Wordpress infection

I inherited a WordPress site for a company. That company submitted adverts to Google which referenced the Website.

Infrequently, Google would reject the advert saying the Website had malicious code on it would reference URLs such as:

https://[pianistrefutationgoose.com]/sfp.js
https://[regulationprivilegescan.top]/advertisers.js
https://[coatsanguine.com]/pixel/pure

The site was submitted to various scanners but I could not find the problem.

Eventually the problem was found because the site encountered an issue and a Wordpress email described the problem.

 Since WordPress 5.2 there is a built-in feature that detects when a plugin or theme causes a fatal error on your site, and notifies you with this automated email.

In this case, WordPress caught an error with one of your plugins, Monetization Code plugin.

WordPress version 5.7.2
Current theme: H-Code Child (version 1.1)
Current plugin: Monetization Code plugin (version 1.0)
PHP version 7.3.12

An error of type E_PARSE was caused in line 89 of the file /var/www/wp-content/plugins/mplugin.php. Error message: syntax error, unexpected end of file

The last part indicated the file in question mplugin.php.

You also neeed to check the database.

https://acinonyxweb.agency/cybersecurity/your-website-is-probably-infected-without-your-knowing-it-how-to-detect-and-clean-viruses-from-wordpress/

 SELECT * FROM `wp_options` WHERE (CONVERT(`option_name` USING utf8mb4) LIKE '%ad_code%' OR CONVERT(`option_value` USING utf8mb4) LIKE '%ad_code%' OR CONVERT(`autoload` USING utf8mb4) LIKE '%ad_code%') LIMIT 50

 

The wp-content\plugins\admin_ips.txt file contains a list of administrator IPs - when the Website is called from these IPs the ad code is hidden, to stop you discovering it.

 

Surface Dock flickering monitor fix

If your Microsoft Surface Dock randomly causes the external monitors to flicker (or go black) then it is worth deleting the following registry settings:

These seem to cache monitor configuration, and once deleted, cause the problem to go away.

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Connectivity]

 [FIX] - Fix for External Display Monitors Flicker/Issues with Dock (SP4) : Surface (reddit.com)

Generate a CSR without IIS using MMC

Generate a CSR via MMC certificate snap-in using Windows (digicert.com)

 

for a wildcard certificate, set the friendly name and cn to *.mydomain.com

Windows 10 Upgrade caused inaccessible boot device

 Inserted Windows 10 USB

Used command prompt from this article

• Bootrec /fixmbr
• Bootrec /fixboot
• Bootrec /rebuildbcd

 However the last command returns:

The requested system device cannot be found.

See if a disk is MBR or GPT

First. Determine wheteher you have GPT disks or MBR disks.

GPT work on the newer UEFI mode boot in BIOS, whereas MBR disks use legacy mode.

diskpart

list disk

See if it has a * in the GPT column

https://support.novastor.com/hc/en-us/articles/360011403653-How-to-repair-the-EFI-bootloader-on-a-GPT-HDD-for-Windows-7-8-8-1-and-10

These commands succeeded.

However on booting it now complained:

Your PC/Device needs to be repaired

File: \BCD

Error code: 0xc0000098

In the BIOS turned disabled CSM Support (this supports legacy [MBR] boots).

As I had GPT disks I had to be sure I was only trying to load in UEFI mode.

Restored the EFI bootloader using this
https://support.novastor.com/hc/en-us/articles/360011403653-How-to-repair-the-EFI-bootloader-on-a-GPT-HDD-for-Windows-7-8-8-1-and-10

Panasonic camera

 To turn off the "IA" symbol being streamed on the HDMI out on the Panasonic camera, go to Setup > External Display and switch to "Off".

Using the Azure App Gateway: networking

 I had an Azure App Gateway providing a routing gateway over a backend App Service and Wordpress site.

I found two problems:

1. Outbound calls from the Azure App Service to a Webservice on the internet failed intermittently.

In the end I discovered the App needed a NAT Gateway as it was suffering SNAT exhaustion. I also improved the code to recycle client connections.

2. Accessing the Wordpress URLs would start erroring with a 502. The backend health probe would occassional complain it couldn't connect, or timed out. Performing a connection diagnostic test (trying to connect on TCP/IP showed 4 errors in 66 attempts).

Again this was a SNAT exhaustion problem. The App Gateway was in a subnet, so I associated the NAT Gateway with that subnet.

Trials of WCF clients and .NET Core 3.1

 I've spent four days debugging a simple WCF problem. We had a WCF server that we needed to connect to. That server required WSSE username/password security, as you can see from various excerpts in the WSDL:

And from a working client, I could see that a good SOAP message looked like this:

    
        
            
                2021-01-09T08:50:59.443Z
                2021-01-09T08:55:59.443Z
            
            
                MyUsername
                MyPassword
            
        
    
    
            My Body goes here
    

Initially I went on a whole route of writing code to create the necessary SOAP header.

A great article is described here:

The bugs I encountered where:

The header 'Security' from the namespace 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' was not understood by the recipient of this message, causing the message to not be processed.

In the end I discovered the simplest implementation was the correct one and no overrides were required. But a bug was still found.  I was getting the error:

The value 'TransportWithMessageCredential' is not supported in this context for the binding security property 'securityMode'.

The solution was found here:

c# - Why TransportWithMessageCredential is not supported in .net core? - Stack Overflow

Even though I created a new .NET Core 3.1 client, the default ServiceModel packages installed were version 4.4, and upgrading them to 4.8 allowed me to set BasicHttpsSecurityMode.TransportWithMessageCredential.

Final code

var endpointAddress = new EndpointAddress(uri);
var binding = new BasicHttpsBinding();
binding.Security.Mode = BasicHttpsSecurityMode.TransportWithMessageCredential;
var client = new StartSessionServiceClient(binding, endpointAddress);
client.ClientCredentials.UserName.UserName = "MyUsername";
client.ClientCredentials.UserName.Password = "MyPassword";
var response = await client.StartSessionAsync(new SessionStartArgs());

References

WCF WS-Security and WSE Nonce Authentication - Rick Strahl's Web Log (west-wind.com)