Nulled theme - is this malware of false positive?

[Scorpion Ghost]

I started playing with a nulled theme yesterday, and I ran it here - https://themecheck.info

So there's a bunch of deprecated functions and other shit, but only these four are worriesome:

Security breaches : Use of base64_decode() Found base64_decode in file OAuth.php. 202: $decoded_sig = base64_decode($signature);

Security breaches : Use of base64_encode() Found base64_encode in file et-google-checkout.php.
Found base64_encode in file OAuth.php.

Malware : Operations on file system fopen was found in the file class-ae-languages.php 170: fopen(WP_CONTENT_DIR . '/et-content/index.html', 'w');175: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/index.html', 'w');180: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/lang/index.html', 'wfopen was found in the file class-ae-languages.php 170: fopen(WP_CONTENT_DIR . '/et-content/index.html', 'w');175: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/index.html', 'w');180: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/lang/index.html', 'wfopen was found in the file class-ae-languages.php 170: fopen(WP_CONTENT_DIR . '/et-content/index.html', 'w');175: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/index.html', 'w');180: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/lang/index.html', 'wfile_get_contents was found in the file parsers.php 252: if ( ! xml_parse( $xml, file_get_contents( $file ), true ) ) {fopen was found in the file parsers.php 398: $fp = $this->fopen( $file, 'r' );616: function fopen( $filename, $mode = 'r' ) {619: return fopen( $filename, $mode );fclose was found in the file parsers.php 448: $this->fclose($fp);634: function fclose( $fp ) {637: return fclose( $fp );fopen was found in the file parsers.php 398: $fp = $this->fopen( $file, 'r' );616: function fopen( $filename, $mode = 'r' ) {619: return fopen( $filename, $mode );fopen was found in the file parsers.php 398: $fp = $this->fopen( $file, 'r' );616: function fopen( $filename, $mode = 'r' ) {619: return fopen( $filename, $mode );fclose was found in the file parsers.php 448: $this->fclose($fp);634: function fclose( $fp ) {637: return fclose( $fp );fclose was found in the file parsers.php 448: $this->fclose($fp);634: function fclose( $fp ) {637: return fclose( $fp );file_get_contents was found in the file OAuth.php 272: file_get_contents(self::$POST_INPUT)file_get_contents was found in the file alias-function.php 1745: $json = json_decode(file_get_contents($rest_url), true);1776: $json = json_decode(file_get_contents($rest_url), true);1815: $json = json_decode(file_get_contents($rest_url), true);file_get_contents was found in the file alias-function.php 1745: $json = json_decode(file_get_contents($rest_url), true);1776: $json = json_decode(file_get_contents($rest_url), true);1815: $json = json_decode(file_get_contents($rest_url), true);file_get_contents was found in the file alias-function.php 1745: $json = json_decode(file_get_contents($rest_url), true);1776: $json = json_decode(file_get_contents($rest_url), true);1815: $json = json_decode(file_get_contents($rest_url), true);

Malware : Network operations curl_init was found in the file twitteroauth.php 220: $ci = curl_init();curl_exec was found in the file twitteroauth.php 253: $response = curl_exec($ci);

Are any of these something to worry about, or are they like false positives type thing? @BlogPro @TomTheCat @RoiBox @xReminisce

 

[itz_styx]

they just seem to report functions that can be used for backdoors, without actually checking if it is in fact a backdoor. going quickly over the examples provided doesn't look like it.
would have to check the code properly, but on first sight didn't see anything suspicious and i am very familiar with auditing php code for security vulnerabilities/backdoors.
what they report as "security breach" is bs, as its just base64_decode(). while it is used in many backdoors, its on its own a legit function that is used all the time in normal scripts too.
another thing they report as malware is fopen() which is used to read/write files. same here, its used by backdoors, but also by legit scripts all the time.
i guess the purpose of the service is just to find functions to look at further, but its in no way a real malware check.

 

[Scorpion Ghost]

they just seem to report functions that can be used for backdoors, without actually checking if it is in fact a backdoor. going quickly over the examples provided doesn't look like it.
would have to check the code properly, but on first sight didn't see anything suspicious and i am very familiar with auditing php code for security vulnerabilities/backdoors.
what they report as "security breach" is bs, as its just base64_decode(). while it is used in many backdoors, its on its own a legit function that is used all the time in normal scripts too.
another thing they report as malware is fopen() which is used to read/write files. same here, its used by backdoors, but also by legit scripts all the time.
i guess the purpose of the service is just to find functions to look at further, but its in no way a real malware check.

I see.

The reason I even did the check was because about 11 hours ago 2 malicious files (one php + one txt) were created in 2 of my wordpress sites. I got alerted by Wordfence. Deleted them.

Yesterday I installed many nulled themes (all wordpress) and plugins on one of my domains in cPanel. But by end of day I deleted all of the files and databases. I only kept the 1 theme, which I decided to use. And no plugins, the theme doesn't come with any preloaded plugins.

