2

I have a Apache VPS by GoDaddy with Wordpress and the Enfold theme. Both are up to date, no additional plugins are installed.

The server frequently gets hacked, and malicious PHP code gets injected to the file structure. Those files send tons of emails out.

I do not know where/ how the attackers enter the website. All passwords have been changed. I set up the following iptable rule

-A INPUT -p tcp -m tcp -m multiport ! --dports 20,21,80,443,1030,2083,2086,2087

to block all ports not needed for the website use and development. (1030 is SSH)

Also, the website is using the cloudflare WAF...

Is there any way to write a bash script which monitors all incoming connections to the server, what port and file they have accessed and logs it? So the next time files get injected i can follow the request at this time and see what connections / IP / service was used.

Thank you for any help to solve the issue. I ideally would not only want to know how to block the attacks but also how they are conducted and what vulnerabilities they are using. As the hack is sending out emails ony, and we don't need exim at the moment, i can easily disable the email server. This way i can try different approaches and observe the attack more often to understand what is really going on.

Thank you!

|improve this question
  • 2
    I think it is a WordPress plugin problem – Cricco95 Feb 18 '17 at 0:08
  • Are you using https on your site? – essefbx Feb 18 '17 at 2:19
  • there are no plugins installed. No SSL certificate is in use – Tom Feb 18 '17 at 7:12
  • I've seen more than a few waves of this type of attack on shared hosting lately, generally with Wordpress (though I've heard Drupal has similar vulnerabilities). In each case they're injecting code into the user agent string, which downloads malicious php files and defaces your templates (to persist the spamming mechanisms). – Ivan Mar 21 '17 at 0:51
1

It would be better to log PHP requests. So you can cobble some simple script on top of your index.php to log all _GET and _POST globals. Based on that, you can see what request is sent with what parameters to your Wordpress which causes a breach.

Your theme used to have vurnerabilities, see link here, it may be that it still has some which is exploited on your website. Unfortunately, you might be on your own in tracking it via _GET and _POST and fixing it by returning null if malicious parameters are passed.

|improve this answer
  • thanks for your time to answer. How would this work though, if the attacker knows that e.g. example.com/wp-content/themes/enfold/vulnerable.php is a vulnerable file. If he sends the request directly to that file, the index.php wont be included in that request right? or am i missing something? – Tom Feb 19 '17 at 0:36
1

Your web server probably logs the requests already. If the server is hacked it is possible that the attacker cleans these logs.

You should therefore automatically send them to a remote server (self-hosted with only the remote logging port open, or you could use one of the cloud services (papertrail, loggly, etc.))

You will not, unfortunately, get the body of the POST requests but this is something you can try to configure as well.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.