Discussion:
attack on wp-admin/install.php
Konrad Karpieszuk
2013-10-08 16:56:12 UTC
Permalink
hello

today few people reported me that instead of main page of my wordpress
site, they see installation wizard. after few minutes main website was ok,
but every subpages had error 404.

i went to dashborad > settings > permalink and refreshed structure of
permalinks. after that all website was ok.

but i see i logs that really somebody tried to get into install.php script,
even few times per second, this is apache log from begging of attack:

http://wklej.org/id/1145478/

question: how it was possible that regular visitors saw installation script
during this attack? and why affter attack permalinks was broken?

at this domain i have two sites:
dev.wpzlecenia.pl - everything is up to date
wpzlecenia.pl - two plugins are in older versions
- Google XML Sitemaps (i have 3.2.9) here is changelog
http://www.arnebrachhold.de/projects/wordpress-plugins/google-xml-sitemaps-generator/changelog/,
it looks that this plugin has no security issue in this version
- WordPress SEO by Yoast - (i have version 1.4.15) here is changelog
http://wordpress.org/plugins/wordpress-seo/changelog/ , it looks that
everything is ok in this older version



--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Mika A Epstein
2013-10-08 18:47:06 UTC
Permalink
I think causality is the other way around.

People were hitting install.php so much because the wizard was showing.
Was your SQL server glitching?
October 8, 2013 9:56 AM
hello
today few people reported me that instead of main page of my wordpress
site, they see installation wizard. after few minutes main website was ok,
but every subpages had error 404.
i went to dashborad > settings > permalink and refreshed structure of
permalinks. after that all website was ok.
but i see i logs that really somebody tried to get into install.php script,
http://wklej.org/id/1145478/
question: how it was possible that regular visitors saw installation script
during this attack? and why affter attack permalinks was broken?
dev.wpzlecenia.pl - everything is up to date
wpzlecenia.pl - two plugins are in older versions
- Google XML Sitemaps (i have 3.2.9) here is changelog
http://www.arnebrachhold.de/projects/wordpress-plugins/google-xml-sitemaps-generator/changelog/,
it looks that this plugin has no security issue in this version
- WordPress SEO by Yoast - (i have version 1.4.15) here is changelog
http://wordpress.org/plugins/wordpress-seo/changelog/ , it looks that
everything is ok in this older version
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
--
Mika A Epstein (aka Ipstenu)
http://ipstenu.org | http://halfelf.org
Konrad Karpieszuk
2013-10-09 06:39:56 UTC
Permalink
two things:

1. my website is not so popular that in one second 20 person try to connect

2. as you can see in log, /wp-admin/install.php is added not always to main
domain but sometimes to single post urls (ie

/2013/10/wdrozenie-zakupionego-szablonu-wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason


--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika A Epstein
I think causality is the other way around.
People were hitting install.php so much because the wizard was showing.
Was your SQL server glitching?
October 8, 2013 9:56 AM
hello
today few people reported me that instead of main page of my wordpress
site, they see installation wizard. after few minutes main website was ok,
but every subpages had error 404.
i went to dashborad > settings > permalink and refreshed structure of
permalinks. after that all website was ok.
but i see i logs that really somebody tried to get into install.php script,
http://wklej.org/id/1145478/
question: how it was possible that regular visitors saw installation script
during this attack? and why affter attack permalinks was broken?
dev.wpzlecenia.pl - everything is up to date
wpzlecenia.pl - two plugins are in older versions
- Google XML Sitemaps (i have 3.2.9) here is changelog
http://www.arnebrachhold.de/**projects/wordpress-plugins/**
google-xml-sitemaps-generator/**changelog/<http://www.arnebrachhold.de/projects/wordpress-plugins/google-xml-sitemaps-generator/changelog/>
,
it looks that this plugin has no security issue in this version
- WordPress SEO by Yoast - (i have version 1.4.15) here is changelog
http://wordpress.org/plugins/**wordpress-seo/changelog/<http://wordpress.org/plugins/wordpress-seo/changelog/>, it looks that
everything is ok in this older version
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
--
Mika A Epstein (aka Ipstenu)
http://ipstenu.org | http://halfelf.org
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Roger Chen
2013-10-09 06:53:45 UTC
Permalink
From the response code (302), it looks like your visitors were stuck in a
redirect loop, which is why there are so many requests to install.php
grouped together. WordPress redirects to wp-admin/install.php when it
thinks your database hasn't been setup. It will preserve the existing
request path when it performs this redirect, since it's completely possible
that somebody actually wanted to set up wordpress in a subdirectory like
'/2013/10/..../'. It looks like you just botched your database
configuration somehow.

Roger
1. my website is not so popular that in one second 20 person try to connect
2. as you can see in log, /wp-admin/install.php is added not always to main
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-zakupionego-szablonu-wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika A Epstein
I think causality is the other way around.
People were hitting install.php so much because the wizard was showing.
Was your SQL server glitching?
October 8, 2013 9:56 AM
hello
today few people reported me that instead of main page of my wordpress
site, they see installation wizard. after few minutes main website was
ok,
Post by Mika A Epstein
but every subpages had error 404.
i went to dashborad > settings > permalink and refreshed structure of
permalinks. after that all website was ok.
but i see i logs that really somebody tried to get into install.php script,
http://wklej.org/id/1145478/
question: how it was possible that regular visitors saw installation script
during this attack? and why affter attack permalinks was broken?
dev.wpzlecenia.pl - everything is up to date
wpzlecenia.pl - two plugins are in older versions
- Google XML Sitemaps (i have 3.2.9) here is changelog
http://www.arnebrachhold.de/**projects/wordpress-plugins/**
google-xml-sitemaps-generator/**changelog/<
http://www.arnebrachhold.de/projects/wordpress-plugins/google-xml-sitemaps-generator/changelog/
Post by Mika A Epstein
,
it looks that this plugin has no security issue in this version
- WordPress SEO by Yoast - (i have version 1.4.15) here is changelog
http://wordpress.org/plugins/**wordpress-seo/changelog/<
http://wordpress.org/plugins/wordpress-seo/changelog/>, it looks that
Post by Mika A Epstein
everything is ok in this older version
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Mika A Epstein
--
Mika A Epstein (aka Ipstenu)
http://ipstenu.org | http://halfelf.org
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Bryan Petty
2013-10-09 06:55:16 UTC
Permalink
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to connect
2. as you can see in log, /wp-admin/install.php is added not always to main
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-zakupionego-szablonu-wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.

Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
Konrad Karpieszuk
2013-10-09 07:35:56 UTC
Permalink
ok, one more info which i thought isn't relative to this problem, but
maybe.

three months ago somebody start this famous ddos attack to wp-login.php at
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP address,
this was not good solution

so few days ago i changed in files:
wp-login.php
wp-admin/index.php

first line from:

<?php

to

<?php if ($_COOKIE["superauth"] != "yep") exit("dostep zabroniony"); //


it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().

It looks like good solution: wordpress core isnt started at all, server is
happy.
Can it be somehow related to this attack on wp-admin/install.php? i dont
belive that this kind of change has something common with install script,
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new way to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland


--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Bryan Petty
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always to
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-zakupionego-szablonu-wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Abdussamad Abdurrazzaq
2013-10-09 07:54:56 UTC
Permalink
If you are this worried you can always delete install.php.
Post by Konrad Karpieszuk
ok, one more info which i thought isn't relative to this problem, but
maybe.
three months ago somebody start this famous ddos attack to wp-login.php at
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP address,
this was not good solution
wp-login.php
wp-admin/index.php
<?php
to
<?php if ($_COOKIE["superauth"] != "yep") exit("dostep zabroniony"); //
it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().
It looks like good solution: wordpress core isnt started at all, server is
happy.
Can it be somehow related to this attack on wp-admin/install.php? i dont
belive that this kind of change has something common with install script,
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new way to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Bryan Petty
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always to
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-zakupionego-szablonu-wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Konrad Karpieszuk
2013-10-09 09:19:55 UTC
Permalink
first of all i want to know *why*. :) i;ve got tens of wordpress sites and
i will have more. i dont want to delete install.php every time (and after
every wordpress upgrade). also maybe we have totally new way to hack
wordpress sites (as you can see it is somehow working, because intruded
broke my site)


--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski



On Wed, Oct 9, 2013 at 9:54 AM, Abdussamad Abdurrazzaq <
Post by Abdussamad Abdurrazzaq
If you are this worried you can always delete install.php.
Post by Konrad Karpieszuk
ok, one more info which i thought isn't relative to this problem, but
maybe.
three months ago somebody start this famous ddos attack to wp-login.php at
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP address,
this was not good solution
wp-login.php
wp-admin/index.php
<?php
to
<?php if ($_COOKIE["superauth"] != "yep") exit("dostep zabroniony"); //
it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().
It looks like good solution: wordpress core isnt started at all, server is
happy.
Can it be somehow related to this attack on wp-admin/install.php? i dont
belive that this kind of change has something common with install script,
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new way to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always to
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-**zakupionego-szablonu-**
wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Mika Epstein
2013-10-09 13:29:09 UTC
Permalink
Block it in your htacess first, actually. That's way easier.

Based on what info you gave us, we can't diagnosis anything. Check your SERVER logs. Did a file get edited or go missing? The problem is not that the file was being hit by millions of people, the problem is why did WP not know it was installed? Check your logs to see if anything happened to the DB. Was it unreadable? Did you add/remove a plugin recently? Did you upgrade?

Your mentioned changes to login and admin shouldn't cause anything like this, it's purely WP no longer thinking it was installed. So what have you done to diagnosis THAT? :)
Post by Konrad Karpieszuk
first of all i want to know *why*. :) i;ve got tens of wordpress sites and
i will have more. i dont want to delete install.php every time (and after
every wordpress upgrade). also maybe we have totally new way to hack
wordpress sites (as you can see it is somehow working, because intruded
broke my site)
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 9:54 AM, Abdussamad Abdurrazzaq <
Post by Abdussamad Abdurrazzaq
If you are this worried you can always delete install.php.
Post by Konrad Karpieszuk
ok, one more info which i thought isn't relative to this problem, but
maybe.
three months ago somebody start this famous ddos attack to wp-login.php at
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP address,
this was not good solution
wp-login.php
wp-admin/index.php
<?php
to
<?php if ($_COOKIE["superauth"] != "yep") exit("dostep zabroniony"); //
it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().
It looks like good solution: wordpress core isnt started at all, server is
happy.
Can it be somehow related to this attack on wp-admin/install.php? i dont
belive that this kind of change has something common with install script,
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new way to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always to
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-**zakupionego-szablonu-**
wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Konrad Karpieszuk
2013-10-09 15:49:36 UTC
Permalink
hello Mika

i dont know if i understand you. I saw you logs in first email. Also i
asked server admin if something wrong was with server in time of this
problem. He said that this was day like every other, only on my server they
saw huge amount of i/o operations, They know that from 3 months somebody
attacks my wp-login.php and it looked like next attack (but this time on
install.php)


--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika Epstein
Block it in your htacess first, actually. That's way easier.
Based on what info you gave us, we can't diagnosis anything. Check your
SERVER logs. Did a file get edited or go missing? The problem is not that
the file was being hit by millions of people, the problem is why did WP not
know it was installed? Check your logs to see if anything happened to the
DB. Was it unreadable? Did you add/remove a plugin recently? Did you
upgrade?
Your mentioned changes to login and admin shouldn't cause anything like
this, it's purely WP no longer thinking it was installed. So what have you
done to diagnosis THAT? :)
Post by Konrad Karpieszuk
first of all i want to know *why*. :) i;ve got tens of wordpress sites
and
Post by Konrad Karpieszuk
i will have more. i dont want to delete install.php every time (and after
every wordpress upgrade). also maybe we have totally new way to hack
wordpress sites (as you can see it is somehow working, because intruded
broke my site)
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 9:54 AM, Abdussamad Abdurrazzaq <
Post by Abdussamad Abdurrazzaq
If you are this worried you can always delete install.php.
Post by Konrad Karpieszuk
ok, one more info which i thought isn't relative to this problem, but
maybe.
three months ago somebody start this famous ddos attack to
wp-login.php at
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP
address,
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
this was not good solution
wp-login.php
wp-admin/index.php
<?php
to
<?php if ($_COOKIE["superauth"] != "yep") exit("dostep zabroniony"); //
it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().
It looks like good solution: wordpress core isnt started at all,
server is
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
happy.
Can it be somehow related to this attack on wp-admin/install.php? i
dont
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
belive that this kind of change has something common with install
script,
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new
way
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always
to
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-**zakupionego-szablonu-**
wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Mika A Epstein
2013-10-09 16:39:50 UTC
Permalink
It's not the next attack. It's your WP site not seeing it's installed.
This means that the DB tables weren't accessible for some reason OR the
wp-config.php was unreadable.
Post by Konrad Karpieszuk
hello Mika
i dont know if i understand you. I saw you logs in first email. Also i
asked server admin if something wrong was with server in time of this
problem. He said that this was day like every other, only on my server they
saw huge amount of i/o operations, They know that from 3 months somebody
attacks my wp-login.php and it looked like next attack (but this time on
install.php)
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika Epstein
Block it in your htacess first, actually. That's way easier.
Based on what info you gave us, we can't diagnosis anything. Check your
SERVER logs. Did a file get edited or go missing? The problem is not that
the file was being hit by millions of people, the problem is why did WP not
know it was installed? Check your logs to see if anything happened to the
DB. Was it unreadable? Did you add/remove a plugin recently? Did you
upgrade?
Your mentioned changes to login and admin shouldn't cause anything like
this, it's purely WP no longer thinking it was installed. So what have you
done to diagnosis THAT? :)
Post by Konrad Karpieszuk
first of all i want to know *why*. :) i;ve got tens of wordpress sites
and
Post by Konrad Karpieszuk
i will have more. i dont want to delete install.php every time (and after
every wordpress upgrade). also maybe we have totally new way to hack
wordpress sites (as you can see it is somehow working, because intruded
broke my site)
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 9:54 AM, Abdussamad Abdurrazzaq<
Post by Abdussamad Abdurrazzaq
If you are this worried you can always delete install.php.
ok, one more info which i thought isn't relative to this problem, but
maybe.
three months ago somebody start this famous ddos attack to
wp-login.php at
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP
address,
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
this was not good solution
wp-login.php
wp-admin/index.php
<?php
to
<?php if ($_COOKIE["superauth"] != "yep") exit("dostep
zabroniony"); //
it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().
It looks like good solution: wordpress core isnt started at all,
server is
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
happy.
Can it be somehow related to this attack on wp-admin/install.php? i
dont
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
belive that this kind of change has something common with install
script,
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new
way
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always
to
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-**zakupionego-szablonu-**
wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<
http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Konrad Karpieszuk
2013-10-09 16:58:45 UTC
Permalink
ok, but why? server admin told me (and i have to trust him) that everything
was ok with connection to DB. or even if it wasnt... why somebody tried to
connect to file /wp-admin/install.php (i still belive that this was not
accident).

what do i think.

i think that somebody in purpose made ddos attack because somehow (maybe he
tested this before) he knewed that during huge ddos attack wordpress will
'lost its mind'. during huge ddos attack server as hardware stops to play
correctly and sometimes for php command like "if
(!file_exists('wp-config.php'))" will not be able to check if file really
exists, will return true (there is now file wp-config.php) and php will
delegate chain of command to installation file. and then hacker will be
able to reinstall my wordpress with his credential



--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika A Epstein
It's not the next attack. It's your WP site not seeing it's installed.
This means that the DB tables weren't accessible for some reason OR the
wp-config.php was unreadable.
Post by Konrad Karpieszuk
hello Mika
i dont know if i understand you. I saw you logs in first email. Also i
asked server admin if something wrong was with server in time of this
problem. He said that this was day like every other, only on my server they
saw huge amount of i/o operations, They know that from 3 months somebody
attacks my wp-login.php and it looked like next attack (but this time on
install.php)
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika Epstein
Block it in your htacess first, actually. That's way easier.
Based on what info you gave us, we can't diagnosis anything. Check your
SERVER logs. Did a file get edited or go missing? The problem is not that
the file was being hit by millions of people, the problem is why did WP not
know it was installed? Check your logs to see if anything happened to the
DB. Was it unreadable? Did you add/remove a plugin recently? Did you
upgrade?
Your mentioned changes to login and admin shouldn't cause anything like
this, it's purely WP no longer thinking it was installed. So what have you
done to diagnosis THAT? :)
Post by Konrad Karpieszuk
first of all i want to know *why*. :) i;ve got tens of wordpress sites
and
Post by Konrad Karpieszuk
i will have more. i dont want to delete install.php every time (and after
every wordpress upgrade). also maybe we have totally new way to hack
wordpress sites (as you can see it is somehow working, because intruded
broke my site)
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 9:54 AM, Abdussamad Abdurrazzaq<
Post by Abdussamad Abdurrazzaq
If you are this worried you can always delete install.php.
ok, one more info which i thought isn't relative to this problem, but
maybe.
three months ago somebody start this famous ddos attack to
wp-login.php at
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
those websites. tens of times per second somebody tried to login into
dashboard using random passwords. at beginning i resolved this in .htaccess
by adding rules that nobody except from my ip address can acces to
wp-login.php. but beacouse i have cowriter without permamnent IP
address,
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
this was not good solution
wp-login.php
wp-admin/index.php
<?php
to
<?php if ($_COOKIE["superauth"] != "yep") exit("dostep zabroniony"); //
it check if we got some 'secret' cookie and if cookie is absent it
immadietly execute die().
It looks like good solution: wordpress core isnt started at all,
server is
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
happy.
Can it be somehow related to this attack on wp-admin/install.php? i
dont
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
belive that this kind of change has something common with install
script,
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
but maybe i dont know wordpress core very good. Or maybe this attacker when
saw that wp-login.php and wp-admin/index.php are secured started new
way
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
to
attack? )or he or she started this long time ago but htaccess prevented
from this)? all ip's from log are outside of Poland, but my regular
visitors are almost only from Poland
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
On Wed, Oct 9, 2013 at 12:39 AM, Konrad Karpieszuk
Post by Konrad Karpieszuk
Post by Konrad Karpieszuk
1. my website is not so popular that in one second 20 person try to
connect
Post by Konrad Karpieszuk
2. as you can see in log, /wp-admin/install.php is added not always
to
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
main
Post by Konrad Karpieszuk
domain but sometimes to single post urls (ie
/2013/10/wdrozenie-****zakupionego-szablonu-**
wordpress/wp-admin/install.php
) This is not url which somebody type in address bar without reason
It's actually fairly likely that in the event that your DB has dropped
as Mika was suggesting, that one of your plugins or server
configuration was causing a redirect loop back to install.php itself
as well.
Most hack attempts don't intentionally claim a user agent as
"Feedfetcher-Google" (which was also seeing that install.php redirect
loop).
--
Regards,
Bryan Petty
______________________________****_________________
wp-hackers mailing list
http://lists.automattic.com/****mailman/listinfo/wp-hackers<http://lists.automattic.com/**mailman/listinfo/wp-hackers>
<
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
Post by Konrad Karpieszuk
______________________________****_________________
wp-hackers mailing list
http://lists.automattic.com/****mailman/listinfo/wp-hackers<http://lists.automattic.com/**mailman/listinfo/wp-hackers>
<
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
Post by Abdussamad Abdurrazzaq
______________________________****_________________
wp-hackers mailing list
http://lists.automattic.com/****mailman/listinfo/wp-hackers<http://lists.automattic.com/**mailman/listinfo/wp-hackers>
<
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Post by Konrad Karpieszuk
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Mika A Epstein
2013-10-09 17:35:47 UTC
Permalink
People tried to access the file because WordPress defaults to that file
when it thinks it's not installed.

Does that make sense? WP couldn't tell it was installed, and thus
assumed it was NOT and people who visted wanted to install. That's the
only logical explanation for the URLs you gave us. Like ttrss pulling
the install.php? That logically happens when it's actually trying to get
a feed, but WP says "Oh hai! I'm not installed!"

This is 100% expected behavior :)

I'm very certain it's not a hack (nb I deal with hacked sites for WP at
my company every single day, it's my job, I'm pretty familiar with how
hacked WP behaves). Or rather, if it IS a hack, it's not that people are
attacking install.php, it's that they somehow made your wp-config.php go
away, or the DB tables.

Honestly though, what we need to know (and what you don't know) is what
did the install.php page say when you hit it? Did it say "no DB" or
"There's no config file..." If you go to /wp-admin/install.php now,
you'll see 'Hai! Already installed!' And I think that was NOT what
people saw. If it was? Then MAYBE you have a brute force attempt (which
is not a hack BTW). But I think not.

I don't think your server admin is wrong, but I do think that you don't
clearly understand how WP handles this sort of thing, so there's some
confusion in explanations to the admin :/
October 9, 2013 9:58 AM
ok, but why? server admin told me (and i have to trust him) that everything
was ok with connection to DB. or even if it wasnt... why somebody tried to
connect to file /wp-admin/install.php (i still belive that this was not
accident).
what do i think.
i think that somebody in purpose made ddos attack because somehow (maybe he
tested this before) he knewed that during huge ddos attack wordpress will
'lost its mind'. during huge ddos attack server as hardware stops to play
correctly and sometimes for php command like "if
(!file_exists('wp-config.php'))" will not be able to check if file really
exists, will return true (there is now file wp-config.php) and php will
delegate chain of command to installation file. and then hacker will be
able to reinstall my wordpress with his credential
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
October 9, 2013 9:39 AM
It's not the next attack. It's your WP site not seeing it's installed.
This means that the DB tables weren't accessible for some reason OR
the wp-config.php was unreadable.
October 9, 2013 6:29 AM
Block it in your htacess first, actually. That's way easier.
Based on what info you gave us, we can't diagnosis anything. Check
your SERVER logs. Did a file get edited or go missing? The problem is
not that the file was being hit by millions of people, the problem is
why did WP not know it was installed? Check your logs to see if
anything happened to the DB. Was it unreadable? Did you add/remove a
plugin recently? Did you upgrade?
Your mentioned changes to login and admin shouldn't cause anything
like this, it's purely WP no longer thinking it was installed. So what
have you done to diagnosis THAT? :)
October 8, 2013 11:47 AM
I think causality is the other way around.
People were hitting install.php so much because the wizard was
showing. Was your SQL server glitching?
--
Mika A Epstein (aka Ipstenu)
http://ipstenu.org | http://halfelf.org
Konrad Karpieszuk
2013-10-09 18:54:38 UTC
Permalink
ok, thank you for those explanations :)


--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
Post by Mika A Epstein
People tried to access the file because WordPress defaults to that file
when it thinks it's not installed.
Does that make sense? WP couldn't tell it was installed, and thus assumed
it was NOT and people who visted wanted to install. That's the only logical
explanation for the URLs you gave us. Like ttrss pulling the install.php?
That logically happens when it's actually trying to get a feed, but WP says
"Oh hai! I'm not installed!"
This is 100% expected behavior :)
I'm very certain it's not a hack (nb I deal with hacked sites for WP at my
company every single day, it's my job, I'm pretty familiar with how hacked
WP behaves). Or rather, if it IS a hack, it's not that people are attacking
install.php, it's that they somehow made your wp-config.php go away, or the
DB tables.
Honestly though, what we need to know (and what you don't know) is what
did the install.php page say when you hit it? Did it say "no DB" or
"There's no config file..." If you go to /wp-admin/install.php now, you'll
see 'Hai! Already installed!' And I think that was NOT what people saw. If
it was? Then MAYBE you have a brute force attempt (which is not a hack
BTW). But I think not.
I don't think your server admin is wrong, but I do think that you don't
clearly understand how WP handles this sort of thing, so there's some
confusion in explanations to the admin :/
October 9, 2013 9:58 AM
ok, but why? server admin told me (and i have to trust him) that everything
was ok with connection to DB. or even if it wasnt... why somebody tried to
connect to file /wp-admin/install.php (i still belive that this was not
accident).
what do i think.
i think that somebody in purpose made ddos attack because somehow (maybe he
tested this before) he knewed that during huge ddos attack wordpress will
'lost its mind'. during huge ddos attack server as hardware stops to play
correctly and sometimes for php command like "if
(!file_exists('wp-config.php')**)" will not be able to check if file
really
exists, will return true (there is now file wp-config.php) and php will
delegate chain of command to installation file. and then hacker will be
able to reinstall my wordpress with his credential
--
(en) regards / (pl) pozdrawiam
Konrad Karpieszuk
http://tradematik.pl wtyczka do WordPressa do tworzenia sklepów dla
klientów z Polski
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
October 9, 2013 9:39 AM
It's not the next attack. It's your WP site not seeing it's installed.
This means that the DB tables weren't accessible for some reason OR the
wp-config.php was unreadable.
October 9, 2013 6:29 AM
Block it in your htacess first, actually. That's way easier.
Based on what info you gave us, we can't diagnosis anything. Check your
SERVER logs. Did a file get edited or go missing? The problem is not that
the file was being hit by millions of people, the problem is why did WP not
know it was installed? Check your logs to see if anything happened to the
DB. Was it unreadable? Did you add/remove a plugin recently? Did you
upgrade?
Your mentioned changes to login and admin shouldn't cause anything like
this, it's purely WP no longer thinking it was installed. So what have you
done to diagnosis THAT? :)
October 8, 2013 11:47 AM
I think causality is the other way around.
People were hitting install.php so much because the wizard was showing.
Was your SQL server glitching?
--
Mika A Epstein (aka Ipstenu)
http://ipstenu.org | http://halfelf.org
______________________________**_________________
wp-hackers mailing list
http://lists.automattic.com/**mailman/listinfo/wp-hackers<http://lists.automattic.com/mailman/listinfo/wp-hackers>
Continue reading on narkive:
Loading...