Overview
This Sherlock investigates a compromised WordPress site using web server logs in Splunk. The attacker enumerated the site with WPScan, brute-forced the login, edited a theme file to plant a web shell, and then ran commands through it. Each task below follows that timeline.
Task 1: Attacker IP address
I searched for wpscan to find requests carrying the tool’s signature. Every matching event came from the same source address.
Identified IP Address
Answer: 203.101.190.116
Task 2: Start of reconnaissance
When did the attacker begin reconnaissance activity?
I sorted the events from this IP and went to the last page to find the earliest one.
Task 3: Tool and version
What is the name and version of the tool used by the attacker?
Opening one of the events shows the User-Agent field, which names the tool and its version.
Identified Tooling
Answer: WPScan v3.8.25
Task 4: Brute-force duration
How many seconds did the brute-force on the login form last before the attacker obtained valid credentials?
The login form is wp-login.php, and the attacker used POST requests. A successful WordPress login answers with a 302 redirect, while a failed one returns 200 and reloads the form. I used that to label each request, then compared the first attempt with the first success:
index=* clientip=203.101.190.116 "/wp-login.php" method=POST
| eval login_type=if(status=302, "Success", "Attempt")
| stats
earliest(eval(if(login_type="Attempt", _time, null()))) as start
earliest(eval(if(login_type="Success", _time, null()))) as end
| eval duration_seconds=end-start
| convert ctime(start) ctime(end)
| table start end duration_secondsWhat the query does: 1. Filters for POST requests to wp-login.php. 2. Labels 302 responses as a success and everything else as an attempt. 3. Finds the time of the first attempt. 4. Finds the time of the first success. 5. Subtracts one from the other. 6. Shows start, end and duration in a table.
Identified Attempts
Answer: 7
Task 5: Targeted theme
The attacker edited a theme file to keep persistent access by uploading a web shell. Which WordPress theme was targeted?
Edits to theme files go through WordPress’s theme editor, so I filtered on theme-editor.php:
index=* clientip=203.101.190.116 "theme-editor.php"
Identified Modified Theme
Answer: twentytwentyfour
Task 6: First command through the web shell
When did the attacker first run a command?
The edited file is hidden-404.php, which fits a web shell: it looks like a harmless 404 template. I filtered on that file:
index=* clientip=203.101.190.116 "hidden-404.php" method=POSTThe POST requests to this file come only seconds apart. That pattern points to someone running commands one after another, not to normal visitors. The first of these requests is the first command.
Identified Webshell
Answer: 2024-08-28 04:03:51
Task 7: Web shell user agent
List the user agent used to access the web shell.
The same events from Task 6 contain the User-Agent field.
Answer: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0