1

Our Wordpress website was hacked. I couldn't find anything intelligible from my limited experience from the limited logs my hosting gives. However, browsing in the FTP files I found a post.php file in the root and two more themes. Nothing strange in the DB, nor a new user. In the index I found the string "Silence is golden".

I spent my day reading about it and it seems one of the most classic WP attacks.

The server hosts a directory of the root where there is a form powered by AppGini, which relies on another DB and is loaded in an iframe in the Wordpress pages. This form is not password protected, however AppGini ships by default protection of MySQL injection.

In your opinion, could this form be the door to enter the WP installation? Is this technically possible? Or is it a 100% Wordpress attack, regardless of what is beside it?

Improve this question
4
  • Does that form have file upload option ?
    – Rahul
    Apr 1, 2017 at 4:31
  • No, you can only fill text-fields or choose options from select2.
    – Fabio Ricci
    Apr 1, 2017 at 7:27
  • 1
    I would expand your question to ask, "can my web server be hacked by accessing a PHP script on the server?" and the answer to that is obviously 'yes'.
    – schroeder ♦
    Apr 1, 2017 at 9:14
  • Sure, it can. But, and forgive again my weak knowledge, even if an automatic script can access the server through a PHP, how could implement a Silence is golden attack? It would be a really clever attack to find a PHP weakness then access the server then know than there is a WP installed and finally put files like post.php on the root and many other files (such two brand new WP themes) and spam apparently random email addresses from post.php. Now, would be that possible (unless this is a human attack, which I don't believe)...?
    – Fabio Ricci
    Apr 1, 2017 at 16:10

4 Answers 4

Reset to default
0

Sure, if there is a PHP script which allows code execution - eg via command injection, file upload, etc - on the same server then an attacker can use that to gain access to the WordPress installation. The same is true for directory traversal vulnerabilities. (Assuming that you do not take any measure to separate different applications such as different virtual machines)

If a separate script contains an SQL injection, that could also lead to access to WordPress, depending on the setup of the database permissions. If the script is on the same domain, XSS could also be exploited.

I'm not familiar with AppGini, and I do not know what kind of form you are using, but as it is some kind of development/code generation tool with a browser-based administration GUI, any form really should be password protected. We can't tell you how an attacker gained access (@K BHATTs answer covers the most common issues), but this also seems like a likely attack vector.

"Silence is golden" index.php files are from WordPress. They are not a sign of anything, they are just there to prevent directory listing.

Improve this answer
1
  • Hi and thanks. Database accessed by AppGini is not the same as the WP one. In addition, I found these interesting lines in my log (I won't bother you with the complete one). basically all was ok till a IP came into the scene. First sign was several wp-login.php calls and then GET /wp-content/themes/F:\xc4\xee\xf0\xee\xe3\xee\xf1\xf2\xee\xff\xf9\xe8\xe5\MultiShell2\xf8\xe5\xeb\xeb\xfb\xcf\xee\xea\xf3\xef\xed\xee\xe9 \xf1\xee\xf4\xf2\uploader\Wordpress Shell Uploader\gaukingo/db.php and several uploads. It seems they passed through the WP-login
    – Fabio Ricci
    Apr 1, 2017 at 20:40
1

the entry points for attacker can include: outdated - PHP, themes, plugins, weak passwords, misconfigured php.ini file that can lead to issues. Please check if any of these have been overlooked.

Improve this answer
0

The best practise to put in place is to ensure that your wordpress and its plugins are updated at a regular interval , i prefer to check for update every 10 days. Given the scenario there do not seem to be any APPgini based exploits available publically and my guess would be a vulnerability in the plugins that might have been installed. Also i suggest if there are a limited people accessing the panel make use of a 2FA.

Coming to the point , this could be a wordpress plugin exploit. An exact guess cannot be given because i dont know what plugins and what version were installed on your wordpress. But yes , there are reverse shell php scripts available through which a limited shell access can be obtained.

Improve this answer
0

found the complete Log in another Post of you.

Here is what I read from it:

The GET Request for the Files wp-login.php from 91.210.145.98 (Windows 10 64Bit, with probably Mozilla Firefox 50) is 200 200 = HTTP Statuscode = OK which means successfull.

The POST of the Login Data was successfull. (A interesting thing is, that i dont see any Bruteforce signs in the LOG you posted). The Attacker is now successfull logged in (access to wp-admin)

The Attacker opens the Theme Editor. (/wp-admin/theme-editor.php) The Attacker checks if the Theme TwentyFourteen already exists. ( /wp-admin/theme-editor.php?file=404.php&theme=twentyfourteen)

The Attacker opens the Page to upload a Theme.

