Categories
WordPress

WordPress Exploit Scanner 0.1

My previous post about hacked WordPress sites caused Donnacha to ask,

After your last post on this subject, I was thinking that it would be a good idea for Automattic to create a plugin that carries out all the checks you suggested people do to find out if they’ve been hacked…

At the time I wasn’t too optimistic about it but after thinking about the idea for a few days I came up with the WordPress Exploit Scanner which does most of what Donnacha wanted.

This WordPress plugin searches the files on your site for a few known strings sometimes used by hackers, and lists them with code fragments taken from the files. It also makes a few checks of the database, looking at the active_plugins blog option, the comments table, and the posts table.
It also allows the blog owner to search for whatever string they like which could come in handy when new exploit code is used in a hack.

You must be running WordPress 2.5.1 or higher to use this plugin. There’s not much point in finding exploited files if you’re running an old version of the software that can be broken into again.

Download the plugin from here: WordPress Exploit Scanner

Thanks to those who tested the plugin, especially Cathal Garvey who provided some great feedback!

By Donncha

Donncha Ó Caoimh is a software developer at Automattic and WordPress plugin developer. He posts photos at In Photos and can also be found on Google+ and Twitter.

79 replies on “WordPress Exploit Scanner 0.1”

This generic principle could be taken a step further to scan for things like obfuscated code in themes and such. Might be worth considering.

Looking for base_64_decode would come up with most of the current malware themes out there, for example. I would not extend that to plugins, because many legit plugins use this methodology to store images in the PHP file (Google XML sitemap generator, to pick an example). But a theme generally doesn’t have the complexity level to contain that sort of thing legitimately.

Otto – Among the strings included is the base64 string of (one of?) the url used in the recent Google redirect hack.

I hadn’t thought to search for base_64_decode but it’s an obvious one I’ll add for the next release!

I use wordpress blogs a lot – and I’ve had some of them hacked.

The greatest pain is having dozens of wp sites to upgrade – then next week have to upgrade all my sites again because of another and another security patch.

Thanks for the great plugin – we all need this.

Doug

Hi, Donncha

I keep getting the following error-message when doing the files only or files+database search:

Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 8662604 bytes) in /home/***/public_html/wp-content/plugins/exploit-scanner/exploit-scanner.php on line 82

The database only search is fine.

Any ideas?

Regarding the “no much point finding exploits on older versions”… i disagree. There´s several people that have a working install with previous versions, that feature unsupported plugins making it hard to upgrade or just don´t have the skills to migrate to a newer version (it´s not “that” easy, specially for 2.0.x) or an´t afford a specialist. IMHO, if a plugin for older versions is available, it could even encourage people to think about upgrading after seeing all the flaws on their install. But leaving 2.0.x, 2.1.x, 2.2.x and 2.3.x users all by themselves is kinda harsh 🙂 (specially if 2.0.x branch is supposed to be supported for several years, as i read on a blog post when 2.1 came out)

I know you say “Don’t worry if ‘/var/www/html/sandpit/wp-content/plugins/exploit-scanner/exploit-scanner.php’ is listed above. That’s a good sign because this script obviously has all the text to search for and it’s working properly!” at the end, but it is a bit weird (and frightening at first) to have it list itself!

[…] Donncha O Caoimh, uno de los más activos desarrolladores de WordPress, ha creado una extensión (todavía en fase muy temprana como indica su versión) que puede ayudarnos a detectar si nuestra instalación de WordPress ha sido infectada por algún atacante para insertar enlaces spam y temas similares… […]

BTW…

I HAVE been hacked. It was worse than having my house robbed. I felt horrible, violated and angry. That’s why I am so happy for this plug-in.

Thanks again…
BigDadGib

I’m impressed! This is a great little security utility, and will help me to check out some of the older blogs I’ve set up for people but haven’t had the time to keep under supervision as much as I’d like.

But as in all these things, the devil is in the detail. I’m running WP 2.6 B1 on my flagship blog, and of course (as warned) there are lots of hits that certainly aren’t mallicious code. What would be really useful would be a list of possible false positives, and a compilation of known nasties so that those of us who aren’t techies can either try to fix things ourselves, or call in someone who can help.

Thanks for such a useful tool!

Donncha, thank you so much, it is great to see you respond with such alacrity. This plugin will be indispensable, especially for users unable to use AIDE.

Between this, and the upcoming security improvements in 2.6, we are getting closer to point at which hackers targeting WordPress will have nowhere left to hide.

This plugin rocks, WP 2.3 version was a spammers delight and many of the residues from that version can be found in files despite upgrades. Especially if the old files/folders were overwritten and not completely removed prior to the upgrade. Thanks.

Cool plugin, however your statement “You must be running WordPress 2.5.1 or higher to use this plugin. There’s not much point in finding exploited files if you’re running an old version of the software that can be broken into again” what about the people using the stable and still supported 2.0.11 branch? They shouldn’t be left out of this plugin.

Sean – I had quite forgotten about the stable version distributed in Debian. As I said in an earlier comment, I have checksums for specific files in a specific version (2.5.1).

I couldn’t maintain multiple versions easily, but I’ll change the die() to a warning.

