My previous post about hacked WordPress sites caused Donnacha to ask,
After your last post on this subject, I was thinking that it would be a good idea for Automattic to create a plugin that carries out all the checks you suggested people do to find out if they’ve been hacked…
At the time I wasn’t too optimistic about it but after thinking about the idea for a few days I came up with the WordPress Exploit Scanner which does most of what Donnacha wanted.
This WordPress plugin searches the files on your site for a few known strings sometimes used by hackers, and lists them with code fragments taken from the files. It also makes a few checks of the database, looking at the active_plugins blog option, the comments table, and the posts table.
It also allows the blog owner to search for whatever string they like which could come in handy when new exploit code is used in a hack.
You must be running WordPress 2.5.1 or higher to use this plugin. There’s not much point in finding exploited files if you’re running an old version of the software that can be broken into again.
Download the plugin from here: WordPress Exploit Scanner
Thanks to those who tested the plugin, especially Cathal Garvey who provided some great feedback!
79 replies on “WordPress Exploit Scanner 0.1”
Thanks! it’s a great option to review ours blogs.
This generic principle could be taken a step further to scan for things like obfuscated code in themes and such. Might be worth considering.
Looking for base_64_decode would come up with most of the current malware themes out there, for example. I would not extend that to plugins, because many legit plugins use this methodology to store images in the PHP file (Google XML sitemap generator, to pick an example). But a theme generally doesn’t have the complexity level to contain that sort of thing legitimately.
Otto – Among the strings included is the base64 string of (one of?) the url used in the recent Google redirect hack.
I hadn’t thought to search for base_64_decode but it’s an obvious one I’ll add for the next release!
I use wordpress blogs a lot – and I’ve had some of them hacked.
The greatest pain is having dozens of wp sites to upgrade – then next week have to upgrade all my sites again because of another and another security patch.
Thanks for the great plugin – we all need this.
Doug
Hi, Donncha
I keep getting the following error-message when doing the files only or files+database search:
Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 8662604 bytes) in /home/***/public_html/wp-content/plugins/exploit-scanner/exploit-scanner.php on line 82
The database only search is fine.
Any ideas?
Regarding the “no much point finding exploits on older versions”… i disagree. There´s several people that have a working install with previous versions, that feature unsupported plugins making it hard to upgrade or just don´t have the skills to migrate to a newer version (it´s not “that” easy, specially for 2.0.x) or an´t afford a specialist. IMHO, if a plugin for older versions is available, it could even encourage people to think about upgrading after seeing all the flaws on their install. But leaving 2.0.x, 2.1.x, 2.2.x and 2.3.x users all by themselves is kinda harsh 🙂 (specially if 2.0.x branch is supposed to be supported for several years, as i read on a blog post when 2.1 came out)
I know you say “Don’t worry if ‘/var/www/html/sandpit/wp-content/plugins/exploit-scanner/exploit-scanner.php’ is listed above. That’s a good sign because this script obviously has all the text to search for and it’s working properly!” at the end, but it is a bit weird (and frightening at first) to have it list itself!
[…] Donncha O Caoimh, uno de los más activos desarrolladores de WordPress, ha creado una extensión (todavÃa en fase muy temprana como indica su versión) que puede ayudarnos a detectar si nuestra instalación de WordPress ha sido infectada por algún atacante para insertar enlaces spam y temas similares… […]
[…] WordPress Exploit Scanner 01. […]
Downloaded, uploaded, plugged it in and it works great.
I am so glad this plug-in was put together. Thank you.
BigDadGib
BTW…
I HAVE been hacked. It was worse than having my house robbed. I felt horrible, violated and angry. That’s why I am so happy for this plug-in.
Thanks again…
BigDadGib
I’m impressed! This is a great little security utility, and will help me to check out some of the older blogs I’ve set up for people but haven’t had the time to keep under supervision as much as I’d like.
But as in all these things, the devil is in the detail. I’m running WP 2.6 B1 on my flagship blog, and of course (as warned) there are lots of hits that certainly aren’t mallicious code. What would be really useful would be a list of possible false positives, and a compilation of known nasties so that those of us who aren’t techies can either try to fix things ourselves, or call in someone who can help.
Thanks for such a useful tool!
[…] Donncha’s WordPress Exploit Scanner→ […]
Donncha, thank you so much, it is great to see you respond with such alacrity. This plugin will be indispensable, especially for users unable to use AIDE.
Between this, and the upcoming security improvements in 2.6, we are getting closer to point at which hackers targeting WordPress will have nowhere left to hide.
