Nulled theme - is this malware of false positive?

Scorpion Ghost

Scorpion Ghost

Elite Member
Executive VIP
Jr. VIP
Joined
Mar 22, 2013
Messages
9,148
Reaction score
10,491
I started playing with a nulled theme yesterday, and I ran it here - https://themecheck.info

So there's a bunch of deprecated functions and other shit, but only these four are worriesome:

Security breaches : Use of base64_decode() Found base64_decode in file OAuth.php. 202: $decoded_sig = base64_decode($signature);

Security breaches : Use of base64_encode() Found base64_encode in file et-google-checkout.php.
Found base64_encode in file OAuth.php.

Malware : Operations on file system fopen was found in the file class-ae-languages.php 170: fopen(WP_CONTENT_DIR . '/et-content/index.html', 'w');175: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/index.html', 'w');180: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/lang/index.html', 'wfopen was found in the file class-ae-languages.php 170: fopen(WP_CONTENT_DIR . '/et-content/index.html', 'w');175: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/index.html', 'w');180: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/lang/index.html', 'wfopen was found in the file class-ae-languages.php 170: fopen(WP_CONTENT_DIR . '/et-content/index.html', 'w');175: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/index.html', 'w');180: fopen(WP_CONTENT_DIR . '/et-content/' . THEME_NAME . '/lang/index.html', 'wfile_get_contents was found in the file parsers.php 252: if ( ! xml_parse( $xml, file_get_contents( $file ), true ) ) {fopen was found in the file parsers.php 398: $fp = $this->fopen( $file, 'r' );616: function fopen( $filename, $mode = 'r' ) {619: return fopen( $filename, $mode );fclose was found in the file parsers.php 448: $this->fclose($fp);634: function fclose( $fp ) {637: return fclose( $fp );fopen was found in the file parsers.php 398: $fp = $this->fopen( $file, 'r' );616: function fopen( $filename, $mode = 'r' ) {619: return fopen( $filename, $mode );fopen was found in the file parsers.php 398: $fp = $this->fopen( $file, 'r' );616: function fopen( $filename, $mode = 'r' ) {619: return fopen( $filename, $mode );fclose was found in the file parsers.php 448: $this->fclose($fp);634: function fclose( $fp ) {637: return fclose( $fp );fclose was found in the file parsers.php 448: $this->fclose($fp);634: function fclose( $fp ) {637: return fclose( $fp );file_get_contents was found in the file OAuth.php 272: file_get_contents(self::$POST_INPUT)file_get_contents was found in the file alias-function.php 1745: $json = json_decode(file_get_contents($rest_url), true);1776: $json = json_decode(file_get_contents($rest_url), true);1815: $json = json_decode(file_get_contents($rest_url), true);file_get_contents was found in the file alias-function.php 1745: $json = json_decode(file_get_contents($rest_url), true);1776: $json = json_decode(file_get_contents($rest_url), true);1815: $json = json_decode(file_get_contents($rest_url), true);file_get_contents was found in the file alias-function.php 1745: $json = json_decode(file_get_contents($rest_url), true);1776: $json = json_decode(file_get_contents($rest_url), true);1815: $json = json_decode(file_get_contents($rest_url), true);

Malware : Network operations curl_init was found in the file twitteroauth.php 220: $ci = curl_init();curl_exec was found in the file twitteroauth.php 253: $response = curl_exec($ci);

Are any of these something to worry about, or are they like false positives type thing? @BlogPro @TomTheCat @RoiBox @xReminisce
 
Advertise on BHW
they just seem to report functions that can be used for backdoors, without actually checking if it is in fact a backdoor. going quickly over the examples provided doesn't look like it.
would have to check the code properly, but on first sight didn't see anything suspicious and i am very familiar with auditing php code for security vulnerabilities/backdoors.
what they report as "security breach" is bs, as its just base64_decode(). while it is used in many backdoors, its on its own a legit function that is used all the time in normal scripts too.
another thing they report as malware is fopen() which is used to read/write files. same here, its used by backdoors, but also by legit scripts all the time.
i guess the purpose of the service is just to find functions to look at further, but its in no way a real malware check.
 
itz_styx said:
they just seem to report functions that can be used for backdoors, without actually checking if it is in fact a backdoor. going quickly over the examples provided doesn't look like it.
would have to check the code properly, but on first sight didn't see anything suspicious and i am very familiar with auditing php code for security vulnerabilities/backdoors.
what they report as "security breach" is bs, as its just base64_decode(). while it is used in many backdoors, its on its own a legit function that is used all the time in normal scripts too.
another thing they report as malware is fopen() which is used to read/write files. same here, its used by backdoors, but also by legit scripts all the time.
i guess the purpose of the service is just to find functions to look at further, but its in no way a real malware check.
Click to expand...

I see.

