WordPress Exploit Scanner 0.1

Fabian (1 comments.) on June 26, 2008 at 7:44 pm.

Thanks! it’s a great option to review ours blogs.

Reply

BG (1 comments.) on June 26, 2008 at 9:30 pm.

Hi, Donncha

I keep getting the following error-message when doing the files only or files+database search:

Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 8662604 bytes) in /home/***/public_html/wp-content/plugins/exploit-scanner/exploit-scanner.php on line 82

The database only search is fine.

Any ideas?

Reply

Rick (1 comments.) on June 26, 2008 at 11:05 pm.

I know you say “Don’t worry if ‘/var/www/html/sandpit/wp-content/plugins/exploit-scanner/exploit-scanner.php’ is listed above. That’s a good sign because this script obviously has all the text to search for and it’s working properly!” at the end, but it is a bit weird (and frightening at first) to have it list itself!

Reply

BigDadGib (2 comments.) on June 27, 2008 at 1:34 am.

BTW…

I HAVE been hacked. It was worse than having my house robbed. I felt horrible, violated and angry. That’s why I am so happy for this plug-in.

Thanks again…
BigDadGib

Reply

Sunny (2 comments.) on June 27, 2008 at 4:05 am.

This plugin rocks, WP 2.3 version was a spammers delight and many of the residues from that version can be found in files despite upgrades. Especially if the old files/folders were overwritten and not completely removed prior to the upgrade. Thanks.

Reply

Marek on June 27, 2008 at 10:44 am.

Maybe usage of OWASP http://www.owasp.org/index.php/Main_Page would help as the prevention for every developer.

Reply

Kirby Witmer (1 comments.) on June 27, 2008 at 4:15 pm.

I keep getting this error message.
Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 22700609 bytes)

Reply

Sean (2 comments.) on June 27, 2008 at 8:08 pm.

@Donncha: Maybe someone would be willing to help you maintain a 2.0.x branch of your plugin since it will be supported until 2010?

Reply

Gamma (1 comments.) on June 28, 2008 at 3:08 am.

When I check just the database it seems to work fine. But if I check the files my Firefox 3 browser starts opening up what seems to be an endless parade of untitled tabs, requiring me to go to the task manager (Win XP)to shut it down. I’m using WP 2.5.1

Reply

mocona on June 29, 2008 at 5:34 am.

Donnacha, Great plugin!! unfortunately I get a Fatal error: Allowed memory size of …….

Could you give us a quick fix or something? I can’t find anything on line 82

And may I suggest to add (NOT MALICIOUS CODE) button at your report? of course a (DELETE THIS MALICIOUS CODE) and (BACKUP AND DELETE THIS MALICIOUS CODE) is a very welcome update.

Thanks for the plugin… great job!

Reply

Chris on June 29, 2008 at 3:27 pm.

Hi,
I’ve just downloaded and installed this plugin, from the link on this page:
http://ocaoimh.ie/exploit-scanner/

…and when I look at the dashboard on my blog, it says the MD5 is:
d41d8cd98f00b204e9800998ecf8427e

…which doesn’t match the one in the readme or on the link above. I think it should be 6a88a18a37c4add7dabd72fc97be13b6.

Am I doing something or is something amiss?

(have tried re-downloading and re-installing)

Cheers,
Chris

Reply

Chris on June 29, 2008 at 4:16 pm.

No, I’ve not edited it. Just unzipped it, ftp’d it in ASCII mode using a DOS window and that’s it.

Reply

Jedmunds on June 29, 2008 at 7:15 pm.

I am getting the following in PSpellShell.php. Does this mean I’ve been hacked? I tried replacing it with the default WordPress one, and I still get this error :

/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php
rror(“PSpell support was not found.”);

$data = shell_exec($cmd);
@unlink($this->_tmpfile);

$returnData = array();
$dataArr = preg_split(“/[\r\n]/”, $data, -1, PREG_SPLIT_NO_EMPTY);

foreach ($dataArr as $dstr) {
$matches = array();

// Skip this line.
if (strpos($dstr, “@”) ===

——————————————————————————–

throwError(“Error opening tmp file.”);

$data = shell_exec($cmd);
@unlink($this->_tmpfile);

$returnData = array();
$dataArr = preg_split(“/\n/”, $data, -1, PREG_SPLIT_NO_EMPTY);

foreach($dataArr as $dstr) {
$matches = array();

// Skip this line.
if (strpos($dstr, “@”) === 0)

Reply

Raph (1 comments.) on June 29, 2008 at 9:12 pm.

