Malicious Redirects Through Bogus Plugin

Recently we have been seeing a rash of WordPress website compromises with attackers abusing the plugin upload functionality in the wp-admin dashboard to redirect visitors and website owners to malicious websites.

The payload is the following bogus plugin located here:

./wp-content/plugins/plugs/plugs.php

At first glance these appear to be very unorthodox domains:

hxxp://xn--o1aofd[.]xn--p1ai

hxxp://xn--80ady8a[.]xn--p1ai

hxxp://xn--80adzf[.]xn--p1ai

hxxp://xn--g1aey4a[.]xn--p1ai

hxxp://xn--g1asqf[.]xn--p1ai

hxxp://xn--i1abh6c[.]xn--p1ai

However, they are using what is known as “punycode”, where everything after the xn-- is unicode.

Continue reading Malicious Redirects Through Bogus Plugin at Sucuri Blog.