4

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password resets.

It is highly unlikely that the attacker has access to the email address (or that they could have intercepted data in the path of the web server and email client) the password reset was sent to.

Why might a hacker attempt to do a password reset? (I've discovered the Wordpress 4.0 CSRF Password Reset vulnerability, but from what I can see this does not seem to match what I am seeing.

The relevant (sanitized) log file entries (starting from about the time the reset email was received) look as follows:

www.attacked.wpsite.addr:443 74.63.240.187 - - [28/Dec/2017:06:10:17 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 302 3644 "-" "-"
www.attacked.wpsite.addr:443 74.63.240.187 - - [28/Dec/2017:06:10:19 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 302 3644 "-" "-"
www.attacked.wpsite.addr:443 54.148.232.32 - - [28/Dec/2017:06:10:22 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 400 3856 "-" "-"
www.attacked.wpsite.addr:443 54.148.232.32 - - [28/Dec/2017:06:10:24 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 400 3856 "-" "-"
www.attacked.wpsite.addr:443 162.243.152.212 - - [28/Dec/2017:06:18:54 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 400 3856 "-" "-"
www.attacked.wpsite.addr:443 162.243.152.212 - - [28/Dec/2017:06:18:56 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 400 3856 "-" "-"
www.attacked.wpsite.addr:443 65.19.143.194 - - [28/Dec/2017:06:24:55 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 400 3745 "-" "-"
www.attacked.wpsite.addr:443 65.19.143.194 - - [28/Dec/2017:06:24:59 +1300] "POST /wp-login.php?action=lostpassword HTTP/1.1" 400 3745 "-" "-"
www.attacked.wpsite.addr:80 185.86.13.213 - - [28/Dec/2017:06:25:19 +1300] "GET /wp-login.php HTTP/1.1" 302 279 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
www.attacked.wpsite.addr:443 185.86.13.213 - - [28/Dec/2017:06:25:21 +1300] "GET /wp-login.php HTTP/1.1" 200 6009 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
www.attacked.wpsite.addr:443 185.86.13.213 - - [28/Dec/2017:06:25:21 +1300] "POST /wp-login.php HTTP/1.1" 200 3754 "https://www.attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
www.attacked.wpsite.addr:80 51.15.146.69 - - [28/Dec/2017:06:43:47 +1300] "POST /wp-login.php HTTP/1.1" 302 238 "http://attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 5.2; rv:52.42.99) Gecko/20130250 Firefox/52.42.99"
www.attacked.wpsite.addr:443 51.15.146.69 - - [28/Dec/2017:06:43:49 +1300] "GET /wp-login.php HTTP/1.1" 200 4798 "http://attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 5.2; rv:52.42.99) Gecko/20130250 Firefox/52.42.99"
www.attacked.wpsite.addr:443 91.200.12.22 - - [28/Dec/2017:07:59:58 +1300] "POST /wp-login.php HTTP/1.1" 200 4987 "https://attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_36_89) AppleWebKit/532.85.48 (KHTML, like Gecko) Chrome/57.4.9780.5052 Safari/534.56"
www.attacked.wpsite.addr:443 91.200.12.22 - - [28/Dec/2017:07:59:59 +1300] "POST /wp-login.php HTTP/1.1" 200 2128 "https://attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 5.0) AppleWebKit/533.09.52 (KHTML, like Gecko) Version/5.5.1 Safari/532.17"
www.attacked.wpsite.addr:443 198.71.87.205 - - [28/Dec/2017:08:08:36 +1300] "GET /wp-login.php HTTP/1.1" 200 4830 "http://www.attacked.wpsite.addr/" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.17"
www.attacked.wpsite.addr:443 198.71.87.205 - - [28/Dec/2017:08:08:36 +1300] "GET /wp-login.php?action=lostpassword HTTP/1.1" 200 1549 "https://www.attacked.wpsite.addr/wp-login.php" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.17"
www.attacked.wpsite.addr:80 185.86.13.213 - - [28/Dec/2017:09:16:41 +1300] "GET /wp-login.php HTTP/1.1" 302 279 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
www.attacked.wpsite.addr:443 185.86.13.213 - - [28/Dec/2017:09:16:44 +1300] "GET /wp-login.php HTTP/1.1" 200 6009 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
www.attacked.wpsite.addr:443 185.86.13.213 - - [28/Dec/2017:09:16:44 +1300] "POST /wp-login.php HTTP/1.1" 200 3722 "https://www.attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
www.attacked.wpsite.addr:443 172.18.252.242 - - [28/Dec/2017:09:41:04 +1300] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.attacked.wpsite.addr%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 3666 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"
www.attacked.wpsite.addr:443 172.18.252.242 - - [28/Dec/2017:09:41:05 +1300] "GET /wp-admin/load-styles.php?c=0&dir=ltr&load%5B%5D=dashicons,buttons,forms,l10n,login&ver=4.9.1 HTTP/1.1" 200 36906 "https://www.attacked.wpsite.addr/wp-login.php?redirect_to=https%3A%2F%2Fwww.attacked.wpsite.addr%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"
www.attacked.wpsite.addr:443 172.18.252.242 - - [28/Dec/2017:09:41:38 +1300] "POST /wp-login.php HTTP/1.1" 302 1338 "https://www.attacked.wpsite.addr/wp-login.php?redirect_to=https%3A%2F%2Fwww.attacked.wpsite.addr%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"
www.attacked.wpsite.addr:443 172.18.252.242 - - [28/Dec/2017:09:41:39 +1300] "GET /wp-admin/ HTTP/1.1" 200 17170 "https://www.attacked.wpsite.addr/wp-login.php?redirect_to=https%3A%2F%2Fwww.attacked.wpsite.addr%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"
www.attacked.wpsite.addr:443 91.200.12.22 - - [28/Dec/2017:10:09:25 +1300] "POST /wp-login.php HTTP/1.1" 200 4987 "https://attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/535.25.78 (KHTML, like Gecko) Chrome/53.7.2713.8085 Safari/531.86"
www.attacked.wpsite.addr:443 91.200.12.22 - - [28/Dec/2017:10:09:25 +1300] "POST /wp-login.php HTTP/1.1" 200 4987 "https://attacked.wpsite.addr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/536.39.82 (KHTML, like Gecko) Chrome/54.8.4130.9402 Safari/531.90"
  • This is hard to say. A naive guess would be that the attacker could want to overflow the admin mailbox to execute other actions that will not get reported ? – Xavier59 Dec 27 '17 at 23:09
  • Thanks for your thought. This doesn't fit as only 3 emails were received over the course of a few days. – davidgo Dec 27 '17 at 23:10
3

