Wordpress Hack

[CAWJames]

Morning all,

 

Woke up to a shedload of .html and rogue .php files in the root of one of our wordpress sites, mostly chinese pages selling fake bags!

 

We run Sucuri and WordFence, and neither show any weaknesses, so how the poop did they manage to shove all these files into the root?

 

I am at a loss, permissions locked to user only writing for directories and files, .htaccess present and correct:

 

RewriteEngine On

RewriteBase /

RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]

RewriteRule ^(.*)$ - [F,L]

RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]

RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]

RewriteCond %{QUERY_STRING} tag\= [NC,OR]

RewriteCond %{QUERY_STRING} ftp\: [NC,OR]

RewriteCond %{QUERY_STRING} http\: [NC,OR]

RewriteCond %{QUERY_STRING} https\: [NC,OR]

RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]

RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]

RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|ê|"|;|\?|\*|=$).* [NC,OR]

RewriteCond %{QUERY_STRING} ^.*("|'|<|>|\|{||).* [NC,OR]

RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]

RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]

RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]

RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare).* [NC]

RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$

RewriteRule ^(.*)$ - [F,L]

Options All -Indexes

Order allow,deny

Deny from all

Order allow,deny

Deny from all

Order allow,deny

Deny from all

Order allow,deny

Deny from all

Order allow,deny

Deny from all

Order allow,deny

Deny from all

Order allow,deny

Deny from all

Order allow,deny

Deny from all

# BEGIN protect xmlrpc.php

order allow,deny

deny from all

# END protect xmlrpc.php

 

# BEGIN WordPress

RewriteEngine On

RewriteBase /

RewriteRule ^index\.php$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f

RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule . /index.php [L]

 

# END WordPress

 

Everything owned by apache apache

 

I assume I have a backdoor, is my only recourse to rebuild from core wordpress and import everything in from new and safe sources?

 

Any insight?

 

Thanks

 

James

[Arthur]

Were you running the latest version of WordPress and any 3rd-party themes/plugins?

 

We run Sucuri and WordFence, and neither show any weaknesses, so how the poop did they manage to shove all these files into the root?

Perhaps there are a few things you have missed? See page 35 onwards in the following presentation...

 

www-personal.umich.edu/~markmont/awp/

 

In your .htaccess file for example you don't have any 'includes' blocked.

 

https://codex.wordpress.org/Hardening_WordPress

 

# Block the include-only files.

RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [s=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]

[NokiX]

check the apache access logs as you will likely see where they got in from there. The following may be of help if your using SSH viewing the logs:

 

cat access_log | awk '{print $8}' | sort | uniq -c | sort -n | tail

cat access_log | awk '{print $2}' | sort | uniq -c | sort -n | tail - 100

 

You may need to change the print ID to match the correct field in your logs but one should output the top accessed files and the other should show the top IP's in your access logs. Should help finding the targeted files.

[difinity]

There are online Wordpress scanners, that will quickly show you any vulnerabilities.

[CAWJames]

Thanks for the replies, WP newest version, all superfluous plugins removed and remaining ones updated.

 

I have a separate .htaccess in wp-includes:

 

Order allow,deny

Deny from all

Require all denied

Allow from all

Allow from all

 

Thanks all

[CAWJames]

Morning,

 

Turns out they had turned our 404 file into a simple file uploader!!

 

Of all the things not to check!

 

Thanks for all the help

 

James

[Heisenberg]

Morning,

 

Turns out they had turned our 404 file into a simple file uploader!!

 

Of all the things not to check!

 

Thanks for all the help

 

James

 

Wow, any way around that?

 

I read through some previous comments which will help as we are moving to wordpress soon!

[Geoff]

I would suggest to start working your way through the following resources that are recommended for malware/ hacks:

 

FAQ My site was hacked « WordPress Codex

http://wordpress.org/support/topic/268083#post-1065779

How To Completely Clean Your Hacked WordPress Installation | Smackdown!

How to find a backdoor in a hacked WordPress » Otto on WordPress

 

Additional Resources:

 

http://sitecheck.sucuri.net/scanner/

Website Security Check - Unmask Parasites

http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Hardening WordPress « WordPress Codex

[CAWJames]

The ways round are to harden the site first, we think the 404 was put in before we hardened using WordFence and Sucuri

[CAWJames]

Now thats gone, a fail2ban server that bans for a year, plus OSSEC keeping an eye, and sending pertinent logs to Pushover on my phone, we are looking secure again See a Level 7 or 10 and I panic, then find its the web guy changing files!!

[Geoff]

Well it proves it works.