Log Analysis - Compromised WordPress

Scenario

One of our WordPress sites has been compromised but we're currently unsure how. The primary hypothesis is that an installed plugin was vulnerable to a remote code execution vulnerability which gave an attacker access to the underlying operating system of the server.

Challenge Questions

Identify the URI of the admin login panel that the attacker gained access to (include the token)

Because WordPress defaults to /wp-login.php or /wp-admin/ for administrative access, the web server access logs were filtered for these endpoints alongside the keyword token. Analyzing anomalous requests and filtering out benign internal traffic revealed malicious brute-force, scanning, and exploitation attempts originating from multiple external IP addresses.

• Admin Login URI: /wp-login.php?itsec-hb-token=adminlogin

• Attacker's IPs:

  • 197.23.128.35
  • 168.22.54.119
  • 119.241.22.121
  • 103.69.55.212

grep 119.241.22.121 access.log | cut -d " " -f 1-9

Figure 1: Enumeration requests by 119.241.22.121.

grep wp-login access.log | cut -d " " -f 1-9 | grep 197.23.128.35

Figure 2: Malicious filter bypass attempts from 197.23.128.35.

grep wp-login access.log | grep 168.22.54.119

Figure 3: Malicious SQL injection requests from 168.22.54.119.

Figure 4: Web shell use by 103.69.55.212.

Can you find two tools the attacker used?

Log analysis identified two automated security assessment tools based on the recorded User-Agent strings:

• sqlmap/1.4.11: An automated SQL injection and database takeover utility (observed in traffic from 168.22.54.119 shown in Figure 3).

• WPScan v3.8.10: A specialized WordPress vulnerability scanner used to enumerate plugins, themes, and users (observed in traffic from 119.241.22.121).

Figure 5: The User-Agent of WPScan v3.8.10 found in one of 119.241.22.121's requests.

The attacker tried to exploit a vulnerability in ‘Contact Form 7’. What CVE was the plugin vulnerable to?

The attacker targeted CVE-2020-35489, an unrestricted file upload vulnerability in the Contact Form 7 plugin that allows arbitrary code execution if improperly configured.

What plugin was exploited to get access?

The attacker successfully exploited the simple-file-list plugin via CVE-2020-36847. This Remote Code Execution (RCE) flaw allows unauthenticated users to upload a malicious PHP file disguised with a benign extension (such as .png) and subsequently execute an HTTP request to rename it back to .php, achieving arbitrary code execution.

What is the name of the PHP web shell file?

The uploaded web shell file was named fr34k.png and used as fr34k.php.

Figure 6: The fr34k.php web shell successfully uploaded as fr34k.png.

What was the HTTP response code provided when the web shell was accessed for the final time?

The final recorded request targeting the web shell returned an HTTP 404 Not Found status code, indicating that the backdoor had been removed.

Figure 7: Final log entry showing the server responding with a 404 status code for fr34k.php.