Analyze a js backdoor of WordPress

Analyze a js backdoor of WordPress

We recently found a backdoor for collecting Administrator Logon creden on many WordPress sites. The victim website is inserted with hidden code. When the Administrator logs on, the code is triggered, the Administrator's login creden are encrypted and sent to the attacker's server through GET requests. Currently, we only find the domain name "conyouse.com" collecting logon creden。 for the affected website.

Credential Leakage

Attackers insert a piece of javascript code on the WordPress login page. when a user attempts to log on to the victim website, the code will steal the user's login creden. The detailed process and analysis are as follows:

We can see that the page is inserted with a malicious js Code from "conyouse [.] com". The content of wp. js is as follows:

 

After simple obfuscation, the code is encoded into the array "_ 0xdd75 ". The following is the content of the array:

 

Replace the array in the following function with the corresponding string

The wordpress loginform contains username and password. preventDefault cancels the current logon operation and submits the logon credendefault to conyouse [.] com/scr. js through ajax, as shown in:

Request format:

1 www. conyouse [.] com/scr. js? Callback = jQuery & Data = & _ =

 

Base64 decoded plaintext is as follows:

 

All http requests:

 

Of course, users generally do not notice this. After logon, the user will jump to the background normally, but the creden have been stolen.

Conclusion

Wordpress, as the world's most popular content management and blog publishing system, has a large user base and we cannot know how many websites have suffered such attacks. Therefore, it is very important to keep the wordpress version and patch updated.