Sean – all things considered, I could probably do it. The 2.0 version barely changes these days so it wouldn’t be too hard to run an md5 check of the files in it and bundle it with the plugin myself.

When I check just the database it seems to work fine. But if I check the files my Firefox 3 browser starts opening up what seems to be an endless parade of untitled tabs, requiring me to go to the task manager (Win XP)to shut it down. I’m using WP 2.5.1

please vote yes in the new lisbon refernedum for your country in spring
this will allow the jedi peace to spread throughout europe
please listen to your minister gormley
he is a practising member of the church of jedi
please encourage your family to vote yes or else you will be the cubans of europe
may the force be with you

Donnacha, Great plugin!! unfortunately I get a Fatal error: Allowed memory size of …….

Could you give us a quick fix or something? I can’t find anything on line 82

And may I suggest to add (NOT MALICIOUS CODE) button at your report? of course a (DELETE THIS MALICIOUS CODE) and (BACKUP AND DELETE THIS MALICIOUS CODE) is a very welcome update.

Thanks for the plugin… great job!

BTW, just a small thing, but for the sake of clarity and because Mocona, above, got the names mixed up, and because there has been some confusion before, I’d better stress that there are too of us with similar names in this thread:

Donncha O Caoimh – well-known WordPress dude from Cork, owner of Holy Shmoly, begetter of MU, taker of photos, creator of plugins etc

Donnacha from Dublin, living in Edinburgh, WordPress neophyte and disciple

… because I definitely wouldn’t want Donncha to get the blame for my dumb-ass questions throughout the blogosphere 🙂

Hi,
I’ve just downloaded and installed this plugin, from the link on this page:
http://ocaoimh.ie/exploit-scanner/

…and when I look at the dashboard on my blog, it says the MD5 is:
d41d8cd98f00b204e9800998ecf8427e

…which doesn’t match the one in the readme or on the link above. I think it should be 6a88a18a37c4add7dabd72fc97be13b6.

Am I doing something or is something amiss?

(have tried re-downloading and re-installing)

Cheers,
Chris

Chris – that’s weird. Did you edit the file with a Windows editor or some other editor that changes file endings? I just downloaded the plugin again to verify that the md5 is ok and it matches.

No, I’ve not edited it. Just unzipped it, ftp’d it in ASCII mode using a DOS window and that’s it.

I’ve just Googled the MD5 that I posted above and got a few more hits than I was expecting!

From what I can make out, that’s the MD5 of an empty file – so presumably the MD5 check just isn’t working on my server for whatever reason.

I am getting the following in PSpellShell.php. Does this mean I’ve been hacked? I tried replacing it with the default WordPress one, and I still get this error :

/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php
rror(“PSpell support was not found.”);

$data = shell_exec($cmd);
@unlink($this->_tmpfile);

$returnData = array();
$dataArr = preg_split(“/[\r\n]/”, $data, -1, PREG_SPLIT_NO_EMPTY);

foreach ($dataArr as $dstr) {
$matches = array();

// Skip this line.
if (strpos($dstr, “@”) ===

——————————————————————————–

throwError(“Error opening tmp file.”);

$data = shell_exec($cmd);
@unlink($this->_tmpfile);

$returnData = array();
$dataArr = preg_split(“/\n/”, $data, -1, PREG_SPLIT_NO_EMPTY);

foreach($dataArr as $dstr) {
$matches = array();

// Skip this line.
if (strpos($dstr, “@”) === 0)

Very happy to see this! After my blog was hacked (see here: http://www.raphkoster.com/2008/04/15/more-on-the-blog-hacking/ for the gory details of all the attacks), I wrote a blog post asking for essentially this same plug-in. Here were the things I wished for:

http://www.raphkoster.com/2008/04/16/what-wordpress-needs/

* Greps every file in your public web directory, recursively, looking for “base64″ and tells you about them. The default WP install has none of these.
* Warns you on modification date of any file in the install, plus in any themes.
* Checks header and footer for unusual size changes.
* Warns you on any files added to install directories that are not something in the vanilla install — e.g., any new php files in wp-admin that aren’t part of the install.
* Warns you on any .htaccess redirects.
* Pulls out the list of administrators by querying in wp_usermeta for wp_metavalue containing %administrator% — not whatever the dashboard uses, which appears to correlate to other tables and therefore misses hacked accounts.
* Generates a table of everything in wp_options that is not a part of the vanilla WP install, so you can check it. Sure, a whole bunch of plugins will show up, but maybe you can check that manually.

Raph: Not true. wp-app.php as well as a lot of the wp-includes/class-*.php files make use of the base64 functions. You’d have to exclude those from your scans, or at least ignore them.

Donncha: I know that SVN uses the MD5 values internally… If that information was exposed (say, through api.wordpress), then you could get the official MD5 sums from the tags repository and compare against those directly.

Otto – I’ve been thinking about it a bit and it probably wouldn’t be too hard once I had a shell script that I could point at a directory and create a file of md5 checksums.

Shell script shouldn’t be too hard either I guess, so maybe for the next version I’ll grab the current releases – 2.0.x, 2.5.1, and whatever 2.6 beta is out and make an array of checksums..

Leave a Reply to Hackers on smack | John M. Ryan Cancel reply