3

Recently a couple of sites we had built have been used to send a tonne of spam emails. We aren't security experts, but with some research believe that it may be some kind of PHP Injection taking place. We managed to remove the infected files from the site/s and have implemented extra software to manage the security better - however, attacks are still being attempted and we aren't sure which file it is that is vulnerable.

We have the following report from one of our plugins (it's a WordPress site), which shows multiple attempts to traverse the directory and upload malicious files. Our worry is that without this plugin the culprit would have had easy access to carry out said attacks - but the scan shows directory's that do not exist?

I guess my question is this: what is it the attacker is doing (in terms of the hack) and why is it showing directories that do not exist? The end goal is to re-factor the code to deminish the apparant exploit - when we know which file it is...

Apologies if this is a bad question or is in the wrong section - I am new to Stack Exchange but am in desperate need of some security expertise!

enter image description here

Improve this question
5
  • 3
    These attempts are automated - they don't know which files you may have that are vulnerable, so a script just runs through a list of common ones.
    – Rory Alsop ♦
    Commented Aug 11, 2016 at 9:01
  • @RoryAslop - So there isn't necessarily any vulnerable files, but the bot/whatever it is, is using a list of plugins/files etc. that are known to be vulnerable, and is trying to exploit those vulnerabilities if they exist? Thanks for the quick response too!
    – JNH1994
    Commented Aug 11, 2016 at 9:07
  • 2
    Yep - scans like this for PHP, Wordpress and other common frameworks happen continuously across the Internet. Sad, but a fact of life these days.
    – Rory Alsop ♦
    Commented Aug 11, 2016 at 9:10
  • @RoryAslop - Ah, okay. Well that is a bit of a relief for my site - but not for the Internet in general I suppose! Still, thanks for the help!!
    – JNH1994
    Commented Aug 11, 2016 at 9:19
  • Instead of trying to block malicious files what about making it so those files won't be executed and thus won't harm the server? You need to change the web server's configuration so it won't execute arbitrary PHP files besides the original Wordpress files (which shouldn't be writable by the web server's user so attackers can't replace a whitelisted file by their own malicious one).
    – André Borie
    Commented Dec 10, 2016 at 0:33

2 Answers 2

Reset to default
2

We have the following report from one of our plugins (it's a WordPress site), which shows multiple attempts to traverse the directory and upload malicious files. Our worry is that without this plugin the culprit would have had easy access to carry out said attacks - but the scan shows directory's that do not exist?

Because the plugin doesn't say - and can't really say - if the attack was successful. It can only say that it did take place.

These look like automated scans for known vulnerabilities. The path traversal test for example is for a vulnerability in wp-ecommerce-shop-styling v2.5.

If you are worried about the attacks, you can follow up on the reports. Check if you have the named plugins installed, and if so, if there are publicly known vulnerabilities for the version you have. You could also visit the link and check if the attack is successful (but first check what the link actually does; You do not want to accidentally trigger an XSS attack for example). Note though that most successful attacks can delete logs, so just because you do not find a successful attack does not necessarily mean that there was none.

Improve this answer
1
  • 1
    Thanks, Tim. We don't have any of the plugins installed that the attack tried to exploit so I think we'll be okay. I'll definitely do some more digging though.
    – JNH1994
    Commented Aug 13, 2016 at 13:28
0

If you're running wordpress you're instantly a target for worms and other hackers. Why you ask? Because wordpress is a very attractive target; a lot of the plugins commonly uses are vulnerable. Furthermore, the reason you see random directories that don't exist trying to get hacked is because the mass scan scripts only check to see if your site is running wordpress and then it loops through a bunch of random popular scripts hoping to own your site.

However, if one is truely persistent, they can EASILY enumerate all of the currently installed plugins and administrator usernames (wp-login) which can be used to either bruteforce your login panel or initiate a more specific and targeted attack.

If you would like to scan your site's wordpress plugins to see if they are vulnerable in the most latest database of vulnerable wordpress plugins you could use a tool called wpscan.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .