Possible Exploit - Accessing the Main Admins account through the CLI

Possible Exploit - Accessing the Main Admins account through the CLI

by Alex Legg -
Number of replies: 6

A bit of background first...

Last week, the machine hosting our Moodle Web Server crashed. Since then, we've been investigating the possible cause. We've seen spikes in the CPU, and I've noticed some odd requests to SCORM modules using API's which I know we do not use or have enabled.

Anyway, the above could all be completely unrelated to what I'm about to share with you...


Reports > Logs

Here I've discovered some very suspicious activity. 66 Password Resets from 1200 till - well, now. Resets performed by the Main Administrators account for User1 from the Origin of CLI, strange because aren't resets always made through the Web Origin?  A Spanish language pack was also updated by the Main Administrator at 0400 and this can only be done by an admin, right? I've since changed the Main Administrators password, and reset the password for User1. Obviously after finding this I went and checked back further through the logs, it happened in February as well, I'm currently downloading a full log to check for all and any other suspicious activity.


Is and if so, how is User1 gaining access to the CLI

We have SSH enabled on our server, so surely she needs this to get to the command line?

Our team noticed that in the cron.php file it states:

// This is a fake CLI script, it is a really ugly hack which emulates

// CLI via web interface, please do not use this hack elsewhere

define('CLI_SCRIPT', true);

define('WEB_CRON_EMULATED_CLI', 'defined'); // ugly ugly hack, do not use elsewhere please

define('NO_OUTPUT_BUFFERING', true);

Could the issue and the user accessing our CLI somehow relate to the above?


Is the System Compromised?

Time User full name Affected user Event context Component Event name Description Origin IP address
12 Apr, 00:15 Alex Legg User1 User: User 1 System User password updated The user with id '4606' changed the password of the user with id '571'. cli

Average of ratings: -
In reply to Alex Legg

Re: Possible Exploit - Accessing the Main Admins account through the CLI

by Ken Task -
Picture of Particularly helpful Moodlers

cli should indicate the running of a CLI script - moodlecode/admin/cli/reset_password.php but that's what you are saying right?   Who is user ID 4606?   Get user ID 4606's IP addresses used and backtrack them.

Check that script ... date and contents of the file itself.

Got ClamAV on server?   do a clamscan on code of Moodle.  That will find some code injections ... base64's.

Is webservices turned on?  Probably have that turned on for mobiles, but might consider checking into that area as well.  Smartphone and tables are capable today.

Think you might need to dig deeper info SSH access to server (which I gather is a Linux flavor, but you didn't mention OS details ... like 'flavor' and version).   Does OS have all the latest patches/updates?

If you were on a CentOS box, I'd suggest checking into the secure log.  How many persons have access to accounts on the server?   Has anyone, at any time shared their ssh login/password with another?

While you do have ssh access you've not mentioned if the server is remotely hosted somewhere or not.   The other day, I brought up a CentOS 7 virtual host on Google's cloud.   In less than 2 minutes, according to logs,  other Google VH boxen on the same class C IP block, were already poking and probing the ssh port and testing logins/passwords ... what is called 'noisy neighbor'!!!

'spirit of sharing', Ken

Average of ratings: Useful (1)
In reply to Ken Task

Re: Possible Exploit - Accessing the Main Admins account through the CLI

by Alex Legg -

Hi Ken, that’s been really helpful, thanks. 

Yeah, reset_password.php might be what’s running then? All I can see from the logs is that it’s a password reset using the cli. The user has never logged in, so I’m unable to retrieve an IP.

I’ve checked the script and it is identical with Moodle’s latest code.

I’m planning a ClamAV test run on a cloned server.

Web Services is disabled.

It’s a Linux server yes, Ubuntu 14.04.03.

SSH access – well there’s no SSH access around the time of the password updates… And the few people that have access would not share it. I'll have to look into this further because of the possibilities of it being stolen etc.

It’s a VPS that isn't for quite some time, it’s not new.

