wordpress post.php blank page: ’sploit!
July 29, 2008 on 8:38 am | In tech stoof | No Commentsin the past week or so, there have been a rash of wordpress ’sploits. i’m writing this up in the interest of saving ’sploitees some recovery time and headaches. i believe all of the exploited blogs were running downrev versions (2.6 is current as of this writing) at the time of exploit.
symptoms include:
- posts go blank or are truncated to random, short-ish lengths (4-5 sentences)
- edit.php returns a blank page on save
- post.php returns a blank page on save/publish
- preview.php returns a blank page
- plugins.php returns a blank page
- theme editor returns a blank page
in this particular sploit, the hackers were able to open a shell through PHP, and use it to find directories on the filesystem which were writable by the (unprivileged) webserver user. they uploaded a set of scripts that attempted to append each valid blog post with pharmaceutical spam, with a keyword of the hackers’ choosing. had everything worked, this would go unnoticed by end users. everything didn’t work.
to find out if this is the case for you, add the following to your wp-config.php:
define(’WP_DEBUG’,true);
if you then load your blog and get a PHP warning/notice about undefined variables, etc, it should barf out the filename of a rogue PHP script, likely to be outside the top-level directory of your blog.
to recover, one would optimally restore from a pre-hack SQL dump. if that isn’t possible or too much data would be lost, perform the following steps:
- back up your database. even if it’s hacked:
$ mysqldump –opt -Q -u user -p -h mysql.hostname dbname > wordpress-yyyymmdd.sql - upgrade to the current wordpress though as of this writing there are still upgrade issues with 2.6. 2.5.1 should suffice.
- back up the wp_options table: (wp_settings i think in earlier WP versions)
$ mysqldump –opt -Q -u user -p -h mysql.hostname dbname wp_options > wp_options.hacked.yyyymmdd.sql - copy the table dump:
$ cp wp_options.hacked.yyyymmdd.sql wp_options.fixed.yyyymmdd.sql - edit the copy in your favorite text editor. you’re looking for the line like:(103,0,’active_plugins’,'a:3:{i:0;s:23:\”../../../video/buzz.php\”;i:1;s:19:\”akismet/akismet.php\”;i:2;s:14:\”lr2Spam.03.php\”;}’,'yes’)in this case, the first entry between brackets is the rogue script. remove it:
(103,0,’active_plugins’,'a:3:{i:1;s:19:\”akismet/akismet.php\”;i:2;s:14:\”lr2Spam.03.php\”;}’,'yes’)
- import the corrected table:
$ mysql -u user -p -h mysql.hostname dbname < wp_options.fixed.yyyymmdd.sql - remove the rogue scripts and/or make them unreadable.
- test test test. removing the call to the rogue script fixed us up. i hope it fixes yours, too.
installing eprints 3.1 on fedora core 9
July 7, 2008 on 2:26 pm | In ramblings | No Commentsthis morning i started playing with eprints to evaluate how well it could get along in our shared environment, behind our load balancer. eprints tries to take over whatever hostname you give it in the apache settings, to it will require at least its own virtual host per install, and i’m not sure how its required indexing service will fare behind our load balancer.
in setting up eprints-3.1.0-rc2 on my rather vanilla fedora 9 box, i found a few steps missing from the fedora 7 documentation at wiki.eprints.org. i know, i should update the wiki page for FC9, but i don’t know them like that, and to make things worse, i’m lazy. so, here are my augmented instructions.
commands are assumed to be run as root as are the instructions on eprints’ wiki, though i did everything with sudo. the below instructions also assume that you have a mysql server installed somewhere, that you know its root password, and that said mysql-server will allow root connections from the host used for the eprints installation – if you’re doing this on a stand-alone box, localhost will do nicely. commands that didn’t need to be run on my stock fedora box are in green to denote them as optional. well, i hope they’re in green; i’m colorblind. finally, i’m installing beneath /var/www/html/eprints3 instead of the default /opt/eprints3.
- yum install gdome2 gdome2-devel (not on FC9 by default)
- yum install tetex-latex ImageMagick (already on FC9 by default)
- yum install antiword (not on FC9 by default)
- yum install xpdf (not on FC9 by default)
- yum install perl-Unicode-String perl-MIME-Lite perl-XML-LibXML perl-XML-Parser (not on FC9 by default)
- yum install perl-CPAN (not on FC9 by default!?!?!?!?)
- cpan Term::ReadKey
- Install XML::GDOME from source (not on FC9 by default)
- useradd -M -d /var/www/html/eprints3 -s /sbin/nologin eprints
- usermod -a -G eprints apache
- download and untar eprints source
- ./configure –with-smtp-server=localhost
- ./install.pl (i edited this to install in /var/www/html/eprints3 instead of /opt/eprints3)
- /var/www/html/bin/generate_apacheconf (missing from instructions)
- echo “Include /var/www/html/eprints3/cfg/apache.conf > /etc/httpd/conf.d/eprints3.conf”
- ln -s /var/www/html/eprints3/bin/epindexer /etc/init.d/epindexer
- /sbin/chkconfig –add epindexer (missing from instructions)
- /sbin/chkconfig –level 345 epindexer on (missing from instructions)
- /etc/init.d/epindexer start
- su -s /bin/sh eprints
- cd /var/www/html/eprints3
- bin/epadmin create
- /etc/init.d/httpd configtest (’cause I’m like that)
- /etc/init.d/httpd restart (if configtest returns OK)
- browse to your installation’s URL(hostname) and have fun!
Powered by WordPress with Pool theme design by Borja Fernandez.
Entries and comments feeds.
Valid XHTML and CSS. ^Top^