This plugin rocks, WP 2.3 version was a spammers delight and many of the residues from that version can be found in files despite upgrades. Especially if the old files/folders were overwritten and not completely removed prior to the upgrade. Thanks.
This sounds like a great plugin!
…bit late for many WP 2.3 installs that got hit 🙁
Just seen that one of the most prominent Internet Marketers just got “hacked” as he was still using 2.3.3
http://www.marcliron.co.uk/sitebuilditreview/stu-mclarens-blog-gets-infected-by-hackers
-Marc
[…] all the talk about WordPress security vulnerabilities, every bit of protection helps. The WordPress Exploit Scanner plugin does just what it says: it looks for any suspicious behavior in your WordPress files and […]
[…] had upgraded to 2.5.1 and unfortunately can only be used for that version. Check the post about it HERE. Share and Enjoy: These icons link to social bookmarking sites where readers can share and […]
Maybe usage of OWASP http://www.owasp.org/index.php/Main_Page would help as the prevention for every developer.
[…] you’re new here, you may want to subscribe to my RSS feed. Thanks for visiting!This plugin is probably one of the most useful and valuable tools to have if your site had used WordPress 2.3 […]
I keep getting this error message.
Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 22700609 bytes)
Same fatal error for me: “Allowed memory size ..” for the file check, db-check works fine.
Kirby – the out of memory is caused by the recursive function that iterates over the filesystem. I’ll have to try and make that less memory intensive!
Cool plugin, however your statement “You must be running WordPress 2.5.1 or higher to use this plugin. There’s not much point in finding exploited files if you’re running an old version of the software that can be broken into again” what about the people using the stable and still supported 2.0.11 branch? They shouldn’t be left out of this plugin.
[…] WordPress Exploid Scanner, se encarga de revisar por nosotros los ficheros de nuestro WordPress para econtrar posibles puntos débiles por los que nos podrÃan atacar mediante un exploid a la base de datos. Posee una lista de posibles ataques que comprueba cuando lo solicitamos. [Descargar] Compártelo ← 36 plugins para Internet Explorer […]
Sean – I had quite forgotten about the stable version distributed in Debian. As I said in an earlier comment, I have checksums for specific files in a specific version (2.5.1).
I couldn’t maintain multiple versions easily, but I’ll change the die() to a warning.
@Donncha: Maybe someone would be willing to help you maintain a 2.0.x branch of your plugin since it will be supported until 2010?
Sean – all things considered, I could probably do it. The 2.0 version barely changes these days so it wouldn’t be too hard to run an md5 check of the files in it and bundle it with the plugin myself.
And also for the new 2.6 beta. This file of checksums could get quite large!
Yes … but the headache of getting hacked would be considerably larger 🙂
When I check just the database it seems to work fine. But if I check the files my Firefox 3 browser starts opening up what seems to be an endless parade of untitled tabs, requiring me to go to the task manager (Win XP)to shut it down. I’m using WP 2.5.1
please vote yes in the new lisbon refernedum for your country in spring
this will allow the jedi peace to spread throughout europe
please listen to your minister gormley
he is a practising member of the church of jedi
please encourage your family to vote yes or else you will be the cubans of europe
may the force be with you
Donnacha, Great plugin!! unfortunately I get a Fatal error: Allowed memory size of …….
Could you give us a quick fix or something? I can’t find anything on line 82
And may I suggest to add (NOT MALICIOUS CODE) button at your report? of course a (DELETE THIS MALICIOUS CODE) and (BACKUP AND DELETE THIS MALICIOUS CODE) is a very welcome update.
Thanks for the plugin… great job!
[…] dem WordPress Exploit Scanner kann man jetzt viel schneller prüfen, ob infizierte Beiträge im eigenen Blog vorhanden […]
[…] WordPress Exploit Scanner pesquisa os ficheiros do teu blog procurando código conhecido por hackers e lista fragmentos de […]
BTW, just a small thing, but for the sake of clarity and because Mocona, above, got the names mixed up, and because there has been some confusion before, I’d better stress that there are too of us with similar names in this thread:
Donncha O Caoimh – well-known WordPress dude from Cork, owner of Holy Shmoly, begetter of MU, taker of photos, creator of plugins etc
Donnacha from Dublin, living in Edinburgh, WordPress neophyte and disciple
… because I definitely wouldn’t want Donncha to get the blame for my dumb-ass questions throughout the blogosphere 🙂
Hi,
I’ve just downloaded and installed this plugin, from the link on this page:
http://ocaoimh.ie/exploit-scanner/
…and when I look at the dashboard on my blog, it says the MD5 is:
d41d8cd98f00b204e9800998ecf8427e
…which doesn’t match the one in the readme or on the link above. I think it should be 6a88a18a37c4add7dabd72fc97be13b6.