The Attacker binds an Wordpress Remote Shell to the database.php of the Theme Gaukingo (Wordpress Shell Uploader\gaukingo) and uploads it.

The Attacker binds an Wordpress Remote Shell to the db.php of the Plugin three-column-screen-layout (three-column-screen-layout/db.php) and uploads it.

He checks if the File GET /wp-content/uploads/db.php already exist but gets an HTTP 404 which means Not Found. He does the same with /wp-content/uploads/2017/23/db.php.

He issues an HEAD Request which means he just recieves Homepage Header Data, which is faster for example if you want to recieve Data in a Linux-Shell. Maybe he is using a Program like Metasploit from now on because he has way more possibel Browsers (Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45) - He logs on via wp-login.php - He opens the Page to upload a Theme - He checks if the Theme sketch is already installed text here

After I read the Log I think he is trying to use a weakness in outdated but still installed Plugins and Themes. I think it's the best to secure your Wordpress in the future as suggested in the Comments. 

[30/Mar/2017:13:52:56 +0100] "GET /wp-login.php HTTP/1.1" 200 2752 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:52:57 +0100] "POST /wp-login.php HTTP/1.1" 302 1136 "http://*************.com.it/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:52:58 +0100] "GET /wp-admin/ HTTP/1.1" 200 62061 "http://*************.com.it/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 

[30/Mar/2017:13:52:59 +0100] "GET /wp-admin/theme-editor.php HTTP/1.1" 200 38782 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:53:00 +0100] "GET /wp-admin/theme-editor.php?file=404.php&theme=twentyfourteen HTTP/1.1" 500 3785 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 

[30/Mar/2017:13:53:01 +0100] "GET /wp-admin/theme-install.php?upload HTTP/1.1" 200 52466 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:53:02 +0100] "POST /wp-admin/update.php?action=upload-theme HTTP/1.1" 200 31812 "*************.com.it/wp-admin/theme-install.php?upload" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 

[30/Mar/2017:13:53:07 +0100] "GET /wp-content/themes/F:\xc4\xee\xf0\xee\xe3\xee\xf1\xf2\xee\xff\xf9\xe8\xe5\MultiShell2\xf8\xe5\xeb\xeb\xfb\xcf\xee\xea\xf3\xef\xed\xee\xe9 \xf1\xee\xf4\xf2\uploader\Wordpress Shell Uploader\gaukingo/db.php HTTP/1.1" 404 51872 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:53:08 +0100] "GET /wp-admin/plugin-install.php?tab=upload HTTP/1.1" 200 40682 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 

[30/Mar/2017:13:53:09 +0100] "POST /wp-admin/update.php?action=upload-plugin HTTP/1.1" 200 31541 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:53:15 +0100] "GET /wp-content/plugins/F:\xc4\xee\xf0\xee\xe3\xee\xf1\xf2\xee\xff\xf9\xe8\xe5\MultiShell2\xf8\xe5\xeb\xeb\xfb\xcf\xee\xea\xf3\xef\xed\xee\xe9 \xf1\xee\xf4\xf2\uploader\Wordpress Shell Uploader\three-column-screen-layout/db.php HTTP/1.1" 404 51874 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:53:16 +0100] "POST /wp-admin/update.php?action=upload-plugin HTTP/1.1" 200 31426 "*************.com.it/wp-admin/theme-install.php?tab=upload" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 

[30/Mar/2017:13:53:19 +0100] "GET /wp-content/uploads/db.php HTTP/1.1" 404 51729 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 
[30/Mar/2017:13:53:20 +0100] "GET /wp-content/uploads/2017/23/db.php HTTP/1.1" 404 51753 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - - 

[30/Mar/2017:13:58:22 +0100] "HEAD /wp-login.php HTTP/1.1" 200 343 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - - 
[30/Mar/2017:13:58:23 +0100] "GET /wp-login.php HTTP/1.1" 200 2697 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - - 
[30/Mar/2017:13:58:23 +0100] "POST /wp-login.php HTTP/1.0" 302 1305 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - - 
[30/Mar/2017:13:58:24 +0100] "POST /wp-admin/ HTTP/1.0" 200 61984 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - - 
[30/Mar/2017:13:58:25 +0100] "GET /wp-admin/theme-install.php HTTP/1.1" 200 52420 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - - 
[30/Mar/2017:13:58:27 +0100] "POST /wp-admin/update.php?action=upload-theme HTTP/1.0" 200 32257 "http://*************.com.it/wp-admin/theme-install.php?upload" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - - 
[30/Mar/2017:13:58:33 +0100] "GET /wp-content/themes/sketch/404.php HTTP/1.1" 200 377 "http://*************.com.it/wp-admin/theme-install.php?upload" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.