The reason I even did the check was because about 11 hours ago 2 malicious files (one php + one txt) were created in 2 of my wordpress sites. I got alerted by Wordfence. Deleted them.

Yesterday I installed many nulled themes (all wordpress) and plugins on one of my domains in cPanel. But by end of day I deleted all of the files and databases. I only kept the 1 theme, which I decided to use. And no plugins, the theme doesn't come with any preloaded plugins.

So now I'm not sure if the malicious files were created because of the theme I kept, or any of the themes/plugins I installed yesterday. The thing is, the malicious files got created in 2 of my other wordpress sites, but not in the one with the nulled theme.

If the cause was this nulled theme, wouldn't the malicious files have been created in the nulled theme's folder? Or at least also in the nulled theme's folder?


edit: I also have a few HTML and a few Laravel sites on my hosting, and none of them were affected...
 
TomTheCat said:
Usually files are written for caching purposes.
Click to expand...

No no, these were malicious files. I mean, how the fuck do I know right? :D

But if you google for these, you will find some discussions.

1- admin_ips.txt
2- mplugin.php

And people that are in the know (probably) said it's malware.

So I don't know, you know? :D
 
TomTheCat said:
Then, 101% it had some kind of malware. I hope you've looked everywhere. Double-check to be sure no other files were written.
Click to expand...

I checked, no other files were written.

itz_styx said:
post the contents of mplugin.php then we can tell ;)
Click to expand...

You're having me dig through the trash now :D

admin_ips.txt

Has only my IP address inside.



mplugin.php :alien: :confused: :mad: :suspicious: :anyway: :oops: o_O :poop:

https://www.codepile.net/pile/OwbozmlK
Sorry I have to share with this link, because when I paste the code in BHW text editor, even if I wrap it in PHP code, the forum just bugs out and won't let me post it.
 
mplugin is definately suspicious! it reports the install back to a command server: "http://www.gomndo.com/o2.php?host=<your ip>"
it hides the plugin from wp's plugin list the function is even called like that lol (hide_plugin_mplugin()) normally backdoors have unsuspicious function names.
it creates the admin_ips.txt to not display ads to the admin.
what it will do then is display some ads to your traffic.. nothing destructive in it, but it can be updated from the C&C server to do whatever, so...
its really lame coded though, so was some noob who did it.
 
itz_styx said:
mplugin is definately suspicious! it reports the install back to a command server: "http://www.gomndo.com/o2.php?host=<your ip>"
it hides the plugin from wp's plugin list the function is even called like that lol (hide_plugin_mplugin()) normally backdoors have unsuspicious function names.
it creates the admin_ips.txt to not display ads to the admin.
what it will do then is display some ads to your traffic.. nothing destructive in it, but it can be updated from the C&C server to do whatever, so...
its really lame coded though, so was some noob who did it.
Click to expand...

That's awesome, great news.

So, assuming that my nulled theme is infected with it, where would you look for the malicious code?

There has to be a key file where something has to be added, like functions.php. Or maybe the files that are mentioned in my OP, what the site that scanned the theme found.
 
it could also have been uploaded through a bug in any plugin/theme.
or via a backdoor, but in the function snippets from the original post there is nothing that would show anything suspicious.
the thing is there are so many ways to add backdoors to php and make them look like its something normal, you really have to dig deep.
however judging by the lame mplugin.php, whoever used it doesnt have much clue. for sure wasnt a real hacker lol
but well finding it still might take time. a good idea would also be to check the access logs to see if there is any request that includes mplugin.php.
that way you might find where it first was activated/downloaded.
 
itz_styx said:
it could also have been uploaded through a bug in any plugin/theme.
or via a backdoor, but in the function snippets from the original post there is nothing that would show anything suspicious.
the thing is there are so many ways to add backdoors to php and make them look like its something normal, you really have to dig deep.
however judging by the lame mplugin.php, whoever used it doesnt have much clue. for sure wasnt a real hacker lol
but well finding it still might take time. a good idea would also be to check the access logs to see if there is any request that includes mplugin.php.
that way you might find where it first was activated/downloaded.
Click to expand...

Well, I tried following this:
  • Log into cPanel.
  • Under the Metrics section, click on Raw Access.
  • Click the domain you'd like to view stats for.
I tried it for both sites, but for both sites the log doesn't extend past today. It doesn't go to yesterday.

I also tried looking through wordpress for any cache logs. I'm pretty sure they're there, can't find them :p
 
maybe your hosting is using logrotate, then old logs will be zipped.
 
itz_styx said:
maybe your hosting is using logrotate, then old logs will be zipped.
Click to expand...

Maybe...

I'll just make the assumption it's one of the many nulled plugins and themes I installed yesterday that did me in, and now that all that's removed we're good.

But if I notice any more malicious or suspicious crap, I'll be taking a look.
 
It doesn't seem important. The first rule of software! "If it's working, don't touch it!" :)
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top