Am I doing something or is something amiss?
(have tried re-downloading and re-installing)
Cheers,
Chris
Chris – that’s weird. Did you edit the file with a Windows editor or some other editor that changes file endings? I just downloaded the plugin again to verify that the md5 is ok and it matches.
No, I’ve not edited it. Just unzipped it, ftp’d it in ASCII mode using a DOS window and that’s it.
I’ve just Googled the MD5 that I posted above and got a few more hits than I was expecting!
From what I can make out, that’s the MD5 of an empty file – so presumably the MD5 check just isn’t working on my server for whatever reason.
I am getting the following in PSpellShell.php. Does this mean I’ve been hacked? I tried replacing it with the default WordPress one, and I still get this error :
/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php
rror(“PSpell support was not found.”);
$data = shell_exec($cmd);
@unlink($this->_tmpfile);
$returnData = array();
$dataArr = preg_split(“/[\r\n]/”, $data, -1, PREG_SPLIT_NO_EMPTY);
foreach ($dataArr as $dstr) {
$matches = array();
// Skip this line.
if (strpos($dstr, “@”) ===
——————————————————————————–
throwError(“Error opening tmp file.”);
$data = shell_exec($cmd);
@unlink($this->_tmpfile);
$returnData = array();
$dataArr = preg_split(“/\n/”, $data, -1, PREG_SPLIT_NO_EMPTY);
foreach($dataArr as $dstr) {
$matches = array();
// Skip this line.
if (strpos($dstr, “@”) === 0)
[…] that was two and a half weeks ago. Times have changed. Donncha has come out with the WordPress Exploit Scanner, (currently version 0.1). It does the work for you! Download it […]
Very happy to see this! After my blog was hacked (see here: http://www.raphkoster.com/2008/04/15/more-on-the-blog-hacking/ for the gory details of all the attacks), I wrote a blog post asking for essentially this same plug-in. Here were the things I wished for:
http://www.raphkoster.com/2008/04/16/what-wordpress-needs/
* Greps every file in your public web directory, recursively, looking for “base64″ and tells you about them. The default WP install has none of these.
* Warns you on modification date of any file in the install, plus in any themes.
* Checks header and footer for unusual size changes.
* Warns you on any files added to install directories that are not something in the vanilla install — e.g., any new php files in wp-admin that aren’t part of the install.
* Warns you on any .htaccess redirects.
* Pulls out the list of administrators by querying in wp_usermeta for wp_metavalue containing %administrator% — not whatever the dashboard uses, which appears to correlate to other tables and therefore misses hacked accounts.
* Generates a table of everything in wp_options that is not a part of the vanilla WP install, so you can check it. Sure, a whole bunch of plugins will show up, but maybe you can check that manually.
[…] WordPress Exploit Scanner 0.1 This WordPress plugin searches the files on your site for a few known strings sometimes used by hackers, and lists them with code fragments taken from the files. It also makes a few checks of the database, looking at the active_plugins blog option, the comments table, and the posts table. […]
[…] ob man über ein geschütztes System verfügt. Erst gestern hat blogs-optimieren.de auf den WP Exploit Scanner verwiesen, mit dessen Hilfe es möglich ist, Schwachstellen wie zum Beispiel eingeschleusten […]
[…] übrigens diesen guten Tipp befolgt und bei Norbert denWordPress Exploit Scanner installiert. Ich bin ja mal […]
[…] sviluppatori più attivi per WordPress, l’irlandese Donncha O Caoimh, ha creato il plugin WP Exploit Scanner per aiutarci nel compito di identificare eventuali compromissioni all’interno del nostro […]
Raph: Not true. wp-app.php as well as a lot of the wp-includes/class-*.php files make use of the base64 functions. You’d have to exclude those from your scans, or at least ignore them.
Donncha: I know that SVN uses the MD5 values internally… If that information was exposed (say, through api.wordpress), then you could get the official MD5 sums from the tags repository and compare against those directly.
Otto – I’ve been thinking about it a bit and it probably wouldn’t be too hard once I had a shell script that I could point at a directory and create a file of md5 checksums.
Shell script shouldn’t be too hard either I guess, so maybe for the next version I’ll grab the current releases – 2.0.x, 2.5.1, and whatever 2.6 beta is out and make an array of checksums..