Average of ratings: -
In reply to Alex Legg

Re: Possible Exploit - Accessing the Main Admins account through the CLI

by Ken Task -
Picture of Particularly helpful Moodlers

Another thought ... when moodle is first installed, it creates two users ... user 1 is originally the guest account and user 2 is the 'admin' account.  Depending upon the age of your Moodle and if the 'torch' for admin'ing has been passed ... have you checked into that original admin account?  It's set to manual so wouldn't be changed by most other authentication methods unless some did a global thang with all accounts.  Have seen this before ... installer in a hurry and used the same password for admin user of Moodle as root user or other user that could su to root or use sudo.

The table at the bottom of your post looks 'doctored' ... am guessing to obsecure 'sensitive' info?   Did you 'doctor' Affected user?  Shows a User 1 ... which is the guest account.

Did, at any time in the history of your Moodle, or was the admin account's password lost?   There were tricks one could do in version 1.9 whereby the password for guest ... which had to have a value in the db ... could be copied and pasted into something being used to edit the record for the admin user.   Thus admin user could login with no  password.

And, got phpMyAdmin on the box? There's a backdoor ready made if not kept up to date like other software.

Got anything in front of the Moodle ... like a WordPress or Joomla that is less than secure?

'spirit of sharing', Ken

Average of ratings: Useful (1)
In reply to Ken Task

Re: Possible Exploit - Accessing the Main Admins account through the CLI

by Alex Legg -

Aha, yes sorry about that I was just obsuring user identification smile Good call though!

That vulnerability is interesting to note. We did inherit the website, much after Moodle 1.9, I'll have to look into that further.

phpMyAdmin we have yes, running on a different machine, we don't use it but it's fully updated.

WordPress we also have, but isn't connected in anyway to Moodle.

Average of ratings: -
In reply to Alex Legg

Re: Possible Exploit - Accessing the Main Admins account through the CLI

by Alex Legg -

So yesterday after hardening passwords, the password changes seem to have stopped.

Untitled Spreadsheet

Time User full name Affected user Event context Component Event name Description Origin IP address
12/04/16, 19:00 Admin User User 002 Course: Communication Skills System Course completed The user with id '16105' completed the course with id '29'. cli
12/04/16, 17:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 16:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 16:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 16:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 16:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 15:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 15:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 15:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 15:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 14:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 14:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 14:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 14:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 13:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 13:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 13:15 Admin User User 003 Course: Communication Skills System Course completed The user with id '16503' completed the course with id '29'. cli
12/04/16, 13:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 13:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 12:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 12:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 12:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 12:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 11:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 11:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 11:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 11:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 10:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 10:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 10:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 10:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 09:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 09:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 09:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 09:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 08:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 08:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 08:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 08:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 07:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 07:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 07:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 07:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 06:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 06:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 06:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 06:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 05:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 05:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 05:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 05:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 04:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 04:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 04:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 04:15 Admin User - System Language packs Language pack updated The language pack 'es_mx' was updated. cli
12/04/16, 04:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 03:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 03:30 Admin User User 004 Course: Dignity and Respect System Course completed The user with id '13226' completed the course with id '16'. cli
12/04/16, 03:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 03:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 03:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 02:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 02:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 02:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 02:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 01:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 01:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 01:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 01:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 00:45 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 00:30 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 00:15 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli
12/04/16, 00:00 Admin User User 001 User: User 001 System User password updated The user with id '4606' changed the password of the user with id '571'. cli

Average of ratings: -
In reply to Alex Legg

Re: Possible Exploit - Accessing the Main Admins account through the CLI

by Alex Legg -

The following is a report of cli activity gathered so far today.

Just noticed... The language pack gets updated at the same time.


Untitled Spreadsheet

Time User full name Affected user Event context Component Event name Description Origin IP address
13/04/16, 04:45 Admin User User 1 Course: Communication Skills System Course completed The user with id '14191' completed the course with id '29'. cli
13/04/16, 04:15 Admin User - System Language packs Language pack updated The language pack 'es_mx' was updated. cli

Average of ratings: -