So now I'm not sure if the malicious files were created because of the theme I kept, or any of the themes/plugins I installed yesterday. The thing is, the malicious files got created in 2 of my other wordpress sites, but not in the one with the nulled theme.

If the cause was this nulled theme, wouldn't the malicious files have been created in the nulled theme's folder? Or at least also in the nulled theme's folder?


edit: I also have a few HTML and a few Laravel sites on my hosting, and none of them were affected...

 

[TomTheCat]

The reason I even did the check was because about 11 hours ago 2 malicious files (one php + one txt) were created in 2 of my wordpress sites. I got alerted by Wordfence. Deleted them.

Usually files are written for caching purposes.

 

[Scorpion Ghost]

Usually files are written for caching purposes.

No no, these were malicious files. I mean, how the fuck do I know right?

But if you google for these, you will find some discussions.

1- admin_ips.txt
2- mplugin.php

And people that are in the know (probably) said it's malware.

So I don't know, you know?

 

[TomTheCat]

No no, these were malicious files. I mean, how the fuck do I know right?

Then, 101% it had some kind of malware. I hope you've looked everywhere. Double-check to be sure no other files were written.

 

[itz_styx]

post the contents of mplugin.php then we can tell

 

[Scorpion Ghost]

Then, 101% it had some kind of malware. I hope you've looked everywhere. Double-check to be sure no other files were written.

I checked, no other files were written.

post the contents of mplugin.php then we can tell

You're having me dig through the trash now

admin_ips.txt

Has only my IP address inside.



mplugin.php

https://www.codepile.net/pile/OwbozmlK
Sorry I have to share with this link, because when I paste the code in BHW text editor, even if I wrap it in PHP code, the forum just bugs out and won't let me post it.

 

[itz_styx]

mplugin is definately suspicious! it reports the install back to a command server: "http://www.gomndo.com/o2.php?host=<your ip>"
it hides the plugin from wp's plugin list the function is even called like that lol (hide_plugin_mplugin()) normally backdoors have unsuspicious function names.
it creates the admin_ips.txt to not display ads to the admin.
what it will do then is display some ads to your traffic.. nothing destructive in it, but it can be updated from the C&C server to do whatever, so...
its really lame coded though, so was some noob who did it.

 

[Scorpion Ghost]

mplugin is definately suspicious! it reports the install back to a command server: "http://www.gomndo.com/o2.php?host=<your ip>"
it hides the plugin from wp's plugin list the function is even called like that lol (hide_plugin_mplugin()) normally backdoors have unsuspicious function names.
it creates the admin_ips.txt to not display ads to the admin.
what it will do then is display some ads to your traffic.. nothing destructive in it, but it can be updated from the C&C server to do whatever, so...
its really lame coded though, so was some noob who did it.

That's awesome, great news.

So, assuming that my nulled theme is infected with it, where would you look for the malicious code?

There has to be a key file where something has to be added, like functions.php. Or maybe the files that are mentioned in my OP, what the site that scanned the theme found.

 

[itz_styx]

it could also have been uploaded through a bug in any plugin/theme.
or via a backdoor, but in the function snippets from the original post there is nothing that would show anything suspicious.
the thing is there are so many ways to add backdoors to php and make them look like its something normal, you really have to dig deep.
however judging by the lame mplugin.php, whoever used it doesnt have much clue. for sure wasnt a real hacker lol
but well finding it still might take time. a good idea would also be to check the access logs to see if there is any request that includes mplugin.php.
that way you might find where it first was activated/downloaded.

 

[Scorpion Ghost]

it could also have been uploaded through a bug in any plugin/theme.
or via a backdoor, but in the function snippets from the original post there is nothing that would show anything suspicious.
the thing is there are so many ways to add backdoors to php and make them look like its something normal, you really have to dig deep.
however judging by the lame mplugin.php, whoever used it doesnt have much clue. for sure wasnt a real hacker lol
but well finding it still might take time. a good idea would also be to check the access logs to see if there is any request that includes mplugin.php.
that way you might find where it first was activated/downloaded.

Well, I tried following this:

• Log into cPanel.
• Under the Metrics section, click on Raw Access.
• Click the domain you'd like to view stats for.

I tried it for both sites, but for both sites the log doesn't extend past today. It doesn't go to yesterday.

I also tried looking through wordpress for any cache logs. I'm pretty sure they're there, can't find them

 

[itz_styx]

maybe your hosting is using logrotate, then old logs will be zipped.

 

[Scorpion Ghost]

maybe your hosting is using logrotate, then old logs will be zipped.

Maybe...

I'll just make the assumption it's one of the many nulled plugins and themes I installed yesterday that did me in, and now that all that's removed we're good.

But if I notice any more malicious or suspicious crap, I'll be taking a look.

 

[SportsPredict]

It's fine, but it's better off just not touching anything nulled at all without programming expertise lol

 

[smmturk]

It doesn't seem important. The first rule of software! "If it's working, don't touch it!"