Caught Hacking File that modifies and damages WP via backdoor

  • abehjat

    (@abehjat)


    9 years, 4 months ago

    I recently got hacked. However, due to permission settings, somehow the hacker wasn’t able to delete all his code files that injected the virus, so I had the change to read his code. I was not sure where to place this document, however, here is the full meat of the hack. I would encourage people to identify in their WordPress instance (most likely caused by a vulnerable plugin):

    http://pastebin.com/KDzhivWT

Viewing 5 replies - 1 through 5 (of 5 total)
  • rawcoder

    (@rawcoder)

    9 years, 4 months ago

    Hello,

    I managed to track down the vulnerability .. It involves a rfi exploit inside the WordPress Download Manager plugin.
    the malicious code to be evaluated -> http://pastebin.com/r95QVeXE

    Please consult following link for security update:
    http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html

    Thread Starter abehjat

    (@abehjat)

    9 years, 4 months ago

    First RevSlider and now these. Interesting. Thank you for the info rawcoder!

    rawcoder

    (@rawcoder)

    9 years, 4 months ago

    oh, you also have to remove line 9 from the script you pasted:
    $code_inject_sape = //malicious code//

    .. and try to look for other obfuscated code blocks ( eval(base64_decode(..) ) .. generally when you can’t read that code, someone is trying to hide something 😉

    Thread Starter abehjat

    (@abehjat)

    9 years, 4 months ago

    I found them all, I’m just doing a quick brush up on them.

    However, the beautiful thing is I’m lucky the main file wasn’t deleted, and I can track all the locations the hacks occured, including the footer of every theme.

    This hack is quite annoying!

    Thread Starter abehjat

    (@abehjat)

    9 years, 4 months ago

    Here are some useful commands/information for anyone interested in targeting some files

    Locate files modified on December 31, 2013 at 4:17 GMT. The command for such hack can be found at:

    touch("wp-optionstmp.php", mktime(12, 17, 11, 12, 31, 2013));

    Some hacks occurred on this date: October 25 2013

    Weird hack involving auth and humungous base64 code

    $auth_pass = "63a9f0ea7bb98050796b649e85481845";
$default_charset = 'Windows-1251';

    Find files between certain times

    find public_html/ -newermt 2013-10-25 ! -newermt 2013-10-26 -ls

    Find files affected by hacks

    grep -rnw public_html/ -e "<!-- Begin WordPress Cache (DO NOT MODIFY) -->"

    Find all instance where eval base64 code occurs

    grep -rnw public_html/ -e "eval(base64_decode("
Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Caught Hacking File that modifies and damages WP via backdoor’ is closed to new replies.