How could a hacker access my Wordpress admin area?

Question

I have two sites which appear to have been hacked. I checked the access logs and found these log entries:

"GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /index.php?cperpage=1 HTTP/1.1" 301 0 "http://example.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /?cperpage=1 HTTP/1.1" 200 25328 "http://example.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /index.php?cperpage=1 HTTP/1.1" 301 0 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /?cperpage=1 HTTP/1.1" 200 25329 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /index.php?cperpage=1 HTTP/1.1" 301 0 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /?cperpage=1 HTTP/1.1" 200 25328 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-admin/theme-editor.php?file=404.php HTTP/1.1" 200 19478 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-admin/theme-editor.php HTTP/1.1" 302 0 "http://example.com/wp-admin/theme-editor.php?file=404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-admin/theme-editor.php?file=404.php&theme=sahifa&scrollto=0&updated=true HTTP/1.1" 200 19649 "http://example.com/wp-admin/theme-editor.php?file=404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-content/themes/sahifa/404.php HTTP/1.1" 200 162 "http://example.com/wp-admin/theme-editor.php?file=404.php&theme=sahifa&scrollto=0&updated=true" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/404.php HTTP/1.1" 200 162 "http://example.com/wp-content/themes/sahifa/404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"

According to these log entries, if looks like a hacker could access wp-admin/theme-editor.php in my site and modify the 404.php page of my theme to append their code as a starting point.

Using codes added to my 404.php he/she could post specific data to this page and create required files as their tools for next steps of an attack like accesson.php.

My question is, how could a hacker run code with admin privileges? Is it some sort of bug or could they access it because of malware which was running on my client when modifying my site? Or was it a misconfiguration of my website which lead to this?

Additional question: What was his/her intent to send get requests like GET /?cperpage=1? Are they just trying to detect CMS on my site or something else?

P.S. I scanned compromised 404.php file in virus total and it was identified as Generic.PHP.RansomA.8D9B55CA or CPR1E7F.Webshell by some of anti-viruses.

Updates:

I did call my site with example.com/?cperpage=1 and eventually opening my homepage after this call it leads to opening my site with admin access. I don't know how this call led to privilege escalation. I looked inside my site codes and could find below details. cperpage is used inside /wp-content/themes/sahifa/functions.php. Here is the snippet:

function _prepared_widget(){
   ....
   ....
   if(!isset($perpage)) $perpage=$_GET["cperpage"];
   ....
    if ($use_link ) {
        if($forces_more) {
            $output .= " <" . $tag . " class=\"more-link\"><a href=\"". get_permalink($post->ID) . "#more-" . $post->ID ."\" title=\"" . $mlink_title . "\">" . $more_links_text = !is_user_logged_in() && @call_user_func_array($checkwidgets,array($perpage, true)) ? $more_links_text : "" . "</a></" . $tag . ">" . "\n";
        } else {
            $output .= " <" . $tag . " class=\"more-link\"><a href=\"". get_permalink($post->ID) . "\" title=\"" . $mlink_title . "\">" . $more_links_text . "</a></" . $tag . ">" . "\n";
        }
    }
    return $output;

}
add_action("init", "_prepared_widget");

Are there any ways to workaround this vulnerability?

I'm afraid nobody can give you a definite answer. We don't have enough information to know how the attack went in detail. — deviantfan, Jul 29, 2018 at 23:30
@deviantfan I add some info at the end of my question about attack. — VSB, Jul 30, 2018 at 0:04
@VSB have you ran wpscan against your site yet? It's pretty good at finding wordpress vulns. I use it constantly — DotNetRussell, Jul 30, 2018 at 0:14
@AnthonyRussell I'm in the middle of it. But thanks for your notice. Currently I'm wondering what wrong with my theme or web-hosting service which just by passing a simple parameter hacker could access my site! — VSB, Jul 30, 2018 at 0:32
@VSB there have been known vulnerabilities with the Sahifa theme in the past. I'd start by consulting those with your accompanying logs — jonroethke, Jul 30, 2018 at 0:43

Karthik Malla · Accepted Answer · 2018-07-30 04:27:19Z

You might have downloaded the nulled theme from file sharing websites. Theme has a backdoor code that allowed attacker to access your website and modify it.

Your code clearly says its compromised, don't try to fix the code as attackers will usually have multiple backdoors and will use one at a time.

Its better to export your WordPress content in XML and then import it in a fresh new latest WordPress account with legally purchased theme. Make sure you nuke your hosting account before installing new WordPress.

Stack Exchange Network

How could a hacker access my Wordpress admin area?

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
php
wordpress
backdoor
.

Hot Network Questions

How could a hacker access my Wordpress admin area?

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged phpwordpressbackdoor.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
php
wordpress
backdoor
.