Found a backdoor in a popular one-click installer

Edged this to my origin team last week but they dont care so posting here. Popular WordPress one-click on Contabo and Hetzner (wont name yet, disclosing). Obfuscated base64 in wp-config.php dropper. Phones home to IP rotated through RackNerd range. Been there since at least march. I cache everything at edge so I noticed when origin had weird POST pattern. Cache hit ratio dropped 0.3% which is how I caught it. The graphs dont lie. Vendor has my report, 90 day clock running. Anyone else audit these scripts or you all just click and pray?

WARNINGS this is why you never trust one-click anything. What could go wrong:

• Remote code execution
• Credential harvesting
• Lateral movement to your database
• Supply chain poisoning of every site on shared Hostinger node
• Persistent access for months because nobody checks wp-config.php after install

I audit every installer with clamav and custom fail2ban rules before deploy. Firewalls on everything. Minimal ports. No exceptions! Have you checked if the backdoor persists through "updates" or what. The vendor probably knew. They always know. 👀

Lol I stopped using one-clicks in 2022 after some script on my GreenCloudVPS box started mining monero and I didnt notice for 3 months because the cpu was so bad anyway Now I just spin up debian minimal and do everything manual. Takes longer but at least you know whats on your box. I had a box with Contabo in 2021 and I dont remember anything special about it Good catch tho

Pro tip: always verify checksums even on "official" images. I have seen this before in Oracle Cloud free tier community where a third-party Ubuntu image had similar dropper.

Heads up for audit process:

• Download installer to isolated VM first
• Run strings and grep for base64, eval, exec
• Monitor outbound connections with tcpdump for 24hr
• Check cron jobs created during install
• Compare file hashes against known clean version

I found a clean version archived on Wayback from January. Hash mismatch with current download. The vendor probably got compromised upstream, not malicious originally. Oracle Cloud free tier images from official source only, never marketplace for production.

Has anyone contacted KnownHost about their mirrored version?

Had to grab it — the paranoia I mean not the backdoor

$12/YR ARE YOU KIDDING these one-click installers are why budget hosting exists and nobody audits because the price is too good to check I tracked the price history on this script bundle, used to be $49 now "free with any HostHatch purchase" — you get what you pay for

🏃 running to check my three Hetzner boxes now

The POST pattern you describe suggests a staged payload rather than simple beacon. If the C2 rotates through RackNerd ranges, check whether the IP assignments correlate with specific BGP communities advertised by their upstreams. Compromised hosts often get moved between prefixes to evade RPKI-based filtering. Worth checking IRR records for those ranges — if the route objects are stale or use unauthenticated maintainers, that's a separate vulnerability.

Also, "obfuscated base64 in wp-config.php" is amateur. Real supply chain attacks target the installer download itself, not the deployed config. The persistence through updates suggests either a compromised update channel or the installer writes to a location WordPress core doesn't touch during updates. Check your file integrity against a clean manual install, not just the vendor package.

I would be interested in the TTL of those DNS re