WARNING - WordPress Exploits

Man i faced this at least 30 times in a span of 2 months. Wordpress really has something that is not right (and something that even the owner is unaware about). Even my default page got hacked (a blog with No extra themes and plugins). I did some research on this and came up with some solutions that is still working for me. I don't want to self advertise, but if anyone is looking to secure their WP installation, they might try my way which i posted here:
http://www.blackhatworld.com/blackh...log-hackproof-complete-guide.html#post4821645

The most two important points should be firstly to go for a good host (like Hostgator and Godaddy), which doesn't allow access to other user's account in shared hosting, and last but not the least, to secure your WP-ADMIN folder.
Try out my techniques, i think it might help you :-)


@mods, please delete the link if you feel necessary :-)
 
Last edited:
Advertise on BHW
madoctopus said:
I've had my site (http://www.imfaction.com - DO NOT OPEN IT IN YOUR BROWSER) hacked like a month ago. Didn't had much time to take care of it but now found some. If you want to look at the site (not much to see) I recommend you open it in a sandbox environment or virtual machine just in case there's a browser exploit hooked on the page that might infect you. Doesn't seems to be but I can't be 100% sure.

Ok, so I had the site hacked about 3-4 times within this month, by 3-4 people. Or maybe just once but he changed the defacement page (less likely). WordPress was at latest version and I had some plugins which were not up to date but when I checked their changelogs there are no security related entries so I don't think that's how they got in.

Also my host seems to have issued several press releases about WP exploits. They were unable to figure out how the exploits work though and what was the attack vector. Thing is, somebody seems to know a way in and the exploit is not public.

I also have a Piwik install in the same host and though I think it was at latest version when I got hacked 1st time, a new version appeared meanwhile. Had no time yet to check Piwik. I don't think that was how they got in though.

Anyway, what I was able to find so far was a mail form coupled with a random-password session script so the hacker protects it from others. Both files are in /public_html/.

A PHP shell in /wp-content/themes/ directory. The shell dir contains a symlink to the root dir. Didn't got to analyze what it does.

A modified index.php file of the theme I had enabled. This contains the current defaced homepage that is seen publicly.

The wordpress credentials were changed. I had a non-default admin username but now it is 'admin', he also changed the email address with another one (free email) and the password. Password is 34 characters which means it is not a MD5 hash. Not sure if WP salts the paswords adding extra characters or it's a hack of the guy who hacked me.

There are 2 more themes in the /wp-contents/themes which one is the shell, the other I haven't looked into but is made by one of the hackers. The directories are 'x' and 'shell'. In WP admin interface 'x' appears as a child theme of Twenty Ten default WP theme.

Plugins I have installed and enabled:
Acronyms 2
Akismet
Enable Image Scaling on Upload
W3 Total Cache
WP-Piwik
WP No Category Base

Plugins installed but NOT enabled:
Accessibility Abbreviation
File Inliner
MailPress
Newsletter
Newsletter Sign-Up
Sendit
WP No Category Base - WPML compatible
WP No Tags Base

Active Theme: Nest

Inactive Themes:
Twenty Eleven
Twenty Ten


My recommendations:
1. BACKUP EVERYTHING. Backup now and backup every time you make updates to the site, or setup an automated backup system.

2. Set restrictive permissions to all files and directories. /wp-content/uploads/ has to be writable, same with the 'cache' directory if you have a caching plugin. The rest should be read-only - both the files and the directories.

3. Uninstall and completely delete all plugins that you don't have enabled.

4. Uninstall and completely delete all plugins you don't really need.

That's all I have so far. Will update when I find something new.
Click to expand...

Your own PC is probably the culprit here. The virus/trojan or whatever seeks out all your ftp type programs then does a ftp to your sites by dialing into your site using your password then freely exploits your files in webhosting container. You better check your own PC for viruses/trojans and other nasties and you might find that it was nothing more than an exploit coming from your own computer.
 
Last edited:
Pekton said:
Just had this pop up with one of my plugins http://seclists.org/fulldisclosure/2012/Nov/51
XSS vulnerability in swfupload in WordPress

Seems its been fixed in wordpress core but some plugins are using old versions. Found out as they just updated Ultimate TinyMCE for this reason. Maybe some of your plugins are using it?
Click to expand...

XSS gets stuff injected in client side. It does not give access to the server/files. So it is certainly not XSS. Could be CSRF but doubt that too. What I am quite sure about is that it allowed a file upload or malicious code execution.

SonicSam said:
Going to this hacked website, unless it does some funky ActiveX stuff for IE (which I assume IE is smart now, haven't used in years), what exactly do you have to look out for? Javascript hacks? I doubt anything this website can do can affect the end user (short of prompting a file download and end user being dumb and opening it)...
Click to expand...

Actually an exploit can do anything because it can break the browser security sandbox, run a Java applet and a bunch of other stuff. It can even download AND execute an .exe automatically and you wouldn't even know it if you don't have an anti-virus.

rutix said:
did you ask the other website owners on the same host for the same issues? Maybe the whole server is exploited...
Click to expand...

Don't know how I ould get a hold of other site owners on same host. I've emailed the host but no reply so far. Also their site is a bit strange - full of affiliate ads to hosting companies. Maybe they got hacked too lol. Maybe that's how they got in... who knows.

BlueZero said:
Its because wordpress allows the use of eval function.
The only solution for that is installing php suhosin on the server and disabling the eval function with that.
Click to expand...

eval only alows you to mask an exploit. It is not a security problem by itself. Use of eval is a problem only if you get nulled scripts from unreliable sources and they're built in with backdoors using eval and base64 or other methods to hide what the backdoor does.

rodvan said:
Stop using nulled scripts. Get legit.watchout for freebies.
Click to expand...

