Htaccess modifié par un hackeur

Question

Bonjour,Depuis 2 semaines un hackeur me modifie le fichier htaccess  sous le dossier www, pour désactiver iThemes Security.Il y a deux semaines une alerte de iThemes Security pour altération de fichier s'est déclenché :  le htaccess avait été modifié et sur 25000 fichiers 6000 fichiers avait été enlevé puis remis et modifié essentiellement des plugins.J'ai supprimé tous les fichiers et dossier sur le serveur et copié à la place une sauvegarde de mon site.Modification de mon mot de passe FTP, changement du nom d'utilisateur (admin avait déjà été changé initialement) modif du mot de passe et de l'adresse de connexion à wordpress.Je met aussi toutes ses adresses IP en Blacklist et rien à faire il arrive toujours à modifier le fichier htaccess 3 à 4 fois par jour.Dans ce fichier htaccess j'ai aussi ajouté# Protéger les fichiers .htaccess et .htpasswdsorder allow,denydeny from allsatisfy all# Protéger le fichier wp-config.phporder allow,denydeny from allActuellement j'ai iThemes SecurityWordfence SecurityIl utilise un adresse principaleXXXXXXXXX Nom d'hôte associé: xxxxxxx.hosting.ovh.netet plein d'autres.Comment est ce que l'on modifié ce fichier d'après vous, si je comprends bien il serait client chez Ovh d'après le nom d’hôte, il utiliserait une faille ?Merci par avance pour votre aide ci dessous la copie des lignes qu'il ajoute au début dans le fichier htaccess # BEGIN iThemes Security - Ne modifiez pas ou ne supprimez pas cette ligne# iThemes Security Config Details: 2	# Passer au travers de l’en-tête d’autorisation.			RewriteEngine On		RewriteCond %{HTTP:Authorization} ^(.*)		RewriteRule .* - [e&#61;HTTP_AUTHORIZATION:%1]		# Activer la liste de blocage de HackRepair.com - iThemes Security > Réglages > Blocage d’utilisateurs > Liste de blocage par défaut	# Start HackRepair.com Blacklist	RewriteEngine on	# Start Abuse Agent Blocking	RewriteCond %{HTTP_USER_AGENT} &#34;^Mozilla.*Indy&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Mozilla.*NEWT&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^$&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Maxthon$&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^SeaMonkey$&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Acunetix&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^binlar&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^BlackWidow&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Bolt 0&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^BOT for JCE&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Bot mailto\:craftbot&#64;yahoo\.com&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^casper&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^checkprivacy&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^ChinaClaw&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^clshttp&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^cmsworldmap&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Custo&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Default Browser 0&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^diavol&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^DIIbot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^DISCo&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^dotbot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Download Demon&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^eCatch&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^EirGrabber&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^EmailCollector&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^EmailSiphon&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^EmailWolf&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Express WebPictures&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^extract&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^ExtractorPro&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^EyeNetIE&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^feedfinder&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^FHscan&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^FlashGet&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^flicky&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^g00g1e&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^GetRight&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^GetWeb\!&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Go\!Zilla&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Go\-Ahead\-Got\-It&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^grab&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^GrabNet&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Grafula&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^harvest&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^HMView&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Image Stripper&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Image Sucker&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^InterGET&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Internet Ninja&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^InternetSeer\.com&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^jakarta&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Java&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^JetCar&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^JOC Web Spider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^kanagawa&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^kmccrew&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^larbin&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^LeechFTP&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^libwww&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Mass Downloader&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^microsoft\.url&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^MIDown tool&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^miner&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Mister PiX&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^MSFrontPage&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Navroad&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^NearSite&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Net Vampire&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^NetAnts&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^NetSpider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^NetZIP&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^nutch&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Octopus&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Offline Explorer&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Offline Navigator&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^PageGrabber&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Papa Foto&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^pavuk&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^pcBrowser&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^PeoplePal&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^planetwork&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^psbot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^purebot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^pycurl&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^RealDownload&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^ReGet&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Rippers 0&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^sitecheck\.internetseer\.com&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^SiteSnagger&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^skygrid&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^SmartDownload&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^sucker&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^SuperBot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^SuperHTTP&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Surfbot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^tAkeOut&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Teleport Pro&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Toata dragostea mea pentru diavola&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^turnit&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^vikspider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^VoidEYE&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Web Image Collector&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebAuto&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebBandit&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebCopier&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebFetch&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebGo IS&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebLeacher&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebReaper&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebSauger&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Website eXtractor&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Website Quester&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebStripper&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebWhacker&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WebZIP&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Widow&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WPScan&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WWW\-Mechanize&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^WWWOFFLE&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Xaldon WebSpider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^Zeus&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;^zmeu&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;360Spider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;CazoodleBot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;discobot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;EasouSpider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;ecxi&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;GT\:\:WWW&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;heritrix&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;HTTP\:\:Lite&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;HTTrack&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;ia_archiver&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;id\-search&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;IDBot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Indy Library&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;IRLbot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;ISC Systems iRc Search 2\.1&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;LinksCrawler&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;LinksManager\.com_bot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;linkwalker&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;lwp\-trivial&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;MFC_Tear_Sample&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Microsoft URL Control&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Missigua Locator&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;MJ12bot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;panscient\.com&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;PECL\:\:HTTP&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;PHPCrawl&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;PleaseCrawl&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;SBIder&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;SearchmetricsBot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Snoopy&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Steeler&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;URI\:\:Fetch&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;urllib&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Web Sucker&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;webalta&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;WebCollage&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;Wells Search II&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;WEP Search&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;XoviBot&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;YisouSpider&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;zermelo&#34; [NC,OR]	RewriteCond %{HTTP_USER_AGENT} &#34;ZyBorg&#34; [NC,OR]	# End Abuse Agent Blocking	# Start Abuse HTTP Referrer Blocking	RewriteCond %{HTTP_REFERER} &#34;^https?://(?:[^/]&#43;\.)?semalt\.com&#34; [NC,OR]	RewriteCond %{HTTP_REFERER} &#34;^https?://(?:[^/]&#43;\.)?kambasoft\.com&#34; [NC,OR]	RewriteCond %{HTTP_REFERER} &#34;^https?://(?:[^/]&#43;\.)?savetubevideo\.com&#34; [NC]	# End Abuse HTTP Referrer Blocking	RewriteRule ^.* - [F,L]	# End HackRepair.com Blacklist, http://pastebin.com/u/hackrepair	# Blocage d’adresses IP - iThemes Security > Réglages > Blocage d’utilisateurs	SetEnvIF REMOTE_ADDR xxxxxx xxxxxxxDenyAccess	SetEnvIF REMOTE_ADDR xxxxxx DenyAccess						Require all granted			Require not env DenyAccess			Require not ip xxxxxxxx	# END iThemes Security - Ne modifiez pas ou ne supprimez pas cette ligne

 · Answer

Willkommen in der OVHcloud Community

Stellen Sie Fragen, suchen Sie nach Informationen, veröffentlichen Sie Inhalte und interagieren Sie mit anderen Mitgliedern der OVHcloud Community.

Htaccess modifié par un hackeur

Related questions

An Diskussion teilnehmen

Empfohlene Inhalte

Most recent in same Forum