New exploit in the wild?

  • Just an hour ago, I’ve noticed four of our user’s WP accounts were hacked (suspicious activity reported by the great cxs scanner), on two different servers. All installations are v3.5.1.

    File hello.php was created in wp-content/plugins/ folder, intereseting two lines added:

    $cookey = "a303a11e6f";
preg_replace("[ redacted just to play it safe ] ... <snip> (can mail or post whole content, it basically evals anything posted).

    New user added to the WP with null username, entry in database with ID = 1001001 and null user_login. Can’t be deleted via backend, only directly thru database.

    Interesting entries in Apache log file for all sites:

    "POST /wp-login.php HTTP/1.0" 302 0 "-" "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10"
"POST /wp-admin/plugin-editor.php?file=hello.php HTTP/1.0" 200 32264 "-" "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10"
"POST /wp-admin/plugin-editor.php?file=hello.php HTTP/1.0" 302 0 "https://www.agrovit.si/wp-admin/plugin-editor.php?file=hello.php" "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/

    I don’t believe he managed to guess passwords to all four sites, something else must be up here. Any thoughts, similar experiences lately?

Viewing 7 replies - 1 through 7 (of 7 total)
Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘New exploit in the wild?’ is closed to new replies.

Tags