Web Hosting Talk : Web Hosting Main Forums : Running a Web Hosting Business : Phishing Hacks

[reddexuk]

Hello,

Recently files have been added to some accounts under our servers (all WordPress accounts). They all follow the same pattern, as wp-apps.php and wp-configure.php files are added which contain malicious content. I've checked the account which has been affected below and there doesn't seem to be any rogue plugin, or any plugin which is the same as in any other account which has been affected, apart from the default plugins.

Here is part of the log for last night (when the malicious files were added):

*I've starred out personal details such as the domain and username*

93.172.144.240 - - [09/Mar/2012:20:12:20 +0000] "GET /wp-apps.php?image=smiley HTTP/1.1" 200 92 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:20 +0000] "GET /wp-apps.php?image=folder HTTP/1.1" 200 90 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:19 +0000] "GET /wp-apps.php HTTP/1.1" 200 110942 "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:42 +0000] "GET /wp-apps.php?image=hidden_file HTTP/1.1" 200 93 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:42 +0000] "GET /wp-apps.php?image=file HTTP/1.1" 200 93 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:42 +0000] "GET /wp-apps.php?image=arrow HTTP/1.1" 200 70 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:42 +0000] "GET /favicon.ico HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:12:42 +0000] "GET /favicon.ico HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:13:06 +0000] "GET /wp-apps.php?dir=%2Fhome%2Fxxxxxxxx%2Fpublic_html%2Fboo1 HTTP/1.1" 200 10968 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:13:07 +0000] "GET /wp-apps.php?image=smiley HTTP/1.1" 200 92 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php?dir=%2Fhome%2Fxxxxxxxx%2Fpublic_html%2Fboo1" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:13:07 +0000] "GET /wp-apps.php?image=folder HTTP/1.1" 200 90 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php?dir=%2Fhome%2Fxxxxxxxx%2Fpublic_html%2Fboo1" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
93.172.144.240 - - [09/Mar/2012:20:13:07 +0000] "GET /wp-apps.php?image=arrow HTTP/1.1" 200 70 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php?dir=%2Fhome%2Fxxxxxxxx%2Fpublic_html%2Fboo1" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"

What seems interesting is this line:

93.172.144.240 - - [09/Mar/2012:20:13:06 +0000] "GET /wp-apps.php?dir=%2Fhome%2Fxxxxxxxx%2Fpublic_html%2Fboo1 HTTP/1.1" 200 10968 "http://www.xxxxxxxxxxxxxxx.co.uk/wp-apps.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"

It appears, if I am correct, that the hacker is trying to get into the public_html directory to upload/modify files using the wp-apps.php file?

We have fixed all the sites now within minutes of being aware that these files existed but how can we prevent this from happening in the future? It's happened on at least three occasions and that's three too many... We're using cPanel on Cent OS 5.

Really appreciate any help - thanks!

James

[zomex]

I know this is the most annoying question but do you know if all of the Wordpress/plugins/themes were up to date?

9 times out of 10 Wordpress installs being hacked is down to running old versions.

[reddexuk]

All completely up to date on that account, I've just checked.

[pmabraham]

Good day:

Make sure that http://codex.wordpress.org/Hardening_WordPress is done for each WordPress site.

Thank you.

[bullfrog]

Apart from the wordpress installation and plugins being up to date, I'll check all the theme folders for the timthumb script. This is usually named timthumb.php or thumb.php. If there's a "cache" directory within the theme folder, it's also a pretty good give away.

These outdated scripts have wreaked havoc across quite a number of sites hosted by us, before we coded a script to search for and update this little script.

Open the the timthumb script and check the versions. If memory serves, pre 1.28 were an issue, but I would be skeptic of anything lower than version 2.x.

New version can be found here: http://code.google.com/p/timthumb/

It's a bit of a shot in the dark due to the access attempts on the wp-app.php file you mentioned, but I believe it's definitely worth a look.