Cdtjkyj

I had a user on our shared host who let their Wordpress install fall victim of an exploit that allowed for arbitrary file creation as the apache user. The files generated are obviously generated with a random generator, but fall under some sort of pattern. I was also thinking about just matching the group, but a find of that nature hits too many files that are legitimate. How can I match all of these example malicious files?

8twcoasx.php

hjoeksdp.php

nzpsmujc.php

oiczdqkp.php

wpebruwi.php

wuclgsvz.php

tie9txh5.php

vza6pn12.php

nwfthzli.php

1wovcnq6.php

1fwevaol.php

zscy86d8.php

ikz45skj.php

n70x0aul.php

nwk34bs0.php

ugdnncmz.php

wdcq2zzi.php

8f4w3dmt1z.php

uqv4e2cm2a.php

55zf4u1dp7.php

szfc8v129e.php

oihfoe09fposf.php (occured more often)

Jwlsjd_baaqifg.php (occured more often)

I'll obviously be working with the user to update their Wordpress install and plugins, but I would appreciate a regex I can toss into find and quickly verify whether the issue persists afterward, etc.

Patterns I can see:

1. Always 8, 10, or 13 characters.


2. Always *.php

You'll have to determine that the "pattern" is precisely first (to create the regex). I can't see anything very clear. It always ends in .php, preceded by 8, 10, or 13 characters, which are upper- or lower-case letters, numbers, or _. Apart from that, it's unclear, e.g. there's not always a number. If you were to match this general "pattern", e.g. with ^[a-zA-Z0-9_]{8}.php$ and for 10 or 13 characters too, then you'd likely get many false positives.

Instead, are the new files created with a current modification date? If so, you could search for newer suspicious files modified after, say, your new config.

find /path/to/directory -newer /path/to/new_config -regextype egrep -regex '.*/([a-zA-Z0-9_]{8}|[a-zA-Z0-9_]{10}|([a-zA-Z0-9_]{13}).php'

One caveat is that it's possible to change the modification date using touch. If your malware does that, it might be possible to filter on access time -anewer, status-change time -cnewer, or -newerXY.

If all the files are owned by a particular user, you could also use that information to filter. i.e. add the option -user apache.