Terence Eden

Whoa. I've just been hit with a nasty bit of #WordPress hacking.

A plugin which calls itself "Core Functionality" hiding in `/plugins/informative/testplugingodlike.php`

Seems to have added *thousands* of admin users to my sites.

Very odd and concerning. Not using multisite. Each has a different (normal) admin password. Some use MFA.

WTAF??

Jul 17, 2024 at 10:30pmWeb
Show threadTerence EdenJul 17, 2024

Looks like it pulls in a script from `94.156.79.8` and does a bunch of other shady shit.

I see it discussed at https://www.wordfence.com/blog/2024/06/an-inside-look-at-the-malware-and-techniques-used-in-the-wordpress-org-supply-chain-attack/

But I don't have any of those plugins.

An Inside Look at The Malware and Techniques Used in the WordPress.org Supply Chain Attack

On Monday June 24th, 2024 the Wordfence Threat Intelligence team was made aware of the presence of malware in the Social Warfare repository plugin (see post Supply Chain Attack on WordPress.org Plugins Leads to 5 Maliciously Compromised WordPress Plugins). After adding the malicious code to our Threat Intelligence Database and examining it, we quickly discovered ...Read More

Wordfence
Show threadTerence EdenJul 17, 2024

I did have PowerPress (which is mentioned at https://www.wordfence.com/blog/2024/06/3-more-plugins-infected-in-wordpress-org-supply-chain-attack-due-to-compromised-developer-passwords/)

But that was only one site.

How did it hit the others?

3 More Plugins Infected in WordPress.org Supply Chain Attack Due to Compromised Developer Passwords

Update #1: As of 12:36PM EST, another plugin has been infected. We’ve updated the list below to include this fourth plugin and the plugins team has been notified. Update #2: As of 2:20 PM EST, two more plugins appear to have malicious commits, however, the releases have not officially been made meaning no sites should ...Read More

Wordfence
Show threadTerence EdenJul 17, 2024
This #WordPress hack is also hiding as `custom-mail-smtp-checker`
Show threadTerence EdenJul 17, 2024
Urgh! And a fake `hello-world/`xg.php` which is stealing WooCommerce info.
Show threadTerence EdenJul 17, 2024

If you've been hit, a quick way to find all the compromised plugins is:

grep -r --include="*.php" "94\.156\.79" .

That should show which files to delete.

Not really how I wanted to spend my evening TBQH!

Show threadTerence EdenJul 18, 2024

This is what my #WordPress sites looked like last night.

There's no way to bulk delete this many users in the interface. I had to go into MySQL and do
`DELETE from wp_users WHERE ID > 1`
(Or whatever the highest ID is of legitimate users)

Show threadJemJul 18, 2024
@Edent you might need to run similar to cleanup any associated user metadata if you like tidy tables
Show threadKestralJul 18, 2024
@Edent oh crikey!
Show threadErnie SmithJul 18, 2024
@Edent Goddamn I’m sorry you had to deal with that
Show threadTerence EdenJul 18, 2024
@ernie made for an "exciting" midnight adventure...
Show threadGabor HejaJul 17, 2024
@Edent Thanks for the headsup and best of luck wiping this sucker as quickly as possible!
Show threadGaelan SteeleJul 17, 2024

@Edent if you were hit by one thing, there’s every chance you got hit by another attacker too - I would beware of any one heuristic and (at minimum) diff your install off a clean download of Wordpress (and the plugins you use). Also check for running processes!

I’ve cleaned up a few of these messes in my time, and they’re always nasty - good luck

Show threadmastaziJul 18, 2024
@Gaelan @Edent that's good advice, just grepping one single IP and deleting those files might not be enough.
Show threadJay HoltslanderJul 18, 2024
@Edent Situation like this I’d probably just get the Sucuri folks cleanup service to do it all for me. (Weighing Time vs money)
Show threadpopeyJul 17, 2024
@Edent Sorry to hear this news. All on the same physical host running under. the www-data user account? Once it's in on one, it's got them all.
Show threadTerence EdenJul 17, 2024

@popey All on the same host. But it is a managed service. I can only get in via SSH. So not sure how something would be able to execute a script to grab all the different DBs.

But it is late, so I'm probably missing something obvious!

Show threadlownJul 17, 2024
@Edent @popey in the Wordfence article you linked first, they talk about a script which traverses up and down the directory tree, searching for all PHP CMS installations on the same machine. Maybe it's that?
Show threadTerence EdenJul 17, 2024
@lown ah, must be. Ta!
Show threadDragonJul 18, 2024
@lown @Edent @popey Sounds like there's no isolation between sites :-/
Show threadpopeyJul 17, 2024
@Edent Perhaps they could drop a file and shell_exec() it? Running as the context of the webserver user (such as www-data) it would be able to hoover up the db connection config and spread easily, inserting itself into the other sites directly. Possibly.
Show threadTerence EdenJul 17, 2024
@popey maybe. Pretty sure that's disabled on my host. Busy firefighting now. What a PITA!!
Show threadGaelan SteeleJul 17, 2024
@Edent did your sites all run as the same (Unix-level) user? then trivial for an attack on one to modify the code for all of them.
Show threadlownJul 17, 2024
@Edent Yikes! Stuff like this stresses me out on Wordpress. It's got so many complex layers, despite the amount of good code and careful work that's gone into coding it. Huge attack surface.
Show threadRob "Flack/Commodork" O'HaraJul 23, 2024
@Edent Thanks for sharing, especially the grep lookup. I got hit with this last week too. I have ~10 domains on HostGator, all different admin and db accounts, and all were compromised. I had "Core Functionality" on one (which seemed to append code to my functions.php) and two more plugins, "informative" and "custom-mail-smtp-checker".
Show threadRob "Flack/Commodork" O'HaraJul 23, 2024
@Edent I also had 4 admin accts on all my sites -- randomly generated 8 char user accts with "example.com" email addresses. I also had a new plugin "Head, Footer, and Post Injection" (sounds bad, right?) show up on all my sites. All my stuff is up to date and patched. I did have one of the compromised plugins on one site (podpress) so maybe that was the backdoor but if so, it was a good one.
Show threadTerence EdenJul 24, 2024
@Flack
Yeah, Sounds identical. Grim.