root access to webserver gained through wordpress installation ?!

  • Hello,

    despite the fact that there are lots of security plugins out there I wonder if it is possible for someone to gain root access to the underlying webserver because of a “badly” installed wp system ?
    And if there is a possibility for attacers to gain root access, how to avoid ?!

    thanks!
    Thorsten

Viewing 14 replies - 1 through 14 (of 14 total)

  • Maybe there are reasons why different servers cannot take a link directly to a site in a sub-folder, but mine can…and every hacker knows WordPress is often found in “root” (which is actually quite relative rahther than absolute). So, all my sites are in sub-folders and I do not have to use any prefixes or suffixes to get to any of them. At least at BlueHost, you can put a site anywhere you wish and get to it directly with mysite.com.

    Thread Starter thorsten23

    (@thorsten23)

    What I mean was root access rights, not the root folder. The installation might be in root directory, this isn’t anything to bother.

    Ah, I see. One of the Support Techs at my host somehow recently went to one of my WordPress Dashboards by using what he called “a nifty little WordPress tool” without having login credentials. I do not know whether there is anything I could have done to block that.

    There is one plugin I occasionally use (and keep deactivated the rest of the time) that apparently has more access than I normally have since it is able to display (but not able to access) the other account folders on my shared server. My host has assured me that I have no need to be concerned about that, but you might want to watch out for plugins that might open holes to wherever such as while writing to your database at root level.

    The only other thing I know about here is that I have heard CGI can be exploited, but I do not use it (as far as I know) and I know nothing about it other than how to inadvertently open a port by making a certain error in a certain file of mine.

    Keep your .htaccess permissions as tight as possible (0400), and I have heard these can be helpful:

    # prevent view of directives
<Files .htaccess>
Order allow,deny
Deny from all
Satisfy All
</Files>

# prevent view of 403.shtml
<Files 403.shtml>
Order allow,deny
Deny from all
</Files>

    Keep your .htaccess permissions as tight as possible (0400)

    Oops, I meant to say (0404)!

    PS: From a Developer who helps me with certain things, here is something related to what I had said about that plugin I sometimes use:

    I recall there being access to others files on the shared server if you back out of your [own] directory [while using that plugin], just in case that was a point of entry I would also make sure your .htaccess file is CHMOD 400 also.

    I just talked with my host about that and was assured all accounts on my shared server have that setting at that specific level.

    Thread Starter thorsten23

    (@thorsten23)

    Yes I know about .htaccess files. But as far as I know, they only limit the access using the apache webserver. So this is usefull to prevent someone from getting access using port 80 with the webbrowser.
    But my question is: Can someone get root access rights to the whole webserver because of a “poorly” configured wordpress installation? I’d assume that thats not possible, but I’m not an expert in “hacking” and security issues … ?!

    thanks for your help!
    Thorsten

    Can someone get root access rights to the whole webserver because of a “poorly” configured wordpress installation? I’d assume that thats not possible, but I’m not an expert in “hacking” and security issues … ?!

    I think that is the kind of question that came up after I had discovered the plugin I have mentioned could see more deeply than my host had assumed I could ever see. When I first called my host and asked what all those strangely-named (other people’s accounts) folders were, the Support Tech I was talking with denied seeing them anywhere at all himself! But then over the next couple of days after I had again called to ask about those folders, I had as many as four high-level Techs at my WordPress DashBoard at one time (with my permission) taking a look at what I was able to see that had surprised them. So yes, *maybe* a highly-skilled hacker could make use of whatever a given plugin might be doing at a given WordPress installation to “look beyond” and try to go there.

    Thread Starter thorsten23

    (@thorsten23)

    can you tell me which plugin caused the trouble ?
    I thing I should try to get deeper into website security… if one wants to build (wordpress) websites, security is one of the things that are not fun, but essential anyway I think …

    can you tell me which plugin caused the trouble ?

    I will not post that here, but I might be able to do that if you can find me privately. Also, that plugin had not caused any trouble other than in the Security Department at my host after I had shown them what it could see!

    Thread Starter thorsten23

    (@thorsten23)

    please mail me @ [email protected]

    ??

    Germany arrived from https://www.ads-software.com/support/profile/leejosepho and landed on https://www.nnysandbox.net/
16 minutes ago   IP: ...

    Did I miss your ring? ??

    Thread Starter thorsten23

    (@thorsten23)

    send you an email … ??

    send you an email … ??

    Maybe you could help me here if you sent one since I am not seeing it and maybe something such as a forwarder is broken somewhere. So if you did send one, maybe tell me which address you might have used without posting the entire thing here…

    Thread Starter thorsten23

    (@thorsten23)

    good morning … ??

    I sent it to [email protected]

Viewing 14 replies - 1 through 14 (of 14 total)
  • The topic ‘root access to webserver gained through wordpress installation ?!’ is closed to new replies.