We cannot know the exact motivations but here are some possibilities:

  • The attacker is just running an automated script and initiating password resets is just one of the many things in the swiss army knife
  • The attacker is testing responses to see if the admin is watching before doing nosier attacks
  • The attacker is just being annoying
  • The attacker thinks there may be a vulnerability he can exploit in reset workflow, perhaps he think he can intercept the reset email from the server through MitM
  • The attacker thinks he can predict the reset token
  • The attacker will combine legitimate resets with a phishing attack to try to trick the admin into giving the password up to his fake reset page
1

Not sure if this is what you're seeing or not, but the password reset emails I've been getting are sent from the email address used by Wordpress, to me at the email address Wordpress has for me, but they're for a domain I've never heard of. Presumably, someone would like me to click the reset link at the bottom, which would send my reset token to their server where they can log it and then use it before it expires to take over my Wordpress admin account.

Defining WP_HOME and WP_SITEURL with your actual website URL in your wp-config.php file can prevent the spoofing (the attacker is just setting a host-header in his request to override PHP's $_SERVER['HTTP_HOST'] global variable).

To prevent the annoying email, you'd have to disable password reset functionality entirely, which may be an option for you. There's a plugin for that if you're interested.

  • plugin mentioned was last updated two years ago. Better to suggest a filter then. – rhand Mar 22 at 1:17
  • 1
    When I answered this 14 months ago, it was fairly current. That said, if the password reset code in Wordpress changes significantly, a plugin might get updated to deal with it. A snippet of PHP code on StackOverflow probably won't. Meanwhile, this is the important bit from the plugin, if having the code here instead appeals to you: function disable_password_reset() { return false; } add_filter ( 'allow_password_reset', 'disable_password_reset' ); add_filter('login_errors',create_function('$a', "return 'Operation failed!';")); – Brandon Roberson Mar 23 at 3:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.