the script inside the theme's main directory
- Add the following code to the
index.phpscript file:
include 'script.php';- Make sure to include the script before the following code:
if ( ! defined( 'ABSPATH' ) ) {
exit;
}