▲
13
What should I be looking for in the logs for wp2shell?
Following on from the link earlier. We have a lot of WordPress across clients and I would rather know what the attempt looks like before patching everything in a panic.
Following on from the link earlier. We have a lot of WordPress across clients and I would rather know what the attempt looks like before patching everything in a panic.
also check for the same user agent hitting a lot of client sites at once. that is how you find out you were part of a sweep rather than the target
The uploads one caught something on a client from about a month ago, unrelated to this. Not a great morning but a useful one.
Without knowing the exact request shape yet, the generally useful things to grep for on any WordPress pre-auth issue:
POST to anything under
/wp-json/from addresses that have never done a normal GETRequests to
xmlrpc.phpthat are not the usual pingback noiseAny 200 on a path ending
.phpinsidewp-content/uploadsNew files in uploads with a php extension, if you have file integrity monitoring
The last one is the highest signal by a distance. Nothing legitimate writes a php file into uploads.