Very happy to see this! After my blog was hacked (see here: http://www.raphkoster.com/2008/04/15/more-on-the-blog-hacking/ for the gory details of all the attacks), I wrote a blog post asking for essentially this same plug-in. Here were the things I wished for:

http://www.raphkoster.com/2008/04/16/what-wordpress-needs/

* Greps every file in your public web directory, recursively, looking for “base64″ and tells you about them. The default WP install has none of these.
* Warns you on modification date of any file in the install, plus in any themes.
* Checks header and footer for unusual size changes.
* Warns you on any files added to install directories that are not something in the vanilla install — e.g., any new php files in wp-admin that aren’t part of the install.
* Warns you on any .htaccess redirects.
* Pulls out the list of administrators by querying in wp_usermeta for wp_metavalue containing %administrator% — not whatever the dashboard uses, which appears to correlate to other tables and therefore misses hacked accounts.
* Generates a table of everything in wp_options that is not a part of the vanilla WP install, so you can check it. Sure, a whole bunch of plugins will show up, but maybe you can check that manually.

Reply

Otto (15 comments.) on June 30, 2008 at 9:27 pm.

Donncha: I know that SVN uses the MD5 values internally… If that information was exposed (say, through api.wordpress), then you could get the official MD5 sums from the tags repository and compare against those directly.

Reply

Richard Catto (4 comments.) on July 4, 2008 at 7:07 am.

I think what is needed is a standalone php script to check your current WordPress core against the official released version (same version).

All code differences should be highlighted.

Reply

Otto (15 comments.) on July 10, 2008 at 7:10 pm.

Donncha: I’ve been thinking about it, and I see some problems with the MD5 concept. The problem is the CR/LF conversion is going to mess things up for you, with different hosts and such. Also, keeping big lists is a losing proposition. Why not use the MD5 idea to check if any files changed?

Here’s some sample code I threw together. It basically recursively hashes a directory of files, encrypts all the hashes with a password, and then stores them into a file. It can also read the file, repeat the process, and list any changes made. The reason for the password encryption is that if somebody has access to the file, they can just rehash unless there is something else not on the system itself to protect against that.

$hashvalue) {
if ($filehashes[$hashkey] != $hashvalue) {
echo “$hashkey has changed!\n”;
}
}
}

store_hashes(‘hashes.txt’,'/path/to/wordpress-2.5.1/’,'password’);

check_hashes(‘hashes.txt’, ‘/path/to/wordpress-2.5.1/’,'password’);

Reply

Chris (1 comments.) on July 18, 2008 at 1:39 am.

Thanks for a great security tool. Having had my site and sql database hacked I appreciate this extra level of security. I was able to run the scanner all right for the first time. But now I get the followong message : Warning: file_get_contents(/home/xxx/public_html/xxxxxx/include/l110n.php) [function.file-get-contents]: failed to open stream: Permission denied in /home/xxx/public_html/xxx/wp-content/plugins/exploit-scanner/exploit-scanner.php on line 82

Any views suggestions appreciated

Thanx

Reply

sapimoto (1 comments.) on August 22, 2008 at 3:45 am.

It’s an usefull plugins for user of wordpress, thanks for sharing…

Reply

Kei on September 29, 2008 at 12:29 pm.

Where can I find the link on 2.6.1?

I’ve uploaded and activated it but can’t find the link..

Reply

thanasis on February 4, 2009 at 11:23 pm.

hi all i found this after scaner

“style=\”visibility:hidden” => “CSS styling to hide parts of a web page”,
“ShellBOT” => “This may be a script used by hackers to get control of your server.”,
“uname -a” => “Tells a hacker what operating system your server is running”,
“shell_exec” => “Executes a server command like ls, cd, wget, etc. This may be a script used by hackers.”,
“YW55cmVzdWx0cy5uZXQ=” => “Base64 encoded text found in PHP code that redirects visitors from Google.”,
“” => “HTML code used to hide spammy links, but is also legitimate code.”,
“eval(unescape” => “Could be Javascript code used to hide code inserted by a hacker.”,
“String.fromCharCode” => “Javascript code used to hide suspicious code, but can also be legitimate code.”,
‘$_COOKIE["yahg"]‘ => “YAHG Googlerank.info exploit code. See here for further info.”

how can i fix this hacks??
thanks!!

Reply

monn (2 comments.) on May 18, 2009 at 3:06 pm.

I’m using version 0.3 and when i’m scanning with the “search files onley” ore “files and database” it redirects me to a russian site “http://gpt0. ru/default .cgi”
That site seems to be ofline, but do i have a problem???

“database onley” gives a hoorey

Could you help me?

THX!

Reply

tiara (1 comments.) on February 12, 2010 at 8:25 pm.

thanks for this plugin! I used it for all my blogs and found a few suspicious files. tsk tsk.

Reply