Is all 100% legit. Never use nulled scripts.

mikie46 said:
Your own PC is probably the culprit here. The virus/trojan or whatever seeks out all your ftp type programs then does a ftp to your sites by dialing into your site using your password then freely exploits your files in webhosting container. You better check your own PC for viruses/trojans and other nasties and you might find that it was nothing more than an exploit coming from your own computer.
Click to expand...

Not the case. PC is clean, and no other site has been affected.

I'm not necessarily looking for a solution here, just wanted to give everybody a heads up to make backups and such. I know what i have to do. Shit happens...
 
What browser were you using ?

I have accessed your site on my VM using firefox with all comps up to date and a few antisp/antivirus and there was nothing malicious that would jump into. Keep in mind that if u had old comps in use they could have been the reason u got infected as well.

What I was thinking about since u mentioned about the "several wp" within your host company got hit is that perhaps you had permissions like 777 and some one used that to replace a file content with a code to download the shell script into your wp (or even replacing it with the shell code itself) hence making it possible to execute within your site.

Note that 777 will give access to others which is not a good practice! You should always use 770 being 0 no access to others where 770 is more than enough for the webserver to do what it needs within your user/group.

EDIT: 770 is meant for folder mostly, for files it will vary on the file type for instance PHP would get 750 instead of 755, etc.
 
Last edited:
cgimaster said:
What browser were you using ?

I have accessed your site on my VM using firefox with all comps up to date and a few antisp/antivirus and there was nothing malicious that would jump into. Keep in mind that if u had old comps in use they could have been the reason u got infected as well.

What I was thinking about since u mentioned about the "several wp" within your host company got hit is that perhaps you had permissions like 777 and some one used that to replace a file content with a code to download the shell script into your wp (or even replacing it with the shell code itself) hence making it possible to execute within your site.

Note that 777 will give access to others which is not a good practice! You should always use 770 being 0 no access to others where 770 is more than enough for the webserver to do what it needs within your user/group.

EDIT: 770 is meant for folder mostly, for files it will vary on the file type for instance PHP would get 750 instead of 755, etc.
Click to expand...

All CPanel hosts use suphp or a similar thing so that problem does not exist. Only thing shared that I can think of is the sessions if you use regular PHP sessions.

I didn't said you get infected with something , I said you might. There are no alarms here either but a good exploit is one that leaves no trace :) Since the site got a visit from a hacker I have no way of knowing if the page loads something bad or not (e.g. through an image).
 
madoctopus said:
All CPanel hosts use suphp or a similar thing so that problem does not exist. Only thing shared that I can think of is the sessions if you use regular PHP sessions.
Click to expand...
That is if it was properly configured, for instance if the open_basedir is wrong or point at a root folder of users then they would still to be able to access / edit files with global permissions such as 777. Also I dont know which hosting youre using of which panel they have but suPHP can also be opted out from the installation, are you sure its being used ?

suPHP alone is not bulletproof and will still allow people to browse your folder or view your files with permissions and configurations are not properly set.


madoctopus said:
I didn't said you get infected with something , I said you might. There are no alarms here either but a good exploit is one that leaves no trace
smile.png
Since the site got a visit from a hacker I have no way of knowing if the page loads something bad or not (e.g. through an image).
Click to expand...

I was just stating that the page is safe to visit or at lest is using ff with all comps uptodate :)

I have came across a really interesting plugin for wordpress a while a go, that you might want to try http://wordpress.org/extend/plugins/wordfence/ its well recommended even at webhostingtalk
 
Last edited:
If you're using WP Multisite, put an .htaccess file in your blogs dir that contains this:
RemoveHandler .html .htm .php .php3 .phtml
AddType text/html .php .htm .html .phtml .php3

If you're not using multisite, put the same file in your wp-content/uploads dir. That file make sure that no PHP code can be executed directly from those directories. It doesn't prevent them from being included by other files.

You may or may not want to add it to your themes and plugins dirs. It really depends on if your theme or plugin somehow uses an executable file directly - for example timthumb.php is executable in some themes. (timthumb.php was the way I got hacked before).

Sounds to me like your web host has improper security settings somewhere. It's not uncommon for hosts to fail to set security where one account can modify another account's directory.
 
Makel your idea sounds good I would try it with some slight changes, instead of removing handlers/adding types I would use a combination of directory/files match, something like this:

Code: 
<Directory /some/path>
    <FilesMatch "\.(htaccess|htpasswd|html|htm|php|phtml)$">
        Order Allow,Deny
        Deny from all
    </FilesMatch>
</Directory>

NOTE: this is untested but might work as good, the main difference is that this will not allow anyone accessing those files directly to have access to them so if any of the files have important information, it will not be displayed.

EDIT: an easier option to the above rule would be to create a .htaccess inside the wp-content folder with the following:

Code: 
Order deny,allow
Deny from all
<Files ~ "\.(xml|css|jpe?g|png|gif|js)$">
    Allow from all
</Files>

At the Files line you would add any file extension you would want to allow access to.
 
Last edited:
Best option is to always run as FEW plugins as you need and keep up to date on all updates released, install BulletProof Security, and obey proper password / file permission standards.
 
For me, wordpress isn't that much of a good sevice. But everyone has his/her preferences
 
fred_durst said:
Don't use nulled themes/plugins
Click to expand...

He said he didnt use those.? I had a problem a few years ago, and it was something coming from my machine and it got all my sites thru my ftp client.... somehow. I cleaned it all up, but now I try to stay up to date and keep the av running. Sorry about your probs, OP.
 
I would suggest you remove your site or "hxxp" it.... People clikc links like it was a g-